23 files changed, 230 insertions, 60 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index a84fc34c8f7..cea0cd9a316 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -245,6 +245,11 @@ config ARCH_HWEIGHT_CFLAGS
 
 config KTIME_SCALAR
         def_bool X86_32
+
+config ARCH_CPU_PROBE_RELEASE
+        def_bool y
+        depends on HOTPLUG_CPU
+
 source "init/Kconfig"
 source "kernel/Kconfig.freezer"
 
@@ -749,11 +754,11 @@ config IOMMU_API
         def_bool (AMD_IOMMU || DMAR)
 
 config MAXSMP
-        bool "Configure Maximum number of SMP Processors and NUMA Nodes"
+        bool "Enable Maximum number of SMP Processors and NUMA Nodes"
         depends on X86_64 && SMP && DEBUG_KERNEL && EXPERIMENTAL
         select CPUMASK_OFFSTACK
         ---help---
-          Configure maximum number of CPUS and NUMA Nodes for this architecture.
+          Enable maximum number of CPUS and NUMA Nodes for this architecture.
           If unsure, say N.
 
 config NR_CPUS
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index 2984a25ff38..f686f49e8b7 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -26,6 +26,7 @@ struct mm_struct;
 struct vm_area_struct;
 
 extern pgd_t swapper_pg_dir[1024];
+extern pgd_t trampoline_pg_dir[1024];
 
 static inline void pgtable_cache_init(void) { }
 static inline void check_pgt_cache(void) { }
diff --git a/arch/x86/include/asm/syscalls.h b/arch/x86/include/asm/syscalls.h
index feb2ff9bfc2..f1d8b441fc7 100644
--- a/arch/x86/include/asm/syscalls.h
+++ b/arch/x86/include/asm/syscalls.h
@@ -23,8 +23,9 @@ long sys_iopl(unsigned int, struct pt_regs *);
 /* kernel/process.c */
 int sys_fork(struct pt_regs *);
 int sys_vfork(struct pt_regs *);
-long sys_execve(const char __user *, char __user * __user *,
-                char __user * __user *, struct pt_regs *);
+long sys_execve(const char __user *,
+                const char __user *const __user *,
+                const char __user *const __user *, struct pt_regs *);
 long sys_clone(unsigned long, unsigned long, void __user *,
                void __user *, struct pt_regs *);
 
diff --git a/arch/x86/include/asm/trampoline.h b/arch/x86/include/asm/trampoline.h
index cb507bb05d7..4dde797c057 100644
--- a/arch/x86/include/asm/trampoline.h
+++ b/arch/x86/include/asm/trampoline.h
@@ -13,14 +13,17 @@ extern unsigned char *trampoline_base;
 
 extern unsigned long init_rsp;
 extern unsigned long initial_code;
+extern unsigned long initial_page_table;
 extern unsigned long initial_gs;
 
 #define TRAMPOLINE_SIZE roundup(trampoline_end - trampoline_data, PAGE_SIZE)
 
 extern unsigned long setup_trampoline(void);
+extern void __init setup_trampoline_page_table(void);
 extern void __init reserve_trampoline_memory(void);
 #else
-static inline void reserve_trampoline_memory(void) {};
+static inline void setup_trampoline_page_table(void) {}
+static inline void reserve_trampoline_memory(void) {}
 #endif /* CONFIG_X86_TRAMPOLINE */
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
index c0427295e8f..1ca132fc0d0 100644
--- a/arch/x86/include/asm/tsc.h
+++ b/arch/x86/include/asm/tsc.h
@@ -59,5 +59,7 @@ extern void check_tsc_sync_source(int cpu);
 extern void check_tsc_sync_target(void);
 
 extern int notsc_setup(char *);
+extern void save_sched_clock_state(void);
+extern void restore_sched_clock_state(void);
 
 #endif /* _ASM_X86_TSC_H */
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 4dc0084ec1b..f1efebaf551 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1728,6 +1728,8 @@ __apicdebuginit(void) print_IO_APIC(void)
                 struct irq_pin_list *entry;
 
                 cfg = desc->chip_data;
+                if (!cfg)
+                        continue;
                 entry = cfg->irq_2_pin;
                 if (!entry)
                         continue;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 60a57b13082..ba5f62f45f0 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -669,7 +669,7 @@ bool cpu_has_amd_erratum(const int *erratum)
         }
 
         /* OSVW unavailable or ID unknown, match family-model-stepping range */
-        ms = (cpu->x86_model << 8) | cpu->x86_mask;
+        ms = (cpu->x86_model << 4) | cpu->x86_mask;
         while ((range = *erratum++))
                 if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
                     (ms >= AMD_MODEL_RANGE_START(range)) &&
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 214ac860ebe..d8d86d01400 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -491,33 +491,78 @@ static void intel_pmu_enable_all(int added)
  *   Intel Errata AAP53  (model 30)
  *   Intel Errata BD53   (model 44)
  *
- * These chips need to be 'reset' when adding counters by programming
- * the magic three (non counting) events 0x4300D2, 0x4300B1 and 0x4300B5
- * either in sequence on the same PMC or on different PMCs.
+ * The official story:
+ *   These chips need to be 'reset' when adding counters by programming the
+ *   magic three (non-counting) events 0x4300B5, 0x4300D2, and 0x4300B1 either
+ *   in sequence on the same PMC or on different PMCs.
+ *
+ * In practise it appears some of these events do in fact count, and
+ * we need to programm all 4 events.
  */
-static void intel_pmu_nhm_enable_all(int added)
+static void intel_pmu_nhm_workaround(void)
 {
-        if (added) {
-                struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
-                int i;
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        static const unsigned long nhm_magic[4] = {
+                0x4300B5,
+                0x4300D2,
+                0x4300B1,
+                0x4300B1
+        };
+        struct perf_event *event;
+        int i;
+
+        /*
+         * The Errata requires below steps:
+         * 1) Clear MSR_IA32_PEBS_ENABLE and MSR_CORE_PERF_GLOBAL_CTRL;
+         * 2) Configure 4 PERFEVTSELx with the magic events and clear
+         *    the corresponding PMCx;
+         * 3) set bit0~bit3 of MSR_CORE_PERF_GLOBAL_CTRL;
+         * 4) Clear MSR_CORE_PERF_GLOBAL_CTRL;
+         * 5) Clear 4 pairs of ERFEVTSELx and PMCx;
+         */
+
+        /*
+         * The real steps we choose are a little different from above.
+         * A) To reduce MSR operations, we don't run step 1) as they
+         *    are already cleared before this function is called;
+         * B) Call x86_perf_event_update to save PMCx before configuring
+         *    PERFEVTSELx with magic number;
+         * C) With step 5), we do clear only when the PERFEVTSELx is
+         *    not used currently.
+         * D) Call x86_perf_event_set_period to restore PMCx;
+         */
 
-                wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + 0, 0x4300D2);
-                wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + 1, 0x4300B1);
-                wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + 2, 0x4300B5);
+        /* We always operate 4 pairs of PERF Counters */
+        for (i = 0; i < 4; i++) {
+                event = cpuc->events[i];
+                if (event)
+                        x86_perf_event_update(event);
+        }
 
-                wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x3);
-                wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x0);
+        for (i = 0; i < 4; i++) {
+                wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + i, nhm_magic[i]);
+                wrmsrl(MSR_ARCH_PERFMON_PERFCTR0 + i, 0x0);
+        }
 
-                for (i = 0; i < 3; i++) {
-                        struct perf_event *event = cpuc->events[i];
+        wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0xf);
+        wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x0);
 
-                        if (!event)
-                                continue;
+        for (i = 0; i < 4; i++) {
+                event = cpuc->events[i];
 
+                if (event) {
+                        x86_perf_event_set_period(event);
                         __x86_pmu_enable_event(&event->hw,
-                                               ARCH_PERFMON_EVENTSEL_ENABLE);
-                }
+                                        ARCH_PERFMON_EVENTSEL_ENABLE);
+                } else
+                        wrmsrl(MSR_ARCH_PERFMON_EVENTSEL0 + i, 0x0);
         }
+}
+
+static void intel_pmu_nhm_enable_all(int added)
+{
+        if (added)
+                intel_pmu_nhm_workaround();
         intel_pmu_enable_all(added);
 }
 
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index febb12cea79..7e578e9cc58 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -497,6 +497,8 @@ static int p4_hw_config(struct perf_event *event)
                 event->hw.config |= event->attr.config &
                         (p4_config_pack_escr(P4_ESCR_MASK_HT) |
                          p4_config_pack_cccr(P4_CCCR_MASK_HT | P4_CCCR_RESERVED));
+
+                event->hw.config &= ~P4_CCCR_FORCE_OVF;
         }
 
         rc = x86_setup_perfctr(event);
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index ff4c453e13f..fa8c1b8e09f 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -334,7 +334,7 @@ ENTRY(startup_32_smp)
 /*
  * Enable paging
  */
-        movl $pa(swapper_pg_dir),%eax
+        movl pa(initial_page_table), %eax
         movl %eax,%cr3          /* set the page table pointer.. */
         movl %cr0,%eax
         orl  $X86_CR0_PG,%eax
@@ -614,6 +614,8 @@ ignore_int:
 .align 4
 ENTRY(initial_code)
         .long i386_start_kernel
+ENTRY(initial_page_table)
+        .long pa(swapper_pg_dir)
 
 /*
  * BSS section
@@ -629,6 +631,10 @@ ENTRY(swapper_pg_dir)
 #endif
 swapper_pg_fixmap:
         .fill 1024,4,0
+#ifdef CONFIG_X86_TRAMPOLINE
+ENTRY(trampoline_pg_dir)
+        .fill 1024,4,0
+#endif
 ENTRY(empty_zero_page)
         .fill 4096,1,0
 
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 1f11f5ce668..a46cb3522c0 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -40,6 +40,7 @@
 
 static unsigned int             mxcsr_feature_mask __read_mostly = 0xffffffffu;
 unsigned int xstate_size;
+EXPORT_SYMBOL_GPL(xstate_size);
 unsigned int sig_xstate_ia32_size = sizeof(struct _fpstate_ia32);
 static struct i387_fxsave_struct fx_scratch __cpuinitdata;
 
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index ef10940e1af..852b81967a3 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -194,7 +194,7 @@ static struct hw_breakpoint {
         unsigned long           addr;
         int                     len;
         int                     type;
-        struct perf_event       **pev;
+        struct perf_event       * __percpu *pev;
 } breakinfo[HBP_NUM];
 
 static unsigned long early_dr7;
diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
index 1bfb6cf4dd5..770ebfb349e 100644
--- a/arch/x86/kernel/kprobes.c
+++ b/arch/x86/kernel/kprobes.c
@@ -709,6 +709,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         struct hlist_node *node, *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
+        kprobe_opcode_t *correct_ret_addr = NULL;
 
         INIT_HLIST_HEAD(&empty_rp);
         kretprobe_hash_lock(current, &head, &flags);
@@ -740,14 +741,34 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
                         /* another task is sharing our hash bucket */
                         continue;
 
+                orig_ret_address = (unsigned long)ri->ret_addr;
+
+                if (orig_ret_address != trampoline_address)
+                        /*
+                         * This is the real return address. Any other
+                         * instances associated with this task are for
+                         * other calls deeper on the call stack
+                         */
+                        break;
+        }
+
+        kretprobe_assert(ri, orig_ret_address, trampoline_address);
+
+        correct_ret_addr = ri->ret_addr;
+        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+                if (ri->task != current)
+                        /* another task is sharing our hash bucket */
+                        continue;
+
+                orig_ret_address = (unsigned long)ri->ret_addr;
                 if (ri->rp && ri->rp->handler) {
                         __get_cpu_var(current_kprobe) = &ri->rp->kp;
                         get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
+                        ri->ret_addr = correct_ret_addr;
                         ri->rp->handler(ri, regs);
                         __get_cpu_var(current_kprobe) = NULL;
                 }
 
-                orig_ret_address = (unsigned long)ri->ret_addr;
                 recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
@@ -759,8 +780,6 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
                         break;
         }
 
-        kretprobe_assert(ri, orig_ret_address, trampoline_address);
-
         kretprobe_hash_unlock(current, &flags);
 
         hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 64ecaf0af9a..57d1868a86a 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -301,8 +301,9 @@ EXPORT_SYMBOL(kernel_thread);
 /*
  * sys_execve() executes a new program.
  */
-long sys_execve(const char __user *name, char __user * __user *argv,
-                char __user * __user *envp, struct pt_regs *regs)
+long sys_execve(const char __user *name,
+                const char __user *const __user *argv,
+                const char __user *const __user *envp, struct pt_regs *regs)
 {
         long error;
         char *filename;
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index b008e788320..c3a4fbb2b99 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1014,6 +1014,8 @@ void __init setup_arch(char **cmdline_p)
         paging_init();
         x86_init.paging.pagetable_setup_done(swapper_pg_dir);
 
+        setup_trampoline_page_table();
+
         tboot_probe();
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index a5e928b0cb5..8b3bfc4dd70 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -73,7 +73,6 @@
 
 #ifdef CONFIG_X86_32
 u8 apicid_2_node[MAX_APICID];
-static int low_mappings;
 #endif
 
 /* State of each CPU */
@@ -91,6 +90,25 @@ DEFINE_PER_CPU(int, cpu_state) = { 0 };
 static DEFINE_PER_CPU(struct task_struct *, idle_thread_array);
 #define get_idle_for_cpu(x)      (per_cpu(idle_thread_array, x))
 #define set_idle_for_cpu(x, p)   (per_cpu(idle_thread_array, x) = (p))
+
+/*
+ * We need this for trampoline_base protection from concurrent accesses when
+ * off- and onlining cores wildly.
+ */
+static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
+
+void cpu_hotplug_driver_lock()
+{
+        mutex_lock(&x86_cpu_hotplug_driver_mutex);
+}
+
+void cpu_hotplug_driver_unlock()
+{
+        mutex_unlock(&x86_cpu_hotplug_driver_mutex);
+}
+
+ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
+ssize_t arch_cpu_release(const char *buf, size_t count) { return -1; }
 #else
 static struct task_struct *idle_thread_array[NR_CPUS] __cpuinitdata ;
 #define get_idle_for_cpu(x)      (idle_thread_array[(x)])
@@ -281,6 +299,18 @@ notrace static void __cpuinit start_secondary(void *unused)
          * fragile that we want to limit the things done here to the
          * most necessary things.
          */
+
+#ifdef CONFIG_X86_32
+        /*
+         * Switch away from the trampoline page-table
+         *
+         * Do this before cpu_init() because it needs to access per-cpu
+         * data which may not be mapped in the trampoline page-table.
+         */
+        load_cr3(swapper_pg_dir);
+        __flush_tlb_all();
+#endif
+
         vmi_bringup();
         cpu_init();
         preempt_disable();
@@ -299,12 +329,6 @@ notrace static void __cpuinit start_secondary(void *unused)
                 legacy_pic->chip->unmask(0);
         }
 
-#ifdef CONFIG_X86_32
-        while (low_mappings)
-                cpu_relax();
-        __flush_tlb_all();
-#endif
-
         /* This must be done before setting cpu_online_mask */
         set_cpu_sibling_map(raw_smp_processor_id());
         wmb();
@@ -750,6 +774,7 @@ do_rest:
 #ifdef CONFIG_X86_32
         /* Stack for startup_32 can be just as for start_secondary onwards */
         irq_ctx_init(cpu);
+        initial_page_table = __pa(&trampoline_pg_dir);
 #else
         clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
         initial_gs = per_cpu_offset(cpu);
@@ -897,20 +922,8 @@ int __cpuinit native_cpu_up(unsigned int cpu)
 
         per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
 
-#ifdef CONFIG_X86_32
-        /* init low mem mapping */
-        clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-                min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-        flush_tlb_all();
-        low_mappings = 1;
-
         err = do_boot_cpu(apicid, cpu);
 
-        zap_low_mappings(false);
-        low_mappings = 0;
-#else
-        err = do_boot_cpu(apicid, cpu);
-#endif
         if (err) {
                 pr_debug("do_boot_cpu failed %d\n", err);
                 return -EIO;
diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
index 196552bb412..d5e06624e34 100644
--- a/arch/x86/kernel/sys_i386_32.c
+++ b/arch/x86/kernel/sys_i386_32.c
@@ -28,7 +28,9 @@
  * Do a system call from kernel instead of calling sys_execve so we
  * end up with proper pt_regs.
  */
-int kernel_execve(const char *filename, char *const argv[], char *const envp[])
+int kernel_execve(const char *filename,
+                  const char *const argv[],
+                  const char *const envp[])
 {
         long __res;
         asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
diff --git a/arch/x86/kernel/trampoline.c b/arch/x86/kernel/trampoline.c
index c652ef62742..a874495b367 100644
--- a/arch/x86/kernel/trampoline.c
+++ b/arch/x86/kernel/trampoline.c
@@ -1,6 +1,7 @@
 #include <linux/io.h>
 
 #include <asm/trampoline.h>
+#include <asm/pgtable.h>
 #include <asm/e820.h>
 
 #if defined(CONFIG_X86_64) && defined(CONFIG_ACPI_SLEEP)
@@ -37,3 +38,20 @@ unsigned long __trampinit setup_trampoline(void)
         memcpy(trampoline_base, trampoline_data, TRAMPOLINE_SIZE);
         return virt_to_phys(trampoline_base);
 }
+
+void __init setup_trampoline_page_table(void)
+{
+#ifdef CONFIG_X86_32
+        /* Copy kernel address range */
+        clone_pgd_range(trampoline_pg_dir + KERNEL_PGD_BOUNDARY,
+                        swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+                        min_t(unsigned long, KERNEL_PGD_PTRS,
+                              KERNEL_PGD_BOUNDARY));
+
+        /* Initialize low mappings */
+        clone_pgd_range(trampoline_pg_dir,
+                        swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+                        min_t(unsigned long, KERNEL_PGD_PTRS,
+                              KERNEL_PGD_BOUNDARY));
+#endif
+}
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index ce8e5023933..d632934cb63 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -626,6 +626,44 @@ static void set_cyc2ns_scale(unsigned long cpu_khz, int cpu)
         local_irq_restore(flags);
 }
 
+static unsigned long long cyc2ns_suspend;
+
+void save_sched_clock_state(void)
+{
+        if (!sched_clock_stable)
+                return;
+
+        cyc2ns_suspend = sched_clock();
+}
+
+/*
+ * Even on processors with invariant TSC, TSC gets reset in some the
+ * ACPI system sleep states. And in some systems BIOS seem to reinit TSC to
+ * arbitrary value (still sync'd across cpu's) during resume from such sleep
+ * states. To cope up with this, recompute the cyc2ns_offset for each cpu so
+ * that sched_clock() continues from the point where it was left off during
+ * suspend.
+ */
+void restore_sched_clock_state(void)
+{
+        unsigned long long offset;
+        unsigned long flags;
+        int cpu;
+
+        if (!sched_clock_stable)
+                return;
+
+        local_irq_save(flags);
+
+        get_cpu_var(cyc2ns_offset) = 0;
+        offset = cyc2ns_suspend - sched_clock();
+
+        for_each_possible_cpu(cpu)
+                per_cpu(cyc2ns_offset, cpu) = offset;
+
+        local_irq_restore(flags);
+}
+
 #ifdef CONFIG_CPU_FREQ
 
 /* Frequency scaling support. Adjust the TSC based timer when the cpu frequency
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 0fd6378981f..ddeb2314b52 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -697,6 +697,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
         pit->wq = create_singlethread_workqueue("kvm-pit-wq");
         if (!pit->wq) {
                 mutex_unlock(&pit->pit_state.lock);
+                kvm_free_irq_source_id(kvm, pit->irq_source_id);
                 kfree(pit);
                 return NULL;
         }
@@ -742,7 +743,7 @@ fail:
         kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
         kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier);
         kvm_free_irq_source_id(kvm, pit->irq_source_id);
-
+        destroy_workqueue(pit->wq);
         kfree(pit);
         return NULL;
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 25f19078b32..3a09c625d52 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2387,7 +2387,7 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
         if (cpu_has_xsave)
                 memcpy(guest_xsave->region,
                         &vcpu->arch.guest_fpu.state->xsave,
-                        sizeof(struct xsave_struct));
+                        xstate_size);
         else {
                 memcpy(guest_xsave->region,
                         &vcpu->arch.guest_fpu.state->fxsave,
@@ -2405,7 +2405,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
 
         if (cpu_has_xsave)
                 memcpy(&vcpu->arch.guest_fpu.state->xsave,
-                        guest_xsave->region, sizeof(struct xsave_struct));
+                        guest_xsave->region, xstate_size);
         else {
                 if (xstate_bv & ~XSTATE_FPSSE)
                         return -EINVAL;
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index e7e8c5f5495..87bb35e34ef 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -113,6 +113,7 @@ static void __save_processor_state(struct saved_context *ctxt)
 void save_processor_state(void)
 {
         __save_processor_state(&saved_context);
+        save_sched_clock_state();
 }
 #ifdef CONFIG_X86_32
 EXPORT_SYMBOL(save_processor_state);
@@ -229,6 +230,7 @@ static void __restore_processor_state(struct saved_context *ctxt)
 void restore_processor_state(void)
 {
         __restore_processor_state(&saved_context);
+        restore_sched_clock_state();
 }
 #ifdef CONFIG_X86_32
 EXPORT_SYMBOL(restore_processor_state);
diff --git a/arch/x86/xen/platform-pci-unplug.c b/arch/x86/xen/platform-pci-unplug.c
index 554c002a1e1..0f456386cce 100644
--- a/arch/x86/xen/platform-pci-unplug.c
+++ b/arch/x86/xen/platform-pci-unplug.c
@@ -72,13 +72,17 @@ void __init xen_unplug_emulated_devices(void)
 {
         int r;
 
+        /* user explicitly requested no unplug */
+        if (xen_emul_unplug & XEN_UNPLUG_NEVER)
+                return;
         /* check the version of the xen platform PCI device */
         r = check_platform_magic();
         /* If the version matches enable the Xen platform PCI driver.
-         * Also enable the Xen platform PCI driver if the version is really old
-         * and the user told us to ignore it. */
+         * Also enable the Xen platform PCI driver if the host does
+         * not support the unplug protocol (XEN_PLATFORM_ERR_MAGIC)
+         * but the user told us that unplugging is unnecessary. */
         if (r && !(r == XEN_PLATFORM_ERR_MAGIC &&
-                        (xen_emul_unplug & XEN_UNPLUG_IGNORE)))
+                        (xen_emul_unplug & XEN_UNPLUG_UNNECESSARY)))
                 return;
         /* Set the default value of xen_emul_unplug depending on whether or
          * not the Xen PV frontends and the Xen platform PCI driver have
@@ -99,7 +103,7 @@ void __init xen_unplug_emulated_devices(void)
                 }
         }
         /* Now unplug the emulated devices */
-        if (!(xen_emul_unplug & XEN_UNPLUG_IGNORE))
+        if (!(xen_emul_unplug & XEN_UNPLUG_UNNECESSARY))
                 outw(xen_emul_unplug, XEN_IOPORT_UNPLUG);
         xen_platform_pci_unplug = xen_emul_unplug;
 }
@@ -125,8 +129,10 @@ static int __init parse_xen_emul_unplug(char *arg)
                         xen_emul_unplug |= XEN_UNPLUG_AUX_IDE_DISKS;
                 else if (!strncmp(p, "nics", l))
                         xen_emul_unplug |= XEN_UNPLUG_ALL_NICS;
-                else if (!strncmp(p, "ignore", l))
-                        xen_emul_unplug |= XEN_UNPLUG_IGNORE;
+                else if (!strncmp(p, "unnecessary", l))
+                        xen_emul_unplug |= XEN_UNPLUG_UNNECESSARY;
+                else if (!strncmp(p, "never", l))
+                        xen_emul_unplug |= XEN_UNPLUG_NEVER;
                 else
                         printk(KERN_WARNING "unrecognised option '%s' "
                                  "in parameter 'xen_emul_unplug'\n", p);