Merge v3.5-rc5 into driver-core-next

This picks up the big printk fixes, and resolves a merge issue with:
	drivers/extcon/extcon_gpio.c

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

21 files changed, 136 insertions, 63 deletions

diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index be6d9e365a80..3470624d7835 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -2460,10 +2460,12 @@ ENTRY(aesni_cbc_dec)
         pxor IN3, STATE4
         movaps IN4, IV
 #else
-        pxor (INP), STATE2
-        pxor 0x10(INP), STATE3
         pxor IN1, STATE4
         movaps IN2, IV
+        movups (INP), IN1
+        pxor IN1, STATE2
+        movups 0x10(INP), IN2
+        pxor IN2, STATE3
 #endif
         movups STATE1, (OUTP)
         movups STATE2, 0x10(OUTP)
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index daeca56211e3..673ac9b63d6b 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -38,7 +38,7 @@
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
 {
         int err = 0;
-        bool ia32 = is_ia32_task();
+        bool ia32 = test_thread_flag(TIF_IA32);
 
         if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
                 return -EFAULT;
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 340ee49961a6..f91e80f4f180 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -176,7 +176,7 @@
 #define X86_FEATURE_XSAVEOPT    (7*32+ 4) /* Optimized Xsave */
 #define X86_FEATURE_PLN         (7*32+ 5) /* Intel Power Limit Notification */
 #define X86_FEATURE_PTS         (7*32+ 6) /* Intel Package Thermal Status */
-#define X86_FEATURE_DTS         (7*32+ 7) /* Digital Thermal Sensor */
+#define X86_FEATURE_DTHERM      (7*32+ 7) /* Digital Thermal Sensor */
 #define X86_FEATURE_HW_PSTATE   (7*32+ 8) /* AMD HW-PState */
 
 /* Virtualization flags: Linux defined, word 8 */
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index 43876f16caf1..cb00ccc7d571 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -47,16 +47,26 @@ static inline void native_set_pte(pte_t *ptep, pte_t pte)
  * they can run pmd_offset_map_lock or pmd_trans_huge or other pmd
  * operations.
  *
- * Without THP if the mmap_sem is hold for reading, the
- * pmd can only transition from null to not null while pmd_read_atomic runs.
- * So there's no need of literally reading it atomically.
+ * Without THP if the mmap_sem is hold for reading, the pmd can only
+ * transition from null to not null while pmd_read_atomic runs. So
+ * we can always return atomic pmd values with this function.
  *
  * With THP if the mmap_sem is hold for reading, the pmd can become
- * THP or null or point to a pte (and in turn become "stable") at any
- * time under pmd_read_atomic, so it's mandatory to read it atomically
- * with cmpxchg8b.
+ * trans_huge or none or point to a pte (and in turn become "stable")
+ * at any time under pmd_read_atomic. We could read it really
+ * atomically here with a atomic64_read for the THP enabled case (and
+ * it would be a whole lot simpler), but to avoid using cmpxchg8b we
+ * only return an atomic pmdval if the low part of the pmdval is later
+ * found stable (i.e. pointing to a pte). And we're returning a none
+ * pmdval if the low part of the pmd is none. In some cases the high
+ * and low part of the pmdval returned may not be consistent if THP is
+ * enabled (the low part may point to previously mapped hugepage,
+ * while the high part may point to a more recently mapped hugepage),
+ * but pmd_none_or_trans_huge_or_clear_bad() only needs the low part
+ * of the pmd to be read atomically to decide if the pmd is unstable
+ * or not, with the only exception of when the low part of the pmd is
+ * zero in which case we return a none pmd.
  */
-#ifndef CONFIG_TRANSPARENT_HUGEPAGE
 static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
 {
         pmdval_t ret;
@@ -74,12 +84,6 @@ static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
 
         return (pmd_t) { ret };
 }
-#else /* CONFIG_TRANSPARENT_HUGEPAGE */
-static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
-{
-        return (pmd_t) { atomic64_read((atomic64_t *)pmdp) };
-}
-#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
 {
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 8afb69319815..b2297e58c6ed 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -422,12 +422,14 @@ acpi_parse_int_src_ovr(struct acpi_subtable_header * header,
                 return 0;
         }
 
-        if (intsrc->source_irq == 0 && intsrc->global_irq == 2) {
+        if (intsrc->source_irq == 0) {
                 if (acpi_skip_timer_override) {
-                        printk(PREFIX "BIOS IRQ0 pin2 override ignored.\n");
+                        printk(PREFIX "BIOS IRQ0 override ignored.\n");
                         return 0;
                 }
-                if (acpi_fix_pin2_polarity && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
+
+                if ((intsrc->global_irq == 2) && acpi_fix_pin2_polarity
+                        && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
                         intsrc->inti_flags &= ~ACPI_MADT_POLARITY_MASK;
                         printk(PREFIX "BIOS IRQ0 pin2 override: forcing polarity to high active.\n");
                 }
@@ -1334,17 +1336,12 @@ static int __init dmi_disable_acpi(const struct dmi_system_id *d)
 }
 
 /*
- * Force ignoring BIOS IRQ0 pin2 override
+ * Force ignoring BIOS IRQ0 override
  */
 static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
 {
-        /*
-         * The ati_ixp4x0_rev() early PCI quirk should have set
-         * the acpi_skip_timer_override flag already:
-         */
         if (!acpi_skip_timer_override) {
-                WARN(1, KERN_ERR "ati_ixp4x0 quirk not complete.\n");
-                pr_notice("%s detected: Ignoring BIOS IRQ0 pin2 override\n",
+                pr_notice("%s detected: Ignoring BIOS IRQ0 override\n",
                         d->ident);
                 acpi_skip_timer_override = 1;
         }
@@ -1438,7 +1435,7 @@ static struct dmi_system_id __initdata acpi_dmi_table_late[] = {
          * is enabled.  This input is incorrectly designated the
          * ISA IRQ 0 via an interrupt source override even though
          * it is wired to the output of the master 8259A and INTIN0
-         * is not connected at all.  Force ignoring BIOS IRQ0 pin2
+         * is not connected at all.  Force ignoring BIOS IRQ0
          * override in that cases.
          */
         {
@@ -1473,6 +1470,14 @@ static struct dmi_system_id __initdata acpi_dmi_table_late[] = {
                      DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
                      },
          },
+        {
+         .callback = dmi_ignore_irq0_timer_override,
+         .ident = "FUJITSU SIEMENS",
+         .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+                     },
+         },
         {}
 };
 
diff --git a/arch/x86/kernel/cpu/mkcapflags.pl b/arch/x86/kernel/cpu/mkcapflags.pl
index dfea390e1608..c7b3fe2d72e0 100644
--- a/arch/x86/kernel/cpu/mkcapflags.pl
+++ b/arch/x86/kernel/cpu/mkcapflags.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 #
 # Generate the x86_cap_flags[] array from include/asm-x86/cpufeature.h
 #
@@ -11,22 +11,35 @@ open(OUT, "> $out\0") or die "$0: cannot create: $out: $!\n";
 print OUT "#include <asm/cpufeature.h>\n\n";
 print OUT "const char * const x86_cap_flags[NCAPINTS*32] = {\n";
 
+%features = ();
+$err = 0;
+
 while (defined($line = <IN>)) {
         if ($line =~ /^\s*\#\s*define\s+(X86_FEATURE_(\S+))\s+(.*)$/) {
                 $macro = $1;
-                $feature = $2;
+                $feature = "\L$2";
                 $tail = $3;
                 if ($tail =~ /\/\*\s*\"([^"]*)\".*\*\//) {
-                        $feature = $1;
+                        $feature = "\L$1";
                 }
 
-                if ($feature ne '') {
-                        printf OUT "\t%-32s = \"%s\",\n",
-                                "[$macro]", "\L$feature";
+                next if ($feature eq '');
+
+                if ($features{$feature}++) {
+                        print STDERR "$in: duplicate feature name: $feature\n";
+                        $err++;
                 }
+                printf OUT "\t%-32s = \"%s\",\n", "[$macro]", $feature;
         }
 }
 print OUT "};\n";
 
 close(IN);
 close(OUT);
+
+if ($err) {
+        unlink($out);
+        exit(1);
+}
+
+exit(0);
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index addf9e82a7f2..ee8e9abc859f 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -31,7 +31,7 @@ void __cpuinit init_scattered_cpuid_features(struct cpuinfo_x86 *c)
         const struct cpuid_bit *cb;
 
         static const struct cpuid_bit __cpuinitconst cpuid_bits[] = {
-                { X86_FEATURE_DTS,              CR_EAX, 0, 0x00000006, 0 },
+                { X86_FEATURE_DTHERM,           CR_EAX, 0, 0x00000006, 0 },
                 { X86_FEATURE_IDA,              CR_EAX, 1, 0x00000006, 0 },
                 { X86_FEATURE_ARAT,             CR_EAX, 2, 0x00000006, 0 },
                 { X86_FEATURE_PLN,              CR_EAX, 4, 0x00000006, 0 },
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 8bfb6146f753..3f61904365cf 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -444,12 +444,12 @@ void kgdb_roundup_cpus(unsigned long flags)
 
 /**
  *      kgdb_arch_handle_exception - Handle architecture specific GDB packets.
- *      @vector: The error vector of the exception that happened.
+ *      @e_vector: The error vector of the exception that happened.
  *      @signo: The signal number of the exception that happened.
  *      @err_code: The error code of the exception that happened.
- *      @remcom_in_buffer: The buffer of the packet we have read.
- *      @remcom_out_buffer: The buffer of %BUFMAX bytes to write a packet into.
- *      @regs: The &struct pt_regs of the current process.
+ *      @remcomInBuffer: The buffer of the packet we have read.
+ *      @remcomOutBuffer: The buffer of %BUFMAX bytes to write a packet into.
+ *      @linux_regs: The &struct pt_regs of the current process.
  *
  *      This function MUST handle the 'c' and 's' command packets,
  *      as well packets to set / remove a hardware breakpoint, if used.
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 086eb58c6e80..f1b42b3a186c 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -120,11 +120,6 @@ bool kvm_check_and_clear_guest_paused(void)
         bool ret = false;
         struct pvclock_vcpu_time_info *src;
 
-        /*
-         * per_cpu() is safe here because this function is only called from
-         * timer functions where preemption is already disabled.
-         */
-        WARN_ON(!in_atomic());
         src = &__get_cpu_var(hv_clock);
         if ((src->flags & PVCLOCK_GUEST_STOPPED) != 0) {
                 __this_cpu_and(hv_clock.flags, ~PVCLOCK_GUEST_STOPPED);
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 62c9457ccd2f..c0f420f76cd3 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -100,7 +100,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
                                  struct dma_attrs *attrs)
 {
         unsigned long dma_mask;
-        struct page *page = NULL;
+        struct page *page;
         unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         dma_addr_t addr;
 
@@ -108,6 +108,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
 
         flag |= __GFP_ZERO;
 again:
+        page = NULL;
         if (!(flag & GFP_ATOMIC))
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
         if (!page)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 25b48edb847c..5de92f1abd76 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -451,6 +451,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
                 },
         },
+        {       /* Handle problems with rebooting on the Precision M6600. */
+                .callback = set_pci_reboot,
+                .ident = "Dell OptiPlex 990",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 3fab55bea29b..7bd8a0823654 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -349,9 +349,12 @@ static bool __cpuinit match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 
 static bool __cpuinit match_mc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 {
-        if (c->phys_proc_id == o->phys_proc_id)
-                return topology_sane(c, o, "mc");
+        if (c->phys_proc_id == o->phys_proc_id) {
+                if (cpu_has(c, X86_FEATURE_AMD_DCM))
+                        return true;
 
+                return topology_sane(c, o, "mc");
+        }
         return false;
 }
 
diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
index 459b58a8a15c..25b7ae8d058a 100644
--- a/arch/x86/lib/csum-wrappers_64.c
+++ b/arch/x86/lib/csum-wrappers_64.c
@@ -115,7 +115,7 @@ EXPORT_SYMBOL(csum_partial_copy_to_user);
  * @src: source address
  * @dst: destination address
  * @len: number of bytes to be copied.
- * @isum: initial sum that is added into the result (32bit unfolded)
+ * @sum: initial sum that is added into the result (32bit unfolded)
  *
  * Returns an 32bit unfolded checksum of the buffer.
  */
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index 677b1ed184c9..4f74d94c8d97 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -22,7 +22,7 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
         void *map;
         int ret;
 
-        if (__range_not_ok(from, n, TASK_SIZE) == 0)
+        if (__range_not_ok(from, n, TASK_SIZE))
                 return len;
 
         do {
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index be1ef574ce9a..78fe3f1ac49f 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -180,7 +180,7 @@ err_free_memtype:
 
 /**
  * ioremap_nocache     -   map bus memory into CPU space
- * @offset:    bus address of the memory
+ * @phys_addr:    bus address of the memory
  * @size:      size of the resource to map
  *
  * ioremap_nocache performs a platform specific sequence of operations to
@@ -217,7 +217,7 @@ EXPORT_SYMBOL(ioremap_nocache);
 
 /**
  * ioremap_wc   -       map memory into CPU space write combined
- * @offset:     bus address of the memory
+ * @phys_addr:  bus address of the memory
  * @size:       size of the resource to map
  *
  * This version of ioremap ensures that the memory is marked write combining.
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index e1ebde315210..a718e0d23503 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -122,7 +122,7 @@ within(unsigned long addr, unsigned long start, unsigned long end)
 
 /**
  * clflush_cache_range - flush a cache range with clflush
- * @addr:       virtual start address
+ * @vaddr:      virtual start address
  * @size:       number of bytes to flush
  *
  * clflush is an unordered instruction which needs fencing with mfence
diff --git a/arch/x86/platform/mrst/early_printk_mrst.c b/arch/x86/platform/mrst/early_printk_mrst.c
index 3c6e328483c7..028454f0c3a5 100644
--- a/arch/x86/platform/mrst/early_printk_mrst.c
+++ b/arch/x86/platform/mrst/early_printk_mrst.c
@@ -110,19 +110,16 @@ static struct kmsg_dumper dw_dumper;
 static int dumper_registered;
 
 static void dw_kmsg_dump(struct kmsg_dumper *dumper,
-                        enum kmsg_dump_reason reason,
-                        const char *s1, unsigned long l1,
-                        const char *s2, unsigned long l2)
+                         enum kmsg_dump_reason reason)
 {
-        int i;
+        static char line[1024];
+        size_t len;
 
         /* When run to this, we'd better re-init the HW */
         mrst_early_console_init();
 
-        for (i = 0; i < l1; i++)
-                early_mrst_console.write(&early_mrst_console, s1 + i, 1);
-        for (i = 0; i < l2; i++)
-                early_mrst_console.write(&early_mrst_console, s2 + i, 1);
+        while (kmsg_dump_get_line(dumper, true, line, sizeof(line), &len))
+                early_mrst_console.write(&early_mrst_console, line, len);
 }
 
 /* Set the ratio rate to 115200, 8n1, IRQ disabled */
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 416bd40c0eba..68d1dc91b37b 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -39,9 +39,9 @@
 #undef __SYSCALL_I386
 #define __SYSCALL_I386(nr, sym, compat) [ nr ] = sym,
 
-typedef void (*sys_call_ptr_t)(void);
+typedef asmlinkage void (*sys_call_ptr_t)(void);
 
-extern void sys_ni_syscall(void);
+extern asmlinkage void sys_ni_syscall(void);
 
 const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
         /*
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e74df9548a02..ff962d4b821e 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -209,6 +209,9 @@ static void __init xen_banner(void)
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
 
+#define CPUID_THERM_POWER_LEAF 6
+#define APERFMPERF_PRESENT 0
+
 static __read_mostly unsigned int cpuid_leaf1_edx_mask = ~0;
 static __read_mostly unsigned int cpuid_leaf1_ecx_mask = ~0;
 
@@ -242,6 +245,11 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                 *dx = cpuid_leaf5_edx_val;
                 return;
 
+        case CPUID_THERM_POWER_LEAF:
+                /* Disabling APERFMPERF for kernel usage */
+                maskecx = ~(1 << APERFMPERF_PRESENT);
+                break;
+
         case 0xb:
                 /* Suppress extended topology stuff */
                 maskebx = 0;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index ffd08c414e91..64effdc6da94 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -706,6 +706,7 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         if (!PageHighMem(page)) {
@@ -741,6 +742,24 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
         spin_unlock_irqrestore(&m2p_override_lock, flags);
 
+        /* p2m(m2p(mfn)) == mfn: the mfn is already present somewhere in
+         * this domain. Set the FOREIGN_FRAME_BIT in the p2m for the other
+         * pfn so that the following mfn_to_pfn(mfn) calls will return the
+         * pfn from the m2p_override (the backend pfn) instead.
+         * We need to do this because the pages shared by the frontend
+         * (xen-blkfront) can be already locked (lock_page, called by
+         * do_read_cache_page); when the userspace backend tries to use them
+         * with direct_IO, mfn_to_pfn returns the pfn of the frontend, so
+         * do_blockdev_direct_IO is going to try to lock the same pages
+         * again resulting in a deadlock.
+         * As a side effect get_user_pages_fast might not be safe on the
+         * frontend pages while they are being shared with the backend,
+         * because mfn_to_pfn (that ends up being called by GUPF) will
+         * return the backend pfn rather than the frontend pfn. */
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == mfn)
+                set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
@@ -752,6 +771,7 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         mfn = get_phys_to_machine(pfn);
@@ -821,6 +841,22 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         } else
                 set_phys_to_machine(pfn, page->index);
 
+        /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
+         * somewhere in this domain, even before being added to the
+         * m2p_override (see comment above in m2p_add_override).
+         * If there are no other entries in the m2p_override corresponding
+         * to this mfn, then remove the FOREIGN_FRAME_BIT from the p2m for
+         * the original pfn (the one shared by the frontend): the backend
+         * cannot do any IO on this page anymore because it has been
+         * unshared. Removing the FOREIGN_FRAME_BIT from the p2m entry of
+         * the original pfn causes mfn_to_pfn(mfn) to return the frontend
+         * pfn again. */
+        mfn &= ~FOREIGN_FRAME_BIT;
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+                        m2p_find_override(mfn) == NULL)
+                set_phys_to_machine(pfn, mfn);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_remove_override);
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 3ebba0753d38..a4790bf22c59 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -371,7 +371,8 @@ char * __init xen_memory_setup(void)
         populated = xen_populate_chunk(map, memmap.nr_entries,
                         max_pfn, &last_pfn, xen_released_pages);
 
-        extra_pages += (xen_released_pages - populated);
+        xen_released_pages -= populated;
+        extra_pages += xen_released_pages;
 
         if (last_pfn > max_pfn) {
                 max_pfn = min(MAX_DOMAIN_PAGES, last_pfn);