19 files changed, 152 insertions, 71 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ee2fb9d37745..f67e839f06c8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -860,7 +860,7 @@ source "kernel/Kconfig.preempt"
 
 config X86_UP_APIC
         bool "Local APIC support on uniprocessors"
-        depends on X86_32 && !SMP && !X86_32_NON_STANDARD
+        depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
         ---help---
           A local APIC (Advanced Programmable Interrupt Controller) is an
           integrated interrupt controller in the CPU. If you have a single-CPU
@@ -885,11 +885,11 @@ config X86_UP_IOAPIC
 
 config X86_LOCAL_APIC
         def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC || PCI_MSI
 
 config X86_IO_APIC
         def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI
 
 config X86_VISWS_APIC
         def_bool y
@@ -1033,6 +1033,7 @@ config X86_REBOOTFIXUPS
 
 config MICROCODE
         tristate "CPU microcode loading support"
+        depends on CPU_SUP_AMD || CPU_SUP_INTEL
         select FW_LOADER
         ---help---
 
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index d3f5c63078d8..89270b4318db 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -374,7 +374,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                  * Catch too early usage of this before alternatives
                  * have run.
                  */
-                asm goto("1: jmp %l[t_warn]\n"
+                asm_volatile_goto("1: jmp %l[t_warn]\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
                          " .long 1b - .\n"
@@ -388,7 +388,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
 
 #endif
 
-                asm goto("1: jmp %l[t_no]\n"
+                asm_volatile_goto("1: jmp %l[t_no]\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
                          " .long 1b - .\n"
@@ -453,7 +453,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
  * have. Thus, we force the jump to the widest, 4-byte, signed relative
  * offset even though the last would often fit in less bytes.
  */
-                asm goto("1: .byte 0xe9\n .long %l[t_dynamic] - 2f\n"
+                asm_volatile_goto("1: .byte 0xe9\n .long %l[t_dynamic] - 2f\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
                          " .long 1b - .\n"              /* src offset */
diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h
index 64507f35800c..6a2cefb4395a 100644
--- a/arch/x86/include/asm/jump_label.h
+++ b/arch/x86/include/asm/jump_label.h
@@ -18,7 +18,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:"
+        asm_volatile_goto("1:"
                 ".byte " __stringify(STATIC_KEY_INIT_NOP) "\n\t"
                 ".pushsection __jump_table,  \"aw\" \n\t"
                 _ASM_ALIGN "\n\t"
diff --git a/arch/x86/include/asm/mutex_64.h b/arch/x86/include/asm/mutex_64.h
index e7e6751648ed..07537a44216e 100644
--- a/arch/x86/include/asm/mutex_64.h
+++ b/arch/x86/include/asm/mutex_64.h
@@ -20,7 +20,7 @@
 static inline void __mutex_fastpath_lock(atomic_t *v,
                                          void (*fail_fn)(atomic_t *))
 {
-        asm volatile goto(LOCK_PREFIX "   decl %0\n"
+        asm_volatile_goto(LOCK_PREFIX "   decl %0\n"
                           "   jns %l[exit]\n"
                           : : "m" (v->counter)
                           : "memory", "cc"
@@ -75,7 +75,7 @@ static inline int __mutex_fastpath_lock_retval(atomic_t *count)
 static inline void __mutex_fastpath_unlock(atomic_t *v,
                                            void (*fail_fn)(atomic_t *))
 {
-        asm volatile goto(LOCK_PREFIX "   incl %0\n"
+        asm_volatile_goto(LOCK_PREFIX "   incl %0\n"
                           "   jg %l[exit]\n"
                           : : "m" (v->counter)
                           : "memory", "cc"
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 6aef9fbc09b7..b913915e8e63 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned long pfn)
         return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY;
 }
 
-static inline unsigned long mfn_to_pfn(unsigned long mfn)
+static inline unsigned long mfn_to_pfn_no_overrides(unsigned long mfn)
 {
         unsigned long pfn;
-        int ret = 0;
+        int ret;
 
         if (xen_feature(XENFEAT_auto_translated_physmap))
                 return mfn;
 
-        if (unlikely(mfn >= machine_to_phys_nr)) {
-                pfn = ~0;
-                goto try_override;
-        }
-        pfn = 0;
+        if (unlikely(mfn >= machine_to_phys_nr))
+                return ~0;
+
         /*
          * The array access can fail (e.g., device space beyond end of RAM).
          * In such cases it doesn't matter what we return (we return garbage),
          * but we must handle the fault without crashing!
          */
         ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
-try_override:
-        /* ret might be < 0 if there are no entries in the m2p for mfn */
         if (ret < 0)
-                pfn = ~0;
-        else if (get_phys_to_machine(pfn) != mfn)
+                return ~0;
+
+        return pfn;
+}
+
+static inline unsigned long mfn_to_pfn(unsigned long mfn)
+{
+        unsigned long pfn;
+
+        if (xen_feature(XENFEAT_auto_translated_physmap))
+                return mfn;
+
+        pfn = mfn_to_pfn_no_overrides(mfn);
+        if (get_phys_to_machine(pfn) != mfn) {
                 /*
                  * If this appears to be a foreign mfn (because the pfn
                  * doesn't map back to the mfn), then check the local override
@@ -111,6 +119,7 @@ try_override:
                  * m2p_find_override_pfn returns ~0 if it doesn't find anything.
                  */
                 pfn = m2p_find_override_pfn(mfn, ~0);
+        }
 
         /* 
          * pfn is ~0 if there are no entries in the m2p for mfn or if the
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 1191ac1c9d25..a419814cea57 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -113,7 +113,7 @@ static int __init early_get_pnodeid(void)
                 break;
         case UV3_HUB_PART_NUMBER:
         case UV3_HUB_PART_NUMBER_X:
-                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
+                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
                 break;
         }
 
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 8355c84b9729..9d8449158cf9 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1506,7 +1506,7 @@ static int __init init_hw_perf_events(void)
                 err = amd_pmu_init();
                 break;
         default:
-                return 0;
+                err = -ENOTSUPP;
         }
         if (err != 0) {
                 pr_cont("no PMU driver, software events only.\n");
@@ -1883,26 +1883,21 @@ static struct pmu pmu = {
 
 void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
 {
-        userpg->cap_usr_time = 0;
-        userpg->cap_usr_time_zero = 0;
-        userpg->cap_usr_rdpmc = x86_pmu.attr_rdpmc;
+        userpg->cap_user_time = 0;
+        userpg->cap_user_time_zero = 0;
+        userpg->cap_user_rdpmc = x86_pmu.attr_rdpmc;
         userpg->pmc_width = x86_pmu.cntval_bits;
 
-        if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC))
-                return;
-
-        if (!boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
+        if (!sched_clock_stable)
                 return;
 
-        userpg->cap_usr_time = 1;
+        userpg->cap_user_time = 1;
         userpg->time_mult = this_cpu_read(cyc2ns);
         userpg->time_shift = CYC2NS_SCALE_FACTOR;
         userpg->time_offset = this_cpu_read(cyc2ns_offset) - now;
 
-        if (sched_clock_stable && !check_tsc_disabled()) {
-                userpg->cap_usr_time_zero = 1;
-                userpg->time_zero = this_cpu_read(cyc2ns_offset);
-        }
+        userpg->cap_user_time_zero = 1;
+        userpg->time_zero = this_cpu_read(cyc2ns_offset);
 }
 
 /*
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 9db76c31b3c3..f31a1655d1ff 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2325,6 +2325,7 @@ __init int intel_pmu_init(void)
                 break;
 
         case 55: /* Atom 22nm "Silvermont" */
+        case 77: /* Avoton "Silvermont" */
                 memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
                         sizeof(hw_cache_event_ids));
                 memcpy(hw_cache_extra_regs, slm_hw_cache_extra_regs,
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 8ed44589b0e4..4118f9f68315 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -2706,14 +2706,14 @@ static void uncore_pmu_init_hrtimer(struct intel_uncore_box *box)
         box->hrtimer.function = uncore_pmu_hrtimer;
 }
 
-struct intel_uncore_box *uncore_alloc_box(struct intel_uncore_type *type, int cpu)
+static struct intel_uncore_box *uncore_alloc_box(struct intel_uncore_type *type, int node)
 {
         struct intel_uncore_box *box;
         int i, size;
 
         size = sizeof(*box) + type->num_shared_regs * sizeof(struct intel_uncore_extra_reg);
 
-        box = kzalloc_node(size, GFP_KERNEL, cpu_to_node(cpu));
+        box = kzalloc_node(size, GFP_KERNEL, node);
         if (!box)
                 return NULL;
 
@@ -3031,7 +3031,7 @@ static int uncore_validate_group(struct intel_uncore_pmu *pmu,
         struct intel_uncore_box *fake_box;
         int ret = -EINVAL, n;
 
-        fake_box = uncore_alloc_box(pmu->type, smp_processor_id());
+        fake_box = uncore_alloc_box(pmu->type, NUMA_NO_NODE);
         if (!fake_box)
                 return -ENOMEM;
 
@@ -3294,7 +3294,7 @@ static int uncore_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id
         }
 
         type = pci_uncores[UNCORE_PCI_DEV_TYPE(id->driver_data)];
-        box = uncore_alloc_box(type, 0);
+        box = uncore_alloc_box(type, NUMA_NO_NODE);
         if (!box)
                 return -ENOMEM;
 
@@ -3499,7 +3499,7 @@ static int uncore_cpu_prepare(int cpu, int phys_id)
                         if (pmu->func_id < 0)
                                 pmu->func_id = j;
 
-                        box = uncore_alloc_box(type, cpu);
+                        box = uncore_alloc_box(type, cpu_to_node(cpu));
                         if (!box)
                                 return -ENOMEM;
 
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 697b93af02dd..a0e2a8a80c94 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -775,11 +775,22 @@ void __init kvm_spinlock_init(void)
         if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
                 return;
 
-        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
+        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
+        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+}
+
+static __init int kvm_spinlock_init_jump(void)
+{
+        if (!kvm_para_available())
+                return 0;
+        if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
+                return 0;
 
         static_key_slow_inc(&paravirt_ticketlocks_enabled);
+        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
 
-        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
-        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+        return 0;
 }
+early_initcall(kvm_spinlock_init_jump);
+
 #endif  /* CONFIG_PARAVIRT_SPINLOCKS */
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 7123b5df479d..af99f71aeb7f 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -216,6 +216,7 @@ int apply_microcode_amd(int cpu)
         /* need to apply patch? */
         if (rev >= mc_amd->hdr.patch_id) {
                 c->microcode = rev;
+                uci->cpu_sig.rev = rev;
                 return 0;
         }
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 563ed91e6faa..7e920bff99a3 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -326,6 +326,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6320"),
                 },
         },
+        {       /* Handle problems with rebooting on the Latitude E5410. */
+                .callback = set_pci_reboot,
+                .ident = "Dell Latitude E5410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5410"),
+                },
+        },
         {       /* Handle problems with rebooting on the Latitude E5420. */
                 .callback = set_pci_reboot,
                 .ident = "Dell Latitude E5420",
@@ -352,12 +360,28 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
         },
         {       /* Handle problems with rebooting on the Precision M6600. */
                 .callback = set_pci_reboot,
-                .ident = "Dell OptiPlex 990",
+                .ident = "Dell Precision M6600",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
                 },
         },
+        {       /* Handle problems with rebooting on the Dell PowerEdge C6100. */
+                .callback = set_pci_reboot,
+                .ident = "Dell PowerEdge C6100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "C6100"),
+                },
+        },
+        {       /* Some C6100 machines were shipped with vendor being 'Dell'. */
+                .callback = set_pci_reboot,
+                .ident = "Dell PowerEdge C6100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "C6100"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
index 22513e96b012..86179d409893 100644
--- a/arch/x86/kernel/sysfb_simplefb.c
+++ b/arch/x86/kernel/sysfb_simplefb.c
@@ -72,14 +72,14 @@ __init int create_simplefb(const struct screen_info *si,
          * the part that is occupied by the framebuffer */
         len = mode->height * mode->stride;
         len = PAGE_ALIGN(len);
-        if (len > si->lfb_size << 16) {
+        if (len > (u64)si->lfb_size << 16) {
                 printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
                 return -EINVAL;
         }
 
         /* setup IORESOURCE_MEM as framebuffer memory */
         memset(&res, 0, sizeof(res));
-        res.flags = IORESOURCE_MEM;
+        res.flags = IORESOURCE_MEM | IORESOURCE_BUSY;
         res.name = simplefb_resname;
         res.start = si->lfb_base;
         res.end = si->lfb_base + len - 1;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a1216de9ffda..2b2fce1b2009 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3255,25 +3255,29 @@ static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
 
 static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
 {
+        struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+
         if (!test_bit(VCPU_EXREG_PDPTR,
                       (unsigned long *)&vcpu->arch.regs_dirty))
                 return;
 
         if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
-                vmcs_write64(GUEST_PDPTR0, vcpu->arch.mmu.pdptrs[0]);
-                vmcs_write64(GUEST_PDPTR1, vcpu->arch.mmu.pdptrs[1]);
-                vmcs_write64(GUEST_PDPTR2, vcpu->arch.mmu.pdptrs[2]);
-                vmcs_write64(GUEST_PDPTR3, vcpu->arch.mmu.pdptrs[3]);
+                vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
+                vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
+                vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
+                vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
         }
 }
 
 static void ept_save_pdptrs(struct kvm_vcpu *vcpu)
 {
+        struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+
         if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
-                vcpu->arch.mmu.pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
-                vcpu->arch.mmu.pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
-                vcpu->arch.mmu.pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
-                vcpu->arch.mmu.pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
+                mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
+                mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
+                mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
+                mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
         }
 
         __set_bit(VCPU_EXREG_PDPTR,
@@ -5345,7 +5349,9 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
          * There are errata that may cause this bit to not be set:
          * AAK134, BY25.
          */
-        if (exit_qualification & INTR_INFO_UNBLOCK_NMI)
+        if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+                        cpu_has_virtual_nmis() &&
+                        (exit_qualification & INTR_INFO_UNBLOCK_NMI))
                 vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
 
         gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
@@ -7775,10 +7781,6 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                 vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
                 vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
                 vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
-                __clear_bit(VCPU_EXREG_PDPTR,
-                                (unsigned long *)&vcpu->arch.regs_avail);
-                __clear_bit(VCPU_EXREG_PDPTR,
-                                (unsigned long *)&vcpu->arch.regs_dirty);
         }
 
         kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
index 5596c7bdd327..082e88129712 100644
--- a/arch/x86/pci/mmconfig-shared.c
+++ b/arch/x86/pci/mmconfig-shared.c
@@ -700,7 +700,7 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
         if (!(pci_probe & PCI_PROBE_MMCONF) || pci_mmcfg_arch_init_failed)
                 return -ENODEV;
 
-        if (start > end || !addr)
+        if (start > end)
                 return -EINVAL;
 
         mutex_lock(&pci_mmcfg_lock);
@@ -716,6 +716,11 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
                 return -EEXIST;
         }
 
+        if (!addr) {
+                mutex_unlock(&pci_mmcfg_lock);
+                return -EINVAL;
+        }
+
         rc = -EBUSY;
         cfg = pci_mmconfig_alloc(seg, start, end, addr);
         if (cfg == NULL) {
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 90f6ed127096..c7e22ab29a5a 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -912,10 +912,13 @@ void __init efi_enter_virtual_mode(void)
 
         for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                 md = p;
-                if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
-                    md->type != EFI_BOOT_SERVICES_CODE &&
-                    md->type != EFI_BOOT_SERVICES_DATA)
-                        continue;
+                if (!(md->attribute & EFI_MEMORY_RUNTIME)) {
+#ifdef CONFIG_X86_64
+                        if (md->type != EFI_BOOT_SERVICES_CODE &&
+                            md->type != EFI_BOOT_SERVICES_DATA)
+#endif
+                                continue;
+                }
 
                 size = md->num_pages << EFI_PAGE_SHIFT;
                 end = md->phys_addr + size;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 8b901e8d782d..a61c7d5811be 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -879,7 +879,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
-        int ret = 0;
 
         pfn = page_to_pfn(page);
         if (!PageHighMem(page)) {
@@ -926,8 +925,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
          * frontend pages while they are being shared with the backend,
          * because mfn_to_pfn (that ends up being called by GUPF) will
          * return the backend pfn rather than the frontend pfn. */
-        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
-        if (ret == 0 && get_phys_to_machine(pfn) == mfn)
+        pfn = mfn_to_pfn_no_overrides(mfn);
+        if (get_phys_to_machine(pfn) == mfn)
                 set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
 
         return 0;
@@ -942,7 +941,6 @@ int m2p_remove_override(struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
-        int ret = 0;
 
         pfn = page_to_pfn(page);
         mfn = get_phys_to_machine(pfn);
@@ -1029,8 +1027,8 @@ int m2p_remove_override(struct page *page,
          * the original pfn causes mfn_to_pfn(mfn) to return the frontend
          * pfn again. */
         mfn &= ~FOREIGN_FRAME_BIT;
-        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
-        if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+        pfn = mfn_to_pfn_no_overrides(mfn);
+        if (get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
                         m2p_find_override(mfn) == NULL)
                 set_phys_to_machine(pfn, mfn);
 
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index d1e4777b4e75..31d04758b76f 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -278,6 +278,15 @@ static void __init xen_smp_prepare_boot_cpu(void)
                    old memory can be recycled */
                 make_lowmem_page_readwrite(xen_initial_gdt);
 
+#ifdef CONFIG_X86_32
+                /*
+                 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
+                 * expects __USER_DS
+                 */
+                loadsegment(ds, __USER_DS);
+                loadsegment(es, __USER_DS);
+#endif
+
                 xen_filter_cpu_maps();
                 xen_setup_vcpu_info_placement();
         }
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 253f63fceea1..be6b86078957 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -259,6 +259,14 @@ void xen_uninit_lock_cpu(int cpu)
 }
 
 
+/*
+ * Our init of PV spinlocks is split in two init functions due to us
+ * using paravirt patching and jump labels patching and having to do
+ * all of this before SMP code is invoked.
+ *
+ * The paravirt patching needs to be done _before_ the alternative asm code
+ * is started, otherwise we would not patch the core kernel code.
+ */
 void __init xen_init_spinlocks(void)
 {
 
@@ -267,12 +275,26 @@ void __init xen_init_spinlocks(void)
                 return;
         }
 
-        static_key_slow_inc(&paravirt_ticketlocks_enabled);
-
         pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(xen_lock_spinning);
         pv_lock_ops.unlock_kick = xen_unlock_kick;
 }
 
+/*
+ * While the jump_label init code needs to happend _after_ the jump labels are
+ * enabled and before SMP is started. Hence we use pre-SMP initcall level
+ * init. We cannot do it in xen_init_spinlocks as that is done before
+ * jump labels are activated.
+ */
+static __init int xen_init_spinlocks_jump(void)
+{
+        if (!xen_pvspin)
+                return 0;
+
+        static_key_slow_inc(&paravirt_ticketlocks_enabled);
+        return 0;
+}
+early_initcall(xen_init_spinlocks_jump);
+
 static __init int xen_parse_nopvspin(char *arg)
 {
         xen_pvspin = false;