Merge remote branch 'anholt/drm-intel-next' into drm-next

* anholt/drm-intel-next: (515 commits)
  drm/i915: Fix out of tree builds
  drm/i915: move fence lru to struct drm_i915_fence_reg
  drm/i915: don't allow tiling changes on pinned buffers v2
  drm/i915: Be extra careful about A/D matching for multifunction SDVO
  drm/i915: Fix DDC bus selection for multifunction SDVO
  drm/i915: cleanup mode setting before unmapping registers
  drm/i915: Make fbc control wrapper functions
  drm/i915: Wait for the GPU whilst shrinking, if truly desperate.
  drm/i915: Use spatio-temporal dithering on PCH
  [MTD] Remove zero-length files mtdbdi.c and internal.ho
  pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs
  libata: Fix several inaccuracies in developer's guide
  slub: Fix bad boundary check in init_kmem_cache_nodes()
  raid6: fix recovery performance regression
  KEYS: call_sbin_request_key() must write lock keyrings before modifying them
  KEYS: Use RCU dereference wrappers in keyring key type code
  KEYS: find_keyring_by_name() can gain access to a freed keyring
  ALSA: hda: Fix 0 dB for Packard Bell models using Conexant CX20549 (Venice)
  ALSA: hda - Add quirk for Dell Inspiron 19T using a Conexant CX20582
  ALSA: take tu->qlock with irqs disabled
  ...

7 files changed, 37 insertions, 6 deletions

diff --git a/arch/x86/kernel/apb_timer.c b/arch/x86/kernel/apb_timer.c
index ff469e470059..a35347501d36 100644
--- a/arch/x86/kernel/apb_timer.c
+++ b/arch/x86/kernel/apb_timer.c
@@ -429,7 +429,7 @@ static int apbt_cpuhp_notify(struct notifier_block *n,
 
 static __init int apbt_late_init(void)
 {
-        if (disable_apbt_percpu)
+        if (disable_apbt_percpu || !apb_timer_block_enabled)
                 return 0;
         /* This notifier should be called after workqueue is ready */
         hotcpu_notifier(apbt_cpuhp_notify, -20);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 127b8718abfb..eb2789c3f721 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2545,6 +2545,9 @@ void irq_force_complete_move(int irq)
         struct irq_desc *desc = irq_to_desc(irq);
         struct irq_cfg *cfg = desc->chip_data;
 
+        if (!cfg)
+                return;
+
         __irq_complete_move(&desc, cfg->vector);
 }
 #else
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index d360b56e9825..b6215b9798e2 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -929,7 +929,8 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
                 powernow_table[i].index = index;
 
                 /* Frequency may be rounded for these */
-                if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
+                if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
+                                 || boot_cpu_data.x86 == 0x11) {
                         powernow_table[i].frequency =
                                 freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
                 } else
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 7e1cca13af35..1366c7cfd483 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -47,6 +47,27 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
                 (c->x86 == 0x6 && c->x86_model >= 0x0e))
                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
 
+        /*
+         * Atom erratum AAE44/AAF40/AAG38/AAH41:
+         *
+         * A race condition between speculative fetches and invalidating
+         * a large page.  This is worked around in microcode, but we
+         * need the microcode to have already been loaded... so if it is
+         * not, recommend a BIOS update and disable large pages.
+         */
+        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2) {
+                u32 ucode, junk;
+
+                wrmsr(MSR_IA32_UCODE_REV, 0, 0);
+                sync_core();
+                rdmsr(MSR_IA32_UCODE_REV, junk, ucode);
+
+                if (ucode < 0x20e) {
+                        printk(KERN_WARNING "Atom PSE erratum detected, BIOS microcode update recommended\n");
+                        clear_cpu_cap(c, X86_FEATURE_PSE);
+                }
+        }
+
 #ifdef CONFIG_X86_64
         set_cpu_cap(c, X86_FEATURE_SYSENTER32);
 #else
diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
index 1cbed97b59cf..dfdb4dba2320 100644
--- a/arch/x86/kernel/cpu/vmware.c
+++ b/arch/x86/kernel/cpu/vmware.c
@@ -22,6 +22,7 @@
  */
 
 #include <linux/dmi.h>
+#include <linux/module.h>
 #include <asm/div64.h>
 #include <asm/vmware.h>
 #include <asm/x86_init.h>
@@ -101,6 +102,7 @@ int vmware_platform(void)
 
         return 0;
 }
+EXPORT_SYMBOL(vmware_platform);
 
 /*
  * VMware hypervisor takes care of exporting a reliable TSC to the guest.
diff --git a/arch/x86/kernel/dumpstack.h b/arch/x86/kernel/dumpstack.h
index e39e77168a37..e1a93be4fd44 100644
--- a/arch/x86/kernel/dumpstack.h
+++ b/arch/x86/kernel/dumpstack.h
@@ -14,6 +14,8 @@
 #define get_bp(bp) asm("movq %%rbp, %0" : "=r" (bp) :)
 #endif
 
+#include <linux/uaccess.h>
+
 extern void
 show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
                 unsigned long *stack, unsigned long bp, char *log_lvl);
@@ -42,8 +44,10 @@ static inline unsigned long rewind_frame_pointer(int n)
         get_bp(frame);
 
 #ifdef CONFIG_FRAME_POINTER
-        while (n--)
-                frame = frame->next_frame;
+        while (n--) {
+                if (probe_kernel_address(&frame->next_frame, frame))
+                        break;
+        }
 #endif
 
         return (unsigned long)frame;
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index dc9690b4c4cc..17cb3295cbf7 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -276,12 +276,12 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
 
         set_tsk_thread_flag(p, TIF_FORK);
 
-        p->thread.fs = me->thread.fs;
-        p->thread.gs = me->thread.gs;
         p->thread.io_bitmap_ptr = NULL;
 
         savesegment(gs, p->thread.gsindex);
+        p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs;
         savesegment(fs, p->thread.fsindex);
+        p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
         savesegment(es, p->thread.es);
         savesegment(ds, p->thread.ds);