8 files changed, 253 insertions, 46 deletions

diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
index e69182fd01cf..4b28159e0421 100644
--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -87,7 +87,9 @@ static long acpi_processor_ffh_cstate_probe_cpu(void *_cx)
         num_cstate_subtype = edx_part & MWAIT_SUBSTATE_MASK;
 
         retval = 0;
-        if (num_cstate_subtype < (cx->address & MWAIT_SUBSTATE_MASK)) {
+        /* If the HW does not support any sub-states in this C-state */
+        if (num_cstate_subtype == 0) {
+                pr_warn(FW_BUG "ACPI MWAIT C-state 0x%x not supported by HW (0x%x)\n", cx->address, edx_part);
                 retval = -1;
                 goto out;
         }
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 481ae38f6a44..ad28db7e6bde 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1996,7 +1996,8 @@ static inline void __smp_error_interrupt(struct pt_regs *regs)
         };
 
         /* First tickle the hardware, only then report what went on. -- REW */
-        apic_write(APIC_ESR, 0);
+        if (lapic_get_maxlvt() > 3)     /* Due to the Pentium erratum 3AP. */
+                apic_write(APIC_ESR, 0);
         v = apic_read(APIC_ESR);
         ack_APIC_irq();
         atomic_inc(&irq_err_count);
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 9b7734b1f975..eeee23ff75ef 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -89,6 +89,9 @@ static DECLARE_WAIT_QUEUE_HEAD(mce_chrdev_wait);
 static DEFINE_PER_CPU(struct mce, mces_seen);
 static int                      cpu_missing;
 
+/* CMCI storm detection filter */
+static DEFINE_PER_CPU(unsigned long, mce_polled_error);
+
 /*
  * MCA banks polled by the period polling timer for corrected events.
  * With Intel CMCI, this only has MCA banks which do not support CMCI (if any).
@@ -595,6 +598,7 @@ void machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
 {
         struct mce m;
         int i;
+        unsigned long *v;
 
         this_cpu_inc(mce_poll_count);
 
@@ -614,6 +618,8 @@ void machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
                 if (!(m.status & MCI_STATUS_VAL))
                         continue;
 
+                v = &get_cpu_var(mce_polled_error);
+                set_bit(0, v);
                 /*
                  * Uncorrected or signalled events are handled by the exception
                  * handler when it is enabled, so don't process those here.
@@ -1278,10 +1284,18 @@ static unsigned long mce_adjust_timer_default(unsigned long interval)
 static unsigned long (*mce_adjust_timer)(unsigned long interval) =
         mce_adjust_timer_default;
 
+static int cmc_error_seen(void)
+{
+        unsigned long *v = &__get_cpu_var(mce_polled_error);
+
+        return test_and_clear_bit(0, v);
+}
+
 static void mce_timer_fn(unsigned long data)
 {
         struct timer_list *t = &__get_cpu_var(mce_timer);
         unsigned long iv;
+        int notify;
 
         WARN_ON(smp_processor_id() != data);
 
@@ -1296,7 +1310,9 @@ static void mce_timer_fn(unsigned long data)
          * polling interval, otherwise increase the polling interval.
          */
         iv = __this_cpu_read(mce_next_interval);
-        if (mce_notify_irq()) {
+        notify = mce_notify_irq();
+        notify |= cmc_error_seen();
+        if (notify) {
                 iv = max(iv / 2, (unsigned long) HZ/100);
         } else {
                 iv = min(iv * 2, round_jiffies_relative(check_interval * HZ));
diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c
index fb6156fee6f7..3bdb95ae8c43 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c
@@ -9,6 +9,7 @@
 #include <linux/interrupt.h>
 #include <linux/percpu.h>
 #include <linux/sched.h>
+#include <linux/cpumask.h>
 #include <asm/apic.h>
 #include <asm/processor.h>
 #include <asm/msr.h>
@@ -137,6 +138,22 @@ unsigned long mce_intel_adjust_timer(unsigned long interval)
         }
 }
 
+static void cmci_storm_disable_banks(void)
+{
+        unsigned long flags, *owned;
+        int bank;
+        u64 val;
+
+        raw_spin_lock_irqsave(&cmci_discover_lock, flags);
+        owned = __get_cpu_var(mce_banks_owned);
+        for_each_set_bit(bank, owned, MAX_NR_BANKS) {
+                rdmsrl(MSR_IA32_MCx_CTL2(bank), val);
+                val &= ~MCI_CTL2_CMCI_EN;
+                wrmsrl(MSR_IA32_MCx_CTL2(bank), val);
+        }
+        raw_spin_unlock_irqrestore(&cmci_discover_lock, flags);
+}
+
 static bool cmci_storm_detect(void)
 {
         unsigned int cnt = __this_cpu_read(cmci_storm_cnt);
@@ -158,7 +175,7 @@ static bool cmci_storm_detect(void)
         if (cnt <= CMCI_STORM_THRESHOLD)
                 return false;
 
-        cmci_clear();
+        cmci_storm_disable_banks();
         __this_cpu_write(cmci_storm_state, CMCI_STORM_ACTIVE);
         r = atomic_add_return(1, &cmci_storm_on_cpus);
         mce_timer_kick(CMCI_POLL_INTERVAL);
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 6d7d5a1260a6..b0cc3809723d 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -225,7 +225,7 @@ static void __init intel_remapping_check(int num, int slot, int func)
  *
  * And yes, so far on current devices the base addr is always under 4G.
  */
-static u32 __init intel_stolen_base(int num, int slot, int func)
+static u32 __init intel_stolen_base(int num, int slot, int func, size_t stolen_size)
 {
         u32 base;
 
@@ -244,6 +244,114 @@ static u32 __init intel_stolen_base(int num, int slot, int func)
 #define MB(x)   (KB (KB (x)))
 #define GB(x)   (MB (KB (x)))
 
+static size_t __init i830_tseg_size(void)
+{
+        u8 tmp = read_pci_config_byte(0, 0, 0, I830_ESMRAMC);
+
+        if (!(tmp & TSEG_ENABLE))
+                return 0;
+
+        if (tmp & I830_TSEG_SIZE_1M)
+                return MB(1);
+        else
+                return KB(512);
+}
+
+static size_t __init i845_tseg_size(void)
+{
+        u8 tmp = read_pci_config_byte(0, 0, 0, I845_ESMRAMC);
+
+        if (!(tmp & TSEG_ENABLE))
+                return 0;
+
+        switch (tmp & I845_TSEG_SIZE_MASK) {
+        case I845_TSEG_SIZE_512K:
+                return KB(512);
+        case I845_TSEG_SIZE_1M:
+                return MB(1);
+        default:
+                WARN_ON(1);
+                return 0;
+        }
+}
+
+static size_t __init i85x_tseg_size(void)
+{
+        u8 tmp = read_pci_config_byte(0, 0, 0, I85X_ESMRAMC);
+
+        if (!(tmp & TSEG_ENABLE))
+                return 0;
+
+        return MB(1);
+}
+
+static size_t __init i830_mem_size(void)
+{
+        return read_pci_config_byte(0, 0, 0, I830_DRB3) * MB(32);
+}
+
+static size_t __init i85x_mem_size(void)
+{
+        return read_pci_config_byte(0, 0, 1, I85X_DRB3) * MB(32);
+}
+
+/*
+ * On 830/845/85x the stolen memory base isn't available in any
+ * register. We need to calculate it as TOM-TSEG_SIZE-stolen_size.
+ */
+static u32 __init i830_stolen_base(int num, int slot, int func, size_t stolen_size)
+{
+        return i830_mem_size() - i830_tseg_size() - stolen_size;
+}
+
+static u32 __init i845_stolen_base(int num, int slot, int func, size_t stolen_size)
+{
+        return i830_mem_size() - i845_tseg_size() - stolen_size;
+}
+
+static u32 __init i85x_stolen_base(int num, int slot, int func, size_t stolen_size)
+{
+        return i85x_mem_size() - i85x_tseg_size() - stolen_size;
+}
+
+static u32 __init i865_stolen_base(int num, int slot, int func, size_t stolen_size)
+{
+        /*
+         * FIXME is the graphics stolen memory region
+         * always at TOUD? Ie. is it always the last
+         * one to be allocated by the BIOS?
+         */
+        return read_pci_config_16(0, 0, 0, I865_TOUD) << 16;
+}
+
+static size_t __init i830_stolen_size(int num, int slot, int func)
+{
+        size_t stolen_size;
+        u16 gmch_ctrl;
+
+        gmch_ctrl = read_pci_config_16(0, 0, 0, I830_GMCH_CTRL);
+
+        switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
+        case I830_GMCH_GMS_STOLEN_512:
+                stolen_size = KB(512);
+                break;
+        case I830_GMCH_GMS_STOLEN_1024:
+                stolen_size = MB(1);
+                break;
+        case I830_GMCH_GMS_STOLEN_8192:
+                stolen_size = MB(8);
+                break;
+        case I830_GMCH_GMS_LOCAL:
+                /* local memory isn't part of the normal address space */
+                stolen_size = 0;
+                break;
+        default:
+                return 0;
+        }
+
+        return stolen_size;
+}
+
 static size_t __init gen3_stolen_size(int num, int slot, int func)
 {
         size_t stolen_size;
@@ -310,7 +418,7 @@ static size_t __init gen6_stolen_size(int num, int slot, int func)
         return gmch_ctrl << 25; /* 32 MB units */
 }
 
-static inline size_t gen8_stolen_size(int num, int slot, int func)
+static size_t gen8_stolen_size(int num, int slot, int func)
 {
         u16 gmch_ctrl;
 
@@ -320,31 +428,74 @@ static inline size_t gen8_stolen_size(int num, int slot, int func)
         return gmch_ctrl << 25; /* 32 MB units */
 }
 
-typedef size_t (*stolen_size_fn)(int num, int slot, int func);
+
+struct intel_stolen_funcs {
+        size_t (*size)(int num, int slot, int func);
+        u32 (*base)(int num, int slot, int func, size_t size);
+};
+
+static const struct intel_stolen_funcs i830_stolen_funcs = {
+        .base = i830_stolen_base,
+        .size = i830_stolen_size,
+};
+
+static const struct intel_stolen_funcs i845_stolen_funcs = {
+        .base = i845_stolen_base,
+        .size = i830_stolen_size,
+};
+
+static const struct intel_stolen_funcs i85x_stolen_funcs = {
+        .base = i85x_stolen_base,
+        .size = gen3_stolen_size,
+};
+
+static const struct intel_stolen_funcs i865_stolen_funcs = {
+        .base = i865_stolen_base,
+        .size = gen3_stolen_size,
+};
+
+static const struct intel_stolen_funcs gen3_stolen_funcs = {
+        .base = intel_stolen_base,
+        .size = gen3_stolen_size,
+};
+
+static const struct intel_stolen_funcs gen6_stolen_funcs = {
+        .base = intel_stolen_base,
+        .size = gen6_stolen_size,
+};
+
+static const struct intel_stolen_funcs gen8_stolen_funcs = {
+        .base = intel_stolen_base,
+        .size = gen8_stolen_size,
+};
 
 static struct pci_device_id intel_stolen_ids[] __initdata = {
-        INTEL_I915G_IDS(gen3_stolen_size),
-        INTEL_I915GM_IDS(gen3_stolen_size),
-        INTEL_I945G_IDS(gen3_stolen_size),
-        INTEL_I945GM_IDS(gen3_stolen_size),
-        INTEL_VLV_M_IDS(gen6_stolen_size),
-        INTEL_VLV_D_IDS(gen6_stolen_size),
-        INTEL_PINEVIEW_IDS(gen3_stolen_size),
-        INTEL_I965G_IDS(gen3_stolen_size),
-        INTEL_G33_IDS(gen3_stolen_size),
-        INTEL_I965GM_IDS(gen3_stolen_size),
-        INTEL_GM45_IDS(gen3_stolen_size),
-        INTEL_G45_IDS(gen3_stolen_size),
-        INTEL_IRONLAKE_D_IDS(gen3_stolen_size),
-        INTEL_IRONLAKE_M_IDS(gen3_stolen_size),
-        INTEL_SNB_D_IDS(gen6_stolen_size),
-        INTEL_SNB_M_IDS(gen6_stolen_size),
-        INTEL_IVB_M_IDS(gen6_stolen_size),
-        INTEL_IVB_D_IDS(gen6_stolen_size),
-        INTEL_HSW_D_IDS(gen6_stolen_size),
-        INTEL_HSW_M_IDS(gen6_stolen_size),
-        INTEL_BDW_M_IDS(gen8_stolen_size),
-        INTEL_BDW_D_IDS(gen8_stolen_size)
+        INTEL_I830_IDS(&i830_stolen_funcs),
+        INTEL_I845G_IDS(&i845_stolen_funcs),
+        INTEL_I85X_IDS(&i85x_stolen_funcs),
+        INTEL_I865G_IDS(&i865_stolen_funcs),
+        INTEL_I915G_IDS(&gen3_stolen_funcs),
+        INTEL_I915GM_IDS(&gen3_stolen_funcs),
+        INTEL_I945G_IDS(&gen3_stolen_funcs),
+        INTEL_I945GM_IDS(&gen3_stolen_funcs),
+        INTEL_VLV_M_IDS(&gen6_stolen_funcs),
+        INTEL_VLV_D_IDS(&gen6_stolen_funcs),
+        INTEL_PINEVIEW_IDS(&gen3_stolen_funcs),
+        INTEL_I965G_IDS(&gen3_stolen_funcs),
+        INTEL_G33_IDS(&gen3_stolen_funcs),
+        INTEL_I965GM_IDS(&gen3_stolen_funcs),
+        INTEL_GM45_IDS(&gen3_stolen_funcs),
+        INTEL_G45_IDS(&gen3_stolen_funcs),
+        INTEL_IRONLAKE_D_IDS(&gen3_stolen_funcs),
+        INTEL_IRONLAKE_M_IDS(&gen3_stolen_funcs),
+        INTEL_SNB_D_IDS(&gen6_stolen_funcs),
+        INTEL_SNB_M_IDS(&gen6_stolen_funcs),
+        INTEL_IVB_M_IDS(&gen6_stolen_funcs),
+        INTEL_IVB_D_IDS(&gen6_stolen_funcs),
+        INTEL_HSW_D_IDS(&gen6_stolen_funcs),
+        INTEL_HSW_M_IDS(&gen6_stolen_funcs),
+        INTEL_BDW_M_IDS(&gen8_stolen_funcs),
+        INTEL_BDW_D_IDS(&gen8_stolen_funcs)
 };
 
 static void __init intel_graphics_stolen(int num, int slot, int func)
@@ -361,11 +512,13 @@ static void __init intel_graphics_stolen(int num, int slot, int func)
 
         for (i = 0; i < ARRAY_SIZE(intel_stolen_ids); i++) {
                 if (intel_stolen_ids[i].device == device) {
-                        stolen_size_fn stolen_size =
-                                (stolen_size_fn)intel_stolen_ids[i].driver_data;
-                        size = stolen_size(num, slot, func);
-                        start = intel_stolen_base(num, slot, func);
+                        const struct intel_stolen_funcs *stolen_funcs =
+                                (const struct intel_stolen_funcs *)intel_stolen_ids[i].driver_data;
+                        size = stolen_funcs->size(num, slot, func);
+                        start = stolen_funcs->base(num, slot, func, size);
                         if (size && start) {
+                                printk(KERN_INFO "Reserving Intel graphics stolen memory at 0x%x-0x%x\n",
+                                       start, start + (u32)size - 1);
                                 /* Mark this space as reserved */
                                 e820_add_region(start, size, E820_RESERVED);
                                 sanitize_e820_map(e820.map,
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 42805fac0092..283a76a9cc40 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -125,7 +125,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
                 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
         seq_printf(p, "  Machine check polls\n");
 #endif
-#if defined(CONFIG_HYPERV) || defined(CONFIG_XEN)
+#if IS_ENABLED(CONFIG_HYPERV) || defined(CONFIG_XEN)
         seq_printf(p, "%*s: ", prec, "THR");
         for_each_online_cpu(j)
                 seq_printf(p, "%10u ", irq_stats(j)->irq_hv_callback_count);
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ebc987398923..af1d14a9ebda 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
                 }
         }
 
+        /*
+         * On x86-64 we do not support 16-bit segments due to
+         * IRET leaking the high bits of the kernel stack address.
+         */
+#ifdef CONFIG_X86_64
+        if (!ldt_info.seg_32bit) {
+                error = -EINVAL;
+                goto out_unlock;
+        }
+#endif
+
         fill_ldt(&ldt, &ldt_info);
         if (oldmode)
                 ldt.avl = 0;
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index 299d49302e7d..0497f719977d 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -1207,23 +1207,31 @@ error:
         return ret;
 }
 
-static inline int __init determine_tce_table_size(u64 ram)
+static inline int __init determine_tce_table_size(void)
 {
         int ret;
 
         if (specified_table_size != TCE_TABLE_SIZE_UNSPECIFIED)
                 return specified_table_size;
 
-        /*
-         * Table sizes are from 0 to 7 (TCE_TABLE_SIZE_64K to
-         * TCE_TABLE_SIZE_8M). Table size 0 has 8K entries and each
-         * larger table size has twice as many entries, so shift the
-         * max ram address by 13 to divide by 8K and then look at the
-         * order of the result to choose between 0-7.
-         */
-        ret = get_order(ram >> 13);
-        if (ret > TCE_TABLE_SIZE_8M)
+        if (is_kdump_kernel() && saved_max_pfn) {
+                /*
+                 * Table sizes are from 0 to 7 (TCE_TABLE_SIZE_64K to
+                 * TCE_TABLE_SIZE_8M). Table size 0 has 8K entries and each
+                 * larger table size has twice as many entries, so shift the
+                 * max ram address by 13 to divide by 8K and then look at the
+                 * order of the result to choose between 0-7.
+                 */
+                ret = get_order((saved_max_pfn * PAGE_SIZE) >> 13);
+                if (ret > TCE_TABLE_SIZE_8M)
+                        ret = TCE_TABLE_SIZE_8M;
+        } else {
+                /*
+                 * Use 8M by default (suggested by Muli) if it's not
+                 * kdump kernel and saved_max_pfn isn't set.
+                 */
                 ret = TCE_TABLE_SIZE_8M;
+        }
 
         return ret;
 }
@@ -1418,8 +1426,7 @@ int __init detect_calgary(void)
                 return -ENOMEM;
         }
 
-        specified_table_size = determine_tce_table_size((is_kdump_kernel() ?
-                                        saved_max_pfn : max_pfn) * PAGE_SIZE);
+        specified_table_size = determine_tce_table_size();
 
         for (bus = 0; bus < MAX_PHB_BUS_NUM; bus++) {
                 struct calgary_bus_info *info = &bus_info[bus];