Merge tag 'for-linus-4.8-rc0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen updates from David Vrabel:
 "Features and fixes for 4.8-rc0:

   - ACPI support for guests on ARM platforms.
   - Generic steal time support for arm and x86.
   - Support cases where kernel cpu is not Xen VCPU number (e.g., if
     in-guest kexec is used).
   - Use the system workqueue instead of a custom workqueue in various
     places"

* tag 'for-linus-4.8-rc0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: (47 commits)
  xen: add static initialization of steal_clock op to xen_time_ops
  xen/pvhvm: run xen_vcpu_setup() for the boot CPU
  xen/evtchn: use xen_vcpu_id mapping
  xen/events: fifo: use xen_vcpu_id mapping
  xen/events: use xen_vcpu_id mapping in events_base
  x86/xen: use xen_vcpu_id mapping when pointing vcpu_info to shared_info
  x86/xen: use xen_vcpu_id mapping for HYPERVISOR_vcpu_op
  xen: introduce xen_vcpu_id mapping
  x86/acpi: store ACPI ids from MADT for future usage
  x86/xen: update cpuid.h from Xen-4.7
  xen/evtchn: add IOCTL_EVTCHN_RESTRICT
  xen-blkback: really don't leak mode property
  xen-blkback: constify instance of "struct attribute_group"
  xen-blkfront: prefer xenbus_scanf() over xenbus_gather()
  xen-blkback: prefer xenbus_scanf() over xenbus_gather()
  xen: support runqueue steal time on xen
  arm/xen: add support for vm_assist hypercall
  xen: update xen headers
  xen-pciback: drop superfluous variables
  xen-pciback: short-circuit read path used for merging write values
  ...

18 files changed, 428 insertions, 242 deletions

diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 979a8317204f..f15bb3b789d5 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -275,7 +275,7 @@ config XEN_HAVE_PVMMU
 
 config XEN_EFI
         def_bool y
-        depends on X86_64 && EFI
+        depends on (ARM || ARM64 || X86_64) && EFI
 
 config XEN_AUTO_XLATE
         def_bool y
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 030e91b38e32..8feab810aed9 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -10,6 +10,7 @@ CFLAGS_features.o			:= $(nostackp)
 CFLAGS_efi.o                            += -fshort-wchar
 LDFLAGS                                 += $(call ld-option, --no-wchar-size-warning)
 
+dom0-$(CONFIG_ARM64) += arm-device.o
 dom0-$(CONFIG_PCI) += pci.o
 dom0-$(CONFIG_USB_SUPPORT) += dbgp.o
 dom0-$(CONFIG_XEN_ACPI) += acpi.o $(xen-pad-y)
diff --git a/drivers/xen/arm-device.c b/drivers/xen/arm-device.c
new file mode 100644
index 000000000000..778acf80aacb
--- /dev/null
+++ b/drivers/xen/arm-device.c
@@ -0,0 +1,196 @@
+/*
+ * Copyright (c) 2015, Linaro Limited, Shannon Zhao
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/acpi.h>
+#include <xen/xen.h>
+#include <xen/page.h>
+#include <xen/interface/memory.h>
+#include <asm/xen/hypervisor.h>
+#include <asm/xen/hypercall.h>
+
+static int xen_unmap_device_mmio(const struct resource *resources,
+                                 unsigned int count)
+{
+        unsigned int i, j, nr;
+        int rc = 0;
+        const struct resource *r;
+        struct xen_remove_from_physmap xrp;
+
+        for (i = 0; i < count; i++) {
+                r = &resources[i];
+                nr = DIV_ROUND_UP(resource_size(r), XEN_PAGE_SIZE);
+                if ((resource_type(r) != IORESOURCE_MEM) || (nr == 0))
+                        continue;
+
+                for (j = 0; j < nr; j++) {
+                        xrp.domid = DOMID_SELF;
+                        xrp.gpfn = XEN_PFN_DOWN(r->start) + j;
+                        rc = HYPERVISOR_memory_op(XENMEM_remove_from_physmap,
+                                                  &xrp);
+                        if (rc)
+                                return rc;
+                }
+        }
+
+        return rc;
+}
+
+static int xen_map_device_mmio(const struct resource *resources,
+                               unsigned int count)
+{
+        unsigned int i, j, nr;
+        int rc = 0;
+        const struct resource *r;
+        xen_pfn_t *gpfns;
+        xen_ulong_t *idxs;
+        int *errs;
+        struct xen_add_to_physmap_range xatp;
+
+        for (i = 0; i < count; i++) {
+                r = &resources[i];
+                nr = DIV_ROUND_UP(resource_size(r), XEN_PAGE_SIZE);
+                if ((resource_type(r) != IORESOURCE_MEM) || (nr == 0))
+                        continue;
+
+                gpfns = kzalloc(sizeof(xen_pfn_t) * nr, GFP_KERNEL);
+                idxs = kzalloc(sizeof(xen_ulong_t) * nr, GFP_KERNEL);
+                errs = kzalloc(sizeof(int) * nr, GFP_KERNEL);
+                if (!gpfns || !idxs || !errs) {
+                        kfree(gpfns);
+                        kfree(idxs);
+                        kfree(errs);
+                        rc = -ENOMEM;
+                        goto unmap;
+                }
+
+                for (j = 0; j < nr; j++) {
+                        /*
+                         * The regions are always mapped 1:1 to DOM0 and this is
+                         * fine because the memory map for DOM0 is the same as
+                         * the host (except for the RAM).
+                         */
+                        gpfns[j] = XEN_PFN_DOWN(r->start) + j;
+                        idxs[j] = XEN_PFN_DOWN(r->start) + j;
+                }
+
+                xatp.domid = DOMID_SELF;
+                xatp.size = nr;
+                xatp.space = XENMAPSPACE_dev_mmio;
+
+                set_xen_guest_handle(xatp.gpfns, gpfns);
+                set_xen_guest_handle(xatp.idxs, idxs);
+                set_xen_guest_handle(xatp.errs, errs);
+
+                rc = HYPERVISOR_memory_op(XENMEM_add_to_physmap_range, &xatp);
+                kfree(gpfns);
+                kfree(idxs);
+                kfree(errs);
+                if (rc)
+                        goto unmap;
+        }
+
+        return rc;
+
+unmap:
+        xen_unmap_device_mmio(resources, i);
+        return rc;
+}
+
+static int xen_platform_notifier(struct notifier_block *nb,
+                                 unsigned long action, void *data)
+{
+        struct platform_device *pdev = to_platform_device(data);
+        int r = 0;
+
+        if (pdev->num_resources == 0 || pdev->resource == NULL)
+                return NOTIFY_OK;
+
+        switch (action) {
+        case BUS_NOTIFY_ADD_DEVICE:
+                r = xen_map_device_mmio(pdev->resource, pdev->num_resources);
+                break;
+        case BUS_NOTIFY_DEL_DEVICE:
+                r = xen_unmap_device_mmio(pdev->resource, pdev->num_resources);
+                break;
+        default:
+                return NOTIFY_DONE;
+        }
+        if (r)
+                dev_err(&pdev->dev, "Platform: Failed to %s device %s MMIO!\n",
+                        action == BUS_NOTIFY_ADD_DEVICE ? "map" :
+                        (action == BUS_NOTIFY_DEL_DEVICE ? "unmap" : "?"),
+                        pdev->name);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block platform_device_nb = {
+        .notifier_call = xen_platform_notifier,
+};
+
+static int __init register_xen_platform_notifier(void)
+{
+        if (!xen_initial_domain() || acpi_disabled)
+                return 0;
+
+        return bus_register_notifier(&platform_bus_type, &platform_device_nb);
+}
+
+arch_initcall(register_xen_platform_notifier);
+
+#ifdef CONFIG_ARM_AMBA
+#include <linux/amba/bus.h>
+
+static int xen_amba_notifier(struct notifier_block *nb,
+                             unsigned long action, void *data)
+{
+        struct amba_device *adev = to_amba_device(data);
+        int r = 0;
+
+        switch (action) {
+        case BUS_NOTIFY_ADD_DEVICE:
+                r = xen_map_device_mmio(&adev->res, 1);
+                break;
+        case BUS_NOTIFY_DEL_DEVICE:
+                r = xen_unmap_device_mmio(&adev->res, 1);
+                break;
+        default:
+                return NOTIFY_DONE;
+        }
+        if (r)
+                dev_err(&adev->dev, "AMBA: Failed to %s device %s MMIO!\n",
+                        action == BUS_NOTIFY_ADD_DEVICE ? "map" :
+                        (action == BUS_NOTIFY_DEL_DEVICE ? "unmap" : "?"),
+                        adev->dev.init_name);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block amba_device_nb = {
+        .notifier_call = xen_amba_notifier,
+};
+
+static int __init register_xen_amba_notifier(void)
+{
+        if (!xen_initial_domain() || acpi_disabled)
+                return 0;
+
+        return bus_register_notifier(&amba_bustype, &amba_device_nb);
+}
+
+arch_initcall(register_xen_amba_notifier);
+#endif
diff --git a/drivers/xen/efi.c b/drivers/xen/efi.c
index e9d2135445c1..22f71ffd3406 100644
--- a/drivers/xen/efi.c
+++ b/drivers/xen/efi.c
@@ -38,7 +38,7 @@
 
 #define efi_data(op)    (op.u.efi_runtime_call)
 
-static efi_status_t xen_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
+efi_status_t xen_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 {
         struct xen_platform_op op = INIT_EFI_OP(get_time);
 
@@ -59,8 +59,9 @@ static efi_status_t xen_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_get_time);
 
-static efi_status_t xen_efi_set_time(efi_time_t *tm)
+efi_status_t xen_efi_set_time(efi_time_t *tm)
 {
         struct xen_platform_op op = INIT_EFI_OP(set_time);
 
@@ -72,10 +73,10 @@ static efi_status_t xen_efi_set_time(efi_time_t *tm)
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_set_time);
 
-static efi_status_t xen_efi_get_wakeup_time(efi_bool_t *enabled,
-                                            efi_bool_t *pending,
-                                            efi_time_t *tm)
+efi_status_t xen_efi_get_wakeup_time(efi_bool_t *enabled, efi_bool_t *pending,
+                                     efi_time_t *tm)
 {
         struct xen_platform_op op = INIT_EFI_OP(get_wakeup_time);
 
@@ -95,8 +96,9 @@ static efi_status_t xen_efi_get_wakeup_time(efi_bool_t *enabled,
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_get_wakeup_time);
 
-static efi_status_t xen_efi_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
+efi_status_t xen_efi_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
 {
         struct xen_platform_op op = INIT_EFI_OP(set_wakeup_time);
 
@@ -113,12 +115,11 @@ static efi_status_t xen_efi_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_set_wakeup_time);
 
-static efi_status_t xen_efi_get_variable(efi_char16_t *name,
-                                         efi_guid_t *vendor,
-                                         u32 *attr,
-                                         unsigned long *data_size,
-                                         void *data)
+efi_status_t xen_efi_get_variable(efi_char16_t *name, efi_guid_t *vendor,
+                                  u32 *attr, unsigned long *data_size,
+                                  void *data)
 {
         struct xen_platform_op op = INIT_EFI_OP(get_variable);
 
@@ -138,10 +139,11 @@ static efi_status_t xen_efi_get_variable(efi_char16_t *name,
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_get_variable);
 
-static efi_status_t xen_efi_get_next_variable(unsigned long *name_size,
-                                              efi_char16_t *name,
-                                              efi_guid_t *vendor)
+efi_status_t xen_efi_get_next_variable(unsigned long *name_size,
+                                       efi_char16_t *name,
+                                       efi_guid_t *vendor)
 {
         struct xen_platform_op op = INIT_EFI_OP(get_next_variable_name);
 
@@ -161,12 +163,11 @@ static efi_status_t xen_efi_get_next_variable(unsigned long *name_size,
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_get_next_variable);
 
-static efi_status_t xen_efi_set_variable(efi_char16_t *name,
-                                         efi_guid_t *vendor,
-                                         u32 attr,
-                                         unsigned long data_size,
-                                         void *data)
+efi_status_t xen_efi_set_variable(efi_char16_t *name, efi_guid_t *vendor,
+                                 u32 attr, unsigned long data_size,
+                                 void *data)
 {
         struct xen_platform_op op = INIT_EFI_OP(set_variable);
 
@@ -183,11 +184,11 @@ static efi_status_t xen_efi_set_variable(efi_char16_t *name,
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_set_variable);
 
-static efi_status_t xen_efi_query_variable_info(u32 attr,
-                                                u64 *storage_space,
-                                                u64 *remaining_space,
-                                                u64 *max_variable_size)
+efi_status_t xen_efi_query_variable_info(u32 attr, u64 *storage_space,
+                                         u64 *remaining_space,
+                                         u64 *max_variable_size)
 {
         struct xen_platform_op op = INIT_EFI_OP(query_variable_info);
 
@@ -205,8 +206,9 @@ static efi_status_t xen_efi_query_variable_info(u32 attr,
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_query_variable_info);
 
-static efi_status_t xen_efi_get_next_high_mono_count(u32 *count)
+efi_status_t xen_efi_get_next_high_mono_count(u32 *count)
 {
         struct xen_platform_op op = INIT_EFI_OP(get_next_high_monotonic_count);
 
@@ -217,10 +219,10 @@ static efi_status_t xen_efi_get_next_high_mono_count(u32 *count)
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_get_next_high_mono_count);
 
-static efi_status_t xen_efi_update_capsule(efi_capsule_header_t **capsules,
-                                           unsigned long count,
-                                           unsigned long sg_list)
+efi_status_t xen_efi_update_capsule(efi_capsule_header_t **capsules,
+                                    unsigned long count, unsigned long sg_list)
 {
         struct xen_platform_op op = INIT_EFI_OP(update_capsule);
 
@@ -237,11 +239,11 @@ static efi_status_t xen_efi_update_capsule(efi_capsule_header_t **capsules,
 
         return efi_data(op).status;
 }
+EXPORT_SYMBOL_GPL(xen_efi_update_capsule);
 
-static efi_status_t xen_efi_query_capsule_caps(efi_capsule_header_t **capsules,
-                                               unsigned long count,
-                                               u64 *max_size,
-                                               int *reset_type)
+efi_status_t xen_efi_query_capsule_caps(efi_capsule_header_t **capsules,
+                                        unsigned long count, u64 *max_size,
+                                        int *reset_type)
 {
         struct xen_platform_op op = INIT_EFI_OP(query_capsule_capabilities);
 
@@ -260,111 +262,4 @@ static efi_status_t xen_efi_query_capsule_caps(efi_capsule_header_t **capsules,
 
         return efi_data(op).status;
 }
-
-static efi_char16_t vendor[100] __initdata;
-
-static efi_system_table_t efi_systab_xen __initdata = {
-        .hdr = {
-                .signature      = EFI_SYSTEM_TABLE_SIGNATURE,
-                .revision       = 0, /* Initialized later. */
-                .headersize     = 0, /* Ignored by Linux Kernel. */
-                .crc32          = 0, /* Ignored by Linux Kernel. */
-                .reserved       = 0
-        },
-        .fw_vendor      = EFI_INVALID_TABLE_ADDR, /* Initialized later. */
-        .fw_revision    = 0,                      /* Initialized later. */
-        .con_in_handle  = EFI_INVALID_TABLE_ADDR, /* Not used under Xen. */
-        .con_in         = EFI_INVALID_TABLE_ADDR, /* Not used under Xen. */
-        .con_out_handle = EFI_INVALID_TABLE_ADDR, /* Not used under Xen. */
-        .con_out        = EFI_INVALID_TABLE_ADDR, /* Not used under Xen. */
-        .stderr_handle  = EFI_INVALID_TABLE_ADDR, /* Not used under Xen. */
-        .stderr         = EFI_INVALID_TABLE_ADDR, /* Not used under Xen. */
-        .runtime        = (efi_runtime_services_t *)EFI_INVALID_TABLE_ADDR,
-                                                  /* Not used under Xen. */
-        .boottime       = (efi_boot_services_t *)EFI_INVALID_TABLE_ADDR,
-                                                  /* Not used under Xen. */
-        .nr_tables      = 0,                      /* Initialized later. */
-        .tables         = EFI_INVALID_TABLE_ADDR  /* Initialized later. */
-};
-
-static const struct efi efi_xen __initconst = {
-        .systab                   = NULL, /* Initialized later. */
-        .runtime_version          = 0,    /* Initialized later. */
-        .mps                      = EFI_INVALID_TABLE_ADDR,
-        .acpi                     = EFI_INVALID_TABLE_ADDR,
-        .acpi20                   = EFI_INVALID_TABLE_ADDR,
-        .smbios                   = EFI_INVALID_TABLE_ADDR,
-        .smbios3                  = EFI_INVALID_TABLE_ADDR,
-        .sal_systab               = EFI_INVALID_TABLE_ADDR,
-        .boot_info                = EFI_INVALID_TABLE_ADDR,
-        .hcdp                     = EFI_INVALID_TABLE_ADDR,
-        .uga                      = EFI_INVALID_TABLE_ADDR,
-        .uv_systab                = EFI_INVALID_TABLE_ADDR,
-        .fw_vendor                = EFI_INVALID_TABLE_ADDR,
-        .runtime                  = EFI_INVALID_TABLE_ADDR,
-        .config_table             = EFI_INVALID_TABLE_ADDR,
-        .get_time                 = xen_efi_get_time,
-        .set_time                 = xen_efi_set_time,
-        .get_wakeup_time          = xen_efi_get_wakeup_time,
-        .set_wakeup_time          = xen_efi_set_wakeup_time,
-        .get_variable             = xen_efi_get_variable,
-        .get_next_variable        = xen_efi_get_next_variable,
-        .set_variable             = xen_efi_set_variable,
-        .query_variable_info      = xen_efi_query_variable_info,
-        .update_capsule           = xen_efi_update_capsule,
-        .query_capsule_caps       = xen_efi_query_capsule_caps,
-        .get_next_high_mono_count = xen_efi_get_next_high_mono_count,
-        .reset_system             = NULL, /* Functionality provided by Xen. */
-        .set_virtual_address_map  = NULL, /* Not used under Xen. */
-        .flags                    = 0     /* Initialized later. */
-};
-
-efi_system_table_t __init *xen_efi_probe(void)
-{
-        struct xen_platform_op op = {
-                .cmd = XENPF_firmware_info,
-                .u.firmware_info = {
-                        .type = XEN_FW_EFI_INFO,
-                        .index = XEN_FW_EFI_CONFIG_TABLE
-                }
-        };
-        union xenpf_efi_info *info = &op.u.firmware_info.u.efi_info;
-
-        if (!xen_initial_domain() || HYPERVISOR_platform_op(&op) < 0)
-                return NULL;
-
-        /* Here we know that Xen runs on EFI platform. */
-
-        efi = efi_xen;
-
-        efi_systab_xen.tables = info->cfg.addr;
-        efi_systab_xen.nr_tables = info->cfg.nent;
-
-        op.cmd = XENPF_firmware_info;
-        op.u.firmware_info.type = XEN_FW_EFI_INFO;
-        op.u.firmware_info.index = XEN_FW_EFI_VENDOR;
-        info->vendor.bufsz = sizeof(vendor);
-        set_xen_guest_handle(info->vendor.name, vendor);
-
-        if (HYPERVISOR_platform_op(&op) == 0) {
-                efi_systab_xen.fw_vendor = __pa_symbol(vendor);
-                efi_systab_xen.fw_revision = info->vendor.revision;
-        } else
-                efi_systab_xen.fw_vendor = __pa_symbol(L"UNKNOWN");
-
-        op.cmd = XENPF_firmware_info;
-        op.u.firmware_info.type = XEN_FW_EFI_INFO;
-        op.u.firmware_info.index = XEN_FW_EFI_VERSION;
-
-        if (HYPERVISOR_platform_op(&op) == 0)
-                efi_systab_xen.hdr.revision = info->version;
-
-        op.cmd = XENPF_firmware_info;
-        op.u.firmware_info.type = XEN_FW_EFI_INFO;
-        op.u.firmware_info.index = XEN_FW_EFI_RT_VERSION;
-
-        if (HYPERVISOR_platform_op(&op) == 0)
-                efi.runtime_version = info->version;
-
-        return &efi_systab_xen;
-}
+EXPORT_SYMBOL_GPL(xen_efi_query_capsule_caps);
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 71d49a95f8c0..d5dbdb9d24d8 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -895,7 +895,7 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
                 irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
                                               handle_percpu_irq, "ipi");
 
-                bind_ipi.vcpu = cpu;
+                bind_ipi.vcpu = xen_vcpu_nr(cpu);
                 if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
                                                 &bind_ipi) != 0)
                         BUG();
@@ -991,7 +991,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
                                                       handle_edge_irq, "virq");
 
                 bind_virq.virq = virq;
-                bind_virq.vcpu = cpu;
+                bind_virq.vcpu = xen_vcpu_nr(cpu);
                 ret = HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq,
                                                 &bind_virq);
                 if (ret == 0)
@@ -1211,7 +1211,8 @@ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector)
 
 #ifdef CONFIG_X86
         if (unlikely(vector == XEN_NMI_VECTOR)) {
-                int rc =  HYPERVISOR_vcpu_op(VCPUOP_send_nmi, cpu, NULL);
+                int rc =  HYPERVISOR_vcpu_op(VCPUOP_send_nmi, xen_vcpu_nr(cpu),
+                                             NULL);
                 if (rc < 0)
                         printk(KERN_WARNING "Sending nmi to CPU%d failed (rc:%d)\n", cpu, rc);
                 return;
@@ -1318,7 +1319,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 
         /* Send future instances of this interrupt to other vcpu. */
         bind_vcpu.port = evtchn;
-        bind_vcpu.vcpu = tcpu;
+        bind_vcpu.vcpu = xen_vcpu_nr(tcpu);
 
         /*
          * Mask the event while changing the VCPU binding to prevent
@@ -1458,7 +1459,7 @@ static void restore_cpu_virqs(unsigned int cpu)
 
                 /* Get a new binding from Xen. */
                 bind_virq.virq = virq;
-                bind_virq.vcpu = cpu;
+                bind_virq.vcpu = xen_vcpu_nr(cpu);
                 if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq,
                                                 &bind_virq) != 0)
                         BUG();
@@ -1482,7 +1483,7 @@ static void restore_cpu_ipis(unsigned int cpu)
                 BUG_ON(ipi_from_irq(irq) != ipi);
 
                 /* Get a new binding from Xen. */
-                bind_ipi.vcpu = cpu;
+                bind_ipi.vcpu = xen_vcpu_nr(cpu);
                 if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
                                                 &bind_ipi) != 0)
                         BUG();
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 9289a17712e2..266c2c733039 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -113,7 +113,7 @@ static int init_control_block(int cpu,
 
         init_control.control_gfn = virt_to_gfn(control_block);
         init_control.offset      = 0;
-        init_control.vcpu        = cpu;
+        init_control.vcpu        = xen_vcpu_nr(cpu);
 
         return HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
 }
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index f4edd6df3df2..e8c7f09d01be 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -55,6 +55,7 @@
 #include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/evtchn.h>
+#include <xen/xen-ops.h>
 #include <asm/xen/hypervisor.h>
 
 struct per_user_data {
@@ -73,8 +74,12 @@ struct per_user_data {
         wait_queue_head_t evtchn_wait;
         struct fasync_struct *evtchn_async_queue;
         const char *name;
+
+        domid_t restrict_domid;
 };
 
+#define UNRESTRICTED_DOMID ((domid_t)-1)
+
 struct user_evtchn {
         struct rb_node node;
         struct per_user_data *user;
@@ -443,12 +448,16 @@ static long evtchn_ioctl(struct file *file,
                 struct ioctl_evtchn_bind_virq bind;
                 struct evtchn_bind_virq bind_virq;
 
+                rc = -EACCES;
+                if (u->restrict_domid != UNRESTRICTED_DOMID)
+                        break;
+
                 rc = -EFAULT;
                 if (copy_from_user(&bind, uarg, sizeof(bind)))
                         break;
 
                 bind_virq.virq = bind.virq;
-                bind_virq.vcpu = 0;
+                bind_virq.vcpu = xen_vcpu_nr(0);
                 rc = HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq,
                                                  &bind_virq);
                 if (rc != 0)
@@ -468,6 +477,11 @@ static long evtchn_ioctl(struct file *file,
                 if (copy_from_user(&bind, uarg, sizeof(bind)))
                         break;
 
+                rc = -EACCES;
+                if (u->restrict_domid != UNRESTRICTED_DOMID &&
+                    u->restrict_domid != bind.remote_domain)
+                        break;
+
                 bind_interdomain.remote_dom  = bind.remote_domain;
                 bind_interdomain.remote_port = bind.remote_port;
                 rc = HYPERVISOR_event_channel_op(EVTCHNOP_bind_interdomain,
@@ -485,6 +499,10 @@ static long evtchn_ioctl(struct file *file,
                 struct ioctl_evtchn_bind_unbound_port bind;
                 struct evtchn_alloc_unbound alloc_unbound;
 
+                rc = -EACCES;
+                if (u->restrict_domid != UNRESTRICTED_DOMID)
+                        break;
+
                 rc = -EFAULT;
                 if (copy_from_user(&bind, uarg, sizeof(bind)))
                         break;
@@ -553,6 +571,27 @@ static long evtchn_ioctl(struct file *file,
                 break;
         }
 
+        case IOCTL_EVTCHN_RESTRICT_DOMID: {
+                struct ioctl_evtchn_restrict_domid ierd;
+
+                rc = -EACCES;
+                if (u->restrict_domid != UNRESTRICTED_DOMID)
+                        break;
+
+                rc = -EFAULT;
+                if (copy_from_user(&ierd, uarg, sizeof(ierd)))
+                    break;
+
+                rc = -EINVAL;
+                if (ierd.domid == 0 || ierd.domid >= DOMID_FIRST_RESERVED)
+                        break;
+
+                u->restrict_domid = ierd.domid;
+                rc = 0;
+
+                break;
+        }
+
         default:
                 rc = -ENOSYS;
                 break;
@@ -601,6 +640,8 @@ static int evtchn_open(struct inode *inode, struct file *filp)
         mutex_init(&u->ring_cons_mutex);
         spin_lock_init(&u->ring_prod_lock);
 
+        u->restrict_domid = UNRESTRICTED_DOMID;
+
         filp->private_data = u;
 
         return nonseekable_open(inode, filp);
diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
index 4547a91bca67..7a47c4c9fb1b 100644
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xen/gntalloc.c
@@ -504,7 +504,7 @@ static int gntalloc_mmap(struct file *filp, struct vm_area_struct *vma)
         struct gntalloc_file_private_data *priv = filp->private_data;
         struct gntalloc_vma_private_data *vm_priv;
         struct gntalloc_gref *gref;
-        int count = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int count = vma_pages(vma);
         int rv, i;
 
         if (!(vma->vm_flags & VM_SHARED)) {
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 67939578cd6d..bb952121ea94 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -982,7 +982,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
 {
         struct gntdev_priv *priv = flip->private_data;
         int index = vma->vm_pgoff;
-        int count = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int count = vma_pages(vma);
         struct grant_map *map;
         int i, err = -EINVAL;
 
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index df2e6f783318..702040fe2001 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -582,7 +582,7 @@ static long privcmd_ioctl(struct file *file,
 static void privcmd_close(struct vm_area_struct *vma)
 {
         struct page **pages = vma->vm_private_data;
-        int numpgs = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int numpgs = vma_pages(vma);
         int numgfns = (vma->vm_end - vma->vm_start) >> XEN_PAGE_SHIFT;
         int rc;
 
diff --git a/drivers/xen/time.c b/drivers/xen/time.c
index 71078425c9ea..ac5f23fcafc2 100644
--- a/drivers/xen/time.c
+++ b/drivers/xen/time.c
@@ -6,6 +6,7 @@
 #include <linux/math64.h>
 #include <linux/gfp.h>
 
+#include <asm/paravirt.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
 
@@ -46,27 +47,31 @@ static u64 get64(const u64 *p)
         return ret;
 }
 
-/*
- * Runstate accounting
- */
-void xen_get_runstate_snapshot(struct vcpu_runstate_info *res)
+static void xen_get_runstate_snapshot_cpu(struct vcpu_runstate_info *res,
+                                          unsigned int cpu)
 {
         u64 state_time;
         struct vcpu_runstate_info *state;
 
         BUG_ON(preemptible());
 
-        state = this_cpu_ptr(&xen_runstate);
+        state = per_cpu_ptr(&xen_runstate, cpu);
 
-        /*
-         * The runstate info is always updated by the hypervisor on
-         * the current CPU, so there's no need to use anything
-         * stronger than a compiler barrier when fetching it.
-         */
         do {
                 state_time = get64(&state->state_entry_time);
+                rmb();  /* Hypervisor might update data. */
                 *res = READ_ONCE(*state);
-        } while (get64(&state->state_entry_time) != state_time);
+                rmb();  /* Hypervisor might update data. */
+        } while (get64(&state->state_entry_time) != state_time ||
+                 (state_time & XEN_RUNSTATE_UPDATE));
+}
+
+/*
+ * Runstate accounting
+ */
+void xen_get_runstate_snapshot(struct vcpu_runstate_info *res)
+{
+        xen_get_runstate_snapshot_cpu(res, smp_processor_id());
 }
 
 /* return true when a vcpu could run but has no real cpu to run on */
@@ -75,6 +80,14 @@ bool xen_vcpu_stolen(int vcpu)
         return per_cpu(xen_runstate, vcpu).state == RUNSTATE_runnable;
 }
 
+u64 xen_steal_clock(int cpu)
+{
+        struct vcpu_runstate_info state;
+
+        xen_get_runstate_snapshot_cpu(&state, cpu);
+        return state.time[RUNSTATE_runnable] + state.time[RUNSTATE_offline];
+}
+
 void xen_setup_runstate_info(int cpu)
 {
         struct vcpu_register_runstate_memory_area area;
@@ -82,7 +95,20 @@ void xen_setup_runstate_info(int cpu)
         area.addr.v = &per_cpu(xen_runstate, cpu);
 
         if (HYPERVISOR_vcpu_op(VCPUOP_register_runstate_memory_area,
-                               cpu, &area))
+                               xen_vcpu_nr(cpu), &area))
                 BUG();
 }
 
+void __init xen_time_setup_guest(void)
+{
+        bool xen_runstate_remote;
+
+        xen_runstate_remote = !HYPERVISOR_vm_assist(VMASST_CMD_enable,
+                                        VMASST_TYPE_runstate_update_flag);
+
+        pv_time_ops.steal_clock = xen_steal_clock;
+
+        static_key_slow_inc(&paravirt_steal_enabled);
+        if (xen_runstate_remote)
+                static_key_slow_inc(&paravirt_steal_rq_enabled);
+}
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 6a25533da237..9e9286d0872e 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -148,7 +148,7 @@ int xen_pcibk_config_read(struct pci_dev *dev, int offset, int size,
         struct xen_pcibk_dev_data *dev_data = pci_get_drvdata(dev);
         const struct config_field_entry *cfg_entry;
         const struct config_field *field;
-        int req_start, req_end, field_start, field_end;
+        int field_start, field_end;
         /* if read fails for any reason, return 0
          * (as if device didn't respond) */
         u32 value = 0, tmp_val;
@@ -178,12 +178,10 @@ int xen_pcibk_config_read(struct pci_dev *dev, int offset, int size,
         list_for_each_entry(cfg_entry, &dev_data->config_fields, list) {
                 field = cfg_entry->field;
 
-                req_start = offset;
-                req_end = offset + size;
                 field_start = OFFSET(cfg_entry);
                 field_end = OFFSET(cfg_entry) + field->size;
 
-                 if (req_end > field_start && field_end > req_start) {
+                if (offset + size > field_start && field_end > offset) {
                         err = conf_space_read(dev, cfg_entry, field_start,
                                               &tmp_val);
                         if (err)
@@ -191,7 +189,7 @@ int xen_pcibk_config_read(struct pci_dev *dev, int offset, int size,
 
                         value = merge_value(value, tmp_val,
                                             get_mask(field->size),
-                                            field_start - req_start);
+                                            field_start - offset);
                 }
         }
 
@@ -211,7 +209,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
         const struct config_field_entry *cfg_entry;
         const struct config_field *field;
         u32 tmp_val;
-        int req_start, req_end, field_start, field_end;
+        int field_start, field_end;
 
         if (unlikely(verbose_request))
                 printk(KERN_DEBUG
@@ -224,21 +222,17 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
         list_for_each_entry(cfg_entry, &dev_data->config_fields, list) {
                 field = cfg_entry->field;
 
-                req_start = offset;
-                req_end = offset + size;
                 field_start = OFFSET(cfg_entry);
                 field_end = OFFSET(cfg_entry) + field->size;
 
-                 if (req_end > field_start && field_end > req_start) {
-                        tmp_val = 0;
-
-                        err = xen_pcibk_config_read(dev, field_start,
-                                                  field->size, &tmp_val);
+                if (offset + size > field_start && field_end > offset) {
+                        err = conf_space_read(dev, cfg_entry, field_start,
+                                              &tmp_val);
                         if (err)
                                 break;
 
                         tmp_val = merge_value(tmp_val, value, get_mask(size),
-                                              req_start - field_start);
+                                              offset - field_start);
 
                         err = conf_space_write(dev, cfg_entry, field_start,
                                                tmp_val);
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index 9ead1c2ff1dd..5fbfd9cfb6d6 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -209,58 +209,35 @@ static int bar_read(struct pci_dev *dev, int offset, u32 * value, void *data)
         return 0;
 }
 
-static inline void read_dev_bar(struct pci_dev *dev,
-                                struct pci_bar_info *bar_info, int offset,
-                                u32 len_mask)
+static void *bar_init(struct pci_dev *dev, int offset)
 {
-        int     pos;
-        struct resource *res = dev->resource;
+        unsigned int pos;
+        const struct resource *res = dev->resource;
+        struct pci_bar_info *bar = kzalloc(sizeof(*bar), GFP_KERNEL);
+
+        if (!bar)
+                return ERR_PTR(-ENOMEM);
 
         if (offset == PCI_ROM_ADDRESS || offset == PCI_ROM_ADDRESS1)
                 pos = PCI_ROM_RESOURCE;
         else {
                 pos = (offset - PCI_BASE_ADDRESS_0) / 4;
-                if (pos && ((res[pos - 1].flags & (PCI_BASE_ADDRESS_SPACE |
-                                PCI_BASE_ADDRESS_MEM_TYPE_MASK)) ==
-                           (PCI_BASE_ADDRESS_SPACE_MEMORY |
-                                PCI_BASE_ADDRESS_MEM_TYPE_64))) {
-                        bar_info->val = res[pos - 1].start >> 32;
-                        bar_info->len_val = -resource_size(&res[pos - 1]) >> 32;
-                        return;
+                if (pos && (res[pos - 1].flags & IORESOURCE_MEM_64)) {
+                        bar->val = res[pos - 1].start >> 32;
+                        bar->len_val = -resource_size(&res[pos - 1]) >> 32;
+                        return bar;
                 }
         }
 
         if (!res[pos].flags ||
             (res[pos].flags & (IORESOURCE_DISABLED | IORESOURCE_UNSET |
                                IORESOURCE_BUSY)))
-                return;
-
-        bar_info->val = res[pos].start |
-                        (res[pos].flags & PCI_REGION_FLAG_MASK);
-        bar_info->len_val = -resource_size(&res[pos]) |
-                            (res[pos].flags & PCI_REGION_FLAG_MASK);
-}
+                return bar;
 
-static void *bar_init(struct pci_dev *dev, int offset)
-{
-        struct pci_bar_info *bar = kzalloc(sizeof(*bar), GFP_KERNEL);
-
-        if (!bar)
-                return ERR_PTR(-ENOMEM);
-
-        read_dev_bar(dev, bar, offset, ~0);
-
-        return bar;
-}
-
-static void *rom_init(struct pci_dev *dev, int offset)
-{
-        struct pci_bar_info *bar = kzalloc(sizeof(*bar), GFP_KERNEL);
-
-        if (!bar)
-                return ERR_PTR(-ENOMEM);
-
-        read_dev_bar(dev, bar, offset, ~PCI_ROM_ADDRESS_ENABLE);
+        bar->val = res[pos].start |
+                   (res[pos].flags & PCI_REGION_FLAG_MASK);
+        bar->len_val = -resource_size(&res[pos]) |
+                       (res[pos].flags & PCI_REGION_FLAG_MASK);
 
         return bar;
 }
@@ -383,7 +360,7 @@ static const struct config_field header_common[] = {
         {                                               \
         .offset     = reg_offset,                       \
         .size       = 4,                                \
-        .init       = rom_init,                         \
+        .init       = bar_init,                         \
         .reset      = bar_reset,                        \
         .release    = bar_release,                      \
         .u.dw.read  = bar_read,                         \
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index 4d529f3e40df..7af369b6aaa2 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -55,7 +55,6 @@ struct xen_pcibk_dev_data {
 
 /* Used by XenBus and xen_pcibk_ops.c */
 extern wait_queue_head_t xen_pcibk_aer_wait_queue;
-extern struct workqueue_struct *xen_pcibk_wq;
 /* Used by pcistub.c and conf_space_quirks.c */
 extern struct list_head xen_pcibk_quirks;
 
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 2f19dd7553e6..f8c77751f330 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -310,7 +310,7 @@ void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
          * already processing a request */
         if (test_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags)
             && !test_and_set_bit(_PDEVF_op_active, &pdev->flags)) {
-                queue_work(xen_pcibk_wq, &pdev->op_work);
+                schedule_work(&pdev->op_work);
         }
         /*_XEN_PCIB_active should have been cleared by pcifront. And also make
         sure xen_pcibk is waiting for ack by checking _PCIB_op_pending*/
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index c252eb3f0176..5ce878c51d03 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -17,7 +17,6 @@
 #include "pciback.h"
 
 #define INVALID_EVTCHN_IRQ  (-1)
-struct workqueue_struct *xen_pcibk_wq;
 
 static bool __read_mostly passthrough;
 module_param(passthrough, bool, S_IRUGO);
@@ -76,8 +75,7 @@ static void xen_pcibk_disconnect(struct xen_pcibk_device *pdev)
         /* If the driver domain started an op, make sure we complete it
          * before releasing the shared memory */
 
-        /* Note, the workqueue does not use spinlocks at all.*/
-        flush_workqueue(xen_pcibk_wq);
+        flush_work(&pdev->op_work);
 
         if (pdev->sh_info != NULL) {
                 xenbus_unmap_ring_vfree(pdev->xdev, pdev->sh_info);
@@ -733,11 +731,6 @@ const struct xen_pcibk_backend *__read_mostly xen_pcibk_backend;
 
 int __init xen_pcibk_xenbus_register(void)
 {
-        xen_pcibk_wq = create_workqueue("xen_pciback_workqueue");
-        if (!xen_pcibk_wq) {
-                pr_err("%s: create xen_pciback_workqueue failed\n", __func__);
-                return -EFAULT;
-        }
         xen_pcibk_backend = &xen_pcibk_vpci_backend;
         if (passthrough)
                 xen_pcibk_backend = &xen_pcibk_passthrough_backend;
@@ -747,6 +740,5 @@ int __init xen_pcibk_xenbus_register(void)
 
 void __exit xen_pcibk_xenbus_unregister(void)
 {
-        destroy_workqueue(xen_pcibk_wq);
         xenbus_unregister_driver(&xen_pcibk_driver);
 }
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index bcb53bdc469c..611a23119675 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -31,7 +31,6 @@
 #include "xenbus_probe.h"
 
 
-static struct workqueue_struct *xenbus_frontend_wq;
 
 /* device/<type>/<id> => <type>-<id> */
 static int frontend_bus_id(char bus_id[XEN_BUS_ID_SIZE], const char *nodename)
@@ -109,13 +108,7 @@ static int xenbus_frontend_dev_resume(struct device *dev)
         if (xen_store_domain_type == XS_LOCAL) {
                 struct xenbus_device *xdev = to_xenbus_device(dev);
 
-                if (!xenbus_frontend_wq) {
-                        pr_err("%s: no workqueue to process delayed resume\n",
-                               xdev->nodename);
-                        return -EFAULT;
-                }
-
-                queue_work(xenbus_frontend_wq, &xdev->work);
+                schedule_work(&xdev->work);
 
                 return 0;
         }
@@ -485,12 +478,6 @@ static int __init xenbus_probe_frontend_init(void)
 
         register_xenstore_notifier(&xenstore_notifier);
 
-        if (xen_store_domain_type == XS_LOCAL) {
-                xenbus_frontend_wq = create_workqueue("xenbus_frontend");
-                if (!xenbus_frontend_wq)
-                        pr_warn("create xenbus frontend workqueue failed, S3 resume is likely to fail\n");
-        }
-
         return 0;
 }
 subsys_initcall(xenbus_probe_frontend_init);
diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
index 5063c5e796b7..23f1387b3ef7 100644
--- a/drivers/xen/xlate_mmu.c
+++ b/drivers/xen/xlate_mmu.c
@@ -29,6 +29,8 @@
  */
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -37,6 +39,7 @@
 #include <xen/page.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/memory.h>
+#include <xen/balloon.h>
 
 typedef void (*xen_gfn_fn_t)(unsigned long gfn, void *data);
 
@@ -185,3 +188,77 @@ int xen_xlate_unmap_gfn_range(struct vm_area_struct *vma,
         return 0;
 }
 EXPORT_SYMBOL_GPL(xen_xlate_unmap_gfn_range);
+
+struct map_balloon_pages {
+        xen_pfn_t *pfns;
+        unsigned int idx;
+};
+
+static void setup_balloon_gfn(unsigned long gfn, void *data)
+{
+        struct map_balloon_pages *info = data;
+
+        info->pfns[info->idx++] = gfn;
+}
+
+/**
+ * xen_xlate_map_ballooned_pages - map a new set of ballooned pages
+ * @gfns: returns the array of corresponding GFNs
+ * @virt: returns the virtual address of the mapped region
+ * @nr_grant_frames: number of GFNs
+ * @return 0 on success, error otherwise
+ *
+ * This allocates a set of ballooned pages and maps them into the
+ * kernel's address space.
+ */
+int __init xen_xlate_map_ballooned_pages(xen_pfn_t **gfns, void **virt,
+                                         unsigned long nr_grant_frames)
+{
+        struct page **pages;
+        xen_pfn_t *pfns;
+        void *vaddr;
+        struct map_balloon_pages data;
+        int rc;
+        unsigned long nr_pages;
+
+        BUG_ON(nr_grant_frames == 0);
+        nr_pages = DIV_ROUND_UP(nr_grant_frames, XEN_PFN_PER_PAGE);
+        pages = kcalloc(nr_pages, sizeof(pages[0]), GFP_KERNEL);
+        if (!pages)
+                return -ENOMEM;
+
+        pfns = kcalloc(nr_grant_frames, sizeof(pfns[0]), GFP_KERNEL);
+        if (!pfns) {
+                kfree(pages);
+                return -ENOMEM;
+        }
+        rc = alloc_xenballooned_pages(nr_pages, pages);
+        if (rc) {
+                pr_warn("%s Couldn't balloon alloc %ld pages rc:%d\n", __func__,
+                        nr_pages, rc);
+                kfree(pages);
+                kfree(pfns);
+                return rc;
+        }
+
+        data.pfns = pfns;
+        data.idx = 0;
+        xen_for_each_gfn(pages, nr_grant_frames, setup_balloon_gfn, &data);
+
+        vaddr = vmap(pages, nr_pages, 0, PAGE_KERNEL);
+        if (!vaddr) {
+                pr_warn("%s Couldn't map %ld pages rc:%d\n", __func__,
+                        nr_pages, rc);
+                free_xenballooned_pages(nr_pages, pages);
+                kfree(pages);
+                kfree(pfns);
+                return -ENOMEM;
+        }
+        kfree(pages);
+
+        *gfns = pfns;
+        *virt = vaddr;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(xen_xlate_map_ballooned_pages);