Merge branch 'sched/urgent' into sched/core

Merge reason: Pick up fixes that did not make it into .32.0

Signed-off-by: Ingo Molnar <mingo@elte.hu>

29 files changed, 154 insertions, 49 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 07e01149e3bf..72ace9515a07 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1443,12 +1443,8 @@ config SECCOMP
 
           If unsure, say Y. Only embedded should say N here.
 
-config CC_STACKPROTECTOR_ALL
-        bool
-
 config CC_STACKPROTECTOR
         bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-        select CC_STACKPROTECTOR_ALL
         ---help---
           This option turns on the -fstack-protector GCC feature. This
           feature puts, at the beginning of functions, a canary value on
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index f2824fb8c79c..2649840d888f 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -400,7 +400,7 @@ config X86_TSC
 
 config X86_CMPXCHG64
         def_bool y
-        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+        depends on !M386 && !M486
 
 # this should be set for all -march=.. options where the compiler
 # generates cmov.
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index a012ee8ef803..d2d24c9ee64d 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -76,7 +76,6 @@ ifdef CONFIG_CC_STACKPROTECTOR
         cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
         ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(biarch)),y)
                 stackp-y := -fstack-protector
-                stackp-$(CONFIG_CC_STACKPROTECTOR_ALL) += -fstack-protector-all
                 KBUILD_CFLAGS += $(stackp-y)
         else
                 $(warning stack protector enabled but no compiler support)
diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld
index 0f6ec455a2b1..03c0683636b6 100644
--- a/arch/x86/boot/setup.ld
+++ b/arch/x86/boot/setup.ld
@@ -53,6 +53,9 @@ SECTIONS
 
         /DISCARD/ : { *(.note*) }
 
+        /*
+         * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility:
+         */
         . = ASSERT(_end <= 0x8000, "Setup too big!");
         . = ASSERT(hdr == 0x1f1, "The setup header has the wrong offset!");
         /* Necessary for the very-old-loader check to work... */
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 1733f9f65e82..581b0568fe19 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -204,7 +204,7 @@ sysexit_from_sys_call:
         movl RDI-ARGOFFSET(%rsp),%r8d   /* reload 5th syscall arg */
         .endm
 
-        .macro auditsys_exit exit,ebpsave=RBP
+        .macro auditsys_exit exit
         testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
         jnz ia32_ret_from_sys_call
         TRACE_IRQS_ON
@@ -217,7 +217,6 @@ sysexit_from_sys_call:
         call audit_syscall_exit
         GET_THREAD_INFO(%r10)
         movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall return value */
-        movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */
         movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
         cli
         TRACE_IRQS_OFF
@@ -351,7 +350,7 @@ cstar_auditsys:
         jmp cstar_dispatch
 
 sysretl_audit:
-        auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */
+        auditsys_exit sysretl_from_sys_call
 #endif
 
 cstar_tracesys:
diff --git a/arch/x86/include/asm/amd_iommu.h b/arch/x86/include/asm/amd_iommu.h
index ac95995b7bad..4b180897e6b5 100644
--- a/arch/x86/include/asm/amd_iommu.h
+++ b/arch/x86/include/asm/amd_iommu.h
@@ -31,6 +31,7 @@ extern irqreturn_t amd_iommu_int_handler(int irq, void *data);
 extern void amd_iommu_flush_all_domains(void);
 extern void amd_iommu_flush_all_devices(void);
 extern void amd_iommu_shutdown(void);
+extern void amd_iommu_apply_erratum_63(u16 devid);
 #else
 static inline int amd_iommu_init(void) { return -ENODEV; }
 static inline void amd_iommu_detect(void) { }
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index e8de2f6f5ca5..617bd56b3070 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -288,7 +288,7 @@ static inline void load_LDT(mm_context_t *pc)
 
 static inline unsigned long get_desc_base(const struct desc_struct *desc)
 {
-        return desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24);
+        return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
 }
 
 static inline void set_desc_base(struct desc_struct *desc, unsigned long base)
diff --git a/arch/x86/include/asm/dma-mapping.h b/arch/x86/include/asm/dma-mapping.h
index 0ee770d23d0e..6a25d5d42836 100644
--- a/arch/x86/include/asm/dma-mapping.h
+++ b/arch/x86/include/asm/dma-mapping.h
@@ -14,6 +14,12 @@
 #include <asm/swiotlb.h>
 #include <asm-generic/dma-coherent.h>
 
+#ifdef CONFIG_ISA
+# define ISA_DMA_BIT_MASK DMA_BIT_MASK(24)
+#else
+# define ISA_DMA_BIT_MASK DMA_BIT_MASK(32)
+#endif
+
 extern dma_addr_t bad_dma_address;
 extern int iommu_merge;
 extern struct device x86_dma_fallback_dev;
@@ -124,10 +130,8 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
         if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
                 return memory;
 
-        if (!dev) {
+        if (!dev)
                 dev = &x86_dma_fallback_dev;
-                gfp |= GFP_DMA;
-        }
 
         if (!is_device_dma_capable(dev))
                 return NULL;
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index c3429e8b2424..c9786480f0fe 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -1000,7 +1000,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
 #define thread_saved_pc(t)      (*(unsigned long *)((t)->thread.sp - 8))
 
 #define task_pt_regs(tsk)       ((struct pt_regs *)(tsk)->thread.sp0 - 1)
-#define KSTK_ESP(tsk)           -1 /* sorry. doesn't work for syscall. */
+extern unsigned long KSTK_ESP(struct task_struct *task);
 #endif /* CONFIG_X86_64 */
 
 extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
index 25a92842dd99..40e37b10c6c0 100644
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -143,6 +143,7 @@ extern unsigned long node_remap_size[];
                                 | 1*SD_BALANCE_FORK                     \
                                 | 0*SD_BALANCE_WAKE                     \
                                 | 1*SD_WAKE_AFFINE                      \
+                                | 0*SD_PREFER_LOCAL                     \
                                 | 0*SD_SHARE_CPUPOWER                   \
                                 | 0*SD_POWERSAVINGS_BALANCE             \
                                 | 0*SD_SHARE_PKG_RESOURCES              \
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index 04eb6c958b9d..d1414af98559 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -19,6 +19,8 @@
 #include <asm/types.h>
 #include <asm/percpu.h>
 #include <asm/uv/uv_mmrs.h>
+#include <asm/irq_vectors.h>
+#include <asm/io_apic.h>
 
 
 /*
@@ -114,7 +116,7 @@
 /*
  * The largest possible NASID of a C or M brick (+ 2)
  */
-#define UV_MAX_NASID_VALUE      (UV_MAX_NUMALINK_NODES * 2)
+#define UV_MAX_NASID_VALUE      (UV_MAX_NUMALINK_BLADES * 2)
 
 struct uv_scir_s {
         struct timer_list timer;
@@ -230,6 +232,20 @@ static inline unsigned long uv_gpa(void *v)
         return uv_soc_phys_ram_to_gpa(__pa(v));
 }
 
+/* gnode -> pnode */
+static inline unsigned long uv_gpa_to_gnode(unsigned long gpa)
+{
+        return gpa >> uv_hub_info->m_val;
+}
+
+/* gpa -> pnode */
+static inline int uv_gpa_to_pnode(unsigned long gpa)
+{
+        unsigned long n_mask = (1UL << uv_hub_info->n_val) - 1;
+
+        return uv_gpa_to_gnode(gpa) & n_mask;
+}
+
 /* pnode, offset --> socket virtual */
 static inline void *uv_pnode_offset_to_vaddr(int pnode, unsigned long offset)
 {
@@ -421,9 +437,14 @@ static inline void uv_set_cpu_scir_bits(int cpu, unsigned char value)
 static inline void uv_hub_send_ipi(int pnode, int apicid, int vector)
 {
         unsigned long val;
+        unsigned long dmode = dest_Fixed;
+
+        if (vector == NMI_VECTOR)
+                dmode = dest_NMI;
 
         val = (1UL << UVH_IPI_INT_SEND_SHFT) |
                         ((apicid) << UVH_IPI_INT_APIC_ID_SHFT) |
+                        (dmode << UVH_IPI_INT_DELIVERY_MODE_SHFT) |
                         (vector << UVH_IPI_INT_VECTOR_SHFT);
         uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
 }
diff --git a/arch/x86/kernel/acpi/realmode/wakeup.lds.S b/arch/x86/kernel/acpi/realmode/wakeup.lds.S
index 7da00b799cda..060fff8f5c5b 100644
--- a/arch/x86/kernel/acpi/realmode/wakeup.lds.S
+++ b/arch/x86/kernel/acpi/realmode/wakeup.lds.S
@@ -57,5 +57,8 @@ SECTIONS
                 *(.note*)
         }
 
+        /*
+         * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility:
+         */
         . = ASSERT(_end <= WAKEUP_SIZE, "Wakeup too big!");
 }
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index 98f230f6a28d..0285521e0a99 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -1220,6 +1220,8 @@ static void __detach_device(struct protection_domain *domain, u16 devid)
         amd_iommu_dev_table[devid].data[1] = 0;
         amd_iommu_dev_table[devid].data[2] = 0;
 
+        amd_iommu_apply_erratum_63(devid);
+
         /* decrease reference counter */
         domain->dev_cnt -= 1;
 
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index b4b61d462dcc..c20001e4f556 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -240,7 +240,7 @@ static void iommu_feature_enable(struct amd_iommu *iommu, u8 bit)
         writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET);
 }
 
-static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
+static void iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
 {
         u32 ctrl;
 
@@ -519,6 +519,26 @@ static void set_dev_entry_bit(u16 devid, u8 bit)
         amd_iommu_dev_table[devid].data[i] |= (1 << _bit);
 }
 
+static int get_dev_entry_bit(u16 devid, u8 bit)
+{
+        int i = (bit >> 5) & 0x07;
+        int _bit = bit & 0x1f;
+
+        return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit;
+}
+
+
+void amd_iommu_apply_erratum_63(u16 devid)
+{
+        int sysmgt;
+
+        sysmgt = get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT1) |
+                 (get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT2) << 1);
+
+        if (sysmgt == 0x01)
+                set_dev_entry_bit(devid, DEV_ENTRY_IW);
+}
+
 /* Writes the specific IOMMU for a device into the rlookup table */
 static void __init set_iommu_for_device(struct amd_iommu *iommu, u16 devid)
 {
@@ -547,6 +567,8 @@ static void __init set_dev_entry_from_acpi(struct amd_iommu *iommu,
         if (flags & ACPI_DEVFLAG_LINT1)
                 set_dev_entry_bit(devid, DEV_ENTRY_LINT1_PASS);
 
+        amd_iommu_apply_erratum_63(devid);
+
         set_iommu_for_device(iommu, devid);
 }
 
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index f5f5886a6b53..326c25477d3d 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -352,14 +352,14 @@ static __init void get_lowmem_redirect(unsigned long *base, unsigned long *size)
 
         for (i = 0; i < ARRAY_SIZE(redir_addrs); i++) {
                 alias.v = uv_read_local_mmr(redir_addrs[i].alias);
-                if (alias.s.base == 0) {
+                if (alias.s.enable && alias.s.base == 0) {
                         *size = (1UL << alias.s.m_alias);
                         redirect.v = uv_read_local_mmr(redir_addrs[i].redirect);
                         *base = (unsigned long)redirect.s.dest_base << DEST_SHIFT;
                         return;
                 }
         }
-        BUG();
+        *base = *size = 0;
 }
 
 enum map_type {map_wb, map_uc};
@@ -619,12 +619,12 @@ void __init uv_system_init(void)
                 uv_cpu_hub_info(cpu)->lowmem_remap_base = lowmem_redir_base;
                 uv_cpu_hub_info(cpu)->lowmem_remap_top = lowmem_redir_size;
                 uv_cpu_hub_info(cpu)->m_val = m_val;
-                uv_cpu_hub_info(cpu)->n_val = m_val;
+                uv_cpu_hub_info(cpu)->n_val = n_val;
                 uv_cpu_hub_info(cpu)->numa_blade_id = blade;
                 uv_cpu_hub_info(cpu)->blade_processor_id = lcpu;
                 uv_cpu_hub_info(cpu)->pnode = pnode;
                 uv_cpu_hub_info(cpu)->pnode_mask = pnode_mask;
-                uv_cpu_hub_info(cpu)->gpa_mask = (1 << (m_val + n_val)) - 1;
+                uv_cpu_hub_info(cpu)->gpa_mask = (1UL << (m_val + n_val)) - 1;
                 uv_cpu_hub_info(cpu)->gnode_upper = gnode_upper;
                 uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra;
                 uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base;
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index b1598a9436d0..721a77ca8115 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1214,7 +1214,8 @@ static int __cpuinit mce_cap_init(void)
         rdmsrl(MSR_IA32_MCG_CAP, cap);
 
         b = cap & MCG_BANKCNT_MASK;
-        printk(KERN_INFO "mce: CPU supports %d MCE banks\n", b);
+        if (!banks)
+                printk(KERN_INFO "mce: CPU supports %d MCE banks\n", b);
 
         if (b > MAX_NR_BANKS) {
                 printk(KERN_WARNING
diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index 315738c74aad..73c86db5acbe 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -846,7 +846,7 @@ int __init mtrr_cleanup(unsigned address_bits)
         sort(range, nr_range, sizeof(struct res_range), cmp_range, NULL);
 
         range_sums = sum_ranges(range, nr_range);
-        printk(KERN_INFO "total RAM coverred: %ldM\n",
+        printk(KERN_INFO "total RAM covered: %ldM\n",
                range_sums >> (20 - PAGE_SHIFT));
 
         if (mtrr_chunk_size && mtrr_gran_size) {
diff --git a/arch/x86/kernel/crash_dump_32.c b/arch/x86/kernel/crash_dump_32.c
index f7cdb3b457aa..cd97ce18c29d 100644
--- a/arch/x86/kernel/crash_dump_32.c
+++ b/arch/x86/kernel/crash_dump_32.c
@@ -16,6 +16,22 @@ static void *kdump_buf_page;
 /* Stores the physical address of elf header of crash image. */
 unsigned long long elfcorehdr_addr = ELFCORE_ADDR_MAX;
 
+static inline bool is_crashed_pfn_valid(unsigned long pfn)
+{
+#ifndef CONFIG_X86_PAE
+        /*
+         * non-PAE kdump kernel executed from a PAE one will crop high pte
+         * bits and poke unwanted space counting again from address 0, we
+         * don't want that. pte must fit into unsigned long. In fact the
+         * test checks high 12 bits for being zero (pfn will be shifted left
+         * by PAGE_SHIFT).
+         */
+        return pte_pfn(pfn_pte(pfn, __pgprot(0))) == pfn;
+#else
+        return true;
+#endif
+}
+
 /**
  * copy_oldmem_page - copy one page from "oldmem"
  * @pfn: page frame number to be copied
@@ -41,6 +57,9 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
         if (!csize)
                 return 0;
 
+        if (!is_crashed_pfn_valid(pfn))
+                return -EFAULT;
+
         vaddr = kmap_atomic_pfn(pfn, KM_PTE0);
 
         if (!userbuf) {
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index ad5bd988fb79..cdcfb122f256 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -454,8 +454,10 @@ void __init efi_init(void)
         if (add_efi_memmap)
                 do_add_efi_memmap();
 
+#ifdef CONFIG_X86_32
         x86_platform.get_wallclock = efi_get_time;
         x86_platform.set_wallclock = efi_set_rtc_mmss;
+#endif
 
         /* Setup for EFI runtime service */
         reboot_type = BOOT_EFI;
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 366baa179913..f4c538b681ca 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -317,6 +317,12 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
                 return UCODE_NFOUND;
         }
 
+        if (*(u32 *)firmware->data != UCODE_MAGIC) {
+                printk(KERN_ERR "microcode: invalid UCODE_MAGIC (0x%08x)\n",
+                       *(u32 *)firmware->data);
+                return UCODE_ERROR;
+        }
+
         ret = generic_load_microcode(cpu, firmware->data, firmware->size);
 
         release_firmware(firmware);
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index b2a71dca5642..a6e804d16c35 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -45,12 +45,10 @@ int iommu_pass_through __read_mostly;
 dma_addr_t bad_dma_address __read_mostly = 0;
 EXPORT_SYMBOL(bad_dma_address);
 
-/* Dummy device used for NULL arguments (normally ISA). Better would
-   be probably a smaller DMA mask, but this is bug-to-bug compatible
-   to older i386. */
+/* Dummy device used for NULL arguments (normally ISA). */
 struct device x86_dma_fallback_dev = {
         .init_name = "fallback device",
-        .coherent_dma_mask = DMA_BIT_MASK(32),
+        .coherent_dma_mask = ISA_DMA_BIT_MASK,
         .dma_mask = &x86_dma_fallback_dev.coherent_dma_mask,
 };
 EXPORT_SYMBOL(x86_dma_fallback_dev);
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index d9db1049e86f..93c501dc2496 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -663,3 +663,8 @@ long sys_arch_prctl(int code, unsigned long addr)
         return do_arch_prctl(current, code, addr);
 }
 
+unsigned long KSTK_ESP(struct task_struct *task)
+{
+        return (test_tsk_thread_flag(task, TIF_IA32)) ?
+                        (task_pt_regs(task)->sp) : ((task)->thread.usersp);
+}
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index a1a3cdda06e1..f93078746e00 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -436,6 +436,14 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5"),
                 },
         },
+        {       /* Handle problems with rebooting on Apple Macmini3,1 */
+                .callback = set_pci_reboot,
+                .ident = "Apple Macmini3,1",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini3,1"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index e09f0e2c14b5..2a34f9c5be21 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -660,6 +660,13 @@ static struct dmi_system_id __initdata bad_bios_dmi_table[] = {
                 },
         },
         {
+                .callback = dmi_low_memory_corruption,
+                .ident = "Phoenix/MSC BIOS",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix/MSC"),
+                },
+        },
+        {
         /*
          * AMI BIOS with low memory corruption was found on Intel DG45ID board.
          * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
index 503c1f2e8835..1740c85e24bb 100644
--- a/arch/x86/kernel/tlb_uv.c
+++ b/arch/x86/kernel/tlb_uv.c
@@ -23,8 +23,6 @@
 static struct bau_control       **uv_bau_table_bases __read_mostly;
 static int                      uv_bau_retry_limit __read_mostly;
 
-/* position of pnode (which is nasid>>1): */
-static int                      uv_nshift __read_mostly;
 /* base pnode in this partition */
 static int                      uv_partition_base_pnode __read_mostly;
 
@@ -723,7 +721,7 @@ uv_activation_descriptor_init(int node, int pnode)
         BUG_ON(!adp);
 
         pa = uv_gpa(adp); /* need the real nasid*/
-        n = pa >> uv_nshift;
+        n = uv_gpa_to_pnode(pa);
         m = pa & uv_mmask;
 
         uv_write_global_mmr64(pnode, UVH_LB_BAU_SB_DESCRIPTOR_BASE,
@@ -778,7 +776,7 @@ uv_payload_queue_init(int node, int pnode, struct bau_control *bau_tablesp)
          * need the pnode of where the memory was really allocated
          */
         pa = uv_gpa(pqp);
-        pn = pa >> uv_nshift;
+        pn = uv_gpa_to_pnode(pa);
         uv_write_global_mmr64(pnode,
                               UVH_LB_BAU_INTD_PAYLOAD_QUEUE_FIRST,
                               ((unsigned long)pn << UV_PAYLOADQ_PNODE_SHIFT) |
@@ -843,8 +841,7 @@ static int __init uv_bau_init(void)
                                        GFP_KERNEL, cpu_to_node(cur_cpu));
 
         uv_bau_retry_limit = 1;
-        uv_nshift = uv_hub_info->n_val;
-        uv_mmask = (1UL << uv_hub_info->n_val) - 1;
+        uv_mmask = (1UL << uv_hub_info->m_val) - 1;
         nblades = uv_num_possible_blades();
 
         uv_bau_table_bases = (struct bau_control **)
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 92929fb3f9fa..3c68fe2d46cf 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -305,6 +305,9 @@ SECTIONS
 
 
 #ifdef CONFIG_X86_32
+/*
+ * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility:
+ */
 . = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
            "kernel image bigger than KERNEL_IMAGE_SIZE");
 #else
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9b9695322f56..ae07d261527c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1692,7 +1692,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
         unsigned bank_num = mcg_cap & 0xff, bank;
 
         r = -EINVAL;
-        if (!bank_num)
+        if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
                 goto out;
         if (mcg_cap & ~(KVM_MCE_CAP_SUPPORTED | 0xff | 0xff0000))
                 goto out;
@@ -4051,7 +4051,7 @@ static int save_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
         return kvm_write_guest_virt(dtable.base + index*8, seg_desc, sizeof(*seg_desc), vcpu);
 }
 
-static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
+static gpa_t get_tss_base_addr(struct kvm_vcpu *vcpu,
                              struct desc_struct *seg_desc)
 {
         u32 base_addr = get_desc_base(seg_desc);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 334e63ca7b2b..2feb9bdedaaf 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -170,8 +170,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
                                 (unsigned long long)phys_addr,
                                 (unsigned long long)(phys_addr + size),
                                 prot_val, new_prot_val);
-                        free_memtype(phys_addr, phys_addr + size);
-                        return NULL;
+                        goto err_free_memtype;
                 }
                 prot_val = new_prot_val;
         }
@@ -197,26 +196,25 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
          */
         area = get_vm_area_caller(size, VM_IOREMAP, caller);
         if (!area)
-                return NULL;
+                goto err_free_memtype;
         area->phys_addr = phys_addr;
         vaddr = (unsigned long) area->addr;
 
-        if (kernel_map_sync_memtype(phys_addr, size, prot_val)) {
-                free_memtype(phys_addr, phys_addr + size);
-                free_vm_area(area);
-                return NULL;
-        }
+        if (kernel_map_sync_memtype(phys_addr, size, prot_val))
+                goto err_free_area;
 
-        if (ioremap_page_range(vaddr, vaddr + size, phys_addr, prot)) {
-                free_memtype(phys_addr, phys_addr + size);
-                free_vm_area(area);
-                return NULL;
-        }
+        if (ioremap_page_range(vaddr, vaddr + size, phys_addr, prot))
+                goto err_free_area;
 
         ret_addr = (void __iomem *) (vaddr + offset);
         mmiotrace_ioremap(unaligned_phys_addr, unaligned_size, ret_addr);
 
         return ret_addr;
+err_free_area:
+        free_vm_area(area);
+err_free_memtype:
+        free_memtype(phys_addr, phys_addr + size);
+        return NULL;
 }
 
 /**
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 3439616d69f1..dfbf70e65860 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -178,6 +178,7 @@ static __read_mostly unsigned int cpuid_leaf1_ecx_mask = ~0;
 static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                       unsigned int *cx, unsigned int *dx)
 {
+        unsigned maskebx = ~0;
         unsigned maskecx = ~0;
         unsigned maskedx = ~0;
 
@@ -185,9 +186,16 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
          * Mask out inconvenient features, to try and disable as many
          * unsupported kernel subsystems as possible.
          */
-        if (*ax == 1) {
+        switch (*ax) {
+        case 1:
                 maskecx = cpuid_leaf1_ecx_mask;
                 maskedx = cpuid_leaf1_edx_mask;
+                break;
+
+        case 0xb:
+                /* Suppress extended topology stuff */
+                maskebx = 0;
+                break;
         }
 
         asm(XEN_EMULATE_PREFIX "cpuid"
@@ -197,6 +205,7 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                   "=d" (*dx)
                 : "0" (*ax), "2" (*cx));
 
+        *bx &= maskebx;
         *cx &= maskecx;
         *dx &= maskedx;
 }
@@ -1075,6 +1084,8 @@ asmlinkage void __init xen_start_kernel(void)
          * Set up some pagetable state before starting to set any ptes.
          */
 
+        xen_init_mmu_ops();
+
         /* Prevent unwanted bits from being set in PTEs. */
         __supported_pte_mask &= ~_PAGE_GLOBAL;
         if (!xen_initial_domain())
@@ -1099,7 +1110,6 @@ asmlinkage void __init xen_start_kernel(void)
          */
         xen_setup_stackprotector();
 
-        xen_init_mmu_ops();
         xen_init_irq_ops();
         xen_init_cpuid_mask();