Merge branch 'master' into for-2.6.33

27 files changed, 140 insertions, 58 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 07e01149e3bf..72ace9515a07 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1443,12 +1443,8 @@ config SECCOMP
 
           If unsure, say Y. Only embedded should say N here.
 
-config CC_STACKPROTECTOR_ALL
-        bool
-
 config CC_STACKPROTECTOR
         bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-        select CC_STACKPROTECTOR_ALL
         ---help---
           This option turns on the -fstack-protector GCC feature. This
           feature puts, at the beginning of functions, a canary value on
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index f2824fb8c79c..2649840d888f 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -400,7 +400,7 @@ config X86_TSC
 
 config X86_CMPXCHG64
         def_bool y
-        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+        depends on !M386 && !M486
 
 # this should be set for all -march=.. options where the compiler
 # generates cmov.
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index a012ee8ef803..d2d24c9ee64d 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -76,7 +76,6 @@ ifdef CONFIG_CC_STACKPROTECTOR
         cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
         ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(biarch)),y)
                 stackp-y := -fstack-protector
-                stackp-$(CONFIG_CC_STACKPROTECTOR_ALL) += -fstack-protector-all
                 KBUILD_CFLAGS += $(stackp-y)
         else
                 $(warning stack protector enabled but no compiler support)
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 1733f9f65e82..581b0568fe19 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -204,7 +204,7 @@ sysexit_from_sys_call:
         movl RDI-ARGOFFSET(%rsp),%r8d   /* reload 5th syscall arg */
         .endm
 
-        .macro auditsys_exit exit,ebpsave=RBP
+        .macro auditsys_exit exit
         testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
         jnz ia32_ret_from_sys_call
         TRACE_IRQS_ON
@@ -217,7 +217,6 @@ sysexit_from_sys_call:
         call audit_syscall_exit
         GET_THREAD_INFO(%r10)
         movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall return value */
-        movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */
         movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
         cli
         TRACE_IRQS_OFF
@@ -351,7 +350,7 @@ cstar_auditsys:
         jmp cstar_dispatch
 
 sysretl_audit:
-        auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */
+        auditsys_exit sysretl_from_sys_call
 #endif
 
 cstar_tracesys:
diff --git a/arch/x86/include/asm/amd_iommu.h b/arch/x86/include/asm/amd_iommu.h
index ac95995b7bad..4b180897e6b5 100644
--- a/arch/x86/include/asm/amd_iommu.h
+++ b/arch/x86/include/asm/amd_iommu.h
@@ -31,6 +31,7 @@ extern irqreturn_t amd_iommu_int_handler(int irq, void *data);
 extern void amd_iommu_flush_all_domains(void);
 extern void amd_iommu_flush_all_devices(void);
 extern void amd_iommu_shutdown(void);
+extern void amd_iommu_apply_erratum_63(u16 devid);
 #else
 static inline int amd_iommu_init(void) { return -ENODEV; }
 static inline void amd_iommu_detect(void) { }
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index e8de2f6f5ca5..617bd56b3070 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -288,7 +288,7 @@ static inline void load_LDT(mm_context_t *pc)
 
 static inline unsigned long get_desc_base(const struct desc_struct *desc)
 {
-        return desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24);
+        return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
 }
 
 static inline void set_desc_base(struct desc_struct *desc, unsigned long base)
diff --git a/arch/x86/include/asm/dma-mapping.h b/arch/x86/include/asm/dma-mapping.h
index 0ee770d23d0e..6a25d5d42836 100644
--- a/arch/x86/include/asm/dma-mapping.h
+++ b/arch/x86/include/asm/dma-mapping.h
@@ -14,6 +14,12 @@
 #include <asm/swiotlb.h>
 #include <asm-generic/dma-coherent.h>
 
+#ifdef CONFIG_ISA
+# define ISA_DMA_BIT_MASK DMA_BIT_MASK(24)
+#else
+# define ISA_DMA_BIT_MASK DMA_BIT_MASK(32)
+#endif
+
 extern dma_addr_t bad_dma_address;
 extern int iommu_merge;
 extern struct device x86_dma_fallback_dev;
@@ -124,10 +130,8 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
         if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
                 return memory;
 
-        if (!dev) {
+        if (!dev)
                 dev = &x86_dma_fallback_dev;
-                gfp |= GFP_DMA;
-        }
 
         if (!is_device_dma_capable(dev))
                 return NULL;
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index c3429e8b2424..c9786480f0fe 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -1000,7 +1000,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
 #define thread_saved_pc(t)      (*(unsigned long *)((t)->thread.sp - 8))
 
 #define task_pt_regs(tsk)       ((struct pt_regs *)(tsk)->thread.sp0 - 1)
-#define KSTK_ESP(tsk)           -1 /* sorry. doesn't work for syscall. */
+extern unsigned long KSTK_ESP(struct task_struct *task);
 #endif /* CONFIG_X86_64 */
 
 extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
index d823c245f63b..40e37b10c6c0 100644
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -143,7 +143,7 @@ extern unsigned long node_remap_size[];
                                 | 1*SD_BALANCE_FORK                     \
                                 | 0*SD_BALANCE_WAKE                     \
                                 | 1*SD_WAKE_AFFINE                      \
-                                | 1*SD_PREFER_LOCAL                     \
+                                | 0*SD_PREFER_LOCAL                     \
                                 | 0*SD_SHARE_CPUPOWER                   \
                                 | 0*SD_POWERSAVINGS_BALANCE             \
                                 | 0*SD_SHARE_PKG_RESOURCES              \
diff --git a/arch/x86/kernel/acpi/processor.c b/arch/x86/kernel/acpi/processor.c
index d296f4a195c9..d85d1b2432ba 100644
--- a/arch/x86/kernel/acpi/processor.c
+++ b/arch/x86/kernel/acpi/processor.c
@@ -79,7 +79,8 @@ void arch_acpi_processor_init_pdc(struct acpi_processor *pr)
         struct cpuinfo_x86 *c = &cpu_data(pr->id);
 
         pr->pdc = NULL;
-        if (c->x86_vendor == X86_VENDOR_INTEL)
+        if (c->x86_vendor == X86_VENDOR_INTEL ||
+            c->x86_vendor == X86_VENDOR_CENTAUR)
                 init_intel_pdc(pr, c);
 
         return;
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index 98f230f6a28d..0285521e0a99 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -1220,6 +1220,8 @@ static void __detach_device(struct protection_domain *domain, u16 devid)
         amd_iommu_dev_table[devid].data[1] = 0;
         amd_iommu_dev_table[devid].data[2] = 0;
 
+        amd_iommu_apply_erratum_63(devid);
+
         /* decrease reference counter */
         domain->dev_cnt -= 1;
 
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index b4b61d462dcc..c20001e4f556 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -240,7 +240,7 @@ static void iommu_feature_enable(struct amd_iommu *iommu, u8 bit)
         writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET);
 }
 
-static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
+static void iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
 {
         u32 ctrl;
 
@@ -519,6 +519,26 @@ static void set_dev_entry_bit(u16 devid, u8 bit)
         amd_iommu_dev_table[devid].data[i] |= (1 << _bit);
 }
 
+static int get_dev_entry_bit(u16 devid, u8 bit)
+{
+        int i = (bit >> 5) & 0x07;
+        int _bit = bit & 0x1f;
+
+        return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit;
+}
+
+
+void amd_iommu_apply_erratum_63(u16 devid)
+{
+        int sysmgt;
+
+        sysmgt = get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT1) |
+                 (get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT2) << 1);
+
+        if (sysmgt == 0x01)
+                set_dev_entry_bit(devid, DEV_ENTRY_IW);
+}
+
 /* Writes the specific IOMMU for a device into the rlookup table */
 static void __init set_iommu_for_device(struct amd_iommu *iommu, u16 devid)
 {
@@ -547,6 +567,8 @@ static void __init set_dev_entry_from_acpi(struct amd_iommu *iommu,
         if (flags & ACPI_DEVFLAG_LINT1)
                 set_dev_entry_bit(devid, DEV_ENTRY_LINT1_PASS);
 
+        amd_iommu_apply_erratum_63(devid);
+
         set_iommu_for_device(iommu, devid);
 }
 
diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
index 7d5c3b0ea8da..8b581d3905cb 100644
--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -526,15 +526,21 @@ static const struct dmi_system_id sw_any_bug_dmi_table[] = {
 
 static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
 {
-        /* http://www.intel.com/Assets/PDF/specupdate/314554.pdf
+        /* Intel Xeon Processor 7100 Series Specification Update
+         * http://www.intel.com/Assets/PDF/specupdate/314554.pdf
          * AL30: A Machine Check Exception (MCE) Occurring during an
          * Enhanced Intel SpeedStep Technology Ratio Change May Cause
-         * Both Processor Cores to Lock Up when HT is enabled*/
+         * Both Processor Cores to Lock Up. */
         if (c->x86_vendor == X86_VENDOR_INTEL) {
                 if ((c->x86 == 15) &&
                     (c->x86_model == 6) &&
-                    (c->x86_mask == 8) && smt_capable())
+                    (c->x86_mask == 8)) {
+                        printk(KERN_INFO "acpi-cpufreq: Intel(R) "
+                            "Xeon(R) 7100 Errata AL30, processors may "
+                            "lock up on frequency changes: disabling "
+                            "acpi-cpufreq.\n");
                         return -ENODEV;
+                    }
                 }
         return 0;
 }
@@ -549,13 +555,18 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
         unsigned int result = 0;
         struct cpuinfo_x86 *c = &cpu_data(policy->cpu);
         struct acpi_processor_performance *perf;
+#ifdef CONFIG_SMP
+        static int blacklisted;
+#endif
 
         dprintk("acpi_cpufreq_cpu_init\n");
 
 #ifdef CONFIG_SMP
-        result = acpi_cpufreq_blacklist(c);
-        if (result)
-                return result;
+        if (blacklisted)
+                return blacklisted;
+        blacklisted = acpi_cpufreq_blacklist(c);
+        if (blacklisted)
+                return blacklisted;
 #endif
 
         data = kzalloc(sizeof(struct acpi_cpufreq_data), GFP_KERNEL);
diff --git a/arch/x86/kernel/cpu/cpufreq/longhaul.c b/arch/x86/kernel/cpu/cpufreq/longhaul.c
index ce2ed3e4aad9..cabd2fa3fc93 100644
--- a/arch/x86/kernel/cpu/cpufreq/longhaul.c
+++ b/arch/x86/kernel/cpu/cpufreq/longhaul.c
@@ -813,7 +813,7 @@ static int __init longhaul_cpu_init(struct cpufreq_policy *policy)
                         memcpy(eblcr, samuel2_eblcr, sizeof(samuel2_eblcr));
                         break;
                 case 1 ... 15:
-                        longhaul_version = TYPE_LONGHAUL_V1;
+                        longhaul_version = TYPE_LONGHAUL_V2;
                         if (c->x86_mask < 8) {
                                 cpu_model = CPU_SAMUEL2;
                                 cpuname = "C3 'Samuel 2' [C5B]";
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 6394aa5c7985..3f12dabeab52 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -1022,7 +1022,7 @@ static int get_transition_latency(struct powernow_k8_data *data)
                  * set it to 1 to avoid problems in the future.
                  * For all others it's a BIOS bug.
                  */
-                if (!boot_cpu_data.x86 == 0x11)
+                if (boot_cpu_data.x86 != 0x11)
                         printk(KERN_ERR FW_WARN PFX "Invalid zero transition "
                                 "latency\n");
                 max_latency = 1;
diff --git a/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c b/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
index 6911e91fb4f6..3ae5a7a3a500 100644
--- a/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
+++ b/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
@@ -232,28 +232,23 @@ static unsigned int speedstep_detect_chipset(void)
         return 0;
 }
 
-struct get_freq_data {
-        unsigned int speed;
-        unsigned int processor;
-};
-
-static void get_freq_data(void *_data)
+static void get_freq_data(void *_speed)
 {
-        struct get_freq_data *data = _data;
+        unsigned int *speed = _speed;
 
-        data->speed = speedstep_get_frequency(data->processor);
+        *speed = speedstep_get_frequency(speedstep_processor);
 }
 
 static unsigned int speedstep_get(unsigned int cpu)
 {
-        struct get_freq_data data = { .processor = cpu };
+        unsigned int speed;
 
         /* You're supposed to ensure CPU is online. */
-        if (smp_call_function_single(cpu, get_freq_data, &data, 1) != 0)
+        if (smp_call_function_single(cpu, get_freq_data, &speed, 1) != 0)
                 BUG();
 
-        dprintk("detected %u kHz as current frequency\n", data.speed);
-        return data.speed;
+        dprintk("detected %u kHz as current frequency\n", speed);
+        return speed;
 }
 
 /**
diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index 315738c74aad..73c86db5acbe 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -846,7 +846,7 @@ int __init mtrr_cleanup(unsigned address_bits)
         sort(range, nr_range, sizeof(struct res_range), cmp_range, NULL);
 
         range_sums = sum_ranges(range, nr_range);
-        printk(KERN_INFO "total RAM coverred: %ldM\n",
+        printk(KERN_INFO "total RAM covered: %ldM\n",
                range_sums >> (20 - PAGE_SHIFT));
 
         if (mtrr_chunk_size && mtrr_gran_size) {
diff --git a/arch/x86/kernel/crash_dump_32.c b/arch/x86/kernel/crash_dump_32.c
index f7cdb3b457aa..cd97ce18c29d 100644
--- a/arch/x86/kernel/crash_dump_32.c
+++ b/arch/x86/kernel/crash_dump_32.c
@@ -16,6 +16,22 @@ static void *kdump_buf_page;
 /* Stores the physical address of elf header of crash image. */
 unsigned long long elfcorehdr_addr = ELFCORE_ADDR_MAX;
 
+static inline bool is_crashed_pfn_valid(unsigned long pfn)
+{
+#ifndef CONFIG_X86_PAE
+        /*
+         * non-PAE kdump kernel executed from a PAE one will crop high pte
+         * bits and poke unwanted space counting again from address 0, we
+         * don't want that. pte must fit into unsigned long. In fact the
+         * test checks high 12 bits for being zero (pfn will be shifted left
+         * by PAGE_SHIFT).
+         */
+        return pte_pfn(pfn_pte(pfn, __pgprot(0))) == pfn;
+#else
+        return true;
+#endif
+}
+
 /**
  * copy_oldmem_page - copy one page from "oldmem"
  * @pfn: page frame number to be copied
@@ -41,6 +57,9 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
         if (!csize)
                 return 0;
 
+        if (!is_crashed_pfn_valid(pfn))
+                return -EFAULT;
+
         vaddr = kmap_atomic_pfn(pfn, KM_PTE0);
 
         if (!userbuf) {
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index ad5bd988fb79..cdcfb122f256 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -454,8 +454,10 @@ void __init efi_init(void)
         if (add_efi_memmap)
                 do_add_efi_memmap();
 
+#ifdef CONFIG_X86_32
         x86_platform.get_wallclock = efi_get_time;
         x86_platform.set_wallclock = efi_set_rtc_mmss;
+#endif
 
         /* Setup for EFI runtime service */
         reboot_type = BOOT_EFI;
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 366baa179913..f4c538b681ca 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -317,6 +317,12 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
                 return UCODE_NFOUND;
         }
 
+        if (*(u32 *)firmware->data != UCODE_MAGIC) {
+                printk(KERN_ERR "microcode: invalid UCODE_MAGIC (0x%08x)\n",
+                       *(u32 *)firmware->data);
+                return UCODE_ERROR;
+        }
+
         ret = generic_load_microcode(cpu, firmware->data, firmware->size);
 
         release_firmware(firmware);
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index b2a71dca5642..a6e804d16c35 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -45,12 +45,10 @@ int iommu_pass_through __read_mostly;
 dma_addr_t bad_dma_address __read_mostly = 0;
 EXPORT_SYMBOL(bad_dma_address);
 
-/* Dummy device used for NULL arguments (normally ISA). Better would
-   be probably a smaller DMA mask, but this is bug-to-bug compatible
-   to older i386. */
+/* Dummy device used for NULL arguments (normally ISA). */
 struct device x86_dma_fallback_dev = {
         .init_name = "fallback device",
-        .coherent_dma_mask = DMA_BIT_MASK(32),
+        .coherent_dma_mask = ISA_DMA_BIT_MASK,
         .dma_mask = &x86_dma_fallback_dev.coherent_dma_mask,
 };
 EXPORT_SYMBOL(x86_dma_fallback_dev);
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index ad535b683170..eb62cbcaa490 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -664,3 +664,8 @@ long sys_arch_prctl(int code, unsigned long addr)
         return do_arch_prctl(current, code, addr);
 }
 
+unsigned long KSTK_ESP(struct task_struct *task)
+{
+        return (test_tsk_thread_flag(task, TIF_IA32)) ?
+                        (task_pt_regs(task)->sp) : ((task)->thread.usersp);
+}
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index a1a3cdda06e1..f93078746e00 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -436,6 +436,14 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5"),
                 },
         },
+        {       /* Handle problems with rebooting on Apple Macmini3,1 */
+                .callback = set_pci_reboot,
+                .ident = "Apple Macmini3,1",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini3,1"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index e09f0e2c14b5..2a34f9c5be21 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -660,6 +660,13 @@ static struct dmi_system_id __initdata bad_bios_dmi_table[] = {
                 },
         },
         {
+                .callback = dmi_low_memory_corruption,
+                .ident = "Phoenix/MSC BIOS",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix/MSC"),
+                },
+        },
+        {
         /*
          * AMI BIOS with low memory corruption was found on Intel DG45ID board.
          * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9b9695322f56..ae07d261527c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1692,7 +1692,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
         unsigned bank_num = mcg_cap & 0xff, bank;
 
         r = -EINVAL;
-        if (!bank_num)
+        if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
                 goto out;
         if (mcg_cap & ~(KVM_MCE_CAP_SUPPORTED | 0xff | 0xff0000))
                 goto out;
@@ -4051,7 +4051,7 @@ static int save_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
         return kvm_write_guest_virt(dtable.base + index*8, seg_desc, sizeof(*seg_desc), vcpu);
 }
 
-static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
+static gpa_t get_tss_base_addr(struct kvm_vcpu *vcpu,
                              struct desc_struct *seg_desc)
 {
         u32 base_addr = get_desc_base(seg_desc);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 334e63ca7b2b..2feb9bdedaaf 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -170,8 +170,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
                                 (unsigned long long)phys_addr,
                                 (unsigned long long)(phys_addr + size),
                                 prot_val, new_prot_val);
-                        free_memtype(phys_addr, phys_addr + size);
-                        return NULL;
+                        goto err_free_memtype;
                 }
                 prot_val = new_prot_val;
         }
@@ -197,26 +196,25 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
          */
         area = get_vm_area_caller(size, VM_IOREMAP, caller);
         if (!area)
-                return NULL;
+                goto err_free_memtype;
         area->phys_addr = phys_addr;
         vaddr = (unsigned long) area->addr;
 
-        if (kernel_map_sync_memtype(phys_addr, size, prot_val)) {
-                free_memtype(phys_addr, phys_addr + size);
-                free_vm_area(area);
-                return NULL;
-        }
+        if (kernel_map_sync_memtype(phys_addr, size, prot_val))
+                goto err_free_area;
 
-        if (ioremap_page_range(vaddr, vaddr + size, phys_addr, prot)) {
-                free_memtype(phys_addr, phys_addr + size);
-                free_vm_area(area);
-                return NULL;
-        }
+        if (ioremap_page_range(vaddr, vaddr + size, phys_addr, prot))
+                goto err_free_area;
 
         ret_addr = (void __iomem *) (vaddr + offset);
         mmiotrace_ioremap(unaligned_phys_addr, unaligned_size, ret_addr);
 
         return ret_addr;
+err_free_area:
+        free_vm_area(area);
+err_free_memtype:
+        free_memtype(phys_addr, phys_addr + size);
+        return NULL;
 }
 
 /**
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 23a4d80fb39e..dfbf70e65860 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -178,6 +178,7 @@ static __read_mostly unsigned int cpuid_leaf1_ecx_mask = ~0;
 static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                       unsigned int *cx, unsigned int *dx)
 {
+        unsigned maskebx = ~0;
         unsigned maskecx = ~0;
         unsigned maskedx = ~0;
 
@@ -185,9 +186,16 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
          * Mask out inconvenient features, to try and disable as many
          * unsupported kernel subsystems as possible.
          */
-        if (*ax == 1) {
+        switch (*ax) {
+        case 1:
                 maskecx = cpuid_leaf1_ecx_mask;
                 maskedx = cpuid_leaf1_edx_mask;
+                break;
+
+        case 0xb:
+                /* Suppress extended topology stuff */
+                maskebx = 0;
+                break;
         }
 
         asm(XEN_EMULATE_PREFIX "cpuid"
@@ -197,6 +205,7 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                   "=d" (*dx)
                 : "0" (*ax), "2" (*cx));
 
+        *bx &= maskebx;
         *cx &= maskecx;
         *dx &= maskedx;
 }