Merge tag 'v4.17-rc6' into next

Sync up with mainline to bring in Atmel controller changes for Caroline.

512 files changed, 38592 insertions, 5612 deletions

diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h
index 6edd177bb1c7..caae4843cb70 100644
--- a/tools/arch/arm/include/uapi/asm/kvm.h
+++ b/tools/arch/arm/include/uapi/asm/kvm.h
@@ -135,6 +135,15 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_CRM_SHIFT           7
 #define KVM_REG_ARM_32_CRN_MASK         0x0000000000007800
 #define KVM_REG_ARM_32_CRN_SHIFT        11
+/*
+ * For KVM currently all guest registers are nonsecure, but we reserve a bit
+ * in the encoding to distinguish secure from nonsecure for AArch32 system
+ * registers that are banked by security. This is 1 for the secure banked
+ * register, and 0 for the nonsecure banked register or if the register is
+ * not banked by security.
+ */
+#define KVM_REG_ARM_SECURE_MASK 0x0000000010000000
+#define KVM_REG_ARM_SECURE_SHIFT        28
 
 #define ARM_CP15_REG_SHIFT_MASK(x,n) \
         (((x) << KVM_REG_ARM_ ## n ## _SHIFT) & KVM_REG_ARM_ ## n ## _MASK)
@@ -186,6 +195,12 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_VFP_FPINST          0x1009
 #define KVM_REG_ARM_VFP_FPINST2         0x100A
 
+/* KVM-as-firmware specific pseudo-registers */
+#define KVM_REG_ARM_FW                  (0x0014 << KVM_REG_ARM_COPROC_SHIFT)
+#define KVM_REG_ARM_FW_REG(r)           (KVM_REG_ARM | KVM_REG_SIZE_U64 | \
+                                         KVM_REG_ARM_FW | ((r) & 0xffff))
+#define KVM_REG_ARM_PSCI_VERSION        KVM_REG_ARM_FW_REG(0)
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR       0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index 9abbf3044654..04b3256f8e6d 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -206,6 +206,12 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_TIMER_CNT           ARM64_SYS_REG(3, 3, 14, 3, 2)
 #define KVM_REG_ARM_TIMER_CVAL          ARM64_SYS_REG(3, 3, 14, 0, 2)
 
+/* KVM-as-firmware specific pseudo-registers */
+#define KVM_REG_ARM_FW                  (0x0014 << KVM_REG_ARM_COPROC_SHIFT)
+#define KVM_REG_ARM_FW_REG(r)           (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
+                                         KVM_REG_ARM_FW | ((r) & 0xffff))
+#define KVM_REG_ARM_PSCI_VERSION        KVM_REG_ARM_FW_REG(0)
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR       0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
diff --git a/tools/arch/frv/include/uapi/asm/bitsperlong.h b/tools/arch/frv/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 76da34b10f59..000000000000
--- a/tools/arch/frv/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm-generic/bitsperlong.h>
diff --git a/tools/arch/frv/include/uapi/asm/mman.h b/tools/arch/frv/include/uapi/asm/mman.h
deleted file mode 100644
index 5bc900b0bc78..000000000000
--- a/tools/arch/frv/include/uapi/asm/mman.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef TOOLS_ARCH_FRV_UAPI_ASM_MMAN_FIX_H
-#define TOOLS_ARCH_FRV_UAPI_ASM_MMAN_FIX_H
-#include <uapi/asm-generic/mman.h>
-/* MAP_32BIT is undefined on frv, fix it for perf */
-#define MAP_32BIT       0
-#endif
diff --git a/tools/arch/m32r/include/uapi/asm/bitsperlong.h b/tools/arch/m32r/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 76da34b10f59..000000000000
--- a/tools/arch/m32r/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm-generic/bitsperlong.h>
diff --git a/tools/arch/m32r/include/uapi/asm/mman.h b/tools/arch/m32r/include/uapi/asm/mman.h
deleted file mode 100644
index d19b82c9c290..000000000000
--- a/tools/arch/m32r/include/uapi/asm/mman.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef TOOLS_ARCH_M32R_UAPI_ASM_MMAN_FIX_H
-#define TOOLS_ARCH_M32R_UAPI_ASM_MMAN_FIX_H
-#include <uapi/asm-generic/mman.h>
-/* MAP_32BIT is undefined on m32r, fix it for perf */
-#define MAP_32BIT       0
-#endif
diff --git a/tools/arch/mn10300/include/uapi/asm/bitsperlong.h b/tools/arch/mn10300/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13b2..000000000000
--- a/tools/arch/mn10300/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/tools/arch/mn10300/include/uapi/asm/mman.h b/tools/arch/mn10300/include/uapi/asm/mman.h
deleted file mode 100644
index b9360639974f..000000000000
--- a/tools/arch/mn10300/include/uapi/asm/mman.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef TOOLS_ARCH_MN10300_UAPI_ASM_MMAN_FIX_H
-#define TOOLS_ARCH_MN10300_UAPI_ASM_MMAN_FIX_H
-#include <uapi/asm-generic/mman.h>
-/* MAP_32BIT is undefined on mn10300, fix it for perf */
-#define MAP_32BIT       0
-#endif
diff --git a/tools/arch/powerpc/include/uapi/asm/unistd.h b/tools/arch/powerpc/include/uapi/asm/unistd.h
new file mode 100644
index 000000000000..389c36fd8299
--- /dev/null
+++ b/tools/arch/powerpc/include/uapi/asm/unistd.h
@@ -0,0 +1,402 @@
+/* SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note */
+/*
+ * This file contains the system call numbers.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#ifndef _UAPI_ASM_POWERPC_UNISTD_H_
+#define _UAPI_ASM_POWERPC_UNISTD_H_
+
+
+#define __NR_restart_syscall      0
+#define __NR_exit                 1
+#define __NR_fork                 2
+#define __NR_read                 3
+#define __NR_write                4
+#define __NR_open                 5
+#define __NR_close                6
+#define __NR_waitpid              7
+#define __NR_creat                8
+#define __NR_link                 9
+#define __NR_unlink              10
+#define __NR_execve              11
+#define __NR_chdir               12
+#define __NR_time                13
+#define __NR_mknod               14
+#define __NR_chmod               15
+#define __NR_lchown              16
+#define __NR_break               17
+#define __NR_oldstat             18
+#define __NR_lseek               19
+#define __NR_getpid              20
+#define __NR_mount               21
+#define __NR_umount              22
+#define __NR_setuid              23
+#define __NR_getuid              24
+#define __NR_stime               25
+#define __NR_ptrace              26
+#define __NR_alarm               27
+#define __NR_oldfstat            28
+#define __NR_pause               29
+#define __NR_utime               30
+#define __NR_stty                31
+#define __NR_gtty                32
+#define __NR_access              33
+#define __NR_nice                34
+#define __NR_ftime               35
+#define __NR_sync                36
+#define __NR_kill                37
+#define __NR_rename              38
+#define __NR_mkdir               39
+#define __NR_rmdir               40
+#define __NR_dup                 41
+#define __NR_pipe                42
+#define __NR_times               43
+#define __NR_prof                44
+#define __NR_brk                 45
+#define __NR_setgid              46
+#define __NR_getgid              47
+#define __NR_signal              48
+#define __NR_geteuid             49
+#define __NR_getegid             50
+#define __NR_acct                51
+#define __NR_umount2             52
+#define __NR_lock                53
+#define __NR_ioctl               54
+#define __NR_fcntl               55
+#define __NR_mpx                 56
+#define __NR_setpgid             57
+#define __NR_ulimit              58
+#define __NR_oldolduname         59
+#define __NR_umask               60
+#define __NR_chroot              61
+#define __NR_ustat               62
+#define __NR_dup2                63
+#define __NR_getppid             64
+#define __NR_getpgrp             65
+#define __NR_setsid              66
+#define __NR_sigaction           67
+#define __NR_sgetmask            68
+#define __NR_ssetmask            69
+#define __NR_setreuid            70
+#define __NR_setregid            71
+#define __NR_sigsuspend          72
+#define __NR_sigpending          73
+#define __NR_sethostname         74
+#define __NR_setrlimit           75
+#define __NR_getrlimit           76
+#define __NR_getrusage           77
+#define __NR_gettimeofday        78
+#define __NR_settimeofday        79
+#define __NR_getgroups           80
+#define __NR_setgroups           81
+#define __NR_select              82
+#define __NR_symlink             83
+#define __NR_oldlstat            84
+#define __NR_readlink            85
+#define __NR_uselib              86
+#define __NR_swapon              87
+#define __NR_reboot              88
+#define __NR_readdir             89
+#define __NR_mmap                90
+#define __NR_munmap              91
+#define __NR_truncate            92
+#define __NR_ftruncate           93
+#define __NR_fchmod              94
+#define __NR_fchown              95
+#define __NR_getpriority         96
+#define __NR_setpriority         97
+#define __NR_profil              98
+#define __NR_statfs              99
+#define __NR_fstatfs            100
+#define __NR_ioperm             101
+#define __NR_socketcall         102
+#define __NR_syslog             103
+#define __NR_setitimer          104
+#define __NR_getitimer          105
+#define __NR_stat               106
+#define __NR_lstat              107
+#define __NR_fstat              108
+#define __NR_olduname           109
+#define __NR_iopl               110
+#define __NR_vhangup            111
+#define __NR_idle               112
+#define __NR_vm86               113
+#define __NR_wait4              114
+#define __NR_swapoff            115
+#define __NR_sysinfo            116
+#define __NR_ipc                117
+#define __NR_fsync              118
+#define __NR_sigreturn          119
+#define __NR_clone              120
+#define __NR_setdomainname      121
+#define __NR_uname              122
+#define __NR_modify_ldt         123
+#define __NR_adjtimex           124
+#define __NR_mprotect           125
+#define __NR_sigprocmask        126
+#define __NR_create_module      127
+#define __NR_init_module        128
+#define __NR_delete_module      129
+#define __NR_get_kernel_syms    130
+#define __NR_quotactl           131
+#define __NR_getpgid            132
+#define __NR_fchdir             133
+#define __NR_bdflush            134
+#define __NR_sysfs              135
+#define __NR_personality        136
+#define __NR_afs_syscall        137 /* Syscall for Andrew File System */
+#define __NR_setfsuid           138
+#define __NR_setfsgid           139
+#define __NR__llseek            140
+#define __NR_getdents           141
+#define __NR__newselect         142
+#define __NR_flock              143
+#define __NR_msync              144
+#define __NR_readv              145
+#define __NR_writev             146
+#define __NR_getsid             147
+#define __NR_fdatasync          148
+#define __NR__sysctl            149
+#define __NR_mlock              150
+#define __NR_munlock            151
+#define __NR_mlockall           152
+#define __NR_munlockall         153
+#define __NR_sched_setparam             154
+#define __NR_sched_getparam             155
+#define __NR_sched_setscheduler         156
+#define __NR_sched_getscheduler         157
+#define __NR_sched_yield                158
+#define __NR_sched_get_priority_max     159
+#define __NR_sched_get_priority_min     160
+#define __NR_sched_rr_get_interval      161
+#define __NR_nanosleep          162
+#define __NR_mremap             163
+#define __NR_setresuid          164
+#define __NR_getresuid          165
+#define __NR_query_module       166
+#define __NR_poll               167
+#define __NR_nfsservctl         168
+#define __NR_setresgid          169
+#define __NR_getresgid          170
+#define __NR_prctl              171
+#define __NR_rt_sigreturn       172
+#define __NR_rt_sigaction       173
+#define __NR_rt_sigprocmask     174
+#define __NR_rt_sigpending      175
+#define __NR_rt_sigtimedwait    176
+#define __NR_rt_sigqueueinfo    177
+#define __NR_rt_sigsuspend      178
+#define __NR_pread64            179
+#define __NR_pwrite64           180
+#define __NR_chown              181
+#define __NR_getcwd             182
+#define __NR_capget             183
+#define __NR_capset             184
+#define __NR_sigaltstack        185
+#define __NR_sendfile           186
+#define __NR_getpmsg            187     /* some people actually want streams */
+#define __NR_putpmsg            188     /* some people actually want streams */
+#define __NR_vfork              189
+#define __NR_ugetrlimit         190     /* SuS compliant getrlimit */
+#define __NR_readahead          191
+#ifndef __powerpc64__                   /* these are 32-bit only */
+#define __NR_mmap2              192
+#define __NR_truncate64         193
+#define __NR_ftruncate64        194
+#define __NR_stat64             195
+#define __NR_lstat64            196
+#define __NR_fstat64            197
+#endif
+#define __NR_pciconfig_read     198
+#define __NR_pciconfig_write    199
+#define __NR_pciconfig_iobase   200
+#define __NR_multiplexer        201
+#define __NR_getdents64         202
+#define __NR_pivot_root         203
+#ifndef __powerpc64__
+#define __NR_fcntl64            204
+#endif
+#define __NR_madvise            205
+#define __NR_mincore            206
+#define __NR_gettid             207
+#define __NR_tkill              208
+#define __NR_setxattr           209
+#define __NR_lsetxattr          210
+#define __NR_fsetxattr          211
+#define __NR_getxattr           212
+#define __NR_lgetxattr          213
+#define __NR_fgetxattr          214
+#define __NR_listxattr          215
+#define __NR_llistxattr         216
+#define __NR_flistxattr         217
+#define __NR_removexattr        218
+#define __NR_lremovexattr       219
+#define __NR_fremovexattr       220
+#define __NR_futex              221
+#define __NR_sched_setaffinity  222
+#define __NR_sched_getaffinity  223
+/* 224 currently unused */
+#define __NR_tuxcall            225
+#ifndef __powerpc64__
+#define __NR_sendfile64         226
+#endif
+#define __NR_io_setup           227
+#define __NR_io_destroy         228
+#define __NR_io_getevents       229
+#define __NR_io_submit          230
+#define __NR_io_cancel          231
+#define __NR_set_tid_address    232
+#define __NR_fadvise64          233
+#define __NR_exit_group         234
+#define __NR_lookup_dcookie     235
+#define __NR_epoll_create       236
+#define __NR_epoll_ctl          237
+#define __NR_epoll_wait         238
+#define __NR_remap_file_pages   239
+#define __NR_timer_create       240
+#define __NR_timer_settime      241
+#define __NR_timer_gettime      242
+#define __NR_timer_getoverrun   243
+#define __NR_timer_delete       244
+#define __NR_clock_settime      245
+#define __NR_clock_gettime      246
+#define __NR_clock_getres       247
+#define __NR_clock_nanosleep    248
+#define __NR_swapcontext        249
+#define __NR_tgkill             250
+#define __NR_utimes             251
+#define __NR_statfs64           252
+#define __NR_fstatfs64          253
+#ifndef __powerpc64__
+#define __NR_fadvise64_64       254
+#endif
+#define __NR_rtas               255
+#define __NR_sys_debug_setcontext 256
+/* Number 257 is reserved for vserver */
+#define __NR_migrate_pages      258
+#define __NR_mbind              259
+#define __NR_get_mempolicy      260
+#define __NR_set_mempolicy      261
+#define __NR_mq_open            262
+#define __NR_mq_unlink          263
+#define __NR_mq_timedsend       264
+#define __NR_mq_timedreceive    265
+#define __NR_mq_notify          266
+#define __NR_mq_getsetattr      267
+#define __NR_kexec_load         268
+#define __NR_add_key            269
+#define __NR_request_key        270
+#define __NR_keyctl             271
+#define __NR_waitid             272
+#define __NR_ioprio_set         273
+#define __NR_ioprio_get         274
+#define __NR_inotify_init       275
+#define __NR_inotify_add_watch  276
+#define __NR_inotify_rm_watch   277
+#define __NR_spu_run            278
+#define __NR_spu_create         279
+#define __NR_pselect6           280
+#define __NR_ppoll              281
+#define __NR_unshare            282
+#define __NR_splice             283
+#define __NR_tee                284
+#define __NR_vmsplice           285
+#define __NR_openat             286
+#define __NR_mkdirat            287
+#define __NR_mknodat            288
+#define __NR_fchownat           289
+#define __NR_futimesat          290
+#ifdef __powerpc64__
+#define __NR_newfstatat         291
+#else
+#define __NR_fstatat64          291
+#endif
+#define __NR_unlinkat           292
+#define __NR_renameat           293
+#define __NR_linkat             294
+#define __NR_symlinkat          295
+#define __NR_readlinkat         296
+#define __NR_fchmodat           297
+#define __NR_faccessat          298
+#define __NR_get_robust_list    299
+#define __NR_set_robust_list    300
+#define __NR_move_pages         301
+#define __NR_getcpu             302
+#define __NR_epoll_pwait        303
+#define __NR_utimensat          304
+#define __NR_signalfd           305
+#define __NR_timerfd_create     306
+#define __NR_eventfd            307
+#define __NR_sync_file_range2   308
+#define __NR_fallocate          309
+#define __NR_subpage_prot       310
+#define __NR_timerfd_settime    311
+#define __NR_timerfd_gettime    312
+#define __NR_signalfd4          313
+#define __NR_eventfd2           314
+#define __NR_epoll_create1      315
+#define __NR_dup3               316
+#define __NR_pipe2              317
+#define __NR_inotify_init1      318
+#define __NR_perf_event_open    319
+#define __NR_preadv             320
+#define __NR_pwritev            321
+#define __NR_rt_tgsigqueueinfo  322
+#define __NR_fanotify_init      323
+#define __NR_fanotify_mark      324
+#define __NR_prlimit64          325
+#define __NR_socket             326
+#define __NR_bind               327
+#define __NR_connect            328
+#define __NR_listen             329
+#define __NR_accept             330
+#define __NR_getsockname        331
+#define __NR_getpeername        332
+#define __NR_socketpair         333
+#define __NR_send               334
+#define __NR_sendto             335
+#define __NR_recv               336
+#define __NR_recvfrom           337
+#define __NR_shutdown           338
+#define __NR_setsockopt         339
+#define __NR_getsockopt         340
+#define __NR_sendmsg            341
+#define __NR_recvmsg            342
+#define __NR_recvmmsg           343
+#define __NR_accept4            344
+#define __NR_name_to_handle_at  345
+#define __NR_open_by_handle_at  346
+#define __NR_clock_adjtime      347
+#define __NR_syncfs             348
+#define __NR_sendmmsg           349
+#define __NR_setns              350
+#define __NR_process_vm_readv   351
+#define __NR_process_vm_writev  352
+#define __NR_finit_module       353
+#define __NR_kcmp               354
+#define __NR_sched_setattr      355
+#define __NR_sched_getattr      356
+#define __NR_renameat2          357
+#define __NR_seccomp            358
+#define __NR_getrandom          359
+#define __NR_memfd_create       360
+#define __NR_bpf                361
+#define __NR_execveat           362
+#define __NR_switch_endian      363
+#define __NR_userfaultfd        364
+#define __NR_membarrier         365
+#define __NR_mlock2             378
+#define __NR_copy_file_range    379
+#define __NR_preadv2            380
+#define __NR_pwritev2           381
+#define __NR_kexec_file_load    382
+#define __NR_statx              383
+#define __NR_pkey_alloc         384
+#define __NR_pkey_free          385
+#define __NR_pkey_mprotect      386
+
+#endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/tools/arch/score/include/uapi/asm/bitsperlong.h b/tools/arch/score/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index df48f2717da2..000000000000
--- a/tools/arch/score/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef _ASM_SCORE_BITSPERLONG_H
-#define _ASM_SCORE_BITSPERLONG_H
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* _ASM_SCORE_BITSPERLONG_H */
diff --git a/tools/arch/score/include/uapi/asm/mman.h b/tools/arch/score/include/uapi/asm/mman.h
deleted file mode 100644
index b4bd195a8586..000000000000
--- a/tools/arch/score/include/uapi/asm/mman.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef TOOLS_ARCH_SCORE_UAPI_ASM_MMAN_FIX_H
-#define TOOLS_ARCH_SCORE_UAPI_ASM_MMAN_FIX_H
-#include <uapi/asm-generic/mman.h>
-/* MAP_32BIT is undefined on score, fix it for perf */
-#define MAP_32BIT       0
-#endif
diff --git a/tools/arch/tile/include/asm/barrier.h b/tools/arch/tile/include/asm/barrier.h
deleted file mode 100644
index 7ad02a591b43..000000000000
--- a/tools/arch/tile/include/asm/barrier.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _TOOLS_LINUX_ASM_TILE_BARRIER_H
-#define _TOOLS_LINUX_ASM_TILE_BARRIER_H
-/*
- * FIXME: This came from tools/perf/perf-sys.h, where it was first introduced
- * in 620830b6954913647b7c7f68920cf48eddf6ad92, more work needed to make it
- * more closely follow the Linux kernel arch/tile/include/asm/barrier.h file.
- * Probably when we continue work on tools/ Kconfig support to have all the
- * CONFIG_ needed for properly doing that.
- */
-
-#define mb()            asm volatile ("mf" ::: "memory")
-#define wmb()           mb()
-#define rmb()           mb()
-
-#endif /* _TOOLS_LINUX_ASM_TILE_BARRIER_H */
diff --git a/tools/arch/tile/include/uapi/asm/bitsperlong.h b/tools/arch/tile/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 57cca78c0fbb..000000000000
--- a/tools/arch/tile/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * Copyright 2010 Tilera Corporation. All Rights Reserved.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of the GNU General Public License
- *   as published by the Free Software Foundation, version 2.
- *
- *   This program is distributed in the hope that it will be useful, but
- *   WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- *   NON INFRINGEMENT.  See the GNU General Public License for
- *   more details.
- */
-
-#ifndef _ASM_TILE_BITSPERLONG_H
-#define _ASM_TILE_BITSPERLONG_H
-
-#ifdef __LP64__
-# define __BITS_PER_LONG 64
-#else
-# define __BITS_PER_LONG 32
-#endif
-
-#include <asm-generic/bitsperlong.h>
-
-#endif /* _ASM_TILE_BITSPERLONG_H */
diff --git a/tools/arch/tile/include/uapi/asm/mman.h b/tools/arch/tile/include/uapi/asm/mman.h
deleted file mode 100644
index 65ec92925c6c..000000000000
--- a/tools/arch/tile/include/uapi/asm/mman.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef TOOLS_ARCH_TILE_UAPI_ASM_MMAN_FIX_H
-#define TOOLS_ARCH_TILE_UAPI_ASM_MMAN_FIX_H
-#define MAP_DENYWRITE   0x0800
-#define MAP_EXECUTABLE  0x1000
-#define MAP_GROWSDOWN   0x0100
-#define MAP_HUGETLB     0x4000
-#define MAP_LOCKED      0x0200
-#define MAP_NONBLOCK    0x0080
-#define MAP_NORESERVE   0x0400
-#define MAP_POPULATE    0x0040
-#define MAP_STACK       MAP_GROWSDOWN
-#include <uapi/asm-generic/mman-common.h>
-/* MAP_32BIT is undefined on tile, fix it for perf */
-#define MAP_32BIT       0
-#endif
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index f41079da38c5..578793e97431 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -316,9 +316,11 @@
 #define X86_FEATURE_VPCLMULQDQ          (16*32+10) /* Carry-Less Multiplication Double Quadword */
 #define X86_FEATURE_AVX512_VNNI         (16*32+11) /* Vector Neural Network Instructions */
 #define X86_FEATURE_AVX512_BITALG       (16*32+12) /* Support for VPOPCNT[B,W] and VPSHUF-BITQMB instructions */
+#define X86_FEATURE_TME                 (16*32+13) /* Intel Total Memory Encryption */
 #define X86_FEATURE_AVX512_VPOPCNTDQ    (16*32+14) /* POPCNT for vectors of DW/QW */
 #define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
 #define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
+#define X86_FEATURE_CLDEMOTE            (16*32+25) /* CLDEMOTE instruction */
 
 /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
 #define X86_FEATURE_OVERFLOW_RECOV      (17*32+ 0) /* MCA overflow recovery support */
@@ -328,6 +330,7 @@
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW       (18*32+ 2) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS       (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+#define X86_FEATURE_PCONFIG             (18*32+18) /* Intel PCONFIG */
 #define X86_FEATURE_SPEC_CTRL           (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
 #define X86_FEATURE_INTEL_STIBP         (18*32+27) /* "" Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ARCH_CAPABILITIES   (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h
index fb3a6de7440b..6847d85400a8 100644
--- a/tools/arch/x86/include/asm/required-features.h
+++ b/tools/arch/x86/include/asm/required-features.h
@@ -53,12 +53,6 @@
 # define NEED_MOVBE     0
 #endif
 
-#ifdef CONFIG_X86_5LEVEL
-# define NEED_LA57      (1<<(X86_FEATURE_LA57 & 31))
-#else
-# define NEED_LA57      0
-#endif
-
 #ifdef CONFIG_X86_64
 #ifdef CONFIG_PARAVIRT
 /* Paravirtualized systems may not have PSE or PGE available */
@@ -104,7 +98,7 @@
 #define REQUIRED_MASK13 0
 #define REQUIRED_MASK14 0
 #define REQUIRED_MASK15 0
-#define REQUIRED_MASK16 (NEED_LA57)
+#define REQUIRED_MASK16 0
 #define REQUIRED_MASK17 0
 #define REQUIRED_MASK18 0
 #define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
diff --git a/tools/arch/x86/include/uapi/asm/kvm.h b/tools/arch/x86/include/uapi/asm/kvm.h
index f3a960488eae..c535c2fdea13 100644
--- a/tools/arch/x86/include/uapi/asm/kvm.h
+++ b/tools/arch/x86/include/uapi/asm/kvm.h
@@ -354,8 +354,25 @@ struct kvm_xcrs {
         __u64 padding[16];
 };
 
-/* definition of registers in kvm_run */
+#define KVM_SYNC_X86_REGS      (1UL << 0)
+#define KVM_SYNC_X86_SREGS     (1UL << 1)
+#define KVM_SYNC_X86_EVENTS    (1UL << 2)
+
+#define KVM_SYNC_X86_VALID_FIELDS \
+        (KVM_SYNC_X86_REGS| \
+         KVM_SYNC_X86_SREGS| \
+         KVM_SYNC_X86_EVENTS)
+
+/* kvm_sync_regs struct included by kvm_run struct */
 struct kvm_sync_regs {
+        /* Members of this structure are potentially malicious.
+         * Care must be taken by code reading, esp. interpreting,
+         * data fields from them inside KVM to prevent TOCTOU and
+         * double-fetch types of vulnerabilities.
+         */
+        struct kvm_regs regs;
+        struct kvm_sregs sregs;
+        struct kvm_vcpu_events events;
 };
 
 #define KVM_X86_QUIRK_LINT0_REENABLED   (1 << 0)
diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile
index c8ec0ae16bf0..53b60ad452f5 100644
--- a/tools/bpf/Makefile
+++ b/tools/bpf/Makefile
@@ -1,19 +1,28 @@
 # SPDX-License-Identifier: GPL-2.0
-prefix = /usr
+include ../scripts/Makefile.include
+
+prefix ?= /usr/local
 
 CC = gcc
 LEX = flex
 YACC = bison
 MAKE = make
+INSTALL ?= install
 
 CFLAGS += -Wall -O2
-CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
+CFLAGS += -D__EXPORTED_HEADERS__ -I$(srctree)/include/uapi -I$(srctree)/include
 
 ifeq ($(srctree),)
 srctree := $(patsubst %/,%,$(dir $(CURDIR)))
 srctree := $(patsubst %/,%,$(dir $(srctree)))
 endif
 
+ifeq ($(V),1)
+  Q =
+else
+  Q = @
+endif
+
 FEATURE_USER = .bpf
 FEATURE_TESTS = libbfd disassembler-four-args
 FEATURE_DISPLAY = libbfd disassembler-four-args
@@ -38,40 +47,61 @@ ifeq ($(feature-disassembler-four-args), 1)
 CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
 endif
 
-%.yacc.c: %.y
-        $(YACC) -o $@ -d $<
+$(OUTPUT)%.yacc.c: $(srctree)/tools/bpf/%.y
+        $(QUIET_BISON)$(YACC) -o $@ -d $<
 
-%.lex.c: %.l
-        $(LEX) -o $@ $<
+$(OUTPUT)%.lex.c: $(srctree)/tools/bpf/%.l
+        $(QUIET_FLEX)$(LEX) -o $@ $<
 
-all: bpf_jit_disasm bpf_dbg bpf_asm bpftool
+$(OUTPUT)%.o: $(srctree)/tools/bpf/%.c
+        $(QUIET_CC)$(COMPILE.c) -o $@ $<
 
-bpf_jit_disasm : CFLAGS += -DPACKAGE='bpf_jit_disasm'
-bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl
-bpf_jit_disasm : bpf_jit_disasm.o
+$(OUTPUT)%.yacc.o: $(OUTPUT)%.yacc.c
+        $(QUIET_CC)$(COMPILE.c) -o $@ $<
+$(OUTPUT)%.lex.o: $(OUTPUT)%.lex.c
+        $(QUIET_CC)$(COMPILE.c) -o $@ $<
 
-bpf_dbg : LDLIBS = -lreadline
-bpf_dbg : bpf_dbg.o
+PROGS = $(OUTPUT)bpf_jit_disasm $(OUTPUT)bpf_dbg $(OUTPUT)bpf_asm
 
-bpf_asm : LDLIBS =
-bpf_asm : bpf_asm.o bpf_exp.yacc.o bpf_exp.lex.o
-bpf_exp.lex.o : bpf_exp.yacc.c
+all: $(PROGS) bpftool
 
-clean: bpftool_clean
-        rm -rf *.o bpf_jit_disasm bpf_dbg bpf_asm bpf_exp.yacc.* bpf_exp.lex.*
+$(OUTPUT)bpf_jit_disasm: CFLAGS += -DPACKAGE='bpf_jit_disasm'
+$(OUTPUT)bpf_jit_disasm: $(OUTPUT)bpf_jit_disasm.o
+        $(QUIET_LINK)$(CC) $(CFLAGS) -o $@ $^ -lopcodes -lbfd -ldl
 
-install: bpftool_install
-        install bpf_jit_disasm $(prefix)/bin/bpf_jit_disasm
-        install bpf_dbg $(prefix)/bin/bpf_dbg
-        install bpf_asm $(prefix)/bin/bpf_asm
+$(OUTPUT)bpf_dbg: $(OUTPUT)bpf_dbg.o
+        $(QUIET_LINK)$(CC) $(CFLAGS) -o $@ $^ -lreadline
+
+$(OUTPUT)bpf_asm: $(OUTPUT)bpf_asm.o $(OUTPUT)bpf_exp.yacc.o $(OUTPUT)bpf_exp.lex.o
+        $(QUIET_LINK)$(CC) $(CFLAGS) -o $@ $^
+
+$(OUTPUT)bpf_exp.lex.c: $(OUTPUT)bpf_exp.yacc.c
+$(OUTPUT)bpf_exp.yacc.o: $(OUTPUT)bpf_exp.yacc.c
+$(OUTPUT)bpf_exp.lex.o: $(OUTPUT)bpf_exp.lex.c
+
+clean: bpftool_clean
+        $(call QUIET_CLEAN, bpf-progs)
+        $(Q)rm -rf $(OUTPUT)*.o $(OUTPUT)bpf_jit_disasm $(OUTPUT)bpf_dbg \
+               $(OUTPUT)bpf_asm $(OUTPUT)bpf_exp.yacc.* $(OUTPUT)bpf_exp.lex.*
+        $(call QUIET_CLEAN, core-gen)
+        $(Q)rm -f $(OUTPUT)FEATURE-DUMP.bpf
+
+install: $(PROGS) bpftool_install
+        $(call QUIET_INSTALL, bpf_jit_disasm)
+        $(Q)$(INSTALL) -m 0755 -d $(DESTDIR)$(prefix)/bin
+        $(Q)$(INSTALL) $(OUTPUT)bpf_jit_disasm $(DESTDIR)$(prefix)/bin/bpf_jit_disasm
+        $(call QUIET_INSTALL, bpf_dbg)
+        $(Q)$(INSTALL) $(OUTPUT)bpf_dbg $(DESTDIR)$(prefix)/bin/bpf_dbg
+        $(call QUIET_INSTALL, bpf_asm)
+        $(Q)$(INSTALL) $(OUTPUT)bpf_asm $(DESTDIR)$(prefix)/bin/bpf_asm
 
 bpftool:
-        $(MAKE) -C bpftool
+        $(call descend,bpftool)
 
 bpftool_install:
-        $(MAKE) -C bpftool install
+        $(call descend,bpftool,install)
 
 bpftool_clean:
-        $(MAKE) -C bpftool clean
+        $(call descend,bpftool,clean)
 
-.PHONY: bpftool FORCE
+.PHONY: all install clean bpftool bpftool_install bpftool_clean
diff --git a/tools/bpf/bpf_dbg.c b/tools/bpf/bpf_dbg.c
index 4f254bcc4423..61b9aa5d6415 100644
--- a/tools/bpf/bpf_dbg.c
+++ b/tools/bpf/bpf_dbg.c
@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file)
 
 static int cmd_load(char *arg)
 {
-        char *subcmd, *cont, *tmp = strdup(arg);
+        char *subcmd, *cont = NULL, *tmp = strdup(arg);
         int ret = CMD_OK;
 
         subcmd = strtok_r(tmp, " ", &cont);
@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg)
                 bpf_reset();
                 bpf_reset_breakpoints();
 
-                ret = cmd_load_bpf(cont);
+                if (!cont)
+                        ret = CMD_ERR;
+                else
+                        ret = cmd_load_bpf(cont);
         } else if (matches(subcmd, "pcap") == 0) {
                 ret = cmd_load_pcap(cont);
         } else {
diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
index e4ceee7f2dff..67ca6c69376c 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
@@ -21,7 +21,7 @@ MAP COMMANDS
 =============
 
 |       **bpftool** **prog { show | list }** [*PROG*]
-|       **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes**}]
+|       **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}]
 |       **bpftool** **prog dump jited**  *PROG* [{**file** *FILE* | **opcodes**}]
 |       **bpftool** **prog pin** *PROG* *FILE*
 |       **bpftool** **prog load** *OBJ* *FILE*
@@ -39,12 +39,18 @@ DESCRIPTION
                   Output will start with program ID followed by program type and
                   zero or more named attributes (depending on kernel version).
 
-        **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** }]
-                  Dump eBPF instructions of the program from the kernel.
-                  If *FILE* is specified image will be written to a file,
-                  otherwise it will be disassembled and printed to stdout.
+        **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }]
+                  Dump eBPF instructions of the program from the kernel. By
+                  default, eBPF will be disassembled and printed to standard
+                  output in human-readable format. In this case, **opcodes**
+                  controls if raw opcodes should be printed as well.
 
-                  **opcodes** controls if raw opcodes will be printed.
+                  If **file** is specified, the binary image will instead be
+                  written to *FILE*.
+
+                  If **visual** is specified, control flow graph (CFG) will be
+                  built instead, and eBPF instructions will be presented with
+                  CFG in DOT format, on standard output.
 
         **bpftool prog dump jited**  *PROG* [{ **file** *FILE* | **opcodes** }]
                   Dump jited image (host machine code) of the program.
diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
index 26901ec87361..4e69782c4a79 100644
--- a/tools/bpf/bpftool/Makefile
+++ b/tools/bpf/bpftool/Makefile
@@ -38,7 +38,7 @@ bash_compdir ?= /usr/share/bash-completion/completions
 CC = gcc
 
 CFLAGS += -O2
-CFLAGS += -W -Wall -Wextra -Wno-unused-parameter -Wshadow
+CFLAGS += -W -Wall -Wextra -Wno-unused-parameter -Wshadow -Wno-missing-field-initializers
 CFLAGS += -DPACKAGE='"bpftool"' -D__EXPORTED_HEADERS__ -I$(srctree)/tools/include/uapi -I$(srctree)/tools/include -I$(srctree)/tools/lib/bpf -I$(srctree)/kernel/bpf/
 CFLAGS += -DBPFTOOL_VERSION='"$(BPFTOOL_VERSION)"'
 LIBS = -lelf -lbfd -lopcodes $(LIBBPF)
@@ -70,7 +70,7 @@ ifeq ($(feature-disassembler-four-args), 1)
 CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
 endif
 
-include $(wildcard *.d)
+include $(wildcard $(OUTPUT)*.d)
 
 all: $(OUTPUT)bpftool
 
@@ -89,6 +89,8 @@ $(OUTPUT)%.o: %.c
 clean: $(LIBBPF)-clean
         $(call QUIET_CLEAN, bpftool)
         $(Q)$(RM) $(OUTPUT)bpftool $(OUTPUT)*.o $(OUTPUT)*.d
+        $(call QUIET_CLEAN, core-gen)
+        $(Q)$(RM) $(OUTPUT)FEATURE-DUMP.bpftool
 
 install: $(OUTPUT)bpftool
         $(call QUIET_INSTALL, bpftool)
diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index 08719c54a614..490811b45fa7 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -147,7 +147,7 @@ _bpftool()
 
     # Deal with simplest keywords
     case $prev in
-        help|key|opcodes)
+        help|key|opcodes|visual)
             return 0
             ;;
         tag)
@@ -223,11 +223,16 @@ _bpftool()
                             return 0
                             ;;
                     *)
-                            _bpftool_once_attr 'file'
+                        _bpftool_once_attr 'file'
+                        if _bpftool_search_list 'xlated'; then
+                            COMPREPLY+=( $( compgen -W 'opcodes visual' -- \
+                                "$cur" ) )
+                        else
                             COMPREPLY+=( $( compgen -W 'opcodes' -- \
                                 "$cur" ) )
-                            return 0
-                            ;;
+                        fi
+                        return 0
+                        ;;
                     esac
                     ;;
                 pin)
diff --git a/tools/bpf/bpftool/cfg.c b/tools/bpf/bpftool/cfg.c
new file mode 100644
index 000000000000..f30b3a4a840b
--- /dev/null
+++ b/tools/bpf/bpftool/cfg.c
@@ -0,0 +1,514 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/*
+ * Copyright (C) 2018 Netronome Systems, Inc.
+ *
+ * This software is dual licensed under the GNU General License Version 2,
+ * June 1991 as shown in the file COPYING in the top-level directory of this
+ * source tree or the BSD 2-Clause License provided below.  You have the
+ * option to license this software under the complete terms of either license.
+ *
+ * The BSD 2-Clause License:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      1. Redistributions of source code must retain the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer.
+ *
+ *      2. Redistributions in binary form must reproduce the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer in the documentation and/or other materials
+ *         provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/list.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "cfg.h"
+#include "main.h"
+#include "xlated_dumper.h"
+
+struct cfg {
+        struct list_head funcs;
+        int func_num;
+};
+
+struct func_node {
+        struct list_head l;
+        struct list_head bbs;
+        struct bpf_insn *start;
+        struct bpf_insn *end;
+        int idx;
+        int bb_num;
+};
+
+struct bb_node {
+        struct list_head l;
+        struct list_head e_prevs;
+        struct list_head e_succs;
+        struct bpf_insn *head;
+        struct bpf_insn *tail;
+        int idx;
+};
+
+#define EDGE_FLAG_EMPTY         0x0
+#define EDGE_FLAG_FALLTHROUGH   0x1
+#define EDGE_FLAG_JUMP          0x2
+struct edge_node {
+        struct list_head l;
+        struct bb_node *src;
+        struct bb_node *dst;
+        int flags;
+};
+
+#define ENTRY_BLOCK_INDEX       0
+#define EXIT_BLOCK_INDEX        1
+#define NUM_FIXED_BLOCKS        2
+#define func_prev(func)         list_prev_entry(func, l)
+#define func_next(func)         list_next_entry(func, l)
+#define bb_prev(bb)             list_prev_entry(bb, l)
+#define bb_next(bb)             list_next_entry(bb, l)
+#define entry_bb(func)          func_first_bb(func)
+#define exit_bb(func)           func_last_bb(func)
+#define cfg_first_func(cfg)     \
+        list_first_entry(&cfg->funcs, struct func_node, l)
+#define cfg_last_func(cfg)      \
+        list_last_entry(&cfg->funcs, struct func_node, l)
+#define func_first_bb(func)     \
+        list_first_entry(&func->bbs, struct bb_node, l)
+#define func_last_bb(func)      \
+        list_last_entry(&func->bbs, struct bb_node, l)
+
+static struct func_node *cfg_append_func(struct cfg *cfg, struct bpf_insn *insn)
+{
+        struct func_node *new_func, *func;
+
+        list_for_each_entry(func, &cfg->funcs, l) {
+                if (func->start == insn)
+                        return func;
+                else if (func->start > insn)
+                        break;
+        }
+
+        func = func_prev(func);
+        new_func = calloc(1, sizeof(*new_func));
+        if (!new_func) {
+                p_err("OOM when allocating FUNC node");
+                return NULL;
+        }
+        new_func->start = insn;
+        new_func->idx = cfg->func_num;
+        list_add(&new_func->l, &func->l);
+        cfg->func_num++;
+
+        return new_func;
+}
+
+static struct bb_node *func_append_bb(struct func_node *func,
+                                      struct bpf_insn *insn)
+{
+        struct bb_node *new_bb, *bb;
+
+        list_for_each_entry(bb, &func->bbs, l) {
+                if (bb->head == insn)
+                        return bb;
+                else if (bb->head > insn)
+                        break;
+        }
+
+        bb = bb_prev(bb);
+        new_bb = calloc(1, sizeof(*new_bb));
+        if (!new_bb) {
+                p_err("OOM when allocating BB node");
+                return NULL;
+        }
+        new_bb->head = insn;
+        INIT_LIST_HEAD(&new_bb->e_prevs);
+        INIT_LIST_HEAD(&new_bb->e_succs);
+        list_add(&new_bb->l, &bb->l);
+
+        return new_bb;
+}
+
+static struct bb_node *func_insert_dummy_bb(struct list_head *after)
+{
+        struct bb_node *bb;
+
+        bb = calloc(1, sizeof(*bb));
+        if (!bb) {
+                p_err("OOM when allocating BB node");
+                return NULL;
+        }
+
+        INIT_LIST_HEAD(&bb->e_prevs);
+        INIT_LIST_HEAD(&bb->e_succs);
+        list_add(&bb->l, after);
+
+        return bb;
+}
+
+static bool cfg_partition_funcs(struct cfg *cfg, struct bpf_insn *cur,
+                                struct bpf_insn *end)
+{
+        struct func_node *func, *last_func;
+
+        func = cfg_append_func(cfg, cur);
+        if (!func)
+                return true;
+
+        for (; cur < end; cur++) {
+                if (cur->code != (BPF_JMP | BPF_CALL))
+                        continue;
+                if (cur->src_reg != BPF_PSEUDO_CALL)
+                        continue;
+                func = cfg_append_func(cfg, cur + cur->off + 1);
+                if (!func)
+                        return true;
+        }
+
+        last_func = cfg_last_func(cfg);
+        last_func->end = end - 1;
+        func = cfg_first_func(cfg);
+        list_for_each_entry_from(func, &last_func->l, l) {
+                func->end = func_next(func)->start - 1;
+        }
+
+        return false;
+}
+
+static bool func_partition_bb_head(struct func_node *func)
+{
+        struct bpf_insn *cur, *end;
+        struct bb_node *bb;
+
+        cur = func->start;
+        end = func->end;
+        INIT_LIST_HEAD(&func->bbs);
+        bb = func_append_bb(func, cur);
+        if (!bb)
+                return true;
+
+        for (; cur <= end; cur++) {
+                if (BPF_CLASS(cur->code) == BPF_JMP) {
+                        u8 opcode = BPF_OP(cur->code);
+
+                        if (opcode == BPF_EXIT || opcode == BPF_CALL)
+                                continue;
+
+                        bb = func_append_bb(func, cur + cur->off + 1);
+                        if (!bb)
+                                return true;
+
+                        if (opcode != BPF_JA) {
+                                bb = func_append_bb(func, cur + 1);
+                                if (!bb)
+                                        return true;
+                        }
+                }
+        }
+
+        return false;
+}
+
+static void func_partition_bb_tail(struct func_node *func)
+{
+        unsigned int bb_idx = NUM_FIXED_BLOCKS;
+        struct bb_node *bb, *last;
+
+        last = func_last_bb(func);
+        last->tail = func->end;
+        bb = func_first_bb(func);
+        list_for_each_entry_from(bb, &last->l, l) {
+                bb->tail = bb_next(bb)->head - 1;
+                bb->idx = bb_idx++;
+        }
+
+        last->idx = bb_idx++;
+        func->bb_num = bb_idx;
+}
+
+static bool func_add_special_bb(struct func_node *func)
+{
+        struct bb_node *bb;
+
+        bb = func_insert_dummy_bb(&func->bbs);
+        if (!bb)
+                return true;
+        bb->idx = ENTRY_BLOCK_INDEX;
+
+        bb = func_insert_dummy_bb(&func_last_bb(func)->l);
+        if (!bb)
+                return true;
+        bb->idx = EXIT_BLOCK_INDEX;
+
+        return false;
+}
+
+static bool func_partition_bb(struct func_node *func)
+{
+        if (func_partition_bb_head(func))
+                return true;
+
+        func_partition_bb_tail(func);
+
+        return false;
+}
+
+static struct bb_node *func_search_bb_with_head(struct func_node *func,
+                                                struct bpf_insn *insn)
+{
+        struct bb_node *bb;
+
+        list_for_each_entry(bb, &func->bbs, l) {
+                if (bb->head == insn)
+                        return bb;
+        }
+
+        return NULL;
+}
+
+static struct edge_node *new_edge(struct bb_node *src, struct bb_node *dst,
+                                  int flags)
+{
+        struct edge_node *e;
+
+        e = calloc(1, sizeof(*e));
+        if (!e) {
+                p_err("OOM when allocating edge node");
+                return NULL;
+        }
+
+        if (src)
+                e->src = src;
+        if (dst)
+                e->dst = dst;
+
+        e->flags |= flags;
+
+        return e;
+}
+
+static bool func_add_bb_edges(struct func_node *func)
+{
+        struct bpf_insn *insn;
+        struct edge_node *e;
+        struct bb_node *bb;
+
+        bb = entry_bb(func);
+        e = new_edge(bb, bb_next(bb), EDGE_FLAG_FALLTHROUGH);
+        if (!e)
+                return true;
+        list_add_tail(&e->l, &bb->e_succs);
+
+        bb = exit_bb(func);
+        e = new_edge(bb_prev(bb), bb, EDGE_FLAG_FALLTHROUGH);
+        if (!e)
+                return true;
+        list_add_tail(&e->l, &bb->e_prevs);
+
+        bb = entry_bb(func);
+        bb = bb_next(bb);
+        list_for_each_entry_from(bb, &exit_bb(func)->l, l) {
+                e = new_edge(bb, NULL, EDGE_FLAG_EMPTY);
+                if (!e)
+                        return true;
+                e->src = bb;
+
+                insn = bb->tail;
+                if (BPF_CLASS(insn->code) != BPF_JMP ||
+                    BPF_OP(insn->code) == BPF_EXIT) {
+                        e->dst = bb_next(bb);
+                        e->flags |= EDGE_FLAG_FALLTHROUGH;
+                        list_add_tail(&e->l, &bb->e_succs);
+                        continue;
+                } else if (BPF_OP(insn->code) == BPF_JA) {
+                        e->dst = func_search_bb_with_head(func,
+                                                          insn + insn->off + 1);
+                        e->flags |= EDGE_FLAG_JUMP;
+                        list_add_tail(&e->l, &bb->e_succs);
+                        continue;
+                }
+
+                e->dst = bb_next(bb);
+                e->flags |= EDGE_FLAG_FALLTHROUGH;
+                list_add_tail(&e->l, &bb->e_succs);
+
+                e = new_edge(bb, NULL, EDGE_FLAG_JUMP);
+                if (!e)
+                        return true;
+                e->src = bb;
+                e->dst = func_search_bb_with_head(func, insn + insn->off + 1);
+                list_add_tail(&e->l, &bb->e_succs);
+        }
+
+        return false;
+}
+
+static bool cfg_build(struct cfg *cfg, struct bpf_insn *insn, unsigned int len)
+{
+        int cnt = len / sizeof(*insn);
+        struct func_node *func;
+
+        INIT_LIST_HEAD(&cfg->funcs);
+
+        if (cfg_partition_funcs(cfg, insn, insn + cnt))
+                return true;
+
+        list_for_each_entry(func, &cfg->funcs, l) {
+                if (func_partition_bb(func) || func_add_special_bb(func))
+                        return true;
+
+                if (func_add_bb_edges(func))
+                        return true;
+        }
+
+        return false;
+}
+
+static void cfg_destroy(struct cfg *cfg)
+{
+        struct func_node *func, *func2;
+
+        list_for_each_entry_safe(func, func2, &cfg->funcs, l) {
+                struct bb_node *bb, *bb2;
+
+                list_for_each_entry_safe(bb, bb2, &func->bbs, l) {
+                        struct edge_node *e, *e2;
+
+                        list_for_each_entry_safe(e, e2, &bb->e_prevs, l) {
+                                list_del(&e->l);
+                                free(e);
+                        }
+
+                        list_for_each_entry_safe(e, e2, &bb->e_succs, l) {
+                                list_del(&e->l);
+                                free(e);
+                        }
+
+                        list_del(&bb->l);
+                        free(bb);
+                }
+
+                list_del(&func->l);
+                free(func);
+        }
+}
+
+static void draw_bb_node(struct func_node *func, struct bb_node *bb)
+{
+        const char *shape;
+
+        if (bb->idx == ENTRY_BLOCK_INDEX || bb->idx == EXIT_BLOCK_INDEX)
+                shape = "Mdiamond";
+        else
+                shape = "record";
+
+        printf("\tfn_%d_bb_%d [shape=%s,style=filled,label=\"",
+               func->idx, bb->idx, shape);
+
+        if (bb->idx == ENTRY_BLOCK_INDEX) {
+                printf("ENTRY");
+        } else if (bb->idx == EXIT_BLOCK_INDEX) {
+                printf("EXIT");
+        } else {
+                unsigned int start_idx;
+                struct dump_data dd = {};
+
+                printf("{");
+                kernel_syms_load(&dd);
+                start_idx = bb->head - func->start;
+                dump_xlated_for_graph(&dd, bb->head, bb->tail, start_idx);
+                kernel_syms_destroy(&dd);
+                printf("}");
+        }
+
+        printf("\"];\n\n");
+}
+
+static void draw_bb_succ_edges(struct func_node *func, struct bb_node *bb)
+{
+        const char *style = "\"solid,bold\"";
+        const char *color = "black";
+        int func_idx = func->idx;
+        struct edge_node *e;
+        int weight = 10;
+
+        if (list_empty(&bb->e_succs))
+                return;
+
+        list_for_each_entry(e, &bb->e_succs, l) {
+                printf("\tfn_%d_bb_%d:s -> fn_%d_bb_%d:n [style=%s, color=%s, weight=%d, constraint=true",
+                       func_idx, e->src->idx, func_idx, e->dst->idx,
+                       style, color, weight);
+                printf("];\n");
+        }
+}
+
+static void func_output_bb_def(struct func_node *func)
+{
+        struct bb_node *bb;
+
+        list_for_each_entry(bb, &func->bbs, l) {
+                draw_bb_node(func, bb);
+        }
+}
+
+static void func_output_edges(struct func_node *func)
+{
+        int func_idx = func->idx;
+        struct bb_node *bb;
+
+        list_for_each_entry(bb, &func->bbs, l) {
+                draw_bb_succ_edges(func, bb);
+        }
+
+        /* Add an invisible edge from ENTRY to EXIT, this is to
+         * improve the graph layout.
+         */
+        printf("\tfn_%d_bb_%d:s -> fn_%d_bb_%d:n [style=\"invis\", constraint=true];\n",
+               func_idx, ENTRY_BLOCK_INDEX, func_idx, EXIT_BLOCK_INDEX);
+}
+
+static void cfg_dump(struct cfg *cfg)
+{
+        struct func_node *func;
+
+        printf("digraph \"DOT graph for eBPF program\" {\n");
+        list_for_each_entry(func, &cfg->funcs, l) {
+                printf("subgraph \"cluster_%d\" {\n\tstyle=\"dashed\";\n\tcolor=\"black\";\n\tlabel=\"func_%d ()\";\n",
+                       func->idx, func->idx);
+                func_output_bb_def(func);
+                func_output_edges(func);
+                printf("}\n");
+        }
+        printf("}\n");
+}
+
+void dump_xlated_cfg(void *buf, unsigned int len)
+{
+        struct bpf_insn *insn = buf;
+        struct cfg cfg;
+
+        memset(&cfg, 0, sizeof(cfg));
+        if (cfg_build(&cfg, insn, len))
+                return;
+
+        cfg_dump(&cfg);
+
+        cfg_destroy(&cfg);
+}
diff --git a/tools/bpf/bpftool/cfg.h b/tools/bpf/bpftool/cfg.h
new file mode 100644
index 000000000000..2cc9bd990b13
--- /dev/null
+++ b/tools/bpf/bpftool/cfg.h
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/*
+ * Copyright (C) 2018 Netronome Systems, Inc.
+ *
+ * This software is dual licensed under the GNU General License Version 2,
+ * June 1991 as shown in the file COPYING in the top-level directory of this
+ * source tree or the BSD 2-Clause License provided below.  You have the
+ * option to license this software under the complete terms of either license.
+ *
+ * The BSD 2-Clause License:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      1. Redistributions of source code must retain the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer.
+ *
+ *      2. Redistributions in binary form must reproduce the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer in the documentation and/or other materials
+ *         provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __BPF_TOOL_CFG_H
+#define __BPF_TOOL_CFG_H
+
+void dump_xlated_cfg(void *buf, unsigned int len);
+
+#endif /* __BPF_TOOL_CFG_H */
diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index 185acfa229b5..1ec852d21d44 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -46,6 +46,9 @@
 
 #include "main.h"
 
+#define BATCH_LINE_LEN_MAX 65536
+#define BATCH_ARG_NB_MAX 4096
+
 const char *bin_name;
 static int last_argc;
 static char **last_argv;
@@ -157,6 +160,54 @@ void fprint_hex(FILE *f, void *arg, unsigned int n, const char *sep)
         }
 }
 
+/* Split command line into argument vector. */
+static int make_args(char *line, char *n_argv[], int maxargs, int cmd_nb)
+{
+        static const char ws[] = " \t\r\n";
+        char *cp = line;
+        int n_argc = 0;
+
+        while (*cp) {
+                /* Skip leading whitespace. */
+                cp += strspn(cp, ws);
+
+                if (*cp == '\0')
+                        break;
+
+                if (n_argc >= (maxargs - 1)) {
+                        p_err("too many arguments to command %d", cmd_nb);
+                        return -1;
+                }
+
+                /* Word begins with quote. */
+                if (*cp == '\'' || *cp == '"') {
+                        char quote = *cp++;
+
+                        n_argv[n_argc++] = cp;
+                        /* Find ending quote. */
+                        cp = strchr(cp, quote);
+                        if (!cp) {
+                                p_err("unterminated quoted string in command %d",
+                                      cmd_nb);
+                                return -1;
+                        }
+                } else {
+                        n_argv[n_argc++] = cp;
+
+                        /* Find end of word. */
+                        cp += strcspn(cp, ws);
+                        if (*cp == '\0')
+                                break;
+                }
+
+                /* Separate words. */
+                *cp++ = 0;
+        }
+        n_argv[n_argc] = NULL;
+
+        return n_argc;
+}
+
 static int do_batch(int argc, char **argv);
 
 static const struct cmd cmds[] = {
@@ -171,11 +222,12 @@ static const struct cmd cmds[] = {
 
 static int do_batch(int argc, char **argv)
 {
+        char buf[BATCH_LINE_LEN_MAX], contline[BATCH_LINE_LEN_MAX];
+        char *n_argv[BATCH_ARG_NB_MAX];
         unsigned int lines = 0;
-        char *n_argv[4096];
-        char buf[65536];
         int n_argc;
         FILE *fp;
+        char *cp;
         int err;
         int i;
 
@@ -191,7 +243,10 @@ static int do_batch(int argc, char **argv)
         }
         NEXT_ARG();
 
-        fp = fopen(*argv, "r");
+        if (!strcmp(*argv, "-"))
+                fp = stdin;
+        else
+                fp = fopen(*argv, "r");
         if (!fp) {
                 p_err("Can't open file (%s): %s", *argv, strerror(errno));
                 return -1;
@@ -200,27 +255,45 @@ static int do_batch(int argc, char **argv)
         if (json_output)
                 jsonw_start_array(json_wtr);
         while (fgets(buf, sizeof(buf), fp)) {
+                cp = strchr(buf, '#');
+                if (cp)
+                        *cp = '\0';
+
                 if (strlen(buf) == sizeof(buf) - 1) {
                         errno = E2BIG;
                         break;
                 }
 
-                n_argc = 0;
-                n_argv[n_argc] = strtok(buf, " \t\n");
-
-                while (n_argv[n_argc]) {
-                        n_argc++;
-                        if (n_argc == ARRAY_SIZE(n_argv)) {
-                                p_err("line %d has too many arguments, skip",
+                /* Append continuation lines if any (coming after a line ending
+                 * with '\' in the batch file).
+                 */
+                while ((cp = strstr(buf, "\\\n")) != NULL) {
+                        if (!fgets(contline, sizeof(contline), fp) ||
+                            strlen(contline) == 0) {
+                                p_err("missing continuation line on command %d",
                                       lines);
-                                n_argc = 0;
-                                break;
+                                err = -1;
+                                goto err_close;
+                        }
+
+                        cp = strchr(contline, '#');
+                        if (cp)
+                                *cp = '\0';
+
+                        if (strlen(buf) + strlen(contline) + 1 > sizeof(buf)) {
+                                p_err("command %d is too long", lines);
+                                err = -1;
+                                goto err_close;
                         }
-                        n_argv[n_argc] = strtok(NULL, " \t\n");
+                        buf[strlen(buf) - 2] = '\0';
+                        strcat(buf, contline);
                 }
 
+                n_argc = make_args(buf, n_argv, BATCH_ARG_NB_MAX, lines);
                 if (!n_argc)
                         continue;
+                if (n_argc < 0)
+                        goto err_close;
 
                 if (json_output) {
                         jsonw_start_object(json_wtr);
@@ -247,11 +320,12 @@ static int do_batch(int argc, char **argv)
                 p_err("reading batch file failed: %s", strerror(errno));
                 err = -1;
         } else {
-                p_info("processed %d lines", lines);
+                p_info("processed %d commands", lines);
                 err = 0;
         }
 err_close:
-        fclose(fp);
+        if (fp != stdin)
+                fclose(fp);
 
         if (json_output)
                 jsonw_end_array(json_wtr);
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index f95fa67bb498..f509c86faede 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -428,7 +428,7 @@ static int show_map_close_json(int fd, struct bpf_map_info *info)
                 jsonw_string_field(json_wtr, "name", info->name);
 
         jsonw_name(json_wtr, "flags");
-        jsonw_printf(json_wtr, "%#x", info->map_flags);
+        jsonw_printf(json_wtr, "%d", info->map_flags);
 
         print_dev_json(info->ifindex, info->netns_dev, info->netns_ino);
 
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index e549e329be82..f7a810897eac 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -47,8 +47,9 @@
 #include <bpf.h>
 #include <libbpf.h>
 
+#include "cfg.h"
 #include "main.h"
-#include "disasm.h"
+#include "xlated_dumper.h"
 
 static const char * const prog_type_name[] = {
         [BPF_PROG_TYPE_UNSPEC]          = "unspec",
@@ -407,259 +408,6 @@ static int do_show(int argc, char **argv)
         return err;
 }
 
-#define SYM_MAX_NAME    256
-
-struct kernel_sym {
-        unsigned long address;
-        char name[SYM_MAX_NAME];
-};
-
-struct dump_data {
-        unsigned long address_call_base;
-        struct kernel_sym *sym_mapping;
-        __u32 sym_count;
-        char scratch_buff[SYM_MAX_NAME];
-};
-
-static int kernel_syms_cmp(const void *sym_a, const void *sym_b)
-{
-        return ((struct kernel_sym *)sym_a)->address -
-               ((struct kernel_sym *)sym_b)->address;
-}
-
-static void kernel_syms_load(struct dump_data *dd)
-{
-        struct kernel_sym *sym;
-        char buff[256];
-        void *tmp, *address;
-        FILE *fp;
-
-        fp = fopen("/proc/kallsyms", "r");
-        if (!fp)
-                return;
-
-        while (!feof(fp)) {
-                if (!fgets(buff, sizeof(buff), fp))
-                        break;
-                tmp = realloc(dd->sym_mapping,
-                              (dd->sym_count + 1) *
-                              sizeof(*dd->sym_mapping));
-                if (!tmp) {
-out:
-                        free(dd->sym_mapping);
-                        dd->sym_mapping = NULL;
-                        fclose(fp);
-                        return;
-                }
-                dd->sym_mapping = tmp;
-                sym = &dd->sym_mapping[dd->sym_count];
-                if (sscanf(buff, "%p %*c %s", &address, sym->name) != 2)
-                        continue;
-                sym->address = (unsigned long)address;
-                if (!strcmp(sym->name, "__bpf_call_base")) {
-                        dd->address_call_base = sym->address;
-                        /* sysctl kernel.kptr_restrict was set */
-                        if (!sym->address)
-                                goto out;
-                }
-                if (sym->address)
-                        dd->sym_count++;
-        }
-
-        fclose(fp);
-
-        qsort(dd->sym_mapping, dd->sym_count,
-              sizeof(*dd->sym_mapping), kernel_syms_cmp);
-}
-
-static void kernel_syms_destroy(struct dump_data *dd)
-{
-        free(dd->sym_mapping);
-}
-
-static struct kernel_sym *kernel_syms_search(struct dump_data *dd,
-                                             unsigned long key)
-{
-        struct kernel_sym sym = {
-                .address = key,
-        };
-
-        return dd->sym_mapping ?
-               bsearch(&sym, dd->sym_mapping, dd->sym_count,
-                       sizeof(*dd->sym_mapping), kernel_syms_cmp) : NULL;
-}
-
-static void print_insn(struct bpf_verifier_env *env, const char *fmt, ...)
-{
-        va_list args;
-
-        va_start(args, fmt);
-        vprintf(fmt, args);
-        va_end(args);
-}
-
-static const char *print_call_pcrel(struct dump_data *dd,
-                                    struct kernel_sym *sym,
-                                    unsigned long address,
-                                    const struct bpf_insn *insn)
-{
-        if (sym)
-                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
-                         "%+d#%s", insn->off, sym->name);
-        else
-                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
-                         "%+d#0x%lx", insn->off, address);
-        return dd->scratch_buff;
-}
-
-static const char *print_call_helper(struct dump_data *dd,
-                                     struct kernel_sym *sym,
-                                     unsigned long address)
-{
-        if (sym)
-                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
-                         "%s", sym->name);
-        else
-                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
-                         "0x%lx", address);
-        return dd->scratch_buff;
-}
-
-static const char *print_call(void *private_data,
-                              const struct bpf_insn *insn)
-{
-        struct dump_data *dd = private_data;
-        unsigned long address = dd->address_call_base + insn->imm;
-        struct kernel_sym *sym;
-
-        sym = kernel_syms_search(dd, address);
-        if (insn->src_reg == BPF_PSEUDO_CALL)
-                return print_call_pcrel(dd, sym, address, insn);
-        else
-                return print_call_helper(dd, sym, address);
-}
-
-static const char *print_imm(void *private_data,
-                             const struct bpf_insn *insn,
-                             __u64 full_imm)
-{
-        struct dump_data *dd = private_data;
-
-        if (insn->src_reg == BPF_PSEUDO_MAP_FD)
-                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
-                         "map[id:%u]", insn->imm);
-        else
-                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
-                         "0x%llx", (unsigned long long)full_imm);
-        return dd->scratch_buff;
-}
-
-static void dump_xlated_plain(struct dump_data *dd, void *buf,
-                              unsigned int len, bool opcodes)
-{
-        const struct bpf_insn_cbs cbs = {
-                .cb_print       = print_insn,
-                .cb_call        = print_call,
-                .cb_imm         = print_imm,
-                .private_data   = dd,
-        };
-        struct bpf_insn *insn = buf;
-        bool double_insn = false;
-        unsigned int i;
-
-        for (i = 0; i < len / sizeof(*insn); i++) {
-                if (double_insn) {
-                        double_insn = false;
-                        continue;
-                }
-
-                double_insn = insn[i].code == (BPF_LD | BPF_IMM | BPF_DW);
-
-                printf("% 4d: ", i);
-                print_bpf_insn(&cbs, NULL, insn + i, true);
-
-                if (opcodes) {
-                        printf("       ");
-                        fprint_hex(stdout, insn + i, 8, " ");
-                        if (double_insn && i < len - 1) {
-                                printf(" ");
-                                fprint_hex(stdout, insn + i + 1, 8, " ");
-                        }
-                        printf("\n");
-                }
-        }
-}
-
-static void print_insn_json(struct bpf_verifier_env *env, const char *fmt, ...)
-{
-        unsigned int l = strlen(fmt);
-        char chomped_fmt[l];
-        va_list args;
-
-        va_start(args, fmt);
-        if (l > 0) {
-                strncpy(chomped_fmt, fmt, l - 1);
-                chomped_fmt[l - 1] = '\0';
-        }
-        jsonw_vprintf_enquote(json_wtr, chomped_fmt, args);
-        va_end(args);
-}
-
-static void dump_xlated_json(struct dump_data *dd, void *buf,
-                             unsigned int len, bool opcodes)
-{
-        const struct bpf_insn_cbs cbs = {
-                .cb_print       = print_insn_json,
-                .cb_call        = print_call,
-                .cb_imm         = print_imm,
-                .private_data   = dd,
-        };
-        struct bpf_insn *insn = buf;
-        bool double_insn = false;
-        unsigned int i;
-
-        jsonw_start_array(json_wtr);
-        for (i = 0; i < len / sizeof(*insn); i++) {
-                if (double_insn) {
-                        double_insn = false;
-                        continue;
-                }
-                double_insn = insn[i].code == (BPF_LD | BPF_IMM | BPF_DW);
-
-                jsonw_start_object(json_wtr);
-                jsonw_name(json_wtr, "disasm");
-                print_bpf_insn(&cbs, NULL, insn + i, true);
-
-                if (opcodes) {
-                        jsonw_name(json_wtr, "opcodes");
-                        jsonw_start_object(json_wtr);
-
-                        jsonw_name(json_wtr, "code");
-                        jsonw_printf(json_wtr, "\"0x%02hhx\"", insn[i].code);
-
-                        jsonw_name(json_wtr, "src_reg");
-                        jsonw_printf(json_wtr, "\"0x%hhx\"", insn[i].src_reg);
-
-                        jsonw_name(json_wtr, "dst_reg");
-                        jsonw_printf(json_wtr, "\"0x%hhx\"", insn[i].dst_reg);
-
-                        jsonw_name(json_wtr, "off");
-                        print_hex_data_json((uint8_t *)(&insn[i].off), 2);
-
-                        jsonw_name(json_wtr, "imm");
-                        if (double_insn && i < len - 1)
-                                print_hex_data_json((uint8_t *)(&insn[i].imm),
-                                                    12);
-                        else
-                                print_hex_data_json((uint8_t *)(&insn[i].imm),
-                                                    4);
-                        jsonw_end_object(json_wtr);
-                }
-                jsonw_end_object(json_wtr);
-        }
-        jsonw_end_array(json_wtr);
-}
-
 static int do_dump(int argc, char **argv)
 {
         struct bpf_prog_info info = {};
@@ -668,6 +416,7 @@ static int do_dump(int argc, char **argv)
         unsigned int buf_size;
         char *filepath = NULL;
         bool opcodes = false;
+        bool visual = false;
         unsigned char *buf;
         __u32 *member_len;
         __u64 *member_ptr;
@@ -706,6 +455,9 @@ static int do_dump(int argc, char **argv)
         } else if (is_prefix(*argv, "opcodes")) {
                 opcodes = true;
                 NEXT_ARG();
+        } else if (is_prefix(*argv, "visual")) {
+                visual = true;
+                NEXT_ARG();
         }
 
         if (argc) {
@@ -777,27 +529,30 @@ static int do_dump(int argc, char **argv)
 
                 if (json_output)
                         jsonw_null(json_wtr);
-        } else {
-                if (member_len == &info.jited_prog_len) {
-                        const char *name = NULL;
-
-                        if (info.ifindex) {
-                                name = ifindex_to_bfd_name_ns(info.ifindex,
-                                                              info.netns_dev,
-                                                              info.netns_ino);
-                                if (!name)
-                                        goto err_free;
-                        }
-
-                        disasm_print_insn(buf, *member_len, opcodes, name);
-                } else {
-                        kernel_syms_load(&dd);
-                        if (json_output)
-                                dump_xlated_json(&dd, buf, *member_len, opcodes);
-                        else
-                                dump_xlated_plain(&dd, buf, *member_len, opcodes);
-                        kernel_syms_destroy(&dd);
+        } else if (member_len == &info.jited_prog_len) {
+                const char *name = NULL;
+
+                if (info.ifindex) {
+                        name = ifindex_to_bfd_name_ns(info.ifindex,
+                                                      info.netns_dev,
+                                                      info.netns_ino);
+                        if (!name)
+                                goto err_free;
                 }
+
+                disasm_print_insn(buf, *member_len, opcodes, name);
+        } else if (visual) {
+                if (json_output)
+                        jsonw_null(json_wtr);
+                else
+                        dump_xlated_cfg(buf, *member_len);
+        } else {
+                kernel_syms_load(&dd);
+                if (json_output)
+                        dump_xlated_json(&dd, buf, *member_len, opcodes);
+                else
+                        dump_xlated_plain(&dd, buf, *member_len, opcodes);
+                kernel_syms_destroy(&dd);
         }
 
         free(buf);
@@ -851,7 +606,7 @@ static int do_help(int argc, char **argv)
 
         fprintf(stderr,
                 "Usage: %s %s { show | list } [PROG]\n"
-                "       %s %s dump xlated PROG [{ file FILE | opcodes }]\n"
+                "       %s %s dump xlated PROG [{ file FILE | opcodes | visual }]\n"
                 "       %s %s dump jited  PROG [{ file FILE | opcodes }]\n"
                 "       %s %s pin   PROG FILE\n"
                 "       %s %s load  OBJ  FILE\n"
diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
new file mode 100644
index 000000000000..7a3173b76c16
--- /dev/null
+++ b/tools/bpf/bpftool/xlated_dumper.c
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/*
+ * Copyright (C) 2018 Netronome Systems, Inc.
+ *
+ * This software is dual licensed under the GNU General License Version 2,
+ * June 1991 as shown in the file COPYING in the top-level directory of this
+ * source tree or the BSD 2-Clause License provided below.  You have the
+ * option to license this software under the complete terms of either license.
+ *
+ * The BSD 2-Clause License:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      1. Redistributions of source code must retain the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer.
+ *
+ *      2. Redistributions in binary form must reproduce the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer in the documentation and/or other materials
+ *         provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+
+#include "disasm.h"
+#include "json_writer.h"
+#include "main.h"
+#include "xlated_dumper.h"
+
+static int kernel_syms_cmp(const void *sym_a, const void *sym_b)
+{
+        return ((struct kernel_sym *)sym_a)->address -
+               ((struct kernel_sym *)sym_b)->address;
+}
+
+void kernel_syms_load(struct dump_data *dd)
+{
+        struct kernel_sym *sym;
+        char buff[256];
+        void *tmp, *address;
+        FILE *fp;
+
+        fp = fopen("/proc/kallsyms", "r");
+        if (!fp)
+                return;
+
+        while (!feof(fp)) {
+                if (!fgets(buff, sizeof(buff), fp))
+                        break;
+                tmp = realloc(dd->sym_mapping,
+                              (dd->sym_count + 1) *
+                              sizeof(*dd->sym_mapping));
+                if (!tmp) {
+out:
+                        free(dd->sym_mapping);
+                        dd->sym_mapping = NULL;
+                        fclose(fp);
+                        return;
+                }
+                dd->sym_mapping = tmp;
+                sym = &dd->sym_mapping[dd->sym_count];
+                if (sscanf(buff, "%p %*c %s", &address, sym->name) != 2)
+                        continue;
+                sym->address = (unsigned long)address;
+                if (!strcmp(sym->name, "__bpf_call_base")) {
+                        dd->address_call_base = sym->address;
+                        /* sysctl kernel.kptr_restrict was set */
+                        if (!sym->address)
+                                goto out;
+                }
+                if (sym->address)
+                        dd->sym_count++;
+        }
+
+        fclose(fp);
+
+        qsort(dd->sym_mapping, dd->sym_count,
+              sizeof(*dd->sym_mapping), kernel_syms_cmp);
+}
+
+void kernel_syms_destroy(struct dump_data *dd)
+{
+        free(dd->sym_mapping);
+}
+
+static struct kernel_sym *kernel_syms_search(struct dump_data *dd,
+                                             unsigned long key)
+{
+        struct kernel_sym sym = {
+                .address = key,
+        };
+
+        return dd->sym_mapping ?
+               bsearch(&sym, dd->sym_mapping, dd->sym_count,
+                       sizeof(*dd->sym_mapping), kernel_syms_cmp) : NULL;
+}
+
+static void print_insn(void *private_data, const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        vprintf(fmt, args);
+        va_end(args);
+}
+
+static void
+print_insn_for_graph(void *private_data, const char *fmt, ...)
+{
+        char buf[64], *p;
+        va_list args;
+
+        va_start(args, fmt);
+        vsnprintf(buf, sizeof(buf), fmt, args);
+        va_end(args);
+
+        p = buf;
+        while (*p != '\0') {
+                if (*p == '\n') {
+                        memmove(p + 3, p, strlen(buf) + 1 - (p - buf));
+                        /* Align each instruction dump row left. */
+                        *p++ = '\\';
+                        *p++ = 'l';
+                        /* Output multiline concatenation. */
+                        *p++ = '\\';
+                } else if (*p == '<' || *p == '>' || *p == '|' || *p == '&') {
+                        memmove(p + 1, p, strlen(buf) + 1 - (p - buf));
+                        /* Escape special character. */
+                        *p++ = '\\';
+                }
+
+                p++;
+        }
+
+        printf("%s", buf);
+}
+
+static void print_insn_json(void *private_data, const char *fmt, ...)
+{
+        unsigned int l = strlen(fmt);
+        char chomped_fmt[l];
+        va_list args;
+
+        va_start(args, fmt);
+        if (l > 0) {
+                strncpy(chomped_fmt, fmt, l - 1);
+                chomped_fmt[l - 1] = '\0';
+        }
+        jsonw_vprintf_enquote(json_wtr, chomped_fmt, args);
+        va_end(args);
+}
+
+static const char *print_call_pcrel(struct dump_data *dd,
+                                    struct kernel_sym *sym,
+                                    unsigned long address,
+                                    const struct bpf_insn *insn)
+{
+        if (sym)
+                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
+                         "%+d#%s", insn->off, sym->name);
+        else
+                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
+                         "%+d#0x%lx", insn->off, address);
+        return dd->scratch_buff;
+}
+
+static const char *print_call_helper(struct dump_data *dd,
+                                     struct kernel_sym *sym,
+                                     unsigned long address)
+{
+        if (sym)
+                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
+                         "%s", sym->name);
+        else
+                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
+                         "0x%lx", address);
+        return dd->scratch_buff;
+}
+
+static const char *print_call(void *private_data,
+                              const struct bpf_insn *insn)
+{
+        struct dump_data *dd = private_data;
+        unsigned long address = dd->address_call_base + insn->imm;
+        struct kernel_sym *sym;
+
+        sym = kernel_syms_search(dd, address);
+        if (insn->src_reg == BPF_PSEUDO_CALL)
+                return print_call_pcrel(dd, sym, address, insn);
+        else
+                return print_call_helper(dd, sym, address);
+}
+
+static const char *print_imm(void *private_data,
+                             const struct bpf_insn *insn,
+                             __u64 full_imm)
+{
+        struct dump_data *dd = private_data;
+
+        if (insn->src_reg == BPF_PSEUDO_MAP_FD)
+                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
+                         "map[id:%u]", insn->imm);
+        else
+                snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
+                         "0x%llx", (unsigned long long)full_imm);
+        return dd->scratch_buff;
+}
+
+void dump_xlated_json(struct dump_data *dd, void *buf, unsigned int len,
+                      bool opcodes)
+{
+        const struct bpf_insn_cbs cbs = {
+                .cb_print       = print_insn_json,
+                .cb_call        = print_call,
+                .cb_imm         = print_imm,
+                .private_data   = dd,
+        };
+        struct bpf_insn *insn = buf;
+        bool double_insn = false;
+        unsigned int i;
+
+        jsonw_start_array(json_wtr);
+        for (i = 0; i < len / sizeof(*insn); i++) {
+                if (double_insn) {
+                        double_insn = false;
+                        continue;
+                }
+                double_insn = insn[i].code == (BPF_LD | BPF_IMM | BPF_DW);
+
+                jsonw_start_object(json_wtr);
+                jsonw_name(json_wtr, "disasm");
+                print_bpf_insn(&cbs, insn + i, true);
+
+                if (opcodes) {
+                        jsonw_name(json_wtr, "opcodes");
+                        jsonw_start_object(json_wtr);
+
+                        jsonw_name(json_wtr, "code");
+                        jsonw_printf(json_wtr, "\"0x%02hhx\"", insn[i].code);
+
+                        jsonw_name(json_wtr, "src_reg");
+                        jsonw_printf(json_wtr, "\"0x%hhx\"", insn[i].src_reg);
+
+                        jsonw_name(json_wtr, "dst_reg");
+                        jsonw_printf(json_wtr, "\"0x%hhx\"", insn[i].dst_reg);
+
+                        jsonw_name(json_wtr, "off");
+                        print_hex_data_json((uint8_t *)(&insn[i].off), 2);
+
+                        jsonw_name(json_wtr, "imm");
+                        if (double_insn && i < len - 1)
+                                print_hex_data_json((uint8_t *)(&insn[i].imm),
+                                                    12);
+                        else
+                                print_hex_data_json((uint8_t *)(&insn[i].imm),
+                                                    4);
+                        jsonw_end_object(json_wtr);
+                }
+                jsonw_end_object(json_wtr);
+        }
+        jsonw_end_array(json_wtr);
+}
+
+void dump_xlated_plain(struct dump_data *dd, void *buf, unsigned int len,
+                       bool opcodes)
+{
+        const struct bpf_insn_cbs cbs = {
+                .cb_print       = print_insn,
+                .cb_call        = print_call,
+                .cb_imm         = print_imm,
+                .private_data   = dd,
+        };
+        struct bpf_insn *insn = buf;
+        bool double_insn = false;
+        unsigned int i;
+
+        for (i = 0; i < len / sizeof(*insn); i++) {
+                if (double_insn) {
+                        double_insn = false;
+                        continue;
+                }
+
+                double_insn = insn[i].code == (BPF_LD | BPF_IMM | BPF_DW);
+
+                printf("% 4d: ", i);
+                print_bpf_insn(&cbs, insn + i, true);
+
+                if (opcodes) {
+                        printf("       ");
+                        fprint_hex(stdout, insn + i, 8, " ");
+                        if (double_insn && i < len - 1) {
+                                printf(" ");
+                                fprint_hex(stdout, insn + i + 1, 8, " ");
+                        }
+                        printf("\n");
+                }
+        }
+}
+
+void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
+                           unsigned int start_idx)
+{
+        const struct bpf_insn_cbs cbs = {
+                .cb_print       = print_insn_for_graph,
+                .cb_call        = print_call,
+                .cb_imm         = print_imm,
+                .private_data   = dd,
+        };
+        struct bpf_insn *insn_start = buf_start;
+        struct bpf_insn *insn_end = buf_end;
+        struct bpf_insn *cur = insn_start;
+
+        for (; cur <= insn_end; cur++) {
+                printf("% 4d: ", (int)(cur - insn_start + start_idx));
+                print_bpf_insn(&cbs, cur, true);
+                if (cur != insn_end)
+                        printf(" | ");
+        }
+}
diff --git a/tools/bpf/bpftool/xlated_dumper.h b/tools/bpf/bpftool/xlated_dumper.h
new file mode 100644
index 000000000000..b34affa7ef2d
--- /dev/null
+++ b/tools/bpf/bpftool/xlated_dumper.h
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/*
+ * Copyright (C) 2018 Netronome Systems, Inc.
+ *
+ * This software is dual licensed under the GNU General License Version 2,
+ * June 1991 as shown in the file COPYING in the top-level directory of this
+ * source tree or the BSD 2-Clause License provided below.  You have the
+ * option to license this software under the complete terms of either license.
+ *
+ * The BSD 2-Clause License:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      1. Redistributions of source code must retain the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer.
+ *
+ *      2. Redistributions in binary form must reproduce the above
+ *         copyright notice, this list of conditions and the following
+ *         disclaimer in the documentation and/or other materials
+ *         provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __BPF_TOOL_XLATED_DUMPER_H
+#define __BPF_TOOL_XLATED_DUMPER_H
+
+#define SYM_MAX_NAME    256
+
+struct kernel_sym {
+        unsigned long address;
+        char name[SYM_MAX_NAME];
+};
+
+struct dump_data {
+        unsigned long address_call_base;
+        struct kernel_sym *sym_mapping;
+        __u32 sym_count;
+        char scratch_buff[SYM_MAX_NAME + 8];
+};
+
+void kernel_syms_load(struct dump_data *dd);
+void kernel_syms_destroy(struct dump_data *dd);
+void dump_xlated_json(struct dump_data *dd, void *buf, unsigned int len,
+                      bool opcodes);
+void dump_xlated_plain(struct dump_data *dd, void *buf, unsigned int len,
+                       bool opcodes);
+void dump_xlated_for_graph(struct dump_data *dd, void *buf, void *buf_end,
+                           unsigned int start_index);
+
+#endif
diff --git a/tools/build/Build.include b/tools/build/Build.include
index 418871d02ebf..a4bbb984941d 100644
--- a/tools/build/Build.include
+++ b/tools/build/Build.include
@@ -12,6 +12,7 @@
 # Convenient variables
 comma   := ,
 squote  := '
+pound   := \#
 
 ###
 # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
@@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\
 ###
 # Replace >$< with >$$< to preserve $ when reloading the .cmd file
 # (needed for make)
-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
+# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
 # (needed for make)
 # Replace >'< with >'\''< to be able to enclose the whole string in '...'
 # (needed for the shell)
-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
+make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
 
 ###
 # Find any prerequisites that is newer than target or that does not exist.
diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
index c378f003b007..5b6dda3b1ca8 100644
--- a/tools/build/Makefile.feature
+++ b/tools/build/Makefile.feature
@@ -82,7 +82,11 @@ FEATURE_TESTS_EXTRA :=                  \
          liberty-z                      \
          libunwind-debug-frame          \
          libunwind-debug-frame-arm      \
-         libunwind-debug-frame-aarch64
+         libunwind-debug-frame-aarch64  \
+         cxx                            \
+         llvm                           \
+         llvm-version                   \
+         clang
 
 FEATURE_TESTS ?= $(FEATURE_TESTS_BASIC)
 
diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
index 0a490cb15149..dac9563b5470 100644
--- a/tools/build/feature/Makefile
+++ b/tools/build/feature/Makefile
@@ -54,7 +54,10 @@ FILES=                                          \
          test-jvmti.bin                         \
          test-sched_getcpu.bin                  \
          test-setns.bin                         \
-         test-libopencsd.bin
+         test-libopencsd.bin                    \
+         test-clang.bin                         \
+         test-llvm.bin                          \
+         test-llvm-version.bin
 
 FILES := $(addprefix $(OUTPUT),$(FILES))
 
@@ -257,11 +260,13 @@ $(OUTPUT)test-llvm.bin:
                 -I$(shell $(LLVM_CONFIG) --includedir)          \
                 -L$(shell $(LLVM_CONFIG) --libdir)              \
                 $(shell $(LLVM_CONFIG) --libs Core BPF)         \
-                $(shell $(LLVM_CONFIG) --system-libs)
+                $(shell $(LLVM_CONFIG) --system-libs)           \
+                > $(@:.bin=.make.output) 2>&1
 
 $(OUTPUT)test-llvm-version.bin:
         $(BUILDXX) -std=gnu++11                                 \
-                -I$(shell $(LLVM_CONFIG) --includedir)
+                -I$(shell $(LLVM_CONFIG) --includedir)          \
+                > $(@:.bin=.make.output) 2>&1
 
 $(OUTPUT)test-clang.bin:
         $(BUILDXX) -std=gnu++11                                 \
@@ -271,7 +276,8 @@ $(OUTPUT)test-clang.bin:
                   -lclangFrontend -lclangEdit -lclangLex        \
                   -lclangAST -Wl,--end-group                    \
                 $(shell $(LLVM_CONFIG) --libs Core option)      \
-                $(shell $(LLVM_CONFIG) --system-libs)
+                $(shell $(LLVM_CONFIG) --system-libs)           \
+                > $(@:.bin=.make.output) 2>&1
 
 -include $(OUTPUT)*.d
 
diff --git a/tools/gpio/gpio-event-mon.c b/tools/gpio/gpio-event-mon.c
index dac4d4131d9b..c864544efe05 100644
--- a/tools/gpio/gpio-event-mon.c
+++ b/tools/gpio/gpio-event-mon.c
@@ -99,7 +99,7 @@ int monitor_device(const char *device_name,
                         ret = -EIO;
                         break;
                 }
-                fprintf(stdout, "GPIO EVENT %" PRIu64 ": ", event.timestamp);
+                fprintf(stdout, "GPIO EVENT %llu: ", event.timestamp);
                 switch (event.id) {
                 case GPIOEVENT_EVENT_RISING_EDGE:
                         fprintf(stdout, "rising edge");
diff --git a/tools/hv/hv_fcopy_daemon.c b/tools/hv/hv_fcopy_daemon.c
index 457a1521f32f..d78aed86af09 100644
--- a/tools/hv/hv_fcopy_daemon.c
+++ b/tools/hv/hv_fcopy_daemon.c
@@ -21,15 +21,17 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <string.h>
 #include <errno.h>
 #include <linux/hyperv.h>
+#include <linux/limits.h>
 #include <syslog.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <getopt.h>
 
 static int target_fd;
-static char target_fname[W_MAX_PATH];
+static char target_fname[PATH_MAX];
 static unsigned long long filesize;
 
 static int hv_start_fcopy(struct hv_start_fcopy *smsg)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 4c99c57736ce..dbf6e8bd98ba 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -634,64 +634,6 @@ static char *kvp_if_name_to_mac(char *if_name)
         return mac_addr;
 }
 
-
-/*
- * Retrieve the interface name given tha MAC address.
- */
-
-static char *kvp_mac_to_if_name(char *mac)
-{
-        DIR *dir;
-        struct dirent *entry;
-        FILE    *file;
-        char    *p, *x;
-        char    *if_name = NULL;
-        char    buf[256];
-        char dev_id[PATH_MAX];
-        unsigned int i;
-
-        dir = opendir(KVP_NET_DIR);
-        if (dir == NULL)
-                return NULL;
-
-        while ((entry = readdir(dir)) != NULL) {
-                /*
-                 * Set the state for the next pass.
-                 */
-                snprintf(dev_id, sizeof(dev_id), "%s%s/address", KVP_NET_DIR,
-                         entry->d_name);
-
-                file = fopen(dev_id, "r");
-                if (file == NULL)
-                        continue;
-
-                p = fgets(buf, sizeof(buf), file);
-                if (p) {
-                        x = strchr(p, '\n');
-                        if (x)
-                                *x = '\0';
-
-                        for (i = 0; i < strlen(p); i++)
-                                p[i] = toupper(p[i]);
-
-                        if (!strcmp(p, mac)) {
-                                /*
-                                 * Found the MAC match; return the interface
-                                 * name. The caller will free the memory.
-                                 */
-                                if_name = strdup(entry->d_name);
-                                fclose(file);
-                                break;
-                        }
-                }
-                fclose(file);
-        }
-
-        closedir(dir);
-        return if_name;
-}
-
-
 static void kvp_process_ipconfig_file(char *cmd,
                                         char *config_buf, unsigned int len,
                                         int element_size, int offset)
@@ -997,6 +939,70 @@ getaddr_done:
         return error;
 }
 
+/*
+ * Retrieve the IP given the MAC address.
+ */
+static int kvp_mac_to_ip(struct hv_kvp_ipaddr_value *kvp_ip_val)
+{
+        char *mac = (char *)kvp_ip_val->adapter_id;
+        DIR *dir;
+        struct dirent *entry;
+        FILE    *file;
+        char    *p, *x;
+        char    *if_name = NULL;
+        char    buf[256];
+        char dev_id[PATH_MAX];
+        unsigned int i;
+        int error = HV_E_FAIL;
+
+        dir = opendir(KVP_NET_DIR);
+        if (dir == NULL)
+                return HV_E_FAIL;
+
+        while ((entry = readdir(dir)) != NULL) {
+                /*
+                 * Set the state for the next pass.
+                 */
+                snprintf(dev_id, sizeof(dev_id), "%s%s/address", KVP_NET_DIR,
+                         entry->d_name);
+
+                file = fopen(dev_id, "r");
+                if (file == NULL)
+                        continue;
+
+                p = fgets(buf, sizeof(buf), file);
+                fclose(file);
+                if (!p)
+                        continue;
+
+                x = strchr(p, '\n');
+                if (x)
+                        *x = '\0';
+
+                for (i = 0; i < strlen(p); i++)
+                        p[i] = toupper(p[i]);
+
+                if (strcmp(p, mac))
+                        continue;
+
+                /*
+                 * Found the MAC match.
+                 * A NIC (e.g. VF) matching the MAC, but without IP, is skipped.
+                 */
+                if_name = entry->d_name;
+                if (!if_name)
+                        continue;
+
+                error = kvp_get_ip_info(0, if_name, KVP_OP_GET_IP_INFO,
+                                        kvp_ip_val, MAX_IP_ADDR_SIZE * 2);
+
+                if (!error && strlen((char *)kvp_ip_val->ip_addr))
+                        break;
+        }
+
+        closedir(dir);
+        return error;
+}
 
 static int expand_ipv6(char *addr, int type)
 {
@@ -1472,26 +1478,12 @@ int main(int argc, char *argv[])
                 switch (op) {
                 case KVP_OP_GET_IP_INFO:
                         kvp_ip_val = &hv_msg->body.kvp_ip_val;
-                        if_name =
-                        kvp_mac_to_if_name((char *)kvp_ip_val->adapter_id);
 
-                        if (if_name == NULL) {
-                                /*
-                                 * We could not map the mac address to an
-                                 * interface name; return error.
-                                 */
-                                hv_msg->error = HV_E_FAIL;
-                                break;
-                        }
-                        error = kvp_get_ip_info(
-                                                0, if_name, KVP_OP_GET_IP_INFO,
-                                                kvp_ip_val,
-                                                (MAX_IP_ADDR_SIZE * 2));
+                        error =  kvp_mac_to_ip(kvp_ip_val);
 
                         if (error)
                                 hv_msg->error = error;
 
-                        free(if_name);
                         break;
 
                 case KVP_OP_SET_IP_INFO:
diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
index b2b4ebffab8c..34031a297f02 100644
--- a/tools/hv/hv_vss_daemon.c
+++ b/tools/hv/hv_vss_daemon.c
@@ -22,6 +22,7 @@
 #include <sys/poll.h>
 #include <sys/ioctl.h>
 #include <sys/stat.h>
+#include <sys/sysmacros.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <mntent.h>
diff --git a/tools/include/asm-generic/barrier.h b/tools/include/asm-generic/barrier.h
index 47b933903eaf..52278d880a61 100644
--- a/tools/include/asm-generic/barrier.h
+++ b/tools/include/asm-generic/barrier.h
@@ -1,7 +1,7 @@
 /*
  * Copied from the kernel sources to tools/perf/:
  *
- * Generic barrier definitions, originally based on MN10300 definitions.
+ * Generic barrier definitions.
  *
  * It should be possible to use these on really simple architectures,
  * but it serves more as a starting point for new ports.
diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
index ca160270fdfa..63440cc8d618 100644
--- a/tools/include/linux/bitmap.h
+++ b/tools/include/linux/bitmap.h
@@ -98,7 +98,7 @@ static inline int test_and_set_bit(int nr, unsigned long *addr)
 
 /**
  * bitmap_alloc - Allocate bitmap
- * @nr: Bit to set
+ * @nbits: Number of bits
  */
 static inline unsigned long *bitmap_alloc(int nbits)
 {
diff --git a/tools/include/linux/compiler.h b/tools/include/linux/compiler.h
index 04e32f965ad7..1827c2f973f9 100644
--- a/tools/include/linux/compiler.h
+++ b/tools/include/linux/compiler.h
@@ -151,11 +151,21 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  * required ordering.
  */
 
-#define READ_ONCE(x) \
-        ({ union { typeof(x) __val; char __c[1]; } __u; __read_once_size(&(x), __u.__c, sizeof(x)); __u.__val; })
-
-#define WRITE_ONCE(x, val) \
-        ({ union { typeof(x) __val; char __c[1]; } __u = { .__val = (val) }; __write_once_size(&(x), __u.__c, sizeof(x)); __u.__val; })
+#define READ_ONCE(x)                                    \
+({                                                      \
+        union { typeof(x) __val; char __c[1]; } __u =   \
+                { .__c = { 0 } };                       \
+        __read_once_size(&(x), __u.__c, sizeof(x));     \
+        __u.__val;                                      \
+})
+
+#define WRITE_ONCE(x, val)                              \
+({                                                      \
+        union { typeof(x) __val; char __c[1]; } __u =   \
+                { .__val = (val) };                     \
+        __write_once_size(&(x), __u.__c, sizeof(x));    \
+        __u.__val;                                      \
+})
 
 
 #ifndef __fallthrough
diff --git a/tools/include/linux/coresight-pmu.h b/tools/include/linux/coresight-pmu.h
index edfeaba95429..a1a959ba24ff 100644
--- a/tools/include/linux/coresight-pmu.h
+++ b/tools/include/linux/coresight-pmu.h
@@ -1,18 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright(C) 2015 Linaro Limited. All rights reserved.
  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef _LINUX_CORESIGHT_PMU_H
diff --git a/tools/include/linux/spinlock.h b/tools/include/linux/spinlock.h
index 4ed569fcb139..1738c0391da4 100644
--- a/tools/include/linux/spinlock.h
+++ b/tools/include/linux/spinlock.h
@@ -6,7 +6,9 @@
 #include <stdbool.h>
 
 #define spinlock_t              pthread_mutex_t
-#define DEFINE_SPINLOCK(x)      pthread_mutex_t x = PTHREAD_MUTEX_INITIALIZER;
+#define DEFINE_SPINLOCK(x)      pthread_mutex_t x = PTHREAD_MUTEX_INITIALIZER
+#define __SPIN_LOCK_UNLOCKED(x) (pthread_mutex_t)PTHREAD_MUTEX_INITIALIZER
+#define spin_lock_init(x)      pthread_mutex_init(x, NULL)
 
 #define spin_lock_irqsave(x, f)         (void)f, pthread_mutex_lock(x)
 #define spin_unlock_irqrestore(x, f)    (void)f, pthread_mutex_unlock(x)
diff --git a/tools/include/tools/config.h b/tools/include/tools/config.h
new file mode 100644
index 000000000000..08ade7df8132
--- /dev/null
+++ b/tools/include/tools/config.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _TOOLS_CONFIG_H
+#define _TOOLS_CONFIG_H
+
+/* Subset of include/linux/kconfig.h */
+
+#define __ARG_PLACEHOLDER_1 0,
+#define __take_second_arg(__ignored, val, ...) val
+
+/*
+ * Helper macros to use CONFIG_ options in C/CPP expressions. Note that
+ * these only work with boolean and tristate options.
+ */
+
+/*
+ * Getting something that works in C and CPP for an arg that may or may
+ * not be defined is tricky.  Here, if we have "#define CONFIG_BOOGER 1"
+ * we match on the placeholder define, insert the "0," for arg1 and generate
+ * the triplet (0, 1, 0).  Then the last step cherry picks the 2nd arg (a one).
+ * When CONFIG_BOOGER is not defined, we generate a (... 1, 0) pair, and when
+ * the last step cherry picks the 2nd arg, we get a zero.
+ */
+#define __is_defined(x)                 ___is_defined(x)
+#define ___is_defined(val)              ____is_defined(__ARG_PLACEHOLDER_##val)
+#define ____is_defined(arg1_or_junk)    __take_second_arg(arg1_or_junk 1, 0)
+
+/*
+ * IS_BUILTIN(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'y', 0
+ * otherwise. For boolean options, this is equivalent to
+ * IS_ENABLED(CONFIG_FOO).
+ */
+#define IS_BUILTIN(option) __is_defined(option)
+
+#endif /* _TOOLS_CONFIG_H */
diff --git a/tools/include/uapi/asm-generic/mman-common.h b/tools/include/uapi/asm-generic/mman-common.h
index f8b134f5608f..e7ee32861d51 100644
--- a/tools/include/uapi/asm-generic/mman-common.h
+++ b/tools/include/uapi/asm-generic/mman-common.h
@@ -27,6 +27,9 @@
 # define MAP_UNINITIALIZED 0x0          /* Don't support this flag */
 #endif
 
+/* 0x0100 - 0x80000 flags are defined in asm-generic/mman.h */
+#define MAP_FIXED_NOREPLACE     0x100000        /* MAP_FIXED which doesn't unmap underlying mapping */
+
 /*
  * Flags for mlock
  */
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index 536ee4febd74..7f5634ce8e88 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -318,6 +318,7 @@ typedef struct _drm_i915_sarea {
 #define DRM_I915_PERF_OPEN              0x36
 #define DRM_I915_PERF_ADD_CONFIG        0x37
 #define DRM_I915_PERF_REMOVE_CONFIG     0x38
+#define DRM_I915_QUERY                  0x39
 
 #define DRM_IOCTL_I915_INIT             DRM_IOW( DRM_COMMAND_BASE + DRM_I915_INIT, drm_i915_init_t)
 #define DRM_IOCTL_I915_FLUSH            DRM_IO ( DRM_COMMAND_BASE + DRM_I915_FLUSH)
@@ -375,6 +376,7 @@ typedef struct _drm_i915_sarea {
 #define DRM_IOCTL_I915_PERF_OPEN        DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_OPEN, struct drm_i915_perf_open_param)
 #define DRM_IOCTL_I915_PERF_ADD_CONFIG  DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_ADD_CONFIG, struct drm_i915_perf_oa_config)
 #define DRM_IOCTL_I915_PERF_REMOVE_CONFIG       DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_REMOVE_CONFIG, __u64)
+#define DRM_IOCTL_I915_QUERY                    DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_QUERY, struct drm_i915_query)
 
 /* Allow drivers to submit batchbuffers directly to hardware, relying
  * on the security mechanisms provided by hardware.
@@ -1358,7 +1360,9 @@ struct drm_intel_overlay_attrs {
  * active on a given plane.
  */
 
-#define I915_SET_COLORKEY_NONE          (1<<0) /* disable color key matching */
+#define I915_SET_COLORKEY_NONE          (1<<0) /* Deprecated. Instead set
+                                                * flags==0 to disable colorkeying.
+                                                */
 #define I915_SET_COLORKEY_DESTINATION   (1<<1)
 #define I915_SET_COLORKEY_SOURCE        (1<<2)
 struct drm_intel_sprite_colorkey {
@@ -1604,15 +1608,115 @@ struct drm_i915_perf_oa_config {
         __u32 n_flex_regs;
 
         /*
-         * These fields are pointers to tuples of u32 values (register
-         * address, value). For example the expected length of the buffer
-         * pointed by mux_regs_ptr is (2 * sizeof(u32) * n_mux_regs).
+         * These fields are pointers to tuples of u32 values (register address,
+         * value). For example the expected length of the buffer pointed by
+         * mux_regs_ptr is (2 * sizeof(u32) * n_mux_regs).
          */
         __u64 mux_regs_ptr;
         __u64 boolean_regs_ptr;
         __u64 flex_regs_ptr;
 };
 
+struct drm_i915_query_item {
+        __u64 query_id;
+#define DRM_I915_QUERY_TOPOLOGY_INFO    1
+
+        /*
+         * When set to zero by userspace, this is filled with the size of the
+         * data to be written at the data_ptr pointer. The kernel sets this
+         * value to a negative value to signal an error on a particular query
+         * item.
+         */
+        __s32 length;
+
+        /*
+         * Unused for now. Must be cleared to zero.
+         */
+        __u32 flags;
+
+        /*
+         * Data will be written at the location pointed by data_ptr when the
+         * value of length matches the length of the data to be written by the
+         * kernel.
+         */
+        __u64 data_ptr;
+};
+
+struct drm_i915_query {
+        __u32 num_items;
+
+        /*
+         * Unused for now. Must be cleared to zero.
+         */
+        __u32 flags;
+
+        /*
+         * This points to an array of num_items drm_i915_query_item structures.
+         */
+        __u64 items_ptr;
+};
+
+/*
+ * Data written by the kernel with query DRM_I915_QUERY_TOPOLOGY_INFO :
+ *
+ * data: contains the 3 pieces of information :
+ *
+ * - the slice mask with one bit per slice telling whether a slice is
+ *   available. The availability of slice X can be queried with the following
+ *   formula :
+ *
+ *           (data[X / 8] >> (X % 8)) & 1
+ *
+ * - the subslice mask for each slice with one bit per subslice telling
+ *   whether a subslice is available. The availability of subslice Y in slice
+ *   X can be queried with the following formula :
+ *
+ *           (data[subslice_offset +
+ *                 X * subslice_stride +
+ *                 Y / 8] >> (Y % 8)) & 1
+ *
+ * - the EU mask for each subslice in each slice with one bit per EU telling
+ *   whether an EU is available. The availability of EU Z in subslice Y in
+ *   slice X can be queried with the following formula :
+ *
+ *           (data[eu_offset +
+ *                 (X * max_subslices + Y) * eu_stride +
+ *                 Z / 8] >> (Z % 8)) & 1
+ */
+struct drm_i915_query_topology_info {
+        /*
+         * Unused for now. Must be cleared to zero.
+         */
+        __u16 flags;
+
+        __u16 max_slices;
+        __u16 max_subslices;
+        __u16 max_eus_per_subslice;
+
+        /*
+         * Offset in data[] at which the subslice masks are stored.
+         */
+        __u16 subslice_offset;
+
+        /*
+         * Stride at which each of the subslice masks for each slice are
+         * stored.
+         */
+        __u16 subslice_stride;
+
+        /*
+         * Offset in data[] at which the EU masks are stored.
+         */
+        __u16 eu_offset;
+
+        /*
+         * Stride at which each of the EU masks for each subslice are stored.
+         */
+        __u16 eu_stride;
+
+        __u8 data[];
+};
+
 #if defined(__cplusplus)
 }
 #endif
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index db6bdc375126..c5ec89732a8d 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -94,6 +94,7 @@ enum bpf_cmd {
         BPF_MAP_GET_FD_BY_ID,
         BPF_OBJ_GET_INFO_BY_FD,
         BPF_PROG_QUERY,
+        BPF_RAW_TRACEPOINT_OPEN,
 };
 
 enum bpf_map_type {
@@ -133,6 +134,9 @@ enum bpf_prog_type {
         BPF_PROG_TYPE_SOCK_OPS,
         BPF_PROG_TYPE_SK_SKB,
         BPF_PROG_TYPE_CGROUP_DEVICE,
+        BPF_PROG_TYPE_SK_MSG,
+        BPF_PROG_TYPE_RAW_TRACEPOINT,
+        BPF_PROG_TYPE_CGROUP_SOCK_ADDR,
 };
 
 enum bpf_attach_type {
@@ -143,6 +147,13 @@ enum bpf_attach_type {
         BPF_SK_SKB_STREAM_PARSER,
         BPF_SK_SKB_STREAM_VERDICT,
         BPF_CGROUP_DEVICE,
+        BPF_SK_MSG_VERDICT,
+        BPF_CGROUP_INET4_BIND,
+        BPF_CGROUP_INET6_BIND,
+        BPF_CGROUP_INET4_CONNECT,
+        BPF_CGROUP_INET6_CONNECT,
+        BPF_CGROUP_INET4_POST_BIND,
+        BPF_CGROUP_INET6_POST_BIND,
         __MAX_BPF_ATTACH_TYPE
 };
 
@@ -231,6 +242,28 @@ enum bpf_attach_type {
 #define BPF_F_RDONLY            (1U << 3)
 #define BPF_F_WRONLY            (1U << 4)
 
+/* Flag for stack_map, store build_id+offset instead of pointer */
+#define BPF_F_STACK_BUILD_ID    (1U << 5)
+
+enum bpf_stack_build_id_status {
+        /* user space need an empty entry to identify end of a trace */
+        BPF_STACK_BUILD_ID_EMPTY = 0,
+        /* with valid build_id and offset */
+        BPF_STACK_BUILD_ID_VALID = 1,
+        /* couldn't get build_id, fallback to ip */
+        BPF_STACK_BUILD_ID_IP = 2,
+};
+
+#define BPF_BUILD_ID_SIZE 20
+struct bpf_stack_build_id {
+        __s32           status;
+        unsigned char   build_id[BPF_BUILD_ID_SIZE];
+        union {
+                __u64   offset;
+                __u64   ip;
+        };
+};
+
 union bpf_attr {
         struct { /* anonymous struct used by BPF_MAP_CREATE command */
                 __u32   map_type;       /* one of enum bpf_map_type */
@@ -270,6 +303,11 @@ union bpf_attr {
                 __u32           prog_flags;
                 char            prog_name[BPF_OBJ_NAME_LEN];
                 __u32           prog_ifindex;   /* ifindex of netdev to prep for */
+                /* For some prog types expected attach type must be known at
+                 * load time to verify attach type specific parts of prog
+                 * (context accesses, allowed helpers, etc).
+                 */
+                __u32           expected_attach_type;
         };
 
         struct { /* anonymous struct used by BPF_OBJ_* commands */
@@ -320,6 +358,11 @@ union bpf_attr {
                 __aligned_u64   prog_ids;
                 __u32           prog_cnt;
         } query;
+
+        struct {
+                __u64 name;
+                __u32 prog_fd;
+        } raw_tracepoint;
 } __attribute__((aligned(8)));
 
 /* BPF helper function descriptions:
@@ -696,6 +739,22 @@ union bpf_attr {
  * int bpf_override_return(pt_regs, rc)
  *      @pt_regs: pointer to struct pt_regs
  *      @rc: the return value to set
+ *
+ * int bpf_msg_redirect_map(map, key, flags)
+ *     Redirect msg to a sock in map using key as a lookup key for the
+ *     sock in map.
+ *     @map: pointer to sockmap
+ *     @key: key to lookup sock in map
+ *     @flags: reserved for future use
+ *     Return: SK_PASS
+ *
+ * int bpf_bind(ctx, addr, addr_len)
+ *     Bind socket to address. Only binding to IP is supported, no port can be
+ *     set in addr.
+ *     @ctx: pointer to context of type bpf_sock_addr
+ *     @addr: pointer to struct sockaddr to bind socket to
+ *     @addr_len: length of sockaddr structure
+ *     Return: 0 on success or negative error code
  */
 #define __BPF_FUNC_MAPPER(FN)           \
         FN(unspec),                     \
@@ -757,7 +816,12 @@ union bpf_attr {
         FN(perf_prog_read_value),       \
         FN(getsockopt),                 \
         FN(override_return),            \
-        FN(sock_ops_cb_flags_set),
+        FN(sock_ops_cb_flags_set),      \
+        FN(msg_redirect_map),           \
+        FN(msg_apply_bytes),            \
+        FN(msg_cork_bytes),             \
+        FN(msg_pull_data),              \
+        FN(bind),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
@@ -800,6 +864,7 @@ enum bpf_func_id {
 /* BPF_FUNC_skb_set_tunnel_key flags. */
 #define BPF_F_ZERO_CSUM_TX              (1ULL << 1)
 #define BPF_F_DONT_FRAGMENT             (1ULL << 2)
+#define BPF_F_SEQ_NUMBER                (1ULL << 3)
 
 /* BPF_FUNC_perf_event_output, BPF_FUNC_perf_event_read and
  * BPF_FUNC_perf_event_read_value flags.
@@ -885,6 +950,15 @@ struct bpf_sock {
         __u32 protocol;
         __u32 mark;
         __u32 priority;
+        __u32 src_ip4;          /* Allows 1,2,4-byte read.
+                                 * Stored in network byte order.
+                                 */
+        __u32 src_ip6[4];       /* Allows 1,2,4-byte read.
+                                 * Stored in network byte order.
+                                 */
+        __u32 src_port;         /* Allows 4-byte read.
+                                 * Stored in host byte order
+                                 */
 };
 
 #define XDP_PACKET_HEADROOM 256
@@ -919,6 +993,14 @@ enum sk_action {
         SK_PASS,
 };
 
+/* user accessible metadata for SK_MSG packet hook, new fields must
+ * be added to the end of this structure
+ */
+struct sk_msg_md {
+        void *data;
+        void *data_end;
+};
+
 #define BPF_TAG_SIZE    8
 
 struct bpf_prog_info {
@@ -952,6 +1034,26 @@ struct bpf_map_info {
         __u64 netns_ino;
 } __attribute__((aligned(8)));
 
+/* User bpf_sock_addr struct to access socket fields and sockaddr struct passed
+ * by user and intended to be used by socket (e.g. to bind to, depends on
+ * attach attach type).
+ */
+struct bpf_sock_addr {
+        __u32 user_family;      /* Allows 4-byte read, but no write. */
+        __u32 user_ip4;         /* Allows 1,2,4-byte read and 4-byte write.
+                                 * Stored in network byte order.
+                                 */
+        __u32 user_ip6[4];      /* Allows 1,2,4-byte read an 4-byte write.
+                                 * Stored in network byte order.
+                                 */
+        __u32 user_port;        /* Allows 4-byte read and write.
+                                 * Stored in network byte order
+                                 */
+        __u32 family;           /* Allows 4-byte read, but no write */
+        __u32 type;             /* Allows 4-byte read, but no write */
+        __u32 protocol;         /* Allows 4-byte read, but no write */
+};
+
 /* User bpf_sock_ops struct to access socket values and specify request ops
  * and their replies.
  * Some of this fields are in network (bigendian) byte order and may need
@@ -1106,4 +1208,8 @@ struct bpf_cgroup_dev_ctx {
         __u32 minor;
 };
 
+struct bpf_raw_tracepoint_args {
+        __u64 args[0];
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h
index 6d9447700e18..68699f654118 100644
--- a/tools/include/uapi/linux/if_link.h
+++ b/tools/include/uapi/linux/if_link.h
@@ -941,4 +941,43 @@ enum {
         IFLA_EVENT_BONDING_OPTIONS,     /* change in bonding options */
 };
 
+/* tun section */
+
+enum {
+        IFLA_TUN_UNSPEC,
+        IFLA_TUN_OWNER,
+        IFLA_TUN_GROUP,
+        IFLA_TUN_TYPE,
+        IFLA_TUN_PI,
+        IFLA_TUN_VNET_HDR,
+        IFLA_TUN_PERSIST,
+        IFLA_TUN_MULTI_QUEUE,
+        IFLA_TUN_NUM_QUEUES,
+        IFLA_TUN_NUM_DISABLED_QUEUES,
+        __IFLA_TUN_MAX,
+};
+
+#define IFLA_TUN_MAX (__IFLA_TUN_MAX - 1)
+
+/* rmnet section */
+
+#define RMNET_FLAGS_INGRESS_DEAGGREGATION         (1U << 0)
+#define RMNET_FLAGS_INGRESS_MAP_COMMANDS          (1U << 1)
+#define RMNET_FLAGS_INGRESS_MAP_CKSUMV4           (1U << 2)
+#define RMNET_FLAGS_EGRESS_MAP_CKSUMV4            (1U << 3)
+
+enum {
+        IFLA_RMNET_UNSPEC,
+        IFLA_RMNET_MUX_ID,
+        IFLA_RMNET_FLAGS,
+        __IFLA_RMNET_MAX,
+};
+
+#define IFLA_RMNET_MAX  (__IFLA_RMNET_MAX - 1)
+
+struct ifla_rmnet_flags {
+        __u32   flags;
+        __u32   mask;
+};
+
 #endif /* _UAPI_LINUX_IF_LINK_H */
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 7b26d4b0b052..b02c41e53d56 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -396,6 +396,10 @@ struct kvm_run {
                 char padding[256];
         };
 
+        /* 2048 is the size of the char array used to bound/pad the size
+         * of the union that holds sync regs.
+         */
+        #define SYNC_REGS_SIZE_BYTES 2048
         /*
          * shared registers between kvm and userspace.
          * kvm_valid_regs specifies the register classes set by the host
@@ -407,7 +411,7 @@ struct kvm_run {
         __u64 kvm_dirty_regs;
         union {
                 struct kvm_sync_regs regs;
-                char padding[2048];
+                char padding[SYNC_REGS_SIZE_BYTES];
         } s;
 };
 
@@ -672,6 +676,13 @@ struct kvm_ioeventfd {
         __u8  pad[36];
 };
 
+#define KVM_X86_DISABLE_EXITS_MWAIT          (1 << 0)
+#define KVM_X86_DISABLE_EXITS_HTL            (1 << 1)
+#define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
+#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
+                                              KVM_X86_DISABLE_EXITS_HTL | \
+                                              KVM_X86_DISABLE_EXITS_PAUSE)
+
 /* for KVM_ENABLE_CAP */
 struct kvm_enable_cap {
         /* in */
@@ -925,7 +936,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_S390_GS 140
 #define KVM_CAP_S390_AIS 141
 #define KVM_CAP_SPAPR_TCE_VFIO 142
-#define KVM_CAP_X86_GUEST_MWAIT 143
+#define KVM_CAP_X86_DISABLE_EXITS 143
 #define KVM_CAP_ARM_USER_IRQ 144
 #define KVM_CAP_S390_CMMA_MIGRATION 145
 #define KVM_CAP_PPC_FWNMI 146
@@ -936,6 +947,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_PPC_GET_CPU_CHAR 151
 #define KVM_CAP_S390_BPB 152
 #define KVM_CAP_GET_MSR_FEATURES 153
+#define KVM_CAP_HYPERV_EVENTFD 154
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -1375,6 +1387,10 @@ struct kvm_enc_region {
 #define KVM_MEMORY_ENCRYPT_REG_REGION    _IOR(KVMIO, 0xbb, struct kvm_enc_region)
 #define KVM_MEMORY_ENCRYPT_UNREG_REGION  _IOR(KVMIO, 0xbc, struct kvm_enc_region)
 
+/* Available with KVM_CAP_HYPERV_EVENTFD */
+#define KVM_HYPERV_EVENTFD        _IOW(KVMIO,  0xbd, struct kvm_hyperv_eventfd)
+
+
 /* Secure Encrypted Virtualization command */
 enum sev_cmd_id {
         /* Guest initialization commands */
@@ -1515,4 +1531,14 @@ struct kvm_assigned_msix_entry {
 #define KVM_ARM_DEV_EL1_PTIMER          (1 << 1)
 #define KVM_ARM_DEV_PMU                 (1 << 2)
 
+struct kvm_hyperv_eventfd {
+        __u32 conn_id;
+        __s32 fd;
+        __u32 flags;
+        __u32 padding[3];
+};
+
+#define KVM_HYPERV_CONN_ID_MASK         0x00ffffff
+#define KVM_HYPERV_EVENTFD_DEASSIGN     (1 << 0)
+
 #endif /* __LINUX_KVM_H */
diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h
index e0739a1aa4b2..b8e288a1f740 100644
--- a/tools/include/uapi/linux/perf_event.h
+++ b/tools/include/uapi/linux/perf_event.h
@@ -380,10 +380,14 @@ struct perf_event_attr {
         __u32                   bp_type;
         union {
                 __u64           bp_addr;
+                __u64           kprobe_func; /* for perf_kprobe */
+                __u64           uprobe_path; /* for perf_uprobe */
                 __u64           config1; /* extension of config */
         };
         union {
                 __u64           bp_len;
+                __u64           kprobe_addr; /* when kprobe_func == NULL */
+                __u64           probe_offset; /* for perf_[k,u]probe */
                 __u64           config2; /* extension of config1 */
         };
         __u64   branch_sample_type; /* enum perf_branch_sample_type */
@@ -444,17 +448,18 @@ struct perf_event_query_bpf {
 /*
  * Ioctls that can be done on a perf event fd:
  */
-#define PERF_EVENT_IOC_ENABLE           _IO ('$', 0)
-#define PERF_EVENT_IOC_DISABLE          _IO ('$', 1)
-#define PERF_EVENT_IOC_REFRESH          _IO ('$', 2)
-#define PERF_EVENT_IOC_RESET            _IO ('$', 3)
-#define PERF_EVENT_IOC_PERIOD           _IOW('$', 4, __u64)
-#define PERF_EVENT_IOC_SET_OUTPUT       _IO ('$', 5)
-#define PERF_EVENT_IOC_SET_FILTER       _IOW('$', 6, char *)
-#define PERF_EVENT_IOC_ID               _IOR('$', 7, __u64 *)
-#define PERF_EVENT_IOC_SET_BPF          _IOW('$', 8, __u32)
-#define PERF_EVENT_IOC_PAUSE_OUTPUT     _IOW('$', 9, __u32)
-#define PERF_EVENT_IOC_QUERY_BPF        _IOWR('$', 10, struct perf_event_query_bpf *)
+#define PERF_EVENT_IOC_ENABLE                   _IO ('$', 0)
+#define PERF_EVENT_IOC_DISABLE                  _IO ('$', 1)
+#define PERF_EVENT_IOC_REFRESH                  _IO ('$', 2)
+#define PERF_EVENT_IOC_RESET                    _IO ('$', 3)
+#define PERF_EVENT_IOC_PERIOD                   _IOW('$', 4, __u64)
+#define PERF_EVENT_IOC_SET_OUTPUT               _IO ('$', 5)
+#define PERF_EVENT_IOC_SET_FILTER               _IOW('$', 6, char *)
+#define PERF_EVENT_IOC_ID                       _IOR('$', 7, __u64 *)
+#define PERF_EVENT_IOC_SET_BPF                  _IOW('$', 8, __u32)
+#define PERF_EVENT_IOC_PAUSE_OUTPUT             _IOW('$', 9, __u32)
+#define PERF_EVENT_IOC_QUERY_BPF                _IOWR('$', 10, struct perf_event_query_bpf *)
+#define PERF_EVENT_IOC_MODIFY_ATTRIBUTES        _IOW('$', 11, struct perf_event_attr *)
 
 enum perf_event_ioc_flags {
         PERF_IOC_FLAG_GROUP             = 1U << 0,
@@ -645,11 +650,23 @@ struct perf_event_mmap_page {
 #define PERF_RECORD_MISC_COMM_EXEC              (1 << 13)
 #define PERF_RECORD_MISC_SWITCH_OUT             (1 << 13)
 /*
- * Indicates that the content of PERF_SAMPLE_IP points to
- * the actual instruction that triggered the event. See also
- * perf_event_attr::precise_ip.
+ * These PERF_RECORD_MISC_* flags below are safely reused
+ * for the following events:
+ *
+ *   PERF_RECORD_MISC_EXACT_IP           - PERF_RECORD_SAMPLE of precise events
+ *   PERF_RECORD_MISC_SWITCH_OUT_PREEMPT - PERF_RECORD_SWITCH* events
+ *
+ *
+ * PERF_RECORD_MISC_EXACT_IP:
+ *   Indicates that the content of PERF_SAMPLE_IP points to
+ *   the actual instruction that triggered the event. See also
+ *   perf_event_attr::precise_ip.
+ *
+ * PERF_RECORD_MISC_SWITCH_OUT_PREEMPT:
+ *   Indicates that thread was preempted in TASK_RUNNING state.
  */
 #define PERF_RECORD_MISC_EXACT_IP               (1 << 14)
+#define PERF_RECORD_MISC_SWITCH_OUT_PREEMPT     (1 << 14)
 /*
  * Reserve the last bit to indicate some extended misc field
  */
diff --git a/tools/include/uapi/sound/asound.h b/tools/include/uapi/sound/asound.h
index 07d61583fd02..ed0a120d4f08 100644
--- a/tools/include/uapi/sound/asound.h
+++ b/tools/include/uapi/sound/asound.h
@@ -242,6 +242,7 @@ typedef int __bitwise snd_pcm_format_t;
 #define SNDRV_PCM_FORMAT_DSD_U16_BE     ((__force snd_pcm_format_t) 51) /* DSD, 2-byte samples DSD (x16), big endian */
 #define SNDRV_PCM_FORMAT_DSD_U32_BE     ((__force snd_pcm_format_t) 52) /* DSD, 4-byte samples DSD (x32), big endian */
 #define SNDRV_PCM_FORMAT_LAST           SNDRV_PCM_FORMAT_DSD_U32_BE
+#define SNDRV_PCM_FORMAT_FIRST          SNDRV_PCM_FORMAT_S8
 
 #ifdef SNDRV_LITTLE_ENDIAN
 #define SNDRV_PCM_FORMAT_S16            SNDRV_PCM_FORMAT_S16_LE
diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
index 5898c22ba310..56c4b3f8a01b 100755
--- a/tools/kvm/kvm_stat/kvm_stat
+++ b/tools/kvm/kvm_stat/kvm_stat
@@ -1121,9 +1121,6 @@ class Tui(object):
         self.screen.refresh()
 
     def _refresh_body(self, sleeptime):
-        def is_child_field(field):
-            return field.find('(') != -1
-
         def insert_child(sorted_items, child, values, parent):
             num = len(sorted_items)
             for i in range(0, num):
@@ -1134,12 +1131,14 @@ class Tui(object):
         def get_sorted_events(self, stats):
             """ separate parent and child events """
             if self._sorting == SORT_DEFAULT:
-                def sortkey((_k, v)):
+                def sortkey(pair):
                     # sort by (delta value, overall value)
+                    v = pair[1]
                     return (v.delta, v.value)
             else:
-                def sortkey((_k, v)):
+                def sortkey(pair):
                     # sort by overall value
+                    v = pair[1]
                     return v.value
 
             childs = []
@@ -1613,7 +1612,7 @@ def assign_globals():
     global PATH_DEBUGFS_TRACING
 
     debugfs = ''
-    for line in file('/proc/mounts'):
+    for line in open('/proc/mounts'):
         if line.split(' ')[0] == 'debugfs':
             debugfs = line.split(' ')[1]
             break
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index b24afc0e6e81..6a12bbf39f7b 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -315,12 +315,8 @@ int filename__read_int(const char *filename, int *value)
         return err;
 }
 
-/*
- * Parses @value out of @filename with strtoull.
- * By using 0 for base, the strtoull detects the
- * base automatically (see man strtoull).
- */
-int filename__read_ull(const char *filename, unsigned long long *value)
+static int filename__read_ull_base(const char *filename,
+                                   unsigned long long *value, int base)
 {
         char line[64];
         int fd = open(filename, O_RDONLY), err = -1;
@@ -329,7 +325,7 @@ int filename__read_ull(const char *filename, unsigned long long *value)
                 return -1;
 
         if (read(fd, line, sizeof(line)) > 0) {
-                *value = strtoull(line, NULL, 0);
+                *value = strtoull(line, NULL, base);
                 if (*value != ULLONG_MAX)
                         err = 0;
         }
@@ -338,6 +334,25 @@ int filename__read_ull(const char *filename, unsigned long long *value)
         return err;
 }
 
+/*
+ * Parses @value out of @filename with strtoull.
+ * By using 16 for base to treat the number as hex.
+ */
+int filename__read_xll(const char *filename, unsigned long long *value)
+{
+        return filename__read_ull_base(filename, value, 16);
+}
+
+/*
+ * Parses @value out of @filename with strtoull.
+ * By using 0 for base, the strtoull detects the
+ * base automatically (see man strtoull).
+ */
+int filename__read_ull(const char *filename, unsigned long long *value)
+{
+        return filename__read_ull_base(filename, value, 0);
+}
+
 #define STRERR_BUFSIZE  128     /* For the buffer size of strerror_r */
 
 int filename__read_str(const char *filename, char **buf, size_t *sizep)
@@ -417,7 +432,8 @@ int procfs__read_str(const char *entry, char **buf, size_t *sizep)
         return filename__read_str(path, buf, sizep);
 }
 
-int sysfs__read_ull(const char *entry, unsigned long long *value)
+static int sysfs__read_ull_base(const char *entry,
+                                unsigned long long *value, int base)
 {
         char path[PATH_MAX];
         const char *sysfs = sysfs__mountpoint();
@@ -427,7 +443,17 @@ int sysfs__read_ull(const char *entry, unsigned long long *value)
 
         snprintf(path, sizeof(path), "%s/%s", sysfs, entry);
 
-        return filename__read_ull(path, value);
+        return filename__read_ull_base(path, value, base);
+}
+
+int sysfs__read_xll(const char *entry, unsigned long long *value)
+{
+        return sysfs__read_ull_base(entry, value, 16);
+}
+
+int sysfs__read_ull(const char *entry, unsigned long long *value)
+{
+        return sysfs__read_ull_base(entry, value, 0);
 }
 
 int sysfs__read_int(const char *entry, int *value)
diff --git a/tools/lib/api/fs/fs.h b/tools/lib/api/fs/fs.h
index dda49deefb52..92d03b8396b1 100644
--- a/tools/lib/api/fs/fs.h
+++ b/tools/lib/api/fs/fs.h
@@ -30,6 +30,7 @@ FS(bpf_fs)
 
 int filename__read_int(const char *filename, int *value);
 int filename__read_ull(const char *filename, unsigned long long *value);
+int filename__read_xll(const char *filename, unsigned long long *value);
 int filename__read_str(const char *filename, char **buf, size_t *sizep);
 
 int filename__write_int(const char *filename, int value);
@@ -39,6 +40,7 @@ int procfs__read_str(const char *entry, char **buf, size_t *sizep);
 int sysctl__read_int(const char *sysctl, int *value);
 int sysfs__read_int(const char *entry, int *value);
 int sysfs__read_ull(const char *entry, unsigned long long *value);
+int sysfs__read_xll(const char *entry, unsigned long long *value);
 int sysfs__read_str(const char *entry, char **buf, size_t *sizep);
 int sysfs__read_bool(const char *entry, bool *value);
 
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 592a58a2b681..acbb3f8b3bec 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -146,26 +146,30 @@ int bpf_create_map_in_map(enum bpf_map_type map_type, const char *name,
                                           -1);
 }
 
-int bpf_load_program_name(enum bpf_prog_type type, const char *name,
-                          const struct bpf_insn *insns,
-                          size_t insns_cnt, const char *license,
-                          __u32 kern_version, char *log_buf,
-                          size_t log_buf_sz)
+int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
+                           char *log_buf, size_t log_buf_sz)
 {
-        int fd;
         union bpf_attr attr;
-        __u32 name_len = name ? strlen(name) : 0;
+        __u32 name_len;
+        int fd;
+
+        if (!load_attr)
+                return -EINVAL;
+
+        name_len = load_attr->name ? strlen(load_attr->name) : 0;
 
         bzero(&attr, sizeof(attr));
-        attr.prog_type = type;
-        attr.insn_cnt = (__u32)insns_cnt;
-        attr.insns = ptr_to_u64(insns);
-        attr.license = ptr_to_u64(license);
+        attr.prog_type = load_attr->prog_type;
+        attr.expected_attach_type = load_attr->expected_attach_type;
+        attr.insn_cnt = (__u32)load_attr->insns_cnt;
+        attr.insns = ptr_to_u64(load_attr->insns);
+        attr.license = ptr_to_u64(load_attr->license);
         attr.log_buf = ptr_to_u64(NULL);
         attr.log_size = 0;
         attr.log_level = 0;
-        attr.kern_version = kern_version;
-        memcpy(attr.prog_name, name, min(name_len, BPF_OBJ_NAME_LEN - 1));
+        attr.kern_version = load_attr->kern_version;
+        memcpy(attr.prog_name, load_attr->name,
+               min(name_len, BPF_OBJ_NAME_LEN - 1));
 
         fd = sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
         if (fd >= 0 || !log_buf || !log_buf_sz)
@@ -184,8 +188,18 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
                      __u32 kern_version, char *log_buf,
                      size_t log_buf_sz)
 {
-        return bpf_load_program_name(type, NULL, insns, insns_cnt, license,
-                                     kern_version, log_buf, log_buf_sz);
+        struct bpf_load_program_attr load_attr;
+
+        memset(&load_attr, 0, sizeof(struct bpf_load_program_attr));
+        load_attr.prog_type = type;
+        load_attr.expected_attach_type = 0;
+        load_attr.name = NULL;
+        load_attr.insns = insns;
+        load_attr.insns_cnt = insns_cnt;
+        load_attr.license = license;
+        load_attr.kern_version = kern_version;
+
+        return bpf_load_program_xattr(&load_attr, log_buf, log_buf_sz);
 }
 
 int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
@@ -428,6 +442,17 @@ int bpf_obj_get_info_by_fd(int prog_fd, void *info, __u32 *info_len)
         return err;
 }
 
+int bpf_raw_tracepoint_open(const char *name, int prog_fd)
+{
+        union bpf_attr attr;
+
+        bzero(&attr, sizeof(attr));
+        attr.raw_tracepoint.name = ptr_to_u64(name);
+        attr.raw_tracepoint.prog_fd = prog_fd;
+
+        return sys_bpf(BPF_RAW_TRACEPOINT_OPEN, &attr, sizeof(attr));
+}
+
 int bpf_set_link_xdp_fd(int ifindex, int fd, __u32 flags)
 {
         struct sockaddr_nl sa;
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index 8d18fb73d7fb..39f6a0d64a3b 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -41,13 +41,20 @@ int bpf_create_map_in_map(enum bpf_map_type map_type, const char *name,
                           int key_size, int inner_map_fd, int max_entries,
                           __u32 map_flags);
 
+struct bpf_load_program_attr {
+        enum bpf_prog_type prog_type;
+        enum bpf_attach_type expected_attach_type;
+        const char *name;
+        const struct bpf_insn *insns;
+        size_t insns_cnt;
+        const char *license;
+        __u32 kern_version;
+};
+
 /* Recommend log buffer size */
 #define BPF_LOG_BUF_SIZE (256 * 1024)
-int bpf_load_program_name(enum bpf_prog_type type, const char *name,
-                          const struct bpf_insn *insns,
-                          size_t insns_cnt, const char *license,
-                          __u32 kern_version, char *log_buf,
-                          size_t log_buf_sz);
+int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
+                           char *log_buf, size_t log_buf_sz);
 int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
                      size_t insns_cnt, const char *license,
                      __u32 kern_version, char *log_buf,
@@ -79,4 +86,5 @@ int bpf_map_get_fd_by_id(__u32 id);
 int bpf_obj_get_info_by_fd(int prog_fd, void *info, __u32 *info_len);
 int bpf_prog_query(int target_fd, enum bpf_attach_type type, __u32 query_flags,
                    __u32 *attach_flags, __u32 *prog_ids, __u32 *prog_cnt);
+int bpf_raw_tracepoint_open(const char *name, int prog_fd);
 #endif
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 5bbbf285af74..5922443063f0 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -203,6 +203,8 @@ struct bpf_program {
         struct bpf_object *obj;
         void *priv;
         bpf_program_clear_priv_t clear_priv;
+
+        enum bpf_attach_type expected_attach_type;
 };
 
 struct bpf_map {
@@ -1162,21 +1164,31 @@ static int bpf_object__collect_reloc(struct bpf_object *obj)
 }
 
 static int
-load_program(enum bpf_prog_type type, const char *name, struct bpf_insn *insns,
-             int insns_cnt, char *license, u32 kern_version, int *pfd)
+load_program(enum bpf_prog_type type, enum bpf_attach_type expected_attach_type,
+             const char *name, struct bpf_insn *insns, int insns_cnt,
+             char *license, u32 kern_version, int *pfd)
 {
-        int ret;
+        struct bpf_load_program_attr load_attr;
         char *log_buf;
+        int ret;
 
-        if (!insns || !insns_cnt)
+        memset(&load_attr, 0, sizeof(struct bpf_load_program_attr));
+        load_attr.prog_type = type;
+        load_attr.expected_attach_type = expected_attach_type;
+        load_attr.name = name;
+        load_attr.insns = insns;
+        load_attr.insns_cnt = insns_cnt;
+        load_attr.license = license;
+        load_attr.kern_version = kern_version;
+
+        if (!load_attr.insns || !load_attr.insns_cnt)
                 return -EINVAL;
 
         log_buf = malloc(BPF_LOG_BUF_SIZE);
         if (!log_buf)
                 pr_warning("Alloc log buffer for bpf loader error, continue without log\n");
 
-        ret = bpf_load_program_name(type, name, insns, insns_cnt, license,
-                                    kern_version, log_buf, BPF_LOG_BUF_SIZE);
+        ret = bpf_load_program_xattr(&load_attr, log_buf, BPF_LOG_BUF_SIZE);
 
         if (ret >= 0) {
                 *pfd = ret;
@@ -1192,18 +1204,18 @@ load_program(enum bpf_prog_type type, const char *name, struct bpf_insn *insns,
                 pr_warning("-- BEGIN DUMP LOG ---\n");
                 pr_warning("\n%s\n", log_buf);
                 pr_warning("-- END LOG --\n");
-        } else if (insns_cnt >= BPF_MAXINSNS) {
-                pr_warning("Program too large (%d insns), at most %d insns\n",
-                           insns_cnt, BPF_MAXINSNS);
+        } else if (load_attr.insns_cnt >= BPF_MAXINSNS) {
+                pr_warning("Program too large (%zu insns), at most %d insns\n",
+                           load_attr.insns_cnt, BPF_MAXINSNS);
                 ret = -LIBBPF_ERRNO__PROG2BIG;
         } else {
                 /* Wrong program type? */
-                if (type != BPF_PROG_TYPE_KPROBE) {
+                if (load_attr.prog_type != BPF_PROG_TYPE_KPROBE) {
                         int fd;
 
-                        fd = bpf_load_program_name(BPF_PROG_TYPE_KPROBE, name,
-                                                   insns, insns_cnt, license,
-                                                   kern_version, NULL, 0);
+                        load_attr.prog_type = BPF_PROG_TYPE_KPROBE;
+                        load_attr.expected_attach_type = 0;
+                        fd = bpf_load_program_xattr(&load_attr, NULL, 0);
                         if (fd >= 0) {
                                 close(fd);
                                 ret = -LIBBPF_ERRNO__PROGTYPE;
@@ -1247,8 +1259,9 @@ bpf_program__load(struct bpf_program *prog,
                         pr_warning("Program '%s' is inconsistent: nr(%d) != 1\n",
                                    prog->section_name, prog->instances.nr);
                 }
-                err = load_program(prog->type, prog->name, prog->insns,
-                                   prog->insns_cnt, license, kern_version, &fd);
+                err = load_program(prog->type, prog->expected_attach_type,
+                                   prog->name, prog->insns, prog->insns_cnt,
+                                   license, kern_version, &fd);
                 if (!err)
                         prog->instances.fds[0] = fd;
                 goto out;
@@ -1276,8 +1289,8 @@ bpf_program__load(struct bpf_program *prog,
                         continue;
                 }
 
-                err = load_program(prog->type, prog->name,
-                                   result.new_insn_ptr,
+                err = load_program(prog->type, prog->expected_attach_type,
+                                   prog->name, result.new_insn_ptr,
                                    result.new_insn_cnt,
                                    license, kern_version, &fd);
 
@@ -1835,11 +1848,25 @@ BPF_PROG_TYPE_FNS(tracepoint, BPF_PROG_TYPE_TRACEPOINT);
 BPF_PROG_TYPE_FNS(xdp, BPF_PROG_TYPE_XDP);
 BPF_PROG_TYPE_FNS(perf_event, BPF_PROG_TYPE_PERF_EVENT);
 
-#define BPF_PROG_SEC(string, type) { string, sizeof(string) - 1, type }
+static void bpf_program__set_expected_attach_type(struct bpf_program *prog,
+                                                 enum bpf_attach_type type)
+{
+        prog->expected_attach_type = type;
+}
+
+#define BPF_PROG_SEC_FULL(string, ptype, atype) \
+        { string, sizeof(string) - 1, ptype, atype }
+
+#define BPF_PROG_SEC(string, ptype) BPF_PROG_SEC_FULL(string, ptype, 0)
+
+#define BPF_SA_PROG_SEC(string, ptype) \
+        BPF_PROG_SEC_FULL(string, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, ptype)
+
 static const struct {
         const char *sec;
         size_t len;
         enum bpf_prog_type prog_type;
+        enum bpf_attach_type expected_attach_type;
 } section_names[] = {
         BPF_PROG_SEC("socket",          BPF_PROG_TYPE_SOCKET_FILTER),
         BPF_PROG_SEC("kprobe/",         BPF_PROG_TYPE_KPROBE),
@@ -1857,10 +1884,18 @@ static const struct {
         BPF_PROG_SEC("lwt_xmit",        BPF_PROG_TYPE_LWT_XMIT),
         BPF_PROG_SEC("sockops",         BPF_PROG_TYPE_SOCK_OPS),
         BPF_PROG_SEC("sk_skb",          BPF_PROG_TYPE_SK_SKB),
+        BPF_PROG_SEC("sk_msg",          BPF_PROG_TYPE_SK_MSG),
+        BPF_SA_PROG_SEC("cgroup/bind4", BPF_CGROUP_INET4_BIND),
+        BPF_SA_PROG_SEC("cgroup/bind6", BPF_CGROUP_INET6_BIND),
+        BPF_SA_PROG_SEC("cgroup/connect4", BPF_CGROUP_INET4_CONNECT),
+        BPF_SA_PROG_SEC("cgroup/connect6", BPF_CGROUP_INET6_CONNECT),
 };
+
 #undef BPF_PROG_SEC
+#undef BPF_PROG_SEC_FULL
+#undef BPF_SA_PROG_SEC
 
-static enum bpf_prog_type bpf_program__guess_type(struct bpf_program *prog)
+static int bpf_program__identify_section(struct bpf_program *prog)
 {
         int i;
 
@@ -1870,13 +1905,13 @@ static enum bpf_prog_type bpf_program__guess_type(struct bpf_program *prog)
         for (i = 0; i < ARRAY_SIZE(section_names); i++)
                 if (strncmp(prog->section_name, section_names[i].sec,
                             section_names[i].len) == 0)
-                        return section_names[i].prog_type;
+                        return i;
 
 err:
         pr_warning("failed to guess program type based on section name %s\n",
                    prog->section_name);
 
-        return BPF_PROG_TYPE_UNSPEC;
+        return -1;
 }
 
 int bpf_map__fd(struct bpf_map *map)
@@ -1976,11 +2011,30 @@ long libbpf_get_error(const void *ptr)
 int bpf_prog_load(const char *file, enum bpf_prog_type type,
                   struct bpf_object **pobj, int *prog_fd)
 {
+        struct bpf_prog_load_attr attr;
+
+        memset(&attr, 0, sizeof(struct bpf_prog_load_attr));
+        attr.file = file;
+        attr.prog_type = type;
+        attr.expected_attach_type = 0;
+
+        return bpf_prog_load_xattr(&attr, pobj, prog_fd);
+}
+
+int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
+                        struct bpf_object **pobj, int *prog_fd)
+{
         struct bpf_program *prog, *first_prog = NULL;
+        enum bpf_attach_type expected_attach_type;
+        enum bpf_prog_type prog_type;
         struct bpf_object *obj;
+        int section_idx;
         int err;
 
-        obj = bpf_object__open(file);
+        if (!attr)
+                return -EINVAL;
+
+        obj = bpf_object__open(attr->file);
         if (IS_ERR(obj))
                 return -ENOENT;
 
@@ -1989,15 +2043,23 @@ int bpf_prog_load(const char *file, enum bpf_prog_type type,
                  * If type is not specified, try to guess it based on
                  * section name.
                  */
-                if (type == BPF_PROG_TYPE_UNSPEC) {
-                        type = bpf_program__guess_type(prog);
-                        if (type == BPF_PROG_TYPE_UNSPEC) {
+                prog_type = attr->prog_type;
+                expected_attach_type = attr->expected_attach_type;
+                if (prog_type == BPF_PROG_TYPE_UNSPEC) {
+                        section_idx = bpf_program__identify_section(prog);
+                        if (section_idx < 0) {
                                 bpf_object__close(obj);
                                 return -EINVAL;
                         }
+                        prog_type = section_names[section_idx].prog_type;
+                        expected_attach_type =
+                                section_names[section_idx].expected_attach_type;
                 }
 
-                bpf_program__set_type(prog, type);
+                bpf_program__set_type(prog, prog_type);
+                bpf_program__set_expected_attach_type(prog,
+                                                      expected_attach_type);
+
                 if (prog->idx != obj->efile.text_shndx && !first_prog)
                         first_prog = prog;
         }
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index f85906533cdd..a3a62a583f27 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -248,6 +248,14 @@ int bpf_map__pin(struct bpf_map *map, const char *path);
 
 long libbpf_get_error(const void *ptr);
 
+struct bpf_prog_load_attr {
+        const char *file;
+        enum bpf_prog_type prog_type;
+        enum bpf_attach_type expected_attach_type;
+};
+
+int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
+                        struct bpf_object **pobj, int *prog_fd);
 int bpf_prog_load(const char *file, enum bpf_prog_type type,
                   struct bpf_object **pobj, int *prog_fd);
 
diff --git a/tools/lib/str_error_r.c b/tools/lib/str_error_r.c
index d6d65537b0d9..6aad8308a0ac 100644
--- a/tools/lib/str_error_r.c
+++ b/tools/lib/str_error_r.c
@@ -22,6 +22,6 @@ char *str_error_r(int errnum, char *buf, size_t buflen)
 {
         int err = strerror_r(errnum, buf, buflen);
         if (err)
-                snprintf(buf, buflen, "INTERNAL ERROR: strerror_r(%d, %p, %zd)=%d", errnum, buf, buflen, err);
+                snprintf(buf, buflen, "INTERNAL ERROR: strerror_r(%d, [buf], %zd)=%d", errnum, buflen, err);
         return buf;
 }
diff --git a/tools/lib/subcmd/parse-options.c b/tools/lib/subcmd/parse-options.c
index f6a1babcbac4..cb7154eccbdc 100644
--- a/tools/lib/subcmd/parse-options.c
+++ b/tools/lib/subcmd/parse-options.c
@@ -433,7 +433,7 @@ match:
 
         if (ambiguous_option) {
                  fprintf(stderr,
-                         " Error: Ambiguous option: %s (could be --%s%s or --%s%s)",
+                         " Error: Ambiguous option: %s (could be --%s%s or --%s%s)\n",
                          arg,
                          (ambiguous_flags & OPT_UNSET) ?  "no-" : "",
                          ambiguous_option->long_name,
@@ -458,7 +458,7 @@ static void check_typos(const char *arg, const struct option *options)
                 return;
 
         if (strstarts(arg, "no-")) {
-                fprintf(stderr, " Error: did you mean `--%s` (with two dashes ?)", arg);
+                fprintf(stderr, " Error: did you mean `--%s` (with two dashes ?)\n", arg);
                 exit(129);
         }
 
@@ -466,7 +466,7 @@ static void check_typos(const char *arg, const struct option *options)
                 if (!options->long_name)
                         continue;
                 if (strstarts(options->long_name, arg)) {
-                        fprintf(stderr, " Error: did you mean `--%s` (with two dashes ?)", arg);
+                        fprintf(stderr, " Error: did you mean `--%s` (with two dashes ?)\n", arg);
                         exit(129);
                 }
         }
diff --git a/tools/lib/symbol/kallsyms.c b/tools/lib/symbol/kallsyms.c
index 914cb8e3d40b..689b6a130dd7 100644
--- a/tools/lib/symbol/kallsyms.c
+++ b/tools/lib/symbol/kallsyms.c
@@ -38,6 +38,10 @@ int kallsyms__parse(const char *filename, void *arg,
 
                 len = hex2u64(line, &start);
 
+                /* Skip the line if we failed to parse the address. */
+                if (!len)
+                        continue;
+
                 len++;
                 if (len + 2 >= line_len)
                         continue;
diff --git a/tools/memory-model/Documentation/cheatsheet.txt b/tools/memory-model/Documentation/cheatsheet.txt
new file mode 100644
index 000000000000..956b1ae4aafb
--- /dev/null
+++ b/tools/memory-model/Documentation/cheatsheet.txt
@@ -0,0 +1,29 @@
+                                  Prior Operation     Subsequent Operation
+                                  ---------------  ---------------------------
+                               C  Self  R  W  RWM  Self  R  W  DR  DW  RMW  SV
+                              --  ----  -  -  ---  ----  -  -  --  --  ---  --
+
+Store, e.g., WRITE_ONCE()            Y                                       Y
+Load, e.g., READ_ONCE()              Y                          Y   Y        Y
+Unsuccessful RMW operation           Y                          Y   Y        Y
+rcu_dereference()                    Y                          Y   Y        Y
+Successful *_acquire()               R                   Y  Y   Y   Y    Y   Y
+Successful *_release()         C        Y  Y    Y     W                      Y
+smp_rmb()                               Y       R        Y      Y        R
+smp_wmb()                                  Y    W           Y       Y    W
+smp_mb() & synchronize_rcu()  CP        Y  Y    Y        Y  Y   Y   Y    Y
+Successful full non-void RMW  CP     Y  Y  Y    Y     Y  Y  Y   Y   Y    Y   Y
+smp_mb__before_atomic()       CP        Y  Y    Y        a  a   a   a    Y
+smp_mb__after_atomic()        CP        a  a    Y        Y  Y   Y   Y
+
+
+Key:    C:      Ordering is cumulative
+        P:      Ordering propagates
+        R:      Read, for example, READ_ONCE(), or read portion of RMW
+        W:      Write, for example, WRITE_ONCE(), or write portion of RMW
+        Y:      Provides ordering
+        a:      Provides ordering given intervening RMW atomic operation
+        DR:     Dependent read (address dependency)
+        DW:     Dependent write (address, data, or control dependency)
+        RMW:    Atomic read-modify-write operation
+        SV      Same-variable access
diff --git a/tools/memory-model/Documentation/explanation.txt b/tools/memory-model/Documentation/explanation.txt
new file mode 100644
index 000000000000..a727c82bd434
--- /dev/null
+++ b/tools/memory-model/Documentation/explanation.txt
@@ -0,0 +1,1845 @@
+Explanation of the Linux-Kernel Memory Consistency Model
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+:Author: Alan Stern <stern@rowland.harvard.edu>
+:Created: October 2017
+
+.. Contents
+
+  1. INTRODUCTION
+  2. BACKGROUND
+  3. A SIMPLE EXAMPLE
+  4. A SELECTION OF MEMORY MODELS
+  5. ORDERING AND CYCLES
+  6. EVENTS
+  7. THE PROGRAM ORDER RELATION: po AND po-loc
+  8. A WARNING
+  9. DEPENDENCY RELATIONS: data, addr, and ctrl
+  10. THE READS-FROM RELATION: rf, rfi, and rfe
+  11. CACHE COHERENCE AND THE COHERENCE ORDER RELATION: co, coi, and coe
+  12. THE FROM-READS RELATION: fr, fri, and fre
+  13. AN OPERATIONAL MODEL
+  14. PROPAGATION ORDER RELATION: cumul-fence
+  15. DERIVATION OF THE LKMM FROM THE OPERATIONAL MODEL
+  16. SEQUENTIAL CONSISTENCY PER VARIABLE
+  17. ATOMIC UPDATES: rmw
+  18. THE PRESERVED PROGRAM ORDER RELATION: ppo
+  19. AND THEN THERE WAS ALPHA
+  20. THE HAPPENS-BEFORE RELATION: hb
+  21. THE PROPAGATES-BEFORE RELATION: pb
+  22. RCU RELATIONS: link, gp-link, rscs-link, and rcu-path
+  23. ODDS AND ENDS
+
+
+
+INTRODUCTION
+------------
+
+The Linux-kernel memory consistency model (LKMM) is rather complex and
+obscure.  This is particularly evident if you read through the
+linux-kernel.bell and linux-kernel.cat files that make up the formal
+version of the model; they are extremely terse and their meanings are
+far from clear.
+
+This document describes the ideas underlying the LKMM.  It is meant
+for people who want to understand how the model was designed.  It does
+not go into the details of the code in the .bell and .cat files;
+rather, it explains in English what the code expresses symbolically.
+
+Sections 2 (BACKGROUND) through 5 (ORDERING AND CYCLES) are aimed
+toward beginners; they explain what memory consistency models are and
+the basic notions shared by all such models.  People already familiar
+with these concepts can skim or skip over them.  Sections 6 (EVENTS)
+through 12 (THE FROM_READS RELATION) describe the fundamental
+relations used in many models.  Starting in Section 13 (AN OPERATIONAL
+MODEL), the workings of the LKMM itself are covered.
+
+Warning: The code examples in this document are not written in the
+proper format for litmus tests.  They don't include a header line, the
+initializations are not enclosed in braces, the global variables are
+not passed by pointers, and they don't have an "exists" clause at the
+end.  Converting them to the right format is left as an exercise for
+the reader.
+
+
+BACKGROUND
+----------
+
+A memory consistency model (or just memory model, for short) is
+something which predicts, given a piece of computer code running on a
+particular kind of system, what values may be obtained by the code's
+load instructions.  The LKMM makes these predictions for code running
+as part of the Linux kernel.
+
+In practice, people tend to use memory models the other way around.
+That is, given a piece of code and a collection of values specified
+for the loads, the model will predict whether it is possible for the
+code to run in such a way that the loads will indeed obtain the
+specified values.  Of course, this is just another way of expressing
+the same idea.
+
+For code running on a uniprocessor system, the predictions are easy:
+Each load instruction must obtain the value written by the most recent
+store instruction accessing the same location (we ignore complicating
+factors such as DMA and mixed-size accesses.)  But on multiprocessor
+systems, with multiple CPUs making concurrent accesses to shared
+memory locations, things aren't so simple.
+
+Different architectures have differing memory models, and the Linux
+kernel supports a variety of architectures.  The LKMM has to be fairly
+permissive, in the sense that any behavior allowed by one of these
+architectures also has to be allowed by the LKMM.
+
+
+A SIMPLE EXAMPLE
+----------------
+
+Here is a simple example to illustrate the basic concepts.  Consider
+some code running as part of a device driver for an input device.  The
+driver might contain an interrupt handler which collects data from the
+device, stores it in a buffer, and sets a flag to indicate the buffer
+is full.  Running concurrently on a different CPU might be a part of
+the driver code being executed by a process in the midst of a read(2)
+system call.  This code tests the flag to see whether the buffer is
+ready, and if it is, copies the data back to userspace.  The buffer
+and the flag are memory locations shared between the two CPUs.
+
+We can abstract out the important pieces of the driver code as follows
+(the reason for using WRITE_ONCE() and READ_ONCE() instead of simple
+assignment statements is discussed later):
+
+        int buf = 0, flag = 0;
+
+        P0()
+        {
+                WRITE_ONCE(buf, 1);
+                WRITE_ONCE(flag, 1);
+        }
+
+        P1()
+        {
+                int r1;
+                int r2 = 0;
+
+                r1 = READ_ONCE(flag);
+                if (r1)
+                        r2 = READ_ONCE(buf);
+        }
+
+Here the P0() function represents the interrupt handler running on one
+CPU and P1() represents the read() routine running on another.  The
+value 1 stored in buf represents input data collected from the device.
+Thus, P0 stores the data in buf and then sets flag.  Meanwhile, P1
+reads flag into the private variable r1, and if it is set, reads the
+data from buf into a second private variable r2 for copying to
+userspace.  (Presumably if flag is not set then the driver will wait a
+while and try again.)
+
+This pattern of memory accesses, where one CPU stores values to two
+shared memory locations and another CPU loads from those locations in
+the opposite order, is widely known as the "Message Passing" or MP
+pattern.  It is typical of memory access patterns in the kernel.
+
+Please note that this example code is a simplified abstraction.  Real
+buffers are usually larger than a single integer, real device drivers
+usually use sleep and wakeup mechanisms rather than polling for I/O
+completion, and real code generally doesn't bother to copy values into
+private variables before using them.  All that is beside the point;
+the idea here is simply to illustrate the overall pattern of memory
+accesses by the CPUs.
+
+A memory model will predict what values P1 might obtain for its loads
+from flag and buf, or equivalently, what values r1 and r2 might end up
+with after the code has finished running.
+
+Some predictions are trivial.  For instance, no sane memory model would
+predict that r1 = 42 or r2 = -7, because neither of those values ever
+gets stored in flag or buf.
+
+Some nontrivial predictions are nonetheless quite simple.  For
+instance, P1 might run entirely before P0 begins, in which case r1 and
+r2 will both be 0 at the end.  Or P0 might run entirely before P1
+begins, in which case r1 and r2 will both be 1.
+
+The interesting predictions concern what might happen when the two
+routines run concurrently.  One possibility is that P1 runs after P0's
+store to buf but before the store to flag.  In this case, r1 and r2
+will again both be 0.  (If P1 had been designed to read buf
+unconditionally then we would instead have r1 = 0 and r2 = 1.)
+
+However, the most interesting possibility is where r1 = 1 and r2 = 0.
+If this were to occur it would mean the driver contains a bug, because
+incorrect data would get sent to the user: 0 instead of 1.  As it
+happens, the LKMM does predict this outcome can occur, and the example
+driver code shown above is indeed buggy.
+
+
+A SELECTION OF MEMORY MODELS
+----------------------------
+
+The first widely cited memory model, and the simplest to understand,
+is Sequential Consistency.  According to this model, systems behave as
+if each CPU executed its instructions in order but with unspecified
+timing.  In other words, the instructions from the various CPUs get
+interleaved in a nondeterministic way, always according to some single
+global order that agrees with the order of the instructions in the
+program source for each CPU.  The model says that the value obtained
+by each load is simply the value written by the most recently executed
+store to the same memory location, from any CPU.
+
+For the MP example code shown above, Sequential Consistency predicts
+that the undesired result r1 = 1, r2 = 0 cannot occur.  The reasoning
+goes like this:
+
+        Since r1 = 1, P0 must store 1 to flag before P1 loads 1 from
+        it, as loads can obtain values only from earlier stores.
+
+        P1 loads from flag before loading from buf, since CPUs execute
+        their instructions in order.
+
+        P1 must load 0 from buf before P0 stores 1 to it; otherwise r2
+        would be 1 since a load obtains its value from the most recent
+        store to the same address.
+
+        P0 stores 1 to buf before storing 1 to flag, since it executes
+        its instructions in order.
+
+        Since an instruction (in this case, P1's store to flag) cannot
+        execute before itself, the specified outcome is impossible.
+
+However, real computer hardware almost never follows the Sequential
+Consistency memory model; doing so would rule out too many valuable
+performance optimizations.  On ARM and PowerPC architectures, for
+instance, the MP example code really does sometimes yield r1 = 1 and
+r2 = 0.
+
+x86 and SPARC follow yet a different memory model: TSO (Total Store
+Ordering).  This model predicts that the undesired outcome for the MP
+pattern cannot occur, but in other respects it differs from Sequential
+Consistency.  One example is the Store Buffer (SB) pattern, in which
+each CPU stores to its own shared location and then loads from the
+other CPU's location:
+
+        int x = 0, y = 0;
+
+        P0()
+        {
+                int r0;
+
+                WRITE_ONCE(x, 1);
+                r0 = READ_ONCE(y);
+        }
+
+        P1()
+        {
+                int r1;
+
+                WRITE_ONCE(y, 1);
+                r1 = READ_ONCE(x);
+        }
+
+Sequential Consistency predicts that the outcome r0 = 0, r1 = 0 is
+impossible.  (Exercise: Figure out the reasoning.)  But TSO allows
+this outcome to occur, and in fact it does sometimes occur on x86 and
+SPARC systems.
+
+The LKMM was inspired by the memory models followed by PowerPC, ARM,
+x86, Alpha, and other architectures.  However, it is different in
+detail from each of them.
+
+
+ORDERING AND CYCLES
+-------------------
+
+Memory models are all about ordering.  Often this is temporal ordering
+(i.e., the order in which certain events occur) but it doesn't have to
+be; consider for example the order of instructions in a program's
+source code.  We saw above that Sequential Consistency makes an
+important assumption that CPUs execute instructions in the same order
+as those instructions occur in the code, and there are many other
+instances of ordering playing central roles in memory models.
+
+The counterpart to ordering is a cycle.  Ordering rules out cycles:
+It's not possible to have X ordered before Y, Y ordered before Z, and
+Z ordered before X, because this would mean that X is ordered before
+itself.  The analysis of the MP example under Sequential Consistency
+involved just such an impossible cycle:
+
+        W: P0 stores 1 to flag   executes before
+        X: P1 loads 1 from flag  executes before
+        Y: P1 loads 0 from buf   executes before
+        Z: P0 stores 1 to buf    executes before
+        W: P0 stores 1 to flag.
+
+In short, if a memory model requires certain accesses to be ordered,
+and a certain outcome for the loads in a piece of code can happen only
+if those accesses would form a cycle, then the memory model predicts
+that outcome cannot occur.
+
+The LKMM is defined largely in terms of cycles, as we will see.
+
+
+EVENTS
+------
+
+The LKMM does not work directly with the C statements that make up
+kernel source code.  Instead it considers the effects of those
+statements in a more abstract form, namely, events.  The model
+includes three types of events:
+
+        Read events correspond to loads from shared memory, such as
+        calls to READ_ONCE(), smp_load_acquire(), or
+        rcu_dereference().
+
+        Write events correspond to stores to shared memory, such as
+        calls to WRITE_ONCE(), smp_store_release(), or atomic_set().
+
+        Fence events correspond to memory barriers (also known as
+        fences), such as calls to smp_rmb() or rcu_read_lock().
+
+These categories are not exclusive; a read or write event can also be
+a fence.  This happens with functions like smp_load_acquire() or
+spin_lock().  However, no single event can be both a read and a write.
+Atomic read-modify-write accesses, such as atomic_inc() or xchg(),
+correspond to a pair of events: a read followed by a write.  (The
+write event is omitted for executions where it doesn't occur, such as
+a cmpxchg() where the comparison fails.)
+
+Other parts of the code, those which do not involve interaction with
+shared memory, do not give rise to events.  Thus, arithmetic and
+logical computations, control-flow instructions, or accesses to
+private memory or CPU registers are not of central interest to the
+memory model.  They only affect the model's predictions indirectly.
+For example, an arithmetic computation might determine the value that
+gets stored to a shared memory location (or in the case of an array
+index, the address where the value gets stored), but the memory model
+is concerned only with the store itself -- its value and its address
+-- not the computation leading up to it.
+
+Events in the LKMM can be linked by various relations, which we will
+describe in the following sections.  The memory model requires certain
+of these relations to be orderings, that is, it requires them not to
+have any cycles.
+
+
+THE PROGRAM ORDER RELATION: po AND po-loc
+-----------------------------------------
+
+The most important relation between events is program order (po).  You
+can think of it as the order in which statements occur in the source
+code after branches are taken into account and loops have been
+unrolled.  A better description might be the order in which
+instructions are presented to a CPU's execution unit.  Thus, we say
+that X is po-before Y (written as "X ->po Y" in formulas) if X occurs
+before Y in the instruction stream.
+
+This is inherently a single-CPU relation; two instructions executing
+on different CPUs are never linked by po.  Also, it is by definition
+an ordering so it cannot have any cycles.
+
+po-loc is a sub-relation of po.  It links two memory accesses when the
+first comes before the second in program order and they access the
+same memory location (the "-loc" suffix).
+
+Although this may seem straightforward, there is one subtle aspect to
+program order we need to explain.  The LKMM was inspired by low-level
+architectural memory models which describe the behavior of machine
+code, and it retains their outlook to a considerable extent.  The
+read, write, and fence events used by the model are close in spirit to
+individual machine instructions.  Nevertheless, the LKMM describes
+kernel code written in C, and the mapping from C to machine code can
+be extremely complex.
+
+Optimizing compilers have great freedom in the way they translate
+source code to object code.  They are allowed to apply transformations
+that add memory accesses, eliminate accesses, combine them, split them
+into pieces, or move them around.  Faced with all these possibilities,
+the LKMM basically gives up.  It insists that the code it analyzes
+must contain no ordinary accesses to shared memory; all accesses must
+be performed using READ_ONCE(), WRITE_ONCE(), or one of the other
+atomic or synchronization primitives.  These primitives prevent a
+large number of compiler optimizations.  In particular, it is
+guaranteed that the compiler will not remove such accesses from the
+generated code (unless it can prove the accesses will never be
+executed), it will not change the order in which they occur in the
+code (within limits imposed by the C standard), and it will not
+introduce extraneous accesses.
+
+This explains why the MP and SB examples above used READ_ONCE() and
+WRITE_ONCE() rather than ordinary memory accesses.  Thanks to this
+usage, we can be certain that in the MP example, P0's write event to
+buf really is po-before its write event to flag, and similarly for the
+other shared memory accesses in the examples.
+
+Private variables are not subject to this restriction.  Since they are
+not shared between CPUs, they can be accessed normally without
+READ_ONCE() or WRITE_ONCE(), and there will be no ill effects.  In
+fact, they need not even be stored in normal memory at all -- in
+principle a private variable could be stored in a CPU register (hence
+the convention that these variables have names starting with the
+letter 'r').
+
+
+A WARNING
+---------
+
+The protections provided by READ_ONCE(), WRITE_ONCE(), and others are
+not perfect; and under some circumstances it is possible for the
+compiler to undermine the memory model.  Here is an example.  Suppose
+both branches of an "if" statement store the same value to the same
+location:
+
+        r1 = READ_ONCE(x);
+        if (r1) {
+                WRITE_ONCE(y, 2);
+                ...  /* do something */
+        } else {
+                WRITE_ONCE(y, 2);
+                ...  /* do something else */
+        }
+
+For this code, the LKMM predicts that the load from x will always be
+executed before either of the stores to y.  However, a compiler could
+lift the stores out of the conditional, transforming the code into
+something resembling:
+
+        r1 = READ_ONCE(x);
+        WRITE_ONCE(y, 2);
+        if (r1) {
+                ...  /* do something */
+        } else {
+                ...  /* do something else */
+        }
+
+Given this version of the code, the LKMM would predict that the load
+from x could be executed after the store to y.  Thus, the memory
+model's original prediction could be invalidated by the compiler.
+
+Another issue arises from the fact that in C, arguments to many
+operators and function calls can be evaluated in any order.  For
+example:
+
+        r1 = f(5) + g(6);
+
+The object code might call f(5) either before or after g(6); the
+memory model cannot assume there is a fixed program order relation
+between them.  (In fact, if the functions are inlined then the
+compiler might even interleave their object code.)
+
+
+DEPENDENCY RELATIONS: data, addr, and ctrl
+------------------------------------------
+
+We say that two events are linked by a dependency relation when the
+execution of the second event depends in some way on a value obtained
+from memory by the first.  The first event must be a read, and the
+value it obtains must somehow affect what the second event does.
+There are three kinds of dependencies: data, address (addr), and
+control (ctrl).
+
+A read and a write event are linked by a data dependency if the value
+obtained by the read affects the value stored by the write.  As a very
+simple example:
+
+        int x, y;
+
+        r1 = READ_ONCE(x);
+        WRITE_ONCE(y, r1 + 5);
+
+The value stored by the WRITE_ONCE obviously depends on the value
+loaded by the READ_ONCE.  Such dependencies can wind through
+arbitrarily complicated computations, and a write can depend on the
+values of multiple reads.
+
+A read event and another memory access event are linked by an address
+dependency if the value obtained by the read affects the location
+accessed by the other event.  The second event can be either a read or
+a write.  Here's another simple example:
+
+        int a[20];
+        int i;
+
+        r1 = READ_ONCE(i);
+        r2 = READ_ONCE(a[r1]);
+
+Here the location accessed by the second READ_ONCE() depends on the
+index value loaded by the first.  Pointer indirection also gives rise
+to address dependencies, since the address of a location accessed
+through a pointer will depend on the value read earlier from that
+pointer.
+
+Finally, a read event and another memory access event are linked by a
+control dependency if the value obtained by the read affects whether
+the second event is executed at all.  Simple example:
+
+        int x, y;
+
+        r1 = READ_ONCE(x);
+        if (r1)
+                WRITE_ONCE(y, 1984);
+
+Execution of the WRITE_ONCE() is controlled by a conditional expression
+which depends on the value obtained by the READ_ONCE(); hence there is
+a control dependency from the load to the store.
+
+It should be pretty obvious that events can only depend on reads that
+come earlier in program order.  Symbolically, if we have R ->data X,
+R ->addr X, or R ->ctrl X (where R is a read event), then we must also
+have R ->po X.  It wouldn't make sense for a computation to depend
+somehow on a value that doesn't get loaded from shared memory until
+later in the code!
+
+
+THE READS-FROM RELATION: rf, rfi, and rfe
+-----------------------------------------
+
+The reads-from relation (rf) links a write event to a read event when
+the value loaded by the read is the value that was stored by the
+write.  In colloquial terms, the load "reads from" the store.  We
+write W ->rf R to indicate that the load R reads from the store W.  We
+further distinguish the cases where the load and the store occur on
+the same CPU (internal reads-from, or rfi) and where they occur on
+different CPUs (external reads-from, or rfe).
+
+For our purposes, a memory location's initial value is treated as
+though it had been written there by an imaginary initial store that
+executes on a separate CPU before the program runs.
+
+Usage of the rf relation implicitly assumes that loads will always
+read from a single store.  It doesn't apply properly in the presence
+of load-tearing, where a load obtains some of its bits from one store
+and some of them from another store.  Fortunately, use of READ_ONCE()
+and WRITE_ONCE() will prevent load-tearing; it's not possible to have:
+
+        int x = 0;
+
+        P0()
+        {
+                WRITE_ONCE(x, 0x1234);
+        }
+
+        P1()
+        {
+                int r1;
+
+                r1 = READ_ONCE(x);
+        }
+
+and end up with r1 = 0x1200 (partly from x's initial value and partly
+from the value stored by P0).
+
+On the other hand, load-tearing is unavoidable when mixed-size
+accesses are used.  Consider this example:
+
+        union {
+                u32     w;
+                u16     h[2];
+        } x;
+
+        P0()
+        {
+                WRITE_ONCE(x.h[0], 0x1234);
+                WRITE_ONCE(x.h[1], 0x5678);
+        }
+
+        P1()
+        {
+                int r1;
+
+                r1 = READ_ONCE(x.w);
+        }
+
+If r1 = 0x56781234 (little-endian!) at the end, then P1 must have read
+from both of P0's stores.  It is possible to handle mixed-size and
+unaligned accesses in a memory model, but the LKMM currently does not
+attempt to do so.  It requires all accesses to be properly aligned and
+of the location's actual size.
+
+
+CACHE COHERENCE AND THE COHERENCE ORDER RELATION: co, coi, and coe
+------------------------------------------------------------------
+
+Cache coherence is a general principle requiring that in a
+multi-processor system, the CPUs must share a consistent view of the
+memory contents.  Specifically, it requires that for each location in
+shared memory, the stores to that location must form a single global
+ordering which all the CPUs agree on (the coherence order), and this
+ordering must be consistent with the program order for accesses to
+that location.
+
+To put it another way, for any variable x, the coherence order (co) of
+the stores to x is simply the order in which the stores overwrite one
+another.  The imaginary store which establishes x's initial value
+comes first in the coherence order; the store which directly
+overwrites the initial value comes second; the store which overwrites
+that value comes third, and so on.
+
+You can think of the coherence order as being the order in which the
+stores reach x's location in memory (or if you prefer a more
+hardware-centric view, the order in which the stores get written to
+x's cache line).  We write W ->co W' if W comes before W' in the
+coherence order, that is, if the value stored by W gets overwritten,
+directly or indirectly, by the value stored by W'.
+
+Coherence order is required to be consistent with program order.  This
+requirement takes the form of four coherency rules:
+
+        Write-write coherence: If W ->po-loc W' (i.e., W comes before
+        W' in program order and they access the same location), where W
+        and W' are two stores, then W ->co W'.
+
+        Write-read coherence: If W ->po-loc R, where W is a store and R
+        is a load, then R must read from W or from some other store
+        which comes after W in the coherence order.
+
+        Read-write coherence: If R ->po-loc W, where R is a load and W
+        is a store, then the store which R reads from must come before
+        W in the coherence order.
+
+        Read-read coherence: If R ->po-loc R', where R and R' are two
+        loads, then either they read from the same store or else the
+        store read by R comes before the store read by R' in the
+        coherence order.
+
+This is sometimes referred to as sequential consistency per variable,
+because it means that the accesses to any single memory location obey
+the rules of the Sequential Consistency memory model.  (According to
+Wikipedia, sequential consistency per variable and cache coherence
+mean the same thing except that cache coherence includes an extra
+requirement that every store eventually becomes visible to every CPU.)
+
+Any reasonable memory model will include cache coherence.  Indeed, our
+expectation of cache coherence is so deeply ingrained that violations
+of its requirements look more like hardware bugs than programming
+errors:
+
+        int x;
+
+        P0()
+        {
+                WRITE_ONCE(x, 17);
+                WRITE_ONCE(x, 23);
+        }
+
+If the final value stored in x after this code ran was 17, you would
+think your computer was broken.  It would be a violation of the
+write-write coherence rule: Since the store of 23 comes later in
+program order, it must also come later in x's coherence order and
+thus must overwrite the store of 17.
+
+        int x = 0;
+
+        P0()
+        {
+                int r1;
+
+                r1 = READ_ONCE(x);
+                WRITE_ONCE(x, 666);
+        }
+
+If r1 = 666 at the end, this would violate the read-write coherence
+rule: The READ_ONCE() load comes before the WRITE_ONCE() store in
+program order, so it must not read from that store but rather from one
+coming earlier in the coherence order (in this case, x's initial
+value).
+
+        int x = 0;
+
+        P0()
+        {
+                WRITE_ONCE(x, 5);
+        }
+
+        P1()
+        {
+                int r1, r2;
+
+                r1 = READ_ONCE(x);
+                r2 = READ_ONCE(x);
+        }
+
+If r1 = 5 (reading from P0's store) and r2 = 0 (reading from the
+imaginary store which establishes x's initial value) at the end, this
+would violate the read-read coherence rule: The r1 load comes before
+the r2 load in program order, so it must not read from a store that
+comes later in the coherence order.
+
+(As a minor curiosity, if this code had used normal loads instead of
+READ_ONCE() in P1, on Itanium it sometimes could end up with r1 = 5
+and r2 = 0!  This results from parallel execution of the operations
+encoded in Itanium's Very-Long-Instruction-Word format, and it is yet
+another motivation for using READ_ONCE() when accessing shared memory
+locations.)
+
+Just like the po relation, co is inherently an ordering -- it is not
+possible for a store to directly or indirectly overwrite itself!  And
+just like with the rf relation, we distinguish between stores that
+occur on the same CPU (internal coherence order, or coi) and stores
+that occur on different CPUs (external coherence order, or coe).
+
+On the other hand, stores to different memory locations are never
+related by co, just as instructions on different CPUs are never
+related by po.  Coherence order is strictly per-location, or if you
+prefer, each location has its own independent coherence order.
+
+
+THE FROM-READS RELATION: fr, fri, and fre
+-----------------------------------------
+
+The from-reads relation (fr) can be a little difficult for people to
+grok.  It describes the situation where a load reads a value that gets
+overwritten by a store.  In other words, we have R ->fr W when the
+value that R reads is overwritten (directly or indirectly) by W, or
+equivalently, when R reads from a store which comes earlier than W in
+the coherence order.
+
+For example:
+
+        int x = 0;
+
+        P0()
+        {
+                int r1;
+
+                r1 = READ_ONCE(x);
+                WRITE_ONCE(x, 2);
+        }
+
+The value loaded from x will be 0 (assuming cache coherence!), and it
+gets overwritten by the value 2.  Thus there is an fr link from the
+READ_ONCE() to the WRITE_ONCE().  If the code contained any later
+stores to x, there would also be fr links from the READ_ONCE() to
+them.
+
+As with rf, rfi, and rfe, we subdivide the fr relation into fri (when
+the load and the store are on the same CPU) and fre (when they are on
+different CPUs).
+
+Note that the fr relation is determined entirely by the rf and co
+relations; it is not independent.  Given a read event R and a write
+event W for the same location, we will have R ->fr W if and only if
+the write which R reads from is co-before W.  In symbols,
+
+        (R ->fr W) := (there exists W' with W' ->rf R and W' ->co W).
+
+
+AN OPERATIONAL MODEL
+--------------------
+
+The LKMM is based on various operational memory models, meaning that
+the models arise from an abstract view of how a computer system
+operates.  Here are the main ideas, as incorporated into the LKMM.
+
+The system as a whole is divided into the CPUs and a memory subsystem.
+The CPUs are responsible for executing instructions (not necessarily
+in program order), and they communicate with the memory subsystem.
+For the most part, executing an instruction requires a CPU to perform
+only internal operations.  However, loads, stores, and fences involve
+more.
+
+When CPU C executes a store instruction, it tells the memory subsystem
+to store a certain value at a certain location.  The memory subsystem
+propagates the store to all the other CPUs as well as to RAM.  (As a
+special case, we say that the store propagates to its own CPU at the
+time it is executed.)  The memory subsystem also determines where the
+store falls in the location's coherence order.  In particular, it must
+arrange for the store to be co-later than (i.e., to overwrite) any
+other store to the same location which has already propagated to CPU C.
+
+When a CPU executes a load instruction R, it first checks to see
+whether there are any as-yet unexecuted store instructions, for the
+same location, that come before R in program order.  If there are, it
+uses the value of the po-latest such store as the value obtained by R,
+and we say that the store's value is forwarded to R.  Otherwise, the
+CPU asks the memory subsystem for the value to load and we say that R
+is satisfied from memory.  The memory subsystem hands back the value
+of the co-latest store to the location in question which has already
+propagated to that CPU.
+
+(In fact, the picture needs to be a little more complicated than this.
+CPUs have local caches, and propagating a store to a CPU really means
+propagating it to the CPU's local cache.  A local cache can take some
+time to process the stores that it receives, and a store can't be used
+to satisfy one of the CPU's loads until it has been processed.  On
+most architectures, the local caches process stores in
+First-In-First-Out order, and consequently the processing delay
+doesn't matter for the memory model.  But on Alpha, the local caches
+have a partitioned design that results in non-FIFO behavior.  We will
+discuss this in more detail later.)
+
+Note that load instructions may be executed speculatively and may be
+restarted under certain circumstances.  The memory model ignores these
+premature executions; we simply say that the load executes at the
+final time it is forwarded or satisfied.
+
+Executing a fence (or memory barrier) instruction doesn't require a
+CPU to do anything special other than informing the memory subsystem
+about the fence.  However, fences do constrain the way CPUs and the
+memory subsystem handle other instructions, in two respects.
+
+First, a fence forces the CPU to execute various instructions in
+program order.  Exactly which instructions are ordered depends on the
+type of fence:
+
+        Strong fences, including smp_mb() and synchronize_rcu(), force
+        the CPU to execute all po-earlier instructions before any
+        po-later instructions;
+
+        smp_rmb() forces the CPU to execute all po-earlier loads
+        before any po-later loads;
+
+        smp_wmb() forces the CPU to execute all po-earlier stores
+        before any po-later stores;
+
+        Acquire fences, such as smp_load_acquire(), force the CPU to
+        execute the load associated with the fence (e.g., the load
+        part of an smp_load_acquire()) before any po-later
+        instructions;
+
+        Release fences, such as smp_store_release(), force the CPU to
+        execute all po-earlier instructions before the store
+        associated with the fence (e.g., the store part of an
+        smp_store_release()).
+
+Second, some types of fence affect the way the memory subsystem
+propagates stores.  When a fence instruction is executed on CPU C:
+
+        For each other CPU C', smb_wmb() forces all po-earlier stores
+        on C to propagate to C' before any po-later stores do.
+
+        For each other CPU C', any store which propagates to C before
+        a release fence is executed (including all po-earlier
+        stores executed on C) is forced to propagate to C' before the
+        store associated with the release fence does.
+
+        Any store which propagates to C before a strong fence is
+        executed (including all po-earlier stores on C) is forced to
+        propagate to all other CPUs before any instructions po-after
+        the strong fence are executed on C.
+
+The propagation ordering enforced by release fences and strong fences
+affects stores from other CPUs that propagate to CPU C before the
+fence is executed, as well as stores that are executed on C before the
+fence.  We describe this property by saying that release fences and
+strong fences are A-cumulative.  By contrast, smp_wmb() fences are not
+A-cumulative; they only affect the propagation of stores that are
+executed on C before the fence (i.e., those which precede the fence in
+program order).
+
+rcu_read_lock(), rcu_read_unlock(), and synchronize_rcu() fences have
+other properties which we discuss later.
+
+
+PROPAGATION ORDER RELATION: cumul-fence
+---------------------------------------
+
+The fences which affect propagation order (i.e., strong, release, and
+smp_wmb() fences) are collectively referred to as cumul-fences, even
+though smp_wmb() isn't A-cumulative.  The cumul-fence relation is
+defined to link memory access events E and F whenever:
+
+        E and F are both stores on the same CPU and an smp_wmb() fence
+        event occurs between them in program order; or
+
+        F is a release fence and some X comes before F in program order,
+        where either X = E or else E ->rf X; or
+
+        A strong fence event occurs between some X and F in program
+        order, where either X = E or else E ->rf X.
+
+The operational model requires that whenever W and W' are both stores
+and W ->cumul-fence W', then W must propagate to any given CPU
+before W' does.  However, for different CPUs C and C', it does not
+require W to propagate to C before W' propagates to C'.
+
+
+DERIVATION OF THE LKMM FROM THE OPERATIONAL MODEL
+-------------------------------------------------
+
+The LKMM is derived from the restrictions imposed by the design
+outlined above.  These restrictions involve the necessity of
+maintaining cache coherence and the fact that a CPU can't operate on a
+value before it knows what that value is, among other things.
+
+The formal version of the LKMM is defined by five requirements, or
+axioms:
+
+        Sequential consistency per variable: This requires that the
+        system obey the four coherency rules.
+
+        Atomicity: This requires that atomic read-modify-write
+        operations really are atomic, that is, no other stores can
+        sneak into the middle of such an update.
+
+        Happens-before: This requires that certain instructions are
+        executed in a specific order.
+
+        Propagation: This requires that certain stores propagate to
+        CPUs and to RAM in a specific order.
+
+        Rcu: This requires that RCU read-side critical sections and
+        grace periods obey the rules of RCU, in particular, the
+        Grace-Period Guarantee.
+
+The first and second are quite common; they can be found in many
+memory models (such as those for C11/C++11).  The "happens-before" and
+"propagation" axioms have analogs in other memory models as well.  The
+"rcu" axiom is specific to the LKMM.
+
+Each of these axioms is discussed below.
+
+
+SEQUENTIAL CONSISTENCY PER VARIABLE
+-----------------------------------
+
+According to the principle of cache coherence, the stores to any fixed
+shared location in memory form a global ordering.  We can imagine
+inserting the loads from that location into this ordering, by placing
+each load between the store that it reads from and the following
+store.  This leaves the relative positions of loads that read from the
+same store unspecified; let's say they are inserted in program order,
+first for CPU 0, then CPU 1, etc.
+
+You can check that the four coherency rules imply that the rf, co, fr,
+and po-loc relations agree with this global ordering; in other words,
+whenever we have X ->rf Y or X ->co Y or X ->fr Y or X ->po-loc Y, the
+X event comes before the Y event in the global ordering.  The LKMM's
+"coherence" axiom expresses this by requiring the union of these
+relations not to have any cycles.  This means it must not be possible
+to find events
+
+        X0 -> X1 -> X2 -> ... -> Xn -> X0,
+
+where each of the links is either rf, co, fr, or po-loc.  This has to
+hold if the accesses to the fixed memory location can be ordered as
+cache coherence demands.
+
+Although it is not obvious, it can be shown that the converse is also
+true: This LKMM axiom implies that the four coherency rules are
+obeyed.
+
+
+ATOMIC UPDATES: rmw
+-------------------
+
+What does it mean to say that a read-modify-write (rmw) update, such
+as atomic_inc(&x), is atomic?  It means that the memory location (x in
+this case) does not get altered between the read and the write events
+making up the atomic operation.  In particular, if two CPUs perform
+atomic_inc(&x) concurrently, it must be guaranteed that the final
+value of x will be the initial value plus two.  We should never have
+the following sequence of events:
+
+        CPU 0 loads x obtaining 13;
+                                        CPU 1 loads x obtaining 13;
+        CPU 0 stores 14 to x;
+                                        CPU 1 stores 14 to x;
+
+where the final value of x is wrong (14 rather than 15).
+
+In this example, CPU 0's increment effectively gets lost because it
+occurs in between CPU 1's load and store.  To put it another way, the
+problem is that the position of CPU 0's store in x's coherence order
+is between the store that CPU 1 reads from and the store that CPU 1
+performs.
+
+The same analysis applies to all atomic update operations.  Therefore,
+to enforce atomicity the LKMM requires that atomic updates follow this
+rule: Whenever R and W are the read and write events composing an
+atomic read-modify-write and W' is the write event which R reads from,
+there must not be any stores coming between W' and W in the coherence
+order.  Equivalently,
+
+        (R ->rmw W) implies (there is no X with R ->fr X and X ->co W),
+
+where the rmw relation links the read and write events making up each
+atomic update.  This is what the LKMM's "atomic" axiom says.
+
+
+THE PRESERVED PROGRAM ORDER RELATION: ppo
+-----------------------------------------
+
+There are many situations where a CPU is obligated to execute two
+instructions in program order.  We amalgamate them into the ppo (for
+"preserved program order") relation, which links the po-earlier
+instruction to the po-later instruction and is thus a sub-relation of
+po.
+
+The operational model already includes a description of one such
+situation: Fences are a source of ppo links.  Suppose X and Y are
+memory accesses with X ->po Y; then the CPU must execute X before Y if
+any of the following hold:
+
+        A strong (smp_mb() or synchronize_rcu()) fence occurs between
+        X and Y;
+
+        X and Y are both stores and an smp_wmb() fence occurs between
+        them;
+
+        X and Y are both loads and an smp_rmb() fence occurs between
+        them;
+
+        X is also an acquire fence, such as smp_load_acquire();
+
+        Y is also a release fence, such as smp_store_release().
+
+Another possibility, not mentioned earlier but discussed in the next
+section, is:
+
+        X and Y are both loads, X ->addr Y (i.e., there is an address
+        dependency from X to Y), and X is a READ_ONCE() or an atomic
+        access.
+
+Dependencies can also cause instructions to be executed in program
+order.  This is uncontroversial when the second instruction is a
+store; either a data, address, or control dependency from a load R to
+a store W will force the CPU to execute R before W.  This is very
+simply because the CPU cannot tell the memory subsystem about W's
+store before it knows what value should be stored (in the case of a
+data dependency), what location it should be stored into (in the case
+of an address dependency), or whether the store should actually take
+place (in the case of a control dependency).
+
+Dependencies to load instructions are more problematic.  To begin with,
+there is no such thing as a data dependency to a load.  Next, a CPU
+has no reason to respect a control dependency to a load, because it
+can always satisfy the second load speculatively before the first, and
+then ignore the result if it turns out that the second load shouldn't
+be executed after all.  And lastly, the real difficulties begin when
+we consider address dependencies to loads.
+
+To be fair about it, all Linux-supported architectures do execute
+loads in program order if there is an address dependency between them.
+After all, a CPU cannot ask the memory subsystem to load a value from
+a particular location before it knows what that location is.  However,
+the split-cache design used by Alpha can cause it to behave in a way
+that looks as if the loads were executed out of order (see the next
+section for more details).  The kernel includes a workaround for this
+problem when the loads come from READ_ONCE(), and therefore the LKMM
+includes address dependencies to loads in the ppo relation.
+
+On the other hand, dependencies can indirectly affect the ordering of
+two loads.  This happens when there is a dependency from a load to a
+store and a second, po-later load reads from that store:
+
+        R ->dep W ->rfi R',
+
+where the dep link can be either an address or a data dependency.  In
+this situation we know it is possible for the CPU to execute R' before
+W, because it can forward the value that W will store to R'.  But it
+cannot execute R' before R, because it cannot forward the value before
+it knows what that value is, or that W and R' do access the same
+location.  However, if there is merely a control dependency between R
+and W then the CPU can speculatively forward W to R' before executing
+R; if the speculation turns out to be wrong then the CPU merely has to
+restart or abandon R'.
+
+(In theory, a CPU might forward a store to a load when it runs across
+an address dependency like this:
+
+        r1 = READ_ONCE(ptr);
+        WRITE_ONCE(*r1, 17);
+        r2 = READ_ONCE(*r1);
+
+because it could tell that the store and the second load access the
+same location even before it knows what the location's address is.
+However, none of the architectures supported by the Linux kernel do
+this.)
+
+Two memory accesses of the same location must always be executed in
+program order if the second access is a store.  Thus, if we have
+
+        R ->po-loc W
+
+(the po-loc link says that R comes before W in program order and they
+access the same location), the CPU is obliged to execute W after R.
+If it executed W first then the memory subsystem would respond to R's
+read request with the value stored by W (or an even later store), in
+violation of the read-write coherence rule.  Similarly, if we had
+
+        W ->po-loc W'
+
+and the CPU executed W' before W, then the memory subsystem would put
+W' before W in the coherence order.  It would effectively cause W to
+overwrite W', in violation of the write-write coherence rule.
+(Interestingly, an early ARMv8 memory model, now obsolete, proposed
+allowing out-of-order writes like this to occur.  The model avoided
+violating the write-write coherence rule by requiring the CPU not to
+send the W write to the memory subsystem at all!)
+
+There is one last example of preserved program order in the LKMM: when
+a load-acquire reads from an earlier store-release.  For example:
+
+        smp_store_release(&x, 123);
+        r1 = smp_load_acquire(&x);
+
+If the smp_load_acquire() ends up obtaining the 123 value that was
+stored by the smp_store_release(), the LKMM says that the load must be
+executed after the store; the store cannot be forwarded to the load.
+This requirement does not arise from the operational model, but it
+yields correct predictions on all architectures supported by the Linux
+kernel, although for differing reasons.
+
+On some architectures, including x86 and ARMv8, it is true that the
+store cannot be forwarded to the load.  On others, including PowerPC
+and ARMv7, smp_store_release() generates object code that starts with
+a fence and smp_load_acquire() generates object code that ends with a
+fence.  The upshot is that even though the store may be forwarded to
+the load, it is still true that any instruction preceding the store
+will be executed before the load or any following instructions, and
+the store will be executed before any instruction following the load.
+
+
+AND THEN THERE WAS ALPHA
+------------------------
+
+As mentioned above, the Alpha architecture is unique in that it does
+not appear to respect address dependencies to loads.  This means that
+code such as the following:
+
+        int x = 0;
+        int y = -1;
+        int *ptr = &y;
+
+        P0()
+        {
+                WRITE_ONCE(x, 1);
+                smp_wmb();
+                WRITE_ONCE(ptr, &x);
+        }
+
+        P1()
+        {
+                int *r1;
+                int r2;
+
+                r1 = ptr;
+                r2 = READ_ONCE(*r1);
+        }
+
+can malfunction on Alpha systems (notice that P1 uses an ordinary load
+to read ptr instead of READ_ONCE()).  It is quite possible that r1 = &x
+and r2 = 0 at the end, in spite of the address dependency.
+
+At first glance this doesn't seem to make sense.  We know that the
+smp_wmb() forces P0's store to x to propagate to P1 before the store
+to ptr does.  And since P1 can't execute its second load
+until it knows what location to load from, i.e., after executing its
+first load, the value x = 1 must have propagated to P1 before the
+second load executed.  So why doesn't r2 end up equal to 1?
+
+The answer lies in the Alpha's split local caches.  Although the two
+stores do reach P1's local cache in the proper order, it can happen
+that the first store is processed by a busy part of the cache while
+the second store is processed by an idle part.  As a result, the x = 1
+value may not become available for P1's CPU to read until after the
+ptr = &x value does, leading to the undesirable result above.  The
+final effect is that even though the two loads really are executed in
+program order, it appears that they aren't.
+
+This could not have happened if the local cache had processed the
+incoming stores in FIFO order.  By contrast, other architectures
+maintain at least the appearance of FIFO order.
+
+In practice, this difficulty is solved by inserting a special fence
+between P1's two loads when the kernel is compiled for the Alpha
+architecture.  In fact, as of version 4.15, the kernel automatically
+adds this fence (called smp_read_barrier_depends() and defined as
+nothing at all on non-Alpha builds) after every READ_ONCE() and atomic
+load.  The effect of the fence is to cause the CPU not to execute any
+po-later instructions until after the local cache has finished
+processing all the stores it has already received.  Thus, if the code
+was changed to:
+
+        P1()
+        {
+                int *r1;
+                int r2;
+
+                r1 = READ_ONCE(ptr);
+                r2 = READ_ONCE(*r1);
+        }
+
+then we would never get r1 = &x and r2 = 0.  By the time P1 executed
+its second load, the x = 1 store would already be fully processed by
+the local cache and available for satisfying the read request.  Thus
+we have yet another reason why shared data should always be read with
+READ_ONCE() or another synchronization primitive rather than accessed
+directly.
+
+The LKMM requires that smp_rmb(), acquire fences, and strong fences
+share this property with smp_read_barrier_depends(): They do not allow
+the CPU to execute any po-later instructions (or po-later loads in the
+case of smp_rmb()) until all outstanding stores have been processed by
+the local cache.  In the case of a strong fence, the CPU first has to
+wait for all of its po-earlier stores to propagate to every other CPU
+in the system; then it has to wait for the local cache to process all
+the stores received as of that time -- not just the stores received
+when the strong fence began.
+
+And of course, none of this matters for any architecture other than
+Alpha.
+
+
+THE HAPPENS-BEFORE RELATION: hb
+-------------------------------
+
+The happens-before relation (hb) links memory accesses that have to
+execute in a certain order.  hb includes the ppo relation and two
+others, one of which is rfe.
+
+W ->rfe R implies that W and R are on different CPUs.  It also means
+that W's store must have propagated to R's CPU before R executed;
+otherwise R could not have read the value stored by W.  Therefore W
+must have executed before R, and so we have W ->hb R.
+
+The equivalent fact need not hold if W ->rfi R (i.e., W and R are on
+the same CPU).  As we have already seen, the operational model allows
+W's value to be forwarded to R in such cases, meaning that R may well
+execute before W does.
+
+It's important to understand that neither coe nor fre is included in
+hb, despite their similarities to rfe.  For example, suppose we have
+W ->coe W'.  This means that W and W' are stores to the same location,
+they execute on different CPUs, and W comes before W' in the coherence
+order (i.e., W' overwrites W).  Nevertheless, it is possible for W' to
+execute before W, because the decision as to which store overwrites
+the other is made later by the memory subsystem.  When the stores are
+nearly simultaneous, either one can come out on top.  Similarly,
+R ->fre W means that W overwrites the value which R reads, but it
+doesn't mean that W has to execute after R.  All that's necessary is
+for the memory subsystem not to propagate W to R's CPU until after R
+has executed, which is possible if W executes shortly before R.
+
+The third relation included in hb is like ppo, in that it only links
+events that are on the same CPU.  However it is more difficult to
+explain, because it arises only indirectly from the requirement of
+cache coherence.  The relation is called prop, and it links two events
+on CPU C in situations where a store from some other CPU comes after
+the first event in the coherence order and propagates to C before the
+second event executes.
+
+This is best explained with some examples.  The simplest case looks
+like this:
+
+        int x;
+
+        P0()
+        {
+                int r1;
+
+                WRITE_ONCE(x, 1);
+                r1 = READ_ONCE(x);
+        }
+
+        P1()
+        {
+                WRITE_ONCE(x, 8);
+        }
+
+If r1 = 8 at the end then P0's accesses must have executed in program
+order.  We can deduce this from the operational model; if P0's load
+had executed before its store then the value of the store would have
+been forwarded to the load, so r1 would have ended up equal to 1, not
+8.  In this case there is a prop link from P0's write event to its read
+event, because P1's store came after P0's store in x's coherence
+order, and P1's store propagated to P0 before P0's load executed.
+
+An equally simple case involves two loads of the same location that
+read from different stores:
+
+        int x = 0;
+
+        P0()
+        {
+                int r1, r2;
+
+                r1 = READ_ONCE(x);
+                r2 = READ_ONCE(x);
+        }
+
+        P1()
+        {
+                WRITE_ONCE(x, 9);
+        }
+
+If r1 = 0 and r2 = 9 at the end then P0's accesses must have executed
+in program order.  If the second load had executed before the first
+then the x = 9 store must have been propagated to P0 before the first
+load executed, and so r1 would have been 9 rather than 0.  In this
+case there is a prop link from P0's first read event to its second,
+because P1's store overwrote the value read by P0's first load, and
+P1's store propagated to P0 before P0's second load executed.
+
+Less trivial examples of prop all involve fences.  Unlike the simple
+examples above, they can require that some instructions are executed
+out of program order.  This next one should look familiar:
+
+        int buf = 0, flag = 0;
+
+        P0()
+        {
+                WRITE_ONCE(buf, 1);
+                smp_wmb();
+                WRITE_ONCE(flag, 1);
+        }
+
+        P1()
+        {
+                int r1;
+                int r2;
+
+                r1 = READ_ONCE(flag);
+                r2 = READ_ONCE(buf);
+        }
+
+This is the MP pattern again, with an smp_wmb() fence between the two
+stores.  If r1 = 1 and r2 = 0 at the end then there is a prop link
+from P1's second load to its first (backwards!).  The reason is
+similar to the previous examples: The value P1 loads from buf gets
+overwritten by P0's store to buf, the fence guarantees that the store
+to buf will propagate to P1 before the store to flag does, and the
+store to flag propagates to P1 before P1 reads flag.
+
+The prop link says that in order to obtain the r1 = 1, r2 = 0 result,
+P1 must execute its second load before the first.  Indeed, if the load
+from flag were executed first, then the buf = 1 store would already
+have propagated to P1 by the time P1's load from buf executed, so r2
+would have been 1 at the end, not 0.  (The reasoning holds even for
+Alpha, although the details are more complicated and we will not go
+into them.)
+
+But what if we put an smp_rmb() fence between P1's loads?  The fence
+would force the two loads to be executed in program order, and it
+would generate a cycle in the hb relation: The fence would create a ppo
+link (hence an hb link) from the first load to the second, and the
+prop relation would give an hb link from the second load to the first.
+Since an instruction can't execute before itself, we are forced to
+conclude that if an smp_rmb() fence is added, the r1 = 1, r2 = 0
+outcome is impossible -- as it should be.
+
+The formal definition of the prop relation involves a coe or fre link,
+followed by an arbitrary number of cumul-fence links, ending with an
+rfe link.  You can concoct more exotic examples, containing more than
+one fence, although this quickly leads to diminishing returns in terms
+of complexity.  For instance, here's an example containing a coe link
+followed by two fences and an rfe link, utilizing the fact that
+release fences are A-cumulative:
+
+        int x, y, z;
+
+        P0()
+        {
+                int r0;
+
+                WRITE_ONCE(x, 1);
+                r0 = READ_ONCE(z);
+        }
+
+        P1()
+        {
+                WRITE_ONCE(x, 2);
+                smp_wmb();
+                WRITE_ONCE(y, 1);
+        }
+
+        P2()
+        {
+                int r2;
+
+                r2 = READ_ONCE(y);
+                smp_store_release(&z, 1);
+        }
+
+If x = 2, r0 = 1, and r2 = 1 after this code runs then there is a prop
+link from P0's store to its load.  This is because P0's store gets
+overwritten by P1's store since x = 2 at the end (a coe link), the
+smp_wmb() ensures that P1's store to x propagates to P2 before the
+store to y does (the first fence), the store to y propagates to P2
+before P2's load and store execute, P2's smp_store_release()
+guarantees that the stores to x and y both propagate to P0 before the
+store to z does (the second fence), and P0's load executes after the
+store to z has propagated to P0 (an rfe link).
+
+In summary, the fact that the hb relation links memory access events
+in the order they execute means that it must not have cycles.  This
+requirement is the content of the LKMM's "happens-before" axiom.
+
+The LKMM defines yet another relation connected to times of
+instruction execution, but it is not included in hb.  It relies on the
+particular properties of strong fences, which we cover in the next
+section.
+
+
+THE PROPAGATES-BEFORE RELATION: pb
+----------------------------------
+
+The propagates-before (pb) relation capitalizes on the special
+features of strong fences.  It links two events E and F whenever some
+store is coherence-later than E and propagates to every CPU and to RAM
+before F executes.  The formal definition requires that E be linked to
+F via a coe or fre link, an arbitrary number of cumul-fences, an
+optional rfe link, a strong fence, and an arbitrary number of hb
+links.  Let's see how this definition works out.
+
+Consider first the case where E is a store (implying that the sequence
+of links begins with coe).  Then there are events W, X, Y, and Z such
+that:
+
+        E ->coe W ->cumul-fence* X ->rfe? Y ->strong-fence Z ->hb* F,
+
+where the * suffix indicates an arbitrary number of links of the
+specified type, and the ? suffix indicates the link is optional (Y may
+be equal to X).  Because of the cumul-fence links, we know that W will
+propagate to Y's CPU before X does, hence before Y executes and hence
+before the strong fence executes.  Because this fence is strong, we
+know that W will propagate to every CPU and to RAM before Z executes.
+And because of the hb links, we know that Z will execute before F.
+Thus W, which comes later than E in the coherence order, will
+propagate to every CPU and to RAM before F executes.
+
+The case where E is a load is exactly the same, except that the first
+link in the sequence is fre instead of coe.
+
+The existence of a pb link from E to F implies that E must execute
+before F.  To see why, suppose that F executed first.  Then W would
+have propagated to E's CPU before E executed.  If E was a store, the
+memory subsystem would then be forced to make E come after W in the
+coherence order, contradicting the fact that E ->coe W.  If E was a
+load, the memory subsystem would then be forced to satisfy E's read
+request with the value stored by W or an even later store,
+contradicting the fact that E ->fre W.
+
+A good example illustrating how pb works is the SB pattern with strong
+fences:
+
+        int x = 0, y = 0;
+
+        P0()
+        {
+                int r0;
+
+                WRITE_ONCE(x, 1);
+                smp_mb();
+                r0 = READ_ONCE(y);
+        }
+
+        P1()
+        {
+                int r1;
+
+                WRITE_ONCE(y, 1);
+                smp_mb();
+                r1 = READ_ONCE(x);
+        }
+
+If r0 = 0 at the end then there is a pb link from P0's load to P1's
+load: an fre link from P0's load to P1's store (which overwrites the
+value read by P0), and a strong fence between P1's store and its load.
+In this example, the sequences of cumul-fence and hb links are empty.
+Note that this pb link is not included in hb as an instance of prop,
+because it does not start and end on the same CPU.
+
+Similarly, if r1 = 0 at the end then there is a pb link from P1's load
+to P0's.  This means that if both r1 and r2 were 0 there would be a
+cycle in pb, which is not possible since an instruction cannot execute
+before itself.  Thus, adding smp_mb() fences to the SB pattern
+prevents the r0 = 0, r1 = 0 outcome.
+
+In summary, the fact that the pb relation links events in the order
+they execute means that it cannot have cycles.  This requirement is
+the content of the LKMM's "propagation" axiom.
+
+
+RCU RELATIONS: link, gp-link, rscs-link, and rcu-path
+-----------------------------------------------------
+
+RCU (Read-Copy-Update) is a powerful synchronization mechanism.  It
+rests on two concepts: grace periods and read-side critical sections.
+
+A grace period is the span of time occupied by a call to
+synchronize_rcu().  A read-side critical section (or just critical
+section, for short) is a region of code delimited by rcu_read_lock()
+at the start and rcu_read_unlock() at the end.  Critical sections can
+be nested, although we won't make use of this fact.
+
+As far as memory models are concerned, RCU's main feature is its
+Grace-Period Guarantee, which states that a critical section can never
+span a full grace period.  In more detail, the Guarantee says:
+
+        If a critical section starts before a grace period then it
+        must end before the grace period does.  In addition, every
+        store that propagates to the critical section's CPU before the
+        end of the critical section must propagate to every CPU before
+        the end of the grace period.
+
+        If a critical section ends after a grace period ends then it
+        must start after the grace period does.  In addition, every
+        store that propagates to the grace period's CPU before the
+        start of the grace period must propagate to every CPU before
+        the start of the critical section.
+
+Here is a simple example of RCU in action:
+
+        int x, y;
+
+        P0()
+        {
+                rcu_read_lock();
+                WRITE_ONCE(x, 1);
+                WRITE_ONCE(y, 1);
+                rcu_read_unlock();
+        }
+
+        P1()
+        {
+                int r1, r2;
+
+                r1 = READ_ONCE(x);
+                synchronize_rcu();
+                r2 = READ_ONCE(y);
+        }
+
+The Grace Period Guarantee tells us that when this code runs, it will
+never end with r1 = 1 and r2 = 0.  The reasoning is as follows.  r1 = 1
+means that P0's store to x propagated to P1 before P1 called
+synchronize_rcu(), so P0's critical section must have started before
+P1's grace period.  On the other hand, r2 = 0 means that P0's store to
+y, which occurs before the end of the critical section, did not
+propagate to P1 before the end of the grace period, violating the
+Guarantee.
+
+In the kernel's implementations of RCU, the business about stores
+propagating to every CPU is realized by placing strong fences at
+suitable places in the RCU-related code.  Thus, if a critical section
+starts before a grace period does then the critical section's CPU will
+execute an smp_mb() fence after the end of the critical section and
+some time before the grace period's synchronize_rcu() call returns.
+And if a critical section ends after a grace period does then the
+synchronize_rcu() routine will execute an smp_mb() fence at its start
+and some time before the critical section's opening rcu_read_lock()
+executes.
+
+What exactly do we mean by saying that a critical section "starts
+before" or "ends after" a grace period?  Some aspects of the meaning
+are pretty obvious, as in the example above, but the details aren't
+entirely clear.  The LKMM formalizes this notion by means of a
+relation with the unfortunately generic name "link".  It is a very
+general relation; among other things, X ->link Z includes cases where
+X happens-before or is equal to some event Y which is equal to or
+comes before Z in the coherence order.  Taking Y = Z, this says that
+X ->rfe Z implies X ->link Z, and taking Y = X, it says that X ->fr Z
+and X ->co Z each imply X ->link Z.
+
+The formal definition of the link relation is more than a little
+obscure, and we won't give it here.  It is closely related to the pb
+relation, and the details don't matter unless you want to comb through
+a somewhat lengthy formal proof.  Pretty much all you need to know
+about link is the information in the preceding paragraph.
+
+The LKMM goes on to define the gp-link and rscs-link relations.  They
+bring grace periods and read-side critical sections into the picture,
+in the following way:
+
+        E ->gp-link F means there is a synchronize_rcu() fence event S
+        and an event X such that E ->po S, either S ->po X or S = X,
+        and X ->link F.  In other words, E and F are connected by a
+        grace period followed by an instance of link.
+
+        E ->rscs-link F means there is a critical section delimited by
+        an rcu_read_lock() fence L and an rcu_read_unlock() fence U,
+        and an event X such that E ->po U, either L ->po X or L = X,
+        and X ->link F.  Roughly speaking, this says that some event
+        in the same critical section as E is connected by link to F.
+
+If we think of the link relation as standing for an extended "before",
+then E ->gp-link F says that E executes before a grace period which
+ends before F executes.  (In fact it says more than this, because it
+includes cases where E executes before a grace period and some store
+propagates to F's CPU before F executes and doesn't propagate to some
+other CPU until after the grace period ends.)  Similarly,
+E ->rscs-link F says that E is part of (or before the start of) a
+critical section which starts before F executes.
+
+Putting this all together, the LKMM expresses the Grace Period
+Guarantee by requiring that there are no cycles consisting of gp-link
+and rscs-link connections in which the number of gp-link instances is
+>= the number of rscs-link instances.  It does this by defining the
+rcu-path relation to link events E and F whenever it is possible to
+pass from E to F by a sequence of gp-link and rscs-link connections
+with at least as many of the former as the latter.  The LKMM's "rcu"
+axiom then says that there are no events E such that E ->rcu-path E.
+
+Justifying this axiom takes some intellectual effort, but it is in
+fact a valid formalization of the Grace Period Guarantee.  We won't
+attempt to go through the detailed argument, but the following
+analysis gives a taste of what is involved.  Suppose we have a
+violation of the first part of the Guarantee: A critical section
+starts before a grace period, and some store propagates to the
+critical section's CPU before the end of the critical section but
+doesn't propagate to some other CPU until after the end of the grace
+period.
+
+Putting symbols to these ideas, let L and U be the rcu_read_lock() and
+rcu_read_unlock() fence events delimiting the critical section in
+question, and let S be the synchronize_rcu() fence event for the grace
+period.  Saying that the critical section starts before S means there
+are events E and F where E is po-after L (which marks the start of the
+critical section), E is "before" F in the sense of the link relation,
+and F is po-before the grace period S:
+
+        L ->po E ->link F ->po S.
+
+Let W be the store mentioned above, let Z come before the end of the
+critical section and witness that W propagates to the critical
+section's CPU by reading from W, and let Y on some arbitrary CPU be a
+witness that W has not propagated to that CPU, where Y happens after
+some event X which is po-after S.  Symbolically, this amounts to:
+
+        S ->po X ->hb* Y ->fr W ->rf Z ->po U.
+
+The fr link from Y to W indicates that W has not propagated to Y's CPU
+at the time that Y executes.  From this, it can be shown (see the
+discussion of the link relation earlier) that X and Z are connected by
+link, yielding:
+
+        S ->po X ->link Z ->po U.
+
+These formulas say that S is po-between F and X, hence F ->gp-link Z
+via X.  They also say that Z comes before the end of the critical
+section and E comes after its start, hence Z ->rscs-link F via E.  But
+now we have a forbidden cycle: F ->gp-link Z ->rscs-link F.  Thus the
+"rcu" axiom rules out this violation of the Grace Period Guarantee.
+
+For something a little more down-to-earth, let's see how the axiom
+works out in practice.  Consider the RCU code example from above, this
+time with statement labels added to the memory access instructions:
+
+        int x, y;
+
+        P0()
+        {
+                rcu_read_lock();
+                W: WRITE_ONCE(x, 1);
+                X: WRITE_ONCE(y, 1);
+                rcu_read_unlock();
+        }
+
+        P1()
+        {
+                int r1, r2;
+
+                Y: r1 = READ_ONCE(x);
+                synchronize_rcu();
+                Z: r2 = READ_ONCE(y);
+        }
+
+
+If r2 = 0 at the end then P0's store at X overwrites the value
+that P1's load at Z reads from, so we have Z ->fre X and thus
+Z ->link X.  In addition, there is a synchronize_rcu() between Y and
+Z, so therefore we have Y ->gp-link X.
+
+If r1 = 1 at the end then P1's load at Y reads from P0's store at W,
+so we have W ->link Y.  In addition, W and X are in the same critical
+section, so therefore we have X ->rscs-link Y.
+
+This gives us a cycle, Y ->gp-link X ->rscs-link Y, with one gp-link
+and one rscs-link, violating the "rcu" axiom.  Hence the outcome is
+not allowed by the LKMM, as we would expect.
+
+For contrast, let's see what can happen in a more complicated example:
+
+        int x, y, z;
+
+        P0()
+        {
+                int r0;
+
+                rcu_read_lock();
+                W: r0 = READ_ONCE(x);
+                X: WRITE_ONCE(y, 1);
+                rcu_read_unlock();
+        }
+
+        P1()
+        {
+                int r1;
+
+                Y: r1 = READ_ONCE(y);
+                synchronize_rcu();
+                Z: WRITE_ONCE(z, 1);
+        }
+
+        P2()
+        {
+                int r2;
+
+                rcu_read_lock();
+                U: r2 = READ_ONCE(z);
+                V: WRITE_ONCE(x, 1);
+                rcu_read_unlock();
+        }
+
+If r0 = r1 = r2 = 1 at the end, then similar reasoning to before shows
+that W ->rscs-link Y via X, Y ->gp-link U via Z, and U ->rscs-link W
+via V.  And just as before, this gives a cycle:
+
+        W ->rscs-link Y ->gp-link U ->rscs-link W.
+
+However, this cycle has fewer gp-link instances than rscs-link
+instances, and consequently the outcome is not forbidden by the LKMM.
+The following instruction timing diagram shows how it might actually
+occur:
+
+P0                      P1                      P2
+--------------------    --------------------    --------------------
+rcu_read_lock()
+X: WRITE_ONCE(y, 1)
+                        Y: r1 = READ_ONCE(y)
+                        synchronize_rcu() starts
+                        .                       rcu_read_lock()
+                        .                       V: WRITE_ONCE(x, 1)
+W: r0 = READ_ONCE(x)    .
+rcu_read_unlock()       .
+                        synchronize_rcu() ends
+                        Z: WRITE_ONCE(z, 1)
+                                                U: r2 = READ_ONCE(z)
+                                                rcu_read_unlock()
+
+This requires P0 and P2 to execute their loads and stores out of
+program order, but of course they are allowed to do so.  And as you
+can see, the Grace Period Guarantee is not violated: The critical
+section in P0 both starts before P1's grace period does and ends
+before it does, and the critical section in P2 both starts after P1's
+grace period does and ends after it does.
+
+
+ODDS AND ENDS
+-------------
+
+This section covers material that didn't quite fit anywhere in the
+earlier sections.
+
+The descriptions in this document don't always match the formal
+version of the LKMM exactly.  For example, the actual formal
+definition of the prop relation makes the initial coe or fre part
+optional, and it doesn't require the events linked by the relation to
+be on the same CPU.  These differences are very unimportant; indeed,
+instances where the coe/fre part of prop is missing are of no interest
+because all the other parts (fences and rfe) are already included in
+hb anyway, and where the formal model adds prop into hb, it includes
+an explicit requirement that the events being linked are on the same
+CPU.
+
+Another minor difference has to do with events that are both memory
+accesses and fences, such as those corresponding to smp_load_acquire()
+calls.  In the formal model, these events aren't actually both reads
+and fences; rather, they are read events with an annotation marking
+them as acquires.  (Or write events annotated as releases, in the case
+smp_store_release().)  The final effect is the same.
+
+Although we didn't mention it above, the instruction execution
+ordering provided by the smp_rmb() fence doesn't apply to read events
+that are part of a non-value-returning atomic update.  For instance,
+given:
+
+        atomic_inc(&x);
+        smp_rmb();
+        r1 = READ_ONCE(y);
+
+it is not guaranteed that the load from y will execute after the
+update to x.  This is because the ARMv8 architecture allows
+non-value-returning atomic operations effectively to be executed off
+the CPU.  Basically, the CPU tells the memory subsystem to increment
+x, and then the increment is carried out by the memory hardware with
+no further involvement from the CPU.  Since the CPU doesn't ever read
+the value of x, there is nothing for the smp_rmb() fence to act on.
+
+The LKMM defines a few extra synchronization operations in terms of
+things we have already covered.  In particular, rcu_dereference() is
+treated as READ_ONCE() and rcu_assign_pointer() is treated as
+smp_store_release() -- which is basically how the Linux kernel treats
+them.
+
+There are a few oddball fences which need special treatment:
+smp_mb__before_atomic(), smp_mb__after_atomic(), and
+smp_mb__after_spinlock().  The LKMM uses fence events with special
+annotations for them; they act as strong fences just like smp_mb()
+except for the sets of events that they order.  Instead of ordering
+all po-earlier events against all po-later events, as smp_mb() does,
+they behave as follows:
+
+        smp_mb__before_atomic() orders all po-earlier events against
+        po-later atomic updates and the events following them;
+
+        smp_mb__after_atomic() orders po-earlier atomic updates and
+        the events preceding them against all po-later events;
+
+        smp_mb_after_spinlock() orders po-earlier lock acquisition
+        events and the events preceding them against all po-later
+        events.
+
+The LKMM includes locking.  In fact, there is special code for locking
+in the formal model, added in order to make tools run faster.
+However, this special code is intended to be exactly equivalent to
+concepts we have already covered.  A spinlock_t variable is treated
+the same as an int, and spin_lock(&s) is treated the same as:
+
+        while (cmpxchg_acquire(&s, 0, 1) != 0)
+                cpu_relax();
+
+which waits until s is equal to 0 and then atomically sets it to 1,
+and where the read part of the atomic update is also an acquire fence.
+An alternate way to express the same thing would be:
+
+        r = xchg_acquire(&s, 1);
+
+along with a requirement that at the end, r = 0.  spin_unlock(&s) is
+treated the same as:
+
+        smp_store_release(&s, 0);
+
+Interestingly, RCU and locking each introduce the possibility of
+deadlock.  When faced with code sequences such as:
+
+        spin_lock(&s);
+        spin_lock(&s);
+        spin_unlock(&s);
+        spin_unlock(&s);
+
+or:
+
+        rcu_read_lock();
+        synchronize_rcu();
+        rcu_read_unlock();
+
+what does the LKMM have to say?  Answer: It says there are no allowed
+executions at all, which makes sense.  But this can also lead to
+misleading results, because if a piece of code has multiple possible
+executions, some of which deadlock, the model will report only on the
+non-deadlocking executions.  For example:
+
+        int x, y;
+
+        P0()
+        {
+                int r0;
+
+                WRITE_ONCE(x, 1);
+                r0 = READ_ONCE(y);
+        }
+
+        P1()
+        {
+                rcu_read_lock();
+                if (READ_ONCE(x) > 0) {
+                        WRITE_ONCE(y, 36);
+                        synchronize_rcu();
+                }
+                rcu_read_unlock();
+        }
+
+Is it possible to end up with r0 = 36 at the end?  The LKMM will tell
+you it is not, but the model won't mention that this is because P1
+will self-deadlock in the executions where it stores 36 in y.
diff --git a/tools/memory-model/Documentation/recipes.txt b/tools/memory-model/Documentation/recipes.txt
new file mode 100644
index 000000000000..ee4309a87fc4
--- /dev/null
+++ b/tools/memory-model/Documentation/recipes.txt
@@ -0,0 +1,570 @@
+This document provides "recipes", that is, litmus tests for commonly
+occurring situations, as well as a few that illustrate subtly broken but
+attractive nuisances.  Many of these recipes include example code from
+v4.13 of the Linux kernel.
+
+The first section covers simple special cases, the second section
+takes off the training wheels to cover more involved examples,
+and the third section provides a few rules of thumb.
+
+
+Simple special cases
+====================
+
+This section presents two simple special cases, the first being where
+there is only one CPU or only one memory location is accessed, and the
+second being use of that old concurrency workhorse, locking.
+
+
+Single CPU or single memory location
+------------------------------------
+
+If there is only one CPU on the one hand or only one variable
+on the other, the code will execute in order.  There are (as
+usual) some things to be careful of:
+
+1.      Some aspects of the C language are unordered.  For example,
+        in the expression "f(x) + g(y)", the order in which f and g are
+        called is not defined; the object code is allowed to use either
+        order or even to interleave the computations.
+
+2.      Compilers are permitted to use the "as-if" rule.  That is, a
+        compiler can emit whatever code it likes for normal accesses,
+        as long as the results of a single-threaded execution appear
+        just as if the compiler had followed all the relevant rules.
+        To see this, compile with a high level of optimization and run
+        the debugger on the resulting binary.
+
+3.      If there is only one variable but multiple CPUs, that variable
+        must be properly aligned and all accesses to that variable must
+        be full sized.  Variables that straddle cachelines or pages void
+        your full-ordering warranty, as do undersized accesses that load
+        from or store to only part of the variable.
+
+4.      If there are multiple CPUs, accesses to shared variables should
+        use READ_ONCE() and WRITE_ONCE() or stronger to prevent load/store
+        tearing, load/store fusing, and invented loads and stores.
+        There are exceptions to this rule, including:
+
+        i.      When there is no possibility of a given shared variable
+                being updated by some other CPU, for example, while
+                holding the update-side lock, reads from that variable
+                need not use READ_ONCE().
+
+        ii.     When there is no possibility of a given shared variable
+                being either read or updated by other CPUs, for example,
+                when running during early boot, reads from that variable
+                need not use READ_ONCE() and writes to that variable
+                need not use WRITE_ONCE().
+
+
+Locking
+-------
+
+Locking is well-known and straightforward, at least if you don't think
+about it too hard.  And the basic rule is indeed quite simple: Any CPU that
+has acquired a given lock sees any changes previously seen or made by any
+CPU before it released that same lock.  Note that this statement is a bit
+stronger than "Any CPU holding a given lock sees all changes made by any
+CPU during the time that CPU was holding this same lock".  For example,
+consider the following pair of code fragments:
+
+        /* See MP+polocks.litmus. */
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                spin_lock(&mylock);
+                WRITE_ONCE(y, 1);
+                spin_unlock(&mylock);
+        }
+
+        void CPU1(void)
+        {
+                spin_lock(&mylock);
+                r0 = READ_ONCE(y);
+                spin_unlock(&mylock);
+                r1 = READ_ONCE(x);
+        }
+
+The basic rule guarantees that if CPU0() acquires mylock before CPU1(),
+then both r0 and r1 must be set to the value 1.  This also has the
+consequence that if the final value of r0 is equal to 1, then the final
+value of r1 must also be equal to 1.  In contrast, the weaker rule would
+say nothing about the final value of r1.
+
+The converse to the basic rule also holds, as illustrated by the
+following litmus test:
+
+        /* See MP+porevlocks.litmus. */
+        void CPU0(void)
+        {
+                r0 = READ_ONCE(y);
+                spin_lock(&mylock);
+                r1 = READ_ONCE(x);
+                spin_unlock(&mylock);
+        }
+
+        void CPU1(void)
+        {
+                spin_lock(&mylock);
+                WRITE_ONCE(x, 1);
+                spin_unlock(&mylock);
+                WRITE_ONCE(y, 1);
+        }
+
+This converse to the basic rule guarantees that if CPU0() acquires
+mylock before CPU1(), then both r0 and r1 must be set to the value 0.
+This also has the consequence that if the final value of r1 is equal
+to 0, then the final value of r0 must also be equal to 0.  In contrast,
+the weaker rule would say nothing about the final value of r0.
+
+These examples show only a single pair of CPUs, but the effects of the
+locking basic rule extend across multiple acquisitions of a given lock
+across multiple CPUs.
+
+However, it is not necessarily the case that accesses ordered by
+locking will be seen as ordered by CPUs not holding that lock.
+Consider this example:
+
+        /* See Z6.0+pooncelock+pooncelock+pombonce.litmus. */
+        void CPU0(void)
+        {
+                spin_lock(&mylock);
+                WRITE_ONCE(x, 1);
+                WRITE_ONCE(y, 1);
+                spin_unlock(&mylock);
+        }
+
+        void CPU1(void)
+        {
+                spin_lock(&mylock);
+                r0 = READ_ONCE(y);
+                WRITE_ONCE(z, 1);
+                spin_unlock(&mylock);
+        }
+
+        void CPU2(void)
+        {
+                WRITE_ONCE(z, 2);
+                smp_mb();
+                r1 = READ_ONCE(x);
+        }
+
+Counter-intuitive though it might be, it is quite possible to have
+the final value of r0 be 1, the final value of z be 2, and the final
+value of r1 be 0.  The reason for this surprising outcome is that
+CPU2() never acquired the lock, and thus did not benefit from the
+lock's ordering properties.
+
+Ordering can be extended to CPUs not holding the lock by careful use
+of smp_mb__after_spinlock():
+
+        /* See Z6.0+pooncelock+poonceLock+pombonce.litmus. */
+        void CPU0(void)
+        {
+                spin_lock(&mylock);
+                WRITE_ONCE(x, 1);
+                WRITE_ONCE(y, 1);
+                spin_unlock(&mylock);
+        }
+
+        void CPU1(void)
+        {
+                spin_lock(&mylock);
+                smp_mb__after_spinlock();
+                r0 = READ_ONCE(y);
+                WRITE_ONCE(z, 1);
+                spin_unlock(&mylock);
+        }
+
+        void CPU2(void)
+        {
+                WRITE_ONCE(z, 2);
+                smp_mb();
+                r1 = READ_ONCE(x);
+        }
+
+This addition of smp_mb__after_spinlock() strengthens the lock acquisition
+sufficiently to rule out the counter-intuitive outcome.
+
+
+Taking off the training wheels
+==============================
+
+This section looks at more complex examples, including message passing,
+load buffering, release-acquire chains, store buffering.
+Many classes of litmus tests have abbreviated names, which may be found
+here: https://www.cl.cam.ac.uk/~pes20/ppc-supplemental/test6.pdf
+
+
+Message passing (MP)
+--------------------
+
+The MP pattern has one CPU execute a pair of stores to a pair of variables
+and another CPU execute a pair of loads from this same pair of variables,
+but in the opposite order.  The goal is to avoid the counter-intuitive
+outcome in which the first load sees the value written by the second store
+but the second load does not see the value written by the first store.
+In the absence of any ordering, this goal may not be met, as can be seen
+in the MP+poonceonces.litmus litmus test.  This section therefore looks at
+a number of ways of meeting this goal.
+
+
+Release and acquire
+~~~~~~~~~~~~~~~~~~~
+
+Use of smp_store_release() and smp_load_acquire() is one way to force
+the desired MP ordering.  The general approach is shown below:
+
+        /* See MP+pooncerelease+poacquireonce.litmus. */
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                smp_store_release(&y, 1);
+        }
+
+        void CPU1(void)
+        {
+                r0 = smp_load_acquire(&y);
+                r1 = READ_ONCE(x);
+        }
+
+The smp_store_release() macro orders any prior accesses against the
+store, while the smp_load_acquire macro orders the load against any
+subsequent accesses.  Therefore, if the final value of r0 is the value 1,
+the final value of r1 must also be the value 1.
+
+The init_stack_slab() function in lib/stackdepot.c uses release-acquire
+in this way to safely initialize of a slab of the stack.  Working out
+the mutual-exclusion design is left as an exercise for the reader.
+
+
+Assign and dereference
+~~~~~~~~~~~~~~~~~~~~~~
+
+Use of rcu_assign_pointer() and rcu_dereference() is quite similar to the
+use of smp_store_release() and smp_load_acquire(), except that both
+rcu_assign_pointer() and rcu_dereference() operate on RCU-protected
+pointers.  The general approach is shown below:
+
+        /* See MP+onceassign+derefonce.litmus. */
+        int z;
+        int *y = &z;
+        int x;
+
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                rcu_assign_pointer(y, &x);
+        }
+
+        void CPU1(void)
+        {
+                rcu_read_lock();
+                r0 = rcu_dereference(y);
+                r1 = READ_ONCE(*r0);
+                rcu_read_unlock();
+        }
+
+In this example, if the final value of r0 is &x then the final value of
+r1 must be 1.
+
+The rcu_assign_pointer() macro has the same ordering properties as does
+smp_store_release(), but the rcu_dereference() macro orders the load only
+against later accesses that depend on the value loaded.  A dependency
+is present if the value loaded determines the address of a later access
+(address dependency, as shown above), the value written by a later store
+(data dependency), or whether or not a later store is executed in the
+first place (control dependency).  Note that the term "data dependency"
+is sometimes casually used to cover both address and data dependencies.
+
+In lib/prime_numbers.c, the expand_to_next_prime() function invokes
+rcu_assign_pointer(), and the next_prime_number() function invokes
+rcu_dereference().  This combination mediates access to a bit vector
+that is expanded as additional primes are needed.
+
+
+Write and read memory barriers
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+It is usually better to use smp_store_release() instead of smp_wmb()
+and to use smp_load_acquire() instead of smp_rmb().  However, the older
+smp_wmb() and smp_rmb() APIs are still heavily used, so it is important
+to understand their use cases.  The general approach is shown below:
+
+        /* See MP+wmbonceonce+rmbonceonce.litmus. */
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                smp_wmb();
+                WRITE_ONCE(y, 1);
+        }
+
+        void CPU1(void)
+        {
+                r0 = READ_ONCE(y);
+                smp_rmb();
+                r1 = READ_ONCE(x);
+        }
+
+The smp_wmb() macro orders prior stores against later stores, and the
+smp_rmb() macro orders prior loads against later loads.  Therefore, if
+the final value of r0 is 1, the final value of r1 must also be 1.
+
+The the xlog_state_switch_iclogs() function in fs/xfs/xfs_log.c contains
+the following write-side code fragment:
+
+        log->l_curr_block -= log->l_logBBsize;
+        ASSERT(log->l_curr_block >= 0);
+        smp_wmb();
+        log->l_curr_cycle++;
+
+And the xlog_valid_lsn() function in fs/xfs/xfs_log_priv.h contains
+the corresponding read-side code fragment:
+
+        cur_cycle = ACCESS_ONCE(log->l_curr_cycle);
+        smp_rmb();
+        cur_block = ACCESS_ONCE(log->l_curr_block);
+
+Alternatively, consider the following comment in function
+perf_output_put_handle() in kernel/events/ring_buffer.c:
+
+         *   kernel                             user
+         *
+         *   if (LOAD ->data_tail) {            LOAD ->data_head
+         *                      (A)             smp_rmb()       (C)
+         *      STORE $data                     LOAD $data
+         *      smp_wmb()       (B)             smp_mb()        (D)
+         *      STORE ->data_head               STORE ->data_tail
+         *   }
+
+The B/C pairing is an example of the MP pattern using smp_wmb() on the
+write side and smp_rmb() on the read side.
+
+Of course, given that smp_mb() is strictly stronger than either smp_wmb()
+or smp_rmb(), any code fragment that would work with smp_rmb() and
+smp_wmb() would also work with smp_mb() replacing either or both of the
+weaker barriers.
+
+
+Load buffering (LB)
+-------------------
+
+The LB pattern has one CPU load from one variable and then store to a
+second, while another CPU loads from the second variable and then stores
+to the first.  The goal is to avoid the counter-intuitive situation where
+each load reads the value written by the other CPU's store.  In the
+absence of any ordering it is quite possible that this may happen, as
+can be seen in the LB+poonceonces.litmus litmus test.
+
+One way of avoiding the counter-intuitive outcome is through the use of a
+control dependency paired with a full memory barrier:
+
+        /* See LB+ctrlonceonce+mbonceonce.litmus. */
+        void CPU0(void)
+        {
+                r0 = READ_ONCE(x);
+                if (r0)
+                        WRITE_ONCE(y, 1);
+        }
+
+        void CPU1(void)
+        {
+                r1 = READ_ONCE(y);
+                smp_mb();
+                WRITE_ONCE(x, 1);
+        }
+
+This pairing of a control dependency in CPU0() with a full memory
+barrier in CPU1() prevents r0 and r1 from both ending up equal to 1.
+
+The A/D pairing from the ring-buffer use case shown earlier also
+illustrates LB.  Here is a repeat of the comment in
+perf_output_put_handle() in kernel/events/ring_buffer.c, showing a
+control dependency on the kernel side and a full memory barrier on
+the user side:
+
+         *   kernel                             user
+         *
+         *   if (LOAD ->data_tail) {            LOAD ->data_head
+         *                      (A)             smp_rmb()       (C)
+         *      STORE $data                     LOAD $data
+         *      smp_wmb()       (B)             smp_mb()        (D)
+         *      STORE ->data_head               STORE ->data_tail
+         *   }
+         *
+         * Where A pairs with D, and B pairs with C.
+
+The kernel's control dependency between the load from ->data_tail
+and the store to data combined with the user's full memory barrier
+between the load from data and the store to ->data_tail prevents
+the counter-intuitive outcome where the kernel overwrites the data
+before the user gets done loading it.
+
+
+Release-acquire chains
+----------------------
+
+Release-acquire chains are a low-overhead, flexible, and easy-to-use
+method of maintaining order.  However, they do have some limitations that
+need to be fully understood.  Here is an example that maintains order:
+
+        /* See ISA2+pooncerelease+poacquirerelease+poacquireonce.litmus. */
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                smp_store_release(&y, 1);
+        }
+
+        void CPU1(void)
+        {
+                r0 = smp_load_acquire(y);
+                smp_store_release(&z, 1);
+        }
+
+        void CPU2(void)
+        {
+                r1 = smp_load_acquire(z);
+                r2 = READ_ONCE(x);
+        }
+
+In this case, if r0 and r1 both have final values of 1, then r2 must
+also have a final value of 1.
+
+The ordering in this example is stronger than it needs to be.  For
+example, ordering would still be preserved if CPU1()'s smp_load_acquire()
+invocation was replaced with READ_ONCE().
+
+It is tempting to assume that CPU0()'s store to x is globally ordered
+before CPU1()'s store to z, but this is not the case:
+
+        /* See Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus. */
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                smp_store_release(&y, 1);
+        }
+
+        void CPU1(void)
+        {
+                r0 = smp_load_acquire(y);
+                smp_store_release(&z, 1);
+        }
+
+        void CPU2(void)
+        {
+                WRITE_ONCE(z, 2);
+                smp_mb();
+                r1 = READ_ONCE(x);
+        }
+
+One might hope that if the final value of r0 is 1 and the final value
+of z is 2, then the final value of r1 must also be 1, but it really is
+possible for r1 to have the final value of 0.  The reason, of course,
+is that in this version, CPU2() is not part of the release-acquire chain.
+This situation is accounted for in the rules of thumb below.
+
+Despite this limitation, release-acquire chains are low-overhead as
+well as simple and powerful, at least as memory-ordering mechanisms go.
+
+
+Store buffering
+---------------
+
+Store buffering can be thought of as upside-down load buffering, so
+that one CPU first stores to one variable and then loads from a second,
+while another CPU stores to the second variable and then loads from the
+first.  Preserving order requires nothing less than full barriers:
+
+        /* See SB+mbonceonces.litmus. */
+        void CPU0(void)
+        {
+                WRITE_ONCE(x, 1);
+                smp_mb();
+                r0 = READ_ONCE(y);
+        }
+
+        void CPU1(void)
+        {
+                WRITE_ONCE(y, 1);
+                smp_mb();
+                r1 = READ_ONCE(x);
+        }
+
+Omitting either smp_mb() will allow both r0 and r1 to have final
+values of 0, but providing both full barriers as shown above prevents
+this counter-intuitive outcome.
+
+This pattern most famously appears as part of Dekker's locking
+algorithm, but it has a much more practical use within the Linux kernel
+of ordering wakeups.  The following comment taken from waitqueue_active()
+in include/linux/wait.h shows the canonical pattern:
+
+ *      CPU0 - waker                    CPU1 - waiter
+ *
+ *                                      for (;;) {
+ *      @cond = true;                     prepare_to_wait(&wq_head, &wait, state);
+ *      smp_mb();                         // smp_mb() from set_current_state()
+ *      if (waitqueue_active(wq_head))         if (@cond)
+ *        wake_up(wq_head);                      break;
+ *                                        schedule();
+ *                                      }
+ *                                      finish_wait(&wq_head, &wait);
+
+On CPU0, the store is to @cond and the load is in waitqueue_active().
+On CPU1, prepare_to_wait() contains both a store to wq_head and a call
+to set_current_state(), which contains an smp_mb() barrier; the load is
+"if (@cond)".  The full barriers prevent the undesirable outcome where
+CPU1 puts the waiting task to sleep and CPU0 fails to wake it up.
+
+Note that use of locking can greatly simplify this pattern.
+
+
+Rules of thumb
+==============
+
+There might seem to be no pattern governing what ordering primitives are
+needed in which situations, but this is not the case.  There is a pattern
+based on the relation between the accesses linking successive CPUs in a
+given litmus test.  There are three types of linkage:
+
+1.      Write-to-read, where the next CPU reads the value that the
+        previous CPU wrote.  The LB litmus-test patterns contain only
+        this type of relation.  In formal memory-modeling texts, this
+        relation is called "reads-from" and is usually abbreviated "rf".
+
+2.      Read-to-write, where the next CPU overwrites the value that the
+        previous CPU read.  The SB litmus test contains only this type
+        of relation.  In formal memory-modeling texts, this relation is
+        often called "from-reads" and is sometimes abbreviated "fr".
+
+3.      Write-to-write, where the next CPU overwrites the value written
+        by the previous CPU.  The Z6.0 litmus test pattern contains a
+        write-to-write relation between the last access of CPU1() and
+        the first access of CPU2().  In formal memory-modeling texts,
+        this relation is often called "coherence order" and is sometimes
+        abbreviated "co".  In the C++ standard, it is instead called
+        "modification order" and often abbreviated "mo".
+
+The strength of memory ordering required for a given litmus test to
+avoid a counter-intuitive outcome depends on the types of relations
+linking the memory accesses for the outcome in question:
+
+o       If all links are write-to-read links, then the weakest
+        possible ordering within each CPU suffices.  For example, in
+        the LB litmus test, a control dependency was enough to do the
+        job.
+
+o       If all but one of the links are write-to-read links, then a
+        release-acquire chain suffices.  Both the MP and the ISA2
+        litmus tests illustrate this case.
+
+o       If more than one of the links are something other than
+        write-to-read links, then a full memory barrier is required
+        between each successive pair of non-write-to-read links.  This
+        case is illustrated by the Z6.0 litmus tests, both in the
+        locking and in the release-acquire sections.
+
+However, if you find yourself having to stretch these rules of thumb
+to fit your situation, you should consider creating a litmus test and
+running it on the model.
diff --git a/tools/memory-model/Documentation/references.txt b/tools/memory-model/Documentation/references.txt
new file mode 100644
index 000000000000..ba2e34c2ec3f
--- /dev/null
+++ b/tools/memory-model/Documentation/references.txt
@@ -0,0 +1,107 @@
+This document provides background reading for memory models and related
+tools.  These documents are aimed at kernel hackers who are interested
+in memory models.
+
+
+Hardware manuals and models
+===========================
+
+o       SPARC International Inc. (Ed.). 1994. "The SPARC Architecture
+        Reference Manual Version 9". SPARC International Inc.
+
+o       Compaq Computer Corporation (Ed.). 2002. "Alpha Architecture
+        Reference Manual".  Compaq Computer Corporation.
+
+o       Intel Corporation (Ed.). 2002. "A Formal Specification of Intel
+        Itanium Processor Family Memory Ordering". Intel Corporation.
+
+o       Intel Corporation (Ed.). 2002. "Intel 64 and IA-32 Architectures
+        Software Developer’s Manual". Intel Corporation.
+
+o       Peter Sewell, Susmit Sarkar, Scott Owens, Francesco Zappa Nardelli,
+        and Magnus O. Myreen. 2010. "x86-TSO: A Rigorous and Usable
+        Programmer's Model for x86 Multiprocessors". Commun. ACM 53, 7
+        (July, 2010), 89-97. http://doi.acm.org/10.1145/1785414.1785443
+
+o       IBM Corporation (Ed.). 2009. "Power ISA Version 2.06". IBM
+        Corporation.
+
+o       ARM Ltd. (Ed.). 2009. "ARM Barrier Litmus Tests and Cookbook".
+        ARM Ltd.
+
+o       Susmit Sarkar, Peter Sewell, Jade Alglave, Luc Maranget, and
+        Derek Williams.  2011. "Understanding POWER Multiprocessors". In
+        Proceedings of the 32Nd ACM SIGPLAN Conference on Programming
+        Language Design and Implementation (PLDI ’11). ACM, New York,
+        NY, USA, 175–186.
+
+o       Susmit Sarkar, Kayvan Memarian, Scott Owens, Mark Batty,
+        Peter Sewell, Luc Maranget, Jade Alglave, and Derek Williams.
+        2012. "Synchronising C/C++ and POWER". In Proceedings of the 33rd
+        ACM SIGPLAN Conference on Programming Language Design and
+        Implementation (PLDI '12). ACM, New York, NY, USA, 311-322.
+
+o       ARM Ltd. (Ed.). 2014. "ARM Architecture Reference Manual (ARMv8,
+        for ARMv8-A architecture profile)". ARM Ltd.
+
+o       Imagination Technologies, LTD. 2015. "MIPS(R) Architecture
+        For Programmers, Volume II-A: The MIPS64(R) Instruction,
+        Set Reference Manual". Imagination Technologies,
+        LTD. https://imgtec.com/?do-download=4302.
+
+o       Shaked Flur, Kathryn E. Gray, Christopher Pulte, Susmit
+        Sarkar, Ali Sezgin, Luc Maranget, Will Deacon, and Peter
+        Sewell. 2016. "Modelling the ARMv8 Architecture, Operationally:
+        Concurrency and ISA". In Proceedings of the 43rd Annual ACM
+        SIGPLAN-SIGACT Symposium on Principles of Programming Languages
+        (POPL ’16). ACM, New York, NY, USA, 608–621.
+
+o       Shaked Flur, Susmit Sarkar, Christopher Pulte, Kyndylan Nienhuis,
+        Luc Maranget, Kathryn E. Gray, Ali Sezgin, Mark Batty, and Peter
+        Sewell. 2017. "Mixed-size Concurrency: ARM, POWER, C/C++11,
+        and SC". In Proceedings of the 44th ACM SIGPLAN Symposium on
+        Principles of Programming Languages (POPL 2017). ACM, New York,
+        NY, USA, 429–442.
+
+
+Linux-kernel memory model
+=========================
+
+o       Andrea Parri, Alan Stern, Luc Maranget, Paul E. McKenney,
+        and Jade Alglave.  2017. "A formal model of
+        Linux-kernel memory ordering - companion webpage".
+        http://moscova.inria.fr/∼maranget/cats7/linux/. (2017). [Online;
+        accessed 30-January-2017].
+
+o       Jade Alglave, Luc Maranget, Paul E. McKenney, Andrea Parri, and
+        Alan Stern.  2017.  "A formal kernel memory-ordering model (part 1)"
+        Linux Weekly News.  https://lwn.net/Articles/718628/
+
+o       Jade Alglave, Luc Maranget, Paul E. McKenney, Andrea Parri, and
+        Alan Stern.  2017.  "A formal kernel memory-ordering model (part 2)"
+        Linux Weekly News.  https://lwn.net/Articles/720550/
+
+
+Memory-model tooling
+====================
+
+o       Daniel Jackson. 2002. "Alloy: A Lightweight Object Modelling
+        Notation". ACM Trans. Softw. Eng. Methodol. 11, 2 (April 2002),
+        256–290. http://doi.acm.org/10.1145/505145.505149
+
+o       Jade Alglave, Luc Maranget, and Michael Tautschnig. 2014. "Herding
+        Cats: Modelling, Simulation, Testing, and Data Mining for Weak
+        Memory". ACM Trans. Program. Lang. Syst. 36, 2, Article 7 (July
+        2014), 7:1–7:74 pages.
+
+o       Jade Alglave, Patrick Cousot, and Luc Maranget. 2016. "Syntax and
+        semantics of the weak consistency model specification language
+        cat". CoRR abs/1608.07531 (2016). http://arxiv.org/abs/1608.07531
+
+
+Memory-model comparisons
+========================
+
+o       Paul E. McKenney, Ulrich Weigand, Andrea Parri, and Boqun
+        Feng. 2016. "Linux-Kernel Memory Model". (6 June 2016).
+        http://open-std.org/JTC1/SC22/WG21/docs/papers/2016/p0124r2.html.
diff --git a/tools/memory-model/README b/tools/memory-model/README
new file mode 100644
index 000000000000..0b3a5f3c9ccd
--- /dev/null
+++ b/tools/memory-model/README
@@ -0,0 +1,206 @@
+                =====================================
+                LINUX KERNEL MEMORY CONSISTENCY MODEL
+                =====================================
+
+============
+INTRODUCTION
+============
+
+This directory contains the memory consistency model (memory model, for
+short) of the Linux kernel, written in the "cat" language and executable
+by the externally provided "herd7" simulator, which exhaustively explores
+the state space of small litmus tests.
+
+In addition, the "klitmus7" tool (also externally provided) may be used
+to convert a litmus test to a Linux kernel module, which in turn allows
+that litmus test to be exercised within the Linux kernel.
+
+
+============
+REQUIREMENTS
+============
+
+Version 7.48 of the "herd7" and "klitmus7" tools must be downloaded
+separately:
+
+  https://github.com/herd/herdtools7
+
+See "herdtools7/INSTALL.md" for installation instructions.
+
+
+==================
+BASIC USAGE: HERD7
+==================
+
+The memory model is used, in conjunction with "herd7", to exhaustively
+explore the state space of small litmus tests.
+
+For example, to run SB+mbonceonces.litmus against the memory model:
+
+  $ herd7 -conf linux-kernel.cfg litmus-tests/SB+mbonceonces.litmus
+
+Here is the corresponding output:
+
+  Test SB+mbonceonces Allowed
+  States 3
+  0:r0=0; 1:r0=1;
+  0:r0=1; 1:r0=0;
+  0:r0=1; 1:r0=1;
+  No
+  Witnesses
+  Positive: 0 Negative: 3
+  Condition exists (0:r0=0 /\ 1:r0=0)
+  Observation SB+mbonceonces Never 0 3
+  Time SB+mbonceonces 0.01
+  Hash=d66d99523e2cac6b06e66f4c995ebb48
+
+The "Positive: 0 Negative: 3" and the "Never 0 3" each indicate that
+this litmus test's "exists" clause can not be satisfied.
+
+See "herd7 -help" or "herdtools7/doc/" for more information.
+
+
+=====================
+BASIC USAGE: KLITMUS7
+=====================
+
+The "klitmus7" tool converts a litmus test into a Linux kernel module,
+which may then be loaded and run.
+
+For example, to run SB+mbonceonces.litmus against hardware:
+
+  $ mkdir mymodules
+  $ klitmus7 -o mymodules litmus-tests/SB+mbonceonces.litmus
+  $ cd mymodules ; make
+  $ sudo sh run.sh
+
+The corresponding output includes:
+
+  Test SB+mbonceonces Allowed
+  Histogram (3 states)
+  644580  :>0:r0=1; 1:r0=0;
+  644328  :>0:r0=0; 1:r0=1;
+  711092  :>0:r0=1; 1:r0=1;
+  No
+  Witnesses
+  Positive: 0, Negative: 2000000
+  Condition exists (0:r0=0 /\ 1:r0=0) is NOT validated
+  Hash=d66d99523e2cac6b06e66f4c995ebb48
+  Observation SB+mbonceonces Never 0 2000000
+  Time SB+mbonceonces 0.16
+
+The "Positive: 0 Negative: 2000000" and the "Never 0 2000000" indicate
+that during two million trials, the state specified in this litmus
+test's "exists" clause was not reached.
+
+And, as with "herd7", please see "klitmus7 -help" or "herdtools7/doc/"
+for more information.
+
+
+====================
+DESCRIPTION OF FILES
+====================
+
+Documentation/cheatsheet.txt
+        Quick-reference guide to the Linux-kernel memory model.
+
+Documentation/explanation.txt
+        Describes the memory model in detail.
+
+Documentation/recipes.txt
+        Lists common memory-ordering patterns.
+
+Documentation/references.txt
+        Provides background reading.
+
+linux-kernel.bell
+        Categorizes the relevant instructions, including memory
+        references, memory barriers, atomic read-modify-write operations,
+        lock acquisition/release, and RCU operations.
+
+        More formally, this file (1) lists the subtypes of the various
+        event types used by the memory model and (2) performs RCU
+        read-side critical section nesting analysis.
+
+linux-kernel.cat
+        Specifies what reorderings are forbidden by memory references,
+        memory barriers, atomic read-modify-write operations, and RCU.
+
+        More formally, this file specifies what executions are forbidden
+        by the memory model.  Allowed executions are those which
+        satisfy the model's "coherence", "atomic", "happens-before",
+        "propagation", and "rcu" axioms, which are defined in the file.
+
+linux-kernel.cfg
+        Convenience file that gathers the common-case herd7 command-line
+        arguments.
+
+linux-kernel.def
+        Maps from C-like syntax to herd7's internal litmus-test
+        instruction-set architecture.
+
+litmus-tests
+        Directory containing a few representative litmus tests, which
+        are listed in litmus-tests/README.  A great deal more litmus
+        tests are available at https://github.com/paulmckrcu/litmus.
+
+lock.cat
+        Provides a front-end analysis of lock acquisition and release,
+        for example, associating a lock acquisition with the preceding
+        and following releases and checking for self-deadlock.
+
+        More formally, this file defines a performance-enhanced scheme
+        for generation of the possible reads-from and coherence order
+        relations on the locking primitives.
+
+README
+        This file.
+
+
+===========
+LIMITATIONS
+===========
+
+The Linux-kernel memory model has the following limitations:
+
+1.      Compiler optimizations are not modeled.  Of course, the use
+        of READ_ONCE() and WRITE_ONCE() limits the compiler's ability
+        to optimize, but there is Linux-kernel code that uses bare C
+        memory accesses.  Handling this code is on the to-do list.
+        For more information, see Documentation/explanation.txt (in
+        particular, the "THE PROGRAM ORDER RELATION: po AND po-loc"
+        and "A WARNING" sections).
+
+2.      Multiple access sizes for a single variable are not supported,
+        and neither are misaligned or partially overlapping accesses.
+
+3.      Exceptions and interrupts are not modeled.  In some cases,
+        this limitation can be overcome by modeling the interrupt or
+        exception with an additional process.
+
+4.      I/O such as MMIO or DMA is not supported.
+
+5.      Self-modifying code (such as that found in the kernel's
+        alternatives mechanism, function tracer, Berkeley Packet Filter
+        JIT compiler, and module loader) is not supported.
+
+6.      Complete modeling of all variants of atomic read-modify-write
+        operations, locking primitives, and RCU is not provided.
+        For example, call_rcu() and rcu_barrier() are not supported.
+        However, a substantial amount of support is provided for these
+        operations, as shown in the linux-kernel.def file.
+
+The "herd7" tool has some additional limitations of its own, apart from
+the memory model:
+
+1.      Non-trivial data structures such as arrays or structures are
+        not supported.  However, pointers are supported, allowing trivial
+        linked lists to be constructed.
+
+2.      Dynamic memory allocation is not supported, although this can
+        be worked around in some cases by supplying multiple statically
+        allocated variables.
+
+Some of these limitations may be overcome in the future, but others are
+more likely to be addressed by incorporating the Linux-kernel memory model
+into other tools.
diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell
new file mode 100644
index 000000000000..432c7cf71b23
--- /dev/null
+++ b/tools/memory-model/linux-kernel.bell
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0+
+(*
+ * Copyright (C) 2015 Jade Alglave <j.alglave@ucl.ac.uk>,
+ * Copyright (C) 2016 Luc Maranget <luc.maranget@inria.fr> for Inria
+ * Copyright (C) 2017 Alan Stern <stern@rowland.harvard.edu>,
+ *                    Andrea Parri <parri.andrea@gmail.com>
+ *
+ * An earlier version of this file appears in the companion webpage for
+ * "Frightening small children and disconcerting grown-ups: Concurrency
+ * in the Linux kernel" by Alglave, Maranget, McKenney, Parri, and Stern,
+ * which is to appear in ASPLOS 2018.
+ *)
+
+"Linux-kernel memory consistency model"
+
+enum Accesses = 'once (*READ_ONCE,WRITE_ONCE,ACCESS_ONCE*) ||
+                'release (*smp_store_release*) ||
+                'acquire (*smp_load_acquire*) ||
+                'noreturn (* R of non-return RMW *)
+instructions R[{'once,'acquire,'noreturn}]
+instructions W[{'once,'release}]
+instructions RMW[{'once,'acquire,'release}]
+
+enum Barriers = 'wmb (*smp_wmb*) ||
+                'rmb (*smp_rmb*) ||
+                'mb (*smp_mb*) ||
+                'rcu-lock (*rcu_read_lock*)  ||
+                'rcu-unlock (*rcu_read_unlock*) ||
+                'sync-rcu (*synchronize_rcu*) ||
+                'before-atomic (*smp_mb__before_atomic*) ||
+                'after-atomic (*smp_mb__after_atomic*) ||
+                'after-spinlock (*smp_mb__after_spinlock*)
+instructions F[Barriers]
+
+(* Compute matching pairs of nested Rcu-lock and Rcu-unlock *)
+let matched = let rec
+            unmatched-locks = Rcu-lock \ domain(matched)
+        and unmatched-unlocks = Rcu-unlock \ range(matched)
+        and unmatched = unmatched-locks | unmatched-unlocks
+        and unmatched-po = [unmatched] ; po ; [unmatched]
+        and unmatched-locks-to-unlocks =
+                [unmatched-locks] ; po ; [unmatched-unlocks]
+        and matched = matched | (unmatched-locks-to-unlocks \
+                (unmatched-po ; unmatched-po))
+        in matched
+
+(* Validate nesting *)
+flag ~empty Rcu-lock \ domain(matched) as unbalanced-rcu-locking
+flag ~empty Rcu-unlock \ range(matched) as unbalanced-rcu-locking
+
+(* Outermost level of nesting only *)
+let crit = matched \ (po^-1 ; matched ; po^-1)
diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat
new file mode 100644
index 000000000000..df97db03b6c2
--- /dev/null
+++ b/tools/memory-model/linux-kernel.cat
@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: GPL-2.0+
+(*
+ * Copyright (C) 2015 Jade Alglave <j.alglave@ucl.ac.uk>,
+ * Copyright (C) 2016 Luc Maranget <luc.maranget@inria.fr> for Inria
+ * Copyright (C) 2017 Alan Stern <stern@rowland.harvard.edu>,
+ *                    Andrea Parri <parri.andrea@gmail.com>
+ *
+ * An earlier version of this file appears in the companion webpage for
+ * "Frightening small children and disconcerting grown-ups: Concurrency
+ * in the Linux kernel" by Alglave, Maranget, McKenney, Parri, and Stern,
+ * which is to appear in ASPLOS 2018.
+ *)
+
+"Linux-kernel memory consistency model"
+
+(*
+ * File "lock.cat" handles locks and is experimental.
+ * It can be replaced by include "cos.cat" for tests that do not use locks.
+ *)
+
+include "lock.cat"
+
+(*******************)
+(* Basic relations *)
+(*******************)
+
+(* Fences *)
+let rmb = [R \ Noreturn] ; fencerel(Rmb) ; [R \ Noreturn]
+let wmb = [W] ; fencerel(Wmb) ; [W]
+let mb = ([M] ; fencerel(Mb) ; [M]) |
+        ([M] ; fencerel(Before-atomic) ; [RMW] ; po? ; [M]) |
+        ([M] ; po? ; [RMW] ; fencerel(After-atomic) ; [M]) |
+        ([M] ; po? ; [LKW] ; fencerel(After-spinlock) ; [M])
+let gp = po ; [Sync-rcu] ; po?
+
+let strong-fence = mb | gp
+
+(* Release Acquire *)
+let acq-po = [Acquire] ; po ; [M]
+let po-rel = [M] ; po ; [Release]
+let rfi-rel-acq = [Release] ; rfi ; [Acquire]
+
+(**********************************)
+(* Fundamental coherence ordering *)
+(**********************************)
+
+(* Sequential Consistency Per Variable *)
+let com = rf | co | fr
+acyclic po-loc | com as coherence
+
+(* Atomic Read-Modify-Write *)
+empty rmw & (fre ; coe) as atomic
+
+(**********************************)
+(* Instruction execution ordering *)
+(**********************************)
+
+(* Preserved Program Order *)
+let dep = addr | data
+let rwdep = (dep | ctrl) ; [W]
+let overwrite = co | fr
+let to-w = rwdep | (overwrite & int)
+let to-r = addr | (dep ; rfi) | rfi-rel-acq
+let fence = strong-fence | wmb | po-rel | rmb | acq-po
+let ppo = to-r | to-w | fence
+
+(* Propagation: Ordering from release operations and strong fences. *)
+let A-cumul(r) = rfe? ; r
+let cumul-fence = A-cumul(strong-fence | po-rel) | wmb
+let prop = (overwrite & ext)? ; cumul-fence* ; rfe?
+
+(*
+ * Happens Before: Ordering from the passage of time.
+ * No fences needed here for prop because relation confined to one process.
+ *)
+let hb = ppo | rfe | ((prop \ id) & int)
+acyclic hb as happens-before
+
+(****************************************)
+(* Write and fence propagation ordering *)
+(****************************************)
+
+(* Propagation: Each non-rf link needs a strong fence. *)
+let pb = prop ; strong-fence ; hb*
+acyclic pb as propagation
+
+(*******)
+(* RCU *)
+(*******)
+
+(*
+ * Effect of read-side critical section proceeds from the rcu_read_lock()
+ * onward on the one hand and from the rcu_read_unlock() backwards on the
+ * other hand.
+ *)
+let rscs = po ; crit^-1 ; po?
+
+(*
+ * The synchronize_rcu() strong fence is special in that it can order not
+ * one but two non-rf relations, but only in conjunction with an RCU
+ * read-side critical section.
+ *)
+let link = hb* ; pb* ; prop
+
+(* Chains that affect the RCU grace-period guarantee *)
+let gp-link = gp ; link
+let rscs-link = rscs ; link
+
+(*
+ * A cycle containing at least as many grace periods as RCU read-side
+ * critical sections is forbidden.
+ *)
+let rec rcu-path =
+        gp-link |
+        (gp-link ; rscs-link) |
+        (rscs-link ; gp-link) |
+        (rcu-path ; rcu-path) |
+        (gp-link ; rcu-path ; rscs-link) |
+        (rscs-link ; rcu-path ; gp-link)
+
+irreflexive rcu-path as rcu
diff --git a/tools/memory-model/linux-kernel.cfg b/tools/memory-model/linux-kernel.cfg
new file mode 100644
index 000000000000..3c8098e99f41
--- /dev/null
+++ b/tools/memory-model/linux-kernel.cfg
@@ -0,0 +1,21 @@
+macros linux-kernel.def
+bell linux-kernel.bell
+model linux-kernel.cat
+graph columns
+squished true
+showevents noregs
+movelabel true
+fontsize 8
+xscale 2.0
+yscale 1.5
+arrowsize 0.8
+showinitrf false
+showfinalrf false
+showinitwrites false
+splines spline
+pad 0.1
+edgeattr hb,color,indigo
+edgeattr co,color,blue
+edgeattr mb,color,darkgreen
+edgeattr wmb,color,darkgreen
+edgeattr rmb,color,darkgreen
diff --git a/tools/memory-model/linux-kernel.def b/tools/memory-model/linux-kernel.def
new file mode 100644
index 000000000000..397e4e67e8c8
--- /dev/null
+++ b/tools/memory-model/linux-kernel.def
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: GPL-2.0+
+//
+// An earlier version of this file appears in the companion webpage for
+// "Frightening small children and disconcerting grown-ups: Concurrency
+// in the Linux kernel" by Alglave, Maranget, McKenney, Parri, and Stern,
+// which is to appear in ASPLOS 2018.
+
+// ONCE
+READ_ONCE(X) __load{once}(X)
+WRITE_ONCE(X,V) { __store{once}(X,V); }
+
+// Release Acquire and friends
+smp_store_release(X,V) { __store{release}(*X,V); }
+smp_load_acquire(X) __load{acquire}(*X)
+rcu_assign_pointer(X,V) { __store{release}(X,V); }
+rcu_dereference(X) __load{once}(X)
+
+// Fences
+smp_mb() { __fence{mb} ; }
+smp_rmb() { __fence{rmb} ; }
+smp_wmb() { __fence{wmb} ; }
+smp_mb__before_atomic() { __fence{before-atomic} ; }
+smp_mb__after_atomic() { __fence{after-atomic} ; }
+smp_mb__after_spinlock() { __fence{after-spinlock} ; }
+
+// Exchange
+xchg(X,V)  __xchg{mb}(X,V)
+xchg_relaxed(X,V) __xchg{once}(X,V)
+xchg_release(X,V) __xchg{release}(X,V)
+xchg_acquire(X,V) __xchg{acquire}(X,V)
+cmpxchg(X,V,W) __cmpxchg{mb}(X,V,W)
+cmpxchg_relaxed(X,V,W) __cmpxchg{once}(X,V,W)
+cmpxchg_acquire(X,V,W) __cmpxchg{acquire}(X,V,W)
+cmpxchg_release(X,V,W) __cmpxchg{release}(X,V,W)
+
+// Spinlocks
+spin_lock(X) { __lock(X) ; }
+spin_unlock(X) { __unlock(X) ; }
+spin_trylock(X) __trylock(X)
+
+// RCU
+rcu_read_lock() { __fence{rcu-lock}; }
+rcu_read_unlock() { __fence{rcu-unlock};}
+synchronize_rcu() { __fence{sync-rcu}; }
+synchronize_rcu_expedited() { __fence{sync-rcu}; }
+
+// Atomic
+atomic_read(X) READ_ONCE(*X)
+atomic_set(X,V) { WRITE_ONCE(*X,V) ; }
+atomic_read_acquire(X) smp_load_acquire(X)
+atomic_set_release(X,V) { smp_store_release(X,V); }
+
+atomic_add(V,X) { __atomic_op(X,+,V) ; }
+atomic_sub(V,X) { __atomic_op(X,-,V) ; }
+atomic_inc(X)   { __atomic_op(X,+,1) ; }
+atomic_dec(X)   { __atomic_op(X,-,1) ; }
+
+atomic_add_return(V,X) __atomic_op_return{mb}(X,+,V)
+atomic_add_return_relaxed(V,X) __atomic_op_return{once}(X,+,V)
+atomic_add_return_acquire(V,X) __atomic_op_return{acquire}(X,+,V)
+atomic_add_return_release(V,X) __atomic_op_return{release}(X,+,V)
+atomic_fetch_add(V,X) __atomic_fetch_op{mb}(X,+,V)
+atomic_fetch_add_relaxed(V,X) __atomic_fetch_op{once}(X,+,V)
+atomic_fetch_add_acquire(V,X) __atomic_fetch_op{acquire}(X,+,V)
+atomic_fetch_add_release(V,X) __atomic_fetch_op{release}(X,+,V)
+
+atomic_inc_return(X) __atomic_op_return{mb}(X,+,1)
+atomic_inc_return_relaxed(X) __atomic_op_return{once}(X,+,1)
+atomic_inc_return_acquire(X) __atomic_op_return{acquire}(X,+,1)
+atomic_inc_return_release(X) __atomic_op_return{release}(X,+,1)
+atomic_fetch_inc(X) __atomic_fetch_op{mb}(X,+,1)
+atomic_fetch_inc_relaxed(X) __atomic_fetch_op{once}(X,+,1)
+atomic_fetch_inc_acquire(X) __atomic_fetch_op{acquire}(X,+,1)
+atomic_fetch_inc_release(X) __atomic_fetch_op{release}(X,+,1)
+
+atomic_sub_return(V,X) __atomic_op_return{mb}(X,-,V)
+atomic_sub_return_relaxed(V,X) __atomic_op_return{once}(X,-,V)
+atomic_sub_return_acquire(V,X) __atomic_op_return{acquire}(X,-,V)
+atomic_sub_return_release(V,X) __atomic_op_return{release}(X,-,V)
+atomic_fetch_sub(V,X) __atomic_fetch_op{mb}(X,-,V)
+atomic_fetch_sub_relaxed(V,X) __atomic_fetch_op{once}(X,-,V)
+atomic_fetch_sub_acquire(V,X) __atomic_fetch_op{acquire}(X,-,V)
+atomic_fetch_sub_release(V,X) __atomic_fetch_op{release}(X,-,V)
+
+atomic_dec_return(X) __atomic_op_return{mb}(X,-,1)
+atomic_dec_return_relaxed(X) __atomic_op_return{once}(X,-,1)
+atomic_dec_return_acquire(X) __atomic_op_return{acquire}(X,-,1)
+atomic_dec_return_release(X) __atomic_op_return{release}(X,-,1)
+atomic_fetch_dec(X) __atomic_fetch_op{mb}(X,-,1)
+atomic_fetch_dec_relaxed(X) __atomic_fetch_op{once}(X,-,1)
+atomic_fetch_dec_acquire(X) __atomic_fetch_op{acquire}(X,-,1)
+atomic_fetch_dec_release(X) __atomic_fetch_op{release}(X,-,1)
+
+atomic_xchg(X,V) __xchg{mb}(X,V)
+atomic_xchg_relaxed(X,V) __xchg{once}(X,V)
+atomic_xchg_release(X,V) __xchg{release}(X,V)
+atomic_xchg_acquire(X,V) __xchg{acquire}(X,V)
+atomic_cmpxchg(X,V,W) __cmpxchg{mb}(X,V,W)
+atomic_cmpxchg_relaxed(X,V,W) __cmpxchg{once}(X,V,W)
+atomic_cmpxchg_acquire(X,V,W) __cmpxchg{acquire}(X,V,W)
+atomic_cmpxchg_release(X,V,W) __cmpxchg{release}(X,V,W)
+
+atomic_sub_and_test(V,X) __atomic_op_return{mb}(X,-,V) == 0
+atomic_dec_and_test(X)  __atomic_op_return{mb}(X,-,1) == 0
+atomic_inc_and_test(X)  __atomic_op_return{mb}(X,+,1) == 0
+atomic_add_negative(V,X) __atomic_op_return{mb}(X,+,V) < 0
diff --git a/tools/memory-model/litmus-tests/CoRR+poonceonce+Once.litmus b/tools/memory-model/litmus-tests/CoRR+poonceonce+Once.litmus
new file mode 100644
index 000000000000..967f9f2a6226
--- /dev/null
+++ b/tools/memory-model/litmus-tests/CoRR+poonceonce+Once.litmus
@@ -0,0 +1,26 @@
+C CoRR+poonceonce+Once
+
+(*
+ * Result: Never
+ *
+ * Test of read-read coherence, that is, whether or not two successive
+ * reads from the same variable are ordered.
+ *)
+
+{}
+
+P0(int *x)
+{
+        WRITE_ONCE(*x, 1);
+}
+
+P1(int *x)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*x);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0)
diff --git a/tools/memory-model/litmus-tests/CoRW+poonceonce+Once.litmus b/tools/memory-model/litmus-tests/CoRW+poonceonce+Once.litmus
new file mode 100644
index 000000000000..4635739f3974
--- /dev/null
+++ b/tools/memory-model/litmus-tests/CoRW+poonceonce+Once.litmus
@@ -0,0 +1,25 @@
+C CoRW+poonceonce+Once
+
+(*
+ * Result: Never
+ *
+ * Test of read-write coherence, that is, whether or not a read from
+ * a given variable and a later write to that same variable are ordered.
+ *)
+
+{}
+
+P0(int *x)
+{
+        int r0;
+
+        r0 = READ_ONCE(*x);
+        WRITE_ONCE(*x, 1);
+}
+
+P1(int *x)
+{
+        WRITE_ONCE(*x, 2);
+}
+
+exists (x=2 /\ 0:r0=2)
diff --git a/tools/memory-model/litmus-tests/CoWR+poonceonce+Once.litmus b/tools/memory-model/litmus-tests/CoWR+poonceonce+Once.litmus
new file mode 100644
index 000000000000..bb068c92d8da
--- /dev/null
+++ b/tools/memory-model/litmus-tests/CoWR+poonceonce+Once.litmus
@@ -0,0 +1,25 @@
+C CoWR+poonceonce+Once
+
+(*
+ * Result: Never
+ *
+ * Test of write-read coherence, that is, whether or not a write to a
+ * given variable and a later read from that same variable are ordered.
+ *)
+
+{}
+
+P0(int *x)
+{
+        int r0;
+
+        WRITE_ONCE(*x, 1);
+        r0 = READ_ONCE(*x);
+}
+
+P1(int *x)
+{
+        WRITE_ONCE(*x, 2);
+}
+
+exists (x=1 /\ 0:r0=2)
diff --git a/tools/memory-model/litmus-tests/CoWW+poonceonce.litmus b/tools/memory-model/litmus-tests/CoWW+poonceonce.litmus
new file mode 100644
index 000000000000..0d9f0a958799
--- /dev/null
+++ b/tools/memory-model/litmus-tests/CoWW+poonceonce.litmus
@@ -0,0 +1,18 @@
+C CoWW+poonceonce
+
+(*
+ * Result: Never
+ *
+ * Test of write-write coherence, that is, whether or not two successive
+ * writes to the same variable are ordered.
+ *)
+
+{}
+
+P0(int *x)
+{
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*x, 2);
+}
+
+exists (x=1)
diff --git a/tools/memory-model/litmus-tests/IRIW+mbonceonces+OnceOnce.litmus b/tools/memory-model/litmus-tests/IRIW+mbonceonces+OnceOnce.litmus
new file mode 100644
index 000000000000..50d5db9ea983
--- /dev/null
+++ b/tools/memory-model/litmus-tests/IRIW+mbonceonces+OnceOnce.litmus
@@ -0,0 +1,45 @@
+C IRIW+mbonceonces+OnceOnce
+
+(*
+ * Result: Never
+ *
+ * Test of independent reads from independent writes with smp_mb()
+ * between each pairs of reads.  In other words, is smp_mb() sufficient to
+ * cause two different reading processes to agree on the order of a pair
+ * of writes, where each write is to a different variable by a different
+ * process?
+ *)
+
+{}
+
+P0(int *x)
+{
+        WRITE_ONCE(*x, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*x);
+        smp_mb();
+        r1 = READ_ONCE(*y);
+}
+
+P2(int *y)
+{
+        WRITE_ONCE(*y, 1);
+}
+
+P3(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        smp_mb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0 /\ 3:r0=1 /\ 3:r1=0)
diff --git a/tools/memory-model/litmus-tests/IRIW+poonceonces+OnceOnce.litmus b/tools/memory-model/litmus-tests/IRIW+poonceonces+OnceOnce.litmus
new file mode 100644
index 000000000000..4b54dd6a6cd9
--- /dev/null
+++ b/tools/memory-model/litmus-tests/IRIW+poonceonces+OnceOnce.litmus
@@ -0,0 +1,43 @@
+C IRIW+poonceonces+OnceOnce
+
+(*
+ * Result: Sometimes
+ *
+ * Test of independent reads from independent writes with nothing
+ * between each pairs of reads.  In other words, is anything at all
+ * needed to cause two different reading processes to agree on the order
+ * of a pair of writes, where each write is to a different variable by a
+ * different process?
+ *)
+
+{}
+
+P0(int *x)
+{
+        WRITE_ONCE(*x, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*x);
+        r1 = READ_ONCE(*y);
+}
+
+P2(int *y)
+{
+        WRITE_ONCE(*y, 1);
+}
+
+P3(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0 /\ 3:r0=1 /\ 3:r1=0)
diff --git a/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus b/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus
new file mode 100644
index 000000000000..7a39a0aaa976
--- /dev/null
+++ b/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus
@@ -0,0 +1,41 @@
+C ISA2+pooncelock+pooncelock+pombonce.litmus
+
+(*
+ * Result: Sometimes
+ *
+ * This test shows that the ordering provided by a lock-protected S
+ * litmus test (P0() and P1()) are not visible to external process P2().
+ * This is likely to change soon.
+ *)
+
+{}
+
+P0(int *x, int *y, spinlock_t *mylock)
+{
+        spin_lock(mylock);
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*y, 1);
+        spin_unlock(mylock);
+}
+
+P1(int *y, int *z, spinlock_t *mylock)
+{
+        int r0;
+
+        spin_lock(mylock);
+        r0 = READ_ONCE(*y);
+        WRITE_ONCE(*z, 1);
+        spin_unlock(mylock);
+}
+
+P2(int *x, int *z)
+{
+        int r1;
+        int r2;
+
+        r2 = READ_ONCE(*z);
+        smp_mb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 2:r2=1 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/ISA2+poonceonces.litmus b/tools/memory-model/litmus-tests/ISA2+poonceonces.litmus
new file mode 100644
index 000000000000..b321aa6f4ea5
--- /dev/null
+++ b/tools/memory-model/litmus-tests/ISA2+poonceonces.litmus
@@ -0,0 +1,37 @@
+C ISA2+poonceonces
+
+(*
+ * Result: Sometimes
+ *
+ * Given a release-acquire chain ordering the first process's store
+ * against the last process's load, is ordering preserved if all of the
+ * smp_store_release() invocations are replaced by WRITE_ONCE() and all
+ * of the smp_load_acquire() invocations are replaced by READ_ONCE()?
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *y, int *z)
+{
+        int r0;
+
+        r0 = READ_ONCE(*y);
+        WRITE_ONCE(*z, 1);
+}
+
+P2(int *x, int *z)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*z);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 2:r0=1 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/ISA2+pooncerelease+poacquirerelease+poacquireonce.litmus b/tools/memory-model/litmus-tests/ISA2+pooncerelease+poacquirerelease+poacquireonce.litmus
new file mode 100644
index 000000000000..025b0462ec9b
--- /dev/null
+++ b/tools/memory-model/litmus-tests/ISA2+pooncerelease+poacquirerelease+poacquireonce.litmus
@@ -0,0 +1,39 @@
+C ISA2+pooncerelease+poacquirerelease+poacquireonce
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates that a release-acquire chain suffices
+ * to order P0()'s initial write against P2()'s final read.  The reason
+ * that the release-acquire chain suffices is because in all but one
+ * case (P2() to P0()), each process reads from the preceding process's
+ * write.  In memory-model-speak, there is only one non-reads-from
+ * (AKA non-rf) link, so release-acquire is all that is needed.
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        smp_store_release(y, 1);
+}
+
+P1(int *y, int *z)
+{
+        int r0;
+
+        r0 = smp_load_acquire(y);
+        smp_store_release(z, 1);
+}
+
+P2(int *x, int *z)
+{
+        int r0;
+        int r1;
+
+        r0 = smp_load_acquire(z);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 2:r0=1 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/LB+ctrlonceonce+mbonceonce.litmus b/tools/memory-model/litmus-tests/LB+ctrlonceonce+mbonceonce.litmus
new file mode 100644
index 000000000000..de6708229dd1
--- /dev/null
+++ b/tools/memory-model/litmus-tests/LB+ctrlonceonce+mbonceonce.litmus
@@ -0,0 +1,34 @@
+C LB+ctrlonceonce+mbonceonce
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates that lightweight ordering suffices for
+ * the load-buffering pattern, in other words, preventing all processes
+ * reading from the preceding process's write.  In this example, the
+ * combination of a control dependency and a full memory barrier are enough
+ * to do the trick.  (But the full memory barrier could be replaced with
+ * another control dependency and order would still be maintained.)
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*x);
+        if (r0)
+                WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*y);
+        smp_mb();
+        WRITE_ONCE(*x, 1);
+}
+
+exists (0:r0=1 /\ 1:r0=1)
diff --git a/tools/memory-model/litmus-tests/LB+poacquireonce+pooncerelease.litmus b/tools/memory-model/litmus-tests/LB+poacquireonce+pooncerelease.litmus
new file mode 100644
index 000000000000..07b9904b0e49
--- /dev/null
+++ b/tools/memory-model/litmus-tests/LB+poacquireonce+pooncerelease.litmus
@@ -0,0 +1,29 @@
+C LB+poacquireonce+pooncerelease
+
+(*
+ * Result: Never
+ *
+ * Does a release-acquire pair suffice for the load-buffering litmus
+ * test, where each process reads from one of two variables then writes
+ * to the other?
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*x);
+        smp_store_release(y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = smp_load_acquire(y);
+        WRITE_ONCE(*x, 1);
+}
+
+exists (0:r0=1 /\ 1:r0=1)
diff --git a/tools/memory-model/litmus-tests/LB+poonceonces.litmus b/tools/memory-model/litmus-tests/LB+poonceonces.litmus
new file mode 100644
index 000000000000..74c49cb3c37b
--- /dev/null
+++ b/tools/memory-model/litmus-tests/LB+poonceonces.litmus
@@ -0,0 +1,28 @@
+C LB+poonceonces
+
+(*
+ * Result: Sometimes
+ *
+ * Can the counter-intuitive outcome for the load-buffering pattern
+ * be prevented even with no explicit ordering?
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*x);
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*y);
+        WRITE_ONCE(*x, 1);
+}
+
+exists (0:r0=1 /\ 1:r0=1)
diff --git a/tools/memory-model/litmus-tests/MP+onceassign+derefonce.litmus b/tools/memory-model/litmus-tests/MP+onceassign+derefonce.litmus
new file mode 100644
index 000000000000..97731b4bbdd8
--- /dev/null
+++ b/tools/memory-model/litmus-tests/MP+onceassign+derefonce.litmus
@@ -0,0 +1,34 @@
+C MP+onceassign+derefonce
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates that rcu_assign_pointer() and
+ * rcu_dereference() suffice to ensure that an RCU reader will not see
+ * pre-initialization garbage when it traverses an RCU-protected data
+ * structure containing a newly inserted element.
+ *)
+
+{
+y=z;
+z=0;
+}
+
+P0(int *x, int **y)
+{
+        WRITE_ONCE(*x, 1);
+        rcu_assign_pointer(*y, x);
+}
+
+P1(int *x, int **y)
+{
+        int *r0;
+        int r1;
+
+        rcu_read_lock();
+        r0 = rcu_dereference(*y);
+        r1 = READ_ONCE(*r0);
+        rcu_read_unlock();
+}
+
+exists (1:r0=x /\ 1:r1=0)
diff --git a/tools/memory-model/litmus-tests/MP+polocks.litmus b/tools/memory-model/litmus-tests/MP+polocks.litmus
new file mode 100644
index 000000000000..712a4fcdf6ce
--- /dev/null
+++ b/tools/memory-model/litmus-tests/MP+polocks.litmus
@@ -0,0 +1,35 @@
+C MP+polocks
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates how lock acquisitions and releases can
+ * stand in for smp_load_acquire() and smp_store_release(), respectively.
+ * In other words, when holding a given lock (or indeed after releasing a
+ * given lock), a CPU is not only guaranteed to see the accesses that other
+ * CPUs made while previously holding that lock, it is also guaranteed
+ * to see all prior accesses by those other CPUs.
+ *)
+
+{}
+
+P0(int *x, int *y, spinlock_t *mylock)
+{
+        WRITE_ONCE(*x, 1);
+        spin_lock(mylock);
+        WRITE_ONCE(*y, 1);
+        spin_unlock(mylock);
+}
+
+P1(int *x, int *y, spinlock_t *mylock)
+{
+        int r0;
+        int r1;
+
+        spin_lock(mylock);
+        r0 = READ_ONCE(*y);
+        spin_unlock(mylock);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0)
diff --git a/tools/memory-model/litmus-tests/MP+poonceonces.litmus b/tools/memory-model/litmus-tests/MP+poonceonces.litmus
new file mode 100644
index 000000000000..b2b60b84fb9d
--- /dev/null
+++ b/tools/memory-model/litmus-tests/MP+poonceonces.litmus
@@ -0,0 +1,27 @@
+C MP+poonceonces
+
+(*
+ * Result: Maybe
+ *
+ * Can the counter-intuitive message-passing outcome be prevented with
+ * no ordering at all?
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0)
diff --git a/tools/memory-model/litmus-tests/MP+pooncerelease+poacquireonce.litmus b/tools/memory-model/litmus-tests/MP+pooncerelease+poacquireonce.litmus
new file mode 100644
index 000000000000..d52c68429722
--- /dev/null
+++ b/tools/memory-model/litmus-tests/MP+pooncerelease+poacquireonce.litmus
@@ -0,0 +1,28 @@
+C MP+pooncerelease+poacquireonce
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates that smp_store_release() and
+ * smp_load_acquire() provide sufficient ordering for the message-passing
+ * pattern.
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        smp_store_release(y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = smp_load_acquire(y);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0)
diff --git a/tools/memory-model/litmus-tests/MP+porevlocks.litmus b/tools/memory-model/litmus-tests/MP+porevlocks.litmus
new file mode 100644
index 000000000000..72c9276b363e
--- /dev/null
+++ b/tools/memory-model/litmus-tests/MP+porevlocks.litmus
@@ -0,0 +1,35 @@
+C MP+porevlocks
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates how lock acquisitions and releases can
+ * stand in for smp_load_acquire() and smp_store_release(), respectively.
+ * In other words, when holding a given lock (or indeed after releasing a
+ * given lock), a CPU is not only guaranteed to see the accesses that other
+ * CPUs made while previously holding that lock, it is also guaranteed to
+ * see all prior accesses by those other CPUs.
+ *)
+
+{}
+
+P0(int *x, int *y, spinlock_t *mylock)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        spin_lock(mylock);
+        r1 = READ_ONCE(*x);
+        spin_unlock(mylock);
+}
+
+P1(int *x, int *y, spinlock_t *mylock)
+{
+        spin_lock(mylock);
+        WRITE_ONCE(*x, 1);
+        spin_unlock(mylock);
+        WRITE_ONCE(*y, 1);
+}
+
+exists (0:r0=1 /\ 0:r1=0)
diff --git a/tools/memory-model/litmus-tests/MP+wmbonceonce+rmbonceonce.litmus b/tools/memory-model/litmus-tests/MP+wmbonceonce+rmbonceonce.litmus
new file mode 100644
index 000000000000..c078f38ff27a
--- /dev/null
+++ b/tools/memory-model/litmus-tests/MP+wmbonceonce+rmbonceonce.litmus
@@ -0,0 +1,30 @@
+C MP+wmbonceonce+rmbonceonce
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates that smp_wmb() and smp_rmb() provide
+ * sufficient ordering for the message-passing pattern.  However, it
+ * is usually better to use smp_store_release() and smp_load_acquire().
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        smp_wmb();
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        smp_rmb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 1:r1=0)
diff --git a/tools/memory-model/litmus-tests/R+mbonceonces.litmus b/tools/memory-model/litmus-tests/R+mbonceonces.litmus
new file mode 100644
index 000000000000..a0e884ad2132
--- /dev/null
+++ b/tools/memory-model/litmus-tests/R+mbonceonces.litmus
@@ -0,0 +1,30 @@
+C R+mbonceonces
+
+(*
+ * Result: Never
+ *
+ * This is the fully ordered (via smp_mb()) version of one of the classic
+ * counterintuitive litmus tests that illustrates the effects of store
+ * propagation delays.  Note that weakening either of the barriers would
+ * cause the resulting test to be allowed.
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        smp_mb();
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        WRITE_ONCE(*y, 2);
+        smp_mb();
+        r0 = READ_ONCE(*x);
+}
+
+exists (y=2 /\ 1:r0=0)
diff --git a/tools/memory-model/litmus-tests/R+poonceonces.litmus b/tools/memory-model/litmus-tests/R+poonceonces.litmus
new file mode 100644
index 000000000000..5386f128a131
--- /dev/null
+++ b/tools/memory-model/litmus-tests/R+poonceonces.litmus
@@ -0,0 +1,27 @@
+C R+poonceonces
+
+(*
+ * Result: Sometimes
+ *
+ * This is the unordered (thus lacking smp_mb()) version of one of the
+ * classic counterintuitive litmus tests that illustrates the effects of
+ * store propagation delays.
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        WRITE_ONCE(*y, 2);
+        r0 = READ_ONCE(*x);
+}
+
+exists (y=2 /\ 1:r0=0)
diff --git a/tools/memory-model/litmus-tests/README b/tools/memory-model/litmus-tests/README
new file mode 100644
index 000000000000..04096fb8b8d9
--- /dev/null
+++ b/tools/memory-model/litmus-tests/README
@@ -0,0 +1,131 @@
+This directory contains the following litmus tests:
+
+CoRR+poonceonce+Once.litmus
+        Test of read-read coherence, that is, whether or not two
+        successive reads from the same variable are ordered.
+
+CoRW+poonceonce+Once.litmus
+        Test of read-write coherence, that is, whether or not a read
+        from a given variable followed by a write to that same variable
+        are ordered.
+
+CoWR+poonceonce+Once.litmus
+        Test of write-read coherence, that is, whether or not a write
+        to a given variable followed by a read from that same variable
+        are ordered.
+
+CoWW+poonceonce.litmus
+        Test of write-write coherence, that is, whether or not two
+        successive writes to the same variable are ordered.
+
+IRIW+mbonceonces+OnceOnce.litmus
+        Test of independent reads from independent writes with smp_mb()
+        between each pairs of reads.  In other words, is smp_mb()
+        sufficient to cause two different reading processes to agree on
+        the order of a pair of writes, where each write is to a different
+        variable by a different process?
+
+IRIW+poonceonces+OnceOnce.litmus
+        Test of independent reads from independent writes with nothing
+        between each pairs of reads.  In other words, is anything at all
+        needed to cause two different reading processes to agree on the
+        order of a pair of writes, where each write is to a different
+        variable by a different process?
+
+ISA2+pooncelock+pooncelock+pombonce.litmus
+        Tests whether the ordering provided by a lock-protected S
+        litmus test is visible to an external process whose accesses are
+        separated by smp_mb().  This addition of an external process to
+        S is otherwise known as ISA2.
+
+ISA2+poonceonces.litmus
+        As below, but with store-release replaced with WRITE_ONCE()
+        and load-acquire replaced with READ_ONCE().
+
+ISA2+pooncerelease+poacquirerelease+poacquireonce.litmus
+        Can a release-acquire chain order a prior store against
+        a later load?
+
+LB+ctrlonceonce+mbonceonce.litmus
+        Does a control dependency and an smp_mb() suffice for the
+        load-buffering litmus test, where each process reads from one
+        of two variables then writes to the other?
+
+LB+poacquireonce+pooncerelease.litmus
+        Does a release-acquire pair suffice for the load-buffering
+        litmus test, where each process reads from one of two variables then
+        writes to the other?
+
+LB+poonceonces.litmus
+        As above, but with store-release replaced with WRITE_ONCE()
+        and load-acquire replaced with READ_ONCE().
+
+MP+onceassign+derefonce.litmus
+        As below, but with rcu_assign_pointer() and an rcu_dereference().
+
+MP+polocks.litmus
+        As below, but with the second access of the writer process
+        and the first access of reader process protected by a lock.
+
+MP+poonceonces.litmus
+        As below, but without the smp_rmb() and smp_wmb().
+
+MP+pooncerelease+poacquireonce.litmus
+        As below, but with a release-acquire chain.
+
+MP+porevlocks.litmus
+        As below, but with the first access of the writer process
+        and the second access of reader process protected by a lock.
+
+MP+wmbonceonce+rmbonceonce.litmus
+        Does a smp_wmb() (between the stores) and an smp_rmb() (between
+        the loads) suffice for the message-passing litmus test, where one
+        process writes data and then a flag, and the other process reads
+        the flag and then the data.  (This is similar to the ISA2 tests,
+        but with two processes instead of three.)
+
+R+mbonceonces.litmus
+        This is the fully ordered (via smp_mb()) version of one of
+        the classic counterintuitive litmus tests that illustrates the
+        effects of store propagation delays.
+
+R+poonceonces.litmus
+        As above, but without the smp_mb() invocations.
+
+SB+mbonceonces.litmus
+        This is the fully ordered (again, via smp_mb() version of store
+        buffering, which forms the core of Dekker's mutual-exclusion
+        algorithm.
+
+SB+poonceonces.litmus
+        As above, but without the smp_mb() invocations.
+
+S+poonceonces.litmus
+        As below, but without the smp_wmb() and acquire load.
+
+S+wmbonceonce+poacquireonce.litmus
+        Can a smp_wmb(), instead of a release, and an acquire order
+        a prior store against a subsequent store?
+
+WRC+poonceonces+Once.litmus
+WRC+pooncerelease+rmbonceonce+Once.litmus
+        These two are members of an extension of the MP litmus-test class
+        in which the first write is moved to a separate process.
+
+Z6.0+pooncelock+pooncelock+pombonce.litmus
+        Is the ordering provided by a spin_unlock() and a subsequent
+        spin_lock() sufficient to make ordering apparent to accesses
+        by a process not holding the lock?
+
+Z6.0+pooncelock+poonceLock+pombonce.litmus
+        As above, but with smp_mb__after_spinlock() immediately
+        following the spin_lock().
+
+Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus
+        Is the ordering provided by a release-acquire chain sufficient
+        to make ordering apparent to accesses by a process that does
+        not participate in that release-acquire chain?
+
+A great many more litmus tests are available here:
+
+        https://github.com/paulmckrcu/litmus
diff --git a/tools/memory-model/litmus-tests/S+poonceonces.litmus b/tools/memory-model/litmus-tests/S+poonceonces.litmus
new file mode 100644
index 000000000000..8c9c2f81a580
--- /dev/null
+++ b/tools/memory-model/litmus-tests/S+poonceonces.litmus
@@ -0,0 +1,28 @@
+C S+poonceonces
+
+(*
+ * Result: Sometimes
+ *
+ * Starting with a two-process release-acquire chain ordering P0()'s
+ * first store against P1()'s final load, if the smp_store_release()
+ * is replaced by WRITE_ONCE() and the smp_load_acquire() replaced by
+ * READ_ONCE(), is ordering preserved?
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 2);
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*y);
+        WRITE_ONCE(*x, 1);
+}
+
+exists (x=2 /\ 1:r0=1)
diff --git a/tools/memory-model/litmus-tests/S+wmbonceonce+poacquireonce.litmus b/tools/memory-model/litmus-tests/S+wmbonceonce+poacquireonce.litmus
new file mode 100644
index 000000000000..c53350205d28
--- /dev/null
+++ b/tools/memory-model/litmus-tests/S+wmbonceonce+poacquireonce.litmus
@@ -0,0 +1,27 @@
+C S+wmbonceonce+poacquireonce
+
+(*
+ * Result: Never
+ *
+ * Can a smp_wmb(), instead of a release, and an acquire order a prior
+ * store against a subsequent store?
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 2);
+        smp_wmb();
+        WRITE_ONCE(*y, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = smp_load_acquire(y);
+        WRITE_ONCE(*x, 1);
+}
+
+exists (x=2 /\ 1:r0=1)
diff --git a/tools/memory-model/litmus-tests/SB+mbonceonces.litmus b/tools/memory-model/litmus-tests/SB+mbonceonces.litmus
new file mode 100644
index 000000000000..74b874ffa8da
--- /dev/null
+++ b/tools/memory-model/litmus-tests/SB+mbonceonces.litmus
@@ -0,0 +1,32 @@
+C SB+mbonceonces
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates that full memory barriers suffice to
+ * order the store-buffering pattern, where each process writes to the
+ * variable that the preceding process reads.  (Locking and RCU can also
+ * suffice, but not much else.)
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        int r0;
+
+        WRITE_ONCE(*x, 1);
+        smp_mb();
+        r0 = READ_ONCE(*y);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        WRITE_ONCE(*y, 1);
+        smp_mb();
+        r0 = READ_ONCE(*x);
+}
+
+exists (0:r0=0 /\ 1:r0=0)
diff --git a/tools/memory-model/litmus-tests/SB+poonceonces.litmus b/tools/memory-model/litmus-tests/SB+poonceonces.litmus
new file mode 100644
index 000000000000..10d550730b25
--- /dev/null
+++ b/tools/memory-model/litmus-tests/SB+poonceonces.litmus
@@ -0,0 +1,29 @@
+C SB+poonceonces
+
+(*
+ * Result: Sometimes
+ *
+ * This litmus test demonstrates that at least some ordering is required
+ * to order the store-buffering pattern, where each process writes to the
+ * variable that the preceding process reads.
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        int r0;
+
+        WRITE_ONCE(*x, 1);
+        r0 = READ_ONCE(*y);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        WRITE_ONCE(*y, 1);
+        r0 = READ_ONCE(*x);
+}
+
+exists (0:r0=0 /\ 1:r0=0)
diff --git a/tools/memory-model/litmus-tests/WRC+poonceonces+Once.litmus b/tools/memory-model/litmus-tests/WRC+poonceonces+Once.litmus
new file mode 100644
index 000000000000..6a2bc12a1af1
--- /dev/null
+++ b/tools/memory-model/litmus-tests/WRC+poonceonces+Once.litmus
@@ -0,0 +1,35 @@
+C WRC+poonceonces+Once
+
+(*
+ * Result: Sometimes
+ *
+ * This litmus test is an extension of the message-passing pattern,
+ * where the first write is moved to a separate process.  Note that this
+ * test has no ordering at all.
+ *)
+
+{}
+
+P0(int *x)
+{
+        WRITE_ONCE(*x, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*x);
+        WRITE_ONCE(*y, 1);
+}
+
+P2(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 2:r0=1 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/WRC+pooncerelease+rmbonceonce+Once.litmus b/tools/memory-model/litmus-tests/WRC+pooncerelease+rmbonceonce+Once.litmus
new file mode 100644
index 000000000000..97fcbffde9a0
--- /dev/null
+++ b/tools/memory-model/litmus-tests/WRC+pooncerelease+rmbonceonce+Once.litmus
@@ -0,0 +1,36 @@
+C WRC+pooncerelease+rmbonceonce+Once
+
+(*
+ * Result: Never
+ *
+ * This litmus test is an extension of the message-passing pattern, where
+ * the first write is moved to a separate process.  Because it features
+ * a release and a read memory barrier, it should be forbidden.
+ *)
+
+{}
+
+P0(int *x)
+{
+        WRITE_ONCE(*x, 1);
+}
+
+P1(int *x, int *y)
+{
+        int r0;
+
+        r0 = READ_ONCE(*x);
+        smp_store_release(y, 1);
+}
+
+P2(int *x, int *y)
+{
+        int r0;
+        int r1;
+
+        r0 = READ_ONCE(*y);
+        smp_rmb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ 2:r0=1 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/Z6.0+pooncelock+poonceLock+pombonce.litmus b/tools/memory-model/litmus-tests/Z6.0+pooncelock+poonceLock+pombonce.litmus
new file mode 100644
index 000000000000..415248fb6699
--- /dev/null
+++ b/tools/memory-model/litmus-tests/Z6.0+pooncelock+poonceLock+pombonce.litmus
@@ -0,0 +1,42 @@
+C Z6.0+pooncelock+poonceLock+pombonce
+
+(*
+ * Result: Never
+ *
+ * This litmus test demonstrates how smp_mb__after_spinlock() may be
+ * used to ensure that accesses in different critical sections for a
+ * given lock running on different CPUs are nevertheless seen in order
+ * by CPUs not holding that lock.
+ *)
+
+{}
+
+P0(int *x, int *y, spinlock_t *mylock)
+{
+        spin_lock(mylock);
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*y, 1);
+        spin_unlock(mylock);
+}
+
+P1(int *y, int *z, spinlock_t *mylock)
+{
+        int r0;
+
+        spin_lock(mylock);
+        smp_mb__after_spinlock();
+        r0 = READ_ONCE(*y);
+        WRITE_ONCE(*z, 1);
+        spin_unlock(mylock);
+}
+
+P2(int *x, int *z)
+{
+        int r1;
+
+        WRITE_ONCE(*z, 2);
+        smp_mb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ z=2 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/Z6.0+pooncelock+pooncelock+pombonce.litmus b/tools/memory-model/litmus-tests/Z6.0+pooncelock+pooncelock+pombonce.litmus
new file mode 100644
index 000000000000..10a2aa04cd07
--- /dev/null
+++ b/tools/memory-model/litmus-tests/Z6.0+pooncelock+pooncelock+pombonce.litmus
@@ -0,0 +1,40 @@
+C Z6.0+pooncelock+pooncelock+pombonce
+
+(*
+ * Result: Sometimes
+ *
+ * This example demonstrates that a pair of accesses made by different
+ * processes each while holding a given lock will not necessarily be
+ * seen as ordered by a third process not holding that lock.
+ *)
+
+{}
+
+P0(int *x, int *y, spinlock_t *mylock)
+{
+        spin_lock(mylock);
+        WRITE_ONCE(*x, 1);
+        WRITE_ONCE(*y, 1);
+        spin_unlock(mylock);
+}
+
+P1(int *y, int *z, spinlock_t *mylock)
+{
+        int r0;
+
+        spin_lock(mylock);
+        r0 = READ_ONCE(*y);
+        WRITE_ONCE(*z, 1);
+        spin_unlock(mylock);
+}
+
+P2(int *x, int *z)
+{
+        int r1;
+
+        WRITE_ONCE(*z, 2);
+        smp_mb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ z=2 /\ 2:r1=0)
diff --git a/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus b/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus
new file mode 100644
index 000000000000..a20fc3fafb53
--- /dev/null
+++ b/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus
@@ -0,0 +1,42 @@
+C Z6.0+pooncerelease+poacquirerelease+mbonceonce
+
+(*
+ * Result: Sometimes
+ *
+ * This litmus test shows that a release-acquire chain, while sufficient
+ * when there is but one non-reads-from (AKA non-rf) link, does not suffice
+ * if there is more than one.  Of the three processes, only P1() reads from
+ * P0's write, which means that there are two non-rf links: P1() to P2()
+ * is a write-to-write link (AKA a "coherence" or just "co" link) and P2()
+ * to P0() is a read-to-write link (AKA a "from-reads" or just "fr" link).
+ * When there are two or more non-rf links, you typically will need one
+ * full barrier for each non-rf link.  (Exceptions include some cases
+ * involving locking.)
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        WRITE_ONCE(*x, 1);
+        smp_store_release(y, 1);
+}
+
+P1(int *y, int *z)
+{
+        int r0;
+
+        r0 = smp_load_acquire(y);
+        smp_store_release(z, 1);
+}
+
+P2(int *x, int *z)
+{
+        int r1;
+
+        WRITE_ONCE(*z, 2);
+        smp_mb();
+        r1 = READ_ONCE(*x);
+}
+
+exists (1:r0=1 /\ z=2 /\ 2:r1=0)
diff --git a/tools/memory-model/lock.cat b/tools/memory-model/lock.cat
new file mode 100644
index 000000000000..ba4a4ec6d313
--- /dev/null
+++ b/tools/memory-model/lock.cat
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: GPL-2.0+
+(*
+ * Copyright (C) 2016 Luc Maranget <luc.maranget@inria.fr> for Inria
+ * Copyright (C) 2017 Alan Stern <stern@rowland.harvard.edu>
+ *)
+
+(* Generate coherence orders and handle lock operations *)
+
+include "cross.cat"
+
+(* From lock reads to their partner lock writes *)
+let lk-rmw = ([LKR] ; po-loc ; [LKW]) \ (po ; po)
+let rmw = rmw | lk-rmw
+
+(*
+ * A paired LKR must always see an unlocked value; spin_lock() calls nested
+ * inside a critical section (for the same lock) always deadlock.
+ *)
+empty ([LKW] ; po-loc ; [domain(lk-rmw)]) \ (po-loc ; [UL] ; po-loc)
+        as lock-nest
+
+(* The litmus test is invalid if an LKW event is not part of an RMW pair *)
+flag ~empty LKW \ range(lk-rmw) as unpaired-LKW
+
+(* This will be allowed if we implement spin_is_locked() *)
+flag ~empty LKR \ domain(lk-rmw) as unpaired-LKR
+
+(* There should be no R or W accesses to spinlocks *)
+let ALL-LOCKS = LKR | LKW | UL | LF
+flag ~empty [M \ IW] ; loc ; [ALL-LOCKS] as mixed-lock-accesses
+
+(* The final value of a spinlock should not be tested *)
+flag ~empty [FW] ; loc ; [ALL-LOCKS] as lock-final
+
+
+(*
+ * Put lock operations in their appropriate classes, but leave UL out of W
+ * until after the co relation has been generated.
+ *)
+let R = R | LKR | LF
+let W = W | LKW
+
+let Release = Release | UL
+let Acquire = Acquire | LKR
+
+
+(* Match LKW events to their corresponding UL events *)
+let critical = ([LKW] ; po-loc ; [UL]) \ (po-loc ; [LKW | UL] ; po-loc)
+
+flag ~empty UL \ range(critical) as unmatched-unlock
+
+(* Allow up to one unmatched LKW per location; more must deadlock *)
+let UNMATCHED-LKW = LKW \ domain(critical)
+empty ([UNMATCHED-LKW] ; loc ; [UNMATCHED-LKW]) \ id as unmatched-locks
+
+
+(* rfi for LF events: link each LKW to the LF events in its critical section *)
+let rfi-lf = ([LKW] ; po-loc ; [LF]) \ ([LKW] ; po-loc ; [UL] ; po-loc)
+
+(* rfe for LF events *)
+let all-possible-rfe-lf =
+  (*
+   * Given an LF event r, compute the possible rfe edges for that event
+   * (all those starting from LKW events in other threads),
+   * and then convert that relation to a set of single-edge relations.
+   *)
+  let possible-rfe-lf r =
+    let pair-to-relation p = p ++ 0
+    in map pair-to-relation ((LKW * {r}) & loc & ext)
+  (* Do this for each LF event r that isn't in rfi-lf *)
+  in map possible-rfe-lf (LF \ range(rfi-lf))
+
+(* Generate all rf relations for LF events *)
+with rfe-lf from cross(all-possible-rfe-lf)
+let rf = rf | rfi-lf | rfe-lf
+
+
+(* Generate all co relations, including LKW events but not UL *)
+let co0 = co0 | ([IW] ; loc ; [LKW]) |
+        (([LKW] ; loc ; [UNMATCHED-LKW]) \ [UNMATCHED-LKW])
+include "cos-opt.cat"
+let W = W | UL
+let M = R | W
+
+(* Merge UL events into co *)
+let co = (co | critical | (critical^-1 ; co))+
+let coe = co & ext
+let coi = co & int
+
+(* Merge LKR events into rf *)
+let rf = rf | ([IW | UL] ; singlestep(co) ; lk-rmw^-1)
+let rfe = rf & ext
+let rfi = rf & int
+
+let fr = rf^-1 ; co
+let fre = fr & ext
+let fri = fr & int
+
+show co,rf,fr
diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
index e6acc281dd37..f76d9914686a 100644
--- a/tools/objtool/Makefile
+++ b/tools/objtool/Makefile
@@ -31,11 +31,11 @@ INCLUDES := -I$(srctree)/tools/include \
             -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
             -I$(srctree)/tools/objtool/arch/$(ARCH)/include
 WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
-CFLAGS   += -Wall -Werror $(WARNINGS) -fomit-frame-pointer -O2 -g $(INCLUDES)
-LDFLAGS  += -lelf $(LIBSUBCMD)
+CFLAGS   += -Werror $(WARNINGS) $(HOSTCFLAGS) -g $(INCLUDES)
+LDFLAGS  += -lelf $(LIBSUBCMD) $(HOSTLDFLAGS)
 
 # Allow old libelf to be used:
-elfshdr := $(shell echo '\#include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
+elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
 CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
 
 AWK = awk
diff --git a/tools/objtool/arch/x86/include/asm/insn.h b/tools/objtool/arch/x86/include/asm/insn.h
index b3e32b010ab1..c2c01f84df75 100644
--- a/tools/objtool/arch/x86/include/asm/insn.h
+++ b/tools/objtool/arch/x86/include/asm/insn.h
@@ -208,4 +208,22 @@ static inline int insn_offset_immediate(struct insn *insn)
         return insn_offset_displacement(insn) + insn->displacement.nbytes;
 }
 
+#define POP_SS_OPCODE 0x1f
+#define MOV_SREG_OPCODE 0x8e
+
+/*
+ * Intel SDM Vol.3A 6.8.3 states;
+ * "Any single-step trap that would be delivered following the MOV to SS
+ * instruction or POP to SS instruction (because EFLAGS.TF is 1) is
+ * suppressed."
+ * This function returns true if @insn is MOV SS or POP SS. On these
+ * instructions, single stepping is suppressed.
+ */
+static inline int insn_masking_exception(struct insn *insn)
+{
+        return insn->opcode.bytes[0] == POP_SS_OPCODE ||
+                (insn->opcode.bytes[0] == MOV_SREG_OPCODE &&
+                 X86_MODRM_REG(insn->modrm.bytes[0]) == 2);
+}
+
 #endif /* _ASM_X86_INSN_H */
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 92b6a2c21631..3a31b238f885 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -59,6 +59,31 @@ static struct instruction *next_insn_same_sec(struct objtool_file *file,
         return next;
 }
 
+static struct instruction *next_insn_same_func(struct objtool_file *file,
+                                               struct instruction *insn)
+{
+        struct instruction *next = list_next_entry(insn, list);
+        struct symbol *func = insn->func;
+
+        if (!func)
+                return NULL;
+
+        if (&next->list != &file->insn_list && next->func == func)
+                return next;
+
+        /* Check if we're already in the subfunction: */
+        if (func == func->cfunc)
+                return NULL;
+
+        /* Move to the subfunction: */
+        return find_insn(file, func->cfunc->sec, func->cfunc->offset);
+}
+
+#define func_for_each_insn_all(file, func, insn)                        \
+        for (insn = find_insn(file, func->sec, func->offset);           \
+             insn;                                                      \
+             insn = next_insn_same_func(file, insn))
+
 #define func_for_each_insn(file, func, insn)                            \
         for (insn = find_insn(file, func->sec, func->offset);           \
              insn && &insn->list != &file->insn_list &&                 \
@@ -149,10 +174,14 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
                         if (!strcmp(func->name, global_noreturns[i]))
                                 return 1;
 
-        if (!func->sec)
+        if (!func->len)
                 return 0;
 
-        func_for_each_insn(file, func, insn) {
+        insn = find_insn(file, func->sec, func->offset);
+        if (!insn->func)
+                return 0;
+
+        func_for_each_insn_all(file, func, insn) {
                 empty = false;
 
                 if (insn->type == INSN_RETURN)
@@ -167,35 +196,28 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
          * case, the function's dead-end status depends on whether the target
          * of the sibling call returns.
          */
-        func_for_each_insn(file, func, insn) {
-                if (insn->sec != func->sec ||
-                    insn->offset >= func->offset + func->len)
-                        break;
-
+        func_for_each_insn_all(file, func, insn) {
                 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
                         struct instruction *dest = insn->jump_dest;
-                        struct symbol *dest_func;
 
                         if (!dest)
                                 /* sibling call to another file */
                                 return 0;
 
-                        if (dest->sec != func->sec ||
-                            dest->offset < func->offset ||
-                            dest->offset >= func->offset + func->len) {
-                                /* local sibling call */
-                                dest_func = find_symbol_by_offset(dest->sec,
-                                                                  dest->offset);
-                                if (!dest_func)
-                                        continue;
+                        if (dest->func && dest->func->pfunc != insn->func->pfunc) {
 
+                                /* local sibling call */
                                 if (recursion == 5) {
-                                        WARN_FUNC("infinite recursion (objtool bug!)",
-                                                  dest->sec, dest->offset);
-                                        return -1;
+                                        /*
+                                         * Infinite recursion: two functions
+                                         * have sibling calls to each other.
+                                         * This is a very rare case.  It means
+                                         * they aren't dead ends.
+                                         */
+                                        return 0;
                                 }
 
-                                return __dead_end_function(file, dest_func,
+                                return __dead_end_function(file, dest->func,
                                                            recursion + 1);
                         }
                 }
@@ -422,7 +444,7 @@ static void add_ignores(struct objtool_file *file)
                         if (!ignore_func(file, func))
                                 continue;
 
-                        func_for_each_insn(file, func, insn)
+                        func_for_each_insn_all(file, func, insn)
                                 insn->ignore = true;
                 }
         }
@@ -782,30 +804,35 @@ out:
         return ret;
 }
 
-static int add_switch_table(struct objtool_file *file, struct symbol *func,
-                            struct instruction *insn, struct rela *table,
-                            struct rela *next_table)
+static int add_switch_table(struct objtool_file *file, struct instruction *insn,
+                            struct rela *table, struct rela *next_table)
 {
         struct rela *rela = table;
         struct instruction *alt_insn;
         struct alternative *alt;
+        struct symbol *pfunc = insn->func->pfunc;
+        unsigned int prev_offset = 0;
 
         list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) {
                 if (rela == next_table)
                         break;
 
-                if (rela->sym->sec != insn->sec ||
-                    rela->addend <= func->offset ||
-                    rela->addend >= func->offset + func->len)
+                /* Make sure the switch table entries are consecutive: */
+                if (prev_offset && rela->offset != prev_offset + 8)
                         break;
 
-                alt_insn = find_insn(file, insn->sec, rela->addend);
-                if (!alt_insn) {
-                        WARN("%s: can't find instruction at %s+0x%x",
-                             file->rodata->rela->name, insn->sec->name,
-                             rela->addend);
-                        return -1;
-                }
+                /* Detect function pointers from contiguous objects: */
+                if (rela->sym->sec == pfunc->sec &&
+                    rela->addend == pfunc->offset)
+                        break;
+
+                alt_insn = find_insn(file, rela->sym->sec, rela->addend);
+                if (!alt_insn)
+                        break;
+
+                /* Make sure the jmp dest is in the function or subfunction: */
+                if (alt_insn->func->pfunc != pfunc)
+                        break;
 
                 alt = malloc(sizeof(*alt));
                 if (!alt) {
@@ -815,6 +842,13 @@ static int add_switch_table(struct objtool_file *file, struct symbol *func,
 
                 alt->insn = alt_insn;
                 list_add_tail(&alt->list, &insn->alts);
+                prev_offset = rela->offset;
+        }
+
+        if (!prev_offset) {
+                WARN_FUNC("can't find switch jump table",
+                          insn->sec, insn->offset);
+                return -1;
         }
 
         return 0;
@@ -869,40 +903,21 @@ static struct rela *find_switch_table(struct objtool_file *file,
 {
         struct rela *text_rela, *rodata_rela;
         struct instruction *orig_insn = insn;
+        unsigned long table_offset;
 
-        text_rela = find_rela_by_dest_range(insn->sec, insn->offset, insn->len);
-        if (text_rela && text_rela->sym == file->rodata->sym) {
-                /* case 1 */
-                rodata_rela = find_rela_by_dest(file->rodata,
-                                                text_rela->addend);
-                if (rodata_rela)
-                        return rodata_rela;
-
-                /* case 2 */
-                rodata_rela = find_rela_by_dest(file->rodata,
-                                                text_rela->addend + 4);
-                if (!rodata_rela)
-                        return NULL;
-
-                file->ignore_unreachables = true;
-                return rodata_rela;
-        }
-
-        /* case 3 */
         /*
          * Backward search using the @first_jump_src links, these help avoid
          * much of the 'in between' code. Which avoids us getting confused by
          * it.
          */
-        for (insn = list_prev_entry(insn, list);
-
+        for (;
              &insn->list != &file->insn_list &&
              insn->sec == func->sec &&
              insn->offset >= func->offset;
 
              insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
 
-                if (insn->type == INSN_JUMP_DYNAMIC)
+                if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
                         break;
 
                 /* allow small jumps within the range */
@@ -918,18 +933,29 @@ static struct rela *find_switch_table(struct objtool_file *file,
                 if (!text_rela || text_rela->sym != file->rodata->sym)
                         continue;
 
+                table_offset = text_rela->addend;
+                if (text_rela->type == R_X86_64_PC32)
+                        table_offset += 4;
+
                 /*
                  * Make sure the .rodata address isn't associated with a
                  * symbol.  gcc jump tables are anonymous data.
                  */
-                if (find_symbol_containing(file->rodata, text_rela->addend))
+                if (find_symbol_containing(file->rodata, table_offset))
                         continue;
 
-                rodata_rela = find_rela_by_dest(file->rodata, text_rela->addend);
-                if (!rodata_rela)
-                        continue;
+                rodata_rela = find_rela_by_dest(file->rodata, table_offset);
+                if (rodata_rela) {
+                        /*
+                         * Use of RIP-relative switch jumps is quite rare, and
+                         * indicates a rare GCC quirk/bug which can leave dead
+                         * code behind.
+                         */
+                        if (text_rela->type == R_X86_64_PC32)
+                                file->ignore_unreachables = true;
 
-                return rodata_rela;
+                        return rodata_rela;
+                }
         }
 
         return NULL;
@@ -943,7 +969,7 @@ static int add_func_switch_tables(struct objtool_file *file,
         struct rela *rela, *prev_rela = NULL;
         int ret;
 
-        func_for_each_insn(file, func, insn) {
+        func_for_each_insn_all(file, func, insn) {
                 if (!last)
                         last = insn;
 
@@ -974,8 +1000,7 @@ static int add_func_switch_tables(struct objtool_file *file,
                  * the beginning of another switch table in the same function.
                  */
                 if (prev_jump) {
-                        ret = add_switch_table(file, func, prev_jump, prev_rela,
-                                               rela);
+                        ret = add_switch_table(file, prev_jump, prev_rela, rela);
                         if (ret)
                                 return ret;
                 }
@@ -985,7 +1010,7 @@ static int add_func_switch_tables(struct objtool_file *file,
         }
 
         if (prev_jump) {
-                ret = add_switch_table(file, func, prev_jump, prev_rela, NULL);
+                ret = add_switch_table(file, prev_jump, prev_rela, NULL);
                 if (ret)
                         return ret;
         }
@@ -1386,6 +1411,17 @@ static int update_insn_state(struct instruction *insn, struct insn_state *state)
                                 state->vals[op->dest.reg].offset = -state->stack_size;
                         }
 
+                        else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
+                                 cfa->base == CFI_BP) {
+
+                                /*
+                                 * mov %rbp, %rsp
+                                 *
+                                 * Restore the original stack pointer (Clang).
+                                 */
+                                state->stack_size = -state->regs[CFI_BP].offset;
+                        }
+
                         else if (op->dest.reg == cfa->base) {
 
                                 /* mov %reg, %rsp */
@@ -1738,15 +1774,13 @@ static int validate_branch(struct objtool_file *file, struct instruction *first,
         while (1) {
                 next_insn = next_insn_same_sec(file, insn);
 
-
-                if (file->c_file && func && insn->func && func != insn->func) {
+                if (file->c_file && func && insn->func && func != insn->func->pfunc) {
                         WARN("%s() falls through to next function %s()",
                              func->name, insn->func->name);
                         return 1;
                 }
 
-                if (insn->func)
-                        func = insn->func;
+                func = insn->func ? insn->func->pfunc : NULL;
 
                 if (func && insn->ignore) {
                         WARN_FUNC("BUG: why am I validating an ignored function?",
@@ -1767,7 +1801,7 @@ static int validate_branch(struct objtool_file *file, struct instruction *first,
 
                                 i = insn;
                                 save_insn = NULL;
-                                func_for_each_insn_continue_reverse(file, func, i) {
+                                func_for_each_insn_continue_reverse(file, insn->func, i) {
                                         if (i->save) {
                                                 save_insn = i;
                                                 break;
@@ -1854,7 +1888,7 @@ static int validate_branch(struct objtool_file *file, struct instruction *first,
                 case INSN_JUMP_UNCONDITIONAL:
                         if (insn->jump_dest &&
                             (!func || !insn->jump_dest->func ||
-                             func == insn->jump_dest->func)) {
+                             insn->jump_dest->func->pfunc == func)) {
                                 ret = validate_branch(file, insn->jump_dest,
                                                       state);
                                 if (ret)
@@ -2049,7 +2083,7 @@ static int validate_functions(struct objtool_file *file)
 
         for_each_sec(file, sec) {
                 list_for_each_entry(func, &sec->symbol_list, list) {
-                        if (func->type != STT_FUNC)
+                        if (func->type != STT_FUNC || func->pfunc != func)
                                 continue;
 
                         insn = find_insn(file, sec, func->offset);
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index c1c338661699..4e60e105583e 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -79,6 +79,19 @@ struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset)
         return NULL;
 }
 
+struct symbol *find_symbol_by_name(struct elf *elf, const char *name)
+{
+        struct section *sec;
+        struct symbol *sym;
+
+        list_for_each_entry(sec, &elf->sections, list)
+                list_for_each_entry(sym, &sec->symbol_list, list)
+                        if (!strcmp(sym->name, name))
+                                return sym;
+
+        return NULL;
+}
+
 struct symbol *find_symbol_containing(struct section *sec, unsigned long offset)
 {
         struct symbol *sym;
@@ -203,10 +216,11 @@ static int read_sections(struct elf *elf)
 
 static int read_symbols(struct elf *elf)
 {
-        struct section *symtab;
-        struct symbol *sym;
+        struct section *symtab, *sec;
+        struct symbol *sym, *pfunc;
         struct list_head *entry, *tmp;
         int symbols_nr, i;
+        char *coldstr;
 
         symtab = find_section_by_name(elf, ".symtab");
         if (!symtab) {
@@ -281,6 +295,30 @@ static int read_symbols(struct elf *elf)
                 hash_add(sym->sec->symbol_hash, &sym->hash, sym->idx);
         }
 
+        /* Create parent/child links for any cold subfunctions */
+        list_for_each_entry(sec, &elf->sections, list) {
+                list_for_each_entry(sym, &sec->symbol_list, list) {
+                        if (sym->type != STT_FUNC)
+                                continue;
+                        sym->pfunc = sym->cfunc = sym;
+                        coldstr = strstr(sym->name, ".cold.");
+                        if (coldstr) {
+                                coldstr[0] = '\0';
+                                pfunc = find_symbol_by_name(elf, sym->name);
+                                coldstr[0] = '.';
+
+                                if (!pfunc) {
+                                        WARN("%s(): can't find parent function",
+                                             sym->name);
+                                        goto err;
+                                }
+
+                                sym->pfunc = pfunc;
+                                pfunc->cfunc = sym;
+                        }
+                }
+        }
+
         return 0;
 
 err:
diff --git a/tools/objtool/elf.h b/tools/objtool/elf.h
index d86e2ff14466..de5cd2ddded9 100644
--- a/tools/objtool/elf.h
+++ b/tools/objtool/elf.h
@@ -61,6 +61,7 @@ struct symbol {
         unsigned char bind, type;
         unsigned long offset;
         unsigned int len;
+        struct symbol *pfunc, *cfunc;
 };
 
 struct rela {
@@ -86,6 +87,7 @@ struct elf {
 struct elf *elf_open(const char *name, int flags);
 struct section *find_section_by_name(struct elf *elf, const char *name);
 struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset);
+struct symbol *find_symbol_by_name(struct elf *elf, const char *name);
 struct symbol *find_symbol_containing(struct section *sec, unsigned long offset);
 struct rela *find_rela_by_dest(struct section *sec, unsigned long offset);
 struct rela *find_rela_by_dest_range(struct section *sec, unsigned long offset,
diff --git a/tools/perf/Documentation/perf-annotate.txt b/tools/perf/Documentation/perf-annotate.txt
index c635eab6af54..749cc6055dac 100644
--- a/tools/perf/Documentation/perf-annotate.txt
+++ b/tools/perf/Documentation/perf-annotate.txt
@@ -21,7 +21,7 @@ If there is no debug info in the object, then annotated assembly is displayed.
 OPTIONS
 -------
 -i::
---input=::
+--input=<file>::
         Input file name. (default: perf.data unless stdin is a fifo)
 
 -d::
@@ -55,6 +55,9 @@ OPTIONS
 --vmlinux=<file>::
         vmlinux pathname.
 
+--ignore-vmlinux::
+        Ignore vmlinux files.
+
 -m::
 --modules::
         Load module symbols. WARNING: use only with -k and LIVE kernel.
@@ -69,7 +72,9 @@ OPTIONS
 
 --stdio:: Use the stdio interface.
 
---stdio-color::
+--stdio2:: Use the stdio2 interface, non-interactive, uses the TUI formatting.
+
+--stdio-color=<mode>::
         'always', 'never' or 'auto', allowing configuring color output
         via the command line, in addition to via "color.ui" .perfconfig.
         Use '--stdio-color always' to generate color even when redirecting
@@ -84,7 +89,7 @@ OPTIONS
 --gtk:: Use the GTK interface.
 
 -C::
---cpu:: Only report samples for the list of CPUs provided. Multiple CPUs can
+--cpu=<cpu>:: Only report samples for the list of CPUs provided. Multiple CPUs can
         be provided as a comma-separated list with no space: 0,1. Ranges of
         CPUs are specified with -: 0-2. Default is to report samples on all
         CPUs.
diff --git a/tools/perf/Documentation/perf-c2c.txt b/tools/perf/Documentation/perf-c2c.txt
index 822414235170..095aebdc5bb7 100644
--- a/tools/perf/Documentation/perf-c2c.txt
+++ b/tools/perf/Documentation/perf-c2c.txt
@@ -116,7 +116,7 @@ and calls standard perf record command.
 Following perf record options are configured by default:
 (check perf record man page for details)
 
-  -W,-d,--sample-cpu
+  -W,-d,--phys-data,--sample-cpu
 
 Unless specified otherwise with '-e' option, following events are monitored by
 default:
diff --git a/tools/perf/Documentation/perf-config.txt b/tools/perf/Documentation/perf-config.txt
index 5b4fff3adc4b..32f4a898e3f2 100644
--- a/tools/perf/Documentation/perf-config.txt
+++ b/tools/perf/Documentation/perf-config.txt
@@ -334,6 +334,11 @@ annotate.*::
 
                 99.93 │      mov    %eax,%eax
 
+        annotate.offset_level::
+                Default is '1', meaning just jump targets will have offsets show right beside
+                the instruction. When set to '2' 'call' instructions will also have its offsets
+                shown, 3 or higher will show offsets for all instructions.
+
 hist.*::
         hist.percentage::
                 This option control the way to calculate overhead of filtered entries -
diff --git a/tools/perf/Documentation/perf-data.txt b/tools/perf/Documentation/perf-data.txt
index 90bb4aabe4f8..c87180764829 100644
--- a/tools/perf/Documentation/perf-data.txt
+++ b/tools/perf/Documentation/perf-data.txt
@@ -1,5 +1,5 @@
 perf-data(1)
-==============
+============
 
 NAME
 ----
diff --git a/tools/perf/Documentation/perf-ftrace.txt b/tools/perf/Documentation/perf-ftrace.txt
index 721a447f046e..b80c84307dc9 100644
--- a/tools/perf/Documentation/perf-ftrace.txt
+++ b/tools/perf/Documentation/perf-ftrace.txt
@@ -1,5 +1,5 @@
 perf-ftrace(1)
-=============
+==============
 
 NAME
 ----
diff --git a/tools/perf/Documentation/perf-kallsyms.txt b/tools/perf/Documentation/perf-kallsyms.txt
index cf9f4040ea5c..f3c620951f6e 100644
--- a/tools/perf/Documentation/perf-kallsyms.txt
+++ b/tools/perf/Documentation/perf-kallsyms.txt
@@ -1,5 +1,5 @@
 perf-kallsyms(1)
-==============
+================
 
 NAME
 ----
diff --git a/tools/perf/Documentation/perf-kmem.txt b/tools/perf/Documentation/perf-kmem.txt
index 479fc3261a50..85b8ac695c87 100644
--- a/tools/perf/Documentation/perf-kmem.txt
+++ b/tools/perf/Documentation/perf-kmem.txt
@@ -25,6 +25,10 @@ OPTIONS
 --input=<file>::
         Select the input file (default: perf.data unless stdin is a fifo)
 
+-f::
+--force::
+        Don't do ownership validation
+
 -v::
 --verbose::
         Be more verbose. (show symbol address, etc)
@@ -61,7 +65,7 @@ OPTIONS
         default, but this option shows live (currently allocated) pages
         instead.  (This option works with --page option only)
 
---time::
+--time=<start>,<stop>::
         Only analyze samples within given time window: <start>,<stop>. Times
         have the format seconds.microseconds. If start is not given (i.e., time
         string is ',x.y') then analysis starts at the beginning of the file. If
diff --git a/tools/perf/Documentation/perf-list.txt b/tools/perf/Documentation/perf-list.txt
index e2a897ae3596..2549c34a7895 100644
--- a/tools/perf/Documentation/perf-list.txt
+++ b/tools/perf/Documentation/perf-list.txt
@@ -141,7 +141,13 @@ on the first memory controller on socket 0 of a Intel Xeon system
 
 Each memory controller has its own PMU.  Measuring the complete system
 bandwidth would require specifying all imc PMUs (see perf list output),
-and adding the values together.
+and adding the values together. To simplify creation of multiple events,
+prefix and glob matching is supported in the PMU name, and the prefix
+'uncore_' is also ignored when performing the match. So the command above
+can be expanded to all memory controllers by using the syntaxes:
+
+  perf stat -C 0 -a imc/cas_count_read/,imc/cas_count_write/ -I 1000 ...
+  perf stat -C 0 -a *imc*/cas_count_read/,*imc*/cas_count_write/ -I 1000 ...
 
 This example measures the combined core power every second
 
diff --git a/tools/perf/Documentation/perf-mem.txt b/tools/perf/Documentation/perf-mem.txt
index 4be08a1e3f8d..f8d2167cf3e7 100644
--- a/tools/perf/Documentation/perf-mem.txt
+++ b/tools/perf/Documentation/perf-mem.txt
@@ -28,25 +28,46 @@ OPTIONS
 <command>...::
         Any command you can specify in a shell.
 
+-i::
+--input=<file>::
+        Input file name.
+
+-f::
+--force::
+        Don't do ownership validation
+
 -t::
---type=::
+--type=<type>::
         Select the memory operation type: load or store (default: load,store)
 
 -D::
---dump-raw-samples=::
+--dump-raw-samples::
         Dump the raw decoded samples on the screen in a format that is easy to parse with
         one sample per line.
 
 -x::
---field-separator::
+--field-separator=<separator>::
         Specify the field separator used when dump raw samples (-D option). By default,
         The separator is the space character.
 
 -C::
---cpu-list::
-        Restrict dump of raw samples to those provided via this option. Note that the same
-        option can be passed in record mode. It will be interpreted the same way as perf
-        record.
+--cpu=<cpu>::
+        Monitor only on the list of CPUs provided. Multiple CPUs can be provided as a
+        comma-separated list with no space: 0,1. Ranges of CPUs are specified with -: 0-2. Default
+        is to monitor all CPUS.
+-U::
+--hide-unresolved::
+        Only display entries resolved to a symbol.
+
+-p::
+--phys-data::
+        Record/Report sample physical addresses
+
+RECORD OPTIONS
+--------------
+-e::
+--event <event>::
+        Event selector. Use 'perf mem record -e list' to list available events.
 
 -K::
 --all-kernel::
@@ -56,12 +77,15 @@ OPTIONS
 --all-user::
         Configure all used events to run in user space.
 
---ldload::
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc)
+
+--ldlat <n>::
         Specify desired latency for loads event.
 
--p::
---phys-data::
-        Record/Report sample physical addresses
+In addition, for report all perf report options are valid, and for record
+all perf record options.
 
 SEE ALSO
 --------
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 3eea6de35a38..cc37b3a4be76 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -191,9 +191,16 @@ OPTIONS
 -i::
 --no-inherit::
         Child tasks do not inherit counters.
+
 -F::
 --freq=::
-        Profile at this frequency.
+        Profile at this frequency. Use 'max' to use the currently maximum
+        allowed frequency, i.e. the value in the kernel.perf_event_max_sample_rate
+        sysctl. Will throttle down to the currently maximum allowed frequency.
+        See --strict-freq.
+
+--strict-freq::
+        Fail if the specified frequency can't be used.
 
 -m::
 --mmap-pages=::
@@ -308,7 +315,11 @@ can be provided. Each cgroup is applied to the corresponding event, i.e., first
 to first event, second cgroup to second event and so on. It is possible to provide
 an empty cgroup (monitor all the time) using, e.g., -G foo,,bar. Cgroups must have
 corresponding events, i.e., they always refer to events defined earlier on the command
-line.
+line. If the user wants to track multiple events for a specific cgroup, the user can
+use '-e e1 -e e2 -G foo,foo' or just use '-e e1 -e e2 -G foo'.
+
+If wanting to monitor, say, 'cycles' for a cgroup and also for system wide, this
+command line can be used: 'perf stat -e cycles -G cgroup_name -a -e cycles'.
 
 -b::
 --branch-any::
diff --git a/tools/perf/Documentation/perf-report.txt b/tools/perf/Documentation/perf-report.txt
index 907e505b6309..917e36fde6d8 100644
--- a/tools/perf/Documentation/perf-report.txt
+++ b/tools/perf/Documentation/perf-report.txt
@@ -80,6 +80,7 @@ OPTIONS
         - comm: command (name) of the task which can be read via /proc/<pid>/comm
         - pid: command and tid of the task
         - dso: name of library or module executed at the time of sample
+        - dso_size: size of library or module executed at the time of sample
         - symbol: name of function executed at the time of sample
         - symbol_size: size of function executed at the time of sample
         - parent: name of function matched to the parent regex filter. Unmatched
@@ -296,6 +297,9 @@ OPTIONS
 --vmlinux=<file>::
         vmlinux pathname
 
+--ignore-vmlinux::
+        Ignore vmlinux files.
+
 --kallsyms=<file>::
         kallsyms pathname
 
@@ -354,7 +358,8 @@ OPTIONS
         Path to objdump binary.
 
 --group::
-        Show event group information together.
+        Show event group information together. It forces group output also
+        if there are no groups defined in data file.
 
 --demangle::
         Demangle symbol names to human readable form. It's enabled by default,
@@ -367,7 +372,7 @@ OPTIONS
         Use the data addresses of samples in addition to instruction addresses
         to build the histograms.  To generate meaningful output, the perf.data
         file must have been obtained using perf record -d -W and using a
-        special event -e cpu/mem-loads/ or -e cpu/mem-stores/. See
+        special event -e cpu/mem-loads/p or -e cpu/mem-stores/p. See
         'perf mem' for simpler access.
 
 --percent-limit::
diff --git a/tools/perf/Documentation/perf-sched.txt b/tools/perf/Documentation/perf-sched.txt
index c7e50f263887..63f938b887dd 100644
--- a/tools/perf/Documentation/perf-sched.txt
+++ b/tools/perf/Documentation/perf-sched.txt
@@ -1,5 +1,5 @@
 perf-sched(1)
-==============
+=============
 
 NAME
 ----
@@ -104,8 +104,8 @@ OPTIONS for 'perf sched timehist'
     kallsyms pathname
 
 -g::
---no-call-graph::
-        Do not display call chains if present.
+--call-graph::
+        Display call chains if present (default on).
 
 --max-stack::
         Maximum number of functions to display in backtrace, default 5.
diff --git a/tools/perf/Documentation/perf-script-perl.txt b/tools/perf/Documentation/perf-script-perl.txt
index 142606c0ec9c..5a1f68122f50 100644
--- a/tools/perf/Documentation/perf-script-perl.txt
+++ b/tools/perf/Documentation/perf-script-perl.txt
@@ -1,5 +1,5 @@
 perf-script-perl(1)
-==================
+===================
 
 NAME
 ----
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index 7730c1d2b5d3..afdafe2110a1 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -228,14 +228,15 @@ OPTIONS
         For sample events it's possible to display misc field with -F +misc option,
         following letters are displayed for each bit:
 
-          PERF_RECORD_MISC_KERNEL        K
-          PERF_RECORD_MISC_USER          U
-          PERF_RECORD_MISC_HYPERVISOR    H
-          PERF_RECORD_MISC_GUEST_KERNEL  G
-          PERF_RECORD_MISC_GUEST_USER    g
-          PERF_RECORD_MISC_MMAP_DATA*    M
-          PERF_RECORD_MISC_COMM_EXEC     E
-          PERF_RECORD_MISC_SWITCH_OUT    S
+          PERF_RECORD_MISC_KERNEL               K
+          PERF_RECORD_MISC_USER                 U
+          PERF_RECORD_MISC_HYPERVISOR           H
+          PERF_RECORD_MISC_GUEST_KERNEL         G
+          PERF_RECORD_MISC_GUEST_USER           g
+          PERF_RECORD_MISC_MMAP_DATA*           M
+          PERF_RECORD_MISC_COMM_EXEC            E
+          PERF_RECORD_MISC_SWITCH_OUT           S
+          PERF_RECORD_MISC_SWITCH_OUT_PREEMPT   Sp
 
           $ perf script -F +misc ...
            sched-messaging  1414 K     28690.636582:       4590 cycles ...
@@ -303,6 +304,9 @@ OPTIONS
 --show-lost-events
         Display lost events i.e. events of type PERF_RECORD_LOST.
 
+--show-round-events
+        Display finished round events i.e. events of type PERF_RECORD_FINISHED_ROUND.
+
 --demangle::
         Demangle symbol names to human readable form. It's enabled by default,
         disable with --no-demangle.
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 823fce7674bb..e6c3b4e555c2 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -49,6 +49,13 @@ report::
           parameters are defined by corresponding entries in
           /sys/bus/event_source/devices/<pmu>/format/*
 
+        Note that the last two syntaxes support prefix and glob matching in
+        the PMU name to simplify creation of events accross multiple instances
+        of the same type of PMU in large systems (e.g. memory controller PMUs).
+        Multiple PMU instances are typical for uncore PMUs, so the prefix
+        'uncore_' is also ignored when performing this match.
+
+
 -i::
 --no-inherit::
         child tasks do not inherit counters
@@ -118,7 +125,11 @@ can be provided. Each cgroup is applied to the corresponding event, i.e., first
 to first event, second cgroup to second event and so on. It is possible to provide
 an empty cgroup (monitor all the time) using, e.g., -G foo,,bar. Cgroups must have
 corresponding events, i.e., they always refer to events defined earlier on the command
-line.
+line. If the user wants to track multiple events for a specific cgroup, the user can
+use '-e e1 -e e2 -G foo,foo' or just use '-e e1 -e e2 -G foo'.
+
+If wanting to monitor, say, 'cycles' for a cgroup and also for system wide, this
+command line can be used: 'perf stat -e cycles -G cgroup_name -a -e cycles'.
 
 -o file::
 --output file::
@@ -142,10 +153,20 @@ perf stat --repeat 10 --null --sync --pre 'make -s O=defconfig-build/clean' -- m
 
 -I msecs::
 --interval-print msecs::
-Print count deltas every N milliseconds (minimum: 10ms)
+Print count deltas every N milliseconds (minimum: 1ms)
 The overhead percentage could be high in some cases, for instance with small, sub 100ms intervals.  Use with caution.
         example: 'perf stat -I 1000 -e cycles -a sleep 5'
 
+--interval-count times::
+Print count deltas for fixed number of times.
+This option should be used together with "-I" option.
+        example: 'perf stat -I 1000 --interval-count 2 -e cycles -a'
+
+--timeout msecs::
+Stop the 'perf stat' session and print count deltas after N milliseconds (minimum: 10 ms).
+This option is not supported with the "-I" option.
+        example: 'perf stat --time 2000 -e cycles -a'
+
 --metric-only::
 Only print computed metrics. Print them in a single line.
 Don't show any raw values. Not supported with --per-thread.
@@ -246,6 +267,16 @@ taskset.
 --no-merge::
 Do not merge results from same PMUs.
 
+When multiple events are created from a single event specification,
+stat will, by default, aggregate the event counts and show the result
+in a single row. This option disables that behavior and shows
+the individual events and counts.
+
+Multiple events are created from a single event specification when:
+1. Prefix or glob matching is used for the PMU name.
+2. Aliases, which are listed immediately after the Kernel PMU events
+   by perf list, are used.
+
 --smi-cost::
 Measure SMI cost if msr/aperf/ and msr/smi/ events are supported.
 
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index 8a32cc77bead..114fda12aa49 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -55,7 +55,9 @@ Default is to monitor all CPUS.
 
 -F <freq>::
 --freq=<freq>::
-        Profile at this frequency.
+        Profile at this frequency. Use 'max' to use the currently maximum
+        allowed frequency, i.e. the value in the kernel.perf_event_max_sample_rate
+        sysctl.
 
 -i::
 --inherit::
@@ -65,6 +67,9 @@ Default is to monitor all CPUS.
 --vmlinux=<path>::
         Path to vmlinux.  Required for annotation functionality.
 
+--ignore-vmlinux::
+        Ignore vmlinux files.
+
 -m <pages>::
 --mmap-pages=<pages>::
         Number of mmap data pages (must be a power of two) or size
diff --git a/tools/perf/Documentation/perf-trace.txt b/tools/perf/Documentation/perf-trace.txt
index 33a88e984e66..115db9e06ecd 100644
--- a/tools/perf/Documentation/perf-trace.txt
+++ b/tools/perf/Documentation/perf-trace.txt
@@ -63,6 +63,31 @@ filter out the startup phase of the program, which is often very different.
 --uid=::
         Record events in threads owned by uid. Name or number.
 
+-G::
+--cgroup::
+        Record events in threads in a cgroup.
+
+        Look for cgroups to set at the /sys/fs/cgroup/perf_event directory, then
+        remove the /sys/fs/cgroup/perf_event/ part and try:
+
+                perf trace -G A -e sched:*switch
+
+        Will set all raw_syscalls:sys_{enter,exit}, pgfault, vfs_getname, etc
+        _and_ sched:sched_switch to the 'A' cgroup, while:
+
+                perf trace -e sched:*switch -G A
+
+        will only set the sched:sched_switch event to the 'A' cgroup, all the
+        other events (raw_syscalls:sys_{enter,exit}, etc are left "without"
+        a cgroup (on the root cgroup, sys wide, etc).
+
+        Multiple cgroups:
+
+                perf trace -G A -e sched:*switch -G B
+
+        the syscall ones go to the 'A' cgroup, the sched:sched_switch goes
+        to the 'B' cgroup.
+
 --filter-pids=::
         Filter out events for these pids and for 'trace' itself (comma separated list).
 
@@ -92,6 +117,9 @@ the thread executes on the designated CPUs. Default is to monitor all CPUs.
 --sched::
         Accrue thread runtime and provide a summary at the end of the session.
 
+--failure::
+        Show only syscalls that failed, i.e. that returned < 0.
+
 -i::
 --input::
         Process events from a given perf data file.
diff --git a/tools/perf/Documentation/perf-version.txt b/tools/perf/Documentation/perf-version.txt
new file mode 100644
index 000000000000..e207b7cfca26
--- /dev/null
+++ b/tools/perf/Documentation/perf-version.txt
@@ -0,0 +1,24 @@
+perf-version(1)
+===============
+
+NAME
+----
+perf-version - display the version of perf binary
+
+SYNOPSIS
+--------
+'perf version' [--build-options]
+
+DESCRIPTION
+-----------
+With no options given, the 'perf version' prints the perf version
+on the standard output.
+
+If the option '--build-options' is given, then the status of
+compiled-in libraries are printed on the standard output.
+
+OPTIONS
+-------
+--build-options::
+        Prints the status of compiled-in libraries on the
+        standard output.
diff --git a/tools/perf/Documentation/perf.data-file-format.txt b/tools/perf/Documentation/perf.data-file-format.txt
index f7d85e89a98a..d00f0d51cab8 100644
--- a/tools/perf/Documentation/perf.data-file-format.txt
+++ b/tools/perf/Documentation/perf.data-file-format.txt
@@ -485,10 +485,5 @@ in pmu-tools parser. This allows to read perf.data from python and dump it.
 quipper
 
 The quipper C++ parser is available at
-https://chromium.googlesource.com/chromiumos/platform2
+http://github.com/google/perf_data_converter/tree/master/src/quipper
 
-It is under the chromiumos-wide-profiling/ subdirectory. This library can
-convert a perf data file to a protobuf and vice versa.
-
-Unfortunately this parser tends to be many versions behind and may not be able
-to parse data files generated by recent perf.
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index 0dfdaa9fa81e..ae7dc46e8f8a 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -27,6 +27,8 @@ NO_SYSCALL_TABLE := 1
 # Additional ARCH settings for ppc
 ifeq ($(SRCARCH),powerpc)
   NO_PERF_REGS := 0
+  NO_SYSCALL_TABLE := 0
+  CFLAGS += -I$(OUTPUT)arch/powerpc/include/generated
   LIBUNWIND_LIBS := -lunwind -lunwind-ppc64
 endif
 
@@ -66,14 +68,14 @@ ifeq ($(NO_PERF_REGS),0)
 endif
 
 ifneq ($(NO_SYSCALL_TABLE),1)
-  CFLAGS += -DHAVE_SYSCALL_TABLE
+  CFLAGS += -DHAVE_SYSCALL_TABLE_SUPPORT
 endif
 
 # So far there's only x86 and arm libdw unwind support merged in perf.
 # Disable it on all other architectures in case libdw unwind
 # support is detected in system. Add supported architectures
 # to the check.
-ifneq ($(SRCARCH),$(filter $(SRCARCH),x86 arm powerpc s390))
+ifneq ($(SRCARCH),$(filter $(SRCARCH),x86 arm arm64 powerpc s390))
   NO_LIBDW_DWARF_UNWIND := 1
 endif
 
@@ -344,12 +346,16 @@ else
       ifneq ($(feature-dwarf_getlocations), 1)
         msg := $(warning Old libdw.h, finding variables at given 'perf probe' point will not work, install elfutils-devel/libdw-dev >= 0.157);
       else
-        CFLAGS += -DHAVE_DWARF_GETLOCATIONS
+        CFLAGS += -DHAVE_DWARF_GETLOCATIONS_SUPPORT
       endif # dwarf_getlocations
     endif # Dwarf support
   endif # libelf support
 endif # NO_LIBELF
 
+ifeq ($(feature-glibc), 1)
+  CFLAGS += -DHAVE_GLIBC_SUPPORT
+endif
+
 ifdef NO_DWARF
   NO_LIBDW_DWARF_UNWIND := 1
 endif
@@ -633,6 +639,7 @@ else
   else
     LDFLAGS += $(PERL_EMBED_LDFLAGS)
     EXTLIBS += $(PERL_EMBED_LIBADD)
+    CFLAGS += -DHAVE_LIBPERL_SUPPORT
     $(call detected,CONFIG_LIBPERL)
   endif
 endif
@@ -666,25 +673,11 @@ else
       ifneq ($(feature-libpython), 1)
         $(call disable-python,No 'Python.h' (for Python 2.x support) was found: disables Python support - please install python-devel/python-dev)
       else
-        ifneq ($(feature-libpython-version), 1)
-          $(warning Python 3 is not yet supported; please set)
-          $(warning PYTHON and/or PYTHON_CONFIG appropriately.)
-          $(warning If you also have Python 2 installed, then)
-          $(warning try something like:)
-          $(warning $(and ,))
-          $(warning $(and ,)  make PYTHON=python2)
-          $(warning $(and ,))
-          $(warning Otherwise, disable Python support entirely:)
-          $(warning $(and ,))
-          $(warning $(and ,)  make NO_LIBPYTHON=1)
-          $(warning $(and ,))
-          $(error   $(and ,))
-        else
-          LDFLAGS += $(PYTHON_EMBED_LDFLAGS)
-          EXTLIBS += $(PYTHON_EMBED_LIBADD)
-          LANG_BINDINGS += $(obj-perf)python/perf.so
-          $(call detected,CONFIG_LIBPYTHON)
-        endif
+         LDFLAGS += $(PYTHON_EMBED_LDFLAGS)
+         EXTLIBS += $(PYTHON_EMBED_LIBADD)
+         LANG_BINDINGS += $(obj-perf)python/perf.so
+         CFLAGS += -DHAVE_LIBPYTHON_SUPPORT
+         $(call detected,CONFIG_LIBPYTHON)
       endif
     endif
   endif
@@ -854,7 +847,7 @@ ifndef NO_JVMTI
   ifeq ($(feature-jvmti), 1)
     $(call detected_var,JDIR)
   else
-    $(warning No openjdk development package found, please install JDK package)
+    $(warning No openjdk development package found, please install JDK package, e.g. openjdk-8-jdk, java-1.8.0-openjdk-devel)
     NO_JVMTI := 1
   endif
 endif
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 012328038594..83e453de36f8 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -296,7 +296,7 @@ PYTHON_EXTBUILD_LIB := $(PYTHON_EXTBUILD)lib/
 PYTHON_EXTBUILD_TMP := $(PYTHON_EXTBUILD)tmp/
 export PYTHON_EXTBUILD_LIB PYTHON_EXTBUILD_TMP
 
-python-clean := $(call QUIET_CLEAN, python) $(RM) -r $(PYTHON_EXTBUILD) $(OUTPUT)python/perf.so
+python-clean := $(call QUIET_CLEAN, python) $(RM) -r $(PYTHON_EXTBUILD) $(OUTPUT)python/perf*.so
 
 PYTHON_EXT_SRCS := $(shell grep -v ^\# util/python-ext-sources)
 PYTHON_EXT_DEPS := util/python-ext-sources util/setup.py $(LIBTRACEEVENT) $(LIBAPI)
@@ -364,7 +364,8 @@ LIBS = -Wl,--whole-archive $(PERFLIBS) $(EXTRA_PERFLIBS) -Wl,--no-whole-archive
 
 ifeq ($(USE_CLANG), 1)
   CLANGLIBS_LIST = AST Basic CodeGen Driver Frontend Lex Tooling Edit Sema Analysis Parse Serialization
-  LIBCLANG = $(foreach l,$(CLANGLIBS_LIST),$(wildcard $(shell $(LLVM_CONFIG) --libdir)/libclang$(l).a))
+  CLANGLIBS_NOEXT_LIST = $(foreach l,$(CLANGLIBS_LIST),$(shell $(LLVM_CONFIG) --libdir)/libclang$(l))
+  LIBCLANG = $(foreach l,$(CLANGLIBS_NOEXT_LIST),$(wildcard $(l).a $(l).so))
   LIBS += -Wl,--start-group $(LIBCLANG) -Wl,--end-group
 endif
 
@@ -473,7 +474,7 @@ $(OUTPUT)python/perf.so: $(PYTHON_EXT_SRCS) $(PYTHON_EXT_DEPS) $(LIBTRACEEVENT_D
           $(PYTHON_WORD) util/setup.py \
           --quiet build_ext; \
         mkdir -p $(OUTPUT)python && \
-        cp $(PYTHON_EXTBUILD_LIB)perf.so $(OUTPUT)python/
+        cp $(PYTHON_EXTBUILD_LIB)perf*.so $(OUTPUT)python/
 
 please_set_SHELL_PATH_to_a_more_modern_shell:
         $(Q)$$(:)
@@ -708,15 +709,15 @@ TAG_FILES= ../../include/uapi/linux/perf_event.h
 
 TAGS:
         $(QUIET_GEN)$(RM) TAGS; \
-        $(FIND) $(TAG_FOLDERS) -name '*.[hcS]' -print | xargs etags -a $(TAG_FILES)
+        $(FIND) $(TAG_FOLDERS) -name '*.[hcS]' -print -o -name '*.cpp' -print | xargs etags -a $(TAG_FILES)
 
 tags:
         $(QUIET_GEN)$(RM) tags; \
-        $(FIND) $(TAG_FOLDERS) -name '*.[hcS]' -print | xargs ctags -a $(TAG_FILES)
+        $(FIND) $(TAG_FOLDERS) -name '*.[hcS]' -print -o -name '*.cpp' -print | xargs ctags -a $(TAG_FILES)
 
 cscope:
         $(QUIET_GEN)$(RM) cscope*; \
-        $(FIND) $(TAG_FOLDERS) -name '*.[hcS]' -print | xargs cscope -b $(TAG_FILES)
+        $(FIND) $(TAG_FOLDERS) -name '*.[hcS]' -print -o -name '*.cpp' -print | xargs cscope -b $(TAG_FILES)
 
 ### Testing rules
 
diff --git a/tools/perf/arch/arm/include/arch-tests.h b/tools/perf/arch/arm/include/arch-tests.h
new file mode 100644
index 000000000000..90ec4c8cb880
--- /dev/null
+++ b/tools/perf/arch/arm/include/arch-tests.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef ARCH_TESTS_H
+#define ARCH_TESTS_H
+
+#ifdef HAVE_DWARF_UNWIND_SUPPORT
+struct thread;
+struct perf_sample;
+#endif
+
+extern struct test arch_tests[];
+
+#endif
diff --git a/tools/perf/arch/arm/tests/Build b/tools/perf/arch/arm/tests/Build
index b30eff9bcc83..883c57ff0c08 100644
--- a/tools/perf/arch/arm/tests/Build
+++ b/tools/perf/arch/arm/tests/Build
@@ -1,2 +1,4 @@
 libperf-y += regs_load.o
 libperf-y += dwarf-unwind.o
+
+libperf-y += arch-tests.o
diff --git a/tools/perf/arch/arm/tests/arch-tests.c b/tools/perf/arch/arm/tests/arch-tests.c
new file mode 100644
index 000000000000..5b1543c98022
--- /dev/null
+++ b/tools/perf/arch/arm/tests/arch-tests.c
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <string.h>
+#include "tests/tests.h"
+#include "arch-tests.h"
+
+struct test arch_tests[] = {
+#ifdef HAVE_DWARF_UNWIND_SUPPORT
+        {
+                .desc = "DWARF unwind",
+                .func = test__dwarf_unwind,
+        },
+#endif
+        {
+                .func = NULL,
+        },
+};
diff --git a/tools/perf/arch/arm/util/auxtrace.c b/tools/perf/arch/arm/util/auxtrace.c
index 2323581b157d..1ce6bdbda561 100644
--- a/tools/perf/arch/arm/util/auxtrace.c
+++ b/tools/perf/arch/arm/util/auxtrace.c
@@ -1,18 +1,7 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright(C) 2015 Linaro Limited. All rights reserved.
  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <stdbool.h>
@@ -68,7 +57,7 @@ struct auxtrace_record
         bool found_spe = false;
         static struct perf_pmu **arm_spe_pmus = NULL;
         static int nr_spes = 0;
-        int i;
+        int i = 0;
 
         if (!evlist)
                 return NULL;
diff --git a/tools/perf/arch/arm/util/cs-etm.c b/tools/perf/arch/arm/util/cs-etm.c
index fbfc055d3f4d..2f595cd73da6 100644
--- a/tools/perf/arch/arm/util/cs-etm.c
+++ b/tools/perf/arch/arm/util/cs-etm.c
@@ -1,18 +1,7 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright(C) 2015 Linaro Limited. All rights reserved.
  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <api/fs/fs.h>
@@ -298,12 +287,17 @@ cs_etm_info_priv_size(struct auxtrace_record *itr __maybe_unused,
 {
         int i;
         int etmv3 = 0, etmv4 = 0;
-        const struct cpu_map *cpus = evlist->cpus;
+        struct cpu_map *event_cpus = evlist->cpus;
+        struct cpu_map *online_cpus = cpu_map__new(NULL);
 
         /* cpu map is not empty, we have specific CPUs to work with */
-        if (!cpu_map__empty(cpus)) {
-                for (i = 0; i < cpu_map__nr(cpus); i++) {
-                        if (cs_etm_is_etmv4(itr, cpus->map[i]))
+        if (!cpu_map__empty(event_cpus)) {
+                for (i = 0; i < cpu__max_cpu(); i++) {
+                        if (!cpu_map__has(event_cpus, i) ||
+                            !cpu_map__has(online_cpus, i))
+                                continue;
+
+                        if (cs_etm_is_etmv4(itr, i))
                                 etmv4++;
                         else
                                 etmv3++;
@@ -311,6 +305,9 @@ cs_etm_info_priv_size(struct auxtrace_record *itr __maybe_unused,
         } else {
                 /* get configuration for all CPUs in the system */
                 for (i = 0; i < cpu__max_cpu(); i++) {
+                        if (!cpu_map__has(online_cpus, i))
+                                continue;
+
                         if (cs_etm_is_etmv4(itr, i))
                                 etmv4++;
                         else
@@ -318,6 +315,8 @@ cs_etm_info_priv_size(struct auxtrace_record *itr __maybe_unused,
                 }
         }
 
+        cpu_map__put(online_cpus);
+
         return (CS_ETM_HEADER_SIZE +
                (etmv4 * CS_ETMV4_PRIV_SIZE) +
                (etmv3 * CS_ETMV3_PRIV_SIZE));
@@ -447,7 +446,9 @@ static int cs_etm_info_fill(struct auxtrace_record *itr,
         int i;
         u32 offset;
         u64 nr_cpu, type;
-        const struct cpu_map *cpus = session->evlist->cpus;
+        struct cpu_map *cpu_map;
+        struct cpu_map *event_cpus = session->evlist->cpus;
+        struct cpu_map *online_cpus = cpu_map__new(NULL);
         struct cs_etm_recording *ptr =
                         container_of(itr, struct cs_etm_recording, itr);
         struct perf_pmu *cs_etm_pmu = ptr->cs_etm_pmu;
@@ -458,8 +459,21 @@ static int cs_etm_info_fill(struct auxtrace_record *itr,
         if (!session->evlist->nr_mmaps)
                 return -EINVAL;
 
-        /* If the cpu_map is empty all CPUs are involved */
-        nr_cpu = cpu_map__empty(cpus) ? cpu__max_cpu() : cpu_map__nr(cpus);
+        /* If the cpu_map is empty all online CPUs are involved */
+        if (cpu_map__empty(event_cpus)) {
+                cpu_map = online_cpus;
+        } else {
+                /* Make sure all specified CPUs are online */
+                for (i = 0; i < cpu_map__nr(event_cpus); i++) {
+                        if (cpu_map__has(event_cpus, i) &&
+                            !cpu_map__has(online_cpus, i))
+                                return -EINVAL;
+                }
+
+                cpu_map = event_cpus;
+        }
+
+        nr_cpu = cpu_map__nr(cpu_map);
         /* Get PMU type as dynamically assigned by the core */
         type = cs_etm_pmu->type;
 
@@ -472,15 +486,11 @@ static int cs_etm_info_fill(struct auxtrace_record *itr,
 
         offset = CS_ETM_SNAPSHOT + 1;
 
-        /* cpu map is not empty, we have specific CPUs to work with */
-        if (!cpu_map__empty(cpus)) {
-                for (i = 0; i < cpu_map__nr(cpus) && offset < priv_size; i++)
-                        cs_etm_get_metadata(cpus->map[i], &offset, itr, info);
-        } else {
-                /* get configuration for all CPUs in the system */
-                for (i = 0; i < cpu__max_cpu(); i++)
+        for (i = 0; i < cpu__max_cpu() && offset < priv_size; i++)
+                if (cpu_map__has(cpu_map, i))
                         cs_etm_get_metadata(i, &offset, itr, info);
-        }
+
+        cpu_map__put(online_cpus);
 
         return 0;
 }
diff --git a/tools/perf/arch/arm/util/cs-etm.h b/tools/perf/arch/arm/util/cs-etm.h
index 5256741be549..1a12e64f5127 100644
--- a/tools/perf/arch/arm/util/cs-etm.h
+++ b/tools/perf/arch/arm/util/cs-etm.h
@@ -1,18 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright(C) 2015 Linaro Limited. All rights reserved.
  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef INCLUDE__PERF_CS_ETM_H__
diff --git a/tools/perf/arch/arm/util/pmu.c b/tools/perf/arch/arm/util/pmu.c
index ac4dffc807b8..e047571e6080 100644
--- a/tools/perf/arch/arm/util/pmu.c
+++ b/tools/perf/arch/arm/util/pmu.c
@@ -1,18 +1,7 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright(C) 2015 Linaro Limited. All rights reserved.
  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <string.h>
diff --git a/tools/perf/arch/arm64/include/arch-tests.h b/tools/perf/arch/arm64/include/arch-tests.h
new file mode 100644
index 000000000000..90ec4c8cb880
--- /dev/null
+++ b/tools/perf/arch/arm64/include/arch-tests.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef ARCH_TESTS_H
+#define ARCH_TESTS_H
+
+#ifdef HAVE_DWARF_UNWIND_SUPPORT
+struct thread;
+struct perf_sample;
+#endif
+
+extern struct test arch_tests[];
+
+#endif
diff --git a/tools/perf/arch/arm64/tests/Build b/tools/perf/arch/arm64/tests/Build
index b30eff9bcc83..883c57ff0c08 100644
--- a/tools/perf/arch/arm64/tests/Build
+++ b/tools/perf/arch/arm64/tests/Build
@@ -1,2 +1,4 @@
 libperf-y += regs_load.o
 libperf-y += dwarf-unwind.o
+
+libperf-y += arch-tests.o
diff --git a/tools/perf/arch/arm64/tests/arch-tests.c b/tools/perf/arch/arm64/tests/arch-tests.c
new file mode 100644
index 000000000000..5b1543c98022
--- /dev/null
+++ b/tools/perf/arch/arm64/tests/arch-tests.c
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <string.h>
+#include "tests/tests.h"
+#include "arch-tests.h"
+
+struct test arch_tests[] = {
+#ifdef HAVE_DWARF_UNWIND_SUPPORT
+        {
+                .desc = "DWARF unwind",
+                .func = test__dwarf_unwind,
+        },
+#endif
+        {
+                .func = NULL,
+        },
+};
diff --git a/tools/perf/arch/arm64/util/Build b/tools/perf/arch/arm64/util/Build
index c0b8dfef98ba..68f8a8eb3ad0 100644
--- a/tools/perf/arch/arm64/util/Build
+++ b/tools/perf/arch/arm64/util/Build
@@ -2,6 +2,7 @@ libperf-y += header.o
 libperf-y += sym-handling.o
 libperf-$(CONFIG_DWARF)     += dwarf-regs.o
 libperf-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o
+libperf-$(CONFIG_LIBDW_DWARF_UNWIND) += unwind-libdw.o
 
 libperf-$(CONFIG_AUXTRACE) += ../../arm/util/pmu.o \
                               ../../arm/util/auxtrace.o \
diff --git a/tools/perf/arch/arm64/util/unwind-libdw.c b/tools/perf/arch/arm64/util/unwind-libdw.c
new file mode 100644
index 000000000000..7623d85e77f3
--- /dev/null
+++ b/tools/perf/arch/arm64/util/unwind-libdw.c
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <elfutils/libdwfl.h>
+#include "../../util/unwind-libdw.h"
+#include "../../util/perf_regs.h"
+#include "../../util/event.h"
+
+bool libdw__arch_set_initial_registers(Dwfl_Thread *thread, void *arg)
+{
+        struct unwind_info *ui = arg;
+        struct regs_dump *user_regs = &ui->sample->user_regs;
+        Dwarf_Word dwarf_regs[PERF_REG_ARM64_MAX], dwarf_pc;
+
+#define REG(r) ({                                               \
+        Dwarf_Word val = 0;                                     \
+        perf_reg_value(&val, user_regs, PERF_REG_ARM64_##r);    \
+        val;                                                    \
+})
+
+        dwarf_regs[0]  = REG(X0);
+        dwarf_regs[1]  = REG(X1);
+        dwarf_regs[2]  = REG(X2);
+        dwarf_regs[3]  = REG(X3);
+        dwarf_regs[4]  = REG(X4);
+        dwarf_regs[5]  = REG(X5);
+        dwarf_regs[6]  = REG(X6);
+        dwarf_regs[7]  = REG(X7);
+        dwarf_regs[8]  = REG(X8);
+        dwarf_regs[9]  = REG(X9);
+        dwarf_regs[10] = REG(X10);
+        dwarf_regs[11] = REG(X11);
+        dwarf_regs[12] = REG(X12);
+        dwarf_regs[13] = REG(X13);
+        dwarf_regs[14] = REG(X14);
+        dwarf_regs[15] = REG(X15);
+        dwarf_regs[16] = REG(X16);
+        dwarf_regs[17] = REG(X17);
+        dwarf_regs[18] = REG(X18);
+        dwarf_regs[19] = REG(X19);
+        dwarf_regs[20] = REG(X20);
+        dwarf_regs[21] = REG(X21);
+        dwarf_regs[22] = REG(X22);
+        dwarf_regs[23] = REG(X23);
+        dwarf_regs[24] = REG(X24);
+        dwarf_regs[25] = REG(X25);
+        dwarf_regs[26] = REG(X26);
+        dwarf_regs[27] = REG(X27);
+        dwarf_regs[28] = REG(X28);
+        dwarf_regs[29] = REG(X29);
+        dwarf_regs[30] = REG(LR);
+        dwarf_regs[31] = REG(SP);
+
+        if (!dwfl_thread_state_registers(thread, 0, PERF_REG_ARM64_MAX,
+                                         dwarf_regs))
+                return false;
+
+        dwarf_pc = REG(PC);
+        dwfl_thread_state_register_pc(thread, dwarf_pc);
+
+        return true;
+}
diff --git a/tools/perf/arch/powerpc/Makefile b/tools/perf/arch/powerpc/Makefile
index 42dab7c8f508..a111239df182 100644
--- a/tools/perf/arch/powerpc/Makefile
+++ b/tools/perf/arch/powerpc/Makefile
@@ -6,3 +6,28 @@ endif
 HAVE_KVM_STAT_SUPPORT := 1
 PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET := 1
 PERF_HAVE_JITDUMP := 1
+
+#
+# Syscall table generation for perf
+#
+
+out    := $(OUTPUT)arch/powerpc/include/generated/asm
+header32 := $(out)/syscalls_32.c
+header64 := $(out)/syscalls_64.c
+sysdef := $(srctree)/tools/arch/powerpc/include/uapi/asm/unistd.h
+sysprf := $(srctree)/tools/perf/arch/powerpc/entry/syscalls/
+systbl := $(sysprf)/mksyscalltbl
+
+# Create output directory if not already present
+_dummy := $(shell [ -d '$(out)' ] || mkdir -p '$(out)')
+
+$(header64): $(sysdef) $(systbl)
+        $(Q)$(SHELL) '$(systbl)' '64' '$(CC)' $(sysdef) > $@
+
+$(header32): $(sysdef) $(systbl)
+        $(Q)$(SHELL) '$(systbl)' '32' '$(CC)' $(sysdef) > $@
+
+clean::
+        $(call QUIET_CLEAN, powerpc) $(RM) $(header32) $(header64)
+
+archheaders: $(header32) $(header64)
diff --git a/tools/perf/arch/powerpc/entry/syscalls/mksyscalltbl b/tools/perf/arch/powerpc/entry/syscalls/mksyscalltbl
new file mode 100755
index 000000000000..ef52e1dd694b
--- /dev/null
+++ b/tools/perf/arch/powerpc/entry/syscalls/mksyscalltbl
@@ -0,0 +1,37 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+#
+# Generate system call table for perf. Derived from
+# s390 script.
+#
+# Copyright IBM Corp. 2017
+# Author(s):  Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+# Changed by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+wordsize=$1
+gcc=$2
+input=$3
+
+if ! test -r $input; then
+        echo "Could not read input file" >&2
+        exit 1
+fi
+
+create_table()
+{
+        local wordsize=$1
+        local max_nr
+
+        echo "static const char *syscalltbl_powerpc_${wordsize}[] = {"
+        while read sc nr; do
+                printf '\t[%d] = "%s",\n' $nr $sc
+                max_nr=$nr
+        done
+        echo '};'
+        echo "#define SYSCALLTBL_POWERPC_${wordsize}_MAX_ID $max_nr"
+}
+
+$gcc -m${wordsize} -E -dM -x c  $input         \
+        |sed -ne 's/^#define __NR_//p' \
+        |sort -t' ' -k2 -nu            \
+        |create_table ${wordsize}
diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c
index 8c72b44444cb..cee4e2f7c057 100644
--- a/tools/perf/arch/s390/annotate/instructions.c
+++ b/tools/perf/arch/s390/annotate/instructions.c
@@ -1,6 +1,113 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/compiler.h>
 
+static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
+                            struct map_symbol *ms)
+{
+        char *endptr, *tok, *name;
+        struct map *map = ms->map;
+        struct addr_map_symbol target = {
+                .map = map,
+        };
+
+        tok = strchr(ops->raw, ',');
+        if (!tok)
+                return -1;
+
+        ops->target.addr = strtoull(tok + 1, &endptr, 16);
+
+        name = strchr(endptr, '<');
+        if (name == NULL)
+                return -1;
+
+        name++;
+
+        if (arch->objdump.skip_functions_char &&
+            strchr(name, arch->objdump.skip_functions_char))
+                return -1;
+
+        tok = strchr(name, '>');
+        if (tok == NULL)
+                return -1;
+
+        *tok = '\0';
+        ops->target.name = strdup(name);
+        *tok = '>';
+
+        if (ops->target.name == NULL)
+                return -1;
+        target.addr = map__objdump_2mem(map, ops->target.addr);
+
+        if (map_groups__find_ams(&target) == 0 &&
+            map__rip_2objdump(target.map, map->map_ip(target.map, target.addr)) == ops->target.addr)
+                ops->target.sym = target.sym;
+
+        return 0;
+}
+
+static int call__scnprintf(struct ins *ins, char *bf, size_t size,
+                           struct ins_operands *ops);
+
+static struct ins_ops s390_call_ops = {
+        .parse     = s390_call__parse,
+        .scnprintf = call__scnprintf,
+};
+
+static int s390_mov__parse(struct arch *arch __maybe_unused,
+                           struct ins_operands *ops,
+                           struct map_symbol *ms __maybe_unused)
+{
+        char *s = strchr(ops->raw, ','), *target, *endptr;
+
+        if (s == NULL)
+                return -1;
+
+        *s = '\0';
+        ops->source.raw = strdup(ops->raw);
+        *s = ',';
+
+        if (ops->source.raw == NULL)
+                return -1;
+
+        target = ++s;
+        ops->target.raw = strdup(target);
+        if (ops->target.raw == NULL)
+                goto out_free_source;
+
+        ops->target.addr = strtoull(target, &endptr, 16);
+        if (endptr == target)
+                goto out_free_target;
+
+        s = strchr(endptr, '<');
+        if (s == NULL)
+                goto out_free_target;
+        endptr = strchr(s + 1, '>');
+        if (endptr == NULL)
+                goto out_free_target;
+
+        *endptr = '\0';
+        ops->target.name = strdup(s + 1);
+        *endptr = '>';
+        if (ops->target.name == NULL)
+                goto out_free_target;
+
+        return 0;
+
+out_free_target:
+        zfree(&ops->target.raw);
+out_free_source:
+        zfree(&ops->source.raw);
+        return -1;
+}
+
+static int mov__scnprintf(struct ins *ins, char *bf, size_t size,
+                          struct ins_operands *ops);
+
+static struct ins_ops s390_mov_ops = {
+        .parse     = s390_mov__parse,
+        .scnprintf = mov__scnprintf,
+};
+
 static struct ins_ops *s390__associate_ins_ops(struct arch *arch, const char *name)
 {
         struct ins_ops *ops = NULL;
@@ -14,21 +121,54 @@ static struct ins_ops *s390__associate_ins_ops(struct arch *arch, const char *na
         if (!strcmp(name, "bras") ||
             !strcmp(name, "brasl") ||
             !strcmp(name, "basr"))
-                ops = &call_ops;
+                ops = &s390_call_ops;
         if (!strcmp(name, "br"))
                 ops = &ret_ops;
+        /* override load/store relative to PC */
+        if (!strcmp(name, "lrl") ||
+            !strcmp(name, "lgrl") ||
+            !strcmp(name, "lgfrl") ||
+            !strcmp(name, "llgfrl") ||
+            !strcmp(name, "strl") ||
+            !strcmp(name, "stgrl"))
+                ops = &s390_mov_ops;
 
         if (ops)
                 arch__associate_ins_ops(arch, name, ops);
         return ops;
 }
 
+static int s390__cpuid_parse(struct arch *arch, char *cpuid)
+{
+        unsigned int family;
+        char model[16], model_c[16], cpumf_v[16], cpumf_a[16];
+        int ret;
+
+        /*
+         * cpuid string format:
+         * "IBM,family,model-capacity,model[,cpum_cf-version,cpum_cf-authorization]"
+         */
+        ret = sscanf(cpuid, "%*[^,],%u,%[^,],%[^,],%[^,],%s", &family, model_c,
+                     model, cpumf_v, cpumf_a);
+        if (ret >= 2) {
+                arch->family = family;
+                arch->model = 0;
+                return 0;
+        }
+
+        return -1;
+}
+
 static int s390__annotate_init(struct arch *arch, char *cpuid __maybe_unused)
 {
+        int err = 0;
+
         if (!arch->initialized) {
                 arch->initialized = true;
                 arch->associate_instruction_ops = s390__associate_ins_ops;
+                if (cpuid)
+                        err = s390__cpuid_parse(arch, cpuid);
         }
 
-        return 0;
+        return err;
 }
diff --git a/tools/perf/arch/s390/util/auxtrace.c b/tools/perf/arch/s390/util/auxtrace.c
index 6cb48e4cffd9..3afe8256eff2 100644
--- a/tools/perf/arch/s390/util/auxtrace.c
+++ b/tools/perf/arch/s390/util/auxtrace.c
@@ -87,6 +87,7 @@ struct auxtrace_record *auxtrace_record__init(struct perf_evlist *evlist,
         struct perf_evsel *pos;
         int diagnose = 0;
 
+        *err = 0;
         if (evlist->nr_entries == 0)
                 return NULL;
 
diff --git a/tools/perf/arch/s390/util/header.c b/tools/perf/arch/s390/util/header.c
index 9fa6c3e5782c..163b92f33998 100644
--- a/tools/perf/arch/s390/util/header.c
+++ b/tools/perf/arch/s390/util/header.c
@@ -1,8 +1,9 @@
 /*
  * Implementation of get_cpuid().
  *
- * Copyright 2014 IBM Corp.
+ * Copyright IBM Corp. 2014, 2018
  * Author(s): Alexander Yarygin <yarygin@linux.vnet.ibm.com>
+ *            Thomas Richter <tmricht@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License (version 2 only)
@@ -13,16 +14,135 @@
 #include <unistd.h>
 #include <stdio.h>
 #include <string.h>
+#include <ctype.h>
 
 #include "../../util/header.h"
+#include "../../util/util.h"
+
+#define SYSINFO_MANU    "Manufacturer:"
+#define SYSINFO_TYPE    "Type:"
+#define SYSINFO_MODEL   "Model:"
+#define SRVLVL_CPUMF    "CPU-MF:"
+#define SRVLVL_VERSION  "version="
+#define SRVLVL_AUTHORIZATION    "authorization="
+#define SYSINFO         "/proc/sysinfo"
+#define SRVLVL          "/proc/service_levels"
 
 int get_cpuid(char *buffer, size_t sz)
 {
-        const char *cpuid = "IBM/S390";
+        char *cp, *line = NULL, *line2;
+        char type[8], model[33], version[8], manufacturer[32], authorization[8];
+        int tpsize = 0, mdsize = 0, vssize = 0, mfsize = 0, atsize = 0;
+        int read;
+        unsigned long line_sz;
+        size_t nbytes;
+        FILE *sysinfo;
+
+        /*
+         * Scan /proc/sysinfo line by line and read out values for
+         * Manufacturer:, Type: and Model:, for example:
+         * Manufacturer:    IBM
+         * Type:            2964
+         * Model:           702              N96
+         * The first word is the Model Capacity and the second word is
+         * Model (can be omitted). Both words have a maximum size of 16
+         * bytes.
+         */
+        memset(manufacturer, 0, sizeof(manufacturer));
+        memset(type, 0, sizeof(type));
+        memset(model, 0, sizeof(model));
+        memset(version, 0, sizeof(version));
+        memset(authorization, 0, sizeof(authorization));
+
+        sysinfo = fopen(SYSINFO, "r");
+        if (sysinfo == NULL)
+                return -1;
+
+        while ((read = getline(&line, &line_sz, sysinfo)) != -1) {
+                if (!strncmp(line, SYSINFO_MANU, strlen(SYSINFO_MANU))) {
+                        line2 = line + strlen(SYSINFO_MANU);
+
+                        while ((cp = strtok_r(line2, "\n ", &line2))) {
+                                mfsize += scnprintf(manufacturer + mfsize,
+                                                    sizeof(manufacturer) - mfsize, "%s", cp);
+                        }
+                }
+
+                if (!strncmp(line, SYSINFO_TYPE, strlen(SYSINFO_TYPE))) {
+                        line2 = line + strlen(SYSINFO_TYPE);
+
+                        while ((cp = strtok_r(line2, "\n ", &line2))) {
+                                tpsize += scnprintf(type + tpsize,
+                                                    sizeof(type) - tpsize, "%s", cp);
+                        }
+                }
+
+                if (!strncmp(line, SYSINFO_MODEL, strlen(SYSINFO_MODEL))) {
+                        line2 = line + strlen(SYSINFO_MODEL);
+
+                        while ((cp = strtok_r(line2, "\n ", &line2))) {
+                                mdsize += scnprintf(model + mdsize, sizeof(model) - mdsize,
+                                                    "%s%s", model[0] ? "," : "", cp);
+                        }
+                        break;
+                }
+        }
+        fclose(sysinfo);
 
-        if (strlen(cpuid) + 1 > sz)
+        /* Missing manufacturer, type or model information should not happen */
+        if (!manufacturer[0] || !type[0] || !model[0])
                 return -1;
 
-        strcpy(buffer, cpuid);
-        return 0;
+        /*
+         * Scan /proc/service_levels and return the CPU-MF counter facility
+         * version number and authorization level.
+         * Optional, does not exist on z/VM guests.
+         */
+        sysinfo = fopen(SRVLVL, "r");
+        if (sysinfo == NULL)
+                goto skip_sysinfo;
+        while ((read = getline(&line, &line_sz, sysinfo)) != -1) {
+                if (strncmp(line, SRVLVL_CPUMF, strlen(SRVLVL_CPUMF)))
+                        continue;
+
+                line2 = line + strlen(SRVLVL_CPUMF);
+                while ((cp = strtok_r(line2, "\n ", &line2))) {
+                        if (!strncmp(cp, SRVLVL_VERSION,
+                                     strlen(SRVLVL_VERSION))) {
+                                char *sep = strchr(cp, '=');
+
+                                vssize += scnprintf(version + vssize,
+                                                    sizeof(version) - vssize, "%s", sep + 1);
+                        }
+                        if (!strncmp(cp, SRVLVL_AUTHORIZATION,
+                                     strlen(SRVLVL_AUTHORIZATION))) {
+                                char *sep = strchr(cp, '=');
+
+                                atsize += scnprintf(authorization + atsize,
+                                                    sizeof(authorization) - atsize, "%s", sep + 1);
+                        }
+                }
+        }
+        fclose(sysinfo);
+
+skip_sysinfo:
+        free(line);
+
+        if (version[0] && authorization[0] )
+                nbytes = snprintf(buffer, sz, "%s,%s,%s,%s,%s",
+                                  manufacturer, type, model, version,
+                                  authorization);
+        else
+                nbytes = snprintf(buffer, sz, "%s,%s,%s", manufacturer, type,
+                                  model);
+        return (nbytes >= sz) ? -1 : 0;
+}
+
+char *get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
+{
+        char *buf = malloc(128);
+
+        if (buf && get_cpuid(buf, 128) < 0)
+                zfree(&buf);
+        return buf;
 }
diff --git a/tools/perf/arch/x86/Makefile b/tools/perf/arch/x86/Makefile
index d74eaa7aa927..1a38e78117ce 100644
--- a/tools/perf/arch/x86/Makefile
+++ b/tools/perf/arch/x86/Makefile
@@ -21,7 +21,7 @@ _dummy := $(shell [ -d '$(out)' ] || mkdir -p '$(out)')
 $(header): $(sys)/syscall_64.tbl $(systbl)
         @(test -d ../../kernel -a -d ../../tools -a -d ../perf && ( \
         (diff -B arch/x86/entry/syscalls/syscall_64.tbl ../../arch/x86/entry/syscalls/syscall_64.tbl >/dev/null) \
-        || echo "Warning: Kernel ABI header at 'tools/arch/x86/entry/syscalls/syscall_64.tbl' differs from latest version at 'arch/x86/entry/syscalls/syscall_64.tbl'" >&2 )) || true
+        || echo "Warning: Kernel ABI header at 'tools/perf/arch/x86/entry/syscalls/syscall_64.tbl' differs from latest version at 'arch/x86/entry/syscalls/syscall_64.tbl'" >&2 )) || true
         $(Q)$(SHELL) '$(systbl)' $(sys)/syscall_64.tbl 'x86_64' > $@
 
 clean::
diff --git a/tools/perf/arch/x86/annotate/instructions.c b/tools/perf/arch/x86/annotate/instructions.c
index 5bd1ba8c0282..44f5aba78210 100644
--- a/tools/perf/arch/x86/annotate/instructions.c
+++ b/tools/perf/arch/x86/annotate/instructions.c
@@ -1,21 +1,43 @@
 // SPDX-License-Identifier: GPL-2.0
 static struct ins x86__instructions[] = {
+        { .name = "adc",        .ops = &mov_ops,  },
+        { .name = "adcb",       .ops = &mov_ops,  },
+        { .name = "adcl",       .ops = &mov_ops,  },
         { .name = "add",        .ops = &mov_ops,  },
         { .name = "addl",       .ops = &mov_ops,  },
         { .name = "addq",       .ops = &mov_ops,  },
+        { .name = "addsd",      .ops = &mov_ops,  },
         { .name = "addw",       .ops = &mov_ops,  },
         { .name = "and",        .ops = &mov_ops,  },
+        { .name = "andb",       .ops = &mov_ops,  },
+        { .name = "andl",       .ops = &mov_ops,  },
+        { .name = "andpd",      .ops = &mov_ops,  },
+        { .name = "andps",      .ops = &mov_ops,  },
+        { .name = "andq",       .ops = &mov_ops,  },
+        { .name = "andw",       .ops = &mov_ops,  },
+        { .name = "bsr",        .ops = &mov_ops,  },
+        { .name = "bt",         .ops = &mov_ops,  },
+        { .name = "btr",        .ops = &mov_ops,  },
         { .name = "bts",        .ops = &mov_ops,  },
+        { .name = "btsq",       .ops = &mov_ops,  },
         { .name = "call",       .ops = &call_ops, },
         { .name = "callq",      .ops = &call_ops, },
+        { .name = "cmovbe",     .ops = &mov_ops,  },
+        { .name = "cmove",      .ops = &mov_ops,  },
+        { .name = "cmovae",     .ops = &mov_ops,  },
         { .name = "cmp",        .ops = &mov_ops,  },
         { .name = "cmpb",       .ops = &mov_ops,  },
         { .name = "cmpl",       .ops = &mov_ops,  },
         { .name = "cmpq",       .ops = &mov_ops,  },
         { .name = "cmpw",       .ops = &mov_ops,  },
         { .name = "cmpxch",     .ops = &mov_ops,  },
+        { .name = "cmpxchg",    .ops = &mov_ops,  },
+        { .name = "cs",         .ops = &mov_ops,  },
         { .name = "dec",        .ops = &dec_ops,  },
         { .name = "decl",       .ops = &dec_ops,  },
+        { .name = "divsd",      .ops = &mov_ops,  },
+        { .name = "divss",      .ops = &mov_ops,  },
+        { .name = "gs",         .ops = &mov_ops,  },
         { .name = "imul",       .ops = &mov_ops,  },
         { .name = "inc",        .ops = &dec_ops,  },
         { .name = "incl",       .ops = &dec_ops,  },
@@ -57,25 +79,68 @@ static struct ins x86__instructions[] = {
         { .name = "lea",        .ops = &mov_ops,  },
         { .name = "lock",       .ops = &lock_ops, },
         { .name = "mov",        .ops = &mov_ops,  },
+        { .name = "movapd",     .ops = &mov_ops,  },
+        { .name = "movaps",     .ops = &mov_ops,  },
         { .name = "movb",       .ops = &mov_ops,  },
         { .name = "movdqa",     .ops = &mov_ops,  },
+        { .name = "movdqu",     .ops = &mov_ops,  },
         { .name = "movl",       .ops = &mov_ops,  },
         { .name = "movq",       .ops = &mov_ops,  },
+        { .name = "movsd",      .ops = &mov_ops,  },
         { .name = "movslq",     .ops = &mov_ops,  },
+        { .name = "movss",      .ops = &mov_ops,  },
+        { .name = "movupd",     .ops = &mov_ops,  },
+        { .name = "movups",     .ops = &mov_ops,  },
+        { .name = "movw",       .ops = &mov_ops,  },
         { .name = "movzbl",     .ops = &mov_ops,  },
         { .name = "movzwl",     .ops = &mov_ops,  },
+        { .name = "mulsd",      .ops = &mov_ops,  },
+        { .name = "mulss",      .ops = &mov_ops,  },
         { .name = "nop",        .ops = &nop_ops,  },
         { .name = "nopl",       .ops = &nop_ops,  },
         { .name = "nopw",       .ops = &nop_ops,  },
         { .name = "or",         .ops = &mov_ops,  },
+        { .name = "orb",        .ops = &mov_ops,  },
         { .name = "orl",        .ops = &mov_ops,  },
+        { .name = "orps",       .ops = &mov_ops,  },
+        { .name = "orq",        .ops = &mov_ops,  },
+        { .name = "pand",       .ops = &mov_ops,  },
+        { .name = "paddq",      .ops = &mov_ops,  },
+        { .name = "pcmpeqb",    .ops = &mov_ops,  },
+        { .name = "por",        .ops = &mov_ops,  },
+        { .name = "rclb",       .ops = &mov_ops,  },
+        { .name = "rcll",       .ops = &mov_ops,  },
+        { .name = "retq",       .ops = &ret_ops,  },
+        { .name = "sbb",        .ops = &mov_ops,  },
+        { .name = "sbbl",       .ops = &mov_ops,  },
+        { .name = "sete",       .ops = &mov_ops,  },
+        { .name = "sub",        .ops = &mov_ops,  },
+        { .name = "subl",       .ops = &mov_ops,  },
+        { .name = "subq",       .ops = &mov_ops,  },
+        { .name = "subsd",      .ops = &mov_ops,  },
+        { .name = "subw",       .ops = &mov_ops,  },
         { .name = "test",       .ops = &mov_ops,  },
         { .name = "testb",      .ops = &mov_ops,  },
         { .name = "testl",      .ops = &mov_ops,  },
+        { .name = "ucomisd",    .ops = &mov_ops,  },
+        { .name = "ucomiss",    .ops = &mov_ops,  },
+        { .name = "vaddsd",     .ops = &mov_ops,  },
+        { .name = "vandpd",     .ops = &mov_ops,  },
+        { .name = "vmovdqa",    .ops = &mov_ops,  },
+        { .name = "vmovq",      .ops = &mov_ops,  },
+        { .name = "vmovsd",     .ops = &mov_ops,  },
+        { .name = "vmulsd",     .ops = &mov_ops,  },
+        { .name = "vorpd",      .ops = &mov_ops,  },
+        { .name = "vsubsd",     .ops = &mov_ops,  },
+        { .name = "vucomisd",   .ops = &mov_ops,  },
         { .name = "xadd",       .ops = &mov_ops,  },
         { .name = "xbeginl",    .ops = &jump_ops, },
         { .name = "xbeginq",    .ops = &jump_ops, },
-        { .name = "retq",       .ops = &ret_ops,  },
+        { .name = "xchg",       .ops = &mov_ops,  },
+        { .name = "xor",        .ops = &mov_ops, },
+        { .name = "xorb",       .ops = &mov_ops, },
+        { .name = "xorpd",      .ops = &mov_ops, },
+        { .name = "xorps",      .ops = &mov_ops, },
 };
 
 static bool x86__ins_is_fused(struct arch *arch, const char *ins1,
diff --git a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
index 5aef183e2f85..4dfe42666d0c 100644
--- a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
@@ -4,379 +4,383 @@
 # The format is:
 # <number> <abi> <name> <entry point>
 #
+# The __x64_sys_*() stubs are created on-the-fly for sys_*() system calls
+#
 # The abi is "common", "64" or "x32" for this file.
 #
-0       common  read                    sys_read
-1       common  write                   sys_write
-2       common  open                    sys_open
-3       common  close                   sys_close
-4       common  stat                    sys_newstat
-5       common  fstat                   sys_newfstat
-6       common  lstat                   sys_newlstat
-7       common  poll                    sys_poll
-8       common  lseek                   sys_lseek
-9       common  mmap                    sys_mmap
-10      common  mprotect                sys_mprotect
-11      common  munmap                  sys_munmap
-12      common  brk                     sys_brk
-13      64      rt_sigaction            sys_rt_sigaction
-14      common  rt_sigprocmask          sys_rt_sigprocmask
-15      64      rt_sigreturn            sys_rt_sigreturn/ptregs
-16      64      ioctl                   sys_ioctl
-17      common  pread64                 sys_pread64
-18      common  pwrite64                sys_pwrite64
-19      64      readv                   sys_readv
-20      64      writev                  sys_writev
-21      common  access                  sys_access
-22      common  pipe                    sys_pipe
-23      common  select                  sys_select
-24      common  sched_yield             sys_sched_yield
-25      common  mremap                  sys_mremap
-26      common  msync                   sys_msync
-27      common  mincore                 sys_mincore
-28      common  madvise                 sys_madvise
-29      common  shmget                  sys_shmget
-30      common  shmat                   sys_shmat
-31      common  shmctl                  sys_shmctl
-32      common  dup                     sys_dup
-33      common  dup2                    sys_dup2
-34      common  pause                   sys_pause
-35      common  nanosleep               sys_nanosleep
-36      common  getitimer               sys_getitimer
-37      common  alarm                   sys_alarm
-38      common  setitimer               sys_setitimer
-39      common  getpid                  sys_getpid
-40      common  sendfile                sys_sendfile64
-41      common  socket                  sys_socket
-42      common  connect                 sys_connect
-43      common  accept                  sys_accept
-44      common  sendto                  sys_sendto
-45      64      recvfrom                sys_recvfrom
-46      64      sendmsg                 sys_sendmsg
-47      64      recvmsg                 sys_recvmsg
-48      common  shutdown                sys_shutdown
-49      common  bind                    sys_bind
-50      common  listen                  sys_listen
-51      common  getsockname             sys_getsockname
-52      common  getpeername             sys_getpeername
-53      common  socketpair              sys_socketpair
-54      64      setsockopt              sys_setsockopt
-55      64      getsockopt              sys_getsockopt
-56      common  clone                   sys_clone/ptregs
-57      common  fork                    sys_fork/ptregs
-58      common  vfork                   sys_vfork/ptregs
-59      64      execve                  sys_execve/ptregs
-60      common  exit                    sys_exit
-61      common  wait4                   sys_wait4
-62      common  kill                    sys_kill
-63      common  uname                   sys_newuname
-64      common  semget                  sys_semget
-65      common  semop                   sys_semop
-66      common  semctl                  sys_semctl
-67      common  shmdt                   sys_shmdt
-68      common  msgget                  sys_msgget
-69      common  msgsnd                  sys_msgsnd
-70      common  msgrcv                  sys_msgrcv
-71      common  msgctl                  sys_msgctl
-72      common  fcntl                   sys_fcntl
-73      common  flock                   sys_flock
-74      common  fsync                   sys_fsync
-75      common  fdatasync               sys_fdatasync
-76      common  truncate                sys_truncate
-77      common  ftruncate               sys_ftruncate
-78      common  getdents                sys_getdents
-79      common  getcwd                  sys_getcwd
-80      common  chdir                   sys_chdir
-81      common  fchdir                  sys_fchdir
-82      common  rename                  sys_rename
-83      common  mkdir                   sys_mkdir
-84      common  rmdir                   sys_rmdir
-85      common  creat                   sys_creat
-86      common  link                    sys_link
-87      common  unlink                  sys_unlink
-88      common  symlink                 sys_symlink
-89      common  readlink                sys_readlink
-90      common  chmod                   sys_chmod
-91      common  fchmod                  sys_fchmod
-92      common  chown                   sys_chown
-93      common  fchown                  sys_fchown
-94      common  lchown                  sys_lchown
-95      common  umask                   sys_umask
-96      common  gettimeofday            sys_gettimeofday
-97      common  getrlimit               sys_getrlimit
-98      common  getrusage               sys_getrusage
-99      common  sysinfo                 sys_sysinfo
-100     common  times                   sys_times
-101     64      ptrace                  sys_ptrace
-102     common  getuid                  sys_getuid
-103     common  syslog                  sys_syslog
-104     common  getgid                  sys_getgid
-105     common  setuid                  sys_setuid
-106     common  setgid                  sys_setgid
-107     common  geteuid                 sys_geteuid
-108     common  getegid                 sys_getegid
-109     common  setpgid                 sys_setpgid
-110     common  getppid                 sys_getppid
-111     common  getpgrp                 sys_getpgrp
-112     common  setsid                  sys_setsid
-113     common  setreuid                sys_setreuid
-114     common  setregid                sys_setregid
-115     common  getgroups               sys_getgroups
-116     common  setgroups               sys_setgroups
-117     common  setresuid               sys_setresuid
-118     common  getresuid               sys_getresuid
-119     common  setresgid               sys_setresgid
-120     common  getresgid               sys_getresgid
-121     common  getpgid                 sys_getpgid
-122     common  setfsuid                sys_setfsuid
-123     common  setfsgid                sys_setfsgid
-124     common  getsid                  sys_getsid
-125     common  capget                  sys_capget
-126     common  capset                  sys_capset
-127     64      rt_sigpending           sys_rt_sigpending
-128     64      rt_sigtimedwait         sys_rt_sigtimedwait
-129     64      rt_sigqueueinfo         sys_rt_sigqueueinfo
-130     common  rt_sigsuspend           sys_rt_sigsuspend
-131     64      sigaltstack             sys_sigaltstack
-132     common  utime                   sys_utime
-133     common  mknod                   sys_mknod
+0       common  read                    __x64_sys_read
+1       common  write                   __x64_sys_write
+2       common  open                    __x64_sys_open
+3       common  close                   __x64_sys_close
+4       common  stat                    __x64_sys_newstat
+5       common  fstat                   __x64_sys_newfstat
+6       common  lstat                   __x64_sys_newlstat
+7       common  poll                    __x64_sys_poll
+8       common  lseek                   __x64_sys_lseek
+9       common  mmap                    __x64_sys_mmap
+10      common  mprotect                __x64_sys_mprotect
+11      common  munmap                  __x64_sys_munmap
+12      common  brk                     __x64_sys_brk
+13      64      rt_sigaction            __x64_sys_rt_sigaction
+14      common  rt_sigprocmask          __x64_sys_rt_sigprocmask
+15      64      rt_sigreturn            __x64_sys_rt_sigreturn/ptregs
+16      64      ioctl                   __x64_sys_ioctl
+17      common  pread64                 __x64_sys_pread64
+18      common  pwrite64                __x64_sys_pwrite64
+19      64      readv                   __x64_sys_readv
+20      64      writev                  __x64_sys_writev
+21      common  access                  __x64_sys_access
+22      common  pipe                    __x64_sys_pipe
+23      common  select                  __x64_sys_select
+24      common  sched_yield             __x64_sys_sched_yield
+25      common  mremap                  __x64_sys_mremap
+26      common  msync                   __x64_sys_msync
+27      common  mincore                 __x64_sys_mincore
+28      common  madvise                 __x64_sys_madvise
+29      common  shmget                  __x64_sys_shmget
+30      common  shmat                   __x64_sys_shmat
+31      common  shmctl                  __x64_sys_shmctl
+32      common  dup                     __x64_sys_dup
+33      common  dup2                    __x64_sys_dup2
+34      common  pause                   __x64_sys_pause
+35      common  nanosleep               __x64_sys_nanosleep
+36      common  getitimer               __x64_sys_getitimer
+37      common  alarm                   __x64_sys_alarm
+38      common  setitimer               __x64_sys_setitimer
+39      common  getpid                  __x64_sys_getpid
+40      common  sendfile                __x64_sys_sendfile64
+41      common  socket                  __x64_sys_socket
+42      common  connect                 __x64_sys_connect
+43      common  accept                  __x64_sys_accept
+44      common  sendto                  __x64_sys_sendto
+45      64      recvfrom                __x64_sys_recvfrom
+46      64      sendmsg                 __x64_sys_sendmsg
+47      64      recvmsg                 __x64_sys_recvmsg
+48      common  shutdown                __x64_sys_shutdown
+49      common  bind                    __x64_sys_bind
+50      common  listen                  __x64_sys_listen
+51      common  getsockname             __x64_sys_getsockname
+52      common  getpeername             __x64_sys_getpeername
+53      common  socketpair              __x64_sys_socketpair
+54      64      setsockopt              __x64_sys_setsockopt
+55      64      getsockopt              __x64_sys_getsockopt
+56      common  clone                   __x64_sys_clone/ptregs
+57      common  fork                    __x64_sys_fork/ptregs
+58      common  vfork                   __x64_sys_vfork/ptregs
+59      64      execve                  __x64_sys_execve/ptregs
+60      common  exit                    __x64_sys_exit
+61      common  wait4                   __x64_sys_wait4
+62      common  kill                    __x64_sys_kill
+63      common  uname                   __x64_sys_newuname
+64      common  semget                  __x64_sys_semget
+65      common  semop                   __x64_sys_semop
+66      common  semctl                  __x64_sys_semctl
+67      common  shmdt                   __x64_sys_shmdt
+68      common  msgget                  __x64_sys_msgget
+69      common  msgsnd                  __x64_sys_msgsnd
+70      common  msgrcv                  __x64_sys_msgrcv
+71      common  msgctl                  __x64_sys_msgctl
+72      common  fcntl                   __x64_sys_fcntl
+73      common  flock                   __x64_sys_flock
+74      common  fsync                   __x64_sys_fsync
+75      common  fdatasync               __x64_sys_fdatasync
+76      common  truncate                __x64_sys_truncate
+77      common  ftruncate               __x64_sys_ftruncate
+78      common  getdents                __x64_sys_getdents
+79      common  getcwd                  __x64_sys_getcwd
+80      common  chdir                   __x64_sys_chdir
+81      common  fchdir                  __x64_sys_fchdir
+82      common  rename                  __x64_sys_rename
+83      common  mkdir                   __x64_sys_mkdir
+84      common  rmdir                   __x64_sys_rmdir
+85      common  creat                   __x64_sys_creat
+86      common  link                    __x64_sys_link
+87      common  unlink                  __x64_sys_unlink
+88      common  symlink                 __x64_sys_symlink
+89      common  readlink                __x64_sys_readlink
+90      common  chmod                   __x64_sys_chmod
+91      common  fchmod                  __x64_sys_fchmod
+92      common  chown                   __x64_sys_chown
+93      common  fchown                  __x64_sys_fchown
+94      common  lchown                  __x64_sys_lchown
+95      common  umask                   __x64_sys_umask
+96      common  gettimeofday            __x64_sys_gettimeofday
+97      common  getrlimit               __x64_sys_getrlimit
+98      common  getrusage               __x64_sys_getrusage
+99      common  sysinfo                 __x64_sys_sysinfo
+100     common  times                   __x64_sys_times
+101     64      ptrace                  __x64_sys_ptrace
+102     common  getuid                  __x64_sys_getuid
+103     common  syslog                  __x64_sys_syslog
+104     common  getgid                  __x64_sys_getgid
+105     common  setuid                  __x64_sys_setuid
+106     common  setgid                  __x64_sys_setgid
+107     common  geteuid                 __x64_sys_geteuid
+108     common  getegid                 __x64_sys_getegid
+109     common  setpgid                 __x64_sys_setpgid
+110     common  getppid                 __x64_sys_getppid
+111     common  getpgrp                 __x64_sys_getpgrp
+112     common  setsid                  __x64_sys_setsid
+113     common  setreuid                __x64_sys_setreuid
+114     common  setregid                __x64_sys_setregid
+115     common  getgroups               __x64_sys_getgroups
+116     common  setgroups               __x64_sys_setgroups
+117     common  setresuid               __x64_sys_setresuid
+118     common  getresuid               __x64_sys_getresuid
+119     common  setresgid               __x64_sys_setresgid
+120     common  getresgid               __x64_sys_getresgid
+121     common  getpgid                 __x64_sys_getpgid
+122     common  setfsuid                __x64_sys_setfsuid
+123     common  setfsgid                __x64_sys_setfsgid
+124     common  getsid                  __x64_sys_getsid
+125     common  capget                  __x64_sys_capget
+126     common  capset                  __x64_sys_capset
+127     64      rt_sigpending           __x64_sys_rt_sigpending
+128     64      rt_sigtimedwait         __x64_sys_rt_sigtimedwait
+129     64      rt_sigqueueinfo         __x64_sys_rt_sigqueueinfo
+130     common  rt_sigsuspend           __x64_sys_rt_sigsuspend
+131     64      sigaltstack             __x64_sys_sigaltstack
+132     common  utime                   __x64_sys_utime
+133     common  mknod                   __x64_sys_mknod
 134     64      uselib
-135     common  personality             sys_personality
-136     common  ustat                   sys_ustat
-137     common  statfs                  sys_statfs
-138     common  fstatfs                 sys_fstatfs
-139     common  sysfs                   sys_sysfs
-140     common  getpriority             sys_getpriority
-141     common  setpriority             sys_setpriority
-142     common  sched_setparam          sys_sched_setparam
-143     common  sched_getparam          sys_sched_getparam
-144     common  sched_setscheduler      sys_sched_setscheduler
-145     common  sched_getscheduler      sys_sched_getscheduler
-146     common  sched_get_priority_max  sys_sched_get_priority_max
-147     common  sched_get_priority_min  sys_sched_get_priority_min
-148     common  sched_rr_get_interval   sys_sched_rr_get_interval
-149     common  mlock                   sys_mlock
-150     common  munlock                 sys_munlock
-151     common  mlockall                sys_mlockall
-152     common  munlockall              sys_munlockall
-153     common  vhangup                 sys_vhangup
-154     common  modify_ldt              sys_modify_ldt
-155     common  pivot_root              sys_pivot_root
-156     64      _sysctl                 sys_sysctl
-157     common  prctl                   sys_prctl
-158     common  arch_prctl              sys_arch_prctl
-159     common  adjtimex                sys_adjtimex
-160     common  setrlimit               sys_setrlimit
-161     common  chroot                  sys_chroot
-162     common  sync                    sys_sync
-163     common  acct                    sys_acct
-164     common  settimeofday            sys_settimeofday
-165     common  mount                   sys_mount
-166     common  umount2                 sys_umount
-167     common  swapon                  sys_swapon
-168     common  swapoff                 sys_swapoff
-169     common  reboot                  sys_reboot
-170     common  sethostname             sys_sethostname
-171     common  setdomainname           sys_setdomainname
-172     common  iopl                    sys_iopl/ptregs
-173     common  ioperm                  sys_ioperm
+135     common  personality             __x64_sys_personality
+136     common  ustat                   __x64_sys_ustat
+137     common  statfs                  __x64_sys_statfs
+138     common  fstatfs                 __x64_sys_fstatfs
+139     common  sysfs                   __x64_sys_sysfs
+140     common  getpriority             __x64_sys_getpriority
+141     common  setpriority             __x64_sys_setpriority
+142     common  sched_setparam          __x64_sys_sched_setparam
+143     common  sched_getparam          __x64_sys_sched_getparam
+144     common  sched_setscheduler      __x64_sys_sched_setscheduler
+145     common  sched_getscheduler      __x64_sys_sched_getscheduler
+146     common  sched_get_priority_max  __x64_sys_sched_get_priority_max
+147     common  sched_get_priority_min  __x64_sys_sched_get_priority_min
+148     common  sched_rr_get_interval   __x64_sys_sched_rr_get_interval
+149     common  mlock                   __x64_sys_mlock
+150     common  munlock                 __x64_sys_munlock
+151     common  mlockall                __x64_sys_mlockall
+152     common  munlockall              __x64_sys_munlockall
+153     common  vhangup                 __x64_sys_vhangup
+154     common  modify_ldt              __x64_sys_modify_ldt
+155     common  pivot_root              __x64_sys_pivot_root
+156     64      _sysctl                 __x64_sys_sysctl
+157     common  prctl                   __x64_sys_prctl
+158     common  arch_prctl              __x64_sys_arch_prctl
+159     common  adjtimex                __x64_sys_adjtimex
+160     common  setrlimit               __x64_sys_setrlimit
+161     common  chroot                  __x64_sys_chroot
+162     common  sync                    __x64_sys_sync
+163     common  acct                    __x64_sys_acct
+164     common  settimeofday            __x64_sys_settimeofday
+165     common  mount                   __x64_sys_mount
+166     common  umount2                 __x64_sys_umount
+167     common  swapon                  __x64_sys_swapon
+168     common  swapoff                 __x64_sys_swapoff
+169     common  reboot                  __x64_sys_reboot
+170     common  sethostname             __x64_sys_sethostname
+171     common  setdomainname           __x64_sys_setdomainname
+172     common  iopl                    __x64_sys_iopl/ptregs
+173     common  ioperm                  __x64_sys_ioperm
 174     64      create_module
-175     common  init_module             sys_init_module
-176     common  delete_module           sys_delete_module
+175     common  init_module             __x64_sys_init_module
+176     common  delete_module           __x64_sys_delete_module
 177     64      get_kernel_syms
 178     64      query_module
-179     common  quotactl                sys_quotactl
+179     common  quotactl                __x64_sys_quotactl
 180     64      nfsservctl
 181     common  getpmsg
 182     common  putpmsg
 183     common  afs_syscall
 184     common  tuxcall
 185     common  security
-186     common  gettid                  sys_gettid
-187     common  readahead               sys_readahead
-188     common  setxattr                sys_setxattr
-189     common  lsetxattr               sys_lsetxattr
-190     common  fsetxattr               sys_fsetxattr
-191     common  getxattr                sys_getxattr
-192     common  lgetxattr               sys_lgetxattr
-193     common  fgetxattr               sys_fgetxattr
-194     common  listxattr               sys_listxattr
-195     common  llistxattr              sys_llistxattr
-196     common  flistxattr              sys_flistxattr
-197     common  removexattr             sys_removexattr
-198     common  lremovexattr            sys_lremovexattr
-199     common  fremovexattr            sys_fremovexattr
-200     common  tkill                   sys_tkill
-201     common  time                    sys_time
-202     common  futex                   sys_futex
-203     common  sched_setaffinity       sys_sched_setaffinity
-204     common  sched_getaffinity       sys_sched_getaffinity
+186     common  gettid                  __x64_sys_gettid
+187     common  readahead               __x64_sys_readahead
+188     common  setxattr                __x64_sys_setxattr
+189     common  lsetxattr               __x64_sys_lsetxattr
+190     common  fsetxattr               __x64_sys_fsetxattr
+191     common  getxattr                __x64_sys_getxattr
+192     common  lgetxattr               __x64_sys_lgetxattr
+193     common  fgetxattr               __x64_sys_fgetxattr
+194     common  listxattr               __x64_sys_listxattr
+195     common  llistxattr              __x64_sys_llistxattr
+196     common  flistxattr              __x64_sys_flistxattr
+197     common  removexattr             __x64_sys_removexattr
+198     common  lremovexattr            __x64_sys_lremovexattr
+199     common  fremovexattr            __x64_sys_fremovexattr
+200     common  tkill                   __x64_sys_tkill
+201     common  time                    __x64_sys_time
+202     common  futex                   __x64_sys_futex
+203     common  sched_setaffinity       __x64_sys_sched_setaffinity
+204     common  sched_getaffinity       __x64_sys_sched_getaffinity
 205     64      set_thread_area
-206     64      io_setup                sys_io_setup
-207     common  io_destroy              sys_io_destroy
-208     common  io_getevents            sys_io_getevents
-209     64      io_submit               sys_io_submit
-210     common  io_cancel               sys_io_cancel
+206     64      io_setup                __x64_sys_io_setup
+207     common  io_destroy              __x64_sys_io_destroy
+208     common  io_getevents            __x64_sys_io_getevents
+209     64      io_submit               __x64_sys_io_submit
+210     common  io_cancel               __x64_sys_io_cancel
 211     64      get_thread_area
-212     common  lookup_dcookie          sys_lookup_dcookie
-213     common  epoll_create            sys_epoll_create
+212     common  lookup_dcookie          __x64_sys_lookup_dcookie
+213     common  epoll_create            __x64_sys_epoll_create
 214     64      epoll_ctl_old
 215     64      epoll_wait_old
-216     common  remap_file_pages        sys_remap_file_pages
-217     common  getdents64              sys_getdents64
-218     common  set_tid_address         sys_set_tid_address
-219     common  restart_syscall         sys_restart_syscall
-220     common  semtimedop              sys_semtimedop
-221     common  fadvise64               sys_fadvise64
-222     64      timer_create            sys_timer_create
-223     common  timer_settime           sys_timer_settime
-224     common  timer_gettime           sys_timer_gettime
-225     common  timer_getoverrun        sys_timer_getoverrun
-226     common  timer_delete            sys_timer_delete
-227     common  clock_settime           sys_clock_settime
-228     common  clock_gettime           sys_clock_gettime
-229     common  clock_getres            sys_clock_getres
-230     common  clock_nanosleep         sys_clock_nanosleep
-231     common  exit_group              sys_exit_group
-232     common  epoll_wait              sys_epoll_wait
-233     common  epoll_ctl               sys_epoll_ctl
-234     common  tgkill                  sys_tgkill
-235     common  utimes                  sys_utimes
+216     common  remap_file_pages        __x64_sys_remap_file_pages
+217     common  getdents64              __x64_sys_getdents64
+218     common  set_tid_address         __x64_sys_set_tid_address
+219     common  restart_syscall         __x64_sys_restart_syscall
+220     common  semtimedop              __x64_sys_semtimedop
+221     common  fadvise64               __x64_sys_fadvise64
+222     64      timer_create            __x64_sys_timer_create
+223     common  timer_settime           __x64_sys_timer_settime
+224     common  timer_gettime           __x64_sys_timer_gettime
+225     common  timer_getoverrun        __x64_sys_timer_getoverrun
+226     common  timer_delete            __x64_sys_timer_delete
+227     common  clock_settime           __x64_sys_clock_settime
+228     common  clock_gettime           __x64_sys_clock_gettime
+229     common  clock_getres            __x64_sys_clock_getres
+230     common  clock_nanosleep         __x64_sys_clock_nanosleep
+231     common  exit_group              __x64_sys_exit_group
+232     common  epoll_wait              __x64_sys_epoll_wait
+233     common  epoll_ctl               __x64_sys_epoll_ctl
+234     common  tgkill                  __x64_sys_tgkill
+235     common  utimes                  __x64_sys_utimes
 236     64      vserver
-237     common  mbind                   sys_mbind
-238     common  set_mempolicy           sys_set_mempolicy
-239     common  get_mempolicy           sys_get_mempolicy
-240     common  mq_open                 sys_mq_open
-241     common  mq_unlink               sys_mq_unlink
-242     common  mq_timedsend            sys_mq_timedsend
-243     common  mq_timedreceive         sys_mq_timedreceive
-244     64      mq_notify               sys_mq_notify
-245     common  mq_getsetattr           sys_mq_getsetattr
-246     64      kexec_load              sys_kexec_load
-247     64      waitid                  sys_waitid
-248     common  add_key                 sys_add_key
-249     common  request_key             sys_request_key
-250     common  keyctl                  sys_keyctl
-251     common  ioprio_set              sys_ioprio_set
-252     common  ioprio_get              sys_ioprio_get
-253     common  inotify_init            sys_inotify_init
-254     common  inotify_add_watch       sys_inotify_add_watch
-255     common  inotify_rm_watch        sys_inotify_rm_watch
-256     common  migrate_pages           sys_migrate_pages
-257     common  openat                  sys_openat
-258     common  mkdirat                 sys_mkdirat
-259     common  mknodat                 sys_mknodat
-260     common  fchownat                sys_fchownat
-261     common  futimesat               sys_futimesat
-262     common  newfstatat              sys_newfstatat
-263     common  unlinkat                sys_unlinkat
-264     common  renameat                sys_renameat
-265     common  linkat                  sys_linkat
-266     common  symlinkat               sys_symlinkat
-267     common  readlinkat              sys_readlinkat
-268     common  fchmodat                sys_fchmodat
-269     common  faccessat               sys_faccessat
-270     common  pselect6                sys_pselect6
-271     common  ppoll                   sys_ppoll
-272     common  unshare                 sys_unshare
-273     64      set_robust_list         sys_set_robust_list
-274     64      get_robust_list         sys_get_robust_list
-275     common  splice                  sys_splice
-276     common  tee                     sys_tee
-277     common  sync_file_range         sys_sync_file_range
-278     64      vmsplice                sys_vmsplice
-279     64      move_pages              sys_move_pages
-280     common  utimensat               sys_utimensat
-281     common  epoll_pwait             sys_epoll_pwait
-282     common  signalfd                sys_signalfd
-283     common  timerfd_create          sys_timerfd_create
-284     common  eventfd                 sys_eventfd
-285     common  fallocate               sys_fallocate
-286     common  timerfd_settime         sys_timerfd_settime
-287     common  timerfd_gettime         sys_timerfd_gettime
-288     common  accept4                 sys_accept4
-289     common  signalfd4               sys_signalfd4
-290     common  eventfd2                sys_eventfd2
-291     common  epoll_create1           sys_epoll_create1
-292     common  dup3                    sys_dup3
-293     common  pipe2                   sys_pipe2
-294     common  inotify_init1           sys_inotify_init1
-295     64      preadv                  sys_preadv
-296     64      pwritev                 sys_pwritev
-297     64      rt_tgsigqueueinfo       sys_rt_tgsigqueueinfo
-298     common  perf_event_open         sys_perf_event_open
-299     64      recvmmsg                sys_recvmmsg
-300     common  fanotify_init           sys_fanotify_init
-301     common  fanotify_mark           sys_fanotify_mark
-302     common  prlimit64               sys_prlimit64
-303     common  name_to_handle_at       sys_name_to_handle_at
-304     common  open_by_handle_at       sys_open_by_handle_at
-305     common  clock_adjtime           sys_clock_adjtime
-306     common  syncfs                  sys_syncfs
-307     64      sendmmsg                sys_sendmmsg
-308     common  setns                   sys_setns
-309     common  getcpu                  sys_getcpu
-310     64      process_vm_readv        sys_process_vm_readv
-311     64      process_vm_writev       sys_process_vm_writev
-312     common  kcmp                    sys_kcmp
-313     common  finit_module            sys_finit_module
-314     common  sched_setattr           sys_sched_setattr
-315     common  sched_getattr           sys_sched_getattr
-316     common  renameat2               sys_renameat2
-317     common  seccomp                 sys_seccomp
-318     common  getrandom               sys_getrandom
-319     common  memfd_create            sys_memfd_create
-320     common  kexec_file_load         sys_kexec_file_load
-321     common  bpf                     sys_bpf
-322     64      execveat                sys_execveat/ptregs
-323     common  userfaultfd             sys_userfaultfd
-324     common  membarrier              sys_membarrier
-325     common  mlock2                  sys_mlock2
-326     common  copy_file_range         sys_copy_file_range
-327     64      preadv2                 sys_preadv2
-328     64      pwritev2                sys_pwritev2
-329     common  pkey_mprotect           sys_pkey_mprotect
-330     common  pkey_alloc              sys_pkey_alloc
-331     common  pkey_free               sys_pkey_free
-332     common  statx                   sys_statx
+237     common  mbind                   __x64_sys_mbind
+238     common  set_mempolicy           __x64_sys_set_mempolicy
+239     common  get_mempolicy           __x64_sys_get_mempolicy
+240     common  mq_open                 __x64_sys_mq_open
+241     common  mq_unlink               __x64_sys_mq_unlink
+242     common  mq_timedsend            __x64_sys_mq_timedsend
+243     common  mq_timedreceive         __x64_sys_mq_timedreceive
+244     64      mq_notify               __x64_sys_mq_notify
+245     common  mq_getsetattr           __x64_sys_mq_getsetattr
+246     64      kexec_load              __x64_sys_kexec_load
+247     64      waitid                  __x64_sys_waitid
+248     common  add_key                 __x64_sys_add_key
+249     common  request_key             __x64_sys_request_key
+250     common  keyctl                  __x64_sys_keyctl
+251     common  ioprio_set              __x64_sys_ioprio_set
+252     common  ioprio_get              __x64_sys_ioprio_get
+253     common  inotify_init            __x64_sys_inotify_init
+254     common  inotify_add_watch       __x64_sys_inotify_add_watch
+255     common  inotify_rm_watch        __x64_sys_inotify_rm_watch
+256     common  migrate_pages           __x64_sys_migrate_pages
+257     common  openat                  __x64_sys_openat
+258     common  mkdirat                 __x64_sys_mkdirat
+259     common  mknodat                 __x64_sys_mknodat
+260     common  fchownat                __x64_sys_fchownat
+261     common  futimesat               __x64_sys_futimesat
+262     common  newfstatat              __x64_sys_newfstatat
+263     common  unlinkat                __x64_sys_unlinkat
+264     common  renameat                __x64_sys_renameat
+265     common  linkat                  __x64_sys_linkat
+266     common  symlinkat               __x64_sys_symlinkat
+267     common  readlinkat              __x64_sys_readlinkat
+268     common  fchmodat                __x64_sys_fchmodat
+269     common  faccessat               __x64_sys_faccessat
+270     common  pselect6                __x64_sys_pselect6
+271     common  ppoll                   __x64_sys_ppoll
+272     common  unshare                 __x64_sys_unshare
+273     64      set_robust_list         __x64_sys_set_robust_list
+274     64      get_robust_list         __x64_sys_get_robust_list
+275     common  splice                  __x64_sys_splice
+276     common  tee                     __x64_sys_tee
+277     common  sync_file_range         __x64_sys_sync_file_range
+278     64      vmsplice                __x64_sys_vmsplice
+279     64      move_pages              __x64_sys_move_pages
+280     common  utimensat               __x64_sys_utimensat
+281     common  epoll_pwait             __x64_sys_epoll_pwait
+282     common  signalfd                __x64_sys_signalfd
+283     common  timerfd_create          __x64_sys_timerfd_create
+284     common  eventfd                 __x64_sys_eventfd
+285     common  fallocate               __x64_sys_fallocate
+286     common  timerfd_settime         __x64_sys_timerfd_settime
+287     common  timerfd_gettime         __x64_sys_timerfd_gettime
+288     common  accept4                 __x64_sys_accept4
+289     common  signalfd4               __x64_sys_signalfd4
+290     common  eventfd2                __x64_sys_eventfd2
+291     common  epoll_create1           __x64_sys_epoll_create1
+292     common  dup3                    __x64_sys_dup3
+293     common  pipe2                   __x64_sys_pipe2
+294     common  inotify_init1           __x64_sys_inotify_init1
+295     64      preadv                  __x64_sys_preadv
+296     64      pwritev                 __x64_sys_pwritev
+297     64      rt_tgsigqueueinfo       __x64_sys_rt_tgsigqueueinfo
+298     common  perf_event_open         __x64_sys_perf_event_open
+299     64      recvmmsg                __x64_sys_recvmmsg
+300     common  fanotify_init           __x64_sys_fanotify_init
+301     common  fanotify_mark           __x64_sys_fanotify_mark
+302     common  prlimit64               __x64_sys_prlimit64
+303     common  name_to_handle_at       __x64_sys_name_to_handle_at
+304     common  open_by_handle_at       __x64_sys_open_by_handle_at
+305     common  clock_adjtime           __x64_sys_clock_adjtime
+306     common  syncfs                  __x64_sys_syncfs
+307     64      sendmmsg                __x64_sys_sendmmsg
+308     common  setns                   __x64_sys_setns
+309     common  getcpu                  __x64_sys_getcpu
+310     64      process_vm_readv        __x64_sys_process_vm_readv
+311     64      process_vm_writev       __x64_sys_process_vm_writev
+312     common  kcmp                    __x64_sys_kcmp
+313     common  finit_module            __x64_sys_finit_module
+314     common  sched_setattr           __x64_sys_sched_setattr
+315     common  sched_getattr           __x64_sys_sched_getattr
+316     common  renameat2               __x64_sys_renameat2
+317     common  seccomp                 __x64_sys_seccomp
+318     common  getrandom               __x64_sys_getrandom
+319     common  memfd_create            __x64_sys_memfd_create
+320     common  kexec_file_load         __x64_sys_kexec_file_load
+321     common  bpf                     __x64_sys_bpf
+322     64      execveat                __x64_sys_execveat/ptregs
+323     common  userfaultfd             __x64_sys_userfaultfd
+324     common  membarrier              __x64_sys_membarrier
+325     common  mlock2                  __x64_sys_mlock2
+326     common  copy_file_range         __x64_sys_copy_file_range
+327     64      preadv2                 __x64_sys_preadv2
+328     64      pwritev2                __x64_sys_pwritev2
+329     common  pkey_mprotect           __x64_sys_pkey_mprotect
+330     common  pkey_alloc              __x64_sys_pkey_alloc
+331     common  pkey_free               __x64_sys_pkey_free
+332     common  statx                   __x64_sys_statx
 
 #
 # x32-specific system call numbers start at 512 to avoid cache impact
-# for native 64-bit operation.
+# for native 64-bit operation. The __x32_compat_sys stubs are created
+# on-the-fly for compat_sys_*() compatibility system calls if X86_X32
+# is defined.
 #
-512     x32     rt_sigaction            compat_sys_rt_sigaction
+512     x32     rt_sigaction            __x32_compat_sys_rt_sigaction
 513     x32     rt_sigreturn            sys32_x32_rt_sigreturn
-514     x32     ioctl                   compat_sys_ioctl
-515     x32     readv                   compat_sys_readv
-516     x32     writev                  compat_sys_writev
-517     x32     recvfrom                compat_sys_recvfrom
-518     x32     sendmsg                 compat_sys_sendmsg
-519     x32     recvmsg                 compat_sys_recvmsg
-520     x32     execve                  compat_sys_execve/ptregs
-521     x32     ptrace                  compat_sys_ptrace
-522     x32     rt_sigpending           compat_sys_rt_sigpending
-523     x32     rt_sigtimedwait         compat_sys_rt_sigtimedwait
-524     x32     rt_sigqueueinfo         compat_sys_rt_sigqueueinfo
-525     x32     sigaltstack             compat_sys_sigaltstack
-526     x32     timer_create            compat_sys_timer_create
-527     x32     mq_notify               compat_sys_mq_notify
-528     x32     kexec_load              compat_sys_kexec_load
-529     x32     waitid                  compat_sys_waitid
-530     x32     set_robust_list         compat_sys_set_robust_list
-531     x32     get_robust_list         compat_sys_get_robust_list
-532     x32     vmsplice                compat_sys_vmsplice
-533     x32     move_pages              compat_sys_move_pages
-534     x32     preadv                  compat_sys_preadv64
-535     x32     pwritev                 compat_sys_pwritev64
-536     x32     rt_tgsigqueueinfo       compat_sys_rt_tgsigqueueinfo
-537     x32     recvmmsg                compat_sys_recvmmsg
-538     x32     sendmmsg                compat_sys_sendmmsg
-539     x32     process_vm_readv        compat_sys_process_vm_readv
-540     x32     process_vm_writev       compat_sys_process_vm_writev
-541     x32     setsockopt              compat_sys_setsockopt
-542     x32     getsockopt              compat_sys_getsockopt
-543     x32     io_setup                compat_sys_io_setup
-544     x32     io_submit               compat_sys_io_submit
-545     x32     execveat                compat_sys_execveat/ptregs
-546     x32     preadv2                 compat_sys_preadv64v2
-547     x32     pwritev2                compat_sys_pwritev64v2
+514     x32     ioctl                   __x32_compat_sys_ioctl
+515     x32     readv                   __x32_compat_sys_readv
+516     x32     writev                  __x32_compat_sys_writev
+517     x32     recvfrom                __x32_compat_sys_recvfrom
+518     x32     sendmsg                 __x32_compat_sys_sendmsg
+519     x32     recvmsg                 __x32_compat_sys_recvmsg
+520     x32     execve                  __x32_compat_sys_execve/ptregs
+521     x32     ptrace                  __x32_compat_sys_ptrace
+522     x32     rt_sigpending           __x32_compat_sys_rt_sigpending
+523     x32     rt_sigtimedwait         __x32_compat_sys_rt_sigtimedwait
+524     x32     rt_sigqueueinfo         __x32_compat_sys_rt_sigqueueinfo
+525     x32     sigaltstack             __x32_compat_sys_sigaltstack
+526     x32     timer_create            __x32_compat_sys_timer_create
+527     x32     mq_notify               __x32_compat_sys_mq_notify
+528     x32     kexec_load              __x32_compat_sys_kexec_load
+529     x32     waitid                  __x32_compat_sys_waitid
+530     x32     set_robust_list         __x32_compat_sys_set_robust_list
+531     x32     get_robust_list         __x32_compat_sys_get_robust_list
+532     x32     vmsplice                __x32_compat_sys_vmsplice
+533     x32     move_pages              __x32_compat_sys_move_pages
+534     x32     preadv                  __x32_compat_sys_preadv64
+535     x32     pwritev                 __x32_compat_sys_pwritev64
+536     x32     rt_tgsigqueueinfo       __x32_compat_sys_rt_tgsigqueueinfo
+537     x32     recvmmsg                __x32_compat_sys_recvmmsg
+538     x32     sendmmsg                __x32_compat_sys_sendmmsg
+539     x32     process_vm_readv        __x32_compat_sys_process_vm_readv
+540     x32     process_vm_writev       __x32_compat_sys_process_vm_writev
+541     x32     setsockopt              __x32_compat_sys_setsockopt
+542     x32     getsockopt              __x32_compat_sys_getsockopt
+543     x32     io_setup                __x32_compat_sys_io_setup
+544     x32     io_submit               __x32_compat_sys_io_submit
+545     x32     execveat                __x32_compat_sys_execveat/ptregs
+546     x32     preadv2                 __x32_compat_sys_preadv64v2
+547     x32     pwritev2                __x32_compat_sys_pwritev64v2
diff --git a/tools/perf/arch/x86/tests/perf-time-to-tsc.c b/tools/perf/arch/x86/tests/perf-time-to-tsc.c
index 06abe8108b33..7a7721604b86 100644
--- a/tools/perf/arch/x86/tests/perf-time-to-tsc.c
+++ b/tools/perf/arch/x86/tests/perf-time-to-tsc.c
@@ -60,6 +60,7 @@ int test__perf_time_to_tsc(struct test *test __maybe_unused, int subtest __maybe
         union perf_event *event;
         u64 test_tsc, comm1_tsc, comm2_tsc;
         u64 test_time, comm1_time = 0, comm2_time = 0;
+        struct perf_mmap *md;
 
         threads = thread_map__new(-1, getpid(), UINT_MAX);
         CHECK_NOT_NULL__(threads);
@@ -109,7 +110,11 @@ int test__perf_time_to_tsc(struct test *test __maybe_unused, int subtest __maybe
         perf_evlist__disable(evlist);
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
-                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                md = &evlist->mmap[i];
+                if (perf_mmap__read_init(md) < 0)
+                        continue;
+
+                while ((event = perf_mmap__read_event(md)) != NULL) {
                         struct perf_sample sample;
 
                         if (event->header.type != PERF_RECORD_COMM ||
@@ -128,8 +133,9 @@ int test__perf_time_to_tsc(struct test *test __maybe_unused, int subtest __maybe
                                 comm2_time = sample.time;
                         }
 next_event:
-                        perf_evlist__mmap_consume(evlist, i);
+                        perf_mmap__consume(md);
                 }
+                perf_mmap__read_done(md);
         }
 
         if (!comm1_time || !comm2_time)
diff --git a/tools/perf/arch/x86/util/auxtrace.c b/tools/perf/arch/x86/util/auxtrace.c
index 6aa3f2a38321..b135af62011c 100644
--- a/tools/perf/arch/x86/util/auxtrace.c
+++ b/tools/perf/arch/x86/util/auxtrace.c
@@ -37,15 +37,11 @@ struct auxtrace_record *auxtrace_record__init_intel(struct perf_evlist *evlist,
         intel_pt_pmu = perf_pmu__find(INTEL_PT_PMU_NAME);
         intel_bts_pmu = perf_pmu__find(INTEL_BTS_PMU_NAME);
 
-        if (evlist) {
-                evlist__for_each_entry(evlist, evsel) {
-                        if (intel_pt_pmu &&
-                            evsel->attr.type == intel_pt_pmu->type)
-                                found_pt = true;
-                        if (intel_bts_pmu &&
-                            evsel->attr.type == intel_bts_pmu->type)
-                                found_bts = true;
-                }
+        evlist__for_each_entry(evlist, evsel) {
+                if (intel_pt_pmu && evsel->attr.type == intel_pt_pmu->type)
+                        found_pt = true;
+                if (intel_bts_pmu && evsel->attr.type == intel_bts_pmu->type)
+                        found_bts = true;
         }
 
         if (found_pt && found_bts) {
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index 944070e98a2c..63eb49082774 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -175,7 +175,7 @@ static const struct option options[] = {
         OPT_UINTEGER('s', "nr_secs"     , &p0.nr_secs,          "max number of seconds to run (default: 5 secs)"),
         OPT_UINTEGER('u', "usleep"      , &p0.sleep_usecs,      "usecs to sleep per loop iteration"),
 
-        OPT_BOOLEAN('R', "data_reads"   , &p0.data_reads,       "access the data via writes (can be mixed with -W)"),
+        OPT_BOOLEAN('R', "data_reads"   , &p0.data_reads,       "access the data via reads (can be mixed with -W)"),
         OPT_BOOLEAN('W', "data_writes"  , &p0.data_writes,      "access the data via writes (can be mixed with -R)"),
         OPT_BOOLEAN('B', "data_backwards", &p0.data_backwards,  "access the data backwards as well"),
         OPT_BOOLEAN('Z', "data_zero_memset", &p0.data_zero_memset,"access the data via glibc bzero only"),
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index f15731a3d438..51709a961496 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -40,10 +40,11 @@
 struct perf_annotate {
         struct perf_tool tool;
         struct perf_session *session;
-        bool       use_tui, use_stdio, use_gtk;
+        bool       use_tui, use_stdio, use_stdio2, use_gtk;
         bool       full_paths;
         bool       print_line;
         bool       skip_missing;
+        bool       has_br_stack;
         const char *sym_hist_filter;
         const char *cpu_list;
         DECLARE_BITMAP(cpu_bitmap, MAX_NR_CPUS);
@@ -146,16 +147,78 @@ static void process_branch_stack(struct branch_stack *bs, struct addr_location *
         free(bi);
 }
 
+static int hist_iter__branch_callback(struct hist_entry_iter *iter,
+                                      struct addr_location *al __maybe_unused,
+                                      bool single __maybe_unused,
+                                      void *arg __maybe_unused)
+{
+        struct hist_entry *he = iter->he;
+        struct branch_info *bi;
+        struct perf_sample *sample = iter->sample;
+        struct perf_evsel *evsel = iter->evsel;
+        int err;
+
+        hist__account_cycles(sample->branch_stack, al, sample, false);
+
+        bi = he->branch_info;
+        err = addr_map_symbol__inc_samples(&bi->from, sample, evsel->idx);
+
+        if (err)
+                goto out;
+
+        err = addr_map_symbol__inc_samples(&bi->to, sample, evsel->idx);
+
+out:
+        return err;
+}
+
+static int process_branch_callback(struct perf_evsel *evsel,
+                                   struct perf_sample *sample,
+                                   struct addr_location *al __maybe_unused,
+                                   struct perf_annotate *ann,
+                                   struct machine *machine)
+{
+        struct hist_entry_iter iter = {
+                .evsel          = evsel,
+                .sample         = sample,
+                .add_entry_cb   = hist_iter__branch_callback,
+                .hide_unresolved        = symbol_conf.hide_unresolved,
+                .ops            = &hist_iter_branch,
+        };
+
+        struct addr_location a;
+        int ret;
+
+        if (machine__resolve(machine, &a, sample) < 0)
+                return -1;
+
+        if (a.sym == NULL)
+                return 0;
+
+        if (a.map != NULL)
+                a.map->dso->hit = 1;
+
+        ret = hist_entry_iter__add(&iter, &a, PERF_MAX_STACK_DEPTH, ann);
+        return ret;
+}
+
+static bool has_annotation(struct perf_annotate *ann)
+{
+        return ui__has_annotation() || ann->use_stdio2;
+}
+
 static int perf_evsel__add_sample(struct perf_evsel *evsel,
                                   struct perf_sample *sample,
                                   struct addr_location *al,
-                                  struct perf_annotate *ann)
+                                  struct perf_annotate *ann,
+                                  struct machine *machine)
 {
         struct hists *hists = evsel__hists(evsel);
         struct hist_entry *he;
         int ret;
 
-        if (ann->sym_hist_filter != NULL &&
+        if ((!ann->has_br_stack || !has_annotation(ann)) &&
+            ann->sym_hist_filter != NULL &&
             (al->sym == NULL ||
              strcmp(ann->sym_hist_filter, al->sym->name) != 0)) {
                 /* We're only interested in a symbol named sym_hist_filter */
@@ -178,6 +241,9 @@ static int perf_evsel__add_sample(struct perf_evsel *evsel,
          */
         process_branch_stack(sample->branch_stack, al, sample);
 
+        if (ann->has_br_stack && has_annotation(ann))
+                return process_branch_callback(evsel, sample, al, ann, machine);
+
         he = hists__add_entry(hists, al, NULL, NULL, NULL, sample, true);
         if (he == NULL)
                 return -ENOMEM;
@@ -206,7 +272,8 @@ static int process_sample_event(struct perf_tool *tool,
         if (ann->cpu_list && !test_bit(sample->cpu, ann->cpu_bitmap))
                 goto out_put;
 
-        if (!al.filtered && perf_evsel__add_sample(evsel, sample, &al, ann)) {
+        if (!al.filtered &&
+            perf_evsel__add_sample(evsel, sample, &al, ann, machine)) {
                 pr_warning("problem incrementing symbol count, "
                            "skipping event\n");
                 ret = -1;
@@ -220,8 +287,11 @@ static int hist_entry__tty_annotate(struct hist_entry *he,
                                     struct perf_evsel *evsel,
                                     struct perf_annotate *ann)
 {
-        return symbol__tty_annotate(he->ms.sym, he->ms.map, evsel,
-                                    ann->print_line, ann->full_paths, 0, 0);
+        if (!ann->use_stdio2)
+                return symbol__tty_annotate(he->ms.sym, he->ms.map, evsel,
+                                            ann->print_line, ann->full_paths, 0, 0);
+        return symbol__tty_annotate2(he->ms.sym, he->ms.map, evsel,
+                                     ann->print_line, ann->full_paths);
 }
 
 static void hists__find_annotations(struct hists *hists,
@@ -238,6 +308,10 @@ static void hists__find_annotations(struct hists *hists,
                 if (he->ms.sym == NULL || he->ms.map->dso->annotate_warned)
                         goto find_next;
 
+                if (ann->sym_hist_filter &&
+                    (strcmp(he->ms.sym->name, ann->sym_hist_filter) != 0))
+                        goto find_next;
+
                 notes = symbol__annotation(he->ms.sym);
                 if (notes->src == NULL) {
 find_next:
@@ -269,6 +343,7 @@ find_next:
                         nd = rb_next(nd);
                 } else if (use_browser == 1) {
                         key = hist_entry__tui_annotate(he, evsel, NULL);
+
                         switch (key) {
                         case -1:
                                 if (!ann->skip_missing)
@@ -420,6 +495,9 @@ int cmd_annotate(int argc, const char **argv)
         OPT_BOOLEAN(0, "gtk", &annotate.use_gtk, "Use the GTK interface"),
         OPT_BOOLEAN(0, "tui", &annotate.use_tui, "Use the TUI interface"),
         OPT_BOOLEAN(0, "stdio", &annotate.use_stdio, "Use the stdio interface"),
+        OPT_BOOLEAN(0, "stdio2", &annotate.use_stdio2, "Use the stdio interface"),
+        OPT_BOOLEAN(0, "ignore-vmlinux", &symbol_conf.ignore_vmlinux,
+                    "don't load vmlinux even if found"),
         OPT_STRING('k', "vmlinux", &symbol_conf.vmlinux_name,
                    "file", "vmlinux pathname"),
         OPT_BOOLEAN('m', "modules", &symbol_conf.use_modules,
@@ -489,20 +567,22 @@ int cmd_annotate(int argc, const char **argv)
         if (annotate.session == NULL)
                 return -1;
 
+        annotate.has_br_stack = perf_header__has_feat(&annotate.session->header,
+                                                      HEADER_BRANCH_STACK);
+
         ret = symbol__annotation_init();
         if (ret < 0)
                 goto out_delete;
 
+        annotation_config__init();
+
         symbol_conf.try_vmlinux_path = true;
 
         ret = symbol__init(&annotate.session->header.env);
         if (ret < 0)
                 goto out_delete;
 
-        if (setup_sorting(NULL) < 0)
-                usage_with_options(annotate_usage, options);
-
-        if (annotate.use_stdio)
+        if (annotate.use_stdio || annotate.use_stdio2)
                 use_browser = 0;
         else if (annotate.use_tui)
                 use_browser = 1;
@@ -511,6 +591,15 @@ int cmd_annotate(int argc, const char **argv)
 
         setup_browser(true);
 
+        if ((use_browser == 1 || annotate.use_stdio2) && annotate.has_br_stack) {
+                sort__mode = SORT_MODE__BRANCH;
+                if (setup_sorting(annotate.session->evlist) < 0)
+                        usage_with_options(annotate_usage, options);
+        } else {
+                if (setup_sorting(NULL) < 0)
+                        usage_with_options(annotate_usage, options);
+        }
+
         ret = __cmd_annotate(&annotate);
 
 out_delete:
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index 539c3d460158..2126bfbcb385 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -32,6 +32,7 @@
 #include "evsel.h"
 #include "ui/browsers/hists.h"
 #include "thread.h"
+#include "mem2node.h"
 
 struct c2c_hists {
         struct hists            hists;
@@ -49,6 +50,7 @@ struct c2c_hist_entry {
         struct c2c_hists        *hists;
         struct c2c_stats         stats;
         unsigned long           *cpuset;
+        unsigned long           *nodeset;
         struct c2c_stats        *node_stats;
         unsigned int             cacheline_idx;
 
@@ -59,6 +61,11 @@ struct c2c_hist_entry {
          * because of its callchain dynamic entry
          */
         struct hist_entry       he;
+
+        unsigned long            paddr;
+        unsigned long            paddr_cnt;
+        bool                     paddr_zero;
+        char                    *nodestr;
 };
 
 static char const *coalesce_default = "pid,iaddr";
@@ -66,6 +73,7 @@ static char const *coalesce_default = "pid,iaddr";
 struct perf_c2c {
         struct perf_tool        tool;
         struct c2c_hists        hists;
+        struct mem2node         mem2node;
 
         unsigned long           **nodes;
         int                      nodes_cnt;
@@ -123,6 +131,10 @@ static void *c2c_he_zalloc(size_t size)
         if (!c2c_he->cpuset)
                 return NULL;
 
+        c2c_he->nodeset = bitmap_alloc(c2c.nodes_cnt);
+        if (!c2c_he->nodeset)
+                return NULL;
+
         c2c_he->node_stats = zalloc(c2c.nodes_cnt * sizeof(*c2c_he->node_stats));
         if (!c2c_he->node_stats)
                 return NULL;
@@ -145,6 +157,8 @@ static void c2c_he_free(void *he)
         }
 
         free(c2c_he->cpuset);
+        free(c2c_he->nodeset);
+        free(c2c_he->nodestr);
         free(c2c_he->node_stats);
         free(c2c_he);
 }
@@ -194,6 +208,28 @@ static void c2c_he__set_cpu(struct c2c_hist_entry *c2c_he,
         set_bit(sample->cpu, c2c_he->cpuset);
 }
 
+static void c2c_he__set_node(struct c2c_hist_entry *c2c_he,
+                             struct perf_sample *sample)
+{
+        int node;
+
+        if (!sample->phys_addr) {
+                c2c_he->paddr_zero = true;
+                return;
+        }
+
+        node = mem2node__node(&c2c.mem2node, sample->phys_addr);
+        if (WARN_ONCE(node < 0, "WARNING: failed to find node\n"))
+                return;
+
+        set_bit(node, c2c_he->nodeset);
+
+        if (c2c_he->paddr != sample->phys_addr) {
+                c2c_he->paddr_cnt++;
+                c2c_he->paddr = sample->phys_addr;
+        }
+}
+
 static void compute_stats(struct c2c_hist_entry *c2c_he,
                           struct c2c_stats *stats,
                           u64 weight)
@@ -237,9 +273,12 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
         if (mi == NULL)
                 return -ENOMEM;
 
-        mi_dup = memdup(mi, sizeof(*mi));
-        if (!mi_dup)
-                goto free_mi;
+        /*
+         * The mi object is released in hists__add_entry_ops,
+         * if it gets sorted out into existing data, so we need
+         * to take the copy now.
+         */
+        mi_dup = mem_info__get(mi);
 
         c2c_decode_stats(&stats, mi);
 
@@ -247,13 +286,14 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
                                   &al, NULL, NULL, mi,
                                   sample, true);
         if (he == NULL)
-                goto free_mi_dup;
+                goto free_mi;
 
         c2c_he = container_of(he, struct c2c_hist_entry, he);
         c2c_add_stats(&c2c_he->stats, &stats);
         c2c_add_stats(&c2c_hists->stats, &stats);
 
         c2c_he__set_cpu(c2c_he, sample);
+        c2c_he__set_node(c2c_he, sample);
 
         hists__inc_nr_samples(&c2c_hists->hists, he->filtered);
         ret = hist_entry__append_callchain(he, sample);
@@ -272,19 +312,15 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
 
                 mi = mi_dup;
 
-                mi_dup = memdup(mi, sizeof(*mi));
-                if (!mi_dup)
-                        goto free_mi;
-
                 c2c_hists = he__get_c2c_hists(he, c2c.cl_sort, 2);
                 if (!c2c_hists)
-                        goto free_mi_dup;
+                        goto free_mi;
 
                 he = hists__add_entry_ops(&c2c_hists->hists, &c2c_entry_ops,
                                           &al, NULL, NULL, mi,
                                           sample, true);
                 if (he == NULL)
-                        goto free_mi_dup;
+                        goto free_mi;
 
                 c2c_he = container_of(he, struct c2c_hist_entry, he);
                 c2c_add_stats(&c2c_he->stats, &stats);
@@ -294,6 +330,7 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
                 compute_stats(c2c_he, &stats, sample->weight);
 
                 c2c_he__set_cpu(c2c_he, sample);
+                c2c_he__set_node(c2c_he, sample);
 
                 hists__inc_nr_samples(&c2c_hists->hists, he->filtered);
                 ret = hist_entry__append_callchain(he, sample);
@@ -303,10 +340,9 @@ out:
         addr_location__put(&al);
         return ret;
 
-free_mi_dup:
-        free(mi_dup);
 free_mi:
-        free(mi);
+        mem_info__put(mi_dup);
+        mem_info__put(mi);
         ret = -ENOMEM;
         goto out;
 }
@@ -457,6 +493,31 @@ static int dcacheline_entry(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
         return scnprintf(hpp->buf, hpp->size, "%*s", width, HEX_STR(buf, addr));
 }
 
+static int
+dcacheline_node_entry(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
+                      struct hist_entry *he)
+{
+        struct c2c_hist_entry *c2c_he;
+        int width = c2c_width(fmt, hpp, he->hists);
+
+        c2c_he = container_of(he, struct c2c_hist_entry, he);
+        if (WARN_ON_ONCE(!c2c_he->nodestr))
+                return 0;
+
+        return scnprintf(hpp->buf, hpp->size, "%*s", width, c2c_he->nodestr);
+}
+
+static int
+dcacheline_node_count(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
+                      struct hist_entry *he)
+{
+        struct c2c_hist_entry *c2c_he;
+        int width = c2c_width(fmt, hpp, he->hists);
+
+        c2c_he = container_of(he, struct c2c_hist_entry, he);
+        return scnprintf(hpp->buf, hpp->size, "%*lu", width, c2c_he->paddr_cnt);
+}
+
 static int offset_entry(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
                         struct hist_entry *he)
 {
@@ -1202,23 +1263,47 @@ cl_idx_empty_entry(struct perf_hpp_fmt *fmt, struct perf_hpp *hpp,
         }
 
 static struct c2c_dimension dim_dcacheline = {
-        .header         = HEADER_LOW("Cacheline"),
+        .header         = HEADER_SPAN("--- Cacheline ----", "Address", 2),
         .name           = "dcacheline",
         .cmp            = dcacheline_cmp,
         .entry          = dcacheline_entry,
         .width          = 18,
 };
 
-static struct c2c_header header_offset_tui = HEADER_LOW("Off");
+static struct c2c_dimension dim_dcacheline_node = {
+        .header         = HEADER_LOW("Node"),
+        .name           = "dcacheline_node",
+        .cmp            = empty_cmp,
+        .entry          = dcacheline_node_entry,
+        .width          = 4,
+};
+
+static struct c2c_dimension dim_dcacheline_count = {
+        .header         = HEADER_LOW("PA cnt"),
+        .name           = "dcacheline_count",
+        .cmp            = empty_cmp,
+        .entry          = dcacheline_node_count,
+        .width          = 6,
+};
+
+static struct c2c_header header_offset_tui = HEADER_SPAN("-----", "Off", 2);
 
 static struct c2c_dimension dim_offset = {
-        .header         = HEADER_BOTH("Data address", "Offset"),
+        .header         = HEADER_SPAN("--- Data address -", "Offset", 2),
         .name           = "offset",
         .cmp            = offset_cmp,
         .entry          = offset_entry,
         .width          = 18,
 };
 
+static struct c2c_dimension dim_offset_node = {
+        .header         = HEADER_LOW("Node"),
+        .name           = "offset_node",
+        .cmp            = empty_cmp,
+        .entry          = dcacheline_node_entry,
+        .width          = 4,
+};
+
 static struct c2c_dimension dim_iaddr = {
         .header         = HEADER_LOW("Code address"),
         .name           = "iaddr",
@@ -1538,7 +1623,10 @@ static struct c2c_dimension dim_dcacheline_num_empty = {
 
 static struct c2c_dimension *dimensions[] = {
         &dim_dcacheline,
+        &dim_dcacheline_node,
+        &dim_dcacheline_count,
         &dim_offset,
+        &dim_offset_node,
         &dim_iaddr,
         &dim_tot_hitm,
         &dim_lcl_hitm,
@@ -1841,20 +1929,56 @@ static inline int valid_hitm_or_store(struct hist_entry *he)
         return has_hitm || c2c_he->stats.store;
 }
 
-static void calc_width(struct hist_entry *he)
+static void set_node_width(struct c2c_hist_entry *c2c_he, int len)
+{
+        struct c2c_dimension *dim;
+
+        dim = &c2c.hists == c2c_he->hists ?
+              &dim_dcacheline_node : &dim_offset_node;
+
+        if (len > dim->width)
+                dim->width = len;
+}
+
+static int set_nodestr(struct c2c_hist_entry *c2c_he)
+{
+        char buf[30];
+        int len;
+
+        if (c2c_he->nodestr)
+                return 0;
+
+        if (bitmap_weight(c2c_he->nodeset, c2c.nodes_cnt)) {
+                len = bitmap_scnprintf(c2c_he->nodeset, c2c.nodes_cnt,
+                                      buf, sizeof(buf));
+        } else {
+                len = scnprintf(buf, sizeof(buf), "N/A");
+        }
+
+        set_node_width(c2c_he, len);
+        c2c_he->nodestr = strdup(buf);
+        return c2c_he->nodestr ? 0 : -ENOMEM;
+}
+
+static void calc_width(struct c2c_hist_entry *c2c_he)
 {
         struct c2c_hists *c2c_hists;
 
-        c2c_hists = container_of(he->hists, struct c2c_hists, hists);
-        hists__calc_col_len(&c2c_hists->hists, he);
+        c2c_hists = container_of(c2c_he->he.hists, struct c2c_hists, hists);
+        hists__calc_col_len(&c2c_hists->hists, &c2c_he->he);
+        set_nodestr(c2c_he);
 }
 
 static int filter_cb(struct hist_entry *he)
 {
+        struct c2c_hist_entry *c2c_he;
+
+        c2c_he = container_of(he, struct c2c_hist_entry, he);
+
         if (c2c.show_src && !he->srcline)
                 he->srcline = hist_entry__get_srcline(he);
 
-        calc_width(he);
+        calc_width(c2c_he);
 
         if (!valid_hitm_or_store(he))
                 he->filtered = HIST_FILTER__C2C;
@@ -1871,12 +1995,11 @@ static int resort_cl_cb(struct hist_entry *he)
         c2c_he = container_of(he, struct c2c_hist_entry, he);
         c2c_hists = c2c_he->hists;
 
-        calc_width(he);
-
         if (display && c2c_hists) {
                 static unsigned int idx;
 
                 c2c_he->cacheline_idx = idx++;
+                calc_width(c2c_he);
 
                 c2c_hists__reinit(c2c_hists, c2c.cl_output, c2c.cl_resort);
 
@@ -2350,14 +2473,66 @@ static void perf_c2c_display(struct perf_session *session)
 }
 #endif /* HAVE_SLANG_SUPPORT */
 
-static void ui_quirks(void)
+static char *fill_line(const char *orig, int len)
+{
+        int i, j, olen = strlen(orig);
+        char *buf;
+
+        buf = zalloc(len + 1);
+        if (!buf)
+                return NULL;
+
+        j = len / 2 - olen / 2;
+
+        for (i = 0; i < j - 1; i++)
+                buf[i] = '-';
+
+        buf[i++] = ' ';
+
+        strcpy(buf + i, orig);
+
+        i += olen;
+
+        buf[i++] = ' ';
+
+        for (; i < len; i++)
+                buf[i] = '-';
+
+        return buf;
+}
+
+static int ui_quirks(void)
 {
+        const char *nodestr = "Data address";
+        char *buf;
+
         if (!c2c.use_stdio) {
                 dim_offset.width  = 5;
                 dim_offset.header = header_offset_tui;
+                nodestr = "CL";
         }
 
         dim_percent_hitm.header = percent_hitm_header[c2c.display];
+
+        /* Fix the zero line for dcacheline column. */
+        buf = fill_line("Cacheline", dim_dcacheline.width +
+                                     dim_dcacheline_node.width +
+                                     dim_dcacheline_count.width + 4);
+        if (!buf)
+                return -ENOMEM;
+
+        dim_dcacheline.header.line[0].text = buf;
+
+        /* Fix the zero line for offset column. */
+        buf = fill_line(nodestr, dim_offset.width +
+                                 dim_offset_node.width +
+                                 dim_dcacheline_count.width + 4);
+        if (!buf)
+                return -ENOMEM;
+
+        dim_offset.header.line[0].text = buf;
+
+        return 0;
 }
 
 #define CALLCHAIN_DEFAULT_OPT  "graph,0.5,caller,function,percent"
@@ -2473,7 +2648,7 @@ static int build_cl_output(char *cl_sort, bool no_source)
                 "percent_lcl_hitm,"
                 "percent_stores_l1hit,"
                 "percent_stores_l1miss,"
-                "offset,",
+                "offset,offset_node,dcacheline_count,",
                 add_pid   ? "pid," : "",
                 add_tid   ? "tid," : "",
                 add_iaddr ? "iaddr," : "",
@@ -2602,17 +2777,21 @@ static int perf_c2c__report(int argc, const char **argv)
                 goto out;
         }
 
-        err = setup_callchain(session->evlist);
+        err = mem2node__init(&c2c.mem2node, &session->header.env);
         if (err)
                 goto out_session;
 
+        err = setup_callchain(session->evlist);
+        if (err)
+                goto out_mem2node;
+
         if (symbol__init(&session->header.env) < 0)
-                goto out_session;
+                goto out_mem2node;
 
         /* No pipe support at the moment. */
         if (perf_data__is_pipe(session->data)) {
                 pr_debug("No pipe support at the moment.\n");
-                goto out_session;
+                goto out_mem2node;
         }
 
         if (c2c.use_stdio)
@@ -2625,12 +2804,14 @@ static int perf_c2c__report(int argc, const char **argv)
         err = perf_session__process_events(session);
         if (err) {
                 pr_err("failed to process sample\n");
-                goto out_session;
+                goto out_mem2node;
         }
 
         c2c_hists__reinit(&c2c.hists,
                         "cl_idx,"
                         "dcacheline,"
+                        "dcacheline_node,"
+                        "dcacheline_count,"
                         "tot_recs,"
                         "percent_hitm,"
                         "tot_hitm,lcl_hitm,rmt_hitm,"
@@ -2652,10 +2833,15 @@ static int perf_c2c__report(int argc, const char **argv)
 
         ui_progress__finish();
 
-        ui_quirks();
+        if (ui_quirks()) {
+                pr_err("failed to setup UI\n");
+                goto out_mem2node;
+        }
 
         perf_c2c_display(session);
 
+out_mem2node:
+        mem2node__exit(&c2c.mem2node);
 out_session:
         perf_session__delete(session);
 out:
@@ -2706,7 +2892,7 @@ static int perf_c2c__record(int argc, const char **argv)
         argc = parse_options(argc, argv, options, record_mem_usage,
                              PARSE_OPT_KEEP_UNKNOWN);
 
-        rec_argc = argc + 10; /* max number of arguments */
+        rec_argc = argc + 11; /* max number of arguments */
         rec_argv = calloc(rec_argc + 1, sizeof(char *));
         if (!rec_argv)
                 return -1;
@@ -2722,6 +2908,7 @@ static int perf_c2c__record(int argc, const char **argv)
                 rec_argv[i++] = "-W";
 
         rec_argv[i++] = "-d";
+        rec_argv[i++] = "--phys-data";
         rec_argv[i++] = "--sample-cpu";
 
         for (j = 0; j < PERF_MEM_EVENTS__MAX; j++) {
diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index 25a42acabee1..f42f228e8899 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -72,6 +72,7 @@ static int __write_tracing_file(const char *name, const char *val, bool append)
         ssize_t size = strlen(val);
         int flags = O_WRONLY;
         char errbuf[512];
+        char *val_copy;
 
         file = get_tracing_file(name);
         if (!file) {
@@ -91,12 +92,23 @@ static int __write_tracing_file(const char *name, const char *val, bool append)
                 goto out;
         }
 
-        if (write(fd, val, size) == size)
+        /*
+         * Copy the original value and append a '\n'. Without this,
+         * the kernel can hide possible errors.
+         */
+        val_copy = strdup(val);
+        if (!val_copy)
+                goto out_close;
+        val_copy[size] = '\n';
+
+        if (write(fd, val_copy, size + 1) == size + 1)
                 ret = 0;
         else
                 pr_debug("write '%s' to tracing/%s failed: %s\n",
                          val, name, str_error_r(errno, errbuf, sizeof(errbuf)));
 
+        free(val_copy);
+out_close:
         close(fd);
 out:
         put_tracing_file(file);
@@ -280,8 +292,10 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace, int argc, const char **argv)
         signal(SIGCHLD, sig_handler);
         signal(SIGPIPE, sig_handler);
 
-        if (reset_tracing_files(ftrace) < 0)
+        if (reset_tracing_files(ftrace) < 0) {
+                pr_err("failed to reset ftrace\n");
                 goto out;
+        }
 
         /* reset ftrace buffer */
         if (write_tracing_file("trace", "0") < 0)
diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
index 4aca13f23b9d..1c41b4eaf73c 100644
--- a/tools/perf/builtin-help.c
+++ b/tools/perf/builtin-help.c
@@ -439,7 +439,7 @@ int cmd_help(int argc, const char **argv)
 #ifdef HAVE_LIBELF_SUPPORT
                 "probe",
 #endif
-#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE)
+#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE_SUPPORT)
                 "trace",
 #endif
         NULL };
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index 55d919dc5bc6..72e2ca096bf5 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -743,16 +743,23 @@ static bool verify_vcpu(int vcpu)
 static s64 perf_kvm__mmap_read_idx(struct perf_kvm_stat *kvm, int idx,
                                    u64 *mmap_time)
 {
+        struct perf_evlist *evlist = kvm->evlist;
         union perf_event *event;
+        struct perf_mmap *md;
         u64 timestamp;
         s64 n = 0;
         int err;
 
         *mmap_time = ULLONG_MAX;
-        while ((event = perf_evlist__mmap_read(kvm->evlist, idx)) != NULL) {
-                err = perf_evlist__parse_sample_timestamp(kvm->evlist, event, &timestamp);
+        md = &evlist->mmap[idx];
+        err = perf_mmap__read_init(md);
+        if (err < 0)
+                return (err == -EAGAIN) ? 0 : -1;
+
+        while ((event = perf_mmap__read_event(md)) != NULL) {
+                err = perf_evlist__parse_sample_timestamp(evlist, event, &timestamp);
                 if (err) {
-                        perf_evlist__mmap_consume(kvm->evlist, idx);
+                        perf_mmap__consume(md);
                         pr_err("Failed to parse sample\n");
                         return -1;
                 }
@@ -762,7 +769,7 @@ static s64 perf_kvm__mmap_read_idx(struct perf_kvm_stat *kvm, int idx,
                  * FIXME: Here we can't consume the event, as perf_session__queue_event will
                  *        point to it, and it'll get possibly overwritten by the kernel.
                  */
-                perf_evlist__mmap_consume(kvm->evlist, idx);
+                perf_mmap__consume(md);
 
                 if (err) {
                         pr_err("Failed to enqueue sample: %d\n", err);
@@ -779,6 +786,7 @@ static s64 perf_kvm__mmap_read_idx(struct perf_kvm_stat *kvm, int idx,
                         break;
         }
 
+        perf_mmap__read_done(md);
         return n;
 }
 
diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
index 506564651cda..57393e94d156 100644
--- a/tools/perf/builtin-mem.c
+++ b/tools/perf/builtin-mem.c
@@ -83,7 +83,7 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
         };
 
         argc = parse_options(argc, argv, options, record_mem_usage,
-                             PARSE_OPT_STOP_AT_NON_OPTION);
+                             PARSE_OPT_KEEP_UNKNOWN);
 
         rec_argc = argc + 9; /* max number of arguments */
         rec_argv = calloc(rec_argc + 1, sizeof(char *));
@@ -436,7 +436,7 @@ int cmd_mem(int argc, const char **argv)
         }
 
         argc = parse_options_subcommand(argc, argv, mem_options, mem_subcommands,
-                                        mem_usage, PARSE_OPT_STOP_AT_NON_OPTION);
+                                        mem_usage, PARSE_OPT_KEEP_UNKNOWN);
 
         if (!argc || !(strncmp(argv[0], "rec", 3) || mem.operation))
                 usage_with_options(mem_usage, mem_options);
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index a217623fec2e..22ebeb92ac51 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -45,6 +45,7 @@
 
 #include <errno.h>
 #include <inttypes.h>
+#include <locale.h>
 #include <poll.h>
 #include <unistd.h>
 #include <sched.h>
@@ -70,7 +71,6 @@ struct record {
         struct auxtrace_record  *itr;
         struct perf_evlist      *evlist;
         struct perf_session     *session;
-        const char              *progname;
         int                     realtime_prio;
         bool                    no_buildid;
         bool                    no_buildid_set;
@@ -273,6 +273,24 @@ static void record__read_auxtrace_snapshot(struct record *rec)
         }
 }
 
+static int record__auxtrace_init(struct record *rec)
+{
+        int err;
+
+        if (!rec->itr) {
+                rec->itr = auxtrace_record__init(rec->evlist, &err);
+                if (err)
+                        return err;
+        }
+
+        err = auxtrace_parse_snapshot_options(rec->itr, &rec->opts,
+                                              rec->opts.auxtrace_snapshot_opts);
+        if (err)
+                return err;
+
+        return auxtrace_parse_filters(rec->evlist);
+}
+
 #else
 
 static inline
@@ -293,6 +311,11 @@ int auxtrace_record__snapshot_start(struct auxtrace_record *itr __maybe_unused)
         return 0;
 }
 
+static int record__auxtrace_init(struct record *rec __maybe_unused)
+{
+        return 0;
+}
+
 #endif
 
 static int record__mmap_evlist(struct record *rec,
@@ -509,7 +532,7 @@ static int record__mmap_read_evlist(struct record *rec, struct perf_evlist *evli
                 struct auxtrace_mmap *mm = &maps[i].auxtrace_mmap;
 
                 if (maps[i].base) {
-                        if (perf_mmap__push(&maps[i], overwrite, rec, record__pushfn) != 0) {
+                        if (perf_mmap__push(&maps[i], rec, record__pushfn) != 0) {
                                 rc = -1;
                                 goto out;
                         }
@@ -731,13 +754,10 @@ static int record__synthesize(struct record *rec, bool tail)
                 return 0;
 
         if (data->is_pipe) {
-                err = perf_event__synthesize_features(
-                        tool, session, rec->evlist, process_synthesized_event);
-                if (err < 0) {
-                        pr_err("Couldn't synthesize features.\n");
-                        return err;
-                }
-
+                /*
+                 * We need to synthesize events first, because some
+                 * features works on top of them (on report side).
+                 */
                 err = perf_event__synthesize_attrs(tool, session,
                                                    process_synthesized_event);
                 if (err < 0) {
@@ -745,6 +765,13 @@ static int record__synthesize(struct record *rec, bool tail)
                         goto out;
                 }
 
+                err = perf_event__synthesize_features(tool, session, rec->evlist,
+                                                      process_synthesized_event);
+                if (err < 0) {
+                        pr_err("Couldn't synthesize features.\n");
+                        return err;
+                }
+
                 if (have_tracepoints(&rec->evlist->entries)) {
                         /*
                          * FIXME err <= 0 here actually means that
@@ -830,7 +857,6 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
         int status = 0;
         unsigned long waking = 0;
         const bool forks = argc > 0;
-        struct machine *machine;
         struct perf_tool *tool = &rec->tool;
         struct record_opts *opts = &rec->opts;
         struct perf_data *data = &rec->data;
@@ -838,8 +864,6 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
         bool disabled = false, draining = false;
         int fd;
 
-        rec->progname = argv[0];
-
         atexit(record__sig_exit);
         signal(SIGCHLD, sig_handler);
         signal(SIGINT, sig_handler);
@@ -935,8 +959,6 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                 goto out_child;
         }
 
-        machine = &session->machines.host;
-
         err = record__synthesize(rec, false);
         if (err < 0)
                 goto out_child;
@@ -964,6 +986,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
          * Let the child rip
          */
         if (forks) {
+                struct machine *machine = &session->machines.host;
                 union perf_event *event;
                 pid_t tgid;
 
@@ -1260,10 +1283,12 @@ static int perf_record_config(const char *var, const char *value, void *cb)
                         return -1;
                 return 0;
         }
-        if (!strcmp(var, "record.call-graph"))
-                var = "call-graph.record-mode"; /* fall-through */
+        if (!strcmp(var, "record.call-graph")) {
+                var = "call-graph.record-mode";
+                return perf_default_config(var, value, cb);
+        }
 
-        return perf_default_config(var, value, cb);
+        return 0;
 }
 
 struct clockid_map {
@@ -1551,7 +1576,11 @@ static struct option __record_options[] = {
         OPT_BOOLEAN(0, "tail-synthesize", &record.opts.tail_synthesize,
                     "synthesize non-sample events at the end of output"),
         OPT_BOOLEAN(0, "overwrite", &record.opts.overwrite, "use overwrite mode"),
-        OPT_UINTEGER('F', "freq", &record.opts.user_freq, "profile at this frequency"),
+        OPT_BOOLEAN(0, "strict-freq", &record.opts.strict_freq,
+                    "Fail if the specified frequency can't be used"),
+        OPT_CALLBACK('F', "freq", &record.opts, "freq or 'max'",
+                     "profile at this frequency",
+                      record__parse_freq),
         OPT_CALLBACK('m', "mmap-pages", &record.opts, "pages[,pages]",
                      "number of mmap data pages and AUX area tracing mmap pages",
                      record__parse_mmap_pages),
@@ -1660,6 +1689,8 @@ int cmd_record(int argc, const char **argv)
         struct record *rec = &record;
         char errbuf[BUFSIZ];
 
+        setlocale(LC_ALL, "");
+
 #ifndef HAVE_LIBBPF_SUPPORT
 # define set_nobuild(s, l, c) set_option_nobuild(record_options, s, l, "NO_LIBBPF=1", c)
         set_nobuild('\0', "clang-path", true);
@@ -1720,17 +1751,6 @@ int cmd_record(int argc, const char **argv)
                 alarm(rec->switch_output.time);
         }
 
-        if (!rec->itr) {
-                rec->itr = auxtrace_record__init(rec->evlist, &err);
-                if (err)
-                        goto out;
-        }
-
-        err = auxtrace_parse_snapshot_options(rec->itr, &rec->opts,
-                                              rec->opts.auxtrace_snapshot_opts);
-        if (err)
-                goto out;
-
         /*
          * Allow aliases to facilitate the lookup of symbols for address
          * filters. Refer to auxtrace_parse_filters().
@@ -1739,7 +1759,7 @@ int cmd_record(int argc, const char **argv)
 
         symbol__init(NULL);
 
-        err = auxtrace_parse_filters(rec->evlist);
+        err = record__auxtrace_init(rec);
         if (err)
                 goto out;
 
@@ -1812,7 +1832,7 @@ int cmd_record(int argc, const char **argv)
         err = target__validate(&rec->opts.target);
         if (err) {
                 target__strerror(&rec->opts.target, err, errbuf, BUFSIZ);
-                ui__warning("%s", errbuf);
+                ui__warning("%s\n", errbuf);
         }
 
         err = target__parse_uid(&rec->opts.target);
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 4ad5dc649716..0f198f6d9b77 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -68,6 +68,7 @@ struct report {
         bool                    header;
         bool                    header_only;
         bool                    nonany_branch_mode;
+        bool                    group_set;
         int                     max_stack;
         struct perf_read_values show_threads_values;
         const char              *pretty_printing_style;
@@ -193,6 +194,45 @@ out:
         return err;
 }
 
+/*
+ * Events in data file are not collect in groups, but we still want
+ * the group display. Set the artificial group and set the leader's
+ * forced_leader flag to notify the display code.
+ */
+static void setup_forced_leader(struct report *report,
+                                struct perf_evlist *evlist)
+{
+        if (report->group_set && !evlist->nr_groups) {
+                struct perf_evsel *leader = perf_evlist__first(evlist);
+
+                perf_evlist__set_leader(evlist);
+                leader->forced_leader = true;
+        }
+}
+
+static int process_feature_event(struct perf_tool *tool,
+                                 union perf_event *event,
+                                 struct perf_session *session __maybe_unused)
+{
+        struct report *rep = container_of(tool, struct report, tool);
+
+        if (event->feat.feat_id < HEADER_LAST_FEATURE)
+                return perf_event__process_feature(tool, event, session);
+
+        if (event->feat.feat_id != HEADER_LAST_FEATURE) {
+                pr_err("failed: wrong feature ID: %" PRIu64 "\n",
+                       event->feat.feat_id);
+                return -1;
+        }
+
+        /*
+         * All features are received, we can force the
+         * group if needed.
+         */
+        setup_forced_leader(rep, session->evlist);
+        return 0;
+}
+
 static int process_sample_event(struct perf_tool *tool,
                                 union perf_event *event,
                                 struct perf_sample *sample,
@@ -400,8 +440,10 @@ static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report
 
         nr_samples = convert_unit(nr_samples, &unit);
         ret = fprintf(fp, "# Samples: %lu%c", nr_samples, unit);
-        if (evname != NULL)
-                ret += fprintf(fp, " of event '%s'", evname);
+        if (evname != NULL) {
+                ret += fprintf(fp, " of event%s '%s'",
+                               evsel->nr_members > 1 ? "s" : "", evname);
+        }
 
         if (rep->time_str)
                 ret += fprintf(fp, " (time slices: %s)", rep->time_str);
@@ -614,6 +656,7 @@ static int stats_print(struct report *rep)
 static void tasks_setup(struct report *rep)
 {
         memset(&rep->tool, 0, sizeof(rep->tool));
+        rep->tool.ordered_events = true;
         if (rep->mmaps_mode) {
                 rep->tool.mmap = perf_event__process_mmap;
                 rep->tool.mmap2 = perf_event__process_mmap2;
@@ -954,7 +997,7 @@ int cmd_report(int argc, const char **argv)
                         .id_index        = perf_event__process_id_index,
                         .auxtrace_info   = perf_event__process_auxtrace_info,
                         .auxtrace        = perf_event__process_auxtrace,
-                        .feature         = perf_event__process_feature,
+                        .feature         = process_feature_event,
                         .ordered_events  = true,
                         .ordering_requires_timestamps = true,
                 },
@@ -975,6 +1018,8 @@ int cmd_report(int argc, const char **argv)
         OPT_BOOLEAN(0, "mmaps", &report.mmaps_mode, "Display recorded tasks memory maps"),
         OPT_STRING('k', "vmlinux", &symbol_conf.vmlinux_name,
                    "file", "vmlinux pathname"),
+        OPT_BOOLEAN(0, "ignore-vmlinux", &symbol_conf.ignore_vmlinux,
+                    "don't load vmlinux even if found"),
         OPT_STRING(0, "kallsyms", &symbol_conf.kallsyms_name,
                    "file", "kallsyms pathname"),
         OPT_BOOLEAN('f', "force", &symbol_conf.force, "don't complain, do it"),
@@ -1056,7 +1101,7 @@ int cmd_report(int argc, const char **argv)
                    "Specify disassembler style (e.g. -M intel for intel syntax)"),
         OPT_BOOLEAN(0, "show-total-period", &symbol_conf.show_total_period,
                     "Show a column with the sum of periods"),
-        OPT_BOOLEAN(0, "group", &symbol_conf.event_group,
+        OPT_BOOLEAN_SET(0, "group", &symbol_conf.event_group, &report.group_set,
                     "Show event group information together"),
         OPT_CALLBACK_NOOPT('b', "branch-stack", &branch_mode, "",
                     "use branch records for per branch histogram filling",
@@ -1173,6 +1218,8 @@ repeat:
         has_br_stack = perf_header__has_feat(&session->header,
                                              HEADER_BRANCH_STACK);
 
+        setup_forced_leader(&report, session->evlist);
+
         if (itrace_synth_opts.last_branch)
                 has_br_stack = true;
 
@@ -1295,6 +1342,7 @@ repeat:
                         symbol_conf.priv_size += sizeof(u32);
                         symbol_conf.sort_by_name = true;
                 }
+                annotation_config__init();
         }
 
         if (symbol__init(&session->header.env) < 0)
@@ -1332,6 +1380,15 @@ repeat:
                 report.range_num = 1;
         }
 
+        if (session->tevent.pevent &&
+            pevent_set_function_resolver(session->tevent.pevent,
+                                         machine__resolve_kernel_addr,
+                                         &session->machines.host) < 0) {
+                pr_err("%s: failed to set libtraceevent function resolver\n",
+                       __func__);
+                return -1;
+        }
+
         sort__setup_elide(stdout);
 
         ret = __cmd_report(&report);
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 83283fedb00f..4dfdee668b0c 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -254,6 +254,10 @@ struct thread_runtime {
         u64 total_delay_time;
 
         int last_state;
+
+        char shortname[3];
+        bool comm_changed;
+
         u64 migrations;
 };
 
@@ -897,6 +901,37 @@ struct sort_dimension {
         struct list_head        list;
 };
 
+/*
+ * handle runtime stats saved per thread
+ */
+static struct thread_runtime *thread__init_runtime(struct thread *thread)
+{
+        struct thread_runtime *r;
+
+        r = zalloc(sizeof(struct thread_runtime));
+        if (!r)
+                return NULL;
+
+        init_stats(&r->run_stats);
+        thread__set_priv(thread, r);
+
+        return r;
+}
+
+static struct thread_runtime *thread__get_runtime(struct thread *thread)
+{
+        struct thread_runtime *tr;
+
+        tr = thread__priv(thread);
+        if (tr == NULL) {
+                tr = thread__init_runtime(thread);
+                if (tr == NULL)
+                        pr_debug("Failed to malloc memory for runtime data.\n");
+        }
+
+        return tr;
+}
+
 static int
 thread_lat_cmp(struct list_head *list, struct work_atoms *l, struct work_atoms *r)
 {
@@ -1480,6 +1515,7 @@ static int map_switch_event(struct perf_sched *sched, struct perf_evsel *evsel,
 {
         const u32 next_pid = perf_evsel__intval(evsel, sample, "next_pid");
         struct thread *sched_in;
+        struct thread_runtime *tr;
         int new_shortname;
         u64 timestamp0, timestamp = sample->time;
         s64 delta;
@@ -1519,22 +1555,28 @@ static int map_switch_event(struct perf_sched *sched, struct perf_evsel *evsel,
         if (sched_in == NULL)
                 return -1;
 
+        tr = thread__get_runtime(sched_in);
+        if (tr == NULL) {
+                thread__put(sched_in);
+                return -1;
+        }
+
         sched->curr_thread[this_cpu] = thread__get(sched_in);
 
         printf("  ");
 
         new_shortname = 0;
-        if (!sched_in->shortname[0]) {
+        if (!tr->shortname[0]) {
                 if (!strcmp(thread__comm_str(sched_in), "swapper")) {
                         /*
                          * Don't allocate a letter-number for swapper:0
                          * as a shortname. Instead, we use '.' for it.
                          */
-                        sched_in->shortname[0] = '.';
-                        sched_in->shortname[1] = ' ';
+                        tr->shortname[0] = '.';
+                        tr->shortname[1] = ' ';
                 } else {
-                        sched_in->shortname[0] = sched->next_shortname1;
-                        sched_in->shortname[1] = sched->next_shortname2;
+                        tr->shortname[0] = sched->next_shortname1;
+                        tr->shortname[1] = sched->next_shortname2;
 
                         if (sched->next_shortname1 < 'Z') {
                                 sched->next_shortname1++;
@@ -1552,6 +1594,7 @@ static int map_switch_event(struct perf_sched *sched, struct perf_evsel *evsel,
         for (i = 0; i < cpus_nr; i++) {
                 int cpu = sched->map.comp ? sched->map.comp_cpus[i] : i;
                 struct thread *curr_thread = sched->curr_thread[cpu];
+                struct thread_runtime *curr_tr;
                 const char *pid_color = color;
                 const char *cpu_color = color;
 
@@ -1569,9 +1612,14 @@ static int map_switch_event(struct perf_sched *sched, struct perf_evsel *evsel,
                 else
                         color_fprintf(stdout, cpu_color, "*");
 
-                if (sched->curr_thread[cpu])
-                        color_fprintf(stdout, pid_color, "%2s ", sched->curr_thread[cpu]->shortname);
-                else
+                if (sched->curr_thread[cpu]) {
+                        curr_tr = thread__get_runtime(sched->curr_thread[cpu]);
+                        if (curr_tr == NULL) {
+                                thread__put(sched_in);
+                                return -1;
+                        }
+                        color_fprintf(stdout, pid_color, "%2s ", curr_tr->shortname);
+                } else
                         color_fprintf(stdout, color, "   ");
         }
 
@@ -1580,14 +1628,15 @@ static int map_switch_event(struct perf_sched *sched, struct perf_evsel *evsel,
 
         timestamp__scnprintf_usec(timestamp, stimestamp, sizeof(stimestamp));
         color_fprintf(stdout, color, "  %12s secs ", stimestamp);
-        if (new_shortname || (verbose > 0 && sched_in->tid)) {
+        if (new_shortname || tr->comm_changed || (verbose > 0 && sched_in->tid)) {
                 const char *pid_color = color;
 
                 if (thread__has_color(sched_in))
                         pid_color = COLOR_PIDS;
 
                 color_fprintf(stdout, pid_color, "%s => %s:%d",
-                       sched_in->shortname, thread__comm_str(sched_in), sched_in->tid);
+                       tr->shortname, thread__comm_str(sched_in), sched_in->tid);
+                tr->comm_changed = false;
         }
 
         if (sched->map.comp && new_cpu)
@@ -1691,6 +1740,37 @@ static int perf_sched__process_tracepoint_sample(struct perf_tool *tool __maybe_
         return err;
 }
 
+static int perf_sched__process_comm(struct perf_tool *tool __maybe_unused,
+                                    union perf_event *event,
+                                    struct perf_sample *sample,
+                                    struct machine *machine)
+{
+        struct thread *thread;
+        struct thread_runtime *tr;
+        int err;
+
+        err = perf_event__process_comm(tool, event, sample, machine);
+        if (err)
+                return err;
+
+        thread = machine__find_thread(machine, sample->pid, sample->tid);
+        if (!thread) {
+                pr_err("Internal error: can't find thread\n");
+                return -1;
+        }
+
+        tr = thread__get_runtime(thread);
+        if (tr == NULL) {
+                thread__put(thread);
+                return -1;
+        }
+
+        tr->comm_changed = true;
+        thread__put(thread);
+
+        return 0;
+}
+
 static int perf_sched__read_events(struct perf_sched *sched)
 {
         const struct perf_evsel_str_handler handlers[] = {
@@ -2200,37 +2280,6 @@ static void save_idle_callchain(struct idle_thread_runtime *itr,
         callchain_cursor__copy(&itr->cursor, &callchain_cursor);
 }
 
-/*
- * handle runtime stats saved per thread
- */
-static struct thread_runtime *thread__init_runtime(struct thread *thread)
-{
-        struct thread_runtime *r;
-
-        r = zalloc(sizeof(struct thread_runtime));
-        if (!r)
-                return NULL;
-
-        init_stats(&r->run_stats);
-        thread__set_priv(thread, r);
-
-        return r;
-}
-
-static struct thread_runtime *thread__get_runtime(struct thread *thread)
-{
-        struct thread_runtime *tr;
-
-        tr = thread__priv(thread);
-        if (tr == NULL) {
-                tr = thread__init_runtime(thread);
-                if (tr == NULL)
-                        pr_debug("Failed to malloc memory for runtime data.\n");
-        }
-
-        return tr;
-}
-
 static struct thread *timehist_get_thread(struct perf_sched *sched,
                                           struct perf_sample *sample,
                                           struct machine *machine,
@@ -3291,7 +3340,7 @@ int cmd_sched(int argc, const char **argv)
         struct perf_sched sched = {
                 .tool = {
                         .sample          = perf_sched__process_tracepoint_sample,
-                        .comm            = perf_event__process_comm,
+                        .comm            = perf_sched__process_comm,
                         .namespaces      = perf_event__process_namespaces,
                         .lost            = perf_event__process_lost,
                         .fork            = perf_sched__process_fork_event,
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index ab19a6ee4093..e0a9845b6cbc 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -657,8 +657,11 @@ static int perf_sample__fprintf_start(struct perf_sample *sample,
                         break;
                 case PERF_RECORD_SWITCH:
                 case PERF_RECORD_SWITCH_CPU_WIDE:
-                        if (has(SWITCH_OUT))
+                        if (has(SWITCH_OUT)) {
                                 ret += fprintf(fp, "S");
+                                if (sample->misc & PERF_RECORD_MISC_SWITCH_OUT_PREEMPT)
+                                        ret += fprintf(fp, "p");
+                        }
                 default:
                         break;
                 }
@@ -1489,6 +1492,7 @@ struct perf_script {
         bool                    show_switch_events;
         bool                    show_namespace_events;
         bool                    show_lost_events;
+        bool                    show_round_events;
         bool                    allocated;
         bool                    per_event_dump;
         struct cpu_map          *cpus;
@@ -2104,6 +2108,16 @@ process_lost_event(struct perf_tool *tool,
         return 0;
 }
 
+static int
+process_finished_round_event(struct perf_tool *tool __maybe_unused,
+                             union perf_event *event,
+                             struct ordered_events *oe __maybe_unused)
+
+{
+        perf_event__fprintf(event, stdout);
+        return 0;
+}
+
 static void sig_handler(int sig __maybe_unused)
 {
         session_done = 1;
@@ -2200,6 +2214,10 @@ static int __cmd_script(struct perf_script *script)
                 script->tool.namespaces = process_namespaces_event;
         if (script->show_lost_events)
                 script->tool.lost = process_lost_event;
+        if (script->show_round_events) {
+                script->tool.ordered_events = false;
+                script->tool.finished_round = process_finished_round_event;
+        }
 
         if (perf_script__setup_per_event_dump(script)) {
                 pr_err("Couldn't create the per event dump files\n");
@@ -2659,8 +2677,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
         }
 
         for_each_lang(scripts_path, scripts_dir, lang_dirent) {
-                snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
-                         lang_dirent->d_name);
+                scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
+                          lang_dirent->d_name);
                 lang_dir = opendir(lang_path);
                 if (!lang_dir)
                         continue;
@@ -2669,8 +2687,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
                         script_root = get_script_root(script_dirent, REPORT_SUFFIX);
                         if (script_root) {
                                 desc = script_desc__findnew(script_root);
-                                snprintf(script_path, MAXPATHLEN, "%s/%s",
-                                         lang_path, script_dirent->d_name);
+                                scnprintf(script_path, MAXPATHLEN, "%s/%s",
+                                          lang_path, script_dirent->d_name);
                                 read_script_info(desc, script_path);
                                 free(script_root);
                         }
@@ -2706,7 +2724,7 @@ static int check_ev_match(char *dir_name, char *scriptname,
         int match, len;
         FILE *fp;
 
-        sprintf(filename, "%s/bin/%s-record", dir_name, scriptname);
+        scnprintf(filename, MAXPATHLEN, "%s/bin/%s-record", dir_name, scriptname);
 
         fp = fopen(filename, "r");
         if (!fp)
@@ -2784,13 +2802,13 @@ int find_scripts(char **scripts_array, char **scripts_path_array)
         }
 
         for_each_lang(scripts_path, scripts_dir, lang_dirent) {
-                snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
-                         lang_dirent->d_name);
-#ifdef NO_LIBPERL
+                scnprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
+                          lang_dirent->d_name);
+#ifndef HAVE_LIBPERL_SUPPORT
                 if (strstr(lang_path, "perl"))
                         continue;
 #endif
-#ifdef NO_LIBPYTHON
+#ifndef HAVE_LIBPYTHON_SUPPORT
                 if (strstr(lang_path, "python"))
                         continue;
 #endif
@@ -2840,8 +2858,8 @@ static char *get_script_path(const char *script_root, const char *suffix)
                 return NULL;
 
         for_each_lang(scripts_path, scripts_dir, lang_dirent) {
-                snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
-                         lang_dirent->d_name);
+                scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
+                          lang_dirent->d_name);
                 lang_dir = opendir(lang_path);
                 if (!lang_dir)
                         continue;
@@ -2852,8 +2870,8 @@ static char *get_script_path(const char *script_root, const char *suffix)
                                 free(__script_root);
                                 closedir(lang_dir);
                                 closedir(scripts_dir);
-                                snprintf(script_path, MAXPATHLEN, "%s/%s",
-                                         lang_path, script_dirent->d_name);
+                                scnprintf(script_path, MAXPATHLEN, "%s/%s",
+                                          lang_path, script_dirent->d_name);
                                 return strdup(script_path);
                         }
                         free(__script_root);
@@ -3139,6 +3157,8 @@ int cmd_script(int argc, const char **argv)
                     "Show namespace events (if recorded)"),
         OPT_BOOLEAN('\0', "show-lost-events", &script.show_lost_events,
                     "Show lost events (if recorded)"),
+        OPT_BOOLEAN('\0', "show-round-events", &script.show_round_events,
+                    "Show round events (if recorded)"),
         OPT_BOOLEAN('\0', "per-event-dump", &script.per_event_dump,
                     "Dump trace output to files named by the monitored events"),
         OPT_BOOLEAN('f', "force", &symbol_conf.force, "don't complain, do it"),
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 54a4c152edb3..f17dc601b0f3 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -168,9 +168,11 @@ static struct timespec		ref_time;
 static struct cpu_map           *aggr_map;
 static aggr_get_id_t            aggr_get_id;
 static bool                     append_file;
+static bool                     interval_count;
 static const char               *output_name;
 static int                      output_fd;
 static int                      print_free_counters_hint;
+static int                      print_mixed_hw_group_error;
 
 struct perf_stat {
         bool                     record;
@@ -507,14 +509,13 @@ static int perf_stat_synthesize_config(bool is_pipe)
 
 #define FD(e, x, y) (*(int *)xyarray__entry(e->fd, x, y))
 
-static int __store_counter_ids(struct perf_evsel *counter,
-                               struct cpu_map *cpus,
-                               struct thread_map *threads)
+static int __store_counter_ids(struct perf_evsel *counter)
 {
         int cpu, thread;
 
-        for (cpu = 0; cpu < cpus->nr; cpu++) {
-                for (thread = 0; thread < threads->nr; thread++) {
+        for (cpu = 0; cpu < xyarray__max_x(counter->fd); cpu++) {
+                for (thread = 0; thread < xyarray__max_y(counter->fd);
+                     thread++) {
                         int fd = FD(counter, cpu, thread);
 
                         if (perf_evlist__id_add_fd(evsel_list, counter,
@@ -534,7 +535,7 @@ static int store_counter_ids(struct perf_evsel *counter)
         if (perf_evsel__alloc_id(counter, cpus->nr, threads->nr))
                 return -ENOMEM;
 
-        return __store_counter_ids(counter, cpus, threads);
+        return __store_counter_ids(counter);
 }
 
 static bool perf_evsel__should_store_id(struct perf_evsel *counter)
@@ -571,6 +572,8 @@ static struct perf_evsel *perf_evsel__reset_weak_group(struct perf_evsel *evsel)
 static int __run_perf_stat(int argc, const char **argv)
 {
         int interval = stat_config.interval;
+        int times = stat_config.times;
+        int timeout = stat_config.timeout;
         char msg[BUFSIZ];
         unsigned long long t0, t1;
         struct perf_evsel *counter;
@@ -584,6 +587,9 @@ static int __run_perf_stat(int argc, const char **argv)
         if (interval) {
                 ts.tv_sec  = interval / USEC_PER_MSEC;
                 ts.tv_nsec = (interval % USEC_PER_MSEC) * NSEC_PER_MSEC;
+        } else if (timeout) {
+                ts.tv_sec  = timeout / USEC_PER_MSEC;
+                ts.tv_nsec = (timeout % USEC_PER_MSEC) * NSEC_PER_MSEC;
         } else {
                 ts.tv_sec  = 1;
                 ts.tv_nsec = 0;
@@ -632,7 +638,19 @@ try_again:
                                 if (verbose > 0)
                                         ui__warning("%s\n", msg);
                                 goto try_again;
-                        }
+                        } else if (target__has_per_thread(&target) &&
+                                   evsel_list->threads &&
+                                   evsel_list->threads->err_thread != -1) {
+                                /*
+                                 * For global --per-thread case, skip current
+                                 * error thread.
+                                 */
+                                if (!thread_map__remove(evsel_list->threads,
+                                                        evsel_list->threads->err_thread)) {
+                                        evsel_list->threads->err_thread = -1;
+                                        goto try_again;
+                                }
+                        }
 
                         perf_evsel__open_strerror(counter, &target,
                                                   errno, msg, sizeof(msg));
@@ -696,10 +714,14 @@ try_again:
                 perf_evlist__start_workload(evsel_list);
                 enable_counters();
 
-                if (interval) {
+                if (interval || timeout) {
                         while (!waitpid(child_pid, &status, WNOHANG)) {
                                 nanosleep(&ts, NULL);
+                                if (timeout)
+                                        break;
                                 process_interval();
+                                if (interval_count && !(--times))
+                                        break;
                         }
                 }
                 waitpid(child_pid, &status, 0);
@@ -716,8 +738,13 @@ try_again:
                 enable_counters();
                 while (!done) {
                         nanosleep(&ts, NULL);
-                        if (interval)
+                        if (timeout)
+                                break;
+                        if (interval) {
                                 process_interval();
+                                if (interval_count && !(--times))
+                                        break;
+                        }
                 }
         }
 
@@ -1100,6 +1127,30 @@ static void abs_printout(int id, int nr, struct perf_evsel *evsel, double avg)
                 fprintf(output, "%s%s", csv_sep, evsel->cgrp->name);
 }
 
+static bool is_mixed_hw_group(struct perf_evsel *counter)
+{
+        struct perf_evlist *evlist = counter->evlist;
+        u32 pmu_type = counter->attr.type;
+        struct perf_evsel *pos;
+
+        if (counter->nr_members < 2)
+                return false;
+
+        evlist__for_each_entry(evlist, pos) {
+                /* software events can be part of any hardware group */
+                if (pos->attr.type == PERF_TYPE_SOFTWARE)
+                        continue;
+                if (pmu_type == PERF_TYPE_SOFTWARE) {
+                        pmu_type = pos->attr.type;
+                        continue;
+                }
+                if (pmu_type != pos->attr.type)
+                        return true;
+        }
+
+        return false;
+}
+
 static void printout(int id, int nr, struct perf_evsel *counter, double uval,
                      char *prefix, u64 run, u64 ena, double noise,
                      struct runtime_stat *st)
@@ -1152,8 +1203,11 @@ static void printout(int id, int nr, struct perf_evsel *counter, double uval,
                         counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
                         csv_sep);
 
-                if (counter->supported)
+                if (counter->supported) {
                         print_free_counters_hint = 1;
+                        if (is_mixed_hw_group(counter))
+                                print_mixed_hw_group_error = 1;
+                }
 
                 fprintf(stat_config.output, "%-*s%s",
                         csv_output ? 0 : unit_width,
@@ -1225,6 +1279,34 @@ static void aggr_update_shadow(void)
         }
 }
 
+static void uniquify_event_name(struct perf_evsel *counter)
+{
+        char *new_name;
+        char *config;
+
+        if (counter->uniquified_name ||
+            !counter->pmu_name || !strncmp(counter->name, counter->pmu_name,
+                                           strlen(counter->pmu_name)))
+                return;
+
+        config = strchr(counter->name, '/');
+        if (config) {
+                if (asprintf(&new_name,
+                             "%s%s", counter->pmu_name, config) > 0) {
+                        free(counter->name);
+                        counter->name = new_name;
+                }
+        } else {
+                if (asprintf(&new_name,
+                             "%s [%s]", counter->name, counter->pmu_name) > 0) {
+                        free(counter->name);
+                        counter->name = new_name;
+                }
+        }
+
+        counter->uniquified_name = true;
+}
+
 static void collect_all_aliases(struct perf_evsel *counter,
                             void (*cb)(struct perf_evsel *counter, void *data,
                                        bool first),
@@ -1253,7 +1335,9 @@ static bool collect_data(struct perf_evsel *counter,
         if (counter->merged_stat)
                 return false;
         cb(counter, data, true);
-        if (!no_merge && counter->auto_merge_stats)
+        if (no_merge)
+                uniquify_event_name(counter);
+        else if (counter->auto_merge_stats)
                 collect_all_aliases(counter, cb, data);
         return true;
 }
@@ -1704,6 +1788,11 @@ static void print_footer(void)
 "       echo 0 > /proc/sys/kernel/nmi_watchdog\n"
 "       perf stat ...\n"
 "       echo 1 > /proc/sys/kernel/nmi_watchdog\n");
+
+        if (print_mixed_hw_group_error)
+                fprintf(output,
+                        "The events in group usually have to be from "
+                        "the same PMU. Try reorganizing the group.\n");
 }
 
 static void print_counters(struct timespec *ts, int argc, const char **argv)
@@ -1890,7 +1979,12 @@ static const struct option stat_options[] = {
         OPT_STRING(0, "post", &post_cmd, "command",
                         "command to run after to the measured command"),
         OPT_UINTEGER('I', "interval-print", &stat_config.interval,
-                    "print counts at regular interval in ms (>= 10)"),
+                    "print counts at regular interval in ms "
+                    "(overhead is possible for values <= 100ms)"),
+        OPT_INTEGER(0, "interval-count", &stat_config.times,
+                    "print counts for fixed number of times"),
+        OPT_UINTEGER(0, "timeout", &stat_config.timeout,
+                    "stop workload and print counts after a timeout period in ms (>= 10ms)"),
         OPT_SET_UINT(0, "per-socket", &stat_config.aggr_mode,
                      "aggregate counts per processor socket", AGGR_SOCKET),
         OPT_SET_UINT(0, "per-core", &stat_config.aggr_mode,
@@ -2274,11 +2368,16 @@ static int add_default_attributes(void)
                 return 0;
 
         if (transaction_run) {
+                struct parse_events_error errinfo;
+
                 if (pmu_have_event("cpu", "cycles-ct") &&
                     pmu_have_event("cpu", "el-start"))
-                        err = parse_events(evsel_list, transaction_attrs, NULL);
+                        err = parse_events(evsel_list, transaction_attrs,
+                                           &errinfo);
                 else
-                        err = parse_events(evsel_list, transaction_limited_attrs, NULL);
+                        err = parse_events(evsel_list,
+                                           transaction_limited_attrs,
+                                           &errinfo);
                 if (err) {
                         fprintf(stderr, "Cannot set up transaction events\n");
                         return -1;
@@ -2688,7 +2787,7 @@ int cmd_stat(int argc, const char **argv)
         int status = -EINVAL, run_idx;
         const char *mode;
         FILE *output = stderr;
-        unsigned int interval;
+        unsigned int interval, timeout;
         const char * const stat_subcommands[] = { "record", "report" };
 
         setlocale(LC_ALL, "");
@@ -2719,6 +2818,7 @@ int cmd_stat(int argc, const char **argv)
                 return __cmd_report(argc, argv);
 
         interval = stat_config.interval;
+        timeout = stat_config.timeout;
 
         /*
          * For record command the -o is already taken care of.
@@ -2860,16 +2960,32 @@ int cmd_stat(int argc, const char **argv)
                 }
         }
 
-        if (interval && interval < 100) {
-                if (interval < 10) {
-                        pr_err("print interval must be >= 10ms\n");
-                        parse_options_usage(stat_usage, stat_options, "I", 1);
+        if (stat_config.times && interval)
+                interval_count = true;
+        else if (stat_config.times && !interval) {
+                pr_err("interval-count option should be used together with "
+                                "interval-print.\n");
+                parse_options_usage(stat_usage, stat_options, "interval-count", 0);
+                parse_options_usage(stat_usage, stat_options, "I", 1);
+                goto out;
+        }
+
+        if (timeout && timeout < 100) {
+                if (timeout < 10) {
+                        pr_err("timeout must be >= 10ms.\n");
+                        parse_options_usage(stat_usage, stat_options, "timeout", 0);
                         goto out;
                 } else
-                        pr_warning("print interval < 100ms. "
+                        pr_warning("timeout < 100ms. "
                                    "The overhead percentage could be high in some cases. "
                                    "Please proceed with caution.\n");
         }
+        if (timeout && interval) {
+                pr_err("timeout option is not supported with interval-print.\n");
+                parse_options_usage(stat_usage, stat_options, "timeout", 0);
+                parse_options_usage(stat_usage, stat_options, "I", 1);
+                goto out;
+        }
 
         if (perf_evlist__alloc_stats(evsel_list, interval))
                 goto out;
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 35ac016fcb98..f39bd60d2708 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -817,14 +817,13 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
         struct perf_session *session = top->session;
         union perf_event *event;
         struct machine *machine;
-        u64 end, start;
         int ret;
 
         md = opts->overwrite ? &evlist->overwrite_mmap[idx] : &evlist->mmap[idx];
-        if (perf_mmap__read_init(md, opts->overwrite, &start, &end) < 0)
+        if (perf_mmap__read_init(md) < 0)
                 return;
 
-        while ((event = perf_mmap__read_event(md, opts->overwrite, &start, end)) != NULL) {
+        while ((event = perf_mmap__read_event(md)) != NULL) {
                 ret = perf_evlist__parse_sample(evlist, event, &sample);
                 if (ret) {
                         pr_err("Can't parse sample, err = %d\n", ret);
@@ -879,7 +878,7 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                 } else
                         ++session->evlist->stats.nr_unknown_events;
 next_event:
-                perf_mmap__consume(md, opts->overwrite);
+                perf_mmap__consume(md);
         }
 
         perf_mmap__read_done(md);
@@ -1224,8 +1223,10 @@ parse_callchain_opt(const struct option *opt, const char *arg, int unset)
 
 static int perf_top_config(const char *var, const char *value, void *cb __maybe_unused)
 {
-        if (!strcmp(var, "top.call-graph"))
-                var = "call-graph.record-mode"; /* fall-through */
+        if (!strcmp(var, "top.call-graph")) {
+                var = "call-graph.record-mode";
+                return perf_default_config(var, value, cb);
+        }
         if (!strcmp(var, "top.children")) {
                 symbol_conf.cumulate_callchain = perf_config_bool(var, value);
                 return 0;
@@ -1307,7 +1308,9 @@ int cmd_top(int argc, const char **argv)
         OPT_STRING(0, "sym-annotate", &top.sym_filter, "symbol name",
                     "symbol to annotate"),
         OPT_BOOLEAN('z', "zero", &top.zero, "zero history across updates"),
-        OPT_UINTEGER('F', "freq", &opts->user_freq, "profile at this frequency"),
+        OPT_CALLBACK('F', "freq", &top.record_opts, "freq or 'max'",
+                     "profile at this frequency",
+                      record__parse_freq),
         OPT_INTEGER('E', "entries", &top.print_entries,
                     "display this many functions"),
         OPT_BOOLEAN('U', "hide_user_symbols", &top.hide_user_symbols,
@@ -1490,6 +1493,8 @@ int cmd_top(int argc, const char **argv)
         if (status < 0)
                 goto out_delete_evlist;
 
+        annotation_config__init();
+
         symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL);
         if (symbol__init(NULL) < 0)
                 return -1;
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index e7f1b182fc15..3ad17ee89403 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -19,6 +19,7 @@
 #include <traceevent/event-parse.h>
 #include <api/fs/tracing_path.h>
 #include "builtin.h"
+#include "util/cgroup.h"
 #include "util/color.h"
 #include "util/debug.h"
 #include "util/env.h"
@@ -83,6 +84,7 @@ struct trace {
         struct perf_evlist      *evlist;
         struct machine          *host;
         struct thread           *current;
+        struct cgroup           *cgroup;
         u64                     base_time;
         FILE                    *output;
         unsigned long           nr_events;
@@ -110,6 +112,7 @@ struct trace {
         bool                    multiple_threads;
         bool                    summary;
         bool                    summary_only;
+        bool                    failure_only;
         bool                    show_comm;
         bool                    print_sample;
         bool                    show_tool_stats;
@@ -1563,7 +1566,7 @@ static int trace__printf_interrupted_entry(struct trace *trace)
         struct thread_trace *ttrace;
         size_t printed;
 
-        if (trace->current == NULL)
+        if (trace->failure_only || trace->current == NULL)
                 return 0;
 
         ttrace = thread__priv(trace->current);
@@ -1636,7 +1639,7 @@ static int trace__sys_enter(struct trace *trace, struct perf_evsel *evsel,
                                            args, trace, thread);
 
         if (sc->is_exit) {
-                if (!(trace->duration_filter || trace->summary_only || trace->min_stack)) {
+                if (!(trace->duration_filter || trace->summary_only || trace->failure_only || trace->min_stack)) {
                         trace__fprintf_entry_head(trace, thread, 0, false, ttrace->entry_time, trace->output);
                         fprintf(trace->output, "%-70s)\n", ttrace->entry_str);
                 }
@@ -1740,7 +1743,7 @@ static int trace__sys_exit(struct trace *trace, struct perf_evsel *evsel,
                 }
         }
 
-        if (trace->summary_only)
+        if (trace->summary_only || (ret >= 0 && trace->failure_only))
                 goto out;
 
         trace__fprintf_entry_head(trace, thread, duration, duration_calculated, ttrace->entry_time, trace->output);
@@ -1959,7 +1962,7 @@ static int trace__event_handler(struct trace *trace, struct perf_evsel *evsel,
                                       trace->output);
         }
 
-        fprintf(trace->output, ")\n");
+        fprintf(trace->output, "\n");
 
         if (callchain_ret > 0)
                 trace__fprintf_callchain(trace, sample);
@@ -2370,6 +2373,34 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                                    trace__sched_stat_runtime))
                 goto out_error_sched_stat_runtime;
 
+        /*
+         * If a global cgroup was set, apply it to all the events without an
+         * explicit cgroup. I.e.:
+         *
+         *      trace -G A -e sched:*switch
+         *
+         * Will set all raw_syscalls:sys_{enter,exit}, pgfault, vfs_getname, etc
+         * _and_ sched:sched_switch to the 'A' cgroup, while:
+         *
+         * trace -e sched:*switch -G A
+         *
+         * will only set the sched:sched_switch event to the 'A' cgroup, all the
+         * other events (raw_syscalls:sys_{enter,exit}, etc are left "without"
+         * a cgroup (on the root cgroup, sys wide, etc).
+         *
+         * Multiple cgroups:
+         *
+         * trace -G A -e sched:*switch -G B
+         *
+         * the syscall ones go to the 'A' cgroup, the sched:sched_switch goes
+         * to the 'B' cgroup.
+         *
+         * evlist__set_default_cgroup() grabs a reference of the passed cgroup
+         * only for the evsels still without a cgroup, i.e. evsel->cgroup == NULL.
+         */
+        if (trace->cgroup)
+                evlist__set_default_cgroup(trace->evlist, trace->cgroup);
+
         err = perf_evlist__create_maps(evlist, &trace->opts.target);
         if (err < 0) {
                 fprintf(trace->output, "Problems parsing the target to trace, check your options!\n");
@@ -2472,8 +2503,13 @@ again:
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
                 union perf_event *event;
+                struct perf_mmap *md;
 
-                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                md = &evlist->mmap[i];
+                if (perf_mmap__read_init(md) < 0)
+                        continue;
+
+                while ((event = perf_mmap__read_event(md)) != NULL) {
                         struct perf_sample sample;
 
                         ++trace->nr_events;
@@ -2486,7 +2522,7 @@ again:
 
                         trace__handle_event(trace, event, &sample);
 next_event:
-                        perf_evlist__mmap_consume(evlist, i);
+                        perf_mmap__consume(md);
 
                         if (interrupted)
                                 goto out_disable;
@@ -2496,6 +2532,7 @@ next_event:
                                 draining = true;
                         }
                 }
+                perf_mmap__read_done(md);
         }
 
         if (trace->nr_events == before) {
@@ -2533,6 +2570,7 @@ out_delete_evlist:
         trace__symbols__exit(trace);
 
         perf_evlist__delete(evlist);
+        cgroup__put(trace->cgroup);
         trace->evlist = NULL;
         trace->live = false;
         return err;
@@ -2972,6 +3010,18 @@ out:
         return err;
 }
 
+static int trace__parse_cgroups(const struct option *opt, const char *str, int unset)
+{
+        struct trace *trace = opt->value;
+
+        if (!list_empty(&trace->evlist->entries))
+                return parse_cgroups(opt, str, unset);
+
+        trace->cgroup = evlist__findnew_cgroup(trace->evlist, str);
+
+        return 0;
+}
+
 int cmd_trace(int argc, const char **argv)
 {
         const char *trace_usage[] = {
@@ -3038,6 +3088,8 @@ int cmd_trace(int argc, const char **argv)
         OPT_INCR('v', "verbose", &verbose, "be more verbose"),
         OPT_BOOLEAN('T', "time", &trace.full_time,
                     "Show full timestamp, not time relative to first start"),
+        OPT_BOOLEAN(0, "failure", &trace.failure_only,
+                    "Show only syscalls that failed"),
         OPT_BOOLEAN('s', "summary", &trace.summary_only,
                     "Show only syscall summary with statistics"),
         OPT_BOOLEAN('S', "with-summary", &trace.summary,
@@ -3062,6 +3114,8 @@ int cmd_trace(int argc, const char **argv)
                         "print the PERF_RECORD_SAMPLE PERF_SAMPLE_ info, for debugging"),
         OPT_UINTEGER(0, "proc-map-timeout", &trace.opts.proc_map_timeout,
                         "per thread proc mmap processing timeout in ms"),
+        OPT_CALLBACK('G', "cgroup", &trace, "name", "monitor event in cgroup name only",
+                     trace__parse_cgroups),
         OPT_UINTEGER('D', "delay", &trace.opts.initial_delay,
                      "ms to wait before starting measurement after program "
                      "start"),
@@ -3088,6 +3142,11 @@ int cmd_trace(int argc, const char **argv)
         argc = parse_options_subcommand(argc, argv, trace_options, trace_subcommands,
                                  trace_usage, PARSE_OPT_STOP_AT_NON_OPTION);
 
+        if ((nr_cgroups || trace.cgroup) && !trace.opts.target.system_wide) {
+                usage_with_options_msg(trace_usage, trace_options,
+                                       "cgroup monitoring only available in system-wide mode");
+        }
+
         err = bpf__setup_stdout(trace.evlist);
         if (err) {
                 bpf__strerror_setup_stdout(trace.evlist, err, bf, sizeof(bf));
diff --git a/tools/perf/builtin-version.c b/tools/perf/builtin-version.c
index 37019c5d675f..50df168be326 100644
--- a/tools/perf/builtin-version.c
+++ b/tools/perf/builtin-version.c
@@ -1,11 +1,94 @@
 // SPDX-License-Identifier: GPL-2.0
 #include "builtin.h"
 #include "perf.h"
+#include "color.h"
 #include <linux/compiler.h>
+#include <tools/config.h>
 #include <stdio.h>
+#include <string.h>
+#include <subcmd/parse-options.h>
 
-int cmd_version(int argc __maybe_unused, const char **argv __maybe_unused)
+int version_verbose;
+
+struct version {
+        bool    build_options;
+};
+
+static struct version version;
+
+static struct option version_options[] = {
+        OPT_BOOLEAN(0, "build-options", &version.build_options,
+                    "display the build options"),
+};
+
+static const char * const version_usage[] = {
+        "perf version [<options>]",
+        NULL
+};
+
+static void on_off_print(const char *status)
+{
+        printf("[ ");
+
+        if (!strcmp(status, "OFF"))
+                color_fprintf(stdout, PERF_COLOR_RED, "%-3s", status);
+        else
+                color_fprintf(stdout, PERF_COLOR_GREEN, "%-3s", status);
+
+        printf(" ]");
+}
+
+static void status_print(const char *name, const char *macro,
+                         const char *status)
 {
+        printf("%22s: ", name);
+        on_off_print(status);
+        printf("  # %s\n", macro);
+}
+
+#define STATUS(__d, __m)                                \
+do {                                                    \
+        if (IS_BUILTIN(__d))                            \
+                status_print(#__m, #__d, "on");         \
+        else                                            \
+                status_print(#__m, #__d, "OFF");        \
+} while (0)
+
+static void library_status(void)
+{
+        STATUS(HAVE_DWARF_SUPPORT, dwarf);
+        STATUS(HAVE_DWARF_GETLOCATIONS_SUPPORT, dwarf_getlocations);
+        STATUS(HAVE_GLIBC_SUPPORT, glibc);
+        STATUS(HAVE_GTK2_SUPPORT, gtk2);
+#ifndef HAVE_SYSCALL_TABLE_SUPPORT
+        STATUS(HAVE_LIBAUDIT_SUPPORT, libaudit);
+#endif
+        STATUS(HAVE_SYSCALL_TABLE_SUPPORT, syscall_table);
+        STATUS(HAVE_LIBBFD_SUPPORT, libbfd);
+        STATUS(HAVE_LIBELF_SUPPORT, libelf);
+        STATUS(HAVE_LIBNUMA_SUPPORT, libnuma);
+        STATUS(HAVE_LIBNUMA_SUPPORT, numa_num_possible_cpus);
+        STATUS(HAVE_LIBPERL_SUPPORT, libperl);
+        STATUS(HAVE_LIBPYTHON_SUPPORT, libpython);
+        STATUS(HAVE_SLANG_SUPPORT, libslang);
+        STATUS(HAVE_LIBCRYPTO_SUPPORT, libcrypto);
+        STATUS(HAVE_LIBUNWIND_SUPPORT, libunwind);
+        STATUS(HAVE_DWARF_SUPPORT, libdw-dwarf-unwind);
+        STATUS(HAVE_ZLIB_SUPPORT, zlib);
+        STATUS(HAVE_LZMA_SUPPORT, lzma);
+        STATUS(HAVE_AUXTRACE_SUPPORT, get_cpuid);
+        STATUS(HAVE_LIBBPF_SUPPORT, bpf);
+}
+
+int cmd_version(int argc, const char **argv)
+{
+        argc = parse_options(argc, argv, version_options, version_usage,
+                             PARSE_OPT_STOP_AT_NON_OPTION);
+
         printf("perf version %s\n", perf_version_string);
+
+        if (version.build_options || version_verbose == 1)
+                library_status();
+
         return 0;
 }
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 790ec25919a0..9aff89bc7535 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -42,6 +42,7 @@ arch/parisc/include/uapi/asm/errno.h
 arch/powerpc/include/uapi/asm/errno.h
 arch/sparc/include/uapi/asm/errno.h
 arch/x86/include/uapi/asm/errno.h
+arch/powerpc/include/uapi/asm/unistd.h
 include/asm-generic/bitops/arch_hweight.h
 include/asm-generic/bitops/const_hweight.h
 include/asm-generic/bitops/__fls.h
@@ -58,6 +59,7 @@ check () {
   file=$1
 
   shift
+  opts=
   while [ -n "$*" ]; do
     opts="$opts \"$1\""
     shift
diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
index 36673f98d66b..3eb7a39169f6 100644
--- a/tools/perf/perf-sys.h
+++ b/tools/perf/perf-sys.h
@@ -46,10 +46,6 @@
 #define CPUINFO_PROC    {"Processor"}
 #endif
 
-#ifdef __metag__
-#define CPUINFO_PROC    {"CPU"}
-#endif
-
 #ifdef __xtensa__
 #define CPUINFO_PROC    {"core ID"}
 #endif
diff --git a/tools/perf/perf.c b/tools/perf/perf.c
index 1b3fc8ec0fa2..20a08cb32332 100644
--- a/tools/perf/perf.c
+++ b/tools/perf/perf.c
@@ -73,7 +73,7 @@ static struct cmd_struct commands[] = {
         { "lock",       cmd_lock,       0 },
         { "kvm",        cmd_kvm,        0 },
         { "test",       cmd_test,       0 },
-#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE)
+#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE_SUPPORT)
         { "trace",      cmd_trace,      0 },
 #endif
         { "inject",     cmd_inject,     0 },
@@ -190,6 +190,12 @@ static int handle_options(const char ***argv, int *argc, int *envchanged)
                         break;
                 }
 
+                if (!strcmp(cmd, "-vv")) {
+                        (*argv)[0] = "version";
+                        version_verbose = 1;
+                        break;
+                }
+
                 /*
                  * Check remaining flags.
                  */
@@ -485,7 +491,7 @@ int main(int argc, const char **argv)
                 argv[0] = cmd;
         }
         if (strstarts(cmd, "trace")) {
-#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE)
+#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE_SUPPORT)
                 setup_path();
                 argv[0] = "trace";
                 return cmd_trace(argc, argv);
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 57b9b342d533..a1a97956136f 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -61,6 +61,7 @@ struct record_opts {
         bool         tail_synthesize;
         bool         overwrite;
         bool         ignore_missing_thread;
+        bool         strict_freq;
         bool         sample_id;
         unsigned int freq;
         unsigned int mmap_pages;
@@ -83,4 +84,7 @@ struct record_opts {
 struct option;
 extern const char * const *record_usage;
 extern struct option *record_options;
+extern int version_verbose;
+
+int record__parse_freq(const struct option *opt, const char *str, int unset);
 #endif
diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
index 999a4e878162..17783913d330 100644
--- a/tools/perf/pmu-events/Build
+++ b/tools/perf/pmu-events/Build
@@ -1,10 +1,12 @@
 hostprogs := jevents
 
 jevents-y       += json.o jsmn.o jevents.o
+CHOSTFLAGS_jevents.o    = -I$(srctree)/tools/include
 pmu-events-y    += pmu-events.o
 JDIR            =  pmu-events/arch/$(SRCARCH)
 JSON            =  $(shell [ -d $(JDIR) ] &&                            \
                         find $(JDIR) -name '*.json' -o -name 'mapfile.csv')
+
 #
 # Locate/process JSON files in pmu-events/arch/
 # directory and create tables in pmu-events.c.
diff --git a/tools/perf/pmu-events/README b/tools/perf/pmu-events/README
index c2ee3e4417fe..e62b09b6a844 100644
--- a/tools/perf/pmu-events/README
+++ b/tools/perf/pmu-events/README
@@ -11,12 +11,17 @@ tree tools/perf/pmu-events/arch/foo.
         - Regular files with '.json' extension in the name are assumed to be
           JSON files, each of which describes a set of PMU events.
 
-        - Regular files with basename starting with 'mapfile.csv' are assumed
-          to be a CSV file that maps a specific CPU to its set of PMU events.
-          (see below for mapfile format)
+        - The CSV file that maps a specific CPU to its set of PMU events is to
+          be named 'mapfile.csv' (see below for mapfile format).
 
         - Directories are traversed, but all other files are ignored.
 
+        - To reduce JSON event duplication per architecture, platform JSONs may
+          use "ArchStdEvent" keyword to dereference an "Architecture standard
+          events", defined in architecture standard JSONs.
+          Architecture standard JSONs must be located in the architecture root
+          folder. Matching is based on the "EventName" field.
+
 The PMU events supported by a CPU model are expected to grouped into topics
 such as Pipelining, Cache, Memory, Floating-point etc. All events for a topic
 should be placed in a separate JSON file - where the file name identifies
@@ -29,6 +34,10 @@ sub directory. Thus for the Silvermont X86 CPU:
         Cache.json      Memory.json     Virtual-Memory.json
         Frontend.json   Pipeline.json
 
+The JSONs folder for a CPU model/family may be placed in the root arch
+folder, or may be placed in a vendor sub-folder under the arch folder
+for instances where the arch and vendor are not the same.
+
 Using the JSON files and the mapfile, 'jevents' generates the C source file,
 'pmu-events.c', which encodes the two sets of tables:
 
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/branch.json
index 3b6208763e50..0b0e6b26605b 100644
--- a/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
+++ b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/branch.json
@@ -1,25 +1,23 @@
 [
-  {,
-    "EventCode": "0x7A",
-    "EventName": "BR_INDIRECT_SPEC",
-    "BriefDescription": "Branch speculatively executed - Indirect branch"
+  {
+    "ArchStdEvent":  "BR_INDIRECT_SPEC",
   },
-  {,
+  {
     "EventCode": "0xC9",
     "EventName": "BR_COND",
     "BriefDescription": "Conditional branch executed"
   },
-  {,
+  {
     "EventCode": "0xCA",
     "EventName": "BR_INDIRECT_MISPRED",
     "BriefDescription": "Indirect branch mispredicted"
   },
-  {,
+  {
     "EventCode": "0xCB",
     "EventName": "BR_INDIRECT_MISPRED_ADDR",
     "BriefDescription": "Indirect branch mispredicted because of address miscompare"
   },
-  {,
+  {
     "EventCode": "0xCC",
     "EventName": "BR_COND_MISPRED",
     "BriefDescription": "Conditional branch mispredicted"
diff --git a/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/bus.json b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/bus.json
new file mode 100644
index 000000000000..ce33b2553277
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/bus.json
@@ -0,0 +1,8 @@
+[
+  {
+        "ArchStdEvent": "BUS_ACCESS_RD",
+  },
+  {
+        "ArchStdEvent": "BUS_ACCESS_WR",
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/cache.json b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/cache.json
new file mode 100644
index 000000000000..5dfbec43c9f9
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/cache.json
@@ -0,0 +1,27 @@
+[
+  {
+        "EventCode": "0xC2",
+        "EventName": "PREFETCH_LINEFILL",
+        "BriefDescription": "Linefill because of prefetch"
+  },
+  {
+        "EventCode": "0xC3",
+        "EventName": "PREFETCH_LINEFILL_DROP",
+        "BriefDescription": "Instruction Cache Throttle occurred"
+  },
+  {
+        "EventCode": "0xC4",
+        "EventName": "READ_ALLOC_ENTER",
+        "BriefDescription": "Entering read allocate mode"
+  },
+  {
+        "EventCode": "0xC5",
+        "EventName": "READ_ALLOC",
+        "BriefDescription": "Read allocate mode"
+  },
+  {
+        "EventCode": "0xC8",
+        "EventName": "EXT_SNOOP",
+        "BriefDescription": "SCU Snooped data from another CPU for this CPU"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/memory.json
index 480d9f7460ab..25ae642ba381 100644
--- a/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
+++ b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/memory.json
@@ -1,20 +1,10 @@
 [
-  {,
-    "EventCode": "0x60",
-    "EventName": "BUS_ACCESS_LD",
-    "BriefDescription": "Bus access - Read"
-  },
-  {,
-    "EventCode": "0x61",
-    "EventName": "BUS_ACCESS_ST",
-    "BriefDescription": "Bus access - Write"
-  },
-  {,
+  {
     "EventCode": "0xC0",
     "EventName": "EXT_MEM_REQ",
     "BriefDescription": "External memory request"
   },
-  {,
+  {
     "EventCode": "0xC1",
     "EventName": "EXT_MEM_REQ_NC",
     "BriefDescription": "Non-cacheable external memory request"
diff --git a/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/other.json b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/other.json
new file mode 100644
index 000000000000..6cc6cbd7bf0b
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/other.json
@@ -0,0 +1,28 @@
+[
+  {
+        "ArchStdEvent": "EXC_IRQ",
+  },
+  {
+        "ArchStdEvent": "EXC_FIQ",
+  },
+  {
+        "EventCode": "0xC6",
+        "EventName": "PRE_DECODE_ERR",
+        "BriefDescription": "Pre-decode error"
+  },
+  {
+        "EventCode": "0xD0",
+        "EventName": "L1I_CACHE_ERR",
+        "BriefDescription": "L1 Instruction Cache (data or tag) memory error"
+  },
+  {
+        "EventCode": "0xD1",
+        "EventName": "L1D_CACHE_ERR",
+        "BriefDescription": "L1 Data Cache (data, tag or dirty) memory error, correctable or non-correctable"
+  },
+  {
+        "EventCode": "0xD2",
+        "EventName": "TLB_ERR",
+        "BriefDescription": "TLB memory error"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/pipeline.json
index 3149fb90555a..f45a6b5d0025 100644
--- a/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
+++ b/tools/perf/pmu-events/arch/arm64/arm/cortex-a53/pipeline.json
@@ -1,50 +1,50 @@
 [
-  {,
+  {
     "EventCode": "0xC7",
     "EventName": "STALL_SB_FULL",
     "BriefDescription": "Data Write operation that stalls the pipeline because the store buffer is full"
   },
-  {,
+  {
     "EventCode": "0xE0",
     "EventName": "OTHER_IQ_DEP_STALL",
     "BriefDescription": "Cycles that the DPU IQ is empty and that is not because of a recent micro-TLB miss, instruction cache miss or pre-decode error"
   },
-  {,
+  {
     "EventCode": "0xE1",
     "EventName": "IC_DEP_STALL",
     "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction cache miss being processed"
   },
-  {,
+  {
     "EventCode": "0xE2",
     "EventName": "IUTLB_DEP_STALL",
     "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction micro-TLB miss being processed"
   },
-  {,
+  {
     "EventCode": "0xE3",
     "EventName": "DECODE_DEP_STALL",
     "BriefDescription": "Cycles the DPU IQ is empty and there is a pre-decode error being processed"
   },
-  {,
+  {
     "EventCode": "0xE4",
     "EventName": "OTHER_INTERLOCK_STALL",
     "BriefDescription": "Cycles there is an interlock other than  Advanced SIMD/Floating-point instructions or load/store instruction"
   },
-  {,
+  {
     "EventCode": "0xE5",
     "EventName": "AGU_DEP_STALL",
     "BriefDescription": "Cycles there is an interlock for a load/store instruction waiting for data to calculate the address in the AGU"
   },
-  {,
+  {
     "EventCode": "0xE6",
     "EventName": "SIMD_DEP_STALL",
     "BriefDescription": "Cycles there is an interlock for an Advanced SIMD/Floating-point operation."
   },
-  {,
+  {
     "EventCode": "0xE7",
     "EventName": "LD_DEP_STALL",
     "BriefDescription": "Cycles there is a stall in the Wr stage because of a load miss"
   },
-  {,
+  {
     "EventCode": "0xE8",
     "EventName": "ST_DEP_STALL",
     "BriefDescription": "Cycles there is a stall in the Wr stage because of a store"
diff --git a/tools/perf/pmu-events/arch/arm64/armv8-recommended.json b/tools/perf/pmu-events/arch/arm64/armv8-recommended.json
new file mode 100644
index 000000000000..6328828c018c
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/armv8-recommended.json
@@ -0,0 +1,452 @@
+[
+    {
+        "PublicDescription": "Attributable Level 1 data cache access, read",
+        "EventCode": "0x40",
+        "EventName": "L1D_CACHE_RD",
+        "BriefDescription": "L1D cache access, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache access, write",
+        "EventCode": "0x41",
+        "EventName": "L1D_CACHE_WR",
+        "BriefDescription": "L1D cache access, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache refill, read",
+        "EventCode": "0x42",
+        "EventName": "L1D_CACHE_REFILL_RD",
+        "BriefDescription": "L1D cache refill, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache refill, write",
+        "EventCode": "0x43",
+        "EventName": "L1D_CACHE_REFILL_WR",
+        "BriefDescription": "L1D cache refill, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache refill, inner",
+        "EventCode": "0x44",
+        "EventName": "L1D_CACHE_REFILL_INNER",
+        "BriefDescription": "L1D cache refill, inner"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache refill, outer",
+        "EventCode": "0x45",
+        "EventName": "L1D_CACHE_REFILL_OUTER",
+        "BriefDescription": "L1D cache refill, outer"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache Write-Back, victim",
+        "EventCode": "0x46",
+        "EventName": "L1D_CACHE_WB_VICTIM",
+        "BriefDescription": "L1D cache Write-Back, victim"
+    },
+    {
+        "PublicDescription": "Level 1 data cache Write-Back, cleaning and coherency",
+        "EventCode": "0x47",
+        "EventName": "L1D_CACHE_WB_CLEAN",
+        "BriefDescription": "L1D cache Write-Back, cleaning and coherency"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data cache invalidate",
+        "EventCode": "0x48",
+        "EventName": "L1D_CACHE_INVAL",
+        "BriefDescription": "L1D cache invalidate"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data TLB refill, read",
+        "EventCode": "0x4C",
+        "EventName": "L1D_TLB_REFILL_RD",
+        "BriefDescription": "L1D tlb refill, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data TLB refill, write",
+        "EventCode": "0x4D",
+        "EventName": "L1D_TLB_REFILL_WR",
+        "BriefDescription": "L1D tlb refill, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data or unified TLB access, read",
+        "EventCode": "0x4E",
+        "EventName": "L1D_TLB_RD",
+        "BriefDescription": "L1D tlb access, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 1 data or unified TLB access, write",
+        "EventCode": "0x4F",
+        "EventName": "L1D_TLB_WR",
+        "BriefDescription": "L1D tlb access, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data cache access, read",
+        "EventCode": "0x50",
+        "EventName": "L2D_CACHE_RD",
+        "BriefDescription": "L2D cache access, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data cache access, write",
+        "EventCode": "0x51",
+        "EventName": "L2D_CACHE_WR",
+        "BriefDescription": "L2D cache access, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data cache refill, read",
+        "EventCode": "0x52",
+        "EventName": "L2D_CACHE_REFILL_RD",
+        "BriefDescription": "L2D cache refill, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data cache refill, write",
+        "EventCode": "0x53",
+        "EventName": "L2D_CACHE_REFILL_WR",
+        "BriefDescription": "L2D cache refill, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data cache Write-Back, victim",
+        "EventCode": "0x56",
+        "EventName": "L2D_CACHE_WB_VICTIM",
+        "BriefDescription": "L2D cache Write-Back, victim"
+    },
+    {
+        "PublicDescription": "Level 2 data cache Write-Back, cleaning and coherency",
+        "EventCode": "0x57",
+        "EventName": "L2D_CACHE_WB_CLEAN",
+        "BriefDescription": "L2D cache Write-Back, cleaning and coherency"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data cache invalidate",
+        "EventCode": "0x58",
+        "EventName": "L2D_CACHE_INVAL",
+        "BriefDescription": "L2D cache invalidate"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data or unified TLB refill, read",
+        "EventCode": "0x5c",
+        "EventName": "L2D_TLB_REFILL_RD",
+        "BriefDescription": "L2D cache refill, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data or unified TLB refill, write",
+        "EventCode": "0x5d",
+        "EventName": "L2D_TLB_REFILL_WR",
+        "BriefDescription": "L2D cache refill, write"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data or unified TLB access, read",
+        "EventCode": "0x5e",
+        "EventName": "L2D_TLB_RD",
+        "BriefDescription": "L2D cache access, read"
+    },
+    {
+        "PublicDescription": "Attributable Level 2 data or unified TLB access, write",
+        "EventCode": "0x5f",
+        "EventName": "L2D_TLB_WR",
+        "BriefDescription": "L2D cache access, write"
+    },
+    {
+        "PublicDescription": "Bus access read",
+        "EventCode": "0x60",
+        "EventName": "BUS_ACCESS_RD",
+        "BriefDescription": "Bus access read"
+   },
+   {
+        "PublicDescription": "Bus access write",
+        "EventCode": "0x61",
+        "EventName": "BUS_ACCESS_WR",
+        "BriefDescription": "Bus access write"
+   }
+   {
+        "PublicDescription": "Bus access, Normal, Cacheable, Shareable",
+        "EventCode": "0x62",
+        "EventName": "BUS_ACCESS_SHARED",
+        "BriefDescription": "Bus access, Normal, Cacheable, Shareable"
+   }
+   {
+        "PublicDescription": "Bus access, not Normal, Cacheable, Shareable",
+        "EventCode": "0x63",
+        "EventName": "BUS_ACCESS_NOT_SHARED",
+        "BriefDescription": "Bus access, not Normal, Cacheable, Shareable"
+   }
+   {
+        "PublicDescription": "Bus access, Normal",
+        "EventCode": "0x64",
+        "EventName": "BUS_ACCESS_NORMAL",
+        "BriefDescription": "Bus access, Normal"
+   }
+   {
+        "PublicDescription": "Bus access, peripheral",
+        "EventCode": "0x65",
+        "EventName": "BUS_ACCESS_PERIPH",
+        "BriefDescription": "Bus access, peripheral"
+   }
+   {
+        "PublicDescription": "Data memory access, read",
+        "EventCode": "0x66",
+        "EventName": "MEM_ACCESS_RD",
+        "BriefDescription": "Data memory access, read"
+   }
+   {
+        "PublicDescription": "Data memory access, write",
+        "EventCode": "0x67",
+        "EventName": "MEM_ACCESS_WR",
+        "BriefDescription": "Data memory access, write"
+   }
+   {
+        "PublicDescription": "Unaligned access, read",
+        "EventCode": "0x68",
+        "EventName": "UNALIGNED_LD_SPEC",
+        "BriefDescription": "Unaligned access, read"
+   }
+   {
+        "PublicDescription": "Unaligned access, write",
+        "EventCode": "0x69",
+        "EventName": "UNALIGNED_ST_SPEC",
+        "BriefDescription": "Unaligned access, write"
+   }
+   {
+        "PublicDescription": "Unaligned access",
+        "EventCode": "0x6a",
+        "EventName": "UNALIGNED_LDST_SPEC",
+        "BriefDescription": "Unaligned access"
+   }
+   {
+        "PublicDescription": "Exclusive operation speculatively executed, LDREX or LDX",
+        "EventCode": "0x6c",
+        "EventName": "LDREX_SPEC",
+        "BriefDescription": "Exclusive operation speculatively executed, LDREX or LDX"
+   }
+   {
+        "PublicDescription": "Exclusive operation speculatively executed, STREX or STX pass",
+        "EventCode": "0x6d",
+        "EventName": "STREX_PASS_SPEC",
+        "BriefDescription": "Exclusive operation speculatively executed, STREX or STX pass"
+   }
+   {
+        "PublicDescription": "Exclusive operation speculatively executed, STREX or STX fail",
+        "EventCode": "0x6e",
+        "EventName": "STREX_FAIL_SPEC",
+        "BriefDescription": "Exclusive operation speculatively executed, STREX or STX fail"
+   }
+   {
+        "PublicDescription": "Exclusive operation speculatively executed, STREX or STX",
+        "EventCode": "0x6f",
+        "EventName": "STREX_SPEC",
+        "BriefDescription": "Exclusive operation speculatively executed, STREX or STX"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, load",
+        "EventCode": "0x70",
+        "EventName": "LD_SPEC",
+        "BriefDescription": "Operation speculatively executed, load"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, store"
+        "EventCode": "0x71",
+        "EventName": "ST_SPEC",
+        "BriefDescription": "Operation speculatively executed, store"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, load or store",
+        "EventCode": "0x72",
+        "EventName": "LDST_SPEC",
+        "BriefDescription": "Operation speculatively executed, load or store"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, integer data processing",
+        "EventCode": "0x73",
+        "EventName": "DP_SPEC",
+        "BriefDescription": "Operation speculatively executed, integer data processing"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, Advanced SIMD instruction",
+        "EventCode": "0x74",
+        "EventName": "ASE_SPEC",
+        "BriefDescription": "Operation speculatively executed, Advanced SIMD instruction",
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, floating-point instruction",
+        "EventCode": "0x75",
+        "EventName": "VFP_SPEC",
+        "BriefDescription": "Operation speculatively executed, floating-point instruction"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, software change of the PC",
+        "EventCode": "0x76",
+        "EventName": "PC_WRITE_SPEC",
+        "BriefDescription": "Operation speculatively executed, software change of the PC"
+   }
+   {
+        "PublicDescription": "Operation speculatively executed, Cryptographic instruction",
+        "EventCode": "0x77",
+        "EventName": "CRYPTO_SPEC",
+        "BriefDescription": "Operation speculatively executed, Cryptographic instruction"
+   }
+   {
+        "PublicDescription": "Branch speculatively executed, immediate branch"
+        "EventCode": "0x78",
+        "EventName": "BR_IMMED_SPEC",
+        "BriefDescription": "Branch speculatively executed, immediate branch"
+   }
+   {
+        "PublicDescription": "Branch speculatively executed, procedure return"
+        "EventCode": "0x79",
+        "EventName": "BR_RETURN_SPEC",
+        "BriefDescription": "Branch speculatively executed, procedure return"
+   }
+   {
+        "PublicDescription": "Branch speculatively executed, indirect branch"
+        "EventCode": "0x7a",
+        "EventName": "BR_INDIRECT_SPEC",
+        "BriefDescription": "Branch speculatively executed, indirect branch"
+   }
+   {
+        "PublicDescription": "Barrier speculatively executed, ISB"
+        "EventCode": "0x7c",
+        "EventName": "ISB_SPEC",
+        "BriefDescription": "Barrier speculatively executed, ISB"
+   }
+   {
+        "PublicDescription": "Barrier speculatively executed, DSB"
+        "EventCode": "0x7d",
+        "EventName": "DSB_SPEC",
+        "BriefDescription": "Barrier speculatively executed, DSB"
+   }
+   {
+        "PublicDescription": "Barrier speculatively executed, DMB"
+        "EventCode": "0x7e",
+        "EventName": "DMB_SPEC",
+        "BriefDescription": "Barrier speculatively executed, DMB"
+   }
+   {
+        "PublicDescription": "Exception taken, Other synchronous"
+        "EventCode": "0x81",
+        "EventName": "EXC_UNDEF",
+        "BriefDescription": "Exception taken, Other synchronous"
+   }
+   {
+        "PublicDescription": "Exception taken, Supervisor Call"
+        "EventCode": "0x82",
+        "EventName": "EXC_SVC",
+        "BriefDescription": "Exception taken, Supervisor Call"
+   }
+   {
+        "PublicDescription": "Exception taken, Instruction Abort"
+        "EventCode": "0x83",
+        "EventName": "EXC_PABORT",
+        "BriefDescription": "Exception taken, Instruction Abort"
+   }
+   {
+        "PublicDescription": "Exception taken, Data Abort and SError"
+        "EventCode": "0x84",
+        "EventName": "EXC_DABORT",
+        "BriefDescription": "Exception taken, Data Abort and SError"
+   }
+   {
+        "PublicDescription": "Exception taken, IRQ"
+        "EventCode": "0x86",
+        "EventName": "EXC_IRQ",
+        "BriefDescription": "Exception taken, IRQ"
+   }
+   {
+        "PublicDescription": "Exception taken, FIQ"
+        "EventCode": "0x87",
+        "EventName": "EXC_FIQ",
+        "BriefDescription": "Exception taken, FIQ"
+   }
+   {
+        "PublicDescription": "Exception taken, Secure Monitor Call"
+        "EventCode": "0x88",
+        "EventName": "EXC_SMC",
+        "BriefDescription": "Exception taken, Secure Monitor Call"
+   }
+   {
+        "PublicDescription": "Exception taken, Hypervisor Call"
+        "EventCode": "0x8a",
+        "EventName": "EXC_HVC",
+        "BriefDescription": "Exception taken, Hypervisor Call"
+   }
+   {
+        "PublicDescription": "Exception taken, Instruction Abort not taken locally"
+        "EventCode": "0x8b",
+        "EventName": "EXC_TRAP_PABORT",
+        "BriefDescription": "Exception taken, Instruction Abort not taken locally"
+   }
+   {
+        "PublicDescription": "Exception taken, Data Abort or SError not taken locally"
+        "EventCode": "0x8c",
+        "EventName": "EXC_TRAP_DABORT",
+        "BriefDescription": "Exception taken, Data Abort or SError not taken locally"
+   }
+   {
+        "PublicDescription": "Exception taken, Other traps not taken locally"
+        "EventCode": "0x8d",
+        "EventName": "EXC_TRAP_OTHER",
+        "BriefDescription": "Exception taken, Other traps not taken locally"
+   }
+   {
+        "PublicDescription": "Exception taken, IRQ not taken locally"
+        "EventCode": "0x8e",
+        "EventName": "EXC_TRAP_IRQ",
+        "BriefDescription": "Exception taken, IRQ not taken locally"
+   }
+   {
+        "PublicDescription": "Exception taken, FIQ not taken locally"
+        "EventCode": "0x8f",
+        "EventName": "EXC_TRAP_FIQ",
+        "BriefDescription": "Exception taken, FIQ not taken locally"
+   }
+   {
+        "PublicDescription": "Release consistency operation speculatively executed, Load-Acquire"
+        "EventCode": "0x90",
+        "EventName": "RC_LD_SPEC",
+        "BriefDescription": "Release consistency operation speculatively executed, Load-Acquire"
+   }
+   {
+        "PublicDescription": "Release consistency operation speculatively executed, Store-Release"
+        "EventCode": "0x91",
+        "EventName": "RC_ST_SPEC",
+        "BriefDescription": "Release consistency operation speculatively executed, Store-Release"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache access, read"
+        "EventCode": "0xa0",
+        "EventName": "L3D_CACHE_RD",
+        "BriefDescription": "Attributable Level 3 data or unified cache access, read"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache access, write"
+        "EventCode": "0xa1",
+        "EventName": "L3D_CACHE_WR",
+        "BriefDescription": "Attributable Level 3 data or unified cache access, write"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache refill, read"
+        "EventCode": "0xa2",
+        "EventName": "L3D_CACHE_REFILL_RD",
+        "BriefDescription": "Attributable Level 3 data or unified cache refill, read"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache refill, write"
+        "EventCode": "0xa3",
+        "EventName": "L3D_CACHE_REFILL_WR",
+        "BriefDescription": "Attributable Level 3 data or unified cache refill, write"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache Write-Back, victim"
+        "EventCode": "0xa6",
+        "EventName": "L3D_CACHE_WB_VICTIM",
+        "BriefDescription": "Attributable Level 3 data or unified cache Write-Back, victim"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache Write-Back, cache clean"
+        "EventCode": "0xa7",
+        "EventName": "L3D_CACHE_WB_CLEAN",
+        "BriefDescription": "Attributable Level 3 data or unified cache Write-Back, cache clean"
+   }
+   {
+        "PublicDescription": "Attributable Level 3 data or unified cache access, invalidate"
+        "EventCode": "0xa8",
+        "EventName": "L3D_CACHE_INVAL",
+        "BriefDescription": "Attributable Level 3 data or unified cache access, invalidate"
+   }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cavium/thunderx2-imp-def.json b/tools/perf/pmu-events/arch/arm64/cavium/thunderx2-imp-def.json
deleted file mode 100644
index 2db45c40ebc7..000000000000
--- a/tools/perf/pmu-events/arch/arm64/cavium/thunderx2-imp-def.json
+++ /dev/null
@@ -1,62 +0,0 @@
-[
-    {
-        "PublicDescription": "Attributable Level 1 data cache access, read",
-        "EventCode": "0x40",
-        "EventName": "l1d_cache_rd",
-        "BriefDescription": "L1D cache read",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data cache access, write ",
-        "EventCode": "0x41",
-        "EventName": "l1d_cache_wr",
-        "BriefDescription": "L1D cache write",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data cache refill, read",
-        "EventCode": "0x42",
-        "EventName": "l1d_cache_refill_rd",
-        "BriefDescription": "L1D cache refill read",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data cache refill, write",
-        "EventCode": "0x43",
-        "EventName": "l1d_cache_refill_wr",
-        "BriefDescription": "L1D refill write",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data TLB refill, read",
-        "EventCode": "0x4C",
-        "EventName": "l1d_tlb_refill_rd",
-        "BriefDescription": "L1D tlb refill read",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data TLB refill, write",
-        "EventCode": "0x4D",
-        "EventName": "l1d_tlb_refill_wr",
-        "BriefDescription": "L1D tlb refill write",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data or unified TLB access, read",
-        "EventCode": "0x4E",
-        "EventName": "l1d_tlb_rd",
-        "BriefDescription": "L1D tlb read",
-    },
-    {
-        "PublicDescription": "Attributable Level 1 data or unified TLB access, write",
-        "EventCode": "0x4F",
-        "EventName": "l1d_tlb_wr",
-        "BriefDescription": "L1D tlb write",
-    },
-    {
-        "PublicDescription": "Bus access read",
-        "EventCode": "0x60",
-        "EventName": "bus_access_rd",
-        "BriefDescription": "Bus access read",
-   },
-   {
-        "PublicDescription": "Bus access write",
-        "EventCode": "0x61",
-        "EventName": "bus_access_wr",
-        "BriefDescription": "Bus access write",
-   }
-]
diff --git a/tools/perf/pmu-events/arch/arm64/cavium/thunderx2/core-imp-def.json b/tools/perf/pmu-events/arch/arm64/cavium/thunderx2/core-imp-def.json
new file mode 100644
index 000000000000..bc03c06c3918
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cavium/thunderx2/core-imp-def.json
@@ -0,0 +1,32 @@
+[
+    {
+        "ArchStdEvent": "L1D_CACHE_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_WR",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_REFILL_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_REFILL_WR",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_REFILL_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_REFILL_WR",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_WR",
+    },
+    {
+        "ArchStdEvent": "BUS_ACCESS_RD",
+   },
+   {
+        "ArchStdEvent": "BUS_ACCESS_WR",
+   }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
deleted file mode 100644
index 480d9f7460ab..000000000000
--- a/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
+++ /dev/null
@@ -1,22 +0,0 @@
-[
-  {,
-    "EventCode": "0x60",
-    "EventName": "BUS_ACCESS_LD",
-    "BriefDescription": "Bus access - Read"
-  },
-  {,
-    "EventCode": "0x61",
-    "EventName": "BUS_ACCESS_ST",
-    "BriefDescription": "Bus access - Write"
-  },
-  {,
-    "EventCode": "0xC0",
-    "EventName": "EXT_MEM_REQ",
-    "BriefDescription": "External memory request"
-  },
-  {,
-    "EventCode": "0xC1",
-    "EventName": "EXT_MEM_REQ_NC",
-    "BriefDescription": "Non-cacheable external memory request"
-  }
-]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
deleted file mode 100644
index 11baad6344b9..000000000000
--- a/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
+++ /dev/null
@@ -1,27 +0,0 @@
-[
-  {,
-    "EventCode": "0xC2",
-    "EventName": "PREFETCH_LINEFILL",
-    "BriefDescription": "Linefill because of prefetch"
-  },
-  {,
-    "EventCode": "0xC3",
-    "EventName": "PREFETCH_LINEFILL_DROP",
-    "BriefDescription": "Instruction Cache Throttle occurred"
-  },
-  {,
-    "EventCode": "0xC4",
-    "EventName": "READ_ALLOC_ENTER",
-    "BriefDescription": "Entering read allocate mode"
-  },
-  {,
-    "EventCode": "0xC5",
-    "EventName": "READ_ALLOC",
-    "BriefDescription": "Read allocate mode"
-  },
-  {,
-    "EventCode": "0xC8",
-    "EventName": "EXT_SNOOP",
-    "BriefDescription": "SCU Snooped data from another CPU for this CPU"
-  }
-]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
deleted file mode 100644
index 73a22402d003..000000000000
--- a/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
+++ /dev/null
@@ -1,32 +0,0 @@
-[
-  {,
-    "EventCode": "0x86",
-    "EventName": "EXC_IRQ",
-    "BriefDescription": "Exception taken, IRQ"
-  },
-  {,
-    "EventCode": "0x87",
-    "EventName": "EXC_FIQ",
-    "BriefDescription": "Exception taken, FIQ"
-  },
-  {,
-    "EventCode": "0xC6",
-    "EventName": "PRE_DECODE_ERR",
-    "BriefDescription": "Pre-decode error"
-  },
-  {,
-    "EventCode": "0xD0",
-    "EventName": "L1I_CACHE_ERR",
-    "BriefDescription": "L1 Instruction Cache (data or tag) memory error"
-  },
-  {,
-    "EventCode": "0xD1",
-    "EventName": "L1D_CACHE_ERR",
-    "BriefDescription": "L1 Data Cache (data, tag or dirty) memory error, correctable or non-correctable"
-  },
-  {,
-    "EventCode": "0xD2",
-    "EventName": "TLB_ERR",
-    "BriefDescription": "TLB memory error"
-  }
-]
diff --git a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/core-imp-def.json b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/core-imp-def.json
new file mode 100644
index 000000000000..9f0f15d15f75
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/core-imp-def.json
@@ -0,0 +1,122 @@
+[
+    {
+        "ArchStdEvent": "L1D_CACHE_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_WR",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_REFILL_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_REFILL_WR",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_WB_VICTIM",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_WB_CLEAN",
+    },
+    {
+        "ArchStdEvent": "L1D_CACHE_INVAL",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_REFILL_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_REFILL_WR",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_RD",
+    },
+    {
+        "ArchStdEvent": "L1D_TLB_WR",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_RD",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_WR",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_REFILL_RD",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_REFILL_WR",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_WB_VICTIM",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_WB_CLEAN",
+    },
+    {
+        "ArchStdEvent": "L2D_CACHE_INVAL",
+    },
+    {
+        "PublicDescription": "Level 1 instruction cache prefetch access count",
+        "EventCode": "0x102e",
+        "EventName": "L1I_CACHE_PRF",
+        "BriefDescription": "L1I cache prefetch access count",
+    },
+    {
+        "PublicDescription": "Level 1 instruction cache miss due to prefetch access count",
+        "EventCode": "0x102f",
+        "EventName": "L1I_CACHE_PRF_REFILL",
+        "BriefDescription": "L1I cache miss due to prefetch access count",
+    },
+    {
+        "PublicDescription": "Instruction queue is empty",
+        "EventCode": "0x1043",
+        "EventName": "IQ_IS_EMPTY",
+        "BriefDescription": "Instruction queue is empty",
+    },
+    {
+        "PublicDescription": "Instruction fetch stall cycles",
+        "EventCode": "0x1044",
+        "EventName": "IF_IS_STALL",
+        "BriefDescription": "Instruction fetch stall cycles",
+    },
+    {
+        "PublicDescription": "Instructions can receive, but not send",
+        "EventCode": "0x2014",
+        "EventName": "FETCH_BUBBLE",
+        "BriefDescription": "Instructions can receive, but not send",
+    },
+    {
+        "PublicDescription": "Prefetch request from LSU",
+        "EventCode": "0x6013",
+        "EventName": "PRF_REQ",
+        "BriefDescription": "Prefetch request from LSU",
+    },
+    {
+        "PublicDescription": "Hit on prefetched data",
+        "EventCode": "0x6014",
+        "EventName": "HIT_ON_PRF",
+        "BriefDescription": "Hit on prefetched data",
+    },
+    {
+        "PublicDescription": "Cycles of that the number of issuing micro operations are less than 4",
+        "EventCode": "0x7001",
+        "EventName": "EXE_STALL_CYCLE",
+        "BriefDescription": "Cycles of that the number of issue ups are less than 4",
+    },
+    {
+        "PublicDescription": "No any micro operation is issued and meanwhile any load operation is not resolved",
+        "EventCode": "0x7004",
+        "EventName": "MEM_STALL_ANYLOAD",
+        "BriefDescription": "No any micro operation is issued and meanwhile any load operation is not resolved",
+    },
+    {
+        "PublicDescription": "No any micro operation is issued and meanwhile there is any load operation missing L1 cache and pending data refill",
+        "EventCode": "0x7006",
+        "EventName": "MEM_STALL_L1MISS",
+        "BriefDescription": "No any micro operation is issued and meanwhile there is any load operation missing L1 cache and pending data refill",
+    },
+    {
+        "PublicDescription": "No any micro operation is issued and meanwhile there is any load operation missing both L1 and L2 cache and pending data refill from L3 cache",
+        "EventCode": "0x7007",
+        "EventName": "MEM_STALL_L2MISS",
+        "BriefDescription": "No any micro operation is issued and meanwhile there is any load operation missing both L1 and L2 cache and pending data refill from L3 cache",
+    },
+]
diff --git a/tools/perf/pmu-events/arch/arm64/mapfile.csv b/tools/perf/pmu-events/arch/arm64/mapfile.csv
index e61c9ca6cf9e..f03e26ecb658 100644
--- a/tools/perf/pmu-events/arch/arm64/mapfile.csv
+++ b/tools/perf/pmu-events/arch/arm64/mapfile.csv
@@ -12,5 +12,7 @@
 #
 #
 #Family-model,Version,Filename,EventType
-0x00000000420f5160,v1,cavium,core
-0x00000000410fd03[[:xdigit:]],v1,cortex-a53,core
+0x00000000410fd03[[:xdigit:]],v1,arm/cortex-a53,core
+0x00000000420f5160,v1,cavium/thunderx2,core
+0x00000000430f0af0,v1,cavium/thunderx2,core
+0x00000000480fd010,v1,hisilicon/hip08,core
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/cache.json b/tools/perf/pmu-events/arch/powerpc/power9/cache.json
index 7945c5196c43..851072105054 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/cache.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/cache.json
@@ -20,11 +20,6 @@
     "BriefDescription": "Finish stall due to a scalar fixed point or CR instruction in the execution pipeline. These instructions get routed to the ALU, ALU2, and DIV pipes"
   },
   {,
-    "EventCode": "0x1D15C",
-    "EventName": "PM_MRK_DTLB_MISS_1G",
-    "BriefDescription": "Marked Data TLB reload (after a miss) page size 2M. Implies radix translation was used"
-  },
-  {,
     "EventCode": "0x4D12A",
     "EventName": "PM_MRK_DATA_FROM_RL4_CYC",
     "BriefDescription": "Duration in cycles to reload from another chip's L4 on the same Node or Group ( Remote) due to a marked load"
@@ -80,21 +75,6 @@
     "BriefDescription": "Threshold counter exceed a count of 4096"
   },
   {,
-    "EventCode": "0x3D156",
-    "EventName": "PM_MRK_DTLB_MISS_64K",
-    "BriefDescription": "Marked Data TLB Miss page size 64K"
-  },
-  {,
-    "EventCode": "0x4C15E",
-    "EventName": "PM_MRK_DTLB_MISS_16M",
-    "BriefDescription": "Marked Data TLB Miss page size 16M"
-  },
-  {,
-    "EventCode": "0x2D15E",
-    "EventName": "PM_MRK_DTLB_MISS_16G",
-    "BriefDescription": "Marked Data TLB Miss page size 16G"
-  },
-  {,
     "EventCode": "0x3F14A",
     "EventName": "PM_MRK_DPTEG_FROM_RMEM",
     "BriefDescription": "A Page Table Entry was loaded into the TLB from another chip's memory on the same Node or Group ( Remote) due to a marked data side request. When using Radix Page Translation, this count excludes PDE reloads. Only PTE reloads are included"
@@ -123,10 +103,5 @@
     "EventCode": "0x1002A",
     "EventName": "PM_CMPLU_STALL_LARX",
     "BriefDescription": "Finish stall because the NTF instruction was a larx waiting to be satisfied"
-  },
-  {,
-    "EventCode": "0x1C058",
-    "EventName": "PM_DTLB_MISS_16G",
-    "BriefDescription": "Data TLB Miss page size 16G"
   }
 ]
\ No newline at end of file
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/frontend.json b/tools/perf/pmu-events/arch/powerpc/power9/frontend.json
index bd8361b5fd6a..f9fa84b16fb5 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/frontend.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/frontend.json
@@ -155,11 +155,6 @@
     "BriefDescription": "Duration in cycles to reload with Shared (S) data from another chip's L2 or L3 on the same Node or Group (Remote), as this chip due to a marked load"
   },
   {,
-    "EventCode": "0x3C056",
-    "EventName": "PM_DTLB_MISS_64K",
-    "BriefDescription": "Data TLB Miss page size 64K"
-  },
-  {,
     "EventCode": "0x30060",
     "EventName": "PM_TM_TRANS_RUN_INST",
     "BriefDescription": "Run instructions completed in transactional state (gated by the run latch)"
@@ -345,11 +340,6 @@
     "BriefDescription": "Larx finished"
   },
   {,
-    "EventCode": "0x4C056",
-    "EventName": "PM_DTLB_MISS_16M",
-    "BriefDescription": "Data TLB Miss page size 16M"
-  },
-  {,
     "EventCode": "0x1003A",
     "EventName": "PM_CMPLU_STALL_LSU_FIN",
     "BriefDescription": "Finish stall because the NTF instruction was an LSU op (other than a load or a store) with all its dependencies met and just going through the LSU pipe to finish"
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/marked.json b/tools/perf/pmu-events/arch/powerpc/power9/marked.json
index 22f9f32060a8..b1954c38bab1 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/marked.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/marked.json
@@ -530,11 +530,6 @@
     "BriefDescription": "Counts all Icache reloads includes demand, prefetch, prefetch turned into demand and demand turned into prefetch"
   },
   {,
-    "EventCode": "0x4003C",
-    "EventName": "PM_DISP_HELD_SYNC_HOLD",
-    "BriefDescription": "Cycles in which dispatch is held because of a synchronizing instruction in the pipeline"
-  },
-  {,
     "EventCode": "0x3003C",
     "EventName": "PM_CMPLU_STALL_NESTED_TEND",
     "BriefDescription": "Completion stall because the ISU is updating the TEXASR to keep track of the nested tend and decrement the TEXASR nested level. This is a short delay"
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/memory.json b/tools/perf/pmu-events/arch/powerpc/power9/memory.json
index 9960d1c0dd44..2e2ebc700c74 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/memory.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/memory.json
@@ -45,11 +45,6 @@
     "BriefDescription": "count of Loads completed"
   },
   {,
-    "EventCode": "0x2D156",
-    "EventName": "PM_MRK_DTLB_MISS_4K",
-    "BriefDescription": "Marked Data TLB Miss page size 4k"
-  },
-  {,
     "EventCode": "0x4C042",
     "EventName": "PM_DATA_FROM_L3",
     "BriefDescription": "The processor's data cache was reloaded from local core's L3 due to a demand load"
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/other.json b/tools/perf/pmu-events/arch/powerpc/power9/other.json
index 5ce312973f1e..48cf4f920b3f 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/other.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/other.json
@@ -70,6 +70,11 @@
     "BriefDescription": "Cycles thread running at priority level 0 or 1"
   },
   {,
+    "EventCode": "0x4C054",
+    "EventName": "PM_DERAT_MISS_16G_1G",
+    "BriefDescription": "Data ERAT Miss (Data TLB Access) page size 16G (hpt mode) or 1G (radix mode)"
+  },
+  {,
     "EventCode": "0x2084",
     "EventName": "PM_FLUSH_HB_RESTORE_CYC",
     "BriefDescription": "Cycles in which no new instructions can be dispatched to the ICT after a flush.  History buffer recovery"
@@ -107,12 +112,12 @@
   {,
     "EventCode": "0x360B2",
     "EventName": "PM_L3_GRP_GUESS_WRONG_LOW",
-    "BriefDescription": "Initial scope=group (GS or NNS) but data from outside group (far or rem). Prediction too Low"
+    "BriefDescription": "Prefetch scope predictor selected GS or NNS, but was wrong because scope was LNS"
   },
   {,
     "EventCode": "0x168A6",
     "EventName": "PM_TM_CAM_OVERFLOW",
-    "BriefDescription": "L3 TM cam overflow during L2 co of SC"
+    "BriefDescription": "L3 TM CAM is full when a L2 castout of TM_SC line occurs.  Line is pushed to memory"
   },
   {,
     "EventCode": "0xE8B0",
@@ -150,11 +155,6 @@
     "BriefDescription": "All ISU rejects"
   },
   {,
-    "EventCode": "0x460A6",
-    "EventName": "PM_RD_FORMING_SC",
-    "BriefDescription": "Read forming SC"
-  },
-  {,
     "EventCode": "0x468A0",
     "EventName": "PM_L3_PF_OFF_CHIP_MEM",
     "BriefDescription": "L3 PF from Off chip memory"
@@ -187,7 +187,7 @@
   {,
     "EventCode": "0x368A6",
     "EventName": "PM_SNP_TM_HIT_T",
-    "BriefDescription": "Snp TM sthit T/Tn/Te"
+    "BriefDescription": "TM snoop that is a store hits line in L3 in T, Tn or Te state (shared modified)"
   },
   {,
     "EventCode": "0x3001A",
@@ -205,6 +205,11 @@
     "BriefDescription": "Duration in cycles to reload with Modified (M) data from another core's ECO L3 on the same chip due to a marked load"
   },
   {,
+    "EventCode": "0xF0B4",
+    "EventName": "PM_DC_PREF_CONS_ALLOC",
+    "BriefDescription": "Prefetch stream allocated in the conservative phase by either the hardware prefetch mechanism or software prefetch. The sum of this pair subtracted from the total number of allocs will give the total allocs in normal phase"
+  },
+  {,
     "EventCode": "0xF894",
     "EventName": "PM_LSU3_L1_CAM_CANCEL",
     "BriefDescription": "ls3 l1 tm cam cancel"
@@ -227,7 +232,12 @@
   {,
     "EventCode": "0x468A6",
     "EventName": "PM_RD_CLEARING_SC",
-    "BriefDescription": "Read clearing SC"
+    "BriefDescription": "Core TM load hits line in L3 in TM_SC state and causes it to be invalidated"
+  },
+  {,
+    "EventCode": "0xD0B0",
+    "EventName": "PM_HWSYNC",
+    "BriefDescription": ""
   },
   {,
     "EventCode": "0x168B0",
@@ -265,6 +275,11 @@
     "BriefDescription": "Prefetch stream allocated by the hardware prefetch mechanism"
   },
   {,
+    "EventCode": "0xF0BC",
+    "EventName": "PM_LS2_UNALIGNED_ST",
+    "BriefDescription": "Store instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the Store of that size.  If the Store wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
     "EventCode": "0xD0AC",
     "EventName": "PM_SRQ_SYNC_CYC",
     "BriefDescription": "A sync is in the S2Q (edge detect to count)"
@@ -275,6 +290,11 @@
     "BriefDescription": "Marked instruction was reloaded from a location beyond the local chiplet"
   },
   {,
+    "EventCode": "0x58A8",
+    "EventName": "PM_DECODE_HOLD_ICT_FULL",
+    "BriefDescription": "Counts the number of cycles in which the IFU was not able to decode and transmit one or more instructions because all itags were in use.  This means the ICT is full for this thread"
+  },
+  {,
     "EventCode": "0x26082",
     "EventName": "PM_L2_IC_INV",
     "BriefDescription": "I-cache Invalidates sent over the realod bus to the core"
@@ -365,6 +385,16 @@
     "BriefDescription": "Duration in cycles to reload either shared or modified data from another core's L2/L3 on a different chip (remote or distant) due to a marked load"
   },
   {,
+    "EventCode": "0xF888",
+    "EventName": "PM_LSU1_STORE_REJECT",
+    "BriefDescription": "All internal store rejects cause the instruction to go back to the SRQ and go to sleep until woken up to try again after the condition has been met"
+  },
+  {,
+    "EventCode": "0xC098",
+    "EventName": "PM_LS2_UNALIGNED_LD",
+    "BriefDescription": "Load instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the load of that size.  If the load wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
     "EventCode": "0x20058",
     "EventName": "PM_DARQ1_10_12_ENTRIES",
     "BriefDescription": "Cycles in which 10 or  more DARQ1 entries (out of 12) are in use"
@@ -372,7 +402,7 @@
   {,
     "EventCode": "0x360A6",
     "EventName": "PM_SNP_TM_HIT_M",
-    "BriefDescription": "Snp TM st hit M/Mu"
+    "BriefDescription": "TM snoop that is a store hits line in L3 in M or Mu state (exclusive modified)"
   },
   {,
     "EventCode": "0x5898",
@@ -395,9 +425,9 @@
     "BriefDescription": "A data line was written to the L1 due to a hardware or software prefetch"
   },
   {,
-    "EventCode": "0xF888",
-    "EventName": "PM_LSU1_STORE_REJECT",
-    "BriefDescription": "All internal store rejects cause the instruction to go back to the SRQ and go to sleep until woken up to try again after the condition has been met"
+    "EventCode": "0x2608E",
+    "EventName": "PM_TM_LD_CONF",
+    "BriefDescription": "TM Load (fav or non-fav) ran into conflict (failed)"
   },
   {,
     "EventCode": "0x1D144",
@@ -422,7 +452,7 @@
   {,
     "EventCode": "0x26884",
     "EventName": "PM_DSIDE_MRU_TOUCH",
-    "BriefDescription": "D-side L2 MRU touch sent to L2"
+    "BriefDescription": "D-side L2 MRU touch commands sent to the L2"
   },
   {,
     "EventCode": "0x30134",
@@ -440,6 +470,16 @@
     "BriefDescription": "XL-form branch was mispredicted due to the predicted target address missing from EAT.  The EAT forces a mispredict in this case since there is no predicated target to validate.  This is a rare case that may occur when the EAT is full and a branch is issued"
   },
   {,
+    "EventCode": "0xC094",
+    "EventName": "PM_LS0_UNALIGNED_LD",
+    "BriefDescription": "Load instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the load of that size.  If the load wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
+    "EventCode": "0xF8BC",
+    "EventName": "PM_LS3_UNALIGNED_ST",
+    "BriefDescription": "Store instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the Store of that size.  If the Store wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
     "EventCode": "0x460AE",
     "EventName": "PM_L3_P2_CO_RTY",
     "BriefDescription": "L3 CO received retry port 2 (memory only), every retry counted"
@@ -492,7 +532,7 @@
   {,
     "EventCode": "0xC880",
     "EventName": "PM_LS1_LD_VECTOR_FIN",
-    "BriefDescription": ""
+    "BriefDescription": "LS1 finished load vector op"
   },
   {,
     "EventCode": "0x2894",
@@ -515,6 +555,11 @@
     "BriefDescription": "Marked derat reload (miss) for any page size"
   },
   {,
+    "EventCode": "0x160A0",
+    "EventName": "PM_L3_PF_MISS_L3",
+    "BriefDescription": "L3 PF missed in L3"
+  },
+  {,
     "EventCode": "0x1C04A",
     "EventName": "PM_DATA_FROM_RL2L3_SHR",
     "BriefDescription": "The processor's data cache was reloaded with Shared (S) data from another chip's L2 or L3 on the same Node or Group (Remote), as this chip due to a demand load"
@@ -565,11 +610,21 @@
     "BriefDescription": "L2 guess local (LNS) and guess was not correct (ie data not on chip)"
   },
   {,
+    "EventCode": "0xC888",
+    "EventName": "PM_LSU_DTLB_MISS_64K",
+    "BriefDescription": "Data TLB Miss page size 64K"
+  },
+  {,
     "EventCode": "0xE0A4",
     "EventName": "PM_TMA_REQ_L2",
     "BriefDescription": "addrs only req to L2 only on the first one,Indication that Load footprint is not expanding"
   },
   {,
+    "EventCode": "0xC088",
+    "EventName": "PM_LSU_DTLB_MISS_4K",
+    "BriefDescription": "Data TLB Miss page size 4K"
+  },
+  {,
     "EventCode": "0x3C042",
     "EventName": "PM_DATA_FROM_L3_DISP_CONFLICT",
     "BriefDescription": "The processor's data cache was reloaded from local core's L3 with dispatch conflict due to a demand load"
@@ -602,7 +657,7 @@
   {,
     "EventCode": "0x26084",
     "EventName": "PM_L2_RCLD_DISP_FAIL_OTHER",
-    "BriefDescription": "All I-or-D side load dispatch attempts for this thread that failed due to reason other than address collision (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All D-side-Ld or I-side-instruction-fetch dispatch attempts for this thread that failed due to reasons other than an address collision conflicts with an L2 machines (e.g. Read-Claim/Snoop machine not available)"
   },
   {,
     "EventCode": "0x101E4",
@@ -647,12 +702,12 @@
   {,
     "EventCode": "0x46080",
     "EventName": "PM_L2_DISP_ALL_L2MISS",
-    "BriefDescription": "All successful Ld/St dispatches for this thread that were an L2 miss (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All successful D-side-Ld/St or I-side-instruction-fetch dispatches for this thread that were an L2 miss"
   },
   {,
-    "EventCode": "0x160A0",
-    "EventName": "PM_L3_PF_MISS_L3",
-    "BriefDescription": "L3 PF missed in L3"
+    "EventCode": "0xF8B8",
+    "EventName": "PM_LS1_UNALIGNED_ST",
+    "BriefDescription": "Store instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the Store of that size.  If the Store wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
   },
   {,
     "EventCode": "0x408C",
@@ -667,7 +722,7 @@
   {,
     "EventCode": "0x160B2",
     "EventName": "PM_L3_LOC_GUESS_CORRECT",
-    "BriefDescription": "initial scope=node/chip (LNS) and data from local node (local) (pred successful) - always PFs only"
+    "BriefDescription": "Prefetch scope predictor selected LNS and was correct"
   },
   {,
     "EventCode": "0x48B4",
@@ -767,7 +822,7 @@
   {,
     "EventCode": "0x36082",
     "EventName": "PM_L2_LD_DISP",
-    "BriefDescription": "All successful I-or-D side load dispatches for this thread (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All successful D-side-Ld or I-side-instruction-fetch dispatches for this thread"
   },
   {,
     "EventCode": "0xF8B0",
@@ -787,7 +842,7 @@
   {,
     "EventCode": "0x16884",
     "EventName": "PM_L2_RCLD_DISP_FAIL_ADDR",
-    "BriefDescription": "All I-od-D side load dispatch attempts for this thread that failed due to address collision with RC/CO/SN/SQ machine (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All D-side-Ld or I-side-instruction-fetch dispatch attempts for this thread that failed due to an address collision conflicts with an L2 machines already working on this line (e.g. ld-hit-stq or Read-claim/Castout/Snoop machines)"
   },
   {,
     "EventCode": "0x460A0",
@@ -830,6 +885,11 @@
     "BriefDescription": "Instruction prefetch requests"
   },
   {,
+    "EventCode": "0xC898",
+    "EventName": "PM_LS3_UNALIGNED_LD",
+    "BriefDescription": "Load instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the load of that size.  If the load wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
     "EventCode": "0x488C",
     "EventName": "PM_IC_PREF_WRITE",
     "BriefDescription": "Instruction prefetch written into IL1"
@@ -837,7 +897,7 @@
   {,
     "EventCode": "0xF89C",
     "EventName": "PM_XLATE_MISS",
-    "BriefDescription": "The LSU requested a line from L2 for translation.  It may be satisfied from any source beyond L2.  Includes speculative instructions"
+    "BriefDescription": "The LSU requested a line from L2 for translation.  It may be satisfied from any source beyond L2.  Includes speculative instructions. Includes instruction, prefetch and demand"
   },
   {,
     "EventCode": "0x14158",
@@ -850,9 +910,14 @@
     "BriefDescription": "Duration in cycles to reload with Shared (S) data from another core's L3 on the same chip due to a marked load"
   },
   {,
+    "EventCode": "0xC88C",
+    "EventName": "PM_LSU_DTLB_MISS_16G_1G",
+    "BriefDescription": "Data TLB Miss page size 16G (HPT) or 1G (Radix)"
+  },
+  {,
     "EventCode": "0x268A6",
     "EventName": "PM_TM_RST_SC",
-    "BriefDescription": "TM-snp rst RM SC"
+    "BriefDescription": "TM snoop hits line in L3 that is TM_SC state and causes it to be invalidated"
   },
   {,
     "EventCode": "0x468A4",
@@ -917,7 +982,7 @@
   {,
     "EventCode": "0x46086",
     "EventName": "PM_L2_SN_M_RD_DONE",
-    "BriefDescription": "SNP dispatched for a read and was M (true M)"
+    "BriefDescription": "Snoop dispatched for a read and was M (true M)"
   },
   {,
     "EventCode": "0x40154",
@@ -980,14 +1045,9 @@
     "BriefDescription": "Link stack predicts right address"
   },
   {,
-    "EventCode": "0x4C05A",
-    "EventName": "PM_DTLB_MISS_1G",
-    "BriefDescription": "Data TLB reload (after a miss) page size 1G. Implies radix translation was used"
-  },
-  {,
     "EventCode": "0x36886",
     "EventName": "PM_L2_SN_SX_I_DONE",
-    "BriefDescription": "SNP dispatched and went from Sx to Ix"
+    "BriefDescription": "Snoop dispatched and went from Sx to Ix"
   },
   {,
     "EventCode": "0x4E04A",
@@ -1000,11 +1060,6 @@
     "BriefDescription": "Duration in cycles to reload from another chip's L4 on a different Node or Group (Distant) due to a marked load"
   },
   {,
-    "EventCode": "0x2608E",
-    "EventName": "PM_TM_LD_CONF",
-    "BriefDescription": "TM Load (fav or non-fav) ran into conflict (failed)"
-  },
-  {,
     "EventCode": "0x4080",
     "EventName": "PM_INST_FROM_L1",
     "BriefDescription": "Instruction fetches from L1.  L1 instruction hit"
@@ -1037,7 +1092,7 @@
   {,
     "EventCode": "0x260A6",
     "EventName": "PM_NON_TM_RST_SC",
-    "BriefDescription": "Non-TM snp rst TM SC"
+    "BriefDescription": "Non-TM snoop hits line in L3 that is TM_SC state and causes it to be invalidated"
   },
   {,
     "EventCode": "0x3608A",
@@ -1065,11 +1120,6 @@
     "BriefDescription": "Branch mispredict flushes.  Includes target and address misprecition"
   },
   {,
-    "EventCode": "0x508C",
-    "EventName": "PM_SHL_CREATED",
-    "BriefDescription": "Store-Hit-Load Table Entry Created"
-  },
-  {,
     "EventCode": "0x1504C",
     "EventName": "PM_IPTEG_FROM_LL4",
     "BriefDescription": "A Page Table Entry was loaded into the TLB from the local chip's L4 cache due to a instruction side request"
@@ -1107,7 +1157,7 @@
   {,
     "EventCode": "0x2608A",
     "EventName": "PM_ISIDE_DISP_FAIL_ADDR",
-    "BriefDescription": "All I-side dispatch attempts for this thread that failed due to a addr collision with another machine (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All I-side-instruction-fetch dispatch attempts for this thread that failed due to an address collision conflict with an L2 machine already working on this line (e.g. ld-hit-stq or RC/CO/SN machines)"
   },
   {,
     "EventCode": "0x50B4",
@@ -1180,9 +1230,9 @@
     "BriefDescription": "Number of stcx instructions finished. This includes instructions in the speculative path of a branch that may be flushed"
   },
   {,
-    "EventCode": "0xE0B8",
-    "EventName": "PM_LS2_TM_DISALLOW",
-    "BriefDescription": "A TM-ineligible instruction tries to execute inside a transaction and the LSU disallows it"
+    "EventCode": "0xD8AC",
+    "EventName": "PM_LWSYNC",
+    "BriefDescription": ""
   },
   {,
     "EventCode": "0x2094",
@@ -1210,6 +1260,11 @@
     "BriefDescription": "Ict empty for this thread due to dispatch holds because the History Buffer was full. Could be GPR/VSR/VMR/FPR/CR/XVF; CR; XVF (XER/VSCR/FPSCR)"
   },
   {,
+    "EventCode": "0xC894",
+    "EventName": "PM_LS1_UNALIGNED_LD",
+    "BriefDescription": "Load instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the load of that size.  If the load wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
     "EventCode": "0x360A2",
     "EventName": "PM_L3_L2_CO_HIT",
     "BriefDescription": "L2 CO hits"
@@ -1292,7 +1347,7 @@
   {,
     "EventCode": "0xC084",
     "EventName": "PM_LS2_LD_VECTOR_FIN",
-    "BriefDescription": ""
+    "BriefDescription": "LS2 finished load vector op"
   },
   {,
     "EventCode": "0x1608E",
@@ -1345,6 +1400,11 @@
     "BriefDescription": "Continuous 16 cycle (2to1) window where this signals rotates thru sampling each SN machine busy. PMU uses this wave to then do 16 cyc count to sample total number of machs running"
   },
   {,
+    "EventCode": "0x36084",
+    "EventName": "PM_L2_RCST_DISP",
+    "BriefDescription": "All D-side store dispatch attempts for this thread"
+  },
+  {,
     "EventCode": "0x46084",
     "EventName": "PM_L2_RCST_DISP_FAIL_OTHER",
     "BriefDescription": "All D-side store dispatch attempts for this thread that failed due to reason other than address collision"
@@ -1355,11 +1415,6 @@
     "BriefDescription": "A demand load referenced a line in an active strided prefetch stream. The stream could have been allocated through the hardware prefetch mechanism or through software."
   },
   {,
-    "EventCode": "0x36084",
-    "EventName": "PM_L2_RCST_DISP",
-    "BriefDescription": "All D-side store dispatch attempts for this thread"
-  },
-  {,
     "EventCode": "0x45054",
     "EventName": "PM_FMA_CMPL",
     "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only. "
@@ -1372,7 +1427,7 @@
   {,
     "EventCode": "0x36080",
     "EventName": "PM_L2_INST",
-    "BriefDescription": "All successful I-side dispatches for this thread   (excludes i_l2mru_tch reqs)"
+    "BriefDescription": "All successful I-side-instruction-fetch (e.g. i-demand, i-prefetch) dispatches for this thread"
   },
   {,
     "EventCode": "0x3504C",
@@ -1387,7 +1442,7 @@
   {,
     "EventCode": "0x1688A",
     "EventName": "PM_ISIDE_DISP",
-    "BriefDescription": "All I-side dispatch attempts for this thread (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All I-side-instruction-fetch dispatch attempts for this thread"
   },
   {,
     "EventCode": "0x468AA",
@@ -1420,6 +1475,11 @@
     "BriefDescription": "Load tm hit in L1"
   },
   {,
+    "EventCode": "0xE0B8",
+    "EventName": "PM_LS2_TM_DISALLOW",
+    "BriefDescription": "A TM-ineligible instruction tries to execute inside a transaction and the LSU disallows it"
+  },
+  {,
     "EventCode": "0x44044",
     "EventName": "PM_INST_FROM_L31_ECO_MOD",
     "BriefDescription": "The processor's Instruction cache was reloaded with Modified (M) data from another core's ECO L3 on the same chip due to an instruction fetch (not prefetch)"
@@ -1467,7 +1527,7 @@
   {,
     "EventCode": "0x36086",
     "EventName": "PM_L2_RC_ST_DONE",
-    "BriefDescription": "RC did store to line that was Tx or Sx"
+    "BriefDescription": "Read-claim machine did store to line that was in Tx or Sx (Tagged or Shared state)"
   },
   {,
     "EventCode": "0xE8AC",
@@ -1500,6 +1560,11 @@
     "BriefDescription": "A Page Table Entry was loaded into the TLB from local core's L2 without conflict due to a instruction side request"
   },
   {,
+    "EventCode": "0x460A6",
+    "EventName": "PM_RD_FORMING_SC",
+    "BriefDescription": "Doesn't occur"
+  },
+  {,
     "EventCode": "0x35042",
     "EventName": "PM_IPTEG_FROM_L3_DISP_CONFLICT",
     "BriefDescription": "A Page Table Entry was loaded into the TLB from local core's L3 with dispatch conflict due to a instruction side request"
@@ -1527,7 +1592,7 @@
   {,
     "EventCode": "0x36882",
     "EventName": "PM_L2_LD_HIT",
-    "BriefDescription": "All successful I-or-D side load dispatches for this thread that were L2 hits (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All successful D-side-Ld or I-side-instruction-fetch dispatches for this thread that were L2 hits"
   },
   {,
     "EventCode": "0x168AC",
@@ -1555,11 +1620,6 @@
     "BriefDescription": "ProbeNops dispatched"
   },
   {,
-    "EventCode": "0x58A8",
-    "EventName": "PM_DECODE_HOLD_ICT_FULL",
-    "BriefDescription": "Counts the number of cycles in which the IFU was not able to decode and transmit one or more instructions because all itags were in use.  This means the ICT is full for this thread"
-  },
-  {,
     "EventCode": "0x10052",
     "EventName": "PM_GRP_PUMP_MPRED_RTY",
     "BriefDescription": "Final Pump Scope (Group) ended up larger than Initial Pump Scope (Chip) for all data types excluding data prefetch (demand load,inst prefetch,inst fetch,xlate)"
@@ -1572,7 +1632,7 @@
   {,
     "EventCode": "0x2688A",
     "EventName": "PM_ISIDE_DISP_FAIL_OTHER",
-    "BriefDescription": "All I-side dispatch attempts for this thread that failed due to a reason other than addrs collision (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All I-side-instruction-fetch dispatch attempts for this thread that failed due to reasons other than an address collision conflict with an L2 machine (e.g. no available RC/CO machines)"
   },
   {,
     "EventCode": "0x2001A",
@@ -1652,12 +1712,12 @@
   {,
     "EventCode": "0x46880",
     "EventName": "PM_ISIDE_MRU_TOUCH",
-    "BriefDescription": "I-side L2 MRU touch sent to L2 for this thread"
+    "BriefDescription": "I-side L2 MRU touch sent to L2 for this thread I-side L2 MRU touch commands sent to the L2 for this thread"
   },
   {,
-    "EventCode": "0x1C05C",
-    "EventName": "PM_DTLB_MISS_2M",
-    "BriefDescription": "Data TLB reload (after a miss) page size 2M. Implies radix translation was used"
+    "EventCode": "0x508C",
+    "EventName": "PM_SHL_CREATED",
+    "BriefDescription": "Store-Hit-Load Table Entry Created"
   },
   {,
     "EventCode": "0x50B8",
@@ -1672,7 +1732,7 @@
   {,
     "EventCode": "0x268B2",
     "EventName": "PM_L3_LOC_GUESS_WRONG",
-    "BriefDescription": "Initial scope=node (LNS) but data from out side local node (near or far or rem). Prediction too Low"
+    "BriefDescription": "Prefetch scope predictor selected LNS, but was wrong"
   },
   {,
     "EventCode": "0x36088",
@@ -1685,6 +1745,11 @@
     "BriefDescription": "L3 PF received retry port 2, every retry counted"
   },
   {,
+    "EventCode": "0xD8B0",
+    "EventName": "PM_PTESYNC",
+    "BriefDescription": ""
+  },
+  {,
     "EventCode": "0x26086",
     "EventName": "PM_CO_TM_SC_FOOTPRINT",
     "BriefDescription": "L2 did a cleanifdirty CO to the L3 (ie created an SC line in the L3) OR L2 TM_store hit dirty HPC line and L3 indicated SC line formed in L3 on RDR bus"
@@ -1740,6 +1805,11 @@
     "BriefDescription": "All successful D-Side Store dispatches that were an L2 miss for this thread"
   },
   {,
+    "EventCode": "0xF8B4",
+    "EventName": "PM_DC_PREF_XCONS_ALLOC",
+    "BriefDescription": "Prefetch stream allocated in the Ultra conservative phase by either the hardware prefetch mechanism or software prefetch"
+  },
+  {,
     "EventCode": "0x35048",
     "EventName": "PM_IPTEG_FROM_DL2L3_SHR",
     "BriefDescription": "A Page Table Entry was loaded into the TLB with Shared (S) data from another chip's L2 or L3 on a different Node or Group (Distant), as this chip due to a instruction side request"
@@ -1782,7 +1852,7 @@
   {,
     "EventCode": "0x460B2",
     "EventName": "PM_L3_SYS_GUESS_WRONG",
-    "BriefDescription": "Initial scope=system (VGS or RNS) but data from local or near. Prediction too high"
+    "BriefDescription": "Prefetch scope predictor selected VGS or RNS, but was wrong"
   },
   {,
     "EventCode": "0x58B8",
@@ -1800,11 +1870,6 @@
     "BriefDescription": "Completion time tabortnoncd, tabortcd, treclaim"
   },
   {,
-    "EventCode": "0x4C054",
-    "EventName": "PM_DERAT_MISS_16G",
-    "BriefDescription": "Data ERAT Miss (Data TLB Access) page size 16G"
-  },
-  {,
     "EventCode": "0x268A0",
     "EventName": "PM_L3_CO_L31",
     "BriefDescription": "L3 CO to L3.1 OR of port 0 and 1 (lossy = may undercount if two cresps come in the same cyc)"
@@ -1862,7 +1927,7 @@
   {,
     "EventCode": "0x368B2",
     "EventName": "PM_L3_GRP_GUESS_WRONG_HIGH",
-    "BriefDescription": "Initial scope=group (GS or NNS) but data from local node. Prediction too high"
+    "BriefDescription": "Prefetch scope predictor selected GS or NNS, but was wrong because scope was VGS or RNS"
   },
   {,
     "EventCode": "0xE8BC",
@@ -1897,7 +1962,7 @@
   {,
     "EventCode": "0x260B2",
     "EventName": "PM_L3_SYS_GUESS_CORRECT",
-    "BriefDescription": "Initial scope=system (VGS or RNS) and data from outside group (far or rem)(pred successful)"
+    "BriefDescription": "Prefetch scope predictor selected VGS or RNS and was correct"
   },
   {,
     "EventCode": "0x1D146",
@@ -1915,6 +1980,11 @@
     "BriefDescription": "RC requests that were on group (aka nodel) pump attempts"
   },
   {,
+    "EventCode": "0xC08C",
+    "EventName": "PM_LSU_DTLB_MISS_16M_2M",
+    "BriefDescription": "Data TLB Miss page size 16M (HPT) or 2M (Radix)"
+  },
+  {,
     "EventCode": "0x16080",
     "EventName": "PM_L2_LD",
     "BriefDescription": "All successful D-side Load dispatches for this thread (L2 miss + L2 hits)"
@@ -1927,7 +1997,7 @@
   {,
     "EventCode": "0xC080",
     "EventName": "PM_LS0_LD_VECTOR_FIN",
-    "BriefDescription": ""
+    "BriefDescription": "LS0 finished load vector op"
   },
   {,
     "EventCode": "0x368B0",
@@ -2000,6 +2070,11 @@
     "BriefDescription": "Conditional Branch Completed in which the HW correctly predicted the direction as taken.  Counted at completion time"
   },
   {,
+    "EventCode": "0xF0B8",
+    "EventName": "PM_LS0_UNALIGNED_ST",
+    "BriefDescription": "Store instructions whose data crosses a double-word boundary, which causes it to require an additional slice than than what normally would be required of the Store of that size.  If the Store wraps from slice 3 to slice 0, thee is an additional 3-cycle penalty"
+  },
+  {,
     "EventCode": "0x20132",
     "EventName": "PM_MRK_DFU_FIN",
     "BriefDescription": "Decimal Unit marked Instruction Finish"
@@ -2007,7 +2082,7 @@
   {,
     "EventCode": "0x160A6",
     "EventName": "PM_TM_SC_CO",
-    "BriefDescription": "L3 castout TM SC line"
+    "BriefDescription": "L3 castout of line that was StoreCopy (original value of speculatively written line) in a Transaction"
   },
   {,
     "EventCode": "0xC8B0",
@@ -2017,7 +2092,7 @@
   {,
     "EventCode": "0x16084",
     "EventName": "PM_L2_RCLD_DISP",
-    "BriefDescription": "All I-or-D side load dispatch attempts for this thread (excludes i_l2mru_tch_reqs)"
+    "BriefDescription": "All D-side-Ld or I-side-instruction-fetch dispatch attempts for this thread"
   },
   {,
     "EventCode": "0x3F150",
@@ -2122,12 +2197,12 @@
   {,
     "EventCode": "0x46082",
     "EventName": "PM_L2_ST_DISP",
-    "BriefDescription": "All successful D-side store dispatches for this thread (L2 miss + L2 hits)"
+    "BriefDescription": "All successful D-side store dispatches for this thread"
   },
   {,
     "EventCode": "0x36880",
     "EventName": "PM_L2_INST_MISS",
-    "BriefDescription": "All successful I-side dispatches that were an L2 miss for this thread (excludes i_l2mru_tch reqs)"
+    "BriefDescription": "All successful I-side-instruction-fetch (e.g. i-demand, i-prefetch) dispatches for this thread that were an L2 miss"
   },
   {,
     "EventCode": "0xE084",
@@ -2217,7 +2292,7 @@
   {,
     "EventCode": "0xC884",
     "EventName": "PM_LS3_LD_VECTOR_FIN",
-    "BriefDescription": ""
+    "BriefDescription": "LS3 finished load vector op"
   },
   {,
     "EventCode": "0x360A8",
@@ -2242,7 +2317,7 @@
   {,
     "EventCode": "0x168B2",
     "EventName": "PM_L3_GRP_GUESS_CORRECT",
-    "BriefDescription": "Initial scope=group (GS or NNS) and data from same group (near) (pred successful)"
+    "BriefDescription": "Prefetch scope predictor selected GS or NNS and was correct"
   },
   {,
     "EventCode": "0x48A4",
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
index 5af1abbe82c4..b4772f54a271 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
@@ -65,11 +65,6 @@
     "BriefDescription": "Dispatch Held"
   },
   {,
-    "EventCode": "0x3D154",
-    "EventName": "PM_MRK_DERAT_MISS_16M",
-    "BriefDescription": "Marked Data ERAT Miss (Data TLB Access) page size 16M"
-  },
-  {,
     "EventCode": "0x200F8",
     "EventName": "PM_EXT_INT",
     "BriefDescription": "external interrupt"
@@ -120,6 +115,11 @@
     "BriefDescription": "A Page Table Entry was loaded into the TLB from local core's L3 without dispatch conflicts hit on Mepf state. due to a marked data side request. When using Radix Page Translation, this count excludes PDE reloads. Only PTE reloads are included"
   },
   {,
+    "EventCode": "0x4C15C",
+    "EventName": "PM_MRK_DERAT_MISS_16G_1G",
+    "BriefDescription": "Marked Data ERAT Miss (Data TLB Access) page size 16G (hpt mode) and 1G (radix mode)"
+  },
+  {,
     "EventCode": "0x10024",
     "EventName": "PM_PMC5_OVERFLOW",
     "BriefDescription": "Overflow from counter 5"
@@ -155,11 +155,6 @@
     "BriefDescription": "Ict empty for this thread due to Icache Miss"
   },
   {,
-    "EventCode": "0x3D152",
-    "EventName": "PM_MRK_DERAT_MISS_1G",
-    "BriefDescription": "Marked Data ERAT Miss (Data TLB Access) page size 1G. Implies radix translation"
-  },
-  {,
     "EventCode": "0x4F14A",
     "EventName": "PM_MRK_DPTEG_FROM_OFF_CHIP_CACHE",
     "BriefDescription": "A Page Table Entry was loaded into the TLB either shared or modified data from another core's L2/L3 on a different chip (remote or distant) due to a marked data side request. When using Radix Page Translation, this count excludes PDE reloads. Only PTE reloads are included"
@@ -185,11 +180,6 @@
     "BriefDescription": "A Page Table Entry was loaded into the TLB from local core's L2 without conflict due to a marked data side request. When using Radix Page Translation, this count excludes PDE reloads. Only PTE reloads are included"
   },
   {,
-    "EventCode": "0x2C05A",
-    "EventName": "PM_DERAT_MISS_1G",
-    "BriefDescription": "Data ERAT Miss (Data TLB Access) page size 1G. Implies radix translation"
-  },
-  {,
     "EventCode": "0x1F058",
     "EventName": "PM_RADIX_PWC_L2_PTE_FROM_L2",
     "BriefDescription": "A Page Table Entry was reloaded to a level 2 page walk cache from the core's L2 data cache. This implies that level 3 and level 4 PWC accesses were not necessary for this translation"
@@ -240,11 +230,6 @@
     "BriefDescription": "Data PTEG reload"
   },
   {,
-    "EventCode": "0x2D152",
-    "EventName": "PM_MRK_DERAT_MISS_2M",
-    "BriefDescription": "Marked Data ERAT Miss (Data TLB Access) page size 2M. Implies radix translation"
-  },
-  {,
     "EventCode": "0x2C046",
     "EventName": "PM_DATA_FROM_RL2L3_MOD",
     "BriefDescription": "The processor's data cache was reloaded with Modified (M) data from another chip's L2 or L3 on the same Node or Group (Remote), as this chip due to a demand load"
@@ -290,6 +275,11 @@
     "BriefDescription": "Finish stall because the NTF instruction was issued to the Decimal Floating Point execution pipe and waiting to finish. Includes decimal floating point instructions + 128 bit binary floating point instructions. Not qualified by multicycle"
   },
   {,
+    "EventCode": "0x3C054",
+    "EventName": "PM_DERAT_MISS_16M_2M",
+    "BriefDescription": "Data ERAT Miss (Data TLB Access) page size 16M (HPT mode) or 2M (Radix mode)"
+  },
+  {,
     "EventCode": "0x4C04C",
     "EventName": "PM_DATA_FROM_DMEM",
     "BriefDescription": "The processor's data cache was reloaded from another chip's memory on the same Node or Group (Distant) due to a demand load"
@@ -360,11 +350,6 @@
     "BriefDescription": "The processor's Instruction cache was reloaded from a memory location including L4 from local remote or distant due to an instruction fetch (not prefetch)"
   },
   {,
-    "EventCode": "0x1C05A",
-    "EventName": "PM_DERAT_MISS_2M",
-    "BriefDescription": "Data ERAT Miss (Data TLB Access) page size 2M. Implies radix translation"
-  },
-  {,
     "EventCode": "0x30024",
     "EventName": "PM_PMC6_OVERFLOW",
     "BriefDescription": "Overflow from counter 6"
@@ -375,6 +360,11 @@
     "BriefDescription": "Branch Instruction Finished"
   },
   {,
+    "EventCode": "0x3D154",
+    "EventName": "PM_MRK_DERAT_MISS_16M_2M",
+    "BriefDescription": "Marked Data ERAT Miss (Data TLB Access) page size 16M (hpt mode) or 2M (radix mode)"
+  },
+  {,
     "EventCode": "0x30020",
     "EventName": "PM_PMC2_REWIND",
     "BriefDescription": "PMC2 Rewind Event (did not match condition)"
@@ -410,11 +400,6 @@
     "BriefDescription": "A Page Table Entry was loaded into the TLB with Modified (M) data from another core's L3 on the same chip due to a marked data side request. When using Radix Page Translation, this count excludes PDE reloads. Only PTE reloads are included"
   },
   {,
-    "EventCode": "0x4C15C",
-    "EventName": "PM_MRK_DERAT_MISS_16G",
-    "BriefDescription": "Marked Data ERAT Miss (Data TLB Access) page size 16G"
-  },
-  {,
     "EventCode": "0x14052",
     "EventName": "PM_INST_GRP_PUMP_MPRED_RTY",
     "BriefDescription": "Final Pump Scope (Group) ended up larger than Initial Pump Scope (Chip) for an instruction fetch"
@@ -445,11 +430,6 @@
     "BriefDescription": "Icache miss demand cycles"
   },
   {,
-    "EventCode": "0x3C054",
-    "EventName": "PM_DERAT_MISS_16M",
-    "BriefDescription": "Data ERAT Miss (Data TLB Access) page size 16M"
-  },
-  {,
     "EventCode": "0x2D14E",
     "EventName": "PM_MRK_DATA_FROM_L21_SHR",
     "BriefDescription": "The processor's data cache was reloaded with Shared (S) data from another core's L2 on the same chip due to a marked load"
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pmc.json b/tools/perf/pmu-events/arch/powerpc/power9/pmc.json
index d0b89f930567..8b3b0f3be664 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/pmc.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/pmc.json
@@ -10,11 +10,6 @@
     "BriefDescription": "Local memory above threshold for LSU medium"
   },
   {,
-    "EventCode": "0x2C056",
-    "EventName": "PM_DTLB_MISS_4K",
-    "BriefDescription": "Data TLB Miss page size 4k"
-  },
-  {,
     "EventCode": "0x40118",
     "EventName": "PM_MRK_DCACHE_RELOAD_INTV",
     "BriefDescription": "Combined Intervention event"
diff --git a/tools/perf/pmu-events/arch/powerpc/power9/translation.json b/tools/perf/pmu-events/arch/powerpc/power9/translation.json
index bc8e03d7a6b0..b27642676244 100644
--- a/tools/perf/pmu-events/arch/powerpc/power9/translation.json
+++ b/tools/perf/pmu-events/arch/powerpc/power9/translation.json
@@ -30,11 +30,6 @@
     "BriefDescription": "Store finish count. Includes speculative activity"
   },
   {,
-    "EventCode": "0x44042",
-    "EventName": "PM_INST_FROM_L3",
-    "BriefDescription": "The processor's Instruction cache was reloaded from local core's L3 due to an instruction fetch (not prefetch)"
-  },
-  {,
     "EventCode": "0x1504A",
     "EventName": "PM_IPTEG_FROM_RL2L3_SHR",
     "BriefDescription": "A Page Table Entry was loaded into the TLB with Shared (S) data from another chip's L2 or L3 on the same Node or Group (Remote), as this chip due to a instruction side request"
@@ -125,6 +120,11 @@
     "BriefDescription": "PMC1 Rewind Value saved"
   },
   {,
+    "EventCode": "0x44042",
+    "EventName": "PM_INST_FROM_L3",
+    "BriefDescription": "The processor's Instruction cache was reloaded from local core's L3 due to an instruction fetch (not prefetch)"
+  },
+  {,
     "EventCode": "0x200FE",
     "EventName": "PM_DATA_FROM_L2MISS",
     "BriefDescription": "Demand LD - L2 Miss (not L2 hit)"
diff --git a/tools/perf/pmu-events/arch/s390/cf_z10/basic.json b/tools/perf/pmu-events/arch/s390/cf_z10/basic.json
new file mode 100644
index 000000000000..8bf16759ca53
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z10/basic.json
@@ -0,0 +1,74 @@
+[
+        {
+                "EventCode": "0",
+                "EventName": "CPU_CYCLES",
+                "BriefDescription": "CPU Cycles",
+                "PublicDescription": "Cycle Count"
+        },
+        {
+                "EventCode": "1",
+                "EventName": "INSTRUCTIONS",
+                "BriefDescription": "Instructions",
+                "PublicDescription": "Instruction Count"
+        },
+        {
+                "EventCode": "2",
+                "EventName": "L1I_DIR_WRITES",
+                "BriefDescription": "L1I Directory Writes",
+                "PublicDescription": "Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "3",
+                "EventName": "L1I_PENALTY_CYCLES",
+                "BriefDescription": "L1I Penalty Cycles",
+                "PublicDescription": "Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "4",
+                "EventName": "L1D_DIR_WRITES",
+                "BriefDescription": "L1D Directory Writes",
+                "PublicDescription": "Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "5",
+                "EventName": "L1D_PENALTY_CYCLES",
+                "BriefDescription": "L1D Penalty Cycles",
+                "PublicDescription": "Level-1 D-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "32",
+                "EventName": "PROBLEM_STATE_CPU_CYCLES",
+                "BriefDescription": "Problem-State CPU Cycles",
+                "PublicDescription": "Problem-State Cycle Count"
+        },
+        {
+                "EventCode": "33",
+                "EventName": "PROBLEM_STATE_INSTRUCTIONS",
+                "BriefDescription": "Problem-State Instructions",
+                "PublicDescription": "Problem-State Instruction Count"
+        },
+        {
+                "EventCode": "34",
+                "EventName": "PROBLEM_STATE_L1I_DIR_WRITES",
+                "BriefDescription": "Problem-State L1I Directory Writes",
+                "PublicDescription": "Problem-State Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "35",
+                "EventName": "PROBLEM_STATE_L1I_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1I Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "36",
+                "EventName": "PROBLEM_STATE_L1D_DIR_WRITES",
+                "BriefDescription": "Problem-State L1D Directory Writes",
+                "PublicDescription": "Problem-State Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "37",
+                "EventName": "PROBLEM_STATE_L1D_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1D Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 D-Cache Penalty Cycle Count"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z10/crypto.json b/tools/perf/pmu-events/arch/s390/cf_z10/crypto.json
new file mode 100644
index 000000000000..7e5b72492141
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z10/crypto.json
@@ -0,0 +1,98 @@
+[
+        {
+                "EventCode": "64",
+                "EventName": "PRNG_FUNCTIONS",
+                "BriefDescription": "PRNG Functions",
+                "PublicDescription": "Total number of the PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "65",
+                "EventName": "PRNG_CYCLES",
+                "BriefDescription": "PRNG Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "66",
+                "EventName": "PRNG_BLOCKED_FUNCTIONS",
+                "BriefDescription": "PRNG Blocked Functions",
+                "PublicDescription": "Total number of the PRNG functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "67",
+                "EventName": "PRNG_BLOCKED_CYCLES",
+                "BriefDescription": "PRNG Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the PRNG functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "68",
+                "EventName": "SHA_FUNCTIONS",
+                "BriefDescription": "SHA Functions",
+                "PublicDescription": "Total number of SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "69",
+                "EventName": "SHA_CYCLES",
+                "BriefDescription": "SHA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the SHA coprocessor is busy performing the SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "70",
+                "EventName": "SHA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "SHA Blocked Functions",
+                "PublicDescription": "Total number of the SHA functions that are issued by the CPU and are blocked because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "71",
+                "EventName": "SHA_BLOCKED_CYCLES",
+                "BriefDescription": "SHA Bloced Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the SHA functions issued by the CPU because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "72",
+                "EventName": "DEA_FUNCTIONS",
+                "BriefDescription": "DEA Functions",
+                "PublicDescription": "Total number of the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "73",
+                "EventName": "DEA_CYCLES",
+                "BriefDescription": "DEA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "74",
+                "EventName": "DEA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "DEA Blocked Functions",
+                "PublicDescription": "Total number of the DEA functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "75",
+                "EventName": "DEA_BLOCKED_CYCLES",
+                "BriefDescription": "DEA Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the DEA functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "76",
+                "EventName": "AES_FUNCTIONS",
+                "BriefDescription": "AES Functions",
+                "PublicDescription": "Total number of AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "77",
+                "EventName": "AES_CYCLES",
+                "BriefDescription": "AES Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "78",
+                "EventName": "AES_BLOCKED_FUNCTIONS",
+                "BriefDescription": "AES Blocked Functions",
+                "PublicDescription": "Total number of AES functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "79",
+                "EventName": "AES_BLOCKED_CYCLES",
+                "BriefDescription": "AES Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the AES functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z10/extended.json b/tools/perf/pmu-events/arch/s390/cf_z10/extended.json
new file mode 100644
index 000000000000..0feedb40f30f
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z10/extended.json
@@ -0,0 +1,110 @@
+[
+        {
+                "EventCode": "128",
+                "EventName": "L1I_L2_SOURCED_WRITES",
+                "BriefDescription": "L1I L2 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from the Level-2 (L1.5) cache"
+        },
+        {
+                "EventCode": "129",
+                "EventName": "L1D_L2_SOURCED_WRITES",
+                "BriefDescription": "L1D L2 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the installed cache line was sourced from the Level-2 (L1.5) cache"
+        },
+        {
+                "EventCode": "130",
+                "EventName": "L1I_L3_LOCAL_WRITES",
+                "BriefDescription": "L1I L3 Local Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the installed cache line was sourced from the Level-3 cache that is on the same book as the Instruction cache (Local L2 cache)"
+        },
+        {
+                "EventCode": "131",
+                "EventName": "L1D_L3_LOCAL_WRITES",
+                "BriefDescription": "L1D L3 Local Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the installtion cache line was source from the Level-3 cache that is on the same book as the Data cache (Local L2 cache)"
+        },
+        {
+                "EventCode": "132",
+                "EventName": "L1I_L3_REMOTE_WRITES",
+                "BriefDescription": "L1I L3 Remote Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the installed cache line was sourced from a Level-3 cache that is not on the same book as the Instruction cache (Remote L2 cache)"
+        },
+        {
+                "EventCode": "133",
+                "EventName": "L1D_L3_REMOTE_WRITES",
+                "BriefDescription": "L1D L3 Remote Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the installed cache line was sourced from a Level-3 cache that is not on the same book as the Data cache (Remote L2 cache)"
+        },
+        {
+                "EventCode": "134",
+                "EventName": "L1D_LMEM_SOURCED_WRITES",
+                "BriefDescription": "L1D Local Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the installed cache line was sourced from memory that is attached to the same book as the Data cache (Local Memory)"
+        },
+        {
+                "EventCode": "135",
+                "EventName": "L1I_LMEM_SOURCED_WRITES",
+                "BriefDescription": "L1I Local Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache where the installed cache line was sourced from memory that is attached to the s ame book as the Instruction cache (Local Memory)"
+        },
+        {
+                "EventCode": "136",
+                "EventName": "L1D_RO_EXCL_WRITES",
+                "BriefDescription": "L1D Read-only Exclusive Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line"
+        },
+        {
+                "EventCode": "137",
+                "EventName": "L1I_CACHELINE_INVALIDATES",
+                "BriefDescription": "L1I Cacheline Invalidates",
+                "PublicDescription": "A cache line in the Level-1 I-Cache has been invalidated by a store on the same CPU as the Level-1 I-Cache"
+        },
+        {
+                "EventCode": "138",
+                "EventName": "ITLB1_WRITES",
+                "BriefDescription": "ITLB1 Writes",
+                "PublicDescription": "A translation entry has been written into the Level-1 Instruction Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "139",
+                "EventName": "DTLB1_WRITES",
+                "BriefDescription": "DTLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "140",
+                "EventName": "TLB2_PTE_WRITES",
+                "BriefDescription": "TLB2 PTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Page Table Entry arrays"
+        },
+        {
+                "EventCode": "141",
+                "EventName": "TLB2_CRSTE_WRITES",
+                "BriefDescription": "TLB2 CRSTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Common Region Segment Table Entry arrays"
+        },
+        {
+                "EventCode": "142",
+                "EventName": "TLB2_CRSTE_HPAGE_WRITES",
+                "BriefDescription": "TLB2 CRSTE One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Common Region Segment Table Entry arrays for a one-megabyte large page translation"
+        },
+        {
+                "EventCode": "145",
+                "EventName": "ITLB1_MISSES",
+                "BriefDescription": "ITLB1 Misses",
+                "PublicDescription": "Level-1 Instruction TLB miss in progress. Incremented by one for every cycle an ITLB1 miss is in progress"
+        },
+        {
+                "EventCode": "146",
+                "EventName": "DTLB1_MISSES",
+                "BriefDescription": "DTLB1 Misses",
+                "PublicDescription": "Level-1 Data TLB miss in progress. Incremented by one for every cycle an DTLB1 miss is in progress"
+        },
+        {
+                "EventCode": "147",
+                "EventName": "L2C_STORES_SENT",
+                "BriefDescription": "L2C Stores Sent",
+                "PublicDescription": "Incremented by one for every store sent to Level-2 (L1.5) cache"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z13/basic.json b/tools/perf/pmu-events/arch/s390/cf_z13/basic.json
new file mode 100644
index 000000000000..8bf16759ca53
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z13/basic.json
@@ -0,0 +1,74 @@
+[
+        {
+                "EventCode": "0",
+                "EventName": "CPU_CYCLES",
+                "BriefDescription": "CPU Cycles",
+                "PublicDescription": "Cycle Count"
+        },
+        {
+                "EventCode": "1",
+                "EventName": "INSTRUCTIONS",
+                "BriefDescription": "Instructions",
+                "PublicDescription": "Instruction Count"
+        },
+        {
+                "EventCode": "2",
+                "EventName": "L1I_DIR_WRITES",
+                "BriefDescription": "L1I Directory Writes",
+                "PublicDescription": "Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "3",
+                "EventName": "L1I_PENALTY_CYCLES",
+                "BriefDescription": "L1I Penalty Cycles",
+                "PublicDescription": "Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "4",
+                "EventName": "L1D_DIR_WRITES",
+                "BriefDescription": "L1D Directory Writes",
+                "PublicDescription": "Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "5",
+                "EventName": "L1D_PENALTY_CYCLES",
+                "BriefDescription": "L1D Penalty Cycles",
+                "PublicDescription": "Level-1 D-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "32",
+                "EventName": "PROBLEM_STATE_CPU_CYCLES",
+                "BriefDescription": "Problem-State CPU Cycles",
+                "PublicDescription": "Problem-State Cycle Count"
+        },
+        {
+                "EventCode": "33",
+                "EventName": "PROBLEM_STATE_INSTRUCTIONS",
+                "BriefDescription": "Problem-State Instructions",
+                "PublicDescription": "Problem-State Instruction Count"
+        },
+        {
+                "EventCode": "34",
+                "EventName": "PROBLEM_STATE_L1I_DIR_WRITES",
+                "BriefDescription": "Problem-State L1I Directory Writes",
+                "PublicDescription": "Problem-State Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "35",
+                "EventName": "PROBLEM_STATE_L1I_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1I Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "36",
+                "EventName": "PROBLEM_STATE_L1D_DIR_WRITES",
+                "BriefDescription": "Problem-State L1D Directory Writes",
+                "PublicDescription": "Problem-State Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "37",
+                "EventName": "PROBLEM_STATE_L1D_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1D Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 D-Cache Penalty Cycle Count"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z13/crypto.json b/tools/perf/pmu-events/arch/s390/cf_z13/crypto.json
new file mode 100644
index 000000000000..7e5b72492141
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z13/crypto.json
@@ -0,0 +1,98 @@
+[
+        {
+                "EventCode": "64",
+                "EventName": "PRNG_FUNCTIONS",
+                "BriefDescription": "PRNG Functions",
+                "PublicDescription": "Total number of the PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "65",
+                "EventName": "PRNG_CYCLES",
+                "BriefDescription": "PRNG Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "66",
+                "EventName": "PRNG_BLOCKED_FUNCTIONS",
+                "BriefDescription": "PRNG Blocked Functions",
+                "PublicDescription": "Total number of the PRNG functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "67",
+                "EventName": "PRNG_BLOCKED_CYCLES",
+                "BriefDescription": "PRNG Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the PRNG functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "68",
+                "EventName": "SHA_FUNCTIONS",
+                "BriefDescription": "SHA Functions",
+                "PublicDescription": "Total number of SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "69",
+                "EventName": "SHA_CYCLES",
+                "BriefDescription": "SHA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the SHA coprocessor is busy performing the SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "70",
+                "EventName": "SHA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "SHA Blocked Functions",
+                "PublicDescription": "Total number of the SHA functions that are issued by the CPU and are blocked because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "71",
+                "EventName": "SHA_BLOCKED_CYCLES",
+                "BriefDescription": "SHA Bloced Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the SHA functions issued by the CPU because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "72",
+                "EventName": "DEA_FUNCTIONS",
+                "BriefDescription": "DEA Functions",
+                "PublicDescription": "Total number of the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "73",
+                "EventName": "DEA_CYCLES",
+                "BriefDescription": "DEA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "74",
+                "EventName": "DEA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "DEA Blocked Functions",
+                "PublicDescription": "Total number of the DEA functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "75",
+                "EventName": "DEA_BLOCKED_CYCLES",
+                "BriefDescription": "DEA Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the DEA functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "76",
+                "EventName": "AES_FUNCTIONS",
+                "BriefDescription": "AES Functions",
+                "PublicDescription": "Total number of AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "77",
+                "EventName": "AES_CYCLES",
+                "BriefDescription": "AES Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "78",
+                "EventName": "AES_BLOCKED_FUNCTIONS",
+                "BriefDescription": "AES Blocked Functions",
+                "PublicDescription": "Total number of AES functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "79",
+                "EventName": "AES_BLOCKED_CYCLES",
+                "BriefDescription": "AES Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the AES functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z13/extended.json b/tools/perf/pmu-events/arch/s390/cf_z13/extended.json
new file mode 100644
index 000000000000..9a002b6967f1
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z13/extended.json
@@ -0,0 +1,338 @@
+[
+        {
+                "EventCode": "128",
+                "EventName": "L1D_RO_EXCL_WRITES",
+                "BriefDescription": "L1D Read-only Exclusive Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line."
+        },
+        {
+                "EventCode": "129",
+                "EventName": "DTLB1_WRITES",
+                "BriefDescription": "DTLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "130",
+                "EventName": "DTLB1_MISSES",
+                "BriefDescription": "DTLB1 Misses",
+                "PublicDescription": "Level-1 Data TLB miss in progress. Incremented by one for every cycle a DTLB1 miss is in progress."
+        },
+        {
+                "EventCode": "131",
+                "EventName": "DTLB1_HPAGE_WRITES",
+                "BriefDescription": "DTLB1 One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer for a one-megabyte page"
+        },
+        {
+                "EventCode": "132",
+                "EventName": "DTLB1_GPAGE_WRITES",
+                "BriefDescription": "DTLB1 Two-Gigabyte Page Writes",
+                "PublicDescription": "Counter:132       Name:DTLB1_GPAGE_WRITES A translation entry has been written to the Level-1 Data Translation Lookaside Buffer for a two-gigabyte page."
+        },
+        {
+                "EventCode": "133",
+                "EventName": "L1D_L2D_SOURCED_WRITES",
+                "BriefDescription": "L1D L2D Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the Level-2 Data cache"
+        },
+        {
+                "EventCode": "134",
+                "EventName": "ITLB1_WRITES",
+                "BriefDescription": "ITLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Instruction Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "135",
+                "EventName": "ITLB1_MISSES",
+                "BriefDescription": "ITLB1 Misses",
+                "PublicDescription": "Level-1 Instruction TLB miss in progress. Incremented by one for every cycle an ITLB1 miss is in progress"
+        },
+        {
+                "EventCode": "136",
+                "EventName": "L1I_L2I_SOURCED_WRITES",
+                "BriefDescription": "L1I L2I Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from the Level-2 Instruction cache"
+        },
+        {
+                "EventCode": "137",
+                "EventName": "TLB2_PTE_WRITES",
+                "BriefDescription": "TLB2 PTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Page Table Entry arrays"
+        },
+        {
+                "EventCode": "138",
+                "EventName": "TLB2_CRSTE_HPAGE_WRITES",
+                "BriefDescription": "TLB2 CRSTE One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Combined Region Segment Table Entry arrays for a one-megabyte large page translation"
+        },
+        {
+                "EventCode": "139",
+                "EventName": "TLB2_CRSTE_WRITES",
+                "BriefDescription": "TLB2 CRSTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Combined Region Segment Table Entry arrays"
+        },
+        {
+                "EventCode": "140",
+                "EventName": "TX_C_TEND",
+                "BriefDescription": "Completed TEND instructions in constrained TX mode",
+                "PublicDescription": "A TEND instruction has completed in a constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "141",
+                "EventName": "TX_NC_TEND",
+                "BriefDescription": "Completed TEND instructions in non-constrained TX mode",
+                "PublicDescription": "A TEND instruction has completed in a non-constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "143",
+                "EventName": "L1C_TLB1_MISSES",
+                "BriefDescription": "L1C TLB1 Misses",
+                "PublicDescription": "Increments by one for any cycle where a Level-1 cache or Level-1 TLB miss is in progress."
+        },
+        {
+                "EventCode": "144",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Chip Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "145",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Chip Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "146",
+                "EventName": "L1D_ONNODE_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Node L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Node Level-4 cache"
+        },
+        {
+                "EventCode": "147",
+                "EventName": "L1D_ONNODE_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D On-Node L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Node Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "148",
+                "EventName": "L1D_ONNODE_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Node L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Node Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "149",
+                "EventName": "L1D_ONDRAWER_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Drawer L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Drawer Level-4 cache"
+        },
+        {
+                "EventCode": "150",
+                "EventName": "L1D_ONDRAWER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D On-Drawer L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Drawer Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "151",
+                "EventName": "L1D_ONDRAWER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Drawer L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Drawer Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "152",
+                "EventName": "L1D_OFFDRAWER_SCOL_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer Same-Column L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Same-Column Level-4 cache"
+        },
+        {
+                "EventCode": "153",
+                "EventName": "L1D_OFFDRAWER_SCOL_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D Off-Drawer Same-Column L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Same-Column Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "154",
+                "EventName": "L1D_OFFDRAWER_SCOL_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer Same-Column L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Same-Column Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "155",
+                "EventName": "L1D_OFFDRAWER_FCOL_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer Far-Column L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Far-Column Level-4 cache"
+        },
+        {
+                "EventCode": "156",
+                "EventName": "L1D_OFFDRAWER_FCOL_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D Off-Drawer Far-Column L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Far-Column Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "157",
+                "EventName": "L1D_OFFDRAWER_FCOL_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer Far-Column L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Far-Column Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "158",
+                "EventName": "L1D_ONNODE_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Node Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Node memory"
+        },
+        {
+                "EventCode": "159",
+                "EventName": "L1D_ONDRAWER_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Drawer Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Drawer memory"
+        },
+        {
+                "EventCode": "160",
+                "EventName": "L1D_OFFDRAWER_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Drawer memory"
+        },
+        {
+                "EventCode": "161",
+                "EventName": "L1D_ONCHIP_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Chip Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Chip memory"
+        },
+        {
+                "EventCode": "162",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Chip Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "163",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On Chip Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "164",
+                "EventName": "L1I_ONNODE_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Node Level-4 cache"
+        },
+        {
+                "EventCode": "165",
+                "EventName": "L1I_ONNODE_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I On-Node L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Node Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "166",
+                "EventName": "L1I_ONNODE_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Node L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Node Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "167",
+                "EventName": "L1I_ONDRAWER_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Drawer L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Drawer Level-4 cache"
+        },
+        {
+                "EventCode": "168",
+                "EventName": "L1I_ONDRAWER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I On-Drawer L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Drawer Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "169",
+                "EventName": "L1I_ONDRAWER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Drawer L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Drawer Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "170",
+                "EventName": "L1I_OFFDRAWER_SCOL_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer Same-Column L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Same-Column Level-4 cache"
+        },
+        {
+                "EventCode": "171",
+                "EventName": "L1I_OFFDRAWER_SCOL_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I Off-Drawer Same-Column L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Same-Column Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "172",
+                "EventName": "L1I_OFFDRAWER_SCOL_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer Same-Column L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Same-Column Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "173",
+                "EventName": "L1I_OFFDRAWER_FCOL_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer Far-Column L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Far-Column Level-4 cache"
+        },
+        {
+                "EventCode": "174",
+                "EventName": "L1I_OFFDRAWER_FCOL_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I Off-Drawer Far-Column L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Far-Column Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "175",
+                "EventName": "L1I_OFFDRAWER_FCOL_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer Far-Column L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Far-Column Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "176",
+                "EventName": "L1I_ONNODE_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Node Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from On-Node memory"
+        },
+        {
+                "EventCode": "177",
+                "EventName": "L1I_ONDRAWER_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Drawer Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from On-Drawer memory"
+        },
+        {
+                "EventCode": "178",
+                "EventName": "L1I_OFFDRAWER_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from On-Drawer memory"
+        },
+        {
+                "EventCode": "179",
+                "EventName": "L1I_ONCHIP_MEM_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from On-Chip memory"
+        },
+        {
+                "EventCode": "218",
+                "EventName": "TX_NC_TABORT",
+                "BriefDescription": "Aborted transactions in non-constrained TX mode",
+                "PublicDescription": "A transaction abort has occurred in a non-constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "219",
+                "EventName": "TX_C_TABORT_NO_SPECIAL",
+                "BriefDescription": "Aborted transactions in constrained TX mode not using special completion logic",
+                "PublicDescription": "A transaction abort has occurred in a constrained transactional-execution mode and the CPU is not using any special logic to allow the transaction to complete"
+        },
+        {
+                "EventCode": "220",
+                "EventName": "TX_C_TABORT_SPECIAL",
+                "BriefDescription": "Aborted transactions in constrained TX mode using special completion logic",
+                "PublicDescription": "A transaction abort has occurred in a constrained transactional-execution mode and the CPU is using special logic to allow the transaction to complete"
+        },
+        {
+                "EventCode": "448",
+                "EventName": "MT_DIAG_CYCLES_ONE_THR_ACTIVE",
+                "BriefDescription": "Cycle count with one thread active",
+                "PublicDescription": "Cycle count with one thread active"
+        },
+        {
+                "EventCode": "449",
+                "EventName": "MT_DIAG_CYCLES_TWO_THR_ACTIVE",
+                "BriefDescription": "Cycle count with two threads active",
+                "PublicDescription": "Cycle count with two threads active"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z14/basic.json b/tools/perf/pmu-events/arch/s390/cf_z14/basic.json
new file mode 100644
index 000000000000..8f653c9d899d
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z14/basic.json
@@ -0,0 +1,50 @@
+[
+        {
+                "EventCode": "0",
+                "EventName": "CPU_CYCLES",
+                "BriefDescription": "CPU Cycles",
+                "PublicDescription": "Cycle Count"
+        },
+        {
+                "EventCode": "1",
+                "EventName": "INSTRUCTIONS",
+                "BriefDescription": "Instructions",
+                "PublicDescription": "Instruction Count"
+        },
+        {
+                "EventCode": "2",
+                "EventName": "L1I_DIR_WRITES",
+                "BriefDescription": "L1I Directory Writes",
+                "PublicDescription": "Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "3",
+                "EventName": "L1I_PENALTY_CYCLES",
+                "BriefDescription": "L1I Penalty Cycles",
+                "PublicDescription": "Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "4",
+                "EventName": "L1D_DIR_WRITES",
+                "BriefDescription": "L1D Directory Writes",
+                "PublicDescription": "Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "5",
+                "EventName": "L1D_PENALTY_CYCLES",
+                "BriefDescription": "L1D Penalty Cycles",
+                "PublicDescription": "Level-1 D-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "32",
+                "EventName": "PROBLEM_STATE_CPU_CYCLES",
+                "BriefDescription": "Problem-State CPU Cycles",
+                "PublicDescription": "Problem-State Cycle Count"
+        },
+        {
+                "EventCode": "33",
+                "EventName": "PROBLEM_STATE_INSTRUCTIONS",
+                "BriefDescription": "Problem-State Instructions",
+                "PublicDescription": "Problem-State Instruction Count"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z14/crypto.json b/tools/perf/pmu-events/arch/s390/cf_z14/crypto.json
new file mode 100644
index 000000000000..7e5b72492141
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z14/crypto.json
@@ -0,0 +1,98 @@
+[
+        {
+                "EventCode": "64",
+                "EventName": "PRNG_FUNCTIONS",
+                "BriefDescription": "PRNG Functions",
+                "PublicDescription": "Total number of the PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "65",
+                "EventName": "PRNG_CYCLES",
+                "BriefDescription": "PRNG Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "66",
+                "EventName": "PRNG_BLOCKED_FUNCTIONS",
+                "BriefDescription": "PRNG Blocked Functions",
+                "PublicDescription": "Total number of the PRNG functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "67",
+                "EventName": "PRNG_BLOCKED_CYCLES",
+                "BriefDescription": "PRNG Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the PRNG functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "68",
+                "EventName": "SHA_FUNCTIONS",
+                "BriefDescription": "SHA Functions",
+                "PublicDescription": "Total number of SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "69",
+                "EventName": "SHA_CYCLES",
+                "BriefDescription": "SHA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the SHA coprocessor is busy performing the SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "70",
+                "EventName": "SHA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "SHA Blocked Functions",
+                "PublicDescription": "Total number of the SHA functions that are issued by the CPU and are blocked because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "71",
+                "EventName": "SHA_BLOCKED_CYCLES",
+                "BriefDescription": "SHA Bloced Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the SHA functions issued by the CPU because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "72",
+                "EventName": "DEA_FUNCTIONS",
+                "BriefDescription": "DEA Functions",
+                "PublicDescription": "Total number of the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "73",
+                "EventName": "DEA_CYCLES",
+                "BriefDescription": "DEA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "74",
+                "EventName": "DEA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "DEA Blocked Functions",
+                "PublicDescription": "Total number of the DEA functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "75",
+                "EventName": "DEA_BLOCKED_CYCLES",
+                "BriefDescription": "DEA Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the DEA functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "76",
+                "EventName": "AES_FUNCTIONS",
+                "BriefDescription": "AES Functions",
+                "PublicDescription": "Total number of AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "77",
+                "EventName": "AES_CYCLES",
+                "BriefDescription": "AES Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "78",
+                "EventName": "AES_BLOCKED_FUNCTIONS",
+                "BriefDescription": "AES Blocked Functions",
+                "PublicDescription": "Total number of AES functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "79",
+                "EventName": "AES_BLOCKED_CYCLES",
+                "BriefDescription": "AES Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the AES functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z14/extended.json b/tools/perf/pmu-events/arch/s390/cf_z14/extended.json
new file mode 100644
index 000000000000..aa4dfb46b65b
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z14/extended.json
@@ -0,0 +1,320 @@
+[
+        {
+                "EventCode": "128",
+                "EventName": "L1D_RO_EXCL_WRITES",
+                "BriefDescription": "L1D Read-only Exclusive Writes",
+                "PublicDescription": "Counter:128       Name:L1D_RO_EXCL_WRITES A directory write to the Level-1 Data cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line"
+        },
+        {
+                "EventCode": "129",
+                "EventName": "DTLB2_WRITES",
+                "BriefDescription": "DTLB2 Writes",
+                "PublicDescription": "A translation has been written into The Translation Lookaside Buffer 2 (TLB2) and the request was made by the data cache"
+        },
+        {
+                "EventCode": "130",
+                "EventName": "DTLB2_MISSES",
+                "BriefDescription": "DTLB2 Misses",
+                "PublicDescription": "A TLB2 miss is in progress for a request made by the data cache. Incremented by one for every TLB2 miss in progress for the Level-1 Data cache on this cycle"
+        },
+        {
+                "EventCode": "131",
+                "EventName": "DTLB2_HPAGE_WRITES",
+                "BriefDescription": "DTLB2 One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry was written into the Combined Region and Segment Table Entry array in the Level-2 TLB for a one-megabyte page or a Last Host Translation was done"
+        },
+        {
+                "EventCode": "132",
+                "EventName": "DTLB2_GPAGE_WRITES",
+                "BriefDescription": "DTLB2 Two-Gigabyte Page Writes",
+                "PublicDescription": "A translation entry for a two-gigabyte page was written into the Level-2 TLB"
+        },
+        {
+                "EventCode": "133",
+                "EventName": "L1D_L2D_SOURCED_WRITES",
+                "BriefDescription": "L1D L2D Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the Level-2 Data cache"
+        },
+        {
+                "EventCode": "134",
+                "EventName": "ITLB2_WRITES",
+                "BriefDescription": "ITLB2 Writes",
+                "PublicDescription": "A translation entry has been written into the Translation Lookaside Buffer 2 (TLB2) and the request was made by the instruction cache"
+        },
+        {
+                "EventCode": "135",
+                "EventName": "ITLB2_MISSES",
+                "BriefDescription": "ITLB2 Misses",
+                "PublicDescription": "A TLB2 miss is in progress for a request made by the instruction cache. Incremented by one for every TLB2 miss in progress for the Level-1 Instruction cache in a cycle"
+        },
+        {
+                "EventCode": "136",
+                "EventName": "L1I_L2I_SOURCED_WRITES",
+                "BriefDescription": "L1I L2I Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from the Level-2 Instruction cache"
+        },
+        {
+                "EventCode": "137",
+                "EventName": "TLB2_PTE_WRITES",
+                "BriefDescription": "TLB2 PTE Writes",
+                "PublicDescription": "A translation entry was written into the Page Table Entry array in the Level-2 TLB"
+        },
+        {
+                "EventCode": "138",
+                "EventName": "TLB2_CRSTE_WRITES",
+                "BriefDescription": "TLB2 CRSTE Writes",
+                "PublicDescription": "Translation entries were written into the Combined Region and Segment Table Entry array and the Page Table Entry array in the Level-2 TLB"
+        },
+        {
+                "EventCode": "139",
+                "EventName": "TLB2_ENGINES_BUSY",
+                "BriefDescription": "TLB2 Engines Busy",
+                "PublicDescription": "The number of Level-2 TLB translation engines busy in a cycle"
+        },
+        {
+                "EventCode": "140",
+                "EventName": "TX_C_TEND",
+                "BriefDescription": "Completed TEND instructions in constrained TX mode",
+                "PublicDescription": "A TEND instruction has completed in a constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "141",
+                "EventName": "TX_NC_TEND",
+                "BriefDescription": "Completed TEND instructions in non-constrained TX mode",
+                "PublicDescription": "A TEND instruction has completed in a non-constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "143",
+                "EventName": "L1C_TLB2_MISSES",
+                "BriefDescription": "L1C TLB2 Misses",
+                "PublicDescription": "Increments by one for any cycle where a level-1 cache or level-2 TLB miss is in progress"
+        },
+        {
+                "EventCode": "144",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Chip Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "145",
+                "EventName": "L1D_ONCHIP_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Chip Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Chip memory"
+        },
+        {
+                "EventCode": "146",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Chip Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "147",
+                "EventName": "L1D_ONCLUSTER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Cluster L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Cluster Level-3 cache withountervention"
+        },
+        {
+                "EventCode": "148",
+                "EventName": "L1D_ONCLUSTER_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Cluster Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Cluster memory"
+        },
+        {
+                "EventCode": "149",
+                "EventName": "L1D_ONCLUSTER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D On-Cluster L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On-Cluster Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "150",
+                "EventName": "L1D_OFFCLUSTER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Cluster L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Cluster Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "151",
+                "EventName": "L1D_OFFCLUSTER_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Cluster Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from Off-Cluster memory"
+        },
+        {
+                "EventCode": "152",
+                "EventName": "L1D_OFFCLUSTER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D Off-Cluster L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Cluster Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "153",
+                "EventName": "L1D_OFFDRAWER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "154",
+                "EventName": "L1D_OFFDRAWER_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from Off-Drawer memory"
+        },
+        {
+                "EventCode": "155",
+                "EventName": "L1D_OFFDRAWER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D Off-Drawer L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off-Drawer Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "156",
+                "EventName": "L1D_ONDRAWER_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Drawer L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Drawer Level-4 cache"
+        },
+        {
+                "EventCode": "157",
+                "EventName": "L1D_OFFDRAWER_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Drawer L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from Off-Drawer Level-4 cache"
+        },
+        {
+                "EventCode": "158",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES_RO",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes read-only",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from On-Chip L3 but a read-only invalidate was done to remove other copies of the cache line"
+        },
+        {
+                "EventCode": "162",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache ine was sourced from an On-Chip Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "163",
+                "EventName": "L1I_ONCHIP_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache ine was sourced from On-Chip memory"
+        },
+        {
+                "EventCode": "164",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache ine was sourced from an On-Chip Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "165",
+                "EventName": "L1I_ONCLUSTER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Cluster L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Cluster Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "166",
+                "EventName": "L1I_ONCLUSTER_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Cluster Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On-Cluster memory"
+        },
+        {
+                "EventCode": "167",
+                "EventName": "L1I_ONCLUSTER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I On-Cluster L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from On-Cluster Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "168",
+                "EventName": "L1I_OFFCLUSTER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Cluster L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Cluster Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "169",
+                "EventName": "L1I_OFFCLUSTER_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Cluster Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from Off-Cluster memory"
+        },
+        {
+                "EventCode": "170",
+                "EventName": "L1I_OFFCLUSTER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I Off-Cluster L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Cluster Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "171",
+                "EventName": "L1I_OFFDRAWER_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "172",
+                "EventName": "L1I_OFFDRAWER_MEMORY_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from Off-Drawer memory"
+        },
+        {
+                "EventCode": "173",
+                "EventName": "L1I_OFFDRAWER_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I Off-Drawer L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off-Drawer Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "174",
+                "EventName": "L1I_ONDRAWER_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Drawer L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from On-Drawer Level-4 cache"
+        },
+        {
+                "EventCode": "175",
+                "EventName": "L1I_OFFDRAWER_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Drawer L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from Off-Drawer Level-4 cache"
+        },
+        {
+                "EventCode": "224",
+                "EventName": "BCD_DFP_EXECUTION_SLOTS",
+                "BriefDescription": "BCD DFP Execution Slots",
+                "PublicDescription": "Count of floating point execution slots used for finished Binary Coded Decimal to Decimal Floating Point conversions. Instructions: CDZT, CXZT, CZDT, CZXT"
+        },
+        {
+                "EventCode": "225",
+                "EventName": "VX_BCD_EXECUTION_SLOTS",
+                "BriefDescription": "VX BCD Execution Slots",
+                "PublicDescription": "Count of floating point execution slots used for finished vector arithmetic Binary Coded Decimal instructions. Instructions: VAP, VSP, VMPVMSP, VDP, VSDP, VRP, VLIP, VSRP, VPSOPVCP, VTP, VPKZ, VUPKZ, VCVB, VCVBG, VCVDVCVDG"
+        },
+        {
+                "EventCode": "226",
+                "EventName": "DECIMAL_INSTRUCTIONS",
+                "BriefDescription": "Decimal Instructions",
+                "PublicDescription": "Decimal instructions dispatched. Instructions: CVB, CVD, AP, CP, DP, ED, EDMK, MP, SRP, SP, ZAP"
+        },
+        {
+                "EventCode": "232",
+                "EventName": "LAST_HOST_TRANSLATIONS",
+                "BriefDescription": "Last host translation done",
+                "PublicDescription": "Last Host Translation done"
+        },
+        {
+                "EventCode": "243",
+                "EventName": "TX_NC_TABORT",
+                "BriefDescription": "Aborted transactions in non-constrained TX mode",
+                "PublicDescription": "A transaction abort has occurred in a non-constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "244",
+                "EventName": "TX_C_TABORT_NO_SPECIAL",
+                "BriefDescription": "Aborted transactions in constrained TX mode not using special completion logic",
+                "PublicDescription": "A transaction abort has occurred in a constrained transactional-execution mode and the CPU is not using any special logic to allow the transaction to complete"
+        },
+        {
+                "EventCode": "245",
+                "EventName": "TX_C_TABORT_SPECIAL",
+                "BriefDescription": "Aborted transactions in constrained TX mode using special completion logic",
+                "PublicDescription": "A transaction abort has occurred in a constrained transactional-execution mode and the CPU is using special logic to allow the transaction to complete"
+        },
+        {
+                "EventCode": "448",
+                "EventName": "MT_DIAG_CYCLES_ONE_THR_ACTIVE",
+                "BriefDescription": "Cycle count with one thread active",
+                "PublicDescription": "Cycle count with one thread active"
+        },
+        {
+                "EventCode": "449",
+                "EventName": "MT_DIAG_CYCLES_TWO_THR_ACTIVE",
+                "BriefDescription": "Cycle count with two threads active",
+                "PublicDescription": "Cycle count with two threads active"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z196/basic.json b/tools/perf/pmu-events/arch/s390/cf_z196/basic.json
new file mode 100644
index 000000000000..8bf16759ca53
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z196/basic.json
@@ -0,0 +1,74 @@
+[
+        {
+                "EventCode": "0",
+                "EventName": "CPU_CYCLES",
+                "BriefDescription": "CPU Cycles",
+                "PublicDescription": "Cycle Count"
+        },
+        {
+                "EventCode": "1",
+                "EventName": "INSTRUCTIONS",
+                "BriefDescription": "Instructions",
+                "PublicDescription": "Instruction Count"
+        },
+        {
+                "EventCode": "2",
+                "EventName": "L1I_DIR_WRITES",
+                "BriefDescription": "L1I Directory Writes",
+                "PublicDescription": "Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "3",
+                "EventName": "L1I_PENALTY_CYCLES",
+                "BriefDescription": "L1I Penalty Cycles",
+                "PublicDescription": "Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "4",
+                "EventName": "L1D_DIR_WRITES",
+                "BriefDescription": "L1D Directory Writes",
+                "PublicDescription": "Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "5",
+                "EventName": "L1D_PENALTY_CYCLES",
+                "BriefDescription": "L1D Penalty Cycles",
+                "PublicDescription": "Level-1 D-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "32",
+                "EventName": "PROBLEM_STATE_CPU_CYCLES",
+                "BriefDescription": "Problem-State CPU Cycles",
+                "PublicDescription": "Problem-State Cycle Count"
+        },
+        {
+                "EventCode": "33",
+                "EventName": "PROBLEM_STATE_INSTRUCTIONS",
+                "BriefDescription": "Problem-State Instructions",
+                "PublicDescription": "Problem-State Instruction Count"
+        },
+        {
+                "EventCode": "34",
+                "EventName": "PROBLEM_STATE_L1I_DIR_WRITES",
+                "BriefDescription": "Problem-State L1I Directory Writes",
+                "PublicDescription": "Problem-State Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "35",
+                "EventName": "PROBLEM_STATE_L1I_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1I Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "36",
+                "EventName": "PROBLEM_STATE_L1D_DIR_WRITES",
+                "BriefDescription": "Problem-State L1D Directory Writes",
+                "PublicDescription": "Problem-State Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "37",
+                "EventName": "PROBLEM_STATE_L1D_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1D Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 D-Cache Penalty Cycle Count"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z196/crypto.json b/tools/perf/pmu-events/arch/s390/cf_z196/crypto.json
new file mode 100644
index 000000000000..7e5b72492141
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z196/crypto.json
@@ -0,0 +1,98 @@
+[
+        {
+                "EventCode": "64",
+                "EventName": "PRNG_FUNCTIONS",
+                "BriefDescription": "PRNG Functions",
+                "PublicDescription": "Total number of the PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "65",
+                "EventName": "PRNG_CYCLES",
+                "BriefDescription": "PRNG Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "66",
+                "EventName": "PRNG_BLOCKED_FUNCTIONS",
+                "BriefDescription": "PRNG Blocked Functions",
+                "PublicDescription": "Total number of the PRNG functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "67",
+                "EventName": "PRNG_BLOCKED_CYCLES",
+                "BriefDescription": "PRNG Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the PRNG functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "68",
+                "EventName": "SHA_FUNCTIONS",
+                "BriefDescription": "SHA Functions",
+                "PublicDescription": "Total number of SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "69",
+                "EventName": "SHA_CYCLES",
+                "BriefDescription": "SHA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the SHA coprocessor is busy performing the SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "70",
+                "EventName": "SHA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "SHA Blocked Functions",
+                "PublicDescription": "Total number of the SHA functions that are issued by the CPU and are blocked because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "71",
+                "EventName": "SHA_BLOCKED_CYCLES",
+                "BriefDescription": "SHA Bloced Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the SHA functions issued by the CPU because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "72",
+                "EventName": "DEA_FUNCTIONS",
+                "BriefDescription": "DEA Functions",
+                "PublicDescription": "Total number of the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "73",
+                "EventName": "DEA_CYCLES",
+                "BriefDescription": "DEA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "74",
+                "EventName": "DEA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "DEA Blocked Functions",
+                "PublicDescription": "Total number of the DEA functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "75",
+                "EventName": "DEA_BLOCKED_CYCLES",
+                "BriefDescription": "DEA Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the DEA functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "76",
+                "EventName": "AES_FUNCTIONS",
+                "BriefDescription": "AES Functions",
+                "PublicDescription": "Total number of AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "77",
+                "EventName": "AES_CYCLES",
+                "BriefDescription": "AES Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "78",
+                "EventName": "AES_BLOCKED_FUNCTIONS",
+                "BriefDescription": "AES Blocked Functions",
+                "PublicDescription": "Total number of AES functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "79",
+                "EventName": "AES_BLOCKED_CYCLES",
+                "BriefDescription": "AES Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the AES functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_z196/extended.json b/tools/perf/pmu-events/arch/s390/cf_z196/extended.json
new file mode 100644
index 000000000000..b6d7fec7c2e7
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_z196/extended.json
@@ -0,0 +1,146 @@
+[
+        {
+                "EventCode": "128",
+                "EventName": "L1D_L2_SOURCED_WRITES",
+                "BriefDescription": "L1D L2 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the returned cache line was sourced from the Level-2 cache"
+        },
+        {
+                "EventCode": "129",
+                "EventName": "L1I_L2_SOURCED_WRITES",
+                "BriefDescription": "L1I L2 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from the Level-2 cache"
+        },
+        {
+                "EventCode": "130",
+                "EventName": "DTLB1_MISSES",
+                "BriefDescription": "DTLB1 Misses",
+                "PublicDescription": "Level-1 Data TLB miss in progress. Incremented by one for every cycle a DTLB1 miss is in progress."
+        },
+        {
+                "EventCode": "131",
+                "EventName": "ITLB1_MISSES",
+                "BriefDescription": "ITLB1 Misses",
+                "PublicDescription": "Level-1 Instruction TLB miss in progress. Incremented by one for every cycle a ITLB1 miss is in progress."
+        },
+        {
+                "EventCode": "133",
+                "EventName": "L2C_STORES_SENT",
+                "BriefDescription": "L2C Stores Sent",
+                "PublicDescription": "Incremented by one for every store sent to Level-2 cache"
+        },
+        {
+                "EventCode": "134",
+                "EventName": "L1D_OFFBOOK_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Book L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the returned cache line was sourced from an Off Book Level-3 cache"
+        },
+        {
+                "EventCode": "135",
+                "EventName": "L1D_ONBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the returned cache line was sourced from an On Book Level-4 cache"
+        },
+        {
+                "EventCode": "136",
+                "EventName": "L1I_ONBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from an On Book Level-4 cache"
+        },
+        {
+                "EventCode": "137",
+                "EventName": "L1D_RO_EXCL_WRITES",
+                "BriefDescription": "L1D Read-only Exclusive Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line"
+        },
+        {
+                "EventCode": "138",
+                "EventName": "L1D_OFFBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the returned cache line was sourced from an Off Book Level-4 cache"
+        },
+        {
+                "EventCode": "139",
+                "EventName": "L1I_OFFBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from an Off Book Level-4 cache"
+        },
+        {
+                "EventCode": "140",
+                "EventName": "DTLB1_HPAGE_WRITES",
+                "BriefDescription": "DTLB1 One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer for a one-megabyte page"
+        },
+        {
+                "EventCode": "141",
+                "EventName": "L1D_LMEM_SOURCED_WRITES",
+                "BriefDescription": "L1D Local Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache where the installed cache line was sourced from memory that is attached to the same book as the Data cache (Local Memory)"
+        },
+        {
+                "EventCode": "142",
+                "EventName": "L1I_LMEM_SOURCED_WRITES",
+                "BriefDescription": "L1I Local Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache where the installed cache line was sourced from memory that is attached to the same book as the Instruction cache (Local Memory)"
+        },
+        {
+                "EventCode": "143",
+                "EventName": "L1I_OFFBOOK_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Book L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from an Off Book Level-3 cache"
+        },
+        {
+                "EventCode": "144",
+                "EventName": "DTLB1_WRITES",
+                "BriefDescription": "DTLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "145",
+                "EventName": "ITLB1_WRITES",
+                "BriefDescription": "ITLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Instruction Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "146",
+                "EventName": "TLB2_PTE_WRITES",
+                "BriefDescription": "TLB2 PTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Page Table Entry arrays"
+        },
+        {
+                "EventCode": "147",
+                "EventName": "TLB2_CRSTE_HPAGE_WRITES",
+                "BriefDescription": "TLB2 CRSTE One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Common Region Segment Table Entry arrays for a one-megabyte large page translation"
+        },
+        {
+                "EventCode": "148",
+                "EventName": "TLB2_CRSTE_WRITES",
+                "BriefDescription": "TLB2 CRSTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Common Region Segment Table Entry arrays"
+        },
+        {
+                "EventCode": "150",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the returned cache line was sourced from an On Chip Level-3 cache"
+        },
+        {
+                "EventCode": "152",
+                "EventName": "L1D_OFFCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache directory where the returned cache line was sourced from an Off Chip/On Book Level-3 cache"
+        },
+        {
+                "EventCode": "153",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from an On Chip Level-3 cache"
+        },
+        {
+                "EventCode": "155",
+                "EventName": "L1I_OFFCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 I-Cache directory where the returned cache line was sourced from an Off Chip/On Book Level-3 cache"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_zec12/basic.json b/tools/perf/pmu-events/arch/s390/cf_zec12/basic.json
new file mode 100644
index 000000000000..8bf16759ca53
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_zec12/basic.json
@@ -0,0 +1,74 @@
+[
+        {
+                "EventCode": "0",
+                "EventName": "CPU_CYCLES",
+                "BriefDescription": "CPU Cycles",
+                "PublicDescription": "Cycle Count"
+        },
+        {
+                "EventCode": "1",
+                "EventName": "INSTRUCTIONS",
+                "BriefDescription": "Instructions",
+                "PublicDescription": "Instruction Count"
+        },
+        {
+                "EventCode": "2",
+                "EventName": "L1I_DIR_WRITES",
+                "BriefDescription": "L1I Directory Writes",
+                "PublicDescription": "Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "3",
+                "EventName": "L1I_PENALTY_CYCLES",
+                "BriefDescription": "L1I Penalty Cycles",
+                "PublicDescription": "Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "4",
+                "EventName": "L1D_DIR_WRITES",
+                "BriefDescription": "L1D Directory Writes",
+                "PublicDescription": "Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "5",
+                "EventName": "L1D_PENALTY_CYCLES",
+                "BriefDescription": "L1D Penalty Cycles",
+                "PublicDescription": "Level-1 D-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "32",
+                "EventName": "PROBLEM_STATE_CPU_CYCLES",
+                "BriefDescription": "Problem-State CPU Cycles",
+                "PublicDescription": "Problem-State Cycle Count"
+        },
+        {
+                "EventCode": "33",
+                "EventName": "PROBLEM_STATE_INSTRUCTIONS",
+                "BriefDescription": "Problem-State Instructions",
+                "PublicDescription": "Problem-State Instruction Count"
+        },
+        {
+                "EventCode": "34",
+                "EventName": "PROBLEM_STATE_L1I_DIR_WRITES",
+                "BriefDescription": "Problem-State L1I Directory Writes",
+                "PublicDescription": "Problem-State Level-1 I-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "35",
+                "EventName": "PROBLEM_STATE_L1I_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1I Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 I-Cache Penalty Cycle Count"
+        },
+        {
+                "EventCode": "36",
+                "EventName": "PROBLEM_STATE_L1D_DIR_WRITES",
+                "BriefDescription": "Problem-State L1D Directory Writes",
+                "PublicDescription": "Problem-State Level-1 D-Cache Directory Write Count"
+        },
+        {
+                "EventCode": "37",
+                "EventName": "PROBLEM_STATE_L1D_PENALTY_CYCLES",
+                "BriefDescription": "Problem-State L1D Penalty Cycles",
+                "PublicDescription": "Problem-State Level-1 D-Cache Penalty Cycle Count"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_zec12/crypto.json b/tools/perf/pmu-events/arch/s390/cf_zec12/crypto.json
new file mode 100644
index 000000000000..7e5b72492141
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_zec12/crypto.json
@@ -0,0 +1,98 @@
+[
+        {
+                "EventCode": "64",
+                "EventName": "PRNG_FUNCTIONS",
+                "BriefDescription": "PRNG Functions",
+                "PublicDescription": "Total number of the PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "65",
+                "EventName": "PRNG_CYCLES",
+                "BriefDescription": "PRNG Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing PRNG functions issued by the CPU"
+        },
+        {
+                "EventCode": "66",
+                "EventName": "PRNG_BLOCKED_FUNCTIONS",
+                "BriefDescription": "PRNG Blocked Functions",
+                "PublicDescription": "Total number of the PRNG functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "67",
+                "EventName": "PRNG_BLOCKED_CYCLES",
+                "BriefDescription": "PRNG Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the PRNG functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "68",
+                "EventName": "SHA_FUNCTIONS",
+                "BriefDescription": "SHA Functions",
+                "PublicDescription": "Total number of SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "69",
+                "EventName": "SHA_CYCLES",
+                "BriefDescription": "SHA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the SHA coprocessor is busy performing the SHA functions issued by the CPU"
+        },
+        {
+                "EventCode": "70",
+                "EventName": "SHA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "SHA Blocked Functions",
+                "PublicDescription": "Total number of the SHA functions that are issued by the CPU and are blocked because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "71",
+                "EventName": "SHA_BLOCKED_CYCLES",
+                "BriefDescription": "SHA Bloced Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the SHA functions issued by the CPU because the SHA coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "72",
+                "EventName": "DEA_FUNCTIONS",
+                "BriefDescription": "DEA Functions",
+                "PublicDescription": "Total number of the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "73",
+                "EventName": "DEA_CYCLES",
+                "BriefDescription": "DEA Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the DEA functions issued by the CPU"
+        },
+        {
+                "EventCode": "74",
+                "EventName": "DEA_BLOCKED_FUNCTIONS",
+                "BriefDescription": "DEA Blocked Functions",
+                "PublicDescription": "Total number of the DEA functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "75",
+                "EventName": "DEA_BLOCKED_CYCLES",
+                "BriefDescription": "DEA Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the DEA functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "76",
+                "EventName": "AES_FUNCTIONS",
+                "BriefDescription": "AES Functions",
+                "PublicDescription": "Total number of AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "77",
+                "EventName": "AES_CYCLES",
+                "BriefDescription": "AES Cycles",
+                "PublicDescription": "Total number of CPU cycles when the DEA/AES coprocessor is busy performing the AES functions issued by the CPU"
+        },
+        {
+                "EventCode": "78",
+                "EventName": "AES_BLOCKED_FUNCTIONS",
+                "BriefDescription": "AES Blocked Functions",
+                "PublicDescription": "Total number of AES functions that are issued by the CPU and are blocked because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+        {
+                "EventCode": "79",
+                "EventName": "AES_BLOCKED_CYCLES",
+                "BriefDescription": "AES Blocked Cycles",
+                "PublicDescription": "Total number of CPU cycles blocked for the AES functions issued by the CPU because the DEA/AES coprocessor is busy performing a function issued by another CPU"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/cf_zec12/extended.json b/tools/perf/pmu-events/arch/s390/cf_zec12/extended.json
new file mode 100644
index 000000000000..8682126aabb2
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/cf_zec12/extended.json
@@ -0,0 +1,212 @@
+[
+        {
+                "EventCode": "128",
+                "EventName": "DTLB1_MISSES",
+                "BriefDescription": "DTLB1 Misses",
+                "PublicDescription": "Level-1 Data TLB miss in progress. Incremented by one for every cycle a DTLB1 miss is in progress."
+        },
+        {
+                "EventCode": "129",
+                "EventName": "ITLB1_MISSES",
+                "BriefDescription": "ITLB1 Misses",
+                "PublicDescription": "Level-1 Instruction TLB miss in progress. Incremented by one for every cycle a ITLB1 miss is in progress."
+        },
+        {
+                "EventCode": "130",
+                "EventName": "L1D_L2I_SOURCED_WRITES",
+                "BriefDescription": "L1D L2I Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the Level-2 Instruction cache"
+        },
+        {
+                "EventCode": "131",
+                "EventName": "L1I_L2I_SOURCED_WRITES",
+                "BriefDescription": "L1I L2I Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from the Level-2 Instruction cache"
+        },
+        {
+                "EventCode": "132",
+                "EventName": "L1D_L2D_SOURCED_WRITES",
+                "BriefDescription": "L1D L2D Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the Level-2 Data cache"
+        },
+        {
+                "EventCode": "133",
+                "EventName": "DTLB1_WRITES",
+                "BriefDescription": "DTLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "135",
+                "EventName": "L1D_LMEM_SOURCED_WRITES",
+                "BriefDescription": "L1D Local Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache where the installed cache line was sourced from memory that is attached to the same book as the Data cache (Local Memory)"
+        },
+        {
+                "EventCode": "137",
+                "EventName": "L1I_LMEM_SOURCED_WRITES",
+                "BriefDescription": "L1I Local Memory Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache where the installed cache line was sourced from memory that is attached to the same book as the Instruction cache (Local Memory)"
+        },
+        {
+                "EventCode": "138",
+                "EventName": "L1D_RO_EXCL_WRITES",
+                "BriefDescription": "L1D Read-only Exclusive Writes",
+                "PublicDescription": "A directory write to the Level-1 D-Cache where the line was originally in a Read-Only state in the cache but has been updated to be in the Exclusive state that allows stores to the cache line"
+        },
+        {
+                "EventCode": "139",
+                "EventName": "DTLB1_HPAGE_WRITES",
+                "BriefDescription": "DTLB1 One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Data Translation Lookaside Buffer for a one-megabyte page"
+        },
+        {
+                "EventCode": "140",
+                "EventName": "ITLB1_WRITES",
+                "BriefDescription": "ITLB1 Writes",
+                "PublicDescription": "A translation entry has been written to the Level-1 Instruction Translation Lookaside Buffer"
+        },
+        {
+                "EventCode": "141",
+                "EventName": "TLB2_PTE_WRITES",
+                "BriefDescription": "TLB2 PTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Page Table Entry arrays"
+        },
+        {
+                "EventCode": "142",
+                "EventName": "TLB2_CRSTE_HPAGE_WRITES",
+                "BriefDescription": "TLB2 CRSTE One-Megabyte Page Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Common Region Segment Table Entry arrays for a one-megabyte large page translation"
+        },
+        {
+                "EventCode": "143",
+                "EventName": "TLB2_CRSTE_WRITES",
+                "BriefDescription": "TLB2 CRSTE Writes",
+                "PublicDescription": "A translation entry has been written to the Level-2 TLB Common Region Segment Table Entry arrays"
+        },
+        {
+                "EventCode": "144",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On Chip Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "145",
+                "EventName": "L1D_OFFCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off Chip/On Book Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "146",
+                "EventName": "L1D_OFFBOOK_L3_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Book L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off Book Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "147",
+                "EventName": "L1D_ONBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D On-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an On Book Level-4 cache"
+        },
+        {
+                "EventCode": "148",
+                "EventName": "L1D_OFFBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1D Off-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off Book Level-4 cache"
+        },
+        {
+                "EventCode": "149",
+                "EventName": "TX_NC_TEND",
+                "BriefDescription": "Completed TEND instructions in non-constrained TX mode",
+                "PublicDescription": "A TEND instruction has completed in a nonconstrained transactional-execution mode"
+        },
+        {
+                "EventCode": "150",
+                "EventName": "L1D_ONCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D On-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from a On Chip Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "151",
+                "EventName": "L1D_OFFCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D Off-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off Chip/On Book Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "152",
+                "EventName": "L1D_OFFBOOK_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1D Off-Book L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from an Off Book Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "153",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On Chip Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "154",
+                "EventName": "L1I_OFFCHIP_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Chip L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off Chip/On Book Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "155",
+                "EventName": "L1I_OFFBOOK_L3_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Book L3 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off Book Level-3 cache without intervention"
+        },
+        {
+                "EventCode": "156",
+                "EventName": "L1I_ONBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I On-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On Book Level-4 cache"
+        },
+        {
+                "EventCode": "157",
+                "EventName": "L1I_OFFBOOK_L4_SOURCED_WRITES",
+                "BriefDescription": "L1I Off-Book L4 Sourced Writes",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off Book Level-4 cache"
+        },
+        {
+                "EventCode": "158",
+                "EventName": "TX_C_TEND",
+                "BriefDescription": "Completed TEND instructions in constrained TX mode",
+                "PublicDescription": "A TEND instruction has completed in a constrained transactional-execution mode"
+        },
+        {
+                "EventCode": "159",
+                "EventName": "L1I_ONCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I On-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an On Chip Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "160",
+                "EventName": "L1I_OFFCHIP_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I Off-Chip L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off Chip/On Book Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "161",
+                "EventName": "L1I_OFFBOOK_L3_SOURCED_WRITES_IV",
+                "BriefDescription": "L1I Off-Book L3 Sourced Writes with Intervention",
+                "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from an Off Book Level-3 cache with intervention"
+        },
+        {
+                "EventCode": "177",
+                "EventName": "TX_NC_TABORT",
+                "BriefDescription": "Aborted transactions in non-constrained TX mode",
+                "PublicDescription": "A transaction abort has occurred in a nonconstrained transactional-execution mode"
+        },
+        {
+                "EventCode": "178",
+                "EventName": "TX_C_TABORT_NO_SPECIAL",
+                "BriefDescription": "Aborted transactions in constrained TX mode not using special completion logic",
+                "PublicDescription": "A transaction abort has occurred in a constrained transactional-execution mode and the CPU is not using any special logic to allow the transaction to complete"
+        },
+        {
+                "EventCode": "179",
+                "EventName": "TX_C_TABORT_SPECIAL",
+                "BriefDescription": "Aborted transactions in constrained TX mode using special completion logic",
+                "PublicDescription": "A transaction abort has occurred in a constrained transactional-execution mode and the CPU is using special logic to allow the transaction to complete"
+        },
+]
diff --git a/tools/perf/pmu-events/arch/s390/mapfile.csv b/tools/perf/pmu-events/arch/s390/mapfile.csv
new file mode 100644
index 000000000000..78bcf7f8e206
--- /dev/null
+++ b/tools/perf/pmu-events/arch/s390/mapfile.csv
@@ -0,0 +1,6 @@
+Family-model,Version,Filename,EventType
+^IBM.209[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z10,core
+^IBM.281[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z196,core
+^IBM.282[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_zec12,core
+^IBM.296[45].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z13,core
+^IBM.390[67].*[13]\.[1-5].[[:xdigit:]]+$,3,cf_z14,core
diff --git a/tools/perf/pmu-events/arch/x86/mapfile.csv b/tools/perf/pmu-events/arch/x86/mapfile.csv
index 93656f2fd53a..7e3cce3bcf3b 100644
--- a/tools/perf/pmu-events/arch/x86/mapfile.csv
+++ b/tools/perf/pmu-events/arch/x86/mapfile.csv
@@ -29,7 +29,6 @@ GenuineIntel-6-4D,v13,silvermont,core
 GenuineIntel-6-4C,v13,silvermont,core
 GenuineIntel-6-2A,v15,sandybridge,core
 GenuineIntel-6-2C,v2,westmereep-dp,core
-GenuineIntel-6-2C,v2,westmereep-dp,core
 GenuineIntel-6-25,v2,westmereep-sp,core
 GenuineIntel-6-2F,v2,westmereex,core
 GenuineIntel-6-55,v1,skylakex,core
diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
index b578aa26e375..db3a594ee1e4 100644
--- a/tools/perf/pmu-events/jevents.c
+++ b/tools/perf/pmu-events/jevents.c
@@ -39,11 +39,13 @@
 #include <unistd.h>
 #include <stdarg.h>
 #include <libgen.h>
+#include <limits.h>
 #include <dirent.h>
 #include <sys/time.h>                   /* getrlimit */
 #include <sys/resource.h>               /* getrlimit */
 #include <ftw.h>
 #include <sys/stat.h>
+#include <linux/list.h>
 #include "jsmn.h"
 #include "json.h"
 #include "jevents.h"
@@ -249,31 +251,25 @@ static const char *field_to_perf(struct map *table, char *map, jsmntok_t *val)
         jsmntok_t *loc = (t);                                   \
         if (!(t)->start && (t) > tokens)                        \
                 loc = (t) - 1;                                  \
-                pr_err("%s:%d: " m ", got %s\n", fn,            \
-                        json_line(map, loc),                    \
-                        json_name(t));                          \
+        pr_err("%s:%d: " m ", got %s\n", fn,                    \
+               json_line(map, loc),                             \
+               json_name(t));                                   \
+        err = -EIO;                                             \
         goto out_free;                                          \
 } } while (0)
 
-#define TOPIC_DEPTH 256
-static char *topic_array[TOPIC_DEPTH];
-static int   topic_level;
+static char *topic;
 
 static char *get_topic(void)
 {
-        char *tp_old, *tp = NULL;
+        char *tp;
         int i;
 
-        for (i = 0; i < topic_level + 1; i++) {
-                int n;
-
-                tp_old = tp;
-                n = asprintf(&tp, "%s%s", tp ?: "", topic_array[i]);
-                if (n < 0) {
-                        pr_info("%s: asprintf() error %s\n", prog);
-                        return NULL;
-                }
-                free(tp_old);
+        /* tp is free'd in process_one_file() */
+        i = asprintf(&tp, "%s", topic);
+        if (i < 0) {
+                pr_info("%s: asprintf() error %s\n", prog);
+                return NULL;
         }
 
         for (i = 0; i < (int) strlen(tp); i++) {
@@ -290,25 +286,15 @@ static char *get_topic(void)
         return tp;
 }
 
-static int add_topic(int level, char *bname)
+static int add_topic(char *bname)
 {
-        char *topic;
-
-        level -= 2;
-
-        if (level >= TOPIC_DEPTH)
-                return -EINVAL;
-
+        free(topic);
         topic = strdup(bname);
         if (!topic) {
                 pr_info("%s: strdup() error %s for file %s\n", prog,
                                 strerror(errno), bname);
                 return -ENOMEM;
         }
-
-        free(topic_array[topic_level]);
-        topic_array[topic_level] = topic;
-        topic_level              = level;
         return 0;
 }
 
@@ -366,6 +352,81 @@ static int print_events_table_entry(void *data, char *name, char *event,
         return 0;
 }
 
+struct event_struct {
+        struct list_head list;
+        char *name;
+        char *event;
+        char *desc;
+        char *long_desc;
+        char *pmu;
+        char *unit;
+        char *perpkg;
+        char *metric_expr;
+        char *metric_name;
+        char *metric_group;
+};
+
+#define ADD_EVENT_FIELD(field) do { if (field) {                \
+        es->field = strdup(field);                              \
+        if (!es->field)                                         \
+                goto out_free;                                  \
+} } while (0)
+
+#define FREE_EVENT_FIELD(field) free(es->field)
+
+#define TRY_FIXUP_FIELD(field) do { if (es->field && !*field) {\
+        *field = strdup(es->field);                             \
+        if (!*field)                                            \
+                return -ENOMEM;                                 \
+} } while (0)
+
+#define FOR_ALL_EVENT_STRUCT_FIELDS(op) do {                    \
+        op(name);                                               \
+        op(event);                                              \
+        op(desc);                                               \
+        op(long_desc);                                          \
+        op(pmu);                                                \
+        op(unit);                                               \
+        op(perpkg);                                             \
+        op(metric_expr);                                        \
+        op(metric_name);                                        \
+        op(metric_group);                                       \
+} while (0)
+
+static LIST_HEAD(arch_std_events);
+
+static void free_arch_std_events(void)
+{
+        struct event_struct *es, *next;
+
+        list_for_each_entry_safe(es, next, &arch_std_events, list) {
+                FOR_ALL_EVENT_STRUCT_FIELDS(FREE_EVENT_FIELD);
+                list_del(&es->list);
+                free(es);
+        }
+}
+
+static int save_arch_std_events(void *data, char *name, char *event,
+                                char *desc, char *long_desc, char *pmu,
+                                char *unit, char *perpkg, char *metric_expr,
+                                char *metric_name, char *metric_group)
+{
+        struct event_struct *es;
+        struct stat *sb = data;
+
+        es = malloc(sizeof(*es));
+        if (!es)
+                return -ENOMEM;
+        memset(es, 0, sizeof(*es));
+        FOR_ALL_EVENT_STRUCT_FIELDS(ADD_EVENT_FIELD);
+        list_add_tail(&es->list, &arch_std_events);
+        return 0;
+out_free:
+        FOR_ALL_EVENT_STRUCT_FIELDS(FREE_EVENT_FIELD);
+        free(es);
+        return -ENOMEM;
+}
+
 static void print_events_table_suffix(FILE *outfp)
 {
         fprintf(outfp, "{\n");
@@ -407,6 +468,32 @@ static char *real_event(const char *name, char *event)
         return event;
 }
 
+static int
+try_fixup(const char *fn, char *arch_std, char **event, char **desc,
+          char **name, char **long_desc, char **pmu, char **filter,
+          char **perpkg, char **unit, char **metric_expr, char **metric_name,
+          char **metric_group, unsigned long long eventcode)
+{
+        /* try to find matching event from arch standard values */
+        struct event_struct *es;
+
+        list_for_each_entry(es, &arch_std_events, list) {
+                if (!strcmp(arch_std, es->name)) {
+                        if (!eventcode && es->event) {
+                                /* allow EventCode to be overridden */
+                                free(*event);
+                                *event = NULL;
+                        }
+                        FOR_ALL_EVENT_STRUCT_FIELDS(TRY_FIXUP_FIELD);
+                        return 0;
+                }
+        }
+
+        pr_err("%s: could not find matching %s for %s\n",
+                                        prog, arch_std, fn);
+        return -1;
+}
+
 /* Call func with each event in the json file */
 int json_events(const char *fn,
           int (*func)(void *data, char *name, char *event, char *desc,
@@ -416,7 +503,7 @@ int json_events(const char *fn,
                       char *metric_name, char *metric_group),
           void *data)
 {
-        int err = -EIO;
+        int err;
         size_t size;
         jsmntok_t *tokens, *tok;
         int i, j, len;
@@ -442,6 +529,7 @@ int json_events(const char *fn,
                 char *metric_expr = NULL;
                 char *metric_name = NULL;
                 char *metric_group = NULL;
+                char *arch_std = NULL;
                 unsigned long long eventcode = 0;
                 struct msrmap *msr = NULL;
                 jsmntok_t *msrval = NULL;
@@ -527,6 +615,10 @@ int json_events(const char *fn,
                                 addfield(map, &metric_expr, "", "", val);
                                 for (s = metric_expr; *s; s++)
                                         *s = tolower(*s);
+                        } else if (json_streq(map, field, "ArchStdEvent")) {
+                                addfield(map, &arch_std, "", "", val);
+                                for (s = arch_std; *s; s++)
+                                        *s = tolower(*s);
                         }
                         /* ignore unknown fields */
                 }
@@ -551,8 +643,21 @@ int json_events(const char *fn,
                 if (name)
                         fixname(name);
 
+                if (arch_std) {
+                        /*
+                         * An arch standard event is referenced, so try to
+                         * fixup any unassigned values.
+                         */
+                        err = try_fixup(fn, arch_std, &event, &desc, &name,
+                                        &long_desc, &pmu, &filter, &perpkg,
+                                        &unit, &metric_expr, &metric_name,
+                                        &metric_group, eventcode);
+                        if (err)
+                                goto free_strings;
+                }
                 err = func(data, name, real_event(name, event), desc, long_desc,
                            pmu, unit, perpkg, metric_expr, metric_name, metric_group);
+free_strings:
                 free(event);
                 free(desc);
                 free(name);
@@ -565,6 +670,8 @@ int json_events(const char *fn,
                 free(metric_expr);
                 free(metric_name);
                 free(metric_group);
+                free(arch_std);
+
                 if (err)
                         break;
                 tok += j;
@@ -588,7 +695,7 @@ static char *file_name_to_table_name(char *fname)
          * Derive rest of table name from basename of the JSON file,
          * replacing hyphens and stripping out .json suffix.
          */
-        n = asprintf(&tblname, "pme_%s", basename(fname));
+        n = asprintf(&tblname, "pme_%s", fname);
         if (n < 0) {
                 pr_info("%s: asprintf() error %s for file %s\n", prog,
                                 strerror(errno), fname);
@@ -598,7 +705,7 @@ static char *file_name_to_table_name(char *fname)
         for (i = 0; i < strlen(tblname); i++) {
                 c = tblname[i];
 
-                if (c == '-')
+                if (c == '-' || c == '/')
                         tblname[i] = '_';
                 else if (c == '.') {
                         tblname[i] = '\0';
@@ -755,25 +862,106 @@ static int get_maxfds(void)
 static FILE *eventsfp;
 static char *mapfile;
 
+static int is_leaf_dir(const char *fpath)
+{
+        DIR *d;
+        struct dirent *dir;
+        int res = 1;
+
+        d = opendir(fpath);
+        if (!d)
+                return 0;
+
+        while ((dir = readdir(d)) != NULL) {
+                if (!strcmp(dir->d_name, ".") || !strcmp(dir->d_name, ".."))
+                        continue;
+
+                if (dir->d_type == DT_DIR) {
+                        res = 0;
+                        break;
+                } else if (dir->d_type == DT_UNKNOWN) {
+                        char path[PATH_MAX];
+                        struct stat st;
+
+                        sprintf(path, "%s/%s", fpath, dir->d_name);
+                        if (stat(path, &st))
+                                break;
+
+                        if (S_ISDIR(st.st_mode)) {
+                                res = 0;
+                                break;
+                        }
+                }
+        }
+
+        closedir(d);
+
+        return res;
+}
+
+static int is_json_file(const char *name)
+{
+        const char *suffix;
+
+        if (strlen(name) < 5)
+                return 0;
+
+        suffix = name + strlen(name) - 5;
+
+        if (strncmp(suffix, ".json", 5) == 0)
+                return 1;
+        return 0;
+}
+
+static int preprocess_arch_std_files(const char *fpath, const struct stat *sb,
+                                int typeflag, struct FTW *ftwbuf)
+{
+        int level = ftwbuf->level;
+        int is_file = typeflag == FTW_F;
+
+        if (level == 1 && is_file && is_json_file(fpath))
+                return json_events(fpath, save_arch_std_events, (void *)sb);
+
+        return 0;
+}
+
 static int process_one_file(const char *fpath, const struct stat *sb,
                             int typeflag, struct FTW *ftwbuf)
 {
-        char *tblname, *bname  = (char *) fpath + ftwbuf->base;
+        char *tblname, *bname;
         int is_dir  = typeflag == FTW_D;
         int is_file = typeflag == FTW_F;
         int level   = ftwbuf->level;
         int err = 0;
 
+        if (level == 2 && is_dir) {
+                /*
+                 * For level 2 directory, bname will include parent name,
+                 * like vendor/platform. So search back from platform dir
+                 * to find this.
+                 */
+                bname = (char *) fpath + ftwbuf->base - 2;
+                for (;;) {
+                        if (*bname == '/')
+                                break;
+                        bname--;
+                }
+                bname++;
+        } else
+                bname = (char *) fpath + ftwbuf->base;
+
         pr_debug("%s %d %7jd %-20s %s\n",
                  is_file ? "f" : is_dir ? "d" : "x",
                  level, sb->st_size, bname, fpath);
 
-        /* base dir */
-        if (level == 0)
+        /* base dir or too deep */
+        if (level == 0 || level > 3)
                 return 0;
 
+
         /* model directory, reset topic */
-        if (level == 1 && is_dir) {
+        if ((level == 1 && is_dir && is_leaf_dir(fpath)) ||
+            (level == 2 && is_dir)) {
                 if (close_table)
                         print_events_table_suffix(eventsfp);
 
@@ -798,16 +986,10 @@ static int process_one_file(const char *fpath, const struct stat *sb,
          * after processing all JSON files (so we can write out the
          * mapping table after all PMU events tables).
          *
-         * TODO: Allow for multiple mapfiles? Punt for now.
          */
         if (level == 1 && is_file) {
-                if (!strncmp(bname, "mapfile.csv", 11)) {
-                        if (mapfile) {
-                                pr_info("%s: Many mapfiles? Using %s, ignoring %s\n",
-                                                prog, mapfile, fpath);
-                        } else {
-                                mapfile = strdup(fpath);
-                        }
+                if (!strcmp(bname, "mapfile.csv")) {
+                        mapfile = strdup(fpath);
                         return 0;
                 }
 
@@ -820,16 +1002,14 @@ static int process_one_file(const char *fpath, const struct stat *sb,
          * ignore it. It could be a readme.txt for instance.
          */
         if (is_file) {
-                char *suffix = bname + strlen(bname) - 5;
-
-                if (strncmp(suffix, ".json", 5)) {
+                if (!is_json_file(bname)) {
                         pr_info("%s: Ignoring file without .json suffix %s\n", prog,
                                 fpath);
                         return 0;
                 }
         }
 
-        if (level > 1 && add_topic(level, bname))
+        if (level > 1 && add_topic(bname))
                 return -ENOMEM;
 
         /*
@@ -928,12 +1108,26 @@ int main(int argc, char *argv[])
 
         maxfds = get_maxfds();
         mapfile = NULL;
+        rc = nftw(ldirname, preprocess_arch_std_files, maxfds, 0);
+        if (rc && verbose) {
+                pr_info("%s: Error preprocessing arch standard files %s\n",
+                        prog, ldirname);
+                goto empty_map;
+        } else if (rc < 0) {
+                /* Make build fail */
+                free_arch_std_events();
+                return 1;
+        } else if (rc) {
+                goto empty_map;
+        }
+
         rc = nftw(ldirname, process_one_file, maxfds, 0);
         if (rc && verbose) {
                 pr_info("%s: Error walking file tree %s\n", prog, ldirname);
                 goto empty_map;
         } else if (rc < 0) {
                 /* Make build fail */
+                free_arch_std_events();
                 return 1;
         } else if (rc) {
                 goto empty_map;
@@ -958,5 +1152,6 @@ int main(int argc, char *argv[])
 empty_map:
         fclose(eventsfp);
         create_empty_mapping(output_file);
+        free_arch_std_events();
         return 0;
 }
diff --git a/tools/perf/python/twatch.py b/tools/perf/python/twatch.py
index c235c22b107a..0a29c5c3079f 100755
--- a/tools/perf/python/twatch.py
+++ b/tools/perf/python/twatch.py
@@ -42,10 +42,10 @@ def main(context_switch = 0, thread = -1):
                         event = evlist.read_on_cpu(cpu)
                         if not event:
                                 continue
-                        print "cpu: %2d, pid: %4d, tid: %4d" % (event.sample_cpu,
-                                                                event.sample_pid,
-                                                                event.sample_tid),
-                        print event
+                        print("cpu: {0}, pid: {1}, tid: {2} {3}".format(event.sample_cpu,
+                                                                        event.sample_pid,
+                                                                        event.sample_tid,
+                                                                        event))
 
 if __name__ == '__main__':
     """
diff --git a/tools/perf/scripts/python/Perf-Trace-Util/Context.c b/tools/perf/scripts/python/Perf-Trace-Util/Context.c
index fcd1dd667906..1a0d27757eec 100644
--- a/tools/perf/scripts/python/Perf-Trace-Util/Context.c
+++ b/tools/perf/scripts/python/Perf-Trace-Util/Context.c
@@ -23,7 +23,17 @@
 #include "../../../perf.h"
 #include "../../../util/trace-event.h"
 
+#if PY_MAJOR_VERSION < 3
+#define _PyCapsule_GetPointer(arg1, arg2) \
+  PyCObject_AsVoidPtr(arg1)
+
 PyMODINIT_FUNC initperf_trace_context(void);
+#else
+#define _PyCapsule_GetPointer(arg1, arg2) \
+  PyCapsule_GetPointer((arg1), (arg2))
+
+PyMODINIT_FUNC PyInit_perf_trace_context(void);
+#endif
 
 static PyObject *perf_trace_context_common_pc(PyObject *obj, PyObject *args)
 {
@@ -34,7 +44,7 @@ static PyObject *perf_trace_context_common_pc(PyObject *obj, PyObject *args)
         if (!PyArg_ParseTuple(args, "O", &context))
                 return NULL;
 
-        scripting_context = PyCObject_AsVoidPtr(context);
+        scripting_context = _PyCapsule_GetPointer(context, NULL);
         retval = common_pc(scripting_context);
 
         return Py_BuildValue("i", retval);
@@ -50,7 +60,7 @@ static PyObject *perf_trace_context_common_flags(PyObject *obj,
         if (!PyArg_ParseTuple(args, "O", &context))
                 return NULL;
 
-        scripting_context = PyCObject_AsVoidPtr(context);
+        scripting_context = _PyCapsule_GetPointer(context, NULL);
         retval = common_flags(scripting_context);
 
         return Py_BuildValue("i", retval);
@@ -66,7 +76,7 @@ static PyObject *perf_trace_context_common_lock_depth(PyObject *obj,
         if (!PyArg_ParseTuple(args, "O", &context))
                 return NULL;
 
-        scripting_context = PyCObject_AsVoidPtr(context);
+        scripting_context = _PyCapsule_GetPointer(context, NULL);
         retval = common_lock_depth(scripting_context);
 
         return Py_BuildValue("i", retval);
@@ -82,7 +92,25 @@ static PyMethodDef ContextMethods[] = {
         { NULL, NULL, 0, NULL}
 };
 
+#if PY_MAJOR_VERSION < 3
 PyMODINIT_FUNC initperf_trace_context(void)
 {
         (void) Py_InitModule("perf_trace_context", ContextMethods);
 }
+#else
+PyMODINIT_FUNC PyInit_perf_trace_context(void)
+{
+        static struct PyModuleDef moduledef = {
+                PyModuleDef_HEAD_INIT,
+                "perf_trace_context",   /* m_name */
+                "",                     /* m_doc */
+                -1,                     /* m_size */
+                ContextMethods,         /* m_methods */
+                NULL,                   /* m_reload */
+                NULL,                   /* m_traverse */
+                NULL,                   /* m_clear */
+                NULL,                   /* m_free */
+        };
+        return PyModule_Create(&moduledef);
+}
+#endif
diff --git a/tools/perf/tests/Build b/tools/perf/tests/Build
index 87bf3edb037c..6c108fa79ae3 100644
--- a/tools/perf/tests/Build
+++ b/tools/perf/tests/Build
@@ -20,6 +20,7 @@ perf-y += hists_cumulate.o
 perf-y += python-use.o
 perf-y += bp_signal.o
 perf-y += bp_signal_overflow.o
+perf-y += bp_account.o
 perf-y += task-exit.o
 perf-y += sw-clock.o
 perf-y += mmap-thread-lookup.o
@@ -47,6 +48,7 @@ perf-y += bitmap.o
 perf-y += perf-hooks.o
 perf-y += clang.o
 perf-y += unit_number__scnprintf.o
+perf-y += mem2node.o
 
 $(OUTPUT)tests/llvm-src-base.c: tests/bpf-script-example.c tests/Build
         $(call rule_mkdir)
diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c
index 97f64ad7fa08..05dfe11c2f9e 100644
--- a/tools/perf/tests/attr.c
+++ b/tools/perf/tests/attr.c
@@ -170,8 +170,8 @@ static int run_dir(const char *d, const char *perf)
         if (verbose > 0)
                 vcnt++;
 
-        snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
-                 d, d, perf, vcnt, v);
+        scnprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
+                  d, d, perf, vcnt, v);
 
         return system(cmd) ? TEST_FAIL : TEST_OK;
 }
diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
index f906b793196f..8a33ca4f9e1f 100644
--- a/tools/perf/tests/attr/test-record-group-sampling
+++ b/tools/perf/tests/attr/test-record-group-sampling
@@ -35,3 +35,6 @@ inherit=0
 # sampling disabled
 sample_freq=0
 sample_period=0
+freq=0
+write_backward=0
+sample_id_all=0
diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c
index e0b1b414d466..6d598cc071ae 100644
--- a/tools/perf/tests/backward-ring-buffer.c
+++ b/tools/perf/tests/backward-ring-buffer.c
@@ -33,10 +33,9 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
         for (i = 0; i < evlist->nr_mmaps; i++) {
                 struct perf_mmap *map = &evlist->overwrite_mmap[i];
                 union perf_event *event;
-                u64 start, end;
 
-                perf_mmap__read_init(map, true, &start, &end);
-                while ((event = perf_mmap__read_event(map, true, &start, end)) != NULL) {
+                perf_mmap__read_init(map);
+                while ((event = perf_mmap__read_event(map)) != NULL) {
                         const u32 type = event->header.type;
 
                         switch (type) {
diff --git a/tools/perf/tests/bp_account.c b/tools/perf/tests/bp_account.c
new file mode 100644
index 000000000000..a20cbc445426
--- /dev/null
+++ b/tools/perf/tests/bp_account.c
@@ -0,0 +1,193 @@
+/*
+ * Powerpc needs __SANE_USERSPACE_TYPES__ before <linux/types.h> to select
+ * 'int-ll64.h' and avoid compile warnings when printing __u64 with %llu.
+ */
+#define __SANE_USERSPACE_TYPES__
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <time.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <sys/mman.h>
+#include <linux/compiler.h>
+#include <linux/hw_breakpoint.h>
+#include <sys/ioctl.h>
+
+#include "tests.h"
+#include "debug.h"
+#include "perf.h"
+#include "cloexec.h"
+
+volatile long the_var;
+
+static noinline int test_function(void)
+{
+        return 0;
+}
+
+static int __event(bool is_x, void *addr, struct perf_event_attr *attr)
+{
+        int fd;
+
+        memset(attr, 0, sizeof(struct perf_event_attr));
+        attr->type = PERF_TYPE_BREAKPOINT;
+        attr->size = sizeof(struct perf_event_attr);
+
+        attr->config = 0;
+        attr->bp_type = is_x ? HW_BREAKPOINT_X : HW_BREAKPOINT_W;
+        attr->bp_addr = (unsigned long) addr;
+        attr->bp_len = sizeof(long);
+
+        attr->sample_period = 1;
+        attr->sample_type = PERF_SAMPLE_IP;
+
+        attr->exclude_kernel = 1;
+        attr->exclude_hv = 1;
+
+        fd = sys_perf_event_open(attr, -1, 0, -1,
+                                 perf_event_open_cloexec_flag());
+        if (fd < 0) {
+                pr_debug("failed opening event %llx\n", attr->config);
+                return TEST_FAIL;
+        }
+
+        return fd;
+}
+
+static int wp_event(void *addr, struct perf_event_attr *attr)
+{
+        return __event(false, addr, attr);
+}
+
+static int bp_event(void *addr, struct perf_event_attr *attr)
+{
+        return __event(true, addr, attr);
+}
+
+static int bp_accounting(int wp_cnt, int share)
+{
+        struct perf_event_attr attr, attr_mod, attr_new;
+        int i, fd[wp_cnt], fd_wp, ret;
+
+        for (i = 0; i < wp_cnt; i++) {
+                fd[i] = wp_event((void *)&the_var, &attr);
+                TEST_ASSERT_VAL("failed to create wp\n", fd[i] != -1);
+                pr_debug("wp %d created\n", i);
+        }
+
+        attr_mod = attr;
+        attr_mod.bp_type = HW_BREAKPOINT_X;
+        attr_mod.bp_addr = (unsigned long) test_function;
+
+        ret = ioctl(fd[0], PERF_EVENT_IOC_MODIFY_ATTRIBUTES, &attr_mod);
+        TEST_ASSERT_VAL("failed to modify wp\n", ret == 0);
+
+        pr_debug("wp 0 modified to bp\n");
+
+        if (!share) {
+                fd_wp = wp_event((void *)&the_var, &attr_new);
+                TEST_ASSERT_VAL("failed to create max wp\n", fd_wp != -1);
+                pr_debug("wp max created\n");
+        }
+
+        for (i = 0; i < wp_cnt; i++)
+                close(fd[i]);
+
+        return 0;
+}
+
+static int detect_cnt(bool is_x)
+{
+        struct perf_event_attr attr;
+        void *addr = is_x ? (void *)test_function : (void *)&the_var;
+        int fd[100], cnt = 0, i;
+
+        while (1) {
+                if (cnt == 100) {
+                        pr_debug("way too many debug registers, fix the test\n");
+                        return 0;
+                }
+                fd[cnt] = __event(is_x, addr, &attr);
+
+                if (fd[cnt] < 0)
+                        break;
+                cnt++;
+        }
+
+        for (i = 0; i < cnt; i++)
+                close(fd[i]);
+
+        return cnt;
+}
+
+static int detect_ioctl(void)
+{
+        struct perf_event_attr attr;
+        int fd, ret = 1;
+
+        fd = wp_event((void *) &the_var, &attr);
+        if (fd > 0) {
+                ret = ioctl(fd, PERF_EVENT_IOC_MODIFY_ATTRIBUTES, &attr);
+                close(fd);
+        }
+
+        return ret ? 0 : 1;
+}
+
+static int detect_share(int wp_cnt, int bp_cnt)
+{
+        struct perf_event_attr attr;
+        int i, fd[wp_cnt + bp_cnt], ret;
+
+        for (i = 0; i < wp_cnt; i++) {
+                fd[i] = wp_event((void *)&the_var, &attr);
+                TEST_ASSERT_VAL("failed to create wp\n", fd[i] != -1);
+        }
+
+        for (; i < (bp_cnt + wp_cnt); i++) {
+                fd[i] = bp_event((void *)test_function, &attr);
+                if (fd[i] == -1)
+                        break;
+        }
+
+        ret = i != (bp_cnt + wp_cnt);
+
+        while (i--)
+                close(fd[i]);
+
+        return ret;
+}
+
+/*
+ * This test does following:
+ *   - detects the number of watch/break-points,
+ *     skip test if any is missing
+ *   - detects PERF_EVENT_IOC_MODIFY_ATTRIBUTES ioctl,
+ *     skip test if it's missing
+ *   - detects if watchpoints and breakpoints share
+ *     same slots
+ *   - create all possible watchpoints on cpu 0
+ *   - change one of it to breakpoint
+ *   - in case wp and bp do not share slots,
+ *     we create another watchpoint to ensure
+ *     the slot accounting is correct
+ */
+int test__bp_accounting(struct test *test __maybe_unused, int subtest __maybe_unused)
+{
+        int has_ioctl = detect_ioctl();
+        int wp_cnt = detect_cnt(false);
+        int bp_cnt = detect_cnt(true);
+        int share  = detect_share(wp_cnt, bp_cnt);
+
+        pr_debug("watchpoints count %d, breakpoints count %d, has_ioctl %d, share %d\n",
+                 wp_cnt, bp_cnt, has_ioctl, share);
+
+        if (!wp_cnt || !bp_cnt || !has_ioctl)
+                return TEST_SKIP;
+
+        return bp_accounting(wp_cnt, share);
+}
diff --git a/tools/perf/tests/bpf-script-example.c b/tools/perf/tests/bpf-script-example.c
index e4123c1b0e88..1ca5106df5f1 100644
--- a/tools/perf/tests/bpf-script-example.c
+++ b/tools/perf/tests/bpf-script-example.c
@@ -31,7 +31,7 @@ struct bpf_map_def SEC("maps") flip_table = {
         .max_entries = 1,
 };
 
-SEC("func=SyS_epoll_pwait")
+SEC("func=do_epoll_wait")
 int bpf_func__SyS_epoll_pwait(void *ctx)
 {
         int ind =0;
diff --git a/tools/perf/tests/bpf-script-test-kbuild.c b/tools/perf/tests/bpf-script-test-kbuild.c
index 3626924740d8..ff3ec8337f0a 100644
--- a/tools/perf/tests/bpf-script-test-kbuild.c
+++ b/tools/perf/tests/bpf-script-test-kbuild.c
@@ -9,7 +9,6 @@
 #define SEC(NAME) __attribute__((section(NAME), used))
 
 #include <uapi/linux/fs.h>
-#include <uapi/asm/ptrace.h>
 
 SEC("func=vfs_llseek")
 int bpf_func__vfs_llseek(void *ctx)
diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c
index e8399beca62b..79b54f8ddebf 100644
--- a/tools/perf/tests/bpf.c
+++ b/tools/perf/tests/bpf.c
@@ -176,13 +176,19 @@ static int do_test(struct bpf_object *obj, int (*func)(void),
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
                 union perf_event *event;
+                struct perf_mmap *md;
 
-                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                md = &evlist->mmap[i];
+                if (perf_mmap__read_init(md) < 0)
+                        continue;
+
+                while ((event = perf_mmap__read_event(md)) != NULL) {
                         const u32 type = event->header.type;
 
                         if (type == PERF_RECORD_SAMPLE)
                                 count ++;
                 }
+                perf_mmap__read_done(md);
         }
 
         if (count != expect) {
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index fafa014240cd..cac8f8889bc3 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -116,6 +116,11 @@ static struct test generic_tests[] = {
                 .is_supported = test__bp_signal_is_supported,
         },
         {
+                .desc = "Breakpoint accounting",
+                .func = test__bp_accounting,
+                .is_supported = test__bp_signal_is_supported,
+        },
+        {
                 .desc = "Number of exit events of a simple workload",
                 .func = test__task_exit,
         },
@@ -271,6 +276,10 @@ static struct test generic_tests[] = {
                 .func = test__unit_number__scnprint,
         },
         {
+                .desc = "mem2node",
+                .func = test__mem2node,
+        },
+        {
                 .func = NULL,
         },
 };
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 3bf7b145b826..99936352df4f 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -409,15 +409,21 @@ static int process_events(struct machine *machine, struct perf_evlist *evlist,
                           struct state *state)
 {
         union perf_event *event;
+        struct perf_mmap *md;
         int i, ret;
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
-                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                md = &evlist->mmap[i];
+                if (perf_mmap__read_init(md) < 0)
+                        continue;
+
+                while ((event = perf_mmap__read_event(md)) != NULL) {
                         ret = process_event(machine, evlist, event, state);
-                        perf_evlist__mmap_consume(evlist, i);
+                        perf_mmap__consume(md);
                         if (ret < 0)
                                 return ret;
                 }
+                perf_mmap__read_done(md);
         }
         return 0;
 }
@@ -482,6 +488,34 @@ static void fs_something(void)
         }
 }
 
+static const char *do_determine_event(bool excl_kernel)
+{
+        const char *event = excl_kernel ? "cycles:u" : "cycles";
+
+#ifdef __s390x__
+        char cpuid[128], model[16], model_c[16], cpum_cf_v[16];
+        unsigned int family;
+        int ret, cpum_cf_a;
+
+        if (get_cpuid(cpuid, sizeof(cpuid)))
+                goto out_clocks;
+        ret = sscanf(cpuid, "%*[^,],%u,%[^,],%[^,],%[^,],%x", &family, model_c,
+                     model, cpum_cf_v, &cpum_cf_a);
+        if (ret != 5)            /* Not available */
+                goto out_clocks;
+        if (excl_kernel && (cpum_cf_a & 4))
+                return event;
+        if (!excl_kernel && (cpum_cf_a & 2))
+                return event;
+
+        /* Fall through: missing authorization */
+out_clocks:
+        event = excl_kernel ? "cpu-clock:u" : "cpu-clock";
+
+#endif
+        return event;
+}
+
 static void do_something(void)
 {
         fs_something();
@@ -592,10 +626,7 @@ static int do_test_code_reading(bool try_kcore)
 
                 perf_evlist__set_maps(evlist, cpus, threads);
 
-                if (excl_kernel)
-                        str = "cycles:u";
-                else
-                        str = "cycles";
+                str = do_determine_event(excl_kernel);
                 pr_debug("Parsing event '%s'\n", str);
                 ret = parse_events(evlist, str, NULL);
                 if (ret < 0) {
diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c
index 260418969120..2f008067d989 100644
--- a/tools/perf/tests/dwarf-unwind.c
+++ b/tools/perf/tests/dwarf-unwind.c
@@ -37,6 +37,19 @@ static int init_live_machine(struct machine *machine)
                                                   mmap_handler, machine, true, 500);
 }
 
+/*
+ * We need to keep these functions global, despite the
+ * fact that they are used only locally in this object,
+ * in order to keep them around even if the binary is
+ * stripped. If they are gone, the unwind check for
+ * symbol fails.
+ */
+int test_dwarf_unwind__thread(struct thread *thread);
+int test_dwarf_unwind__compare(void *p1, void *p2);
+int test_dwarf_unwind__krava_3(struct thread *thread);
+int test_dwarf_unwind__krava_2(struct thread *thread);
+int test_dwarf_unwind__krava_1(struct thread *thread);
+
 #define MAX_STACK 8
 
 static int unwind_entry(struct unwind_entry *entry, void *arg)
@@ -45,12 +58,12 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)
         char *symbol = entry->sym ? entry->sym->name : NULL;
         static const char *funcs[MAX_STACK] = {
                 "test__arch_unwind_sample",
-                "unwind_thread",
-                "compare",
+                "test_dwarf_unwind__thread",
+                "test_dwarf_unwind__compare",
                 "bsearch",
-                "krava_3",
-                "krava_2",
-                "krava_1",
+                "test_dwarf_unwind__krava_3",
+                "test_dwarf_unwind__krava_2",
+                "test_dwarf_unwind__krava_1",
                 "test__dwarf_unwind"
         };
         /*
@@ -77,7 +90,7 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)
         return strcmp((const char *) symbol, funcs[idx]);
 }
 
-static noinline int unwind_thread(struct thread *thread)
+noinline int test_dwarf_unwind__thread(struct thread *thread)
 {
         struct perf_sample sample;
         unsigned long cnt = 0;
@@ -108,7 +121,7 @@ static noinline int unwind_thread(struct thread *thread)
 
 static int global_unwind_retval = -INT_MAX;
 
-static noinline int compare(void *p1, void *p2)
+noinline int test_dwarf_unwind__compare(void *p1, void *p2)
 {
         /* Any possible value should be 'thread' */
         struct thread *thread = *(struct thread **)p1;
@@ -117,17 +130,17 @@ static noinline int compare(void *p1, void *p2)
                 /* Call unwinder twice for both callchain orders. */
                 callchain_param.order = ORDER_CALLER;
 
-                global_unwind_retval = unwind_thread(thread);
+                global_unwind_retval = test_dwarf_unwind__thread(thread);
                 if (!global_unwind_retval) {
                         callchain_param.order = ORDER_CALLEE;
-                        global_unwind_retval = unwind_thread(thread);
+                        global_unwind_retval = test_dwarf_unwind__thread(thread);
                 }
         }
 
         return p1 - p2;
 }
 
-static noinline int krava_3(struct thread *thread)
+noinline int test_dwarf_unwind__krava_3(struct thread *thread)
 {
         struct thread *array[2] = {thread, thread};
         void *fp = &bsearch;
@@ -141,18 +154,19 @@ static noinline int krava_3(struct thread *thread)
                         size_t, int (*)(void *, void *));
 
         _bsearch = fp;
-        _bsearch(array, &thread, 2, sizeof(struct thread **), compare);
+        _bsearch(array, &thread, 2, sizeof(struct thread **),
+                 test_dwarf_unwind__compare);
         return global_unwind_retval;
 }
 
-static noinline int krava_2(struct thread *thread)
+noinline int test_dwarf_unwind__krava_2(struct thread *thread)
 {
-        return krava_3(thread);
+        return test_dwarf_unwind__krava_3(thread);
 }
 
-static noinline int krava_1(struct thread *thread)
+noinline int test_dwarf_unwind__krava_1(struct thread *thread)
 {
-        return krava_2(thread);
+        return test_dwarf_unwind__krava_2(thread);
 }
 
 int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unused)
@@ -189,7 +203,7 @@ int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unu
                 goto out;
         }
 
-        err = krava_1(thread);
+        err = test_dwarf_unwind__krava_1(thread);
         thread__put(thread);
 
  out:
diff --git a/tools/perf/tests/keep-tracking.c b/tools/perf/tests/keep-tracking.c
index c46530918938..17c46f3e6f1e 100644
--- a/tools/perf/tests/keep-tracking.c
+++ b/tools/perf/tests/keep-tracking.c
@@ -27,18 +27,23 @@
 static int find_comm(struct perf_evlist *evlist, const char *comm)
 {
         union perf_event *event;
+        struct perf_mmap *md;
         int i, found;
 
         found = 0;
         for (i = 0; i < evlist->nr_mmaps; i++) {
-                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                md = &evlist->mmap[i];
+                if (perf_mmap__read_init(md) < 0)
+                        continue;
+                while ((event = perf_mmap__read_event(md)) != NULL) {
                         if (event->header.type == PERF_RECORD_COMM &&
                             (pid_t)event->comm.pid == getpid() &&
                             (pid_t)event->comm.tid == getpid() &&
                             strcmp(event->comm.comm, comm) == 0)
                                 found += 1;
-                        perf_evlist__mmap_consume(evlist, i);
+                        perf_mmap__consume(md);
                 }
+                perf_mmap__read_done(md);
         }
         return found;
 }
diff --git a/tools/perf/tests/mem.c b/tools/perf/tests/mem.c
index 21952e1e6e6d..0f82ee9fd3f7 100644
--- a/tools/perf/tests/mem.c
+++ b/tools/perf/tests/mem.c
@@ -16,7 +16,7 @@ static int check(union perf_mem_data_src data_src,
 
         n = perf_mem__snp_scnprintf(out, sizeof out, &mi);
         n += perf_mem__lvl_scnprintf(out + n, sizeof out - n, &mi);
-        snprintf(failure, sizeof failure, "unexpected %s", out);
+        scnprintf(failure, sizeof failure, "unexpected %s", out);
         TEST_ASSERT_VAL(failure, !strcmp(string, out));
         return 0;
 }
diff --git a/tools/perf/tests/mem2node.c b/tools/perf/tests/mem2node.c
new file mode 100644
index 000000000000..0c3c87f86e03
--- /dev/null
+++ b/tools/perf/tests/mem2node.c
@@ -0,0 +1,75 @@
+#include <linux/compiler.h>
+#include <linux/bitmap.h>
+#include "cpumap.h"
+#include "mem2node.h"
+#include "tests.h"
+
+static struct node {
+        int              node;
+        const char      *map;
+} test_nodes[] = {
+        { .node = 0, .map = "0"     },
+        { .node = 1, .map = "1-2"   },
+        { .node = 3, .map = "5-7,9" },
+};
+
+#define T TEST_ASSERT_VAL
+
+static unsigned long *get_bitmap(const char *str, int nbits)
+{
+        struct cpu_map *map = cpu_map__new(str);
+        unsigned long *bm = NULL;
+        int i;
+
+        bm = bitmap_alloc(nbits);
+
+        if (map && bm) {
+                bitmap_zero(bm, nbits);
+
+                for (i = 0; i < map->nr; i++) {
+                        set_bit(map->map[i], bm);
+                }
+        }
+
+        if (map)
+                cpu_map__put(map);
+        else
+                free(bm);
+
+        return bm && map ? bm : NULL;
+}
+
+int test__mem2node(struct test *t __maybe_unused, int subtest __maybe_unused)
+{
+        struct mem2node map;
+        struct memory_node nodes[3];
+        struct perf_env env = {
+                .memory_nodes    = (struct memory_node *) &nodes[0],
+                .nr_memory_nodes = ARRAY_SIZE(nodes),
+                .memory_bsize    = 0x100,
+        };
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(nodes); i++) {
+                nodes[i].node = test_nodes[i].node;
+                nodes[i].size = 10;
+
+                T("failed: alloc bitmap",
+                  (nodes[i].set = get_bitmap(test_nodes[i].map, 10)));
+        }
+
+        T("failed: mem2node__init", !mem2node__init(&map, &env));
+        T("failed: mem2node__node",  0 == mem2node__node(&map,   0x50));
+        T("failed: mem2node__node",  1 == mem2node__node(&map,  0x100));
+        T("failed: mem2node__node",  1 == mem2node__node(&map,  0x250));
+        T("failed: mem2node__node",  3 == mem2node__node(&map,  0x500));
+        T("failed: mem2node__node",  3 == mem2node__node(&map,  0x650));
+        T("failed: mem2node__node", -1 == mem2node__node(&map,  0x450));
+        T("failed: mem2node__node", -1 == mem2node__node(&map, 0x1050));
+
+        for (i = 0; i < ARRAY_SIZE(nodes); i++)
+                free(nodes[i].set);
+
+        mem2node__exit(&map);
+        return 0;
+}
diff --git a/tools/perf/tests/mmap-basic.c b/tools/perf/tests/mmap-basic.c
index c0e971da965c..0919b0793e5b 100644
--- a/tools/perf/tests/mmap-basic.c
+++ b/tools/perf/tests/mmap-basic.c
@@ -38,6 +38,7 @@ int test__basic_mmap(struct test *test __maybe_unused, int subtest __maybe_unuse
                      expected_nr_events[nsyscalls], i, j;
         struct perf_evsel *evsels[nsyscalls], *evsel;
         char sbuf[STRERR_BUFSIZE];
+        struct perf_mmap *md;
 
         threads = thread_map__new(-1, getpid(), UINT_MAX);
         if (threads == NULL) {
@@ -74,7 +75,7 @@ int test__basic_mmap(struct test *test __maybe_unused, int subtest __maybe_unuse
                 snprintf(name, sizeof(name), "sys_enter_%s", syscall_names[i]);
                 evsels[i] = perf_evsel__newtp("syscalls", name);
                 if (IS_ERR(evsels[i])) {
-                        pr_debug("perf_evsel__new\n");
+                        pr_debug("perf_evsel__new(%s)\n", name);
                         goto out_delete_evlist;
                 }
 
@@ -106,7 +107,11 @@ int test__basic_mmap(struct test *test __maybe_unused, int subtest __maybe_unuse
                         ++foo;
                 }
 
-        while ((event = perf_evlist__mmap_read(evlist, 0)) != NULL) {
+        md = &evlist->mmap[0];
+        if (perf_mmap__read_init(md) < 0)
+                goto out_init;
+
+        while ((event = perf_mmap__read_event(md)) != NULL) {
                 struct perf_sample sample;
 
                 if (event->header.type != PERF_RECORD_SAMPLE) {
@@ -129,9 +134,11 @@ int test__basic_mmap(struct test *test __maybe_unused, int subtest __maybe_unuse
                         goto out_delete_evlist;
                 }
                 nr_events[evsel->idx]++;
-                perf_evlist__mmap_consume(evlist, 0);
+                perf_mmap__consume(md);
         }
+        perf_mmap__read_done(md);
 
+out_init:
         err = 0;
         evlist__for_each_entry(evlist, evsel) {
                 if (nr_events[evsel->idx] != expected_nr_events[evsel->idx]) {
diff --git a/tools/perf/tests/openat-syscall-tp-fields.c b/tools/perf/tests/openat-syscall-tp-fields.c
index 43519267b93b..344dc3ac2469 100644
--- a/tools/perf/tests/openat-syscall-tp-fields.c
+++ b/tools/perf/tests/openat-syscall-tp-fields.c
@@ -86,8 +86,13 @@ int test__syscall_openat_tp_fields(struct test *test __maybe_unused, int subtest
 
                 for (i = 0; i < evlist->nr_mmaps; i++) {
                         union perf_event *event;
+                        struct perf_mmap *md;
 
-                        while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                        md = &evlist->mmap[i];
+                        if (perf_mmap__read_init(md) < 0)
+                                continue;
+
+                        while ((event = perf_mmap__read_event(md)) != NULL) {
                                 const u32 type = event->header.type;
                                 int tp_flags;
                                 struct perf_sample sample;
@@ -95,7 +100,7 @@ int test__syscall_openat_tp_fields(struct test *test __maybe_unused, int subtest
                                 ++nr_events;
 
                                 if (type != PERF_RECORD_SAMPLE) {
-                                        perf_evlist__mmap_consume(evlist, i);
+                                        perf_mmap__consume(md);
                                         continue;
                                 }
 
@@ -115,6 +120,7 @@ int test__syscall_openat_tp_fields(struct test *test __maybe_unused, int subtest
 
                                 goto out_ok;
                         }
+                        perf_mmap__read_done(md);
                 }
 
                 if (nr_events == before)
diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
index 0afafab85238..34394cc05077 100644
--- a/tools/perf/tests/perf-record.c
+++ b/tools/perf/tests/perf-record.c
@@ -164,8 +164,13 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
 
                 for (i = 0; i < evlist->nr_mmaps; i++) {
                         union perf_event *event;
+                        struct perf_mmap *md;
 
-                        while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                        md = &evlist->mmap[i];
+                        if (perf_mmap__read_init(md) < 0)
+                                continue;
+
+                        while ((event = perf_mmap__read_event(md)) != NULL) {
                                 const u32 type = event->header.type;
                                 const char *name = perf_event__name(type);
 
@@ -266,8 +271,9 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
                                         ++errs;
                                 }
 
-                                perf_evlist__mmap_consume(evlist, i);
+                                perf_mmap__consume(md);
                         }
+                        perf_mmap__read_done(md);
                 }
 
                 /*
diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
index 9abca267afa9..7bedf8608fdd 100644
--- a/tools/perf/tests/pmu.c
+++ b/tools/perf/tests/pmu.c
@@ -98,7 +98,7 @@ static char *test_format_dir_get(void)
                 struct test_format *format = &test_formats[i];
                 FILE *file;
 
-                snprintf(name, PATH_MAX, "%s/%s", dir, format->name);
+                scnprintf(name, PATH_MAX, "%s/%s", dir, format->name);
 
                 file = fopen(name, "w");
                 if (!file)
diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
index 30a950c9d407..1c16e56cd93e 100644
--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
@@ -5,7 +5,7 @@ had_vfs_getname=$?
 
 cleanup_probe_vfs_getname() {
         if [ $had_vfs_getname -eq 1 ] ; then
-                perf probe -q -d probe:vfs_getname
+                perf probe -q -d probe:vfs_getname*
         fi
 }
 
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
index c446c894b297..ee86473643be 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
@@ -15,30 +15,26 @@ nm -g $libc 2>/dev/null | fgrep -q inet_pton || exit 254
 
 trace_libc_inet_pton_backtrace() {
         idx=0
-        expected[0]="PING.*bytes"
-        expected[1]="64 bytes from ::1.*"
-        expected[2]=".*ping statistics.*"
-        expected[3]=".*packets transmitted.*"
-        expected[4]="rtt min.*"
-        expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
-        expected[6]=".*inet_pton[[:space:]]\($libc\)$"
+        expected[0]="ping[][0-9 \.:]+probe_libc:inet_pton: \([[:xdigit:]]+\)"
+        expected[1]=".*inet_pton[[:space:]]\($libc|inlined\)$"
         case "$(uname -m)" in
         s390x)
-                eventattr='call-graph=dwarf'
-                expected[7]="gaih_inet[[:space:]]\(inlined\)$"
-                expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$"
-                expected[9]="main[[:space:]]\(.*/bin/ping.*\)$"
-                expected[10]="__libc_start_main[[:space:]]\($libc\)$"
-                expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$"
+                eventattr='call-graph=dwarf,max-stack=4'
+                expected[2]="gaih_inet.*[[:space:]]\($libc|inlined\)$"
+                expected[3]="(__GI_)?getaddrinfo[[:space:]]\($libc|inlined\)$"
+                expected[4]="main[[:space:]]\(.*/bin/ping.*\)$"
                 ;;
         *)
                 eventattr='max-stack=3'
-                expected[7]="getaddrinfo[[:space:]]\($libc\)$"
-                expected[8]=".*\(.*/bin/ping.*\)$"
+                expected[2]="getaddrinfo[[:space:]]\($libc\)$"
+                expected[3]=".*\(.*/bin/ping.*\)$"
                 ;;
         esac
 
-        perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
+        file=`mktemp -u /tmp/perf.data.XXX`
+
+        perf record -e probe_libc:inet_pton/$eventattr/ -o $file ping -6 -c 1 ::1 > /dev/null 2>&1
+        perf script -i $file | while read line ; do
                 echo $line
                 echo "$line" | egrep -q "${expected[$idx]}"
                 if [ $? -ne 0 ] ; then
@@ -48,6 +44,11 @@ trace_libc_inet_pton_backtrace() {
                 let idx+=1
                 [ -z "${expected[$idx]}" ] && break
         done
+
+        # If any statements are executed from this point onwards,
+        # the exit code of the last among these will be reflected
+        # in err below. If the exit code is 0, the test will pass
+        # even if the perf script output does not match.
 }
 
 # Check for IPv6 interface existence
diff --git a/tools/perf/tests/sw-clock.c b/tools/perf/tests/sw-clock.c
index f6c72f915d48..f9490b237893 100644
--- a/tools/perf/tests/sw-clock.c
+++ b/tools/perf/tests/sw-clock.c
@@ -39,6 +39,7 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
         };
         struct cpu_map *cpus;
         struct thread_map *threads;
+        struct perf_mmap *md;
 
         attr.sample_freq = 500;
 
@@ -93,7 +94,11 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
 
         perf_evlist__disable(evlist);
 
-        while ((event = perf_evlist__mmap_read(evlist, 0)) != NULL) {
+        md = &evlist->mmap[0];
+        if (perf_mmap__read_init(md) < 0)
+                goto out_init;
+
+        while ((event = perf_mmap__read_event(md)) != NULL) {
                 struct perf_sample sample;
 
                 if (event->header.type != PERF_RECORD_SAMPLE)
@@ -108,9 +113,11 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                 total_periods += sample.period;
                 nr_samples++;
 next_event:
-                perf_evlist__mmap_consume(evlist, 0);
+                perf_mmap__consume(md);
         }
+        perf_mmap__read_done(md);
 
+out_init:
         if ((u64) nr_samples == total_periods) {
                 pr_debug("All (%d) samples have period value of 1!\n",
                          nr_samples);
diff --git a/tools/perf/tests/switch-tracking.c b/tools/perf/tests/switch-tracking.c
index 33e00295a972..9b5be51e5e7b 100644
--- a/tools/perf/tests/switch-tracking.c
+++ b/tools/perf/tests/switch-tracking.c
@@ -258,16 +258,22 @@ static int process_events(struct perf_evlist *evlist,
         unsigned pos, cnt = 0;
         LIST_HEAD(events);
         struct event_node *events_array, *node;
+        struct perf_mmap *md;
         int i, ret;
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
-                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
+                md = &evlist->mmap[i];
+                if (perf_mmap__read_init(md) < 0)
+                        continue;
+
+                while ((event = perf_mmap__read_event(md)) != NULL) {
                         cnt += 1;
                         ret = add_event(evlist, &events, event);
-                        perf_evlist__mmap_consume(evlist, i);
+                         perf_mmap__consume(md);
                         if (ret < 0)
                                 goto out_free_nodes;
                 }
+                perf_mmap__read_done(md);
         }
 
         events_array = calloc(cnt, sizeof(struct event_node));
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 01b62b81751b..e92fa6029ac7 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -47,6 +47,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
         char sbuf[STRERR_BUFSIZE];
         struct cpu_map *cpus;
         struct thread_map *threads;
+        struct perf_mmap *md;
 
         signal(SIGCHLD, sig_handler);
 
@@ -110,13 +111,19 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
         perf_evlist__start_workload(evlist);
 
 retry:
-        while ((event = perf_evlist__mmap_read(evlist, 0)) != NULL) {
+        md = &evlist->mmap[0];
+        if (perf_mmap__read_init(md) < 0)
+                goto out_init;
+
+        while ((event = perf_mmap__read_event(md)) != NULL) {
                 if (event->header.type == PERF_RECORD_EXIT)
                         nr_exit++;
 
-                perf_evlist__mmap_consume(evlist, 0);
+                perf_mmap__consume(md);
         }
+        perf_mmap__read_done(md);
 
+out_init:
         if (!exited || !nr_exit) {
                 perf_evlist__poll(evlist, -1);
                 goto retry;
diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h
index 2862b80bc288..a9760e790563 100644
--- a/tools/perf/tests/tests.h
+++ b/tools/perf/tests/tests.h
@@ -58,6 +58,7 @@ int test__hists_link(struct test *test, int subtest);
 int test__python_use(struct test *test, int subtest);
 int test__bp_signal(struct test *test, int subtest);
 int test__bp_signal_overflow(struct test *test, int subtest);
+int test__bp_accounting(struct test *test, int subtest);
 int test__task_exit(struct test *test, int subtest);
 int test__mem(struct test *test, int subtest);
 int test__sw_clock_freq(struct test *test, int subtest);
@@ -102,6 +103,7 @@ int test__clang(struct test *test, int subtest);
 const char *test__clang_subtest_get_desc(int subtest);
 int test__clang_subtest_get_nr(void);
 int test__unit_number__scnprint(struct test *test, int subtest);
+int test__mem2node(struct test *t, int subtest);
 
 bool test__bp_signal_is_supported(void);
 
diff --git a/tools/perf/tests/vmlinux-kallsyms.c b/tools/perf/tests/vmlinux-kallsyms.c
index f6789fb029d6..1e5adb65632a 100644
--- a/tools/perf/tests/vmlinux-kallsyms.c
+++ b/tools/perf/tests/vmlinux-kallsyms.c
@@ -56,7 +56,7 @@ int test__vmlinux_matches_kallsyms(struct test *test __maybe_unused, int subtest
          * be compacted against the list of modules found in the "vmlinux"
          * code and with the one got from /proc/modules from the "kallsyms" code.
          */
-        if (__machine__load_kallsyms(&kallsyms, "/proc/kallsyms", type, true) <= 0) {
+        if (machine__load_kallsyms(&kallsyms, "/proc/kallsyms", type) <= 0) {
                 pr_debug("dso__load_kallsyms ");
                 goto out;
         }
@@ -125,7 +125,7 @@ int test__vmlinux_matches_kallsyms(struct test *test __maybe_unused, int subtest
 
                 if (pair && UM(pair->start) == mem_start) {
 next_pair:
-                        if (strcmp(sym->name, pair->name) == 0) {
+                        if (arch__compare_symbol_names(sym->name, pair->name) == 0) {
                                 /*
                                  * kallsyms don't have the symbol end, so we
                                  * set that by using the next symbol start - 1,
diff --git a/tools/perf/trace/beauty/mmap.c b/tools/perf/trace/beauty/mmap.c
index 417e3ecfe9d7..9f68077b241b 100644
--- a/tools/perf/trace/beauty/mmap.c
+++ b/tools/perf/trace/beauty/mmap.c
@@ -54,6 +54,9 @@ static size_t syscall_arg__scnprintf_mmap_flags(char *bf, size_t size,
         P_MMAP_FLAG(EXECUTABLE);
         P_MMAP_FLAG(FILE);
         P_MMAP_FLAG(FIXED);
+#ifdef MAP_FIXED_NOREPLACE
+        P_MMAP_FLAG(FIXED_NOREPLACE);
+#endif
         P_MMAP_FLAG(GROWSDOWN);
         P_MMAP_FLAG(HUGETLB);
         P_MMAP_FLAG(LOCKED);
diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c
index 63399af3049f..4f75561424ed 100644
--- a/tools/perf/ui/browser.c
+++ b/tools/perf/ui/browser.c
@@ -45,23 +45,33 @@ void ui_browser__set_percent_color(struct ui_browser *browser,
          ui_browser__set_color(browser, color);
 }
 
-void ui_browser__gotorc(struct ui_browser *browser, int y, int x)
+void ui_browser__gotorc_title(struct ui_browser *browser, int y, int x)
 {
         SLsmg_gotorc(browser->y + y, browser->x + x);
 }
 
+void ui_browser__gotorc(struct ui_browser *browser, int y, int x)
+{
+        SLsmg_gotorc(browser->y + y + browser->extra_title_lines, browser->x + x);
+}
+
 void ui_browser__write_nstring(struct ui_browser *browser __maybe_unused, const char *msg,
                                unsigned int width)
 {
         slsmg_write_nstring(msg, width);
 }
 
+void ui_browser__vprintf(struct ui_browser *browser __maybe_unused, const char *fmt, va_list args)
+{
+        slsmg_vprintf(fmt, args);
+}
+
 void ui_browser__printf(struct ui_browser *browser __maybe_unused, const char *fmt, ...)
 {
         va_list args;
 
         va_start(args, fmt);
-        slsmg_vprintf(fmt, args);
+        ui_browser__vprintf(browser, fmt, args);
         va_end(args);
 }
 
@@ -186,6 +196,7 @@ void ui_browser__refresh_dimensions(struct ui_browser *browser)
 {
         browser->width = SLtt_Screen_Cols - 1;
         browser->height = browser->rows = SLtt_Screen_Rows - 2;
+        browser->rows -= browser->extra_title_lines;
         browser->y = 1;
         browser->x = 0;
 }
@@ -332,8 +343,8 @@ static int __ui_browser__refresh(struct ui_browser *browser)
         else
                 width += 1;
 
-        SLsmg_fill_region(browser->y + row, browser->x,
-                          browser->height - row, width, ' ');
+        SLsmg_fill_region(browser->y + row + browser->extra_title_lines, browser->x,
+                          browser->rows - row, width, ' ');
 
         return 0;
 }
@@ -779,6 +790,4 @@ void ui_browser__init(void)
                 struct ui_browser_colorset *c = &ui_browser__colorsets[i++];
                 sltt_set_color(c->colorset, c->name, c->fg, c->bg);
         }
-
-        annotate_browser__init();
 }
diff --git a/tools/perf/ui/browser.h b/tools/perf/ui/browser.h
index 03e1734412b9..aa5932e1d62e 100644
--- a/tools/perf/ui/browser.h
+++ b/tools/perf/ui/browser.h
@@ -3,6 +3,7 @@
 #define _PERF_UI_BROWSER_H_ 1
 
 #include <linux/types.h>
+#include <stdarg.h>
 
 #define HE_COLORSET_TOP         50
 #define HE_COLORSET_MEDIUM      51
@@ -16,6 +17,7 @@ struct ui_browser {
         u64           index, top_idx;
         void          *top, *entries;
         u16           y, x, width, height, rows, columns, horiz_scroll;
+        u8            extra_title_lines;
         int           current_color;
         void          *priv;
         const char    *title;
@@ -37,9 +39,11 @@ bool ui_browser__is_current_entry(struct ui_browser *browser, unsigned row);
 void ui_browser__refresh_dimensions(struct ui_browser *browser);
 void ui_browser__reset_index(struct ui_browser *browser);
 
+void ui_browser__gotorc_title(struct ui_browser *browser, int y, int x);
 void ui_browser__gotorc(struct ui_browser *browser, int y, int x);
 void ui_browser__write_nstring(struct ui_browser *browser, const char *msg,
                                unsigned int width);
+void ui_browser__vprintf(struct ui_browser *browser, const char *fmt, va_list args);
 void ui_browser__printf(struct ui_browser *browser, const char *fmt, ...);
 void ui_browser__write_graph(struct ui_browser *browser, int graph);
 void __ui_browser__line_arrow(struct ui_browser *browser, unsigned int column,
@@ -77,5 +81,4 @@ void ui_browser__list_head_seek(struct ui_browser *browser, off_t offset, int wh
 unsigned int ui_browser__list_head_refresh(struct ui_browser *browser);
 
 void ui_browser__init(void);
-void annotate_browser__init(void);
 #endif /* _PERF_UI_BROWSER_H_ */
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index fbf927cf775d..3781d74088a7 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -9,7 +9,6 @@
 #include "../../util/sort.h"
 #include "../../util/symbol.h"
 #include "../../util/evsel.h"
-#include "../../util/config.h"
 #include "../../util/evlist.h"
 #include <inttypes.h>
 #include <pthread.h>
@@ -22,28 +21,6 @@ struct disasm_line_samples {
         struct sym_hist_entry he;
 };
 
-#define IPC_WIDTH 6
-#define CYCLES_WIDTH 6
-
-struct browser_line {
-        u32     idx;
-        int     idx_asm;
-        int     jump_sources;
-};
-
-static struct annotate_browser_opt {
-        bool hide_src_code,
-             use_offset,
-             jump_arrows,
-             show_linenr,
-             show_nr_jumps,
-             show_nr_samples,
-             show_total_period;
-} annotate_browser__opts = {
-        .use_offset     = true,
-        .jump_arrows    = true,
-};
-
 struct arch;
 
 struct annotate_browser {
@@ -51,245 +28,98 @@ struct annotate_browser {
         struct rb_root              entries;
         struct rb_node             *curr_hot;
         struct annotation_line     *selection;
-        struct annotation_line    **offsets;
         struct arch                *arch;
-        int                         nr_events;
-        u64                         start;
-        int                         nr_asm_entries;
-        int                         nr_entries;
-        int                         max_jump_sources;
-        int                         nr_jumps;
         bool                        searching_backwards;
-        bool                        have_cycles;
-        u8                          addr_width;
-        u8                          jumps_width;
-        u8                          target_width;
-        u8                          min_addr_width;
-        u8                          max_addr_width;
         char                        search_bf[128];
 };
 
-static inline struct browser_line *browser_line(struct annotation_line *al)
+static inline struct annotation *browser__annotation(struct ui_browser *browser)
 {
-        void *ptr = al;
-
-        ptr = container_of(al, struct disasm_line, al);
-        return ptr - sizeof(struct browser_line);
+        struct map_symbol *ms = browser->priv;
+        return symbol__annotation(ms->sym);
 }
 
-static bool disasm_line__filter(struct ui_browser *browser __maybe_unused,
-                                void *entry)
+static bool disasm_line__filter(struct ui_browser *browser, void *entry)
 {
-        if (annotate_browser__opts.hide_src_code) {
-                struct annotation_line *al = list_entry(entry, struct annotation_line, node);
-
-                return al->offset == -1;
-        }
-
-        return false;
+        struct annotation *notes = browser__annotation(browser);
+        struct annotation_line *al = list_entry(entry, struct annotation_line, node);
+        return annotation_line__filter(al, notes);
 }
 
-static int annotate_browser__jumps_percent_color(struct annotate_browser *browser,
-                                                 int nr, bool current)
+static int ui_browser__jumps_percent_color(struct ui_browser *browser, int nr, bool current)
 {
-        if (current && (!browser->b.use_navkeypressed || browser->b.navkeypressed))
+        struct annotation *notes = browser__annotation(browser);
+
+        if (current && (!browser->use_navkeypressed || browser->navkeypressed))
                 return HE_COLORSET_SELECTED;
-        if (nr == browser->max_jump_sources)
+        if (nr == notes->max_jump_sources)
                 return HE_COLORSET_TOP;
         if (nr > 1)
                 return HE_COLORSET_MEDIUM;
         return HE_COLORSET_NORMAL;
 }
 
-static int annotate_browser__set_jumps_percent_color(struct annotate_browser *browser,
-                                                     int nr, bool current)
+static int ui_browser__set_jumps_percent_color(void *browser, int nr, bool current)
 {
-         int color = annotate_browser__jumps_percent_color(browser, nr, current);
-         return ui_browser__set_color(&browser->b, color);
+         int color = ui_browser__jumps_percent_color(browser, nr, current);
+         return ui_browser__set_color(browser, color);
 }
 
-static int annotate_browser__pcnt_width(struct annotate_browser *ab)
+static int annotate_browser__set_color(void *browser, int color)
 {
-        return (annotate_browser__opts.show_total_period ? 12 : 7) * ab->nr_events;
+        return ui_browser__set_color(browser, color);
 }
 
-static int annotate_browser__cycles_width(struct annotate_browser *ab)
+static void annotate_browser__write_graph(void *browser, int graph)
 {
-        return ab->have_cycles ? IPC_WIDTH + CYCLES_WIDTH : 0;
+        ui_browser__write_graph(browser, graph);
 }
 
-static void disasm_line__write(struct disasm_line *dl, struct ui_browser *browser,
-                               char *bf, size_t size)
+static void annotate_browser__set_percent_color(void *browser, double percent, bool current)
 {
-        if (dl->ins.ops && dl->ins.ops->scnprintf) {
-                if (ins__is_jump(&dl->ins)) {
-                        bool fwd = dl->ops.target.offset > dl->al.offset;
-
-                        ui_browser__write_graph(browser, fwd ? SLSMG_DARROW_CHAR :
-                                                            SLSMG_UARROW_CHAR);
-                        SLsmg_write_char(' ');
-                } else if (ins__is_call(&dl->ins)) {
-                        ui_browser__write_graph(browser, SLSMG_RARROW_CHAR);
-                        SLsmg_write_char(' ');
-                } else if (ins__is_ret(&dl->ins)) {
-                        ui_browser__write_graph(browser, SLSMG_LARROW_CHAR);
-                        SLsmg_write_char(' ');
-                } else {
-                        ui_browser__write_nstring(browser, " ", 2);
-                }
-        } else {
-                ui_browser__write_nstring(browser, " ", 2);
-        }
+        ui_browser__set_percent_color(browser, percent, current);
+}
 
-        disasm_line__scnprintf(dl, bf, size, !annotate_browser__opts.use_offset);
+static void annotate_browser__printf(void *browser, const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        ui_browser__vprintf(browser, fmt, args);
+        va_end(args);
 }
 
 static void annotate_browser__write(struct ui_browser *browser, void *entry, int row)
 {
         struct annotate_browser *ab = container_of(browser, struct annotate_browser, b);
+        struct annotation *notes = browser__annotation(browser);
         struct annotation_line *al = list_entry(entry, struct annotation_line, node);
-        struct browser_line *bl = browser_line(al);
-        bool current_entry = ui_browser__is_current_entry(browser, row);
-        bool change_color = (!annotate_browser__opts.hide_src_code &&
-                             (!current_entry || (browser->use_navkeypressed &&
-                                                 !browser->navkeypressed)));
-        int width = browser->width, printed;
-        int i, pcnt_width = annotate_browser__pcnt_width(ab),
-               cycles_width = annotate_browser__cycles_width(ab);
-        double percent_max = 0.0;
-        char bf[256];
-        bool show_title = false;
-
-        for (i = 0; i < ab->nr_events; i++) {
-                if (al->samples[i].percent > percent_max)
-                        percent_max = al->samples[i].percent;
-        }
-
-        if ((row == 0) && (al->offset == -1 || percent_max == 0.0)) {
-                if (ab->have_cycles) {
-                        if (al->ipc == 0.0 && al->cycles == 0)
-                                show_title = true;
-                } else
-                        show_title = true;
-        }
-
-        if (al->offset != -1 && percent_max != 0.0) {
-                for (i = 0; i < ab->nr_events; i++) {
-                        ui_browser__set_percent_color(browser,
-                                                al->samples[i].percent,
-                                                current_entry);
-                        if (annotate_browser__opts.show_total_period) {
-                                ui_browser__printf(browser, "%11" PRIu64 " ",
-                                                   al->samples[i].he.period);
-                        } else if (annotate_browser__opts.show_nr_samples) {
-                                ui_browser__printf(browser, "%6" PRIu64 " ",
-                                                   al->samples[i].he.nr_samples);
-                        } else {
-                                ui_browser__printf(browser, "%6.2f ",
-                                                   al->samples[i].percent);
-                        }
-                }
-        } else {
-                ui_browser__set_percent_color(browser, 0, current_entry);
-
-                if (!show_title)
-                        ui_browser__write_nstring(browser, " ", pcnt_width);
-                else {
-                        ui_browser__printf(browser, "%*s", pcnt_width,
-                                           annotate_browser__opts.show_total_period ? "Period" :
-                                           annotate_browser__opts.show_nr_samples ? "Samples" : "Percent");
-                }
-        }
-        if (ab->have_cycles) {
-                if (al->ipc)
-                        ui_browser__printf(browser, "%*.2f ", IPC_WIDTH - 1, al->ipc);
-                else if (!show_title)
-                        ui_browser__write_nstring(browser, " ", IPC_WIDTH);
-                else
-                        ui_browser__printf(browser, "%*s ", IPC_WIDTH - 1, "IPC");
-
-                if (al->cycles)
-                        ui_browser__printf(browser, "%*" PRIu64 " ",
-                                           CYCLES_WIDTH - 1, al->cycles);
-                else if (!show_title)
-                        ui_browser__write_nstring(browser, " ", CYCLES_WIDTH);
-                else
-                        ui_browser__printf(browser, "%*s ", CYCLES_WIDTH - 1, "Cycle");
-        }
-
-        SLsmg_write_char(' ');
+        struct annotation_write_ops ops = {
+                .first_line              = row == 0,
+                .current_entry           = ui_browser__is_current_entry(browser, row),
+                .change_color            = (!notes->options->hide_src_code &&
+                                            (!ops.current_entry ||
+                                             (browser->use_navkeypressed &&
+                                              !browser->navkeypressed))),
+                .width                   = browser->width,
+                .obj                     = browser,
+                .set_color               = annotate_browser__set_color,
+                .set_percent_color       = annotate_browser__set_percent_color,
+                .set_jumps_percent_color = ui_browser__set_jumps_percent_color,
+                .printf                  = annotate_browser__printf,
+                .write_graph             = annotate_browser__write_graph,
+        };
 
         /* The scroll bar isn't being used */
         if (!browser->navkeypressed)
-                width += 1;
-
-        if (!*al->line)
-                ui_browser__write_nstring(browser, " ", width - pcnt_width - cycles_width);
-        else if (al->offset == -1) {
-                if (al->line_nr && annotate_browser__opts.show_linenr)
-                        printed = scnprintf(bf, sizeof(bf), "%-*d ",
-                                        ab->addr_width + 1, al->line_nr);
-                else
-                        printed = scnprintf(bf, sizeof(bf), "%*s  ",
-                                    ab->addr_width, " ");
-                ui_browser__write_nstring(browser, bf, printed);
-                ui_browser__write_nstring(browser, al->line, width - printed - pcnt_width - cycles_width + 1);
-        } else {
-                u64 addr = al->offset;
-                int color = -1;
-
-                if (!annotate_browser__opts.use_offset)
-                        addr += ab->start;
-
-                if (!annotate_browser__opts.use_offset) {
-                        printed = scnprintf(bf, sizeof(bf), "%" PRIx64 ": ", addr);
-                } else {
-                        if (bl->jump_sources) {
-                                if (annotate_browser__opts.show_nr_jumps) {
-                                        int prev;
-                                        printed = scnprintf(bf, sizeof(bf), "%*d ",
-                                                            ab->jumps_width,
-                                                            bl->jump_sources);
-                                        prev = annotate_browser__set_jumps_percent_color(ab, bl->jump_sources,
-                                                                                         current_entry);
-                                        ui_browser__write_nstring(browser, bf, printed);
-                                        ui_browser__set_color(browser, prev);
-                                }
-
-                                printed = scnprintf(bf, sizeof(bf), "%*" PRIx64 ": ",
-                                                    ab->target_width, addr);
-                        } else {
-                                printed = scnprintf(bf, sizeof(bf), "%*s  ",
-                                                    ab->addr_width, " ");
-                        }
-                }
-
-                if (change_color)
-                        color = ui_browser__set_color(browser, HE_COLORSET_ADDR);
-                ui_browser__write_nstring(browser, bf, printed);
-                if (change_color)
-                        ui_browser__set_color(browser, color);
+                ops.width += 1;
 
-                disasm_line__write(disasm_line(al), browser, bf, sizeof(bf));
+        annotation_line__write(al, notes, &ops);
 
-                ui_browser__write_nstring(browser, bf, width - pcnt_width - cycles_width - 3 - printed);
-        }
-
-        if (current_entry)
+        if (ops.current_entry)
                 ab->selection = al;
 }
 
-static bool disasm_line__is_valid_jump(struct disasm_line *dl, struct symbol *sym)
-{
-        if (!dl || !dl->ins.ops || !ins__is_jump(&dl->ins)
-            || !disasm_line__has_offset(dl)
-            || dl->ops.target.offset < 0
-            || dl->ops.target.offset >= (s64)symbol__size(sym))
-                return false;
-
-        return true;
-}
-
 static bool is_fused(struct annotate_browser *ab, struct disasm_line *cursor)
 {
         struct disasm_line *pos = list_prev_entry(cursor, al.node);
@@ -314,17 +144,18 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser)
         struct annotate_browser *ab = container_of(browser, struct annotate_browser, b);
         struct disasm_line *cursor = disasm_line(ab->selection);
         struct annotation_line *target;
-        struct browser_line *btarget, *bcursor;
         unsigned int from, to;
         struct map_symbol *ms = ab->b.priv;
         struct symbol *sym = ms->sym;
-        u8 pcnt_width = annotate_browser__pcnt_width(ab);
+        struct annotation *notes = symbol__annotation(sym);
+        u8 pcnt_width = annotation__pcnt_width(notes);
+        int width;
 
         /* PLT symbols contain external offsets */
         if (strstr(sym->name, "@plt"))
                 return;
 
-        if (!disasm_line__is_valid_jump(cursor, sym))
+        if (!disasm_line__is_valid_local_jump(cursor, sym))
                 return;
 
         /*
@@ -347,31 +178,31 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser)
          *  name right after the '<' token and probably treating this like a
          *  'call' instruction.
          */
-        target = ab->offsets[cursor->ops.target.offset];
+        target = notes->offsets[cursor->ops.target.offset];
         if (target == NULL) {
-                ui_helpline__printf("WARN: jump target inconsistency, press 'o', ab->offsets[%#x] = NULL\n",
+                ui_helpline__printf("WARN: jump target inconsistency, press 'o', notes->offsets[%#x] = NULL\n",
                                     cursor->ops.target.offset);
                 return;
         }
 
-        bcursor = browser_line(&cursor->al);
-        btarget = browser_line(target);
-
-        if (annotate_browser__opts.hide_src_code) {
-                from = bcursor->idx_asm;
-                to = btarget->idx_asm;
+        if (notes->options->hide_src_code) {
+                from = cursor->al.idx_asm;
+                to = target->idx_asm;
         } else {
-                from = (u64)bcursor->idx;
-                to = (u64)btarget->idx;
+                from = (u64)cursor->al.idx;
+                to = (u64)target->idx;
         }
 
+        width = annotation__cycles_width(notes);
+
         ui_browser__set_color(browser, HE_COLORSET_JUMP_ARROWS);
-        __ui_browser__line_arrow(browser, pcnt_width + 2 + ab->addr_width,
+        __ui_browser__line_arrow(browser,
+                                 pcnt_width + 2 + notes->widths.addr + width,
                                  from, to);
 
         if (is_fused(ab, cursor)) {
                 ui_browser__mark_fused(browser,
-                                       pcnt_width + 3 + ab->addr_width,
+                                       pcnt_width + 3 + notes->widths.addr + width,
                                        from - 1,
                                        to > from ? true : false);
         }
@@ -379,15 +210,15 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser)
 
 static unsigned int annotate_browser__refresh(struct ui_browser *browser)
 {
-        struct annotate_browser *ab = container_of(browser, struct annotate_browser, b);
+        struct annotation *notes = browser__annotation(browser);
         int ret = ui_browser__list_head_refresh(browser);
-        int pcnt_width = annotate_browser__pcnt_width(ab);
+        int pcnt_width = annotation__pcnt_width(notes);
 
-        if (annotate_browser__opts.jump_arrows)
+        if (notes->options->jump_arrows)
                 annotate_browser__draw_current_jump(browser);
 
         ui_browser__set_color(browser, HE_COLORSET_NORMAL);
-        __ui_browser__vline(browser, pcnt_width, 0, browser->height - 1);
+        __ui_browser__vline(browser, pcnt_width, 0, browser->rows - 1);
         return ret;
 }
 
@@ -425,6 +256,7 @@ static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line
 static void annotate_browser__set_top(struct annotate_browser *browser,
                                       struct annotation_line *pos, u32 idx)
 {
+        struct annotation *notes = browser__annotation(&browser->b);
         unsigned back;
 
         ui_browser__refresh_dimensions(&browser->b);
@@ -434,7 +266,7 @@ static void annotate_browser__set_top(struct annotate_browser *browser,
         while (browser->b.top_idx != 0 && back != 0) {
                 pos = list_entry(pos->node.prev, struct annotation_line, node);
 
-                if (disasm_line__filter(&browser->b, &pos->node))
+                if (annotation_line__filter(pos, notes))
                         continue;
 
                 --browser->b.top_idx;
@@ -448,16 +280,12 @@ static void annotate_browser__set_top(struct annotate_browser *browser,
 static void annotate_browser__set_rb_top(struct annotate_browser *browser,
                                          struct rb_node *nd)
 {
-        struct browser_line *bpos;
-        struct annotation_line *pos;
-        u32 idx;
+        struct annotation *notes = browser__annotation(&browser->b);
+        struct annotation_line * pos = rb_entry(nd, struct annotation_line, rb_node);
+        u32 idx = pos->idx;
 
-        pos = rb_entry(nd, struct annotation_line, rb_node);
-        bpos = browser_line(pos);
-
-        idx = bpos->idx;
-        if (annotate_browser__opts.hide_src_code)
-                idx = bpos->idx_asm;
+        if (notes->options->hide_src_code)
+                idx = pos->idx_asm;
         annotate_browser__set_top(browser, pos, idx);
         browser->curr_hot = nd;
 }
@@ -505,47 +333,47 @@ static void annotate_browser__calc_percent(struct annotate_browser *browser,
 
 static bool annotate_browser__toggle_source(struct annotate_browser *browser)
 {
+        struct annotation *notes = browser__annotation(&browser->b);
         struct annotation_line *al;
-        struct browser_line *bl;
         off_t offset = browser->b.index - browser->b.top_idx;
 
         browser->b.seek(&browser->b, offset, SEEK_CUR);
         al = list_entry(browser->b.top, struct annotation_line, node);
-        bl = browser_line(al);
 
-        if (annotate_browser__opts.hide_src_code) {
-                if (bl->idx_asm < offset)
-                        offset = bl->idx;
+        if (notes->options->hide_src_code) {
+                if (al->idx_asm < offset)
+                        offset = al->idx;
 
-                browser->b.nr_entries = browser->nr_entries;
-                annotate_browser__opts.hide_src_code = false;
+                browser->b.nr_entries = notes->nr_entries;
+                notes->options->hide_src_code = false;
                 browser->b.seek(&browser->b, -offset, SEEK_CUR);
-                browser->b.top_idx = bl->idx - offset;
-                browser->b.index = bl->idx;
+                browser->b.top_idx = al->idx - offset;
+                browser->b.index = al->idx;
         } else {
-                if (bl->idx_asm < 0) {
+                if (al->idx_asm < 0) {
                         ui_helpline__puts("Only available for assembly lines.");
                         browser->b.seek(&browser->b, -offset, SEEK_CUR);
                         return false;
                 }
 
-                if (bl->idx_asm < offset)
-                        offset = bl->idx_asm;
+                if (al->idx_asm < offset)
+                        offset = al->idx_asm;
 
-                browser->b.nr_entries = browser->nr_asm_entries;
-                annotate_browser__opts.hide_src_code = true;
+                browser->b.nr_entries = notes->nr_asm_entries;
+                notes->options->hide_src_code = true;
                 browser->b.seek(&browser->b, -offset, SEEK_CUR);
-                browser->b.top_idx = bl->idx_asm - offset;
-                browser->b.index = bl->idx_asm;
+                browser->b.top_idx = al->idx_asm - offset;
+                browser->b.index = al->idx_asm;
         }
 
         return true;
 }
 
-static void annotate_browser__init_asm_mode(struct annotate_browser *browser)
+static void ui_browser__init_asm_mode(struct ui_browser *browser)
 {
-        ui_browser__reset_index(&browser->b);
-        browser->b.nr_entries = browser->nr_asm_entries;
+        struct annotation *notes = browser__annotation(browser);
+        ui_browser__reset_index(browser);
+        browser->nr_entries = notes->nr_asm_entries;
 }
 
 #define SYM_TITLE_MAX_SIZE (PATH_MAX + 64)
@@ -556,6 +384,15 @@ static int sym_title(struct symbol *sym, struct map *map, char *title,
         return snprintf(title, sz, "%s  %s", sym->name, map->dso->long_name);
 }
 
+/*
+ * This can be called from external jumps, i.e. jumps from one functon
+ * to another, like from the kernel's entry_SYSCALL_64 function to the
+ * swapgs_restore_regs_and_return_to_usermode() function.
+ *
+ * So all we check here is that dl->ops.target.sym is set, if it is, just
+ * go to that function and when exiting from its disassembly, come back
+ * to the calling function.
+ */
 static bool annotate_browser__callq(struct annotate_browser *browser,
                                     struct perf_evsel *evsel,
                                     struct hist_browser_timer *hbt)
@@ -563,35 +400,25 @@ static bool annotate_browser__callq(struct annotate_browser *browser,
         struct map_symbol *ms = browser->b.priv;
         struct disasm_line *dl = disasm_line(browser->selection);
         struct annotation *notes;
-        struct addr_map_symbol target = {
-                .map = ms->map,
-                .addr = map__objdump_2mem(ms->map, dl->ops.target.addr),
-        };
         char title[SYM_TITLE_MAX_SIZE];
 
-        if (!ins__is_call(&dl->ins))
-                return false;
-
-        if (map_groups__find_ams(&target) ||
-            map__rip_2objdump(target.map, target.map->map_ip(target.map,
-                                                             target.addr)) !=
-            dl->ops.target.addr) {
+        if (!dl->ops.target.sym) {
                 ui_helpline__puts("The called function was not found.");
                 return true;
         }
 
-        notes = symbol__annotation(target.sym);
+        notes = symbol__annotation(dl->ops.target.sym);
         pthread_mutex_lock(&notes->lock);
 
-        if (notes->src == NULL && symbol__alloc_hist(target.sym) < 0) {
+        if (notes->src == NULL && symbol__alloc_hist(dl->ops.target.sym) < 0) {
                 pthread_mutex_unlock(&notes->lock);
                 ui__warning("Not enough memory for annotating '%s' symbol!\n",
-                            target.sym->name);
+                            dl->ops.target.sym->name);
                 return true;
         }
 
         pthread_mutex_unlock(&notes->lock);
-        symbol__tui_annotate(target.sym, target.map, evsel, hbt);
+        symbol__tui_annotate(dl->ops.target.sym, ms->map, evsel, hbt);
         sym_title(ms->sym, ms->map, title, sizeof(title));
         ui_browser__show_title(&browser->b, title);
         return true;
@@ -601,23 +428,23 @@ static
 struct disasm_line *annotate_browser__find_offset(struct annotate_browser *browser,
                                           s64 offset, s64 *idx)
 {
-        struct map_symbol *ms = browser->b.priv;
-        struct symbol *sym = ms->sym;
-        struct annotation *notes = symbol__annotation(sym);
+        struct annotation *notes = browser__annotation(&browser->b);
         struct disasm_line *pos;
 
         *idx = 0;
         list_for_each_entry(pos, &notes->src->source, al.node) {
                 if (pos->al.offset == offset)
                         return pos;
-                if (!disasm_line__filter(&browser->b, &pos->al.node))
+                if (!annotation_line__filter(&pos->al, notes))
                         ++*idx;
         }
 
         return NULL;
 }
 
-static bool annotate_browser__jump(struct annotate_browser *browser)
+static bool annotate_browser__jump(struct annotate_browser *browser,
+                                   struct perf_evsel *evsel,
+                                   struct hist_browser_timer *hbt)
 {
         struct disasm_line *dl = disasm_line(browser->selection);
         u64 offset;
@@ -626,6 +453,11 @@ static bool annotate_browser__jump(struct annotate_browser *browser)
         if (!ins__is_jump(&dl->ins))
                 return false;
 
+        if (dl->ops.target.outside) {
+                annotate_browser__callq(browser, evsel, hbt);
+                return true;
+        }
+
         offset = dl->ops.target.offset;
         dl = annotate_browser__find_offset(browser, offset, &idx);
         if (dl == NULL) {
@@ -642,14 +474,12 @@ static
 struct annotation_line *annotate_browser__find_string(struct annotate_browser *browser,
                                           char *s, s64 *idx)
 {
-        struct map_symbol *ms = browser->b.priv;
-        struct symbol *sym = ms->sym;
-        struct annotation *notes = symbol__annotation(sym);
+        struct annotation *notes = browser__annotation(&browser->b);
         struct annotation_line *al = browser->selection;
 
         *idx = browser->b.index;
         list_for_each_entry_continue(al, &notes->src->source, node) {
-                if (disasm_line__filter(&browser->b, &al->node))
+                if (annotation_line__filter(al, notes))
                         continue;
 
                 ++*idx;
@@ -681,14 +511,12 @@ static
 struct annotation_line *annotate_browser__find_string_reverse(struct annotate_browser *browser,
                                                   char *s, s64 *idx)
 {
-        struct map_symbol *ms = browser->b.priv;
-        struct symbol *sym = ms->sym;
-        struct annotation *notes = symbol__annotation(sym);
+        struct annotation *notes = browser__annotation(&browser->b);
         struct annotation_line *al = browser->selection;
 
         *idx = browser->b.index;
         list_for_each_entry_continue_reverse(al, &notes->src->source, node) {
-                if (disasm_line__filter(&browser->b, &al->node))
+                if (annotation_line__filter(al, notes))
                         continue;
 
                 --*idx;
@@ -764,17 +592,21 @@ bool annotate_browser__continue_search_reverse(struct annotate_browser *browser,
         return __annotate_browser__search_reverse(browser);
 }
 
-static void annotate_browser__update_addr_width(struct annotate_browser *browser)
+static int annotate_browser__show(struct ui_browser *browser, char *title, const char *help)
 {
-        if (annotate_browser__opts.use_offset)
-                browser->target_width = browser->min_addr_width;
-        else
-                browser->target_width = browser->max_addr_width;
+        struct map_symbol *ms = browser->priv;
+        struct symbol *sym = ms->sym;
+        char symbol_dso[SYM_TITLE_MAX_SIZE];
+
+        if (ui_browser__show(browser, title, help) < 0)
+                return -1;
 
-        browser->addr_width = browser->target_width;
+        sym_title(sym, ms->map, symbol_dso, sizeof(symbol_dso));
 
-        if (annotate_browser__opts.show_nr_jumps)
-                browser->addr_width += browser->jumps_width + 1;
+        ui_browser__gotorc_title(browser, 0, 0);
+        ui_browser__set_color(browser, HE_COLORSET_ROOT);
+        ui_browser__write_nstring(browser, symbol_dso, browser->width + 1);
+        return 0;
 }
 
 static int annotate_browser__run(struct annotate_browser *browser,
@@ -782,15 +614,18 @@ static int annotate_browser__run(struct annotate_browser *browser,
                                  struct hist_browser_timer *hbt)
 {
         struct rb_node *nd = NULL;
+        struct hists *hists = evsel__hists(evsel);
         struct map_symbol *ms = browser->b.priv;
         struct symbol *sym = ms->sym;
+        struct annotation *notes = symbol__annotation(ms->sym);
         const char *help = "Press 'h' for help on key bindings";
         int delay_secs = hbt ? hbt->refresh : 0;
+        char title[256];
         int key;
-        char title[SYM_TITLE_MAX_SIZE];
 
-        sym_title(sym, ms->map, title, sizeof(title));
-        if (ui_browser__show(&browser->b, title, help) < 0)
+        annotation__scnprintf_samples_period(notes, title, sizeof(title), evsel);
+
+        if (annotate_browser__show(&browser->b, title, help) < 0)
                 return -1;
 
         annotate_browser__calc_percent(browser, evsel);
@@ -821,8 +656,11 @@ static int annotate_browser__run(struct annotate_browser *browser,
                         if (hbt)
                                 hbt->timer(hbt->arg);
 
-                        if (delay_secs != 0)
+                        if (delay_secs != 0) {
                                 symbol__annotate_decay_histogram(sym, evsel->idx);
+                                hists__scnprintf_title(hists, title, sizeof(title));
+                                annotate_browser__show(&browser->b, title, help);
+                        }
                         continue;
                 case K_TAB:
                         if (nd != NULL) {
@@ -854,10 +692,12 @@ static int annotate_browser__run(struct annotate_browser *browser,
                 "J             Toggle showing number of jump sources on targets\n"
                 "n             Search next string\n"
                 "o             Toggle disassembler output/simplified view\n"
+                "O             Bump offset level (jump targets -> +call -> all -> cycle thru)\n"
                 "s             Toggle source code view\n"
                 "t             Circulate percent, total period, samples view\n"
                 "/             Search string\n"
                 "k             Toggle line numbers\n"
+                "P             Print to [symbol_name].annotation file.\n"
                 "r             Run available scripts\n"
                 "?             Search string backwards\n");
                         continue;
@@ -867,8 +707,7 @@ static int annotate_browser__run(struct annotate_browser *browser,
                                 continue;
                         }
                 case 'k':
-                        annotate_browser__opts.show_linenr =
-                                !annotate_browser__opts.show_linenr;
+                        notes->options->show_linenr = !notes->options->show_linenr;
                         break;
                 case 'H':
                         nd = browser->curr_hot;
@@ -878,15 +717,19 @@ static int annotate_browser__run(struct annotate_browser *browser,
                                 ui_helpline__puts(help);
                         continue;
                 case 'o':
-                        annotate_browser__opts.use_offset = !annotate_browser__opts.use_offset;
-                        annotate_browser__update_addr_width(browser);
+                        notes->options->use_offset = !notes->options->use_offset;
+                        annotation__update_column_widths(notes);
+                        continue;
+                case 'O':
+                        if (++notes->options->offset_level > ANNOTATION__MAX_OFFSET_LEVEL)
+                                notes->options->offset_level = ANNOTATION__MIN_OFFSET_LEVEL;
                         continue;
                 case 'j':
-                        annotate_browser__opts.jump_arrows = !annotate_browser__opts.jump_arrows;
+                        notes->options->jump_arrows = !notes->options->jump_arrows;
                         continue;
                 case 'J':
-                        annotate_browser__opts.show_nr_jumps = !annotate_browser__opts.show_nr_jumps;
-                        annotate_browser__update_addr_width(browser);
+                        notes->options->show_nr_jumps = !notes->options->show_nr_jumps;
+                        annotation__update_column_widths(notes);
                         continue;
                 case '/':
                         if (annotate_browser__search(browser, delay_secs)) {
@@ -912,7 +755,7 @@ show_help:
                                            browser->b.height,
                                            browser->b.index,
                                            browser->b.top_idx,
-                                           browser->nr_asm_entries);
+                                           notes->nr_asm_entries);
                 }
                         continue;
                 case K_ENTER:
@@ -928,22 +771,25 @@ show_help:
                                 goto show_sup_ins;
                         else if (ins__is_ret(&dl->ins))
                                 goto out;
-                        else if (!(annotate_browser__jump(browser) ||
+                        else if (!(annotate_browser__jump(browser, evsel, hbt) ||
                                      annotate_browser__callq(browser, evsel, hbt))) {
 show_sup_ins:
                                 ui_helpline__puts("Actions are only available for function call/return & jump/branch instructions.");
                         }
                         continue;
                 }
+                case 'P':
+                        map_symbol__annotation_dump(ms, evsel);
+                        continue;
                 case 't':
-                        if (annotate_browser__opts.show_total_period) {
-                                annotate_browser__opts.show_total_period = false;
-                                annotate_browser__opts.show_nr_samples = true;
-                        } else if (annotate_browser__opts.show_nr_samples)
-                                annotate_browser__opts.show_nr_samples = false;
+                        if (notes->options->show_total_period) {
+                                notes->options->show_total_period = false;
+                                notes->options->show_nr_samples = true;
+                        } else if (notes->options->show_nr_samples)
+                                notes->options->show_nr_samples = false;
                         else
-                                annotate_browser__opts.show_total_period = true;
-                        annotate_browser__update_addr_width(browser);
+                                notes->options->show_total_period = true;
+                        annotation__update_column_widths(notes);
                         continue;
                 case K_LEFT:
                 case K_ESC:
@@ -965,12 +811,6 @@ out:
 int map_symbol__tui_annotate(struct map_symbol *ms, struct perf_evsel *evsel,
                              struct hist_browser_timer *hbt)
 {
-        /* Set default value for show_total_period and show_nr_samples  */
-        annotate_browser__opts.show_total_period =
-                symbol_conf.show_total_period;
-        annotate_browser__opts.show_nr_samples =
-                symbol_conf.show_nr_samples;
-
         return symbol__tui_annotate(ms->sym, ms->map, evsel, hbt);
 }
 
@@ -984,129 +824,11 @@ int hist_entry__tui_annotate(struct hist_entry *he, struct perf_evsel *evsel,
         return map_symbol__tui_annotate(&he->ms, evsel, hbt);
 }
 
-
-static unsigned count_insn(struct annotate_browser *browser, u64 start, u64 end)
-{
-        unsigned n_insn = 0;
-        u64 offset;
-
-        for (offset = start; offset <= end; offset++) {
-                if (browser->offsets[offset])
-                        n_insn++;
-        }
-        return n_insn;
-}
-
-static void count_and_fill(struct annotate_browser *browser, u64 start, u64 end,
-                           struct cyc_hist *ch)
-{
-        unsigned n_insn;
-        u64 offset;
-
-        n_insn = count_insn(browser, start, end);
-        if (n_insn && ch->num && ch->cycles) {
-                float ipc = n_insn / ((double)ch->cycles / (double)ch->num);
-
-                /* Hide data when there are too many overlaps. */
-                if (ch->reset >= 0x7fff || ch->reset >= ch->num / 2)
-                        return;
-
-                for (offset = start; offset <= end; offset++) {
-                        struct annotation_line *al = browser->offsets[offset];
-
-                        if (al)
-                                al->ipc = ipc;
-                }
-        }
-}
-
-/*
- * This should probably be in util/annotate.c to share with the tty
- * annotate, but right now we need the per byte offsets arrays,
- * which are only here.
- */
-static void annotate__compute_ipc(struct annotate_browser *browser, size_t size,
-                           struct symbol *sym)
-{
-        u64 offset;
-        struct annotation *notes = symbol__annotation(sym);
-
-        if (!notes->src || !notes->src->cycles_hist)
-                return;
-
-        pthread_mutex_lock(&notes->lock);
-        for (offset = 0; offset < size; ++offset) {
-                struct cyc_hist *ch;
-
-                ch = &notes->src->cycles_hist[offset];
-                if (ch && ch->cycles) {
-                        struct annotation_line *al;
-
-                        if (ch->have_start)
-                                count_and_fill(browser, ch->start, offset, ch);
-                        al = browser->offsets[offset];
-                        if (al && ch->num_aggr)
-                                al->cycles = ch->cycles_aggr / ch->num_aggr;
-                        browser->have_cycles = true;
-                }
-        }
-        pthread_mutex_unlock(&notes->lock);
-}
-
-static void annotate_browser__mark_jump_targets(struct annotate_browser *browser,
-                                                size_t size)
-{
-        u64 offset;
-        struct map_symbol *ms = browser->b.priv;
-        struct symbol *sym = ms->sym;
-
-        /* PLT symbols contain external offsets */
-        if (strstr(sym->name, "@plt"))
-                return;
-
-        for (offset = 0; offset < size; ++offset) {
-                struct annotation_line *al = browser->offsets[offset];
-                struct disasm_line *dl;
-                struct browser_line *blt;
-
-                dl = disasm_line(al);
-
-                if (!disasm_line__is_valid_jump(dl, sym))
-                        continue;
-
-                al = browser->offsets[dl->ops.target.offset];
-
-                /*
-                 * FIXME: Oops, no jump target? Buggy disassembler? Or do we
-                 * have to adjust to the previous offset?
-                 */
-                if (al == NULL)
-                        continue;
-
-                blt = browser_line(al);
-                if (++blt->jump_sources > browser->max_jump_sources)
-                        browser->max_jump_sources = blt->jump_sources;
-
-                ++browser->nr_jumps;
-        }
-}
-
-static inline int width_jumps(int n)
-{
-        if (n >= 100)
-                return 5;
-        if (n / 10)
-                return 2;
-        return 1;
-}
-
 int symbol__tui_annotate(struct symbol *sym, struct map *map,
                          struct perf_evsel *evsel,
                          struct hist_browser_timer *hbt)
 {
-        struct annotation_line *al;
-        struct annotation *notes;
-        size_t size;
+        struct annotation *notes = symbol__annotation(sym);
         struct map_symbol ms = {
                 .map = map,
                 .sym = sym,
@@ -1117,31 +839,20 @@ int symbol__tui_annotate(struct symbol *sym, struct map *map,
                         .seek    = ui_browser__list_head_seek,
                         .write   = annotate_browser__write,
                         .filter  = disasm_line__filter,
+                        .extra_title_lines = 1, /* for hists__scnprintf_title() */
                         .priv    = &ms,
                         .use_navkeypressed = true,
                 },
         };
         int ret = -1, err;
-        int nr_pcnt = 1;
 
         if (sym == NULL)
                 return -1;
 
-        size = symbol__size(sym);
-
         if (map->dso->annotate_warned)
                 return -1;
 
-        browser.offsets = zalloc(size * sizeof(struct annotation_line *));
-        if (browser.offsets == NULL) {
-                ui__error("Not enough memory!");
-                return -1;
-        }
-
-        if (perf_evsel__is_group_event(evsel))
-                nr_pcnt = evsel->nr_members;
-
-        err = symbol__annotate(sym, map, evsel, sizeof(struct browser_line), &browser.arch);
+        err = symbol__annotate2(sym, map, evsel, &annotation__default_options, &browser.arch);
         if (err) {
                 char msg[BUFSIZ];
                 symbol__strerror_disassemble(sym, map, err, msg, sizeof(msg));
@@ -1149,110 +860,21 @@ int symbol__tui_annotate(struct symbol *sym, struct map *map,
                 goto out_free_offsets;
         }
 
-        symbol__calc_percent(sym, evsel);
-
         ui_helpline__push("Press ESC to exit");
 
-        notes = symbol__annotation(sym);
-        browser.start = map__rip_2objdump(map, sym->start);
-
-        list_for_each_entry(al, &notes->src->source, node) {
-                struct browser_line *bpos;
-                size_t line_len = strlen(al->line);
-
-                if (browser.b.width < line_len)
-                        browser.b.width = line_len;
-                bpos = browser_line(al);
-                bpos->idx = browser.nr_entries++;
-                if (al->offset != -1) {
-                        bpos->idx_asm = browser.nr_asm_entries++;
-                        /*
-                         * FIXME: short term bandaid to cope with assembly
-                         * routines that comes with labels in the same column
-                         * as the address in objdump, sigh.
-                         *
-                         * E.g. copy_user_generic_unrolled
-                         */
-                        if (al->offset < (s64)size)
-                                browser.offsets[al->offset] = al;
-                } else
-                        bpos->idx_asm = -1;
-        }
-
-        annotate_browser__mark_jump_targets(&browser, size);
-        annotate__compute_ipc(&browser, size, sym);
-
-        browser.addr_width = browser.target_width = browser.min_addr_width = hex_width(size);
-        browser.max_addr_width = hex_width(sym->end);
-        browser.jumps_width = width_jumps(browser.max_jump_sources);
-        browser.nr_events = nr_pcnt;
-        browser.b.nr_entries = browser.nr_entries;
+        browser.b.width = notes->max_line_len;
+        browser.b.nr_entries = notes->nr_entries;
         browser.b.entries = &notes->src->source,
         browser.b.width += 18; /* Percentage */
 
-        if (annotate_browser__opts.hide_src_code)
-                annotate_browser__init_asm_mode(&browser);
-
-        annotate_browser__update_addr_width(&browser);
+        if (notes->options->hide_src_code)
+                ui_browser__init_asm_mode(&browser.b);
 
         ret = annotate_browser__run(&browser, evsel, hbt);
 
         annotated_source__purge(notes->src);
 
 out_free_offsets:
-        free(browser.offsets);
+        zfree(&notes->offsets);
         return ret;
 }
-
-#define ANNOTATE_CFG(n) \
-        { .name = #n, .value = &annotate_browser__opts.n, }
-
-/*
- * Keep the entries sorted, they are bsearch'ed
- */
-static struct annotate_config {
-        const char *name;
-        bool *value;
-} annotate__configs[] = {
-        ANNOTATE_CFG(hide_src_code),
-        ANNOTATE_CFG(jump_arrows),
-        ANNOTATE_CFG(show_linenr),
-        ANNOTATE_CFG(show_nr_jumps),
-        ANNOTATE_CFG(show_nr_samples),
-        ANNOTATE_CFG(show_total_period),
-        ANNOTATE_CFG(use_offset),
-};
-
-#undef ANNOTATE_CFG
-
-static int annotate_config__cmp(const void *name, const void *cfgp)
-{
-        const struct annotate_config *cfg = cfgp;
-
-        return strcmp(name, cfg->name);
-}
-
-static int annotate__config(const char *var, const char *value,
-                            void *data __maybe_unused)
-{
-        struct annotate_config *cfg;
-        const char *name;
-
-        if (!strstarts(var, "annotate."))
-                return 0;
-
-        name = var + 9;
-        cfg = bsearch(name, annotate__configs, ARRAY_SIZE(annotate__configs),
-                      sizeof(struct annotate_config), annotate_config__cmp);
-
-        if (cfg == NULL)
-                ui__warning("%s variable unknown, ignoring...", var);
-        else
-                *cfg->value = perf_config_bool(name, value);
-        return 0;
-}
-
-void annotate_browser__init(void)
-{
-        perf_config(annotate__config, NULL);
-}
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 6495ee55d9c3..e5f247247daa 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -32,8 +32,7 @@
 
 extern void hist_browser__init_hpp(void);
 
-static int perf_evsel_browser_title(struct hist_browser *browser,
-                                    char *bf, size_t size);
+static int hists_browser__scnprintf_title(struct hist_browser *browser, char *bf, size_t size);
 static void hist_browser__update_nr_entries(struct hist_browser *hb);
 
 static struct rb_node *hists__filter_entries(struct rb_node *nd,
@@ -62,6 +61,15 @@ static int hist_browser__get_folding(struct hist_browser *browser)
         return unfolded_rows;
 }
 
+static void hist_browser__set_title_space(struct hist_browser *hb)
+{
+        struct ui_browser *browser = &hb->b;
+        struct hists *hists = hb->hists;
+        struct perf_hpp_list *hpp_list = hists->hpp_list;
+
+        browser->extra_title_lines = hb->show_headers ? hpp_list->nr_header_lines : 0;
+}
+
 static u32 hist_browser__nr_entries(struct hist_browser *hb)
 {
         u32 nr_entries;
@@ -82,10 +90,16 @@ static void hist_browser__update_rows(struct hist_browser *hb)
         struct ui_browser *browser = &hb->b;
         struct hists *hists = hb->hists;
         struct perf_hpp_list *hpp_list = hists->hpp_list;
-        u16 header_offset, index_row;
+        u16 index_row;
 
-        header_offset = hb->show_headers ? hpp_list->nr_header_lines : 0;
-        browser->rows = browser->height - header_offset;
+        if (!hb->show_headers) {
+                browser->rows += browser->extra_title_lines;
+                browser->extra_title_lines = 0;
+                return;
+        }
+
+        browser->extra_title_lines = hpp_list->nr_header_lines;
+        browser->rows -= browser->extra_title_lines;
         /*
          * Verify if we were at the last line and that line isn't
          * visibe because we now show the header line(s).
@@ -108,17 +122,6 @@ static void hist_browser__refresh_dimensions(struct ui_browser *browser)
          *        changeset.
          */
         ui_browser__refresh_dimensions(browser);
-        hist_browser__update_rows(hb);
-}
-
-static void hist_browser__gotorc(struct hist_browser *browser, int row, int column)
-{
-        struct hists *hists = browser->hists;
-        struct perf_hpp_list *hpp_list = hists->hpp_list;
-        u16 header_offset;
-
-        header_offset = browser->show_headers ? hpp_list->nr_header_lines : 0;
-        ui_browser__gotorc(&browser->b, row + header_offset, column);
 }
 
 static void hist_browser__reset(struct hist_browser *browser)
@@ -656,9 +659,10 @@ int hist_browser__run(struct hist_browser *browser, const char *help,
                         struct hist_entry *h = rb_entry(browser->b.top,
                                                         struct hist_entry, rb_node);
                         ui_helpline__pop();
-                        ui_helpline__fpush("%d: nr_ent=(%d,%d), rows=%d, idx=%d, fve: idx=%d, row_off=%d, nrows=%d",
+                        ui_helpline__fpush("%d: nr_ent=(%d,%d), etl: %d, rows=%d, idx=%d, fve: idx=%d, row_off=%d, nrows=%d",
                                            seq++, browser->b.nr_entries,
                                            browser->hists->nr_entries,
+                                           browser->b.extra_title_lines,
                                            browser->b.rows,
                                            browser->b.index,
                                            browser->b.top_idx,
@@ -733,7 +737,7 @@ static void hist_browser__show_callchain_entry(struct hist_browser *browser,
         }
 
         ui_browser__set_color(&browser->b, color);
-        hist_browser__gotorc(browser, row, 0);
+        ui_browser__gotorc(&browser->b, row, 0);
         ui_browser__write_nstring(&browser->b, " ", offset);
         ui_browser__printf(&browser->b, "%c", folded_sign);
         ui_browser__write_graph(&browser->b, show_annotated ? SLSMG_RARROW_CHAR : ' ');
@@ -1249,7 +1253,7 @@ static int hist_browser__show_entry(struct hist_browser *browser,
                 };
                 int column = 0;
 
-                hist_browser__gotorc(browser, row, 0);
+                ui_browser__gotorc(&browser->b, row, 0);
 
                 hists__for_each_format(browser->hists, fmt) {
                         char s[2048];
@@ -1358,7 +1362,7 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 goto show_callchain;
         }
 
-        hist_browser__gotorc(browser, row, 0);
+        ui_browser__gotorc(&browser->b, row, 0);
 
         if (current_entry && browser->b.navkeypressed)
                 ui_browser__set_color(&browser->b, HE_COLORSET_SELECTED);
@@ -1507,7 +1511,7 @@ static int hist_browser__show_no_entry(struct hist_browser *browser,
                 browser->selection = NULL;
         }
 
-        hist_browser__gotorc(browser, row, 0);
+        ui_browser__gotorc(&browser->b, row, 0);
 
         if (current_entry && browser->b.navkeypressed)
                 ui_browser__set_color(&browser->b, HE_COLORSET_SELECTED);
@@ -1713,7 +1717,7 @@ static void hists_browser__headers(struct hist_browser *browser)
                 hists_browser__scnprintf_headers(browser, headers,
                                                  sizeof(headers), line);
 
-                ui_browser__gotorc(&browser->b, line, 0);
+                ui_browser__gotorc_title(&browser->b, line, 0);
                 ui_browser__set_color(&browser->b, HE_COLORSET_ROOT);
                 ui_browser__write_nstring(&browser->b, headers, browser->b.width + 1);
         }
@@ -1740,17 +1744,11 @@ static void ui_browser__hists_init_top(struct ui_browser *browser)
 static unsigned int hist_browser__refresh(struct ui_browser *browser)
 {
         unsigned row = 0;
-        u16 header_offset = 0;
         struct rb_node *nd;
         struct hist_browser *hb = container_of(browser, struct hist_browser, b);
-        struct hists *hists = hb->hists;
-
-        if (hb->show_headers) {
-                struct perf_hpp_list *hpp_list = hists->hpp_list;
 
+        if (hb->show_headers)
                 hist_browser__show_headers(hb);
-                header_offset = hpp_list->nr_header_lines;
-        }
 
         ui_browser__hists_init_top(browser);
         hb->he_selection = NULL;
@@ -1788,7 +1786,7 @@ static unsigned int hist_browser__refresh(struct ui_browser *browser)
                         break;
         }
 
-        return row + header_offset;
+        return row;
 }
 
 static struct rb_node *hists__filter_entries(struct rb_node *nd,
@@ -2143,6 +2141,7 @@ void hist_browser__init(struct hist_browser *browser,
         browser->b.seek                 = ui_browser__hists_seek;
         browser->b.use_navkeypressed    = true;
         browser->show_headers           = symbol_conf.show_hist_headers;
+        hist_browser__set_title_space(browser);
 
         if (symbol_conf.report_hierarchy) {
                 struct perf_hpp_list_node *fmt_node;
@@ -2183,7 +2182,7 @@ perf_evsel_browser__new(struct perf_evsel *evsel,
         if (browser) {
                 browser->hbt   = hbt;
                 browser->env   = env;
-                browser->title = perf_evsel_browser_title;
+                browser->title = hists_browser__scnprintf_title;
         }
         return browser;
 }
@@ -2209,79 +2208,11 @@ static inline bool is_report_browser(void *timer)
         return timer == NULL;
 }
 
-static int perf_evsel_browser_title(struct hist_browser *browser,
-                                char *bf, size_t size)
+static int hists_browser__scnprintf_title(struct hist_browser *browser, char *bf, size_t size)
 {
         struct hist_browser_timer *hbt = browser->hbt;
-        struct hists *hists = browser->hists;
-        char unit;
-        int printed;
-        const struct dso *dso = hists->dso_filter;
-        const struct thread *thread = hists->thread_filter;
-        int socket_id = hists->socket_filter;
-        unsigned long nr_samples = hists->stats.nr_events[PERF_RECORD_SAMPLE];
-        u64 nr_events = hists->stats.total_period;
-        struct perf_evsel *evsel = hists_to_evsel(hists);
-        const char *ev_name = perf_evsel__name(evsel);
-        char buf[512];
-        size_t buflen = sizeof(buf);
-        char ref[30] = " show reference callgraph, ";
-        bool enable_ref = false;
-
-        if (symbol_conf.filter_relative) {
-                nr_samples = hists->stats.nr_non_filtered_samples;
-                nr_events = hists->stats.total_non_filtered_period;
-        }
-
-        if (perf_evsel__is_group_event(evsel)) {
-                struct perf_evsel *pos;
+        int printed = __hists__scnprintf_title(browser->hists, bf, size, !is_report_browser(hbt));
 
-                perf_evsel__group_desc(evsel, buf, buflen);
-                ev_name = buf;
-
-                for_each_group_member(pos, evsel) {
-                        struct hists *pos_hists = evsel__hists(pos);
-
-                        if (symbol_conf.filter_relative) {
-                                nr_samples += pos_hists->stats.nr_non_filtered_samples;
-                                nr_events += pos_hists->stats.total_non_filtered_period;
-                        } else {
-                                nr_samples += pos_hists->stats.nr_events[PERF_RECORD_SAMPLE];
-                                nr_events += pos_hists->stats.total_period;
-                        }
-                }
-        }
-
-        if (symbol_conf.show_ref_callgraph &&
-            strstr(ev_name, "call-graph=no"))
-                enable_ref = true;
-        nr_samples = convert_unit(nr_samples, &unit);
-        printed = scnprintf(bf, size,
-                           "Samples: %lu%c of event '%s',%sEvent count (approx.): %" PRIu64,
-                           nr_samples, unit, ev_name, enable_ref ? ref : " ", nr_events);
-
-
-        if (hists->uid_filter_str)
-                printed += snprintf(bf + printed, size - printed,
-                                    ", UID: %s", hists->uid_filter_str);
-        if (thread) {
-                if (hists__has(hists, thread)) {
-                        printed += scnprintf(bf + printed, size - printed,
-                                    ", Thread: %s(%d)",
-                                     (thread->comm_set ? thread__comm_str(thread) : ""),
-                                    thread->tid);
-                } else {
-                        printed += scnprintf(bf + printed, size - printed,
-                                    ", Thread: %s",
-                                     (thread->comm_set ? thread__comm_str(thread) : ""));
-                }
-        }
-        if (dso)
-                printed += scnprintf(bf + printed, size - printed,
-                                    ", DSO: %s", dso->short_name);
-        if (socket_id > -1)
-                printed += scnprintf(bf + printed, size - printed,
-                                    ", Processor Socket: %d", socket_id);
         if (!is_report_browser(hbt)) {
                 struct perf_top *top = hbt->arg;
 
@@ -2783,7 +2714,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
         "h/?/F1        Show this window\n"                              \
         "UP/DOWN/PGUP\n"                                                \
         "PGDN/SPACE    Navigate\n"                                      \
-        "q/ESC/CTRL+C  Exit browser\n\n"                                \
+        "q/ESC/CTRL+C  Exit browser or go back to previous screen\n\n"  \
         "For multiple event sessions:\n\n"                              \
         "TAB/UNTAB     Switch events\n\n"                               \
         "For symbolic views (--sort has sym):\n\n"                      \
diff --git a/tools/perf/ui/stdio/hist.c b/tools/perf/ui/stdio/hist.c
index 25dd1e0ecc58..6832fcb2e6ff 100644
--- a/tools/perf/ui/stdio/hist.c
+++ b/tools/perf/ui/stdio/hist.c
@@ -840,15 +840,11 @@ size_t events_stats__fprintf(struct events_stats *stats, FILE *fp)
         for (i = 0; i < PERF_RECORD_HEADER_MAX; ++i) {
                 const char *name;
 
-                if (stats->nr_events[i] == 0)
-                        continue;
-
                 name = perf_event__name(i);
                 if (!strcmp(name, "UNKNOWN"))
                         continue;
 
-                ret += fprintf(fp, "%16s events: %10d\n", name,
-                               stats->nr_events[i]);
+                ret += fprintf(fp, "%16s events: %10d\n", name, stats->nr_events[i]);
         }
 
         return ret;
diff --git a/tools/perf/util/Build b/tools/perf/util/Build
index ea0a452550b0..8052373bcd6a 100644
--- a/tools/perf/util/Build
+++ b/tools/perf/util/Build
@@ -106,6 +106,7 @@ libperf-y += units.o
 libperf-y += time-utils.o
 libperf-y += expr-bison.o
 libperf-y += branch.o
+libperf-y += mem2node.o
 
 libperf-$(CONFIG_LIBBPF) += bpf-loader.o
 libperf-$(CONFIG_BPF_PROLOGUE) += bpf-prologue.o
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 28b233c3dcbe..5d74a30fe00f 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -14,8 +14,10 @@
 #include "sort.h"
 #include "build-id.h"
 #include "color.h"
+#include "config.h"
 #include "cache.h"
 #include "symbol.h"
+#include "units.h"
 #include "debug.h"
 #include "annotate.h"
 #include "evsel.h"
@@ -27,8 +29,26 @@
 #include <linux/bitops.h>
 #include <linux/kernel.h>
 
+/* FIXME: For the HE_COLORSET */
+#include "ui/browser.h"
+
+/*
+ * FIXME: Using the same values as slang.h,
+ * but that header may not be available everywhere
+ */
+#define LARROW_CHAR     ((unsigned char)',')
+#define RARROW_CHAR     ((unsigned char)'+')
+#define DARROW_CHAR     ((unsigned char)'.')
+#define UARROW_CHAR     ((unsigned char)'-')
+
 #include "sane_ctype.h"
 
+struct annotation_options annotation__default_options = {
+        .use_offset     = true,
+        .jump_arrows    = true,
+        .offset_level   = ANNOTATION__OFFSET_JUMP_TARGETS,
+};
+
 const char      *disassembler_style;
 const char      *objdump_path;
 static regex_t   file_lineno;
@@ -184,9 +204,13 @@ bool ins__is_fused(struct arch *arch, const char *ins1, const char *ins2)
         return arch->ins_is_fused(arch, ins1, ins2);
 }
 
-static int call__parse(struct arch *arch, struct ins_operands *ops, struct map *map)
+static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_symbol *ms)
 {
         char *endptr, *tok, *name;
+        struct map *map = ms->map;
+        struct addr_map_symbol target = {
+                .map = map,
+        };
 
         ops->target.addr = strtoull(ops->raw, &endptr, 16);
 
@@ -208,32 +232,36 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map *
         ops->target.name = strdup(name);
         *tok = '>';
 
-        return ops->target.name == NULL ? -1 : 0;
+        if (ops->target.name == NULL)
+                return -1;
+find_target:
+        target.addr = map__objdump_2mem(map, ops->target.addr);
 
-indirect_call:
-        tok = strchr(endptr, '*');
-        if (tok == NULL) {
-                struct symbol *sym = map__find_symbol(map, map->map_ip(map, ops->target.addr));
-                if (sym != NULL)
-                        ops->target.name = strdup(sym->name);
-                else
-                        ops->target.addr = 0;
-                return 0;
-        }
+        if (map_groups__find_ams(&target) == 0 &&
+            map__rip_2objdump(target.map, map->map_ip(target.map, target.addr)) == ops->target.addr)
+                ops->target.sym = target.sym;
 
-        ops->target.addr = strtoull(tok + 1, NULL, 16);
         return 0;
+
+indirect_call:
+        tok = strchr(endptr, '*');
+        if (tok != NULL)
+                ops->target.addr = strtoull(tok + 1, NULL, 16);
+        goto find_target;
 }
 
 static int call__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
-        if (ops->target.name)
-                return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.name);
+        if (ops->target.sym)
+                return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.sym->name);
 
         if (ops->target.addr == 0)
                 return ins__raw_scnprintf(ins, bf, size, ops);
 
+        if (ops->target.name)
+                return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.name);
+
         return scnprintf(bf, size, "%-6s *%" PRIx64, ins->name, ops->target.addr);
 }
 
@@ -244,14 +272,29 @@ static struct ins_ops call_ops = {
 
 bool ins__is_call(const struct ins *ins)
 {
-        return ins->ops == &call_ops;
+        return ins->ops == &call_ops || ins->ops == &s390_call_ops;
 }
 
-static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *ops, struct map *map __maybe_unused)
+static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *ops, struct map_symbol *ms)
 {
-        const char *s = strchr(ops->raw, '+');
+        struct map *map = ms->map;
+        struct symbol *sym = ms->sym;
+        struct addr_map_symbol target = {
+                .map = map,
+        };
         const char *c = strchr(ops->raw, ',');
-
+        u64 start, end;
+        /*
+         * Examples of lines to parse for the _cpp_lex_token@@Base
+         * function:
+         *
+         * 1159e6c: jne    115aa32 <_cpp_lex_token@@Base+0xf92>
+         * 1159e8b: jne    c469be <cpp_named_operator2name@@Base+0xa72>
+         *
+         * The first is a jump to an offset inside the same function,
+         * the second is to another function, i.e. that 0xa72 is an
+         * offset in the cpp_named_operator2name@@base function.
+         */
         /*
          * skip over possible up to 2 operands to get to address, e.g.:
          * tbnz  w0, #26, ffff0000083cd190 <security_file_permission+0xd0>
@@ -267,8 +310,36 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
                 ops->target.addr = strtoull(ops->raw, NULL, 16);
         }
 
-        if (s++ != NULL) {
-                ops->target.offset = strtoull(s, NULL, 16);
+        target.addr = map__objdump_2mem(map, ops->target.addr);
+        start = map->unmap_ip(map, sym->start),
+        end = map->unmap_ip(map, sym->end);
+
+        ops->target.outside = target.addr < start || target.addr > end;
+
+        /*
+         * FIXME: things like this in _cpp_lex_token (gcc's cc1 program):
+
+                cpp_named_operator2name@@Base+0xa72
+
+         * Point to a place that is after the cpp_named_operator2name
+         * boundaries, i.e.  in the ELF symbol table for cc1
+         * cpp_named_operator2name is marked as being 32-bytes long, but it in
+         * fact is much larger than that, so we seem to need a symbols__find()
+         * routine that looks for >= current->start and  < next_symbol->start,
+         * possibly just for C++ objects?
+         *
+         * For now lets just make some progress by marking jumps to outside the
+         * current function as call like.
+         *
+         * Actual navigation will come next, with further understanding of how
+         * the symbol searching and disassembly should be done.
+         */
+        if (map_groups__find_ams(&target) == 0 &&
+            map__rip_2objdump(target.map, map->map_ip(target.map, target.addr)) == ops->target.addr)
+                ops->target.sym = target.sym;
+
+        if (!ops->target.outside) {
+                ops->target.offset = target.addr - start;
                 ops->target.offset_avail = true;
         } else {
                 ops->target.offset_avail = false;
@@ -280,11 +351,15 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
 static int jump__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
-        const char *c = strchr(ops->raw, ',');
+        const char *c;
 
         if (!ops->target.addr || ops->target.offset < 0)
                 return ins__raw_scnprintf(ins, bf, size, ops);
 
+        if (ops->target.outside && ops->target.sym != NULL)
+                return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.sym->name);
+
+        c = strchr(ops->raw, ',');
         if (c != NULL) {
                 const char *c2 = strchr(c + 1, ',');
 
@@ -340,7 +415,7 @@ static int comment__symbol(char *raw, char *comment, u64 *addrp, char **namep)
         return 0;
 }
 
-static int lock__parse(struct arch *arch, struct ins_operands *ops, struct map *map)
+static int lock__parse(struct arch *arch, struct ins_operands *ops, struct map_symbol *ms)
 {
         ops->locked.ops = zalloc(sizeof(*ops->locked.ops));
         if (ops->locked.ops == NULL)
@@ -355,7 +430,7 @@ static int lock__parse(struct arch *arch, struct ins_operands *ops, struct map *
                 goto out_free_ops;
 
         if (ops->locked.ins.ops->parse &&
-            ops->locked.ins.ops->parse(arch, ops->locked.ops, map) < 0)
+            ops->locked.ins.ops->parse(arch, ops->locked.ops, ms) < 0)
                 goto out_free_ops;
 
         return 0;
@@ -398,7 +473,7 @@ static struct ins_ops lock_ops = {
         .scnprintf = lock__scnprintf,
 };
 
-static int mov__parse(struct arch *arch, struct ins_operands *ops, struct map *map __maybe_unused)
+static int mov__parse(struct arch *arch, struct ins_operands *ops, struct map_symbol *ms __maybe_unused)
 {
         char *s = strchr(ops->raw, ','), *target, *comment, prev;
 
@@ -459,7 +534,7 @@ static struct ins_ops mov_ops = {
         .scnprintf = mov__scnprintf,
 };
 
-static int dec__parse(struct arch *arch __maybe_unused, struct ins_operands *ops, struct map *map __maybe_unused)
+static int dec__parse(struct arch *arch __maybe_unused, struct ins_operands *ops, struct map_symbol *ms __maybe_unused)
 {
         char *target, *comment, *s, prev;
 
@@ -826,6 +901,66 @@ int addr_map_symbol__account_cycles(struct addr_map_symbol *ams,
         return err;
 }
 
+static unsigned annotation__count_insn(struct annotation *notes, u64 start, u64 end)
+{
+        unsigned n_insn = 0;
+        u64 offset;
+
+        for (offset = start; offset <= end; offset++) {
+                if (notes->offsets[offset])
+                        n_insn++;
+        }
+        return n_insn;
+}
+
+static void annotation__count_and_fill(struct annotation *notes, u64 start, u64 end, struct cyc_hist *ch)
+{
+        unsigned n_insn;
+        u64 offset;
+
+        n_insn = annotation__count_insn(notes, start, end);
+        if (n_insn && ch->num && ch->cycles) {
+                float ipc = n_insn / ((double)ch->cycles / (double)ch->num);
+
+                /* Hide data when there are too many overlaps. */
+                if (ch->reset >= 0x7fff || ch->reset >= ch->num / 2)
+                        return;
+
+                for (offset = start; offset <= end; offset++) {
+                        struct annotation_line *al = notes->offsets[offset];
+
+                        if (al)
+                                al->ipc = ipc;
+                }
+        }
+}
+
+void annotation__compute_ipc(struct annotation *notes, size_t size)
+{
+        u64 offset;
+
+        if (!notes->src || !notes->src->cycles_hist)
+                return;
+
+        pthread_mutex_lock(&notes->lock);
+        for (offset = 0; offset < size; ++offset) {
+                struct cyc_hist *ch;
+
+                ch = &notes->src->cycles_hist[offset];
+                if (ch && ch->cycles) {
+                        struct annotation_line *al;
+
+                        if (ch->have_start)
+                                annotation__count_and_fill(notes, ch->start, offset, ch);
+                        al = notes->offsets[offset];
+                        if (al && ch->num_aggr)
+                                al->cycles = ch->cycles_aggr / ch->num_aggr;
+                        notes->have_cycles = true;
+                }
+        }
+        pthread_mutex_unlock(&notes->lock);
+}
+
 int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, struct perf_sample *sample,
                                  int evidx)
 {
@@ -838,14 +973,14 @@ int hist_entry__inc_addr_samples(struct hist_entry *he, struct perf_sample *samp
         return symbol__inc_addr_samples(he->ms.sym, he->ms.map, evidx, ip, sample);
 }
 
-static void disasm_line__init_ins(struct disasm_line *dl, struct arch *arch, struct map *map)
+static void disasm_line__init_ins(struct disasm_line *dl, struct arch *arch, struct map_symbol *ms)
 {
         dl->ins.ops = ins__find(arch, dl->ins.name);
 
         if (!dl->ins.ops)
                 return;
 
-        if (dl->ins.ops->parse && dl->ins.ops->parse(arch, &dl->ops, map) < 0)
+        if (dl->ins.ops->parse && dl->ins.ops->parse(arch, &dl->ops, ms) < 0)
                 dl->ins.ops = NULL;
 }
 
@@ -882,7 +1017,7 @@ out_free_name:
 struct annotate_args {
         size_t                   privsize;
         struct arch             *arch;
-        struct map              *map;
+        struct map_symbol        ms;
         struct perf_evsel       *evsel;
         s64                      offset;
         char                    *line;
@@ -964,7 +1099,7 @@ static struct disasm_line *disasm_line__new(struct annotate_args *args)
                         if (disasm_line__parse(dl->al.line, &dl->ins.name, &dl->ops.raw) < 0)
                                 goto out_free_line;
 
-                        disasm_line__init_ins(dl, args->arch, args->map);
+                        disasm_line__init_ins(dl, args->arch, &args->ms);
                 }
         }
 
@@ -1128,6 +1263,9 @@ annotation_line__print(struct annotation_line *al, struct symbol *sym, u64 start
                                 max_percent = sample->percent;
                 }
 
+                if (al->samples_nr > nr_percent)
+                        nr_percent = al->samples_nr;
+
                 if (max_percent < min_pcnt)
                         return -1;
 
@@ -1222,7 +1360,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, FILE *file,
                                       struct annotate_args *args,
                                       int *line_nr)
 {
-        struct map *map = args->map;
+        struct map *map = args->ms.map;
         struct annotation *notes = symbol__annotation(sym);
         struct disasm_line *dl;
         char *line = NULL, *parsed_line, *tmp, *tmp2;
@@ -1269,6 +1407,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, FILE *file,
         args->offset  = offset;
         args->line    = parsed_line;
         args->line_nr = *line_nr;
+        args->ms.sym  = sym;
 
         dl = disasm_line__new(args);
         free(line);
@@ -1277,14 +1416,14 @@ static int symbol__parse_objdump_line(struct symbol *sym, FILE *file,
         if (dl == NULL)
                 return -1;
 
-        if (!disasm_line__has_offset(dl)) {
+        if (!disasm_line__has_local_offset(dl)) {
                 dl->ops.target.offset = dl->ops.target.addr -
                                         map__rip_2objdump(map, sym->start);
                 dl->ops.target.offset_avail = true;
         }
 
-        /* kcore has no symbols, so add the call target name */
-        if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.name) {
+        /* kcore has no symbols, so add the call target symbol */
+        if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.sym) {
                 struct addr_map_symbol target = {
                         .map = map,
                         .addr = dl->ops.target.addr,
@@ -1292,7 +1431,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, FILE *file,
 
                 if (!map_groups__find_ams(&target) &&
                     target.sym->start == target.al_addr)
-                        dl->ops.target.name = strdup(target.sym->name);
+                        dl->ops.target.sym = target.sym;
         }
 
         annotation_line__add(&dl->al, &notes->src->source);
@@ -1421,9 +1560,9 @@ fallback:
 
 static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
 {
-        struct map *map = args->map;
+        struct map *map = args->ms.map;
         struct dso *dso = map->dso;
-        char command[PATH_MAX * 2];
+        char *command;
         FILE *file;
         char symfs_filename[PATH_MAX];
         struct kcore_extract kce;
@@ -1464,7 +1603,7 @@ static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
                 strcpy(symfs_filename, tmp);
         }
 
-        snprintf(command, sizeof(command),
+        err = asprintf(&command,
                  "%s %s%s --start-address=0x%016" PRIx64
                  " --stop-address=0x%016" PRIx64
                  " -l -d %s %s -C \"%s\" 2>/dev/null|grep -v \"%s:\"|expand",
@@ -1477,12 +1616,17 @@ static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
                  symbol_conf.annotate_src ? "-S" : "",
                  symfs_filename, symfs_filename);
 
+        if (err < 0) {
+                pr_err("Failure allocating memory for the command to run\n");
+                goto out_remove_tmp;
+        }
+
         pr_debug("Executing: %s\n", command);
 
         err = -1;
         if (pipe(stdout_fd) < 0) {
                 pr_err("Failure creating the pipe to run %s\n", command);
-                goto out_remove_tmp;
+                goto out_free_command;
         }
 
         pid = fork();
@@ -1509,7 +1653,7 @@ static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
                  * If we were using debug info should retry with
                  * original binary.
                  */
-                goto out_remove_tmp;
+                goto out_free_command;
         }
 
         nline = 0;
@@ -1537,6 +1681,8 @@ static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
 
         fclose(file);
         err = 0;
+out_free_command:
+        free(command);
 out_remove_tmp:
         close(stdout_fd[0]);
 
@@ -1550,7 +1696,7 @@ out:
 
 out_close_stdout:
         close(stdout_fd[1]);
-        goto out_remove_tmp;
+        goto out_free_command;
 }
 
 static void calc_percent(struct sym_hist *hist,
@@ -1613,7 +1759,6 @@ int symbol__annotate(struct symbol *sym, struct map *map,
 {
         struct annotate_args args = {
                 .privsize       = privsize,
-                .map            = map,
                 .evsel          = evsel,
         };
         struct perf_env *env = perf_evsel__env(evsel);
@@ -1639,6 +1784,9 @@ int symbol__annotate(struct symbol *sym, struct map *map,
                 }
         }
 
+        args.ms.map = map;
+        args.ms.sym = sym;
+
         return symbol__disassemble(sym, &args);
 }
 
@@ -1879,6 +2027,103 @@ int symbol__annotate_printf(struct symbol *sym, struct map *map,
         return more;
 }
 
+static void FILE__set_percent_color(void *fp __maybe_unused,
+                                    double percent __maybe_unused,
+                                    bool current __maybe_unused)
+{
+}
+
+static int FILE__set_jumps_percent_color(void *fp __maybe_unused,
+                                         int nr __maybe_unused, bool current __maybe_unused)
+{
+        return 0;
+}
+
+static int FILE__set_color(void *fp __maybe_unused, int color __maybe_unused)
+{
+        return 0;
+}
+
+static void FILE__printf(void *fp, const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        vfprintf(fp, fmt, args);
+        va_end(args);
+}
+
+static void FILE__write_graph(void *fp, int graph)
+{
+        const char *s;
+        switch (graph) {
+
+        case DARROW_CHAR: s = "↓"; break;
+        case UARROW_CHAR: s = "↑"; break;
+        case LARROW_CHAR: s = "←"; break;
+        case RARROW_CHAR: s = "→"; break;
+        default:                s = "?"; break;
+        }
+
+        fputs(s, fp);
+}
+
+int symbol__annotate_fprintf2(struct symbol *sym, FILE *fp)
+{
+        struct annotation *notes = symbol__annotation(sym);
+        struct annotation_write_ops ops = {
+                .first_line              = true,
+                .obj                     = fp,
+                .set_color               = FILE__set_color,
+                .set_percent_color       = FILE__set_percent_color,
+                .set_jumps_percent_color = FILE__set_jumps_percent_color,
+                .printf                  = FILE__printf,
+                .write_graph             = FILE__write_graph,
+        };
+        struct annotation_line *al;
+
+        list_for_each_entry(al, &notes->src->source, node) {
+                if (annotation_line__filter(al, notes))
+                        continue;
+                annotation_line__write(al, notes, &ops);
+                fputc('\n', fp);
+                ops.first_line = false;
+        }
+
+        return 0;
+}
+
+int map_symbol__annotation_dump(struct map_symbol *ms, struct perf_evsel *evsel)
+{
+        const char *ev_name = perf_evsel__name(evsel);
+        char buf[1024];
+        char *filename;
+        int err = -1;
+        FILE *fp;
+
+        if (asprintf(&filename, "%s.annotation", ms->sym->name) < 0)
+                return -1;
+
+        fp = fopen(filename, "w");
+        if (fp == NULL)
+                goto out_free_filename;
+
+        if (perf_evsel__is_group_event(evsel)) {
+                perf_evsel__group_desc(evsel, buf, sizeof(buf));
+                ev_name = buf;
+        }
+
+        fprintf(fp, "%s() %s\nEvent: %s\n\n",
+                ms->sym->name, ms->map->dso->long_name, ev_name);
+        symbol__annotate_fprintf2(ms->sym, fp);
+
+        fclose(fp);
+        err = 0;
+out_free_filename:
+        free(filename);
+        return err;
+}
+
 void symbol__annotate_zero_histogram(struct symbol *sym, int evidx)
 {
         struct annotation *notes = symbol__annotation(sym);
@@ -1938,8 +2183,109 @@ size_t disasm__fprintf(struct list_head *head, FILE *fp)
         return printed;
 }
 
+bool disasm_line__is_valid_local_jump(struct disasm_line *dl, struct symbol *sym)
+{
+        if (!dl || !dl->ins.ops || !ins__is_jump(&dl->ins) ||
+            !disasm_line__has_local_offset(dl) || dl->ops.target.offset < 0 ||
+            dl->ops.target.offset >= (s64)symbol__size(sym))
+                return false;
+
+        return true;
+}
+
+void annotation__mark_jump_targets(struct annotation *notes, struct symbol *sym)
+{
+        u64 offset, size = symbol__size(sym);
+
+        /* PLT symbols contain external offsets */
+        if (strstr(sym->name, "@plt"))
+                return;
+
+        for (offset = 0; offset < size; ++offset) {
+                struct annotation_line *al = notes->offsets[offset];
+                struct disasm_line *dl;
+
+                dl = disasm_line(al);
+
+                if (!disasm_line__is_valid_local_jump(dl, sym))
+                        continue;
+
+                al = notes->offsets[dl->ops.target.offset];
+
+                /*
+                 * FIXME: Oops, no jump target? Buggy disassembler? Or do we
+                 * have to adjust to the previous offset?
+                 */
+                if (al == NULL)
+                        continue;
+
+                if (++al->jump_sources > notes->max_jump_sources)
+                        notes->max_jump_sources = al->jump_sources;
+
+                ++notes->nr_jumps;
+        }
+}
+
+void annotation__set_offsets(struct annotation *notes, s64 size)
+{
+        struct annotation_line *al;
+
+        notes->max_line_len = 0;
+
+        list_for_each_entry(al, &notes->src->source, node) {
+                size_t line_len = strlen(al->line);
+
+                if (notes->max_line_len < line_len)
+                        notes->max_line_len = line_len;
+                al->idx = notes->nr_entries++;
+                if (al->offset != -1) {
+                        al->idx_asm = notes->nr_asm_entries++;
+                        /*
+                         * FIXME: short term bandaid to cope with assembly
+                         * routines that comes with labels in the same column
+                         * as the address in objdump, sigh.
+                         *
+                         * E.g. copy_user_generic_unrolled
+                         */
+                        if (al->offset < size)
+                                notes->offsets[al->offset] = al;
+                } else
+                        al->idx_asm = -1;
+        }
+}
+
+static inline int width_jumps(int n)
+{
+        if (n >= 100)
+                return 5;
+        if (n / 10)
+                return 2;
+        return 1;
+}
+
+void annotation__init_column_widths(struct annotation *notes, struct symbol *sym)
+{
+        notes->widths.addr = notes->widths.target =
+                notes->widths.min_addr = hex_width(symbol__size(sym));
+        notes->widths.max_addr = hex_width(sym->end);
+        notes->widths.jumps = width_jumps(notes->max_jump_sources);
+}
+
+void annotation__update_column_widths(struct annotation *notes)
+{
+        if (notes->options->use_offset)
+                notes->widths.target = notes->widths.min_addr;
+        else
+                notes->widths.target = notes->widths.max_addr;
+
+        notes->widths.addr = notes->widths.target;
+
+        if (notes->options->show_nr_jumps)
+                notes->widths.addr += notes->widths.jumps + 1;
+}
+
 static void annotation__calc_lines(struct annotation *notes, struct map *map,
-                                  struct rb_root *root, u64 start)
+                                  struct rb_root *root)
 {
         struct annotation_line *al;
         struct rb_root tmp_root = RB_ROOT;
@@ -1960,8 +2306,8 @@ static void annotation__calc_lines(struct annotation *notes, struct map *map,
                 if (percent_max <= 0.5)
                         continue;
 
-                al->path = get_srcline(map->dso, start + al->offset, NULL,
-                                       false, true, start + al->offset);
+                al->path = get_srcline(map->dso, notes->start + al->offset, NULL,
+                                       false, true, notes->start + al->offset);
                 insert_source_line(&tmp_root, al);
         }
 
@@ -1972,9 +2318,36 @@ static void symbol__calc_lines(struct symbol *sym, struct map *map,
                               struct rb_root *root)
 {
         struct annotation *notes = symbol__annotation(sym);
-        u64 start = map__rip_2objdump(map, sym->start);
 
-        annotation__calc_lines(notes, map, root, start);
+        annotation__calc_lines(notes, map, root);
+}
+
+int symbol__tty_annotate2(struct symbol *sym, struct map *map,
+                          struct perf_evsel *evsel, bool print_lines,
+                          bool full_paths)
+{
+        struct dso *dso = map->dso;
+        struct rb_root source_line = RB_ROOT;
+        struct annotation_options opts = annotation__default_options;
+        struct annotation *notes = symbol__annotation(sym);
+        char buf[1024];
+
+        if (symbol__annotate2(sym, map, evsel, &opts, NULL) < 0)
+                return -1;
+
+        if (print_lines) {
+                srcline_full_filename = full_paths;
+                symbol__calc_lines(sym, map, &source_line);
+                print_summary(&source_line, dso->long_name);
+        }
+
+        annotation__scnprintf_samples_period(notes, buf, sizeof(buf), evsel);
+        fprintf(stdout, "%s\n%s() %s\n", buf, sym->name, dso->long_name);
+        symbol__annotate_fprintf2(sym, stdout);
+
+        annotated_source__purge(symbol__annotation(sym)->src);
+
+        return 0;
 }
 
 int symbol__tty_annotate(struct symbol *sym, struct map *map,
@@ -2007,3 +2380,331 @@ bool ui__has_annotation(void)
 {
         return use_browser == 1 && perf_hpp_list.sym;
 }
+
+
+double annotation_line__max_percent(struct annotation_line *al, struct annotation *notes)
+{
+        double percent_max = 0.0;
+        int i;
+
+        for (i = 0; i < notes->nr_events; i++) {
+                if (al->samples[i].percent > percent_max)
+                        percent_max = al->samples[i].percent;
+        }
+
+        return percent_max;
+}
+
+static void disasm_line__write(struct disasm_line *dl, struct annotation *notes,
+                               void *obj, char *bf, size_t size,
+                               void (*obj__printf)(void *obj, const char *fmt, ...),
+                               void (*obj__write_graph)(void *obj, int graph))
+{
+        if (dl->ins.ops && dl->ins.ops->scnprintf) {
+                if (ins__is_jump(&dl->ins)) {
+                        bool fwd;
+
+                        if (dl->ops.target.outside)
+                                goto call_like;
+                        fwd = dl->ops.target.offset > dl->al.offset;
+                        obj__write_graph(obj, fwd ? DARROW_CHAR : UARROW_CHAR);
+                        obj__printf(obj, " ");
+                } else if (ins__is_call(&dl->ins)) {
+call_like:
+                        obj__write_graph(obj, RARROW_CHAR);
+                        obj__printf(obj, " ");
+                } else if (ins__is_ret(&dl->ins)) {
+                        obj__write_graph(obj, LARROW_CHAR);
+                        obj__printf(obj, " ");
+                } else {
+                        obj__printf(obj, "  ");
+                }
+        } else {
+                obj__printf(obj, "  ");
+        }
+
+        disasm_line__scnprintf(dl, bf, size, !notes->options->use_offset);
+}
+
+static void __annotation_line__write(struct annotation_line *al, struct annotation *notes,
+                                     bool first_line, bool current_entry, bool change_color, int width,
+                                     void *obj,
+                                     int  (*obj__set_color)(void *obj, int color),
+                                     void (*obj__set_percent_color)(void *obj, double percent, bool current),
+                                     int  (*obj__set_jumps_percent_color)(void *obj, int nr, bool current),
+                                     void (*obj__printf)(void *obj, const char *fmt, ...),
+                                     void (*obj__write_graph)(void *obj, int graph))
+
+{
+        double percent_max = annotation_line__max_percent(al, notes);
+        int pcnt_width = annotation__pcnt_width(notes),
+            cycles_width = annotation__cycles_width(notes);
+        bool show_title = false;
+        char bf[256];
+        int printed;
+
+        if (first_line && (al->offset == -1 || percent_max == 0.0)) {
+                if (notes->have_cycles) {
+                        if (al->ipc == 0.0 && al->cycles == 0)
+                                show_title = true;
+                } else
+                        show_title = true;
+        }
+
+        if (al->offset != -1 && percent_max != 0.0) {
+                int i;
+
+                for (i = 0; i < notes->nr_events; i++) {
+                        obj__set_percent_color(obj, al->samples[i].percent, current_entry);
+                        if (notes->options->show_total_period) {
+                                obj__printf(obj, "%11" PRIu64 " ", al->samples[i].he.period);
+                        } else if (notes->options->show_nr_samples) {
+                                obj__printf(obj, "%6" PRIu64 " ",
+                                                   al->samples[i].he.nr_samples);
+                        } else {
+                                obj__printf(obj, "%6.2f ",
+                                                   al->samples[i].percent);
+                        }
+                }
+        } else {
+                obj__set_percent_color(obj, 0, current_entry);
+
+                if (!show_title)
+                        obj__printf(obj, "%-*s", pcnt_width, " ");
+                else {
+                        obj__printf(obj, "%-*s", pcnt_width,
+                                           notes->options->show_total_period ? "Period" :
+                                           notes->options->show_nr_samples ? "Samples" : "Percent");
+                }
+        }
+
+        if (notes->have_cycles) {
+                if (al->ipc)
+                        obj__printf(obj, "%*.2f ", ANNOTATION__IPC_WIDTH - 1, al->ipc);
+                else if (!show_title)
+                        obj__printf(obj, "%*s", ANNOTATION__IPC_WIDTH, " ");
+                else
+                        obj__printf(obj, "%*s ", ANNOTATION__IPC_WIDTH - 1, "IPC");
+
+                if (al->cycles)
+                        obj__printf(obj, "%*" PRIu64 " ",
+                                           ANNOTATION__CYCLES_WIDTH - 1, al->cycles);
+                else if (!show_title)
+                        obj__printf(obj, "%*s", ANNOTATION__CYCLES_WIDTH, " ");
+                else
+                        obj__printf(obj, "%*s ", ANNOTATION__CYCLES_WIDTH - 1, "Cycle");
+        }
+
+        obj__printf(obj, " ");
+
+        if (!*al->line)
+                obj__printf(obj, "%-*s", width - pcnt_width - cycles_width, " ");
+        else if (al->offset == -1) {
+                if (al->line_nr && notes->options->show_linenr)
+                        printed = scnprintf(bf, sizeof(bf), "%-*d ", notes->widths.addr + 1, al->line_nr);
+                else
+                        printed = scnprintf(bf, sizeof(bf), "%-*s  ", notes->widths.addr, " ");
+                obj__printf(obj, bf);
+                obj__printf(obj, "%-*s", width - printed - pcnt_width - cycles_width + 1, al->line);
+        } else {
+                u64 addr = al->offset;
+                int color = -1;
+
+                if (!notes->options->use_offset)
+                        addr += notes->start;
+
+                if (!notes->options->use_offset) {
+                        printed = scnprintf(bf, sizeof(bf), "%" PRIx64 ": ", addr);
+                } else {
+                        if (al->jump_sources &&
+                            notes->options->offset_level >= ANNOTATION__OFFSET_JUMP_TARGETS) {
+                                if (notes->options->show_nr_jumps) {
+                                        int prev;
+                                        printed = scnprintf(bf, sizeof(bf), "%*d ",
+                                                            notes->widths.jumps,
+                                                            al->jump_sources);
+                                        prev = obj__set_jumps_percent_color(obj, al->jump_sources,
+                                                                            current_entry);
+                                        obj__printf(obj, bf);
+                                        obj__set_color(obj, prev);
+                                }
+print_addr:
+                                printed = scnprintf(bf, sizeof(bf), "%*" PRIx64 ": ",
+                                                    notes->widths.target, addr);
+                        } else if (ins__is_call(&disasm_line(al)->ins) &&
+                                   notes->options->offset_level >= ANNOTATION__OFFSET_CALL) {
+                                goto print_addr;
+                        } else if (notes->options->offset_level == ANNOTATION__MAX_OFFSET_LEVEL) {
+                                goto print_addr;
+                        } else {
+                                printed = scnprintf(bf, sizeof(bf), "%-*s  ",
+                                                    notes->widths.addr, " ");
+                        }
+                }
+
+                if (change_color)
+                        color = obj__set_color(obj, HE_COLORSET_ADDR);
+                obj__printf(obj, bf);
+                if (change_color)
+                        obj__set_color(obj, color);
+
+                disasm_line__write(disasm_line(al), notes, obj, bf, sizeof(bf), obj__printf, obj__write_graph);
+
+                obj__printf(obj, "%-*s", width - pcnt_width - cycles_width - 3 - printed, bf);
+        }
+
+}
+
+void annotation_line__write(struct annotation_line *al, struct annotation *notes,
+                            struct annotation_write_ops *ops)
+{
+        __annotation_line__write(al, notes, ops->first_line, ops->current_entry,
+                                 ops->change_color, ops->width, ops->obj,
+                                 ops->set_color, ops->set_percent_color,
+                                 ops->set_jumps_percent_color, ops->printf,
+                                 ops->write_graph);
+}
+
+int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *evsel,
+                      struct annotation_options *options, struct arch **parch)
+{
+        struct annotation *notes = symbol__annotation(sym);
+        size_t size = symbol__size(sym);
+        int nr_pcnt = 1, err;
+
+        notes->offsets = zalloc(size * sizeof(struct annotation_line *));
+        if (notes->offsets == NULL)
+                return -1;
+
+        if (perf_evsel__is_group_event(evsel))
+                nr_pcnt = evsel->nr_members;
+
+        err = symbol__annotate(sym, map, evsel, 0, parch);
+        if (err)
+                goto out_free_offsets;
+
+        notes->options = options;
+
+        symbol__calc_percent(sym, evsel);
+
+        notes->start = map__rip_2objdump(map, sym->start);
+
+        annotation__set_offsets(notes, size);
+        annotation__mark_jump_targets(notes, sym);
+        annotation__compute_ipc(notes, size);
+        annotation__init_column_widths(notes, sym);
+        notes->nr_events = nr_pcnt;
+
+        annotation__update_column_widths(notes);
+
+        return 0;
+
+out_free_offsets:
+        zfree(&notes->offsets);
+        return -1;
+}
+
+int __annotation__scnprintf_samples_period(struct annotation *notes,
+                                           char *bf, size_t size,
+                                           struct perf_evsel *evsel,
+                                           bool show_freq)
+{
+        const char *ev_name = perf_evsel__name(evsel);
+        char buf[1024], ref[30] = " show reference callgraph, ";
+        char sample_freq_str[64] = "";
+        unsigned long nr_samples = 0;
+        int nr_members = 1;
+        bool enable_ref = false;
+        u64 nr_events = 0;
+        char unit;
+        int i;
+
+        if (perf_evsel__is_group_event(evsel)) {
+                perf_evsel__group_desc(evsel, buf, sizeof(buf));
+                ev_name = buf;
+                nr_members = evsel->nr_members;
+        }
+
+        for (i = 0; i < nr_members; i++) {
+                struct sym_hist *ah = annotation__histogram(notes, evsel->idx + i);
+
+                nr_samples += ah->nr_samples;
+                nr_events  += ah->period;
+        }
+
+        if (symbol_conf.show_ref_callgraph && strstr(ev_name, "call-graph=no"))
+                enable_ref = true;
+
+        if (show_freq)
+                scnprintf(sample_freq_str, sizeof(sample_freq_str), " %d Hz,", evsel->attr.sample_freq);
+
+        nr_samples = convert_unit(nr_samples, &unit);
+        return scnprintf(bf, size, "Samples: %lu%c of event%s '%s',%s%sEvent count (approx.): %" PRIu64,
+                         nr_samples, unit, evsel->nr_members > 1 ? "s" : "",
+                         ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events);
+}
+
+#define ANNOTATION__CFG(n) \
+        { .name = #n, .value = &annotation__default_options.n, }
+
+/*
+ * Keep the entries sorted, they are bsearch'ed
+ */
+static struct annotation_config {
+        const char *name;
+        void *value;
+} annotation__configs[] = {
+        ANNOTATION__CFG(hide_src_code),
+        ANNOTATION__CFG(jump_arrows),
+        ANNOTATION__CFG(offset_level),
+        ANNOTATION__CFG(show_linenr),
+        ANNOTATION__CFG(show_nr_jumps),
+        ANNOTATION__CFG(show_nr_samples),
+        ANNOTATION__CFG(show_total_period),
+        ANNOTATION__CFG(use_offset),
+};
+
+#undef ANNOTATION__CFG
+
+static int annotation_config__cmp(const void *name, const void *cfgp)
+{
+        const struct annotation_config *cfg = cfgp;
+
+        return strcmp(name, cfg->name);
+}
+
+static int annotation__config(const char *var, const char *value,
+                            void *data __maybe_unused)
+{
+        struct annotation_config *cfg;
+        const char *name;
+
+        if (!strstarts(var, "annotate."))
+                return 0;
+
+        name = var + 9;
+        cfg = bsearch(name, annotation__configs, ARRAY_SIZE(annotation__configs),
+                      sizeof(struct annotation_config), annotation_config__cmp);
+
+        if (cfg == NULL)
+                pr_debug("%s variable unknown, ignoring...", var);
+        else if (strcmp(var, "annotate.offset_level") == 0) {
+                perf_config_int(cfg->value, name, value);
+
+                if (*(int *)cfg->value > ANNOTATION__MAX_OFFSET_LEVEL)
+                        *(int *)cfg->value = ANNOTATION__MAX_OFFSET_LEVEL;
+                else if (*(int *)cfg->value < ANNOTATION__MIN_OFFSET_LEVEL)
+                        *(int *)cfg->value = ANNOTATION__MIN_OFFSET_LEVEL;
+        } else {
+                *(bool *)cfg->value = perf_config_bool(name, value);
+        }
+        return 0;
+}
+
+void annotation_config__init(void)
+{
+        perf_config(annotation__config, NULL);
+
+        annotation__default_options.show_total_period = symbol_conf.show_total_period;
+        annotation__default_options.show_nr_samples   = symbol_conf.show_nr_samples;
+}
diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
index ce427445671f..f28a9e43421d 100644
--- a/tools/perf/util/annotate.h
+++ b/tools/perf/util/annotate.h
@@ -24,9 +24,11 @@ struct ins_operands {
         struct {
                 char    *raw;
                 char    *name;
+                struct symbol *sym;
                 u64     addr;
                 s64     offset;
                 bool    offset_avail;
+                bool    outside;
         } target;
         union {
                 struct {
@@ -45,7 +47,7 @@ struct arch;
 
 struct ins_ops {
         void (*free)(struct ins_operands *ops);
-        int (*parse)(struct arch *arch, struct ins_operands *ops, struct map *map);
+        int (*parse)(struct arch *arch, struct ins_operands *ops, struct map_symbol *ms);
         int (*scnprintf)(struct ins *ins, char *bf, size_t size,
                          struct ins_operands *ops);
 };
@@ -57,6 +59,30 @@ bool ins__is_lock(const struct ins *ins);
 int ins__scnprintf(struct ins *ins, char *bf, size_t size, struct ins_operands *ops);
 bool ins__is_fused(struct arch *arch, const char *ins1, const char *ins2);
 
+#define ANNOTATION__IPC_WIDTH 6
+#define ANNOTATION__CYCLES_WIDTH 6
+
+struct annotation_options {
+        bool hide_src_code,
+             use_offset,
+             jump_arrows,
+             show_linenr,
+             show_nr_jumps,
+             show_nr_samples,
+             show_total_period;
+        u8   offset_level;
+};
+
+enum {
+        ANNOTATION__OFFSET_JUMP_TARGETS = 1,
+        ANNOTATION__OFFSET_CALL,
+        ANNOTATION__MAX_OFFSET_LEVEL,
+};
+
+#define ANNOTATION__MIN_OFFSET_LEVEL ANNOTATION__OFFSET_JUMP_TARGETS
+
+extern struct annotation_options annotation__default_options;
+
 struct annotation;
 
 struct sym_hist_entry {
@@ -76,10 +102,13 @@ struct annotation_line {
         s64                      offset;
         char                    *line;
         int                      line_nr;
+        int                      jump_sources;
         float                    ipc;
         u64                      cycles;
         size_t                   privsize;
         char                    *path;
+        u32                      idx;
+        int                      idx_asm;
         int                      samples_nr;
         struct annotation_data   samples[0];
 };
@@ -97,14 +126,52 @@ static inline struct disasm_line *disasm_line(struct annotation_line *al)
         return al ? container_of(al, struct disasm_line, al) : NULL;
 }
 
-static inline bool disasm_line__has_offset(const struct disasm_line *dl)
+/*
+ * Is this offset in the same function as the line it is used?
+ * asm functions jump to other functions, for instance.
+ */
+static inline bool disasm_line__has_local_offset(const struct disasm_line *dl)
 {
-        return dl->ops.target.offset_avail;
+        return dl->ops.target.offset_avail && !dl->ops.target.outside;
 }
 
+/*
+ * Can we draw an arrow from the jump to its target, for instance? I.e.
+ * is the jump and its target in the same function?
+ */
+bool disasm_line__is_valid_local_jump(struct disasm_line *dl, struct symbol *sym);
+
 void disasm_line__free(struct disasm_line *dl);
 struct annotation_line *
 annotation_line__next(struct annotation_line *pos, struct list_head *head);
+
+struct annotation_write_ops {
+        bool first_line, current_entry, change_color;
+        int  width;
+        void *obj;
+        int  (*set_color)(void *obj, int color);
+        void (*set_percent_color)(void *obj, double percent, bool current);
+        int  (*set_jumps_percent_color)(void *obj, int nr, bool current);
+        void (*printf)(void *obj, const char *fmt, ...);
+        void (*write_graph)(void *obj, int graph);
+};
+
+double annotation_line__max_percent(struct annotation_line *al, struct annotation *notes);
+void annotation_line__write(struct annotation_line *al, struct annotation *notes,
+                            struct annotation_write_ops *ops);
+
+int __annotation__scnprintf_samples_period(struct annotation *notes,
+                                           char *bf, size_t size,
+                                           struct perf_evsel *evsel,
+                                           bool show_freq);
+
+static inline int annotation__scnprintf_samples_period(struct annotation *notes,
+                                                       char *bf, size_t size,
+                                                       struct perf_evsel *evsel)
+{
+        return __annotation__scnprintf_samples_period(notes, bf, size, evsel, true);
+}
+
 int disasm_line__scnprintf(struct disasm_line *dl, char *bf, size_t size, bool raw);
 size_t disasm__fprintf(struct list_head *head, FILE *fp);
 void symbol__calc_percent(struct symbol *sym, struct perf_evsel *evsel);
@@ -150,9 +217,47 @@ struct annotated_source {
 struct annotation {
         pthread_mutex_t         lock;
         u64                     max_coverage;
+        u64                     start;
+        struct annotation_options *options;
+        struct annotation_line  **offsets;
+        int                     nr_events;
+        int                     nr_jumps;
+        int                     max_jump_sources;
+        int                     nr_entries;
+        int                     nr_asm_entries;
+        u16                     max_line_len;
+        struct {
+                u8              addr;
+                u8              jumps;
+                u8              target;
+                u8              min_addr;
+                u8              max_addr;
+        } widths;
+        bool                    have_cycles;
         struct annotated_source *src;
 };
 
+static inline int annotation__cycles_width(struct annotation *notes)
+{
+        return notes->have_cycles ? ANNOTATION__IPC_WIDTH + ANNOTATION__CYCLES_WIDTH : 0;
+}
+
+static inline int annotation__pcnt_width(struct annotation *notes)
+{
+        return (notes->options->show_total_period ? 12 : 7) * notes->nr_events;
+}
+
+static inline bool annotation_line__filter(struct annotation_line *al, struct annotation *notes)
+{
+        return notes->options->hide_src_code && al->offset == -1;
+}
+
+void annotation__set_offsets(struct annotation *notes, s64 size);
+void annotation__compute_ipc(struct annotation *notes, size_t size);
+void annotation__mark_jump_targets(struct annotation *notes, struct symbol *sym);
+void annotation__update_column_widths(struct annotation *notes);
+void annotation__init_column_widths(struct annotation *notes, struct symbol *sym);
+
 static inline struct sym_hist *annotation__histogram(struct annotation *notes, int idx)
 {
         return (((void *)&notes->src->histograms) +
@@ -180,6 +285,10 @@ void symbol__annotate_zero_histograms(struct symbol *sym);
 int symbol__annotate(struct symbol *sym, struct map *map,
                      struct perf_evsel *evsel, size_t privsize,
                      struct arch **parch);
+int symbol__annotate2(struct symbol *sym, struct map *map,
+                      struct perf_evsel *evsel,
+                      struct annotation_options *options,
+                      struct arch **parch);
 
 enum symbol_disassemble_errno {
         SYMBOL_ANNOTATE_ERRNO__SUCCESS          = 0,
@@ -204,16 +313,23 @@ int symbol__strerror_disassemble(struct symbol *sym, struct map *map,
 int symbol__annotate_printf(struct symbol *sym, struct map *map,
                             struct perf_evsel *evsel, bool full_paths,
                             int min_pcnt, int max_lines, int context);
+int symbol__annotate_fprintf2(struct symbol *sym, FILE *fp);
 void symbol__annotate_zero_histogram(struct symbol *sym, int evidx);
 void symbol__annotate_decay_histogram(struct symbol *sym, int evidx);
 void annotated_source__purge(struct annotated_source *as);
 
+int map_symbol__annotation_dump(struct map_symbol *ms, struct perf_evsel *evsel);
+
 bool ui__has_annotation(void);
 
 int symbol__tty_annotate(struct symbol *sym, struct map *map,
                          struct perf_evsel *evsel, bool print_lines,
                          bool full_paths, int min_pcnt, int max_lines);
 
+int symbol__tty_annotate2(struct symbol *sym, struct map *map,
+                          struct perf_evsel *evsel, bool print_lines,
+                          bool full_paths);
+
 #ifdef HAVE_SLANG_SUPPORT
 int symbol__tui_annotate(struct symbol *sym, struct map *map,
                          struct perf_evsel *evsel,
@@ -231,4 +347,6 @@ static inline int symbol__tui_annotate(struct symbol *sym __maybe_unused,
 
 extern const char       *disassembler_style;
 
+void annotation_config__init(void);
+
 #endif  /* __PERF_ANNOTATE_H */
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 6470ea2aa25e..857de69a5361 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -233,9 +233,9 @@ static void *auxtrace_copy_data(u64 size, struct perf_session *session)
         return p;
 }
 
-static int auxtrace_queues__add_buffer(struct auxtrace_queues *queues,
-                                       unsigned int idx,
-                                       struct auxtrace_buffer *buffer)
+static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues,
+                                         unsigned int idx,
+                                         struct auxtrace_buffer *buffer)
 {
         struct auxtrace_queue *queue;
         int err;
@@ -286,7 +286,7 @@ static int auxtrace_queues__split_buffer(struct auxtrace_queues *queues,
                         return -ENOMEM;
                 b->size = BUFFER_LIMIT_FOR_32_BIT;
                 b->consecutive = consecutive;
-                err = auxtrace_queues__add_buffer(queues, idx, b);
+                err = auxtrace_queues__queue_buffer(queues, idx, b);
                 if (err) {
                         auxtrace_buffer__free(b);
                         return err;
@@ -302,31 +302,6 @@ static int auxtrace_queues__split_buffer(struct auxtrace_queues *queues,
         return 0;
 }
 
-static int auxtrace_queues__add_event_buffer(struct auxtrace_queues *queues,
-                                             struct perf_session *session,
-                                             unsigned int idx,
-                                             struct auxtrace_buffer *buffer)
-{
-        if (session->one_mmap) {
-                buffer->data = buffer->data_offset - session->one_mmap_offset +
-                               session->one_mmap_addr;
-        } else if (perf_data__is_pipe(session->data)) {
-                buffer->data = auxtrace_copy_data(buffer->size, session);
-                if (!buffer->data)
-                        return -ENOMEM;
-                buffer->data_needs_freeing = true;
-        } else if (BITS_PER_LONG == 32 &&
-                   buffer->size > BUFFER_LIMIT_FOR_32_BIT) {
-                int err;
-
-                err = auxtrace_queues__split_buffer(queues, idx, buffer);
-                if (err)
-                        return err;
-        }
-
-        return auxtrace_queues__add_buffer(queues, idx, buffer);
-}
-
 static bool filter_cpu(struct perf_session *session, int cpu)
 {
         unsigned long *cpu_bitmap = session->itrace_synth_opts->cpu_bitmap;
@@ -334,45 +309,71 @@ static bool filter_cpu(struct perf_session *session, int cpu)
         return cpu_bitmap && cpu != -1 && !test_bit(cpu, cpu_bitmap);
 }
 
-int auxtrace_queues__add_event(struct auxtrace_queues *queues,
-                               struct perf_session *session,
-                               union perf_event *event, off_t data_offset,
-                               struct auxtrace_buffer **buffer_ptr)
+static int auxtrace_queues__add_buffer(struct auxtrace_queues *queues,
+                                       struct perf_session *session,
+                                       unsigned int idx,
+                                       struct auxtrace_buffer *buffer,
+                                       struct auxtrace_buffer **buffer_ptr)
 {
-        struct auxtrace_buffer *buffer;
-        unsigned int idx;
-        int err;
+        int err = -ENOMEM;
 
-        if (filter_cpu(session, event->auxtrace.cpu))
+        if (filter_cpu(session, buffer->cpu))
                 return 0;
 
-        buffer = zalloc(sizeof(struct auxtrace_buffer));
+        buffer = memdup(buffer, sizeof(*buffer));
         if (!buffer)
                 return -ENOMEM;
 
-        buffer->pid = -1;
-        buffer->tid = event->auxtrace.tid;
-        buffer->cpu = event->auxtrace.cpu;
-        buffer->data_offset = data_offset;
-        buffer->offset = event->auxtrace.offset;
-        buffer->reference = event->auxtrace.reference;
-        buffer->size = event->auxtrace.size;
-        idx = event->auxtrace.idx;
+        if (session->one_mmap) {
+                buffer->data = buffer->data_offset - session->one_mmap_offset +
+                               session->one_mmap_addr;
+        } else if (perf_data__is_pipe(session->data)) {
+                buffer->data = auxtrace_copy_data(buffer->size, session);
+                if (!buffer->data)
+                        goto out_free;
+                buffer->data_needs_freeing = true;
+        } else if (BITS_PER_LONG == 32 &&
+                   buffer->size > BUFFER_LIMIT_FOR_32_BIT) {
+                err = auxtrace_queues__split_buffer(queues, idx, buffer);
+                if (err)
+                        goto out_free;
+        }
 
-        err = auxtrace_queues__add_event_buffer(queues, session, idx, buffer);
+        err = auxtrace_queues__queue_buffer(queues, idx, buffer);
         if (err)
-                goto out_err;
+                goto out_free;
 
+        /* FIXME: Doesn't work for split buffer */
         if (buffer_ptr)
                 *buffer_ptr = buffer;
 
         return 0;
 
-out_err:
+out_free:
         auxtrace_buffer__free(buffer);
         return err;
 }
 
+int auxtrace_queues__add_event(struct auxtrace_queues *queues,
+                               struct perf_session *session,
+                               union perf_event *event, off_t data_offset,
+                               struct auxtrace_buffer **buffer_ptr)
+{
+        struct auxtrace_buffer buffer = {
+                .pid = -1,
+                .tid = event->auxtrace.tid,
+                .cpu = event->auxtrace.cpu,
+                .data_offset = data_offset,
+                .offset = event->auxtrace.offset,
+                .reference = event->auxtrace.reference,
+                .size = event->auxtrace.size,
+        };
+        unsigned int idx = event->auxtrace.idx;
+
+        return auxtrace_queues__add_buffer(queues, session, idx, &buffer,
+                                           buffer_ptr);
+}
+
 static int auxtrace_queues__add_indexed_event(struct auxtrace_queues *queues,
                                               struct perf_session *session,
                                               off_t file_offset, size_t sz)
diff --git a/tools/perf/util/auxtrace.h b/tools/perf/util/auxtrace.h
index 453c148d2158..e731f55da072 100644
--- a/tools/perf/util/auxtrace.h
+++ b/tools/perf/util/auxtrace.h
@@ -130,6 +130,7 @@ struct auxtrace_index {
 /**
  * struct auxtrace - session callbacks to allow AUX area data decoding.
  * @process_event: lets the decoder see all session events
+ * @process_auxtrace_event: process a PERF_RECORD_AUXTRACE event
  * @flush_events: process any remaining data
  * @free_events: free resources associated with event processing
  * @free: free resources associated with the session
@@ -301,6 +302,7 @@ struct auxtrace_mmap_params {
  * @parse_snapshot_options: parse snapshot options
  * @reference: provide a 64-bit reference number for auxtrace_event
  * @read_finish: called after reading from an auxtrace mmap
+ * @alignment: alignment (if any) for AUX area data
  */
 struct auxtrace_record {
         int (*recording_options)(struct auxtrace_record *itr,
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index 7f8553630c4d..537eadd81914 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -316,7 +316,6 @@ static int machine__write_buildid_table(struct machine *machine,
                                         struct feat_fd *fd)
 {
         int err = 0;
-        char nm[PATH_MAX];
         struct dso *pos;
         u16 kmisc = PERF_RECORD_MISC_KERNEL,
             umisc = PERF_RECORD_MISC_USER;
@@ -338,9 +337,8 @@ static int machine__write_buildid_table(struct machine *machine,
                         name = pos->short_name;
                         name_len = pos->short_name_len;
                 } else if (dso__is_kcore(pos)) {
-                        machine__mmap_name(machine, nm, sizeof(nm));
-                        name = nm;
-                        name_len = strlen(nm);
+                        name = machine->mmap_name;
+                        name_len = strlen(name);
                 } else {
                         name = pos->long_name;
                         name_len = pos->long_name_len;
@@ -813,12 +811,10 @@ static int dso__cache_build_id(struct dso *dso, struct machine *machine)
         bool is_kallsyms = dso__is_kallsyms(dso);
         bool is_vdso = dso__is_vdso(dso);
         const char *name = dso->long_name;
-        char nm[PATH_MAX];
 
         if (dso__is_kcore(dso)) {
                 is_kallsyms = true;
-                machine__mmap_name(machine, nm, sizeof(nm));
-                name = nm;
+                name = machine->mmap_name;
         }
         return build_id_cache__add_b(dso->build_id, sizeof(dso->build_id), name,
                                      dso->nsinfo, is_kallsyms, is_vdso);
diff --git a/tools/perf/util/c++/clang-test.cpp b/tools/perf/util/c++/clang-test.cpp
index a4014d786676..7b042a5ebc68 100644
--- a/tools/perf/util/c++/clang-test.cpp
+++ b/tools/perf/util/c++/clang-test.cpp
@@ -41,7 +41,7 @@ int test__clang_to_IR(void)
         if (!M)
                 return -1;
         for (llvm::Function& F : *M)
-                if (F.getName() == "bpf_func__SyS_epoll_wait")
+                if (F.getName() == "bpf_func__SyS_epoll_pwait")
                         return 0;
         return -1;
 }
diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp
index 1bfc946e37dc..bf31ceab33bd 100644
--- a/tools/perf/util/c++/clang.cpp
+++ b/tools/perf/util/c++/clang.cpp
@@ -9,6 +9,7 @@
  * Copyright (C) 2016 Huawei Inc.
  */
 
+#include "clang/Basic/Version.h"
 #include "clang/CodeGen/CodeGenAction.h"
 #include "clang/Frontend/CompilerInvocation.h"
 #include "clang/Frontend/CompilerInstance.h"
@@ -58,7 +59,8 @@ createCompilerInvocation(llvm::opt::ArgStringList CFlags, StringRef& Path,
 
         FrontendOptions& Opts = CI->getFrontendOpts();
         Opts.Inputs.clear();
-        Opts.Inputs.emplace_back(Path, IK_C);
+        Opts.Inputs.emplace_back(Path,
+                        FrontendOptions::getInputKindForExtension("c"));
         return CI;
 }
 
@@ -71,10 +73,17 @@ getModuleFromSource(llvm::opt::ArgStringList CFlags,
 
         Clang.setVirtualFileSystem(&*VFS);
 
+#if CLANG_VERSION_MAJOR < 4
         IntrusiveRefCntPtr<CompilerInvocation> CI =
                 createCompilerInvocation(std::move(CFlags), Path,
                                          Clang.getDiagnostics());
         Clang.setInvocation(&*CI);
+#else
+        std::shared_ptr<CompilerInvocation> CI(
+                createCompilerInvocation(std::move(CFlags), Path,
+                                         Clang.getDiagnostics()));
+        Clang.setInvocation(CI);
+#endif
 
         std::unique_ptr<CodeGenAction> Act(new EmitLLVMOnlyAction(&*LLVMCtx));
         if (!Clang.ExecuteAction(*Act))
diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
index 984f69144f87..decb91f9da82 100644
--- a/tools/perf/util/cgroup.c
+++ b/tools/perf/util/cgroup.c
@@ -71,7 +71,7 @@ cgroupfs_find_mountpoint(char *buf, size_t maxlen)
         return -1;
 }
 
-static int open_cgroup(char *name)
+static int open_cgroup(const char *name)
 {
         char path[PATH_MAX + 1];
         char mnt[PATH_MAX + 1];
@@ -81,7 +81,7 @@ static int open_cgroup(char *name)
         if (cgroupfs_find_mountpoint(mnt, PATH_MAX + 1))
                 return -1;
 
-        snprintf(path, PATH_MAX, "%s/%s", mnt, name);
+        scnprintf(path, PATH_MAX, "%s/%s", mnt, name);
 
         fd = open(path, O_RDONLY);
         if (fd == -1)
@@ -90,41 +90,64 @@ static int open_cgroup(char *name)
         return fd;
 }
 
-static int add_cgroup(struct perf_evlist *evlist, char *str)
+static struct cgroup *evlist__find_cgroup(struct perf_evlist *evlist, const char *str)
 {
         struct perf_evsel *counter;
-        struct cgroup_sel *cgrp = NULL;
-        int n;
+        struct cgroup *cgrp = NULL;
         /*
          * check if cgrp is already defined, if so we reuse it
          */
         evlist__for_each_entry(evlist, counter) {
-                cgrp = counter->cgrp;
-                if (!cgrp)
+                if (!counter->cgrp)
                         continue;
-                if (!strcmp(cgrp->name, str)) {
-                        refcount_inc(&cgrp->refcnt);
+                if (!strcmp(counter->cgrp->name, str)) {
+                        cgrp = cgroup__get(counter->cgrp);
                         break;
                 }
-
-                cgrp = NULL;
         }
 
-        if (!cgrp) {
-                cgrp = zalloc(sizeof(*cgrp));
-                if (!cgrp)
-                        return -1;
+        return cgrp;
+}
 
-                cgrp->name = str;
-                refcount_set(&cgrp->refcnt, 1);
+static struct cgroup *cgroup__new(const char *name)
+{
+        struct cgroup *cgroup = zalloc(sizeof(*cgroup));
 
-                cgrp->fd = open_cgroup(str);
-                if (cgrp->fd == -1) {
-                        free(cgrp);
-                        return -1;
-                }
+        if (cgroup != NULL) {
+                refcount_set(&cgroup->refcnt, 1);
+
+                cgroup->name = strdup(name);
+                if (!cgroup->name)
+                        goto out_err;
+                cgroup->fd = open_cgroup(name);
+                if (cgroup->fd == -1)
+                        goto out_free_name;
         }
 
+        return cgroup;
+
+out_free_name:
+        free(cgroup->name);
+out_err:
+        free(cgroup);
+        return NULL;
+}
+
+struct cgroup *evlist__findnew_cgroup(struct perf_evlist *evlist, const char *name)
+{
+        struct cgroup *cgroup = evlist__find_cgroup(evlist, name);
+
+        return cgroup ?: cgroup__new(name);
+}
+
+static int add_cgroup(struct perf_evlist *evlist, const char *str)
+{
+        struct perf_evsel *counter;
+        struct cgroup *cgrp = evlist__findnew_cgroup(evlist, str);
+        int n;
+
+        if (!cgrp)
+                return -1;
         /*
          * find corresponding event
          * if add cgroup N, then need to find event N
@@ -135,31 +158,58 @@ static int add_cgroup(struct perf_evlist *evlist, char *str)
                         goto found;
                 n++;
         }
-        if (refcount_dec_and_test(&cgrp->refcnt))
-                free(cgrp);
 
+        cgroup__put(cgrp);
         return -1;
 found:
         counter->cgrp = cgrp;
         return 0;
 }
 
-void close_cgroup(struct cgroup_sel *cgrp)
+static void cgroup__delete(struct cgroup *cgroup)
+{
+        close(cgroup->fd);
+        zfree(&cgroup->name);
+        free(cgroup);
+}
+
+void cgroup__put(struct cgroup *cgrp)
 {
         if (cgrp && refcount_dec_and_test(&cgrp->refcnt)) {
-                close(cgrp->fd);
-                zfree(&cgrp->name);
-                free(cgrp);
+                cgroup__delete(cgrp);
         }
 }
 
-int parse_cgroups(const struct option *opt __maybe_unused, const char *str,
+struct cgroup *cgroup__get(struct cgroup *cgroup)
+{
+       if (cgroup)
+                refcount_inc(&cgroup->refcnt);
+       return cgroup;
+}
+
+static void evsel__set_default_cgroup(struct perf_evsel *evsel, struct cgroup *cgroup)
+{
+        if (evsel->cgrp == NULL)
+                evsel->cgrp = cgroup__get(cgroup);
+}
+
+void evlist__set_default_cgroup(struct perf_evlist *evlist, struct cgroup *cgroup)
+{
+        struct perf_evsel *evsel;
+
+        evlist__for_each_entry(evlist, evsel)
+                evsel__set_default_cgroup(evsel, cgroup);
+}
+
+int parse_cgroups(const struct option *opt, const char *str,
                   int unset __maybe_unused)
 {
         struct perf_evlist *evlist = *(struct perf_evlist **)opt->value;
+        struct perf_evsel *counter;
+        struct cgroup *cgrp = NULL;
         const char *p, *e, *eos = str + strlen(str);
         char *s;
-        int ret;
+        int ret, i;
 
         if (list_empty(&evlist->entries)) {
                 fprintf(stderr, "must define events before cgroups\n");
@@ -177,10 +227,9 @@ int parse_cgroups(const struct option *opt __maybe_unused, const char *str,
                         if (!s)
                                 return -1;
                         ret = add_cgroup(evlist, s);
-                        if (ret) {
-                                free(s);
+                        free(s);
+                        if (ret)
                                 return -1;
-                        }
                 }
                 /* nr_cgroups is increased een for empty cgroups */
                 nr_cgroups++;
@@ -188,5 +237,18 @@ int parse_cgroups(const struct option *opt __maybe_unused, const char *str,
                         break;
                 str = p+1;
         }
+        /* for the case one cgroup combine to multiple events */
+        i = 0;
+        if (nr_cgroups == 1) {
+                evlist__for_each_entry(evlist, counter) {
+                        if (i == 0)
+                                cgrp = counter->cgrp;
+                        else {
+                                counter->cgrp = cgrp;
+                                refcount_inc(&cgrp->refcnt);
+                        }
+                        i++;
+                }
+        }
         return 0;
 }
diff --git a/tools/perf/util/cgroup.h b/tools/perf/util/cgroup.h
index afafc87e9201..f033a80c1b14 100644
--- a/tools/perf/util/cgroup.h
+++ b/tools/perf/util/cgroup.h
@@ -6,7 +6,7 @@
 
 struct option;
 
-struct cgroup_sel {
+struct cgroup {
         char *name;
         int fd;
         refcount_t refcnt;
@@ -14,7 +14,16 @@ struct cgroup_sel {
 
 
 extern int nr_cgroups; /* number of explicit cgroups defined */
-void close_cgroup(struct cgroup_sel *cgrp);
+
+struct cgroup *cgroup__get(struct cgroup *cgroup);
+void cgroup__put(struct cgroup *cgroup);
+
+struct perf_evlist;
+
+struct cgroup *evlist__findnew_cgroup(struct perf_evlist *evlist, const char *name);
+
+void evlist__set_default_cgroup(struct perf_evlist *evlist, struct cgroup *cgroup);
+
 int parse_cgroups(const struct option *opt, const char *str, int unset);
 
 #endif /* __CGROUP_H__ */
diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
index 1fb01849f1c7..c8b98fa22997 100644
--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
@@ -1,6 +1,5 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
- * SPDX-License-Identifier: GPL-2.0
- *
  * Copyright(C) 2015-2018 Linaro Limited.
  *
  * Author: Tor Jeremiassen <tor@ti.com>
@@ -78,6 +77,8 @@ int cs_etm_decoder__reset(struct cs_etm_decoder *decoder)
 {
         ocsd_datapath_resp_t dp_ret;
 
+        decoder->prev_return = OCSD_RESP_CONT;
+
         dp_ret = ocsd_dt_process_data(decoder->dcd_tree, OCSD_OP_RESET,
                                       0, 0, NULL, NULL);
         if (OCSD_DATA_RESP_IS_FATAL(dp_ret))
@@ -253,16 +254,16 @@ static void cs_etm_decoder__clear_buffer(struct cs_etm_decoder *decoder)
         decoder->packet_count = 0;
         for (i = 0; i < MAX_BUFFER; i++) {
                 decoder->packet_buffer[i].start_addr = 0xdeadbeefdeadbeefUL;
-                decoder->packet_buffer[i].end_addr   = 0xdeadbeefdeadbeefUL;
-                decoder->packet_buffer[i].exc        = false;
-                decoder->packet_buffer[i].exc_ret    = false;
-                decoder->packet_buffer[i].cpu        = INT_MIN;
+                decoder->packet_buffer[i].end_addr = 0xdeadbeefdeadbeefUL;
+                decoder->packet_buffer[i].last_instr_taken_branch = false;
+                decoder->packet_buffer[i].exc = false;
+                decoder->packet_buffer[i].exc_ret = false;
+                decoder->packet_buffer[i].cpu = INT_MIN;
         }
 }
 
 static ocsd_datapath_resp_t
 cs_etm_decoder__buffer_packet(struct cs_etm_decoder *decoder,
-                              const ocsd_generic_trace_elem *elem,
                               const u8 trace_chan_id,
                               enum cs_etm_sample_type sample_type)
 {
@@ -278,18 +279,16 @@ cs_etm_decoder__buffer_packet(struct cs_etm_decoder *decoder,
                 return OCSD_RESP_FATAL_SYS_ERR;
 
         et = decoder->tail;
+        et = (et + 1) & (MAX_BUFFER - 1);
+        decoder->tail = et;
+        decoder->packet_count++;
+
         decoder->packet_buffer[et].sample_type = sample_type;
-        decoder->packet_buffer[et].start_addr = elem->st_addr;
-        decoder->packet_buffer[et].end_addr = elem->en_addr;
         decoder->packet_buffer[et].exc = false;
         decoder->packet_buffer[et].exc_ret = false;
         decoder->packet_buffer[et].cpu = *((int *)inode->priv);
-
-        /* Wrap around if need be */
-        et = (et + 1) & (MAX_BUFFER - 1);
-
-        decoder->tail = et;
-        decoder->packet_count++;
+        decoder->packet_buffer[et].start_addr = 0xdeadbeefdeadbeefUL;
+        decoder->packet_buffer[et].end_addr = 0xdeadbeefdeadbeefUL;
 
         if (decoder->packet_count == MAX_BUFFER - 1)
                 return OCSD_RESP_WAIT;
@@ -297,6 +296,47 @@ cs_etm_decoder__buffer_packet(struct cs_etm_decoder *decoder,
         return OCSD_RESP_CONT;
 }
 
+static ocsd_datapath_resp_t
+cs_etm_decoder__buffer_range(struct cs_etm_decoder *decoder,
+                             const ocsd_generic_trace_elem *elem,
+                             const uint8_t trace_chan_id)
+{
+        int ret = 0;
+        struct cs_etm_packet *packet;
+
+        ret = cs_etm_decoder__buffer_packet(decoder, trace_chan_id,
+                                            CS_ETM_RANGE);
+        if (ret != OCSD_RESP_CONT && ret != OCSD_RESP_WAIT)
+                return ret;
+
+        packet = &decoder->packet_buffer[decoder->tail];
+
+        packet->start_addr = elem->st_addr;
+        packet->end_addr = elem->en_addr;
+        switch (elem->last_i_type) {
+        case OCSD_INSTR_BR:
+        case OCSD_INSTR_BR_INDIRECT:
+                packet->last_instr_taken_branch = elem->last_instr_exec;
+                break;
+        case OCSD_INSTR_ISB:
+        case OCSD_INSTR_DSB_DMB:
+        case OCSD_INSTR_OTHER:
+        default:
+                packet->last_instr_taken_branch = false;
+                break;
+        }
+
+        return ret;
+}
+
+static ocsd_datapath_resp_t
+cs_etm_decoder__buffer_trace_on(struct cs_etm_decoder *decoder,
+                                const uint8_t trace_chan_id)
+{
+        return cs_etm_decoder__buffer_packet(decoder, trace_chan_id,
+                                             CS_ETM_TRACE_ON);
+}
+
 static ocsd_datapath_resp_t cs_etm_decoder__gen_trace_elem_printer(
                                 const void *context,
                                 const ocsd_trc_index_t indx __maybe_unused,
@@ -313,12 +353,13 @@ static ocsd_datapath_resp_t cs_etm_decoder__gen_trace_elem_printer(
                 decoder->trace_on = false;
                 break;
         case OCSD_GEN_TRC_ELEM_TRACE_ON:
+                resp = cs_etm_decoder__buffer_trace_on(decoder,
+                                                       trace_chan_id);
                 decoder->trace_on = true;
                 break;
         case OCSD_GEN_TRC_ELEM_INSTR_RANGE:
-                resp = cs_etm_decoder__buffer_packet(decoder, elem,
-                                                     trace_chan_id,
-                                                     CS_ETM_RANGE);
+                resp = cs_etm_decoder__buffer_range(decoder, elem,
+                                                    trace_chan_id);
                 break;
         case OCSD_GEN_TRC_ELEM_EXCEPTION:
                 decoder->packet_buffer[decoder->tail].exc = true;
diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.h b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.h
index 3d2e6205d186..743f5f444304 100644
--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.h
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.h
@@ -24,12 +24,14 @@ struct cs_etm_buffer {
 
 enum cs_etm_sample_type {
         CS_ETM_RANGE = 1 << 0,
+        CS_ETM_TRACE_ON = 1 << 1,
 };
 
 struct cs_etm_packet {
         enum cs_etm_sample_type sample_type;
         u64 start_addr;
         u64 end_addr;
+        u8 last_instr_taken_branch;
         u8 exc;
         u8 exc_ret;
         int cpu;
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index b9f0a53dfa65..bf16dc9ee507 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -1,6 +1,5 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
- * SPDX-License-Identifier: GPL-2.0
- *
  * Copyright(C) 2015-2018 Linaro Limited.
  *
  * Author: Tor Jeremiassen <tor@ti.com>
@@ -32,6 +31,14 @@
 
 #define MAX_TIMESTAMP (~0ULL)
 
+/*
+ * A64 instructions are always 4 bytes
+ *
+ * Only A64 is supported, so can use this constant for converting between
+ * addresses and instruction counts, calculting offsets etc
+ */
+#define A64_INSTR_SIZE 4
+
 struct cs_etm_auxtrace {
         struct auxtrace auxtrace;
         struct auxtrace_queues queues;
@@ -45,11 +52,15 @@ struct cs_etm_auxtrace {
         u8 snapshot_mode;
         u8 data_queued;
         u8 sample_branches;
+        u8 sample_instructions;
 
         int num_cpu;
         u32 auxtrace_type;
         u64 branches_sample_type;
         u64 branches_id;
+        u64 instructions_sample_type;
+        u64 instructions_sample_period;
+        u64 instructions_id;
         u64 **metadata;
         u64 kernel_start;
         unsigned int pmu_type;
@@ -68,6 +79,12 @@ struct cs_etm_queue {
         u64 time;
         u64 timestamp;
         u64 offset;
+        u64 period_instructions;
+        struct branch_stack *last_branch;
+        struct branch_stack *last_branch_rb;
+        size_t last_branch_pos;
+        struct cs_etm_packet *prev_packet;
+        struct cs_etm_packet *packet;
 };
 
 static int cs_etm__update_queues(struct cs_etm_auxtrace *etm);
@@ -174,6 +191,16 @@ static void cs_etm__free_queue(void *priv)
 {
         struct cs_etm_queue *etmq = priv;
 
+        if (!etmq)
+                return;
+
+        thread__zput(etmq->thread);
+        cs_etm_decoder__free(etmq->decoder);
+        zfree(&etmq->event_buf);
+        zfree(&etmq->last_branch);
+        zfree(&etmq->last_branch_rb);
+        zfree(&etmq->prev_packet);
+        zfree(&etmq->packet);
         free(etmq);
 }
 
@@ -212,6 +239,7 @@ static void cs_etm__free(struct perf_session *session)
         for (i = 0; i < aux->num_cpu; i++)
                 zfree(&aux->metadata[i]);
 
+        thread__zput(aux->unknown_thread);
         zfree(&aux->metadata);
         zfree(&aux);
 }
@@ -270,11 +298,35 @@ static struct cs_etm_queue *cs_etm__alloc_queue(struct cs_etm_auxtrace *etm,
         struct cs_etm_decoder_params d_params;
         struct cs_etm_trace_params  *t_params;
         struct cs_etm_queue *etmq;
+        size_t szp = sizeof(struct cs_etm_packet);
 
         etmq = zalloc(sizeof(*etmq));
         if (!etmq)
                 return NULL;
 
+        etmq->packet = zalloc(szp);
+        if (!etmq->packet)
+                goto out_free;
+
+        if (etm->synth_opts.last_branch || etm->sample_branches) {
+                etmq->prev_packet = zalloc(szp);
+                if (!etmq->prev_packet)
+                        goto out_free;
+        }
+
+        if (etm->synth_opts.last_branch) {
+                size_t sz = sizeof(struct branch_stack);
+
+                sz += etm->synth_opts.last_branch_sz *
+                      sizeof(struct branch_entry);
+                etmq->last_branch = zalloc(sz);
+                if (!etmq->last_branch)
+                        goto out_free;
+                etmq->last_branch_rb = zalloc(sz);
+                if (!etmq->last_branch_rb)
+                        goto out_free;
+        }
+
         etmq->event_buf = malloc(PERF_SAMPLE_MAX_SIZE);
         if (!etmq->event_buf)
                 goto out_free;
@@ -329,6 +381,7 @@ static struct cs_etm_queue *cs_etm__alloc_queue(struct cs_etm_auxtrace *etm,
                 goto out_free_decoder;
 
         etmq->offset = 0;
+        etmq->period_instructions = 0;
 
         return etmq;
 
@@ -336,6 +389,10 @@ out_free_decoder:
         cs_etm_decoder__free(etmq->decoder);
 out_free:
         zfree(&etmq->event_buf);
+        zfree(&etmq->last_branch);
+        zfree(&etmq->last_branch_rb);
+        zfree(&etmq->prev_packet);
+        zfree(&etmq->packet);
         free(etmq);
 
         return NULL;
@@ -389,6 +446,129 @@ static int cs_etm__update_queues(struct cs_etm_auxtrace *etm)
         return 0;
 }
 
+static inline void cs_etm__copy_last_branch_rb(struct cs_etm_queue *etmq)
+{
+        struct branch_stack *bs_src = etmq->last_branch_rb;
+        struct branch_stack *bs_dst = etmq->last_branch;
+        size_t nr = 0;
+
+        /*
+         * Set the number of records before early exit: ->nr is used to
+         * determine how many branches to copy from ->entries.
+         */
+        bs_dst->nr = bs_src->nr;
+
+        /*
+         * Early exit when there is nothing to copy.
+         */
+        if (!bs_src->nr)
+                return;
+
+        /*
+         * As bs_src->entries is a circular buffer, we need to copy from it in
+         * two steps.  First, copy the branches from the most recently inserted
+         * branch ->last_branch_pos until the end of bs_src->entries buffer.
+         */
+        nr = etmq->etm->synth_opts.last_branch_sz - etmq->last_branch_pos;
+        memcpy(&bs_dst->entries[0],
+               &bs_src->entries[etmq->last_branch_pos],
+               sizeof(struct branch_entry) * nr);
+
+        /*
+         * If we wrapped around at least once, the branches from the beginning
+         * of the bs_src->entries buffer and until the ->last_branch_pos element
+         * are older valid branches: copy them over.  The total number of
+         * branches copied over will be equal to the number of branches asked by
+         * the user in last_branch_sz.
+         */
+        if (bs_src->nr >= etmq->etm->synth_opts.last_branch_sz) {
+                memcpy(&bs_dst->entries[nr],
+                       &bs_src->entries[0],
+                       sizeof(struct branch_entry) * etmq->last_branch_pos);
+        }
+}
+
+static inline void cs_etm__reset_last_branch_rb(struct cs_etm_queue *etmq)
+{
+        etmq->last_branch_pos = 0;
+        etmq->last_branch_rb->nr = 0;
+}
+
+static inline u64 cs_etm__last_executed_instr(struct cs_etm_packet *packet)
+{
+        /*
+         * The packet records the execution range with an exclusive end address
+         *
+         * A64 instructions are constant size, so the last executed
+         * instruction is A64_INSTR_SIZE before the end address
+         * Will need to do instruction level decode for T32 instructions as
+         * they can be variable size (not yet supported).
+         */
+        return packet->end_addr - A64_INSTR_SIZE;
+}
+
+static inline u64 cs_etm__instr_count(const struct cs_etm_packet *packet)
+{
+        /*
+         * Only A64 instructions are currently supported, so can get
+         * instruction count by dividing.
+         * Will need to do instruction level decode for T32 instructions as
+         * they can be variable size (not yet supported).
+         */
+        return (packet->end_addr - packet->start_addr) / A64_INSTR_SIZE;
+}
+
+static inline u64 cs_etm__instr_addr(const struct cs_etm_packet *packet,
+                                     u64 offset)
+{
+        /*
+         * Only A64 instructions are currently supported, so can get
+         * instruction address by muliplying.
+         * Will need to do instruction level decode for T32 instructions as
+         * they can be variable size (not yet supported).
+         */
+        return packet->start_addr + offset * A64_INSTR_SIZE;
+}
+
+static void cs_etm__update_last_branch_rb(struct cs_etm_queue *etmq)
+{
+        struct branch_stack *bs = etmq->last_branch_rb;
+        struct branch_entry *be;
+
+        /*
+         * The branches are recorded in a circular buffer in reverse
+         * chronological order: we start recording from the last element of the
+         * buffer down.  After writing the first element of the stack, move the
+         * insert position back to the end of the buffer.
+         */
+        if (!etmq->last_branch_pos)
+                etmq->last_branch_pos = etmq->etm->synth_opts.last_branch_sz;
+
+        etmq->last_branch_pos -= 1;
+
+        be       = &bs->entries[etmq->last_branch_pos];
+        be->from = cs_etm__last_executed_instr(etmq->prev_packet);
+        be->to   = etmq->packet->start_addr;
+        /* No support for mispredict */
+        be->flags.mispred = 0;
+        be->flags.predicted = 1;
+
+        /*
+         * Increment bs->nr until reaching the number of last branches asked by
+         * the user on the command line.
+         */
+        if (bs->nr < etmq->etm->synth_opts.last_branch_sz)
+                bs->nr += 1;
+}
+
+static int cs_etm__inject_event(union perf_event *event,
+                               struct perf_sample *sample, u64 type)
+{
+        event->header.size = perf_event__sample_event_size(sample, type, 0);
+        return perf_event__synthesize_sample(event, type, 0, sample);
+}
+
+
 static int
 cs_etm__get_trace(struct cs_etm_buffer *buff, struct cs_etm_queue *etmq)
 {
@@ -433,8 +613,8 @@ cs_etm__get_trace(struct cs_etm_buffer *buff, struct cs_etm_queue *etmq)
         return buff->len;
 }
 
-static void  cs_etm__set_pid_tid_cpu(struct cs_etm_auxtrace *etm,
-                                     struct auxtrace_queue *queue)
+static void cs_etm__set_pid_tid_cpu(struct cs_etm_auxtrace *etm,
+                                    struct auxtrace_queue *queue)
 {
         struct cs_etm_queue *etmq = queue->priv;
 
@@ -453,35 +633,105 @@ static void  cs_etm__set_pid_tid_cpu(struct cs_etm_auxtrace *etm,
         }
 }
 
+static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
+                                            u64 addr, u64 period)
+{
+        int ret = 0;
+        struct cs_etm_auxtrace *etm = etmq->etm;
+        union perf_event *event = etmq->event_buf;
+        struct perf_sample sample = {.ip = 0,};
+
+        event->sample.header.type = PERF_RECORD_SAMPLE;
+        event->sample.header.misc = PERF_RECORD_MISC_USER;
+        event->sample.header.size = sizeof(struct perf_event_header);
+
+        sample.ip = addr;
+        sample.pid = etmq->pid;
+        sample.tid = etmq->tid;
+        sample.id = etmq->etm->instructions_id;
+        sample.stream_id = etmq->etm->instructions_id;
+        sample.period = period;
+        sample.cpu = etmq->packet->cpu;
+        sample.flags = 0;
+        sample.insn_len = 1;
+        sample.cpumode = event->header.misc;
+
+        if (etm->synth_opts.last_branch) {
+                cs_etm__copy_last_branch_rb(etmq);
+                sample.branch_stack = etmq->last_branch;
+        }
+
+        if (etm->synth_opts.inject) {
+                ret = cs_etm__inject_event(event, &sample,
+                                           etm->instructions_sample_type);
+                if (ret)
+                        return ret;
+        }
+
+        ret = perf_session__deliver_synth_event(etm->session, event, &sample);
+
+        if (ret)
+                pr_err(
+                        "CS ETM Trace: failed to deliver instruction event, error %d\n",
+                        ret);
+
+        if (etm->synth_opts.last_branch)
+                cs_etm__reset_last_branch_rb(etmq);
+
+        return ret;
+}
+
 /*
  * The cs etm packet encodes an instruction range between a branch target
  * and the next taken branch. Generate sample accordingly.
  */
-static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq,
-                                       struct cs_etm_packet *packet)
+static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq)
 {
         int ret = 0;
         struct cs_etm_auxtrace *etm = etmq->etm;
         struct perf_sample sample = {.ip = 0,};
         union perf_event *event = etmq->event_buf;
-        u64 start_addr = packet->start_addr;
-        u64 end_addr = packet->end_addr;
+        struct dummy_branch_stack {
+                u64                     nr;
+                struct branch_entry     entries;
+        } dummy_bs;
 
         event->sample.header.type = PERF_RECORD_SAMPLE;
         event->sample.header.misc = PERF_RECORD_MISC_USER;
         event->sample.header.size = sizeof(struct perf_event_header);
 
-        sample.ip = start_addr;
+        sample.ip = cs_etm__last_executed_instr(etmq->prev_packet);
         sample.pid = etmq->pid;
         sample.tid = etmq->tid;
-        sample.addr = end_addr;
+        sample.addr = etmq->packet->start_addr;
         sample.id = etmq->etm->branches_id;
         sample.stream_id = etmq->etm->branches_id;
         sample.period = 1;
-        sample.cpu = packet->cpu;
+        sample.cpu = etmq->packet->cpu;
         sample.flags = 0;
         sample.cpumode = PERF_RECORD_MISC_USER;
 
+        /*
+         * perf report cannot handle events without a branch stack
+         */
+        if (etm->synth_opts.last_branch) {
+                dummy_bs = (struct dummy_branch_stack){
+                        .nr = 1,
+                        .entries = {
+                                .from = sample.ip,
+                                .to = sample.addr,
+                        },
+                };
+                sample.branch_stack = (struct branch_stack *)&dummy_bs;
+        }
+
+        if (etm->synth_opts.inject) {
+                ret = cs_etm__inject_event(event, &sample,
+                                           etm->branches_sample_type);
+                if (ret)
+                        return ret;
+        }
+
         ret = perf_session__deliver_synth_event(etm->session, event, &sample);
 
         if (ret)
@@ -578,6 +828,24 @@ static int cs_etm__synth_events(struct cs_etm_auxtrace *etm,
                 etm->sample_branches = true;
                 etm->branches_sample_type = attr.sample_type;
                 etm->branches_id = id;
+                id += 1;
+                attr.sample_type &= ~(u64)PERF_SAMPLE_ADDR;
+        }
+
+        if (etm->synth_opts.last_branch)
+                attr.sample_type |= PERF_SAMPLE_BRANCH_STACK;
+
+        if (etm->synth_opts.instructions) {
+                attr.config = PERF_COUNT_HW_INSTRUCTIONS;
+                attr.sample_period = etm->synth_opts.period;
+                etm->instructions_sample_period = attr.sample_period;
+                err = cs_etm__synth_event(session, &attr, id);
+                if (err)
+                        return err;
+                etm->sample_instructions = true;
+                etm->instructions_sample_type = attr.sample_type;
+                etm->instructions_id = id;
+                id += 1;
         }
 
         return 0;
@@ -585,25 +853,108 @@ static int cs_etm__synth_events(struct cs_etm_auxtrace *etm,
 
 static int cs_etm__sample(struct cs_etm_queue *etmq)
 {
+        struct cs_etm_auxtrace *etm = etmq->etm;
+        struct cs_etm_packet *tmp;
         int ret;
-        struct cs_etm_packet packet;
+        u64 instrs_executed;
 
-        while (1) {
-                ret = cs_etm_decoder__get_packet(etmq->decoder, &packet);
-                if (ret <= 0)
+        instrs_executed = cs_etm__instr_count(etmq->packet);
+        etmq->period_instructions += instrs_executed;
+
+        /*
+         * Record a branch when the last instruction in
+         * PREV_PACKET is a branch.
+         */
+        if (etm->synth_opts.last_branch &&
+            etmq->prev_packet &&
+            etmq->prev_packet->sample_type == CS_ETM_RANGE &&
+            etmq->prev_packet->last_instr_taken_branch)
+                cs_etm__update_last_branch_rb(etmq);
+
+        if (etm->sample_instructions &&
+            etmq->period_instructions >= etm->instructions_sample_period) {
+                /*
+                 * Emit instruction sample periodically
+                 * TODO: allow period to be defined in cycles and clock time
+                 */
+
+                /* Get number of instructions executed after the sample point */
+                u64 instrs_over = etmq->period_instructions -
+                        etm->instructions_sample_period;
+
+                /*
+                 * Calculate the address of the sampled instruction (-1 as
+                 * sample is reported as though instruction has just been
+                 * executed, but PC has not advanced to next instruction)
+                 */
+                u64 offset = (instrs_executed - instrs_over - 1);
+                u64 addr = cs_etm__instr_addr(etmq->packet, offset);
+
+                ret = cs_etm__synth_instruction_sample(
+                        etmq, addr, etm->instructions_sample_period);
+                if (ret)
                         return ret;
 
+                /* Carry remaining instructions into next sample period */
+                etmq->period_instructions = instrs_over;
+        }
+
+        if (etm->sample_branches &&
+            etmq->prev_packet &&
+            etmq->prev_packet->sample_type == CS_ETM_RANGE &&
+            etmq->prev_packet->last_instr_taken_branch) {
+                ret = cs_etm__synth_branch_sample(etmq);
+                if (ret)
+                        return ret;
+        }
+
+        if (etm->sample_branches || etm->synth_opts.last_branch) {
                 /*
-                 * If the packet contains an instruction range, generate an
-                 * instruction sequence event.
+                 * Swap PACKET with PREV_PACKET: PACKET becomes PREV_PACKET for
+                 * the next incoming packet.
                  */
-                if (packet.sample_type & CS_ETM_RANGE)
-                        cs_etm__synth_branch_sample(etmq, &packet);
+                tmp = etmq->packet;
+                etmq->packet = etmq->prev_packet;
+                etmq->prev_packet = tmp;
         }
 
         return 0;
 }
 
+static int cs_etm__flush(struct cs_etm_queue *etmq)
+{
+        int err = 0;
+        struct cs_etm_packet *tmp;
+
+        if (etmq->etm->synth_opts.last_branch &&
+            etmq->prev_packet &&
+            etmq->prev_packet->sample_type == CS_ETM_RANGE) {
+                /*
+                 * Generate a last branch event for the branches left in the
+                 * circular buffer at the end of the trace.
+                 *
+                 * Use the address of the end of the last reported execution
+                 * range
+                 */
+                u64 addr = cs_etm__last_executed_instr(etmq->prev_packet);
+
+                err = cs_etm__synth_instruction_sample(
+                        etmq, addr,
+                        etmq->period_instructions);
+                etmq->period_instructions = 0;
+
+                /*
+                 * Swap PACKET with PREV_PACKET: PACKET becomes PREV_PACKET for
+                 * the next incoming packet.
+                 */
+                tmp = etmq->packet;
+                etmq->packet = etmq->prev_packet;
+                etmq->prev_packet = tmp;
+        }
+
+        return err;
+}
+
 static int cs_etm__run_decoder(struct cs_etm_queue *etmq)
 {
         struct cs_etm_auxtrace *etm = etmq->etm;
@@ -615,45 +966,72 @@ static int cs_etm__run_decoder(struct cs_etm_queue *etmq)
                 etm->kernel_start = machine__kernel_start(etm->machine);
 
         /* Go through each buffer in the queue and decode them one by one */
-more:
-        buffer_used = 0;
-        memset(&buffer, 0, sizeof(buffer));
-        err = cs_etm__get_trace(&buffer, etmq);
-        if (err <= 0)
-                return err;
-        /*
-         * We cannot assume consecutive blocks in the data file are contiguous,
-         * reset the decoder to force re-sync.
-         */
-        err = cs_etm_decoder__reset(etmq->decoder);
-        if (err != 0)
-                return err;
-
-        /* Run trace decoder until buffer consumed or end of trace */
-        do {
-                processed = 0;
-
-                err = cs_etm_decoder__process_data_block(
-                                                etmq->decoder,
-                                                etmq->offset,
-                                                &buffer.buf[buffer_used],
-                                                buffer.len - buffer_used,
-                                                &processed);
-
-                if (err)
+        while (1) {
+                buffer_used = 0;
+                memset(&buffer, 0, sizeof(buffer));
+                err = cs_etm__get_trace(&buffer, etmq);
+                if (err <= 0)
                         return err;
-
-                etmq->offset += processed;
-                buffer_used += processed;
-
                 /*
-                 * Nothing to do with an error condition, let's hope the next
-                 * chunk will be better.
+                 * We cannot assume consecutive blocks in the data file are
+                 * contiguous, reset the decoder to force re-sync.
                  */
-                err = cs_etm__sample(etmq);
-        } while (buffer.len > buffer_used);
+                err = cs_etm_decoder__reset(etmq->decoder);
+                if (err != 0)
+                        return err;
 
-goto more;
+                /* Run trace decoder until buffer consumed or end of trace */
+                do {
+                        processed = 0;
+                        err = cs_etm_decoder__process_data_block(
+                                etmq->decoder,
+                                etmq->offset,
+                                &buffer.buf[buffer_used],
+                                buffer.len - buffer_used,
+                                &processed);
+                        if (err)
+                                return err;
+
+                        etmq->offset += processed;
+                        buffer_used += processed;
+
+                        /* Process each packet in this chunk */
+                        while (1) {
+                                err = cs_etm_decoder__get_packet(etmq->decoder,
+                                                                 etmq->packet);
+                                if (err <= 0)
+                                        /*
+                                         * Stop processing this chunk on
+                                         * end of data or error
+                                         */
+                                        break;
+
+                                switch (etmq->packet->sample_type) {
+                                case CS_ETM_RANGE:
+                                        /*
+                                         * If the packet contains an instruction
+                                         * range, generate instruction sequence
+                                         * events.
+                                         */
+                                        cs_etm__sample(etmq);
+                                        break;
+                                case CS_ETM_TRACE_ON:
+                                        /*
+                                         * Discontinuity in trace, flush
+                                         * previous branch stack
+                                         */
+                                        cs_etm__flush(etmq);
+                                        break;
+                                default:
+                                        break;
+                                }
+                        }
+                } while (buffer.len > buffer_used);
+
+                if (err == 0)
+                        /* Flush any remaining branch stack entries */
+                        err = cs_etm__flush(etmq);
+        }
 
         return err;
 }
@@ -980,6 +1358,23 @@ int cs_etm__process_auxtrace_info(union perf_event *event,
         etm->auxtrace.free = cs_etm__free;
         session->auxtrace = &etm->auxtrace;
 
+        etm->unknown_thread = thread__new(999999999, 999999999);
+        if (!etm->unknown_thread)
+                goto err_free_queues;
+
+        /*
+         * Initialize list node so that at thread__zput() we can avoid
+         * segmentation fault at list_del_init().
+         */
+        INIT_LIST_HEAD(&etm->unknown_thread->node);
+
+        err = thread__set_comm(etm->unknown_thread, "unknown", 0);
+        if (err)
+                goto err_delete_thread;
+
+        if (thread__init_map_groups(etm->unknown_thread, etm->machine))
+                goto err_delete_thread;
+
         if (dump_trace) {
                 cs_etm__print_auxtrace_info(auxtrace_info->priv, num_cpu);
                 return 0;
@@ -994,16 +1389,18 @@ int cs_etm__process_auxtrace_info(union perf_event *event,
 
         err = cs_etm__synth_events(etm, session);
         if (err)
-                goto err_free_queues;
+                goto err_delete_thread;
 
         err = auxtrace_queues__process_index(&etm->queues, session);
         if (err)
-                goto err_free_queues;
+                goto err_delete_thread;
 
         etm->data_queued = etm->queues.populated;
 
         return 0;
 
+err_delete_thread:
+        thread__zput(etm->unknown_thread);
 err_free_queues:
         auxtrace_queues__free(&etm->queues);
         session->auxtrace = NULL;
diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
index 5864d5dca616..37f8d48179ca 100644
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -1,18 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright(C) 2015 Linaro Limited. All rights reserved.
  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef INCLUDE__UTIL_PERF_CS_ETM_H__
diff --git a/tools/perf/util/debug.c b/tools/perf/util/debug.c
index f3a71db83947..3d6459626c2a 100644
--- a/tools/perf/util/debug.c
+++ b/tools/perf/util/debug.c
@@ -232,7 +232,6 @@ int perf_quiet_option(void)
                 var++;
         }
 
-        quiet = true;
         return 0;
 }
 
diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index f5acda13dcfa..7eb7de5aee44 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -979,7 +979,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf)
         return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die));
 }
 
-#ifdef HAVE_DWARF_GETLOCATIONS
+#ifdef HAVE_DWARF_GETLOCATIONS_SUPPORT
 /**
  * die_get_var_innermost_scope - Get innermost scope range of given variable DIE
  * @sp_die: a subprogram DIE
diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
index 6d311868d850..4c842762e3f2 100644
--- a/tools/perf/util/env.c
+++ b/tools/perf/util/env.c
@@ -32,6 +32,10 @@ void perf_env__exit(struct perf_env *env)
         for (i = 0; i < env->caches_cnt; i++)
                 cpu_cache_level__free(&env->caches[i]);
         zfree(&env->caches);
+
+        for (i = 0; i < env->nr_memory_nodes; i++)
+                free(env->memory_nodes[i].set);
+        zfree(&env->memory_nodes);
 }
 
 int perf_env__set_cmdline(struct perf_env *env, int argc, const char *argv[])
diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h
index bf970f57dce0..c4ef2e523367 100644
--- a/tools/perf/util/env.h
+++ b/tools/perf/util/env.h
@@ -27,6 +27,12 @@ struct numa_node {
         struct cpu_map  *map;
 };
 
+struct memory_node {
+        u64              node;
+        u64              size;
+        unsigned long   *set;
+};
+
 struct perf_env {
         char                    *hostname;
         char                    *os_release;
@@ -43,6 +49,7 @@ struct perf_env {
         int                     nr_sibling_cores;
         int                     nr_sibling_threads;
         int                     nr_numa_nodes;
+        int                     nr_memory_nodes;
         int                     nr_pmu_mappings;
         int                     nr_groups;
         char                    *cmdline;
@@ -54,6 +61,8 @@ struct perf_env {
         struct cpu_cache_level  *caches;
         int                      caches_cnt;
         struct numa_node        *numa_nodes;
+        struct memory_node      *memory_nodes;
+        unsigned long long       memory_bsize;
 };
 
 extern struct perf_env perf_env;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 44e603c27944..98ff3a6a3d50 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -894,8 +894,6 @@ int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
                                        struct machine *machine)
 {
         size_t size;
-        const char *mmap_name;
-        char name_buff[PATH_MAX];
         struct map *map = machine__kernel_map(machine);
         struct kmap *kmap;
         int err;
@@ -918,7 +916,6 @@ int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
                 return -1;
         }
 
-        mmap_name = machine__mmap_name(machine, name_buff, sizeof(name_buff));
         if (machine__is_host(machine)) {
                 /*
                  * kernel uses PERF_RECORD_MISC_USER for user space maps,
@@ -931,7 +928,7 @@ int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
 
         kmap = map__kmap(map);
         size = snprintf(event->mmap.filename, sizeof(event->mmap.filename),
-                        "%s%s", mmap_name, kmap->ref_reloc_sym->name) + 1;
+                        "%s%s", machine->mmap_name, kmap->ref_reloc_sym->name) + 1;
         size = PERF_ALIGN(size, sizeof(u64));
         event->mmap.header.type = PERF_RECORD_MMAP;
         event->mmap.header.size = (sizeof(event->mmap) -
@@ -1424,7 +1421,9 @@ size_t perf_event__fprintf_itrace_start(union perf_event *event, FILE *fp)
 size_t perf_event__fprintf_switch(union perf_event *event, FILE *fp)
 {
         bool out = event->header.misc & PERF_RECORD_MISC_SWITCH_OUT;
-        const char *in_out = out ? "OUT" : "IN ";
+        const char *in_out = !out ? "IN         " :
+                !(event->header.misc & PERF_RECORD_MISC_SWITCH_OUT_PREEMPT) ?
+                                    "OUT        " : "OUT preempt";
 
         if (event->header.type == PERF_RECORD_SWITCH)
                 return fprintf(fp, " %s\n", in_out);
@@ -1591,17 +1590,6 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
                 return -1;
 
         dump_printf(" ... thread: %s:%d\n", thread__comm_str(thread), thread->tid);
-        /*
-         * Have we already created the kernel maps for this machine?
-         *
-         * This should have happened earlier, when we processed the kernel MMAP
-         * events, but for older perf.data files there was no such thing, so do
-         * it now.
-         */
-        if (sample->cpumode == PERF_RECORD_MISC_KERNEL &&
-            machine__kernel_map(machine) == NULL)
-                machine__create_kernel_maps(machine);
-
         thread__find_addr_map(thread, sample->cpumode, MAP__FUNCTION, sample->ip, al);
         dump_printf(" ...... dso: %s\n",
                     al->map ? al->map->dso->long_name :
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index e5fc14e53c05..a59281d64368 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -702,29 +702,6 @@ static int perf_evlist__resume(struct perf_evlist *evlist)
         return perf_evlist__set_paused(evlist, false);
 }
 
-union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist, int idx)
-{
-        struct perf_mmap *md = &evlist->mmap[idx];
-
-        /*
-         * Check messup is required for forward overwritable ring buffer:
-         * memory pointed by md->prev can be overwritten in this case.
-         * No need for read-write ring buffer: kernel stop outputting when
-         * it hit md->prev (perf_mmap__consume()).
-         */
-        return perf_mmap__read_forward(md);
-}
-
-union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
-{
-        return perf_evlist__mmap_read_forward(evlist, idx);
-}
-
-void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
-{
-        perf_mmap__consume(&evlist->mmap[idx], false);
-}
-
 static void perf_evlist__munmap_nofree(struct perf_evlist *evlist)
 {
         int i;
@@ -745,7 +722,8 @@ void perf_evlist__munmap(struct perf_evlist *evlist)
         zfree(&evlist->overwrite_mmap);
 }
 
-static struct perf_mmap *perf_evlist__alloc_mmap(struct perf_evlist *evlist)
+static struct perf_mmap *perf_evlist__alloc_mmap(struct perf_evlist *evlist,
+                                                 bool overwrite)
 {
         int i;
         struct perf_mmap *map;
@@ -759,9 +737,10 @@ static struct perf_mmap *perf_evlist__alloc_mmap(struct perf_evlist *evlist)
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
                 map[i].fd = -1;
+                map[i].overwrite = overwrite;
                 /*
                  * When the perf_mmap() call is made we grab one refcount, plus
-                 * one extra to let perf_evlist__mmap_consume() get the last
+                 * one extra to let perf_mmap__consume() get the last
                  * events after all real references (perf_mmap__get()) are
                  * dropped.
                  *
@@ -802,7 +781,7 @@ static int perf_evlist__mmap_per_evsel(struct perf_evlist *evlist, int idx,
                         maps = evlist->overwrite_mmap;
 
                         if (!maps) {
-                                maps = perf_evlist__alloc_mmap(evlist);
+                                maps = perf_evlist__alloc_mmap(evlist, true);
                                 if (!maps)
                                         return -1;
                                 evlist->overwrite_mmap = maps;
@@ -1052,7 +1031,7 @@ int perf_evlist__mmap_ex(struct perf_evlist *evlist, unsigned int pages,
         struct mmap_params mp;
 
         if (!evlist->mmap)
-                evlist->mmap = perf_evlist__alloc_mmap(evlist);
+                evlist->mmap = perf_evlist__alloc_mmap(evlist, false);
         if (!evlist->mmap)
                 return -ENOMEM;
 
@@ -1086,11 +1065,30 @@ int perf_evlist__mmap(struct perf_evlist *evlist, unsigned int pages)
 
 int perf_evlist__create_maps(struct perf_evlist *evlist, struct target *target)
 {
+        bool all_threads = (target->per_thread && target->system_wide);
         struct cpu_map *cpus;
         struct thread_map *threads;
 
+        /*
+         * If specify '-a' and '--per-thread' to perf record, perf record
+         * will override '--per-thread'. target->per_thread = false and
+         * target->system_wide = true.
+         *
+         * If specify '--per-thread' only to perf record,
+         * target->per_thread = true and target->system_wide = false.
+         *
+         * So target->per_thread && target->system_wide is false.
+         * For perf record, thread_map__new_str doesn't call
+         * thread_map__new_all_cpus. That will keep perf record's
+         * current behavior.
+         *
+         * For perf stat, it allows the case that target->per_thread and
+         * target->system_wide are all true. It means to collect system-wide
+         * per-thread data. thread_map__new_str will call
+         * thread_map__new_all_cpus to enumerate all threads.
+         */
         threads = thread_map__new_str(target->pid, target->tid, target->uid,
-                                      target->per_thread);
+                                      all_threads);
 
         if (!threads)
                 return -1;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 336b838e6957..6c41b2f78713 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -129,10 +129,6 @@ struct perf_sample_id *perf_evlist__id2sid(struct perf_evlist *evlist, u64 id);
 
 void perf_evlist__toggle_bkw_mmap(struct perf_evlist *evlist, enum bkw_mmap_state state);
 
-union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx);
-
-union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist,
-                                                 int idx);
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 
 int perf_evlist__open(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index ef351688b797..4cd2cf93f726 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -244,6 +244,7 @@ void perf_evsel__init(struct perf_evsel *evsel,
         evsel->metric_name   = NULL;
         evsel->metric_events = NULL;
         evsel->collect_stat  = false;
+        evsel->pmu_name      = NULL;
 }
 
 struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx)
@@ -621,22 +622,34 @@ const char *perf_evsel__group_name(struct perf_evsel *evsel)
         return evsel->group_name ?: "anon group";
 }
 
+/*
+ * Returns the group details for the specified leader,
+ * with following rules.
+ *
+ *  For record -e '{cycles,instructions}'
+ *    'anon group { cycles:u, instructions:u }'
+ *
+ *  For record -e 'cycles,instructions' and report --group
+ *    'cycles:u, instructions:u'
+ */
 int perf_evsel__group_desc(struct perf_evsel *evsel, char *buf, size_t size)
 {
-        int ret;
+        int ret = 0;
         struct perf_evsel *pos;
         const char *group_name = perf_evsel__group_name(evsel);
 
-        ret = scnprintf(buf, size, "%s", group_name);
+        if (!evsel->forced_leader)
+                ret = scnprintf(buf, size, "%s { ", group_name);
 
-        ret += scnprintf(buf + ret, size - ret, " { %s",
+        ret += scnprintf(buf + ret, size - ret, "%s",
                          perf_evsel__name(evsel));
 
         for_each_group_member(pos, evsel)
                 ret += scnprintf(buf + ret, size - ret, ", %s",
                                  perf_evsel__name(pos));
 
-        ret += scnprintf(buf + ret, size - ret, " }");
+        if (!evsel->forced_leader)
+                ret += scnprintf(buf + ret, size - ret, " }");
 
         return ret;
 }
@@ -917,8 +930,11 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
          * than leader in case leader 'leads' the sampling.
          */
         if ((leader != evsel) && leader->sample_read) {
-                attr->sample_freq   = 0;
-                attr->sample_period = 0;
+                attr->freq           = 0;
+                attr->sample_freq    = 0;
+                attr->sample_period  = 0;
+                attr->write_backward = 0;
+                attr->sample_id_all  = 0;
         }
 
         if (opts->no_samples)
@@ -1233,7 +1249,7 @@ void perf_evsel__exit(struct perf_evsel *evsel)
         perf_evsel__free_fd(evsel);
         perf_evsel__free_id(evsel);
         perf_evsel__free_config_terms(evsel);
-        close_cgroup(evsel->cgrp);
+        cgroup__put(evsel->cgrp);
         cpu_map__put(evsel->cpus);
         cpu_map__put(evsel->own_cpus);
         thread_map__put(evsel->threads);
@@ -1909,12 +1925,16 @@ try_fallback:
                 goto fallback_missing_features;
         } else if (!perf_missing_features.group_read &&
                     evsel->attr.inherit &&
-                   (evsel->attr.read_format & PERF_FORMAT_GROUP)) {
+                   (evsel->attr.read_format & PERF_FORMAT_GROUP) &&
+                   perf_evsel__is_group_leader(evsel)) {
                 perf_missing_features.group_read = true;
                 pr_debug2("switching off group read\n");
                 goto fallback_missing_features;
         }
 out_close:
+        if (err)
+                threads->err_thread = thread;
+
         do {
                 while (--thread >= 0) {
                         close(FD(evsel, cpu, thread));
@@ -2738,8 +2758,14 @@ bool perf_evsel__fallback(struct perf_evsel *evsel, int err,
                    (paranoid = perf_event_paranoid()) > 1) {
                 const char *name = perf_evsel__name(evsel);
                 char *new_name;
+                const char *sep = ":";
+
+                /* Is there already the separator in the name. */
+                if (strchr(name, '/') ||
+                    strchr(name, ':'))
+                        sep = "";
 
-                if (asprintf(&new_name, "%s%su", name, strchr(name, ':') ? "" : ":") < 0)
+                if (asprintf(&new_name, "%s%su", name, sep) < 0)
                         return false;
 
                 if (evsel->name)
@@ -2854,8 +2880,7 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target,
 #if defined(__i386__) || defined(__x86_64__)
                 if (evsel->attr.type == PERF_TYPE_HARDWARE)
                         return scnprintf(msg, size, "%s",
-        "No hardware sampling interrupt available.\n"
-        "No APIC? If so then you can boot the kernel with the \"lapic\" boot parameter to force-enable it.");
+        "No hardware sampling interrupt available.\n");
 #endif
                 break;
         case EBUSY:
@@ -2878,8 +2903,7 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target,
 
         return scnprintf(msg, size,
         "The sys_perf_event_open() syscall returned with %d (%s) for event (%s).\n"
-        "/bin/dmesg may provide additional information.\n"
-        "No CONFIG_PERF_EVENTS=y kernel support configured?",
+        "/bin/dmesg | grep -i perf may provide additional information.\n",
                          err, str_error_r(err, sbuf, sizeof(sbuf)),
                          perf_evsel__name(evsel));
 }
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index a7487c6d1866..92ec009a292d 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -30,7 +30,7 @@ struct perf_sample_id {
         u64                     period;
 };
 
-struct cgroup_sel;
+struct cgroup;
 
 /*
  * The 'struct perf_evsel_config_term' is used to pass event
@@ -107,7 +107,7 @@ struct perf_evsel {
         struct perf_stat_evsel  *stats;
         void                    *priv;
         u64                     db_id;
-        struct cgroup_sel       *cgrp;
+        struct cgroup           *cgrp;
         void                    *handler;
         struct cpu_map          *cpus;
         struct cpu_map          *own_cpus;
@@ -115,6 +115,7 @@ struct perf_evsel {
         unsigned int            sample_size;
         int                     id_pos;
         int                     is_pos;
+        bool                    uniquified_name;
         bool                    snapshot;
         bool                    supported;
         bool                    needs_swap;
@@ -125,6 +126,7 @@ struct perf_evsel {
         bool                    per_pkg;
         bool                    precise_max;
         bool                    ignore_missing_thread;
+        bool                    forced_leader;
         /* parse modifier helper */
         int                     exclude_GH;
         int                     nr_members;
@@ -142,6 +144,7 @@ struct perf_evsel {
         struct perf_evsel       **metric_events;
         bool                    collect_stat;
         bool                    weak_group;
+        const char              *pmu_name;
 };
 
 union u64_swap {
diff --git a/tools/perf/util/generate-cmdlist.sh b/tools/perf/util/generate-cmdlist.sh
index ff17920a5ebc..c3cef36d4176 100755
--- a/tools/perf/util/generate-cmdlist.sh
+++ b/tools/perf/util/generate-cmdlist.sh
@@ -38,7 +38,7 @@ do
 done
 echo "#endif /* HAVE_LIBELF_SUPPORT */"
 
-echo "#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE)"
+echo "#if defined(HAVE_LIBAUDIT_SUPPORT) || defined(HAVE_SYSCALL_TABLE_SUPPORT)"
 sed -n -e 's/^perf-\([^         ]*\)[   ].* audit*/\1/p' command-list.txt |
 sort |
 while read cmd
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index a326e0d8b5b6..a8bff2178fbc 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -17,6 +17,7 @@
 #include <sys/stat.h>
 #include <sys/utsname.h>
 #include <linux/time64.h>
+#include <dirent.h>
 
 #include "evlist.h"
 #include "evsel.h"
@@ -37,6 +38,7 @@
 #include "asm/bug.h"
 #include "tool.h"
 #include "time-utils.h"
+#include "units.h"
 
 #include "sane_ctype.h"
 
@@ -132,6 +134,25 @@ int do_write(struct feat_fd *ff, const void *buf, size_t size)
 }
 
 /* Return: 0 if succeded, -ERR if failed. */
+static int do_write_bitmap(struct feat_fd *ff, unsigned long *set, u64 size)
+{
+        u64 *p = (u64 *) set;
+        int i, ret;
+
+        ret = do_write(ff, &size, sizeof(size));
+        if (ret < 0)
+                return ret;
+
+        for (i = 0; (u64) i < BITS_TO_U64(size); i++) {
+                ret = do_write(ff, p + i, sizeof(*p));
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+/* Return: 0 if succeded, -ERR if failed. */
 int write_padded(struct feat_fd *ff, const void *bf,
                  size_t count, size_t count_aligned)
 {
@@ -243,6 +264,38 @@ static char *do_read_string(struct feat_fd *ff)
         return NULL;
 }
 
+/* Return: 0 if succeded, -ERR if failed. */
+static int do_read_bitmap(struct feat_fd *ff, unsigned long **pset, u64 *psize)
+{
+        unsigned long *set;
+        u64 size, *p;
+        int i, ret;
+
+        ret = do_read_u64(ff, &size);
+        if (ret)
+                return ret;
+
+        set = bitmap_alloc(size);
+        if (!set)
+                return -ENOMEM;
+
+        bitmap_zero(set, size);
+
+        p = (u64 *) set;
+
+        for (i = 0; (u64) i < BITS_TO_U64(size); i++) {
+                ret = do_read_u64(ff, p + i);
+                if (ret < 0) {
+                        free(set);
+                        return ret;
+                }
+        }
+
+        *pset  = set;
+        *psize = size;
+        return 0;
+}
+
 static int write_tracing_data(struct feat_fd *ff,
                               struct perf_evlist *evlist)
 {
@@ -1196,6 +1249,177 @@ static int write_sample_time(struct feat_fd *ff,
                         sizeof(evlist->last_sample_time));
 }
 
+
+static int memory_node__read(struct memory_node *n, unsigned long idx)
+{
+        unsigned int phys, size = 0;
+        char path[PATH_MAX];
+        struct dirent *ent;
+        DIR *dir;
+
+#define for_each_memory(mem, dir)                                       \
+        while ((ent = readdir(dir)))                                    \
+                if (strcmp(ent->d_name, ".") &&                         \
+                    strcmp(ent->d_name, "..") &&                        \
+                    sscanf(ent->d_name, "memory%u", &mem) == 1)
+
+        scnprintf(path, PATH_MAX,
+                  "%s/devices/system/node/node%lu",
+                  sysfs__mountpoint(), idx);
+
+        dir = opendir(path);
+        if (!dir) {
+                pr_warning("failed: cant' open memory sysfs data\n");
+                return -1;
+        }
+
+        for_each_memory(phys, dir) {
+                size = max(phys, size);
+        }
+
+        size++;
+
+        n->set = bitmap_alloc(size);
+        if (!n->set) {
+                closedir(dir);
+                return -ENOMEM;
+        }
+
+        bitmap_zero(n->set, size);
+        n->node = idx;
+        n->size = size;
+
+        rewinddir(dir);
+
+        for_each_memory(phys, dir) {
+                set_bit(phys, n->set);
+        }
+
+        closedir(dir);
+        return 0;
+}
+
+static int memory_node__sort(const void *a, const void *b)
+{
+        const struct memory_node *na = a;
+        const struct memory_node *nb = b;
+
+        return na->node - nb->node;
+}
+
+static int build_mem_topology(struct memory_node *nodes, u64 size, u64 *cntp)
+{
+        char path[PATH_MAX];
+        struct dirent *ent;
+        DIR *dir;
+        u64 cnt = 0;
+        int ret = 0;
+
+        scnprintf(path, PATH_MAX, "%s/devices/system/node/",
+                  sysfs__mountpoint());
+
+        dir = opendir(path);
+        if (!dir) {
+                pr_debug2("%s: could't read %s, does this arch have topology information?\n",
+                          __func__, path);
+                return -1;
+        }
+
+        while (!ret && (ent = readdir(dir))) {
+                unsigned int idx;
+                int r;
+
+                if (!strcmp(ent->d_name, ".") ||
+                    !strcmp(ent->d_name, ".."))
+                        continue;
+
+                r = sscanf(ent->d_name, "node%u", &idx);
+                if (r != 1)
+                        continue;
+
+                if (WARN_ONCE(cnt >= size,
+                              "failed to write MEM_TOPOLOGY, way too many nodes\n"))
+                        return -1;
+
+                ret = memory_node__read(&nodes[cnt++], idx);
+        }
+
+        *cntp = cnt;
+        closedir(dir);
+
+        if (!ret)
+                qsort(nodes, cnt, sizeof(nodes[0]), memory_node__sort);
+
+        return ret;
+}
+
+#define MAX_MEMORY_NODES 2000
+
+/*
+ * The MEM_TOPOLOGY holds physical memory map for every
+ * node in system. The format of data is as follows:
+ *
+ *  0 - version          | for future changes
+ *  8 - block_size_bytes | /sys/devices/system/memory/block_size_bytes
+ * 16 - count            | number of nodes
+ *
+ * For each node we store map of physical indexes for
+ * each node:
+ *
+ * 32 - node id          | node index
+ * 40 - size             | size of bitmap
+ * 48 - bitmap           | bitmap of memory indexes that belongs to node
+ */
+static int write_mem_topology(struct feat_fd *ff __maybe_unused,
+                              struct perf_evlist *evlist __maybe_unused)
+{
+        static struct memory_node nodes[MAX_MEMORY_NODES];
+        u64 bsize, version = 1, i, nr;
+        int ret;
+
+        ret = sysfs__read_xll("devices/system/memory/block_size_bytes",
+                              (unsigned long long *) &bsize);
+        if (ret)
+                return ret;
+
+        ret = build_mem_topology(&nodes[0], MAX_MEMORY_NODES, &nr);
+        if (ret)
+                return ret;
+
+        ret = do_write(ff, &version, sizeof(version));
+        if (ret < 0)
+                goto out;
+
+        ret = do_write(ff, &bsize, sizeof(bsize));
+        if (ret < 0)
+                goto out;
+
+        ret = do_write(ff, &nr, sizeof(nr));
+        if (ret < 0)
+                goto out;
+
+        for (i = 0; i < nr; i++) {
+                struct memory_node *n = &nodes[i];
+
+                #define _W(v)                                           \
+                        ret = do_write(ff, &n->v, sizeof(n->v));        \
+                        if (ret < 0)                                    \
+                                goto out;
+
+                _W(node)
+                _W(size)
+
+                #undef _W
+
+                ret = do_write_bitmap(ff, n->set, n->size);
+                if (ret < 0)
+                        goto out;
+        }
+
+out:
+        return ret;
+}
+
 static void print_hostname(struct feat_fd *ff, FILE *fp)
 {
         fprintf(fp, "# hostname : %s\n", ff->ph->env.hostname);
@@ -1543,6 +1767,35 @@ static void print_sample_time(struct feat_fd *ff, FILE *fp)
         fprintf(fp, "# sample duration : %10.3f ms\n", d);
 }
 
+static void memory_node__fprintf(struct memory_node *n,
+                                 unsigned long long bsize, FILE *fp)
+{
+        char buf_map[100], buf_size[50];
+        unsigned long long size;
+
+        size = bsize * bitmap_weight(n->set, n->size);
+        unit_number__scnprintf(buf_size, 50, size);
+
+        bitmap_scnprintf(n->set, n->size, buf_map, 100);
+        fprintf(fp, "#  %3" PRIu64 " [%s]: %s\n", n->node, buf_size, buf_map);
+}
+
+static void print_mem_topology(struct feat_fd *ff, FILE *fp)
+{
+        struct memory_node *nodes;
+        int i, nr;
+
+        nodes = ff->ph->env.memory_nodes;
+        nr    = ff->ph->env.nr_memory_nodes;
+
+        fprintf(fp, "# memory nodes (nr %d, block size 0x%llx):\n",
+                nr, ff->ph->env.memory_bsize);
+
+        for (i = 0; i < nr; i++) {
+                memory_node__fprintf(&nodes[i], ff->ph->env.memory_bsize, fp);
+        }
+}
+
 static int __event_process_build_id(struct build_id_event *bev,
                                     char *filename,
                                     struct perf_session *session)
@@ -2205,6 +2458,58 @@ static int process_sample_time(struct feat_fd *ff, void *data __maybe_unused)
         return 0;
 }
 
+static int process_mem_topology(struct feat_fd *ff,
+                                void *data __maybe_unused)
+{
+        struct memory_node *nodes;
+        u64 version, i, nr, bsize;
+        int ret = -1;
+
+        if (do_read_u64(ff, &version))
+                return -1;
+
+        if (version != 1)
+                return -1;
+
+        if (do_read_u64(ff, &bsize))
+                return -1;
+
+        if (do_read_u64(ff, &nr))
+                return -1;
+
+        nodes = zalloc(sizeof(*nodes) * nr);
+        if (!nodes)
+                return -1;
+
+        for (i = 0; i < nr; i++) {
+                struct memory_node n;
+
+                #define _R(v)                           \
+                        if (do_read_u64(ff, &n.v))      \
+                                goto out;               \
+
+                _R(node)
+                _R(size)
+
+                #undef _R
+
+                if (do_read_bitmap(ff, &n.set, &n.size))
+                        goto out;
+
+                nodes[i] = n;
+        }
+
+        ff->ph->env.memory_bsize    = bsize;
+        ff->ph->env.memory_nodes    = nodes;
+        ff->ph->env.nr_memory_nodes = nr;
+        ret = 0;
+
+out:
+        if (ret)
+                free(nodes);
+        return ret;
+}
+
 struct feature_ops {
         int (*write)(struct feat_fd *ff, struct perf_evlist *evlist);
         void (*print)(struct feat_fd *ff, FILE *fp);
@@ -2263,6 +2568,7 @@ static const struct feature_ops feat_ops[HEADER_LAST_FEATURE] = {
         FEAT_OPN(STAT,          stat,           false),
         FEAT_OPN(CACHE,         cache,          true),
         FEAT_OPR(SAMPLE_TIME,   sample_time,    false),
+        FEAT_OPR(MEM_TOPOLOGY,  mem_topology,   true),
 };
 
 struct header_print_data {
@@ -2318,7 +2624,12 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
         if (ret == -1)
                 return -1;
 
-        fprintf(fp, "# captured on: %s", ctime(&st.st_ctime));
+        fprintf(fp, "# captured on    : %s", ctime(&st.st_ctime));
+
+        fprintf(fp, "# header version : %u\n", header->version);
+        fprintf(fp, "# data offset    : %" PRIu64 "\n", header->data_offset);
+        fprintf(fp, "# data size      : %" PRIu64 "\n", header->data_size);
+        fprintf(fp, "# feat offset    : %" PRIu64 "\n", header->feat_offset);
 
         perf_header__process_sections(header, fd, &hd,
                                       perf_file_section__fprintf_info);
@@ -3105,8 +3416,17 @@ int perf_event__synthesize_features(struct perf_tool *tool,
                         return ret;
                 }
         }
+
+        /* Send HEADER_LAST_FEATURE mark. */
+        fe = ff.buf;
+        fe->feat_id     = HEADER_LAST_FEATURE;
+        fe->header.type = PERF_RECORD_HEADER_FEATURE;
+        fe->header.size = sizeof(*fe);
+
+        ret = process(tool, ff.buf, NULL, NULL);
+
         free(ff.buf);
-        return 0;
+        return ret;
 }
 
 int perf_event__process_feature(struct perf_tool *tool,
diff --git a/tools/perf/util/header.h b/tools/perf/util/header.h
index f28aaaa3a440..90d4577a92dc 100644
--- a/tools/perf/util/header.h
+++ b/tools/perf/util/header.h
@@ -36,6 +36,7 @@ enum {
         HEADER_STAT,
         HEADER_CACHE,
         HEADER_SAMPLE_TIME,
+        HEADER_MEM_TOPOLOGY,
         HEADER_LAST_FEATURE,
         HEADER_FEAT_BITS        = 256,
 };
@@ -174,4 +175,5 @@ int write_padded(struct feat_fd *fd, const void *bf,
 int get_cpuid(char *buffer, size_t sz);
 
 char *get_cpuid_str(struct perf_pmu *pmu __maybe_unused);
+int strcmp_cpuid_str(const char *s1, const char *s2);
 #endif /* __PERF_HEADER_H */
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index b6140950301e..4d602fba40b2 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -6,6 +6,7 @@
 #include "session.h"
 #include "namespaces.h"
 #include "sort.h"
+#include "units.h"
 #include "evlist.h"
 #include "evsel.h"
 #include "annotate.h"
@@ -14,6 +15,7 @@
 #include "ui/progress.h"
 #include <errno.h>
 #include <math.h>
+#include <inttypes.h>
 #include <sys/param.h>
 
 static bool hists__filter_entry_by_dso(struct hists *hists,
@@ -536,7 +538,7 @@ static struct hist_entry *hists__findnew_entry(struct hists *hists,
                          * This mem info was allocated from sample__resolve_mem
                          * and will not be used anymore.
                          */
-                        zfree(&entry->mem_info);
+                        mem_info__zput(entry->mem_info);
 
                         /* If the map of an existing hist_entry has
                          * become out-of-date due to an exec() or
@@ -879,7 +881,7 @@ iter_prepare_cumulative_entry(struct hist_entry_iter *iter,
          * cumulated only one time to prevent entries more than 100%
          * overhead.
          */
-        he_cache = malloc(sizeof(*he_cache) * (iter->max_stack + 1));
+        he_cache = malloc(sizeof(*he_cache) * (callchain_cursor.nr + 1));
         if (he_cache == NULL)
                 return -ENOMEM;
 
@@ -1045,8 +1047,6 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
         if (err)
                 return err;
 
-        iter->max_stack = max_stack_depth;
-
         err = iter->ops->prepare_entry(iter, al);
         if (err)
                 goto out;
@@ -1141,7 +1141,7 @@ void hist_entry__delete(struct hist_entry *he)
         if (he->mem_info) {
                 map__zput(he->mem_info->iaddr.map);
                 map__zput(he->mem_info->daddr.map);
-                zfree(&he->mem_info);
+                mem_info__zput(he->mem_info);
         }
 
         zfree(&he->stat_acc);
@@ -2456,6 +2456,85 @@ u64 hists__total_period(struct hists *hists)
                 hists->stats.total_period;
 }
 
+int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool show_freq)
+{
+        char unit;
+        int printed;
+        const struct dso *dso = hists->dso_filter;
+        const struct thread *thread = hists->thread_filter;
+        int socket_id = hists->socket_filter;
+        unsigned long nr_samples = hists->stats.nr_events[PERF_RECORD_SAMPLE];
+        u64 nr_events = hists->stats.total_period;
+        struct perf_evsel *evsel = hists_to_evsel(hists);
+        const char *ev_name = perf_evsel__name(evsel);
+        char buf[512], sample_freq_str[64] = "";
+        size_t buflen = sizeof(buf);
+        char ref[30] = " show reference callgraph, ";
+        bool enable_ref = false;
+
+        if (symbol_conf.filter_relative) {
+                nr_samples = hists->stats.nr_non_filtered_samples;
+                nr_events = hists->stats.total_non_filtered_period;
+        }
+
+        if (perf_evsel__is_group_event(evsel)) {
+                struct perf_evsel *pos;
+
+                perf_evsel__group_desc(evsel, buf, buflen);
+                ev_name = buf;
+
+                for_each_group_member(pos, evsel) {
+                        struct hists *pos_hists = evsel__hists(pos);
+
+                        if (symbol_conf.filter_relative) {
+                                nr_samples += pos_hists->stats.nr_non_filtered_samples;
+                                nr_events += pos_hists->stats.total_non_filtered_period;
+                        } else {
+                                nr_samples += pos_hists->stats.nr_events[PERF_RECORD_SAMPLE];
+                                nr_events += pos_hists->stats.total_period;
+                        }
+                }
+        }
+
+        if (symbol_conf.show_ref_callgraph &&
+            strstr(ev_name, "call-graph=no"))
+                enable_ref = true;
+
+        if (show_freq)
+                scnprintf(sample_freq_str, sizeof(sample_freq_str), " %d Hz,", evsel->attr.sample_freq);
+
+        nr_samples = convert_unit(nr_samples, &unit);
+        printed = scnprintf(bf, size,
+                           "Samples: %lu%c of event%s '%s',%s%sEvent count (approx.): %" PRIu64,
+                           nr_samples, unit, evsel->nr_members > 1 ? "s" : "",
+                           ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events);
+
+
+        if (hists->uid_filter_str)
+                printed += snprintf(bf + printed, size - printed,
+                                    ", UID: %s", hists->uid_filter_str);
+        if (thread) {
+                if (hists__has(hists, thread)) {
+                        printed += scnprintf(bf + printed, size - printed,
+                                    ", Thread: %s(%d)",
+                                     (thread->comm_set ? thread__comm_str(thread) : ""),
+                                    thread->tid);
+                } else {
+                        printed += scnprintf(bf + printed, size - printed,
+                                    ", Thread: %s",
+                                     (thread->comm_set ? thread__comm_str(thread) : ""));
+                }
+        }
+        if (dso)
+                printed += scnprintf(bf + printed, size - printed,
+                                    ", DSO: %s", dso->short_name);
+        if (socket_id > -1)
+                printed += scnprintf(bf + printed, size - printed,
+                                    ", Processor Socket: %d", socket_id);
+
+        return printed;
+}
+
 int parse_filter_percentage(const struct option *opt __maybe_unused,
                             const char *arg, int unset __maybe_unused)
 {
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index 02721b579746..fbabfd8a215d 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -61,6 +61,7 @@ enum hist_column {
         HISTC_SRCLINE_TO,
         HISTC_TRACE,
         HISTC_SYM_SIZE,
+        HISTC_DSO_SIZE,
         HISTC_NR_COLS, /* Last entry */
 };
 
@@ -107,7 +108,6 @@ struct hist_entry_iter {
         int curr;
 
         bool hide_unresolved;
-        int max_stack;
 
         struct perf_evsel *evsel;
         struct perf_sample *sample;
@@ -504,5 +504,11 @@ int __hpp__slsmg_color_printf(struct perf_hpp *hpp, const char *fmt, ...);
 int __hist_entry__snprintf(struct hist_entry *he, struct perf_hpp *hpp,
                            struct perf_hpp_list *hpp_list);
 int hists__fprintf_headers(struct hists *hists, FILE *fp);
+int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool show_freq);
+
+static inline int hists__scnprintf_title(struct hists *hists, char *bf, size_t size)
+{
+        return __hists__scnprintf_title(hists, bf, size, true);
+}
 
 #endif  /* __PERF_HIST_H */
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index aa1593ce551d..f9157aed1289 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -1378,6 +1378,7 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder)
         intel_pt_clear_tx_flags(decoder);
         decoder->have_tma = false;
         decoder->cbr = 0;
+        decoder->timestamp_insn_cnt = 0;
         decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC;
         decoder->overflow = true;
         return -EOVERFLOW;
@@ -1616,6 +1617,7 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder *decoder)
                 case INTEL_PT_PWRX:
                         intel_pt_log("ERROR: Missing TIP after FUP\n");
                         decoder->pkt_state = INTEL_PT_STATE_ERR3;
+                        decoder->pkt_step = 0;
                         return -ENOENT;
 
                 case INTEL_PT_OVF:
@@ -2390,14 +2392,6 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
         return &decoder->state;
 }
 
-static bool intel_pt_at_psb(unsigned char *buf, size_t len)
-{
-        if (len < INTEL_PT_PSB_LEN)
-                return false;
-        return memmem(buf, INTEL_PT_PSB_LEN, INTEL_PT_PSB_STR,
-                      INTEL_PT_PSB_LEN);
-}
-
 /**
  * intel_pt_next_psb - move buffer pointer to the start of the next PSB packet.
  * @buf: pointer to buffer pointer
@@ -2486,6 +2480,7 @@ static unsigned char *intel_pt_last_psb(unsigned char *buf, size_t len)
  * @buf: buffer
  * @len: size of buffer
  * @tsc: TSC value returned
+ * @rem: returns remaining size when TSC is found
  *
  * Find a TSC packet in @buf and return the TSC value.  This function assumes
  * that @buf starts at a PSB and that PSB+ will contain TSC and so stops if a
@@ -2493,7 +2488,8 @@ static unsigned char *intel_pt_last_psb(unsigned char *buf, size_t len)
  *
  * Return: %true if TSC is found, false otherwise.
  */
-static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc)
+static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc,
+                              size_t *rem)
 {
         struct intel_pt_pkt packet;
         int ret;
@@ -2504,6 +2500,7 @@ static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc)
                         return false;
                 if (packet.type == INTEL_PT_TSC) {
                         *tsc = packet.payload;
+                        *rem = len;
                         return true;
                 }
                 if (packet.type == INTEL_PT_PSBEND)
@@ -2554,6 +2551,8 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2)
  * @len_a: size of first buffer
  * @buf_b: second buffer
  * @len_b: size of second buffer
+ * @consecutive: returns true if there is data in buf_b that is consecutive
+ *               to buf_a
  *
  * If the trace contains TSC we can look at the last TSC of @buf_a and the
  * first TSC of @buf_b in order to determine if the buffers overlap, and then
@@ -2566,33 +2565,41 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2)
 static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a,
                                                 size_t len_a,
                                                 unsigned char *buf_b,
-                                                size_t len_b)
+                                                size_t len_b, bool *consecutive)
 {
         uint64_t tsc_a, tsc_b;
         unsigned char *p;
-        size_t len;
+        size_t len, rem_a, rem_b;
 
         p = intel_pt_last_psb(buf_a, len_a);
         if (!p)
                 return buf_b; /* No PSB in buf_a => no overlap */
 
         len = len_a - (p - buf_a);
-        if (!intel_pt_next_tsc(p, len, &tsc_a)) {
+        if (!intel_pt_next_tsc(p, len, &tsc_a, &rem_a)) {
                 /* The last PSB+ in buf_a is incomplete, so go back one more */
                 len_a -= len;
                 p = intel_pt_last_psb(buf_a, len_a);
                 if (!p)
                         return buf_b; /* No full PSB+ => assume no overlap */
                 len = len_a - (p - buf_a);
-                if (!intel_pt_next_tsc(p, len, &tsc_a))
+                if (!intel_pt_next_tsc(p, len, &tsc_a, &rem_a))
                         return buf_b; /* No TSC in buf_a => assume no overlap */
         }
 
         while (1) {
                 /* Ignore PSB+ with no TSC */
-                if (intel_pt_next_tsc(buf_b, len_b, &tsc_b) &&
-                    intel_pt_tsc_cmp(tsc_a, tsc_b) < 0)
-                        return buf_b; /* tsc_a < tsc_b => no overlap */
+                if (intel_pt_next_tsc(buf_b, len_b, &tsc_b, &rem_b)) {
+                        int cmp = intel_pt_tsc_cmp(tsc_a, tsc_b);
+
+                        /* Same TSC, so buffers are consecutive */
+                        if (!cmp && rem_b >= rem_a) {
+                                *consecutive = true;
+                                return buf_b + len_b - (rem_b - rem_a);
+                        }
+                        if (cmp < 0)
+                                return buf_b; /* tsc_a < tsc_b => no overlap */
+                }
 
                 if (!intel_pt_step_psb(&buf_b, &len_b))
                         return buf_b + len_b; /* No PSB in buf_b => no data */
@@ -2606,6 +2613,8 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a,
  * @buf_b: second buffer
  * @len_b: size of second buffer
  * @have_tsc: can use TSC packets to detect overlap
+ * @consecutive: returns true if there is data in buf_b that is consecutive
+ *               to buf_a
  *
  * When trace samples or snapshots are recorded there is the possibility that
  * the data overlaps.  Note that, for the purposes of decoding, data is only
@@ -2616,7 +2625,7 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a,
  */
 unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a,
                                      unsigned char *buf_b, size_t len_b,
-                                     bool have_tsc)
+                                     bool have_tsc, bool *consecutive)
 {
         unsigned char *found;
 
@@ -2628,7 +2637,8 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a,
                 return buf_b; /* No overlap */
 
         if (have_tsc) {
-                found = intel_pt_find_overlap_tsc(buf_a, len_a, buf_b, len_b);
+                found = intel_pt_find_overlap_tsc(buf_a, len_a, buf_b, len_b,
+                                                  consecutive);
                 if (found)
                         return found;
         }
@@ -2643,28 +2653,16 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a,
         }
 
         /* Now len_b >= len_a */
-        if (len_b > len_a) {
-                /* The leftover buffer 'b' must start at a PSB */
-                while (!intel_pt_at_psb(buf_b + len_a, len_b - len_a)) {
-                        if (!intel_pt_step_psb(&buf_a, &len_a))
-                                return buf_b; /* No overlap */
-                }
-        }
-
         while (1) {
                 /* Potential overlap so check the bytes */
                 found = memmem(buf_a, len_a, buf_b, len_a);
-                if (found)
+                if (found) {
+                        *consecutive = true;
                         return buf_b + len_a;
+                }
 
                 /* Try again at next PSB in buffer 'a' */
                 if (!intel_pt_step_psb(&buf_a, &len_a))
                         return buf_b; /* No overlap */
-
-                /* The leftover buffer 'b' must start at a PSB */
-                while (!intel_pt_at_psb(buf_b + len_a, len_b - len_a)) {
-                        if (!intel_pt_step_psb(&buf_a, &len_a))
-                                return buf_b; /* No overlap */
-                }
         }
 }
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
index 921b22e8ca0e..fc1752d50019 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
@@ -117,7 +117,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder);
 
 unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a,
                                      unsigned char *buf_b, size_t len_b,
-                                     bool have_tsc);
+                                     bool have_tsc, bool *consecutive);
 
 int intel_pt__strerror(int code, char *buf, size_t buflen);
 
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 3773d9c54f45..0effaff57020 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -132,6 +132,7 @@ struct intel_pt_queue {
         struct intel_pt *pt;
         unsigned int queue_nr;
         struct auxtrace_buffer *buffer;
+        struct auxtrace_buffer *old_buffer;
         void *decoder;
         const struct intel_pt_state *state;
         struct ip_callchain *chain;
@@ -143,6 +144,7 @@ struct intel_pt_queue {
         bool stop;
         bool step_through_buffers;
         bool use_buffer_pid_tid;
+        bool sync_switch;
         pid_t pid, tid;
         int cpu;
         int switch_state;
@@ -207,49 +209,28 @@ static void intel_pt_dump_event(struct intel_pt *pt, unsigned char *buf,
 static int intel_pt_do_fix_overlap(struct intel_pt *pt, struct auxtrace_buffer *a,
                                    struct auxtrace_buffer *b)
 {
+        bool consecutive = false;
         void *start;
 
         start = intel_pt_find_overlap(a->data, a->size, b->data, b->size,
-                                      pt->have_tsc);
+                                      pt->have_tsc, &consecutive);
         if (!start)
                 return -EINVAL;
         b->use_size = b->data + b->size - start;
         b->use_data = start;
+        if (b->use_size && consecutive)
+                b->consecutive = true;
         return 0;
 }
 
-static void intel_pt_use_buffer_pid_tid(struct intel_pt_queue *ptq,
-                                        struct auxtrace_queue *queue,
-                                        struct auxtrace_buffer *buffer)
-{
-        if (queue->cpu == -1 && buffer->cpu != -1)
-                ptq->cpu = buffer->cpu;
-
-        ptq->pid = buffer->pid;
-        ptq->tid = buffer->tid;
-
-        intel_pt_log("queue %u cpu %d pid %d tid %d\n",
-                     ptq->queue_nr, ptq->cpu, ptq->pid, ptq->tid);
-
-        thread__zput(ptq->thread);
-
-        if (ptq->tid != -1) {
-                if (ptq->pid != -1)
-                        ptq->thread = machine__findnew_thread(ptq->pt->machine,
-                                                              ptq->pid,
-                                                              ptq->tid);
-                else
-                        ptq->thread = machine__find_thread(ptq->pt->machine, -1,
-                                                           ptq->tid);
-        }
-}
-
 /* This function assumes data is processed sequentially only */
 static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
 {
         struct intel_pt_queue *ptq = data;
-        struct auxtrace_buffer *buffer = ptq->buffer, *old_buffer = buffer;
+        struct auxtrace_buffer *buffer = ptq->buffer;
+        struct auxtrace_buffer *old_buffer = ptq->old_buffer;
         struct auxtrace_queue *queue;
+        bool might_overlap;
 
         if (ptq->stop) {
                 b->len = 0;
@@ -257,7 +238,7 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
         }
 
         queue = &ptq->pt->queues.queue_array[ptq->queue_nr];
-next:
+
         buffer = auxtrace_buffer__next(queue, buffer);
         if (!buffer) {
                 if (old_buffer)
@@ -276,7 +257,8 @@ next:
                         return -ENOMEM;
         }
 
-        if (ptq->pt->snapshot_mode && !buffer->consecutive && old_buffer &&
+        might_overlap = ptq->pt->snapshot_mode || ptq->pt->sampling_mode;
+        if (might_overlap && !buffer->consecutive && old_buffer &&
             intel_pt_do_fix_overlap(ptq->pt, old_buffer, buffer))
                 return -ENOMEM;
 
@@ -289,33 +271,24 @@ next:
         }
         b->ref_timestamp = buffer->reference;
 
-        /*
-         * If in snapshot mode and the buffer has no usable data, get next
-         * buffer and again check overlap against old_buffer.
-         */
-        if (ptq->pt->snapshot_mode && !b->len)
-                goto next;
-
-        if (old_buffer)
-                auxtrace_buffer__drop_data(old_buffer);
-
-        if (!old_buffer || ptq->pt->sampling_mode || (ptq->pt->snapshot_mode &&
-                                                      !buffer->consecutive)) {
+        if (!old_buffer || (might_overlap && !buffer->consecutive)) {
                 b->consecutive = false;
                 b->trace_nr = buffer->buffer_nr + 1;
         } else {
                 b->consecutive = true;
         }
 
-        if (ptq->use_buffer_pid_tid && (ptq->pid != buffer->pid ||
-                                        ptq->tid != buffer->tid))
-                intel_pt_use_buffer_pid_tid(ptq, queue, buffer);
-
         if (ptq->step_through_buffers)
                 ptq->stop = true;
 
-        if (!b->len)
+        if (b->len) {
+                if (old_buffer)
+                        auxtrace_buffer__drop_data(old_buffer);
+                ptq->old_buffer = buffer;
+        } else {
+                auxtrace_buffer__drop_data(buffer);
                 return intel_pt_get_trace(b, data);
+        }
 
         return 0;
 }
@@ -954,16 +927,15 @@ static int intel_pt_setup_queue(struct intel_pt *pt,
                         ptq->cpu = queue->cpu;
                 ptq->tid = queue->tid;
 
-                if (pt->sampling_mode) {
-                        if (pt->timeless_decoding)
-                                ptq->step_through_buffers = true;
-                        if (pt->timeless_decoding || !pt->have_sched_switch)
-                                ptq->use_buffer_pid_tid = true;
-                }
+                if (pt->sampling_mode && !pt->snapshot_mode &&
+                    pt->timeless_decoding)
+                        ptq->step_through_buffers = true;
+
+                ptq->sync_switch = pt->sync_switch;
         }
 
         if (!ptq->on_heap &&
-            (!pt->sync_switch ||
+            (!ptq->sync_switch ||
              ptq->switch_state != INTEL_PT_SS_EXPECTING_SWITCH_EVENT)) {
                 const struct intel_pt_state *state;
                 int ret;
@@ -1546,7 +1518,7 @@ static int intel_pt_sample(struct intel_pt_queue *ptq)
         if (pt->synth_opts.last_branch)
                 intel_pt_update_last_branch_rb(ptq);
 
-        if (!pt->sync_switch)
+        if (!ptq->sync_switch)
                 return 0;
 
         if (intel_pt_is_switch_ip(ptq, state->to_ip)) {
@@ -1627,6 +1599,21 @@ static u64 intel_pt_switch_ip(struct intel_pt *pt, u64 *ptss_ip)
         return switch_ip;
 }
 
+static void intel_pt_enable_sync_switch(struct intel_pt *pt)
+{
+        unsigned int i;
+
+        pt->sync_switch = true;
+
+        for (i = 0; i < pt->queues.nr_queues; i++) {
+                struct auxtrace_queue *queue = &pt->queues.queue_array[i];
+                struct intel_pt_queue *ptq = queue->priv;
+
+                if (ptq)
+                        ptq->sync_switch = true;
+        }
+}
+
 static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp)
 {
         const struct intel_pt_state *state = ptq->state;
@@ -1643,7 +1630,7 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp)
                         if (pt->switch_ip) {
                                 intel_pt_log("switch_ip: %"PRIx64" ptss_ip: %"PRIx64"\n",
                                              pt->switch_ip, pt->ptss_ip);
-                                pt->sync_switch = true;
+                                intel_pt_enable_sync_switch(pt);
                         }
                 }
         }
@@ -1659,9 +1646,9 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp)
                 if (state->err) {
                         if (state->err == INTEL_PT_ERR_NODATA)
                                 return 1;
-                        if (pt->sync_switch &&
+                        if (ptq->sync_switch &&
                             state->from_ip >= pt->kernel_start) {
-                                pt->sync_switch = false;
+                                ptq->sync_switch = false;
                                 intel_pt_next_tid(pt, ptq);
                         }
                         if (pt->synth_opts.errors) {
@@ -1687,7 +1674,7 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp)
                                      state->timestamp, state->est_timestamp);
                         ptq->timestamp = state->est_timestamp;
                 /* Use estimated TSC in unknown switch state */
-                } else if (pt->sync_switch &&
+                } else if (ptq->sync_switch &&
                            ptq->switch_state == INTEL_PT_SS_UNKNOWN &&
                            intel_pt_is_switch_ip(ptq, state->to_ip) &&
                            ptq->next_tid == -1) {
@@ -1834,7 +1821,7 @@ static int intel_pt_sync_switch(struct intel_pt *pt, int cpu, pid_t tid,
                 return 1;
 
         ptq = intel_pt_cpu_to_ptq(pt, cpu);
-        if (!ptq)
+        if (!ptq || !ptq->sync_switch)
                 return 1;
 
         switch (ptq->switch_state) {
@@ -2075,9 +2062,6 @@ static int intel_pt_process_auxtrace_event(struct perf_session *session,
         struct intel_pt *pt = container_of(session->auxtrace, struct intel_pt,
                                            auxtrace);
 
-        if (pt->sampling_mode)
-                return 0;
-
         if (!pt->data_queued) {
                 struct auxtrace_buffer *buffer;
                 off_t data_offset;
diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
index 4952b429caa7..1cca0a2fa641 100644
--- a/tools/perf/util/llvm-utils.c
+++ b/tools/perf/util/llvm-utils.c
@@ -433,6 +433,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
         char serr[STRERR_BUFSIZE];
         char *kbuild_dir = NULL, *kbuild_include_opts = NULL;
         const char *template = llvm_param.clang_bpf_cmd_template;
+        char *command_echo, *command_out;
 
         if (path[0] != '-' && realpath(path, abspath) == NULL) {
                 err = errno;
@@ -487,6 +488,16 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
                       (path[0] == '-') ? path : abspath);
 
         pr_debug("llvm compiling command template: %s\n", template);
+
+        if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0)
+                goto errout;
+
+        err = read_from_pipe(command_echo, (void **) &command_out, NULL);
+        if (err)
+                goto errout;
+
+        pr_debug("llvm compiling command : %s\n", command_out);
+
         err = read_from_pipe(template, &obj_buf, &obj_buf_sz);
         if (err) {
                 pr_err("ERROR:\tunable to compile %s\n", path);
@@ -497,6 +508,8 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
                 goto errout;
         }
 
+        free(command_echo);
+        free(command_out);
         free(kbuild_dir);
         free(kbuild_include_opts);
 
@@ -509,6 +522,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
                 *p_obj_buf_sz = obj_buf_sz;
         return 0;
 errout:
+        free(command_echo);
         free(kbuild_dir);
         free(kbuild_include_opts);
         free(obj_buf);
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index b05a67464c03..32d50492505d 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -48,8 +48,23 @@ static void machine__threads_init(struct machine *machine)
         }
 }
 
+static int machine__set_mmap_name(struct machine *machine)
+{
+        if (machine__is_host(machine))
+                machine->mmap_name = strdup("[kernel.kallsyms]");
+        else if (machine__is_default_guest(machine))
+                machine->mmap_name = strdup("[guest.kernel.kallsyms]");
+        else if (asprintf(&machine->mmap_name, "[guest.kernel.kallsyms.%d]",
+                          machine->pid) < 0)
+                machine->mmap_name = NULL;
+
+        return machine->mmap_name ? 0 : -ENOMEM;
+}
+
 int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
 {
+        int err = -ENOMEM;
+
         memset(machine, 0, sizeof(*machine));
         map_groups__init(&machine->kmaps, machine);
         RB_CLEAR_NODE(&machine->rb_node);
@@ -73,13 +88,16 @@ int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
         if (machine->root_dir == NULL)
                 return -ENOMEM;
 
+        if (machine__set_mmap_name(machine))
+                goto out;
+
         if (pid != HOST_KERNEL_ID) {
                 struct thread *thread = machine__findnew_thread(machine, -1,
                                                                 pid);
                 char comm[64];
 
                 if (thread == NULL)
-                        return -ENOMEM;
+                        goto out;
 
                 snprintf(comm, sizeof(comm), "[guest/%d]", pid);
                 thread__set_comm(thread, comm, 0);
@@ -87,7 +105,13 @@ int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
         }
 
         machine->current_tid = NULL;
+        err = 0;
 
+out:
+        if (err) {
+                zfree(&machine->root_dir);
+                zfree(&machine->mmap_name);
+        }
         return 0;
 }
 
@@ -119,7 +143,7 @@ struct machine *machine__new_kallsyms(void)
          *    ask for not using the kcore parsing code, once this one is fixed
          *    to create a map per module.
          */
-        if (machine && __machine__load_kallsyms(machine, "/proc/kallsyms", MAP__FUNCTION, true) <= 0) {
+        if (machine && machine__load_kallsyms(machine, "/proc/kallsyms", MAP__FUNCTION) <= 0) {
                 machine__delete(machine);
                 machine = NULL;
         }
@@ -180,6 +204,7 @@ void machine__exit(struct machine *machine)
         dsos__exit(&machine->dsos);
         machine__exit_vdso(machine);
         zfree(&machine->root_dir);
+        zfree(&machine->mmap_name);
         zfree(&machine->current_tid);
 
         for (i = 0; i < THREADS__TABLE_SIZE; i++) {
@@ -322,20 +347,6 @@ void machines__process_guests(struct machines *machines,
         }
 }
 
-char *machine__mmap_name(struct machine *machine, char *bf, size_t size)
-{
-        if (machine__is_host(machine))
-                snprintf(bf, size, "[%s]", "kernel.kallsyms");
-        else if (machine__is_default_guest(machine))
-                snprintf(bf, size, "[%s]", "guest.kernel.kallsyms");
-        else {
-                snprintf(bf, size, "[%s.%d]", "guest.kernel.kallsyms",
-                         machine->pid);
-        }
-
-        return bf;
-}
-
 void machines__set_id_hdr_size(struct machines *machines, u16 id_hdr_size)
 {
         struct rb_node *node;
@@ -771,24 +782,18 @@ size_t machine__fprintf(struct machine *machine, FILE *fp)
 
 static struct dso *machine__get_kernel(struct machine *machine)
 {
-        const char *vmlinux_name = NULL;
+        const char *vmlinux_name = machine->mmap_name;
         struct dso *kernel;
 
         if (machine__is_host(machine)) {
-                vmlinux_name = symbol_conf.vmlinux_name;
-                if (!vmlinux_name)
-                        vmlinux_name = DSO__NAME_KALLSYMS;
+                if (symbol_conf.vmlinux_name)
+                        vmlinux_name = symbol_conf.vmlinux_name;
 
                 kernel = machine__findnew_kernel(machine, vmlinux_name,
                                                  "[kernel]", DSO_TYPE_KERNEL);
         } else {
-                char bf[PATH_MAX];
-
-                if (machine__is_default_guest(machine))
+                if (symbol_conf.default_guest_vmlinux_name)
                         vmlinux_name = symbol_conf.default_guest_vmlinux_name;
-                if (!vmlinux_name)
-                        vmlinux_name = machine__mmap_name(machine, bf,
-                                                          sizeof(bf));
 
                 kernel = machine__findnew_kernel(machine, vmlinux_name,
                                                  "[guest.kernel]",
@@ -849,13 +854,10 @@ static int machine__get_running_kernel_start(struct machine *machine,
         return 0;
 }
 
-int __machine__create_kernel_maps(struct machine *machine, struct dso *kernel)
+static int
+__machine__create_kernel_maps(struct machine *machine, struct dso *kernel)
 {
         int type;
-        u64 start = 0;
-
-        if (machine__get_running_kernel_start(machine, NULL, &start))
-                return -1;
 
         /* In case of renewal the kernel map, destroy previous one */
         machine__destroy_kernel_maps(machine);
@@ -864,7 +866,7 @@ int __machine__create_kernel_maps(struct machine *machine, struct dso *kernel)
                 struct kmap *kmap;
                 struct map *map;
 
-                machine->vmlinux_maps[type] = map__new2(start, kernel, type);
+                machine->vmlinux_maps[type] = map__new2(0, kernel, type);
                 if (machine->vmlinux_maps[type] == NULL)
                         return -1;
 
@@ -987,11 +989,11 @@ int machines__create_kernel_maps(struct machines *machines, pid_t pid)
         return machine__create_kernel_maps(machine);
 }
 
-int __machine__load_kallsyms(struct machine *machine, const char *filename,
-                             enum map_type type, bool no_kcore)
+int machine__load_kallsyms(struct machine *machine, const char *filename,
+                             enum map_type type)
 {
         struct map *map = machine__kernel_map(machine);
-        int ret = __dso__load_kallsyms(map->dso, filename, map, no_kcore);
+        int ret = __dso__load_kallsyms(map->dso, filename, map, true);
 
         if (ret > 0) {
                 dso__set_loaded(map->dso, type);
@@ -1006,12 +1008,6 @@ int __machine__load_kallsyms(struct machine *machine, const char *filename,
         return ret;
 }
 
-int machine__load_kallsyms(struct machine *machine, const char *filename,
-                           enum map_type type)
-{
-        return __machine__load_kallsyms(machine, filename, type, false);
-}
-
 int machine__load_vmlinux_path(struct machine *machine, enum map_type type)
 {
         struct map *map = machine__kernel_map(machine);
@@ -1023,13 +1019,6 @@ int machine__load_vmlinux_path(struct machine *machine, enum map_type type)
         return ret;
 }
 
-static void map_groups__fixup_end(struct map_groups *mg)
-{
-        int i;
-        for (i = 0; i < MAP__NR_TYPES; ++i)
-                __map_groups__fixup_end(mg, i);
-}
-
 static char *get_kernel_version(const char *root_dir)
 {
         char version[PATH_MAX];
@@ -1215,10 +1204,29 @@ static int machine__create_modules(struct machine *machine)
         return 0;
 }
 
+static void machine__set_kernel_mmap(struct machine *machine,
+                                     u64 start, u64 end)
+{
+        int i;
+
+        for (i = 0; i < MAP__NR_TYPES; i++) {
+                machine->vmlinux_maps[i]->start = start;
+                machine->vmlinux_maps[i]->end   = end;
+
+                /*
+                 * Be a bit paranoid here, some perf.data file came with
+                 * a zero sized synthesized MMAP event for the kernel.
+                 */
+                if (start == 0 && end == 0)
+                        machine->vmlinux_maps[i]->end = ~0ULL;
+        }
+}
+
 int machine__create_kernel_maps(struct machine *machine)
 {
         struct dso *kernel = machine__get_kernel(machine);
         const char *name = NULL;
+        struct map *map;
         u64 addr = 0;
         int ret;
 
@@ -1239,38 +1247,32 @@ int machine__create_kernel_maps(struct machine *machine)
                                  "continuing anyway...\n", machine->pid);
         }
 
-        /*
-         * Now that we have all the maps created, just set the ->end of them:
-         */
-        map_groups__fixup_end(&machine->kmaps);
-
         if (!machine__get_running_kernel_start(machine, &name, &addr)) {
                 if (name &&
                     maps__set_kallsyms_ref_reloc_sym(machine->vmlinux_maps, name, addr)) {
                         machine__destroy_kernel_maps(machine);
                         return -1;
                 }
-        }
 
-        return 0;
-}
+                /* we have a real start address now, so re-order the kmaps */
+                map = machine__kernel_map(machine);
 
-static void machine__set_kernel_mmap_len(struct machine *machine,
-                                         union perf_event *event)
-{
-        int i;
+                map__get(map);
+                map_groups__remove(&machine->kmaps, map);
 
-        for (i = 0; i < MAP__NR_TYPES; i++) {
-                machine->vmlinux_maps[i]->start = event->mmap.start;
-                machine->vmlinux_maps[i]->end   = (event->mmap.start +
-                                                   event->mmap.len);
-                /*
-                 * Be a bit paranoid here, some perf.data file came with
-                 * a zero sized synthesized MMAP event for the kernel.
-                 */
-                if (machine->vmlinux_maps[i]->end == 0)
-                        machine->vmlinux_maps[i]->end = ~0ULL;
+                /* assume it's the last in the kmaps */
+                machine__set_kernel_mmap(machine, addr, ~0ULL);
+
+                map_groups__insert(&machine->kmaps, map);
+                map__put(map);
         }
+
+        /* update end address of the kernel map using adjacent module address */
+        map = map__next(machine__kernel_map(machine));
+        if (map)
+                machine__set_kernel_mmap(machine, addr, map->start);
+
+        return 0;
 }
 
 static bool machine__uses_kcore(struct machine *machine)
@@ -1289,7 +1291,6 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
                                               union perf_event *event)
 {
         struct map *map;
-        char kmmap_prefix[PATH_MAX];
         enum dso_kernel_type kernel_type;
         bool is_kernel_mmap;
 
@@ -1297,15 +1298,14 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
         if (machine__uses_kcore(machine))
                 return 0;
 
-        machine__mmap_name(machine, kmmap_prefix, sizeof(kmmap_prefix));
         if (machine__is_host(machine))
                 kernel_type = DSO_TYPE_KERNEL;
         else
                 kernel_type = DSO_TYPE_GUEST_KERNEL;
 
         is_kernel_mmap = memcmp(event->mmap.filename,
-                                kmmap_prefix,
-                                strlen(kmmap_prefix) - 1) == 0;
+                                machine->mmap_name,
+                                strlen(machine->mmap_name) - 1) == 0;
         if (event->mmap.filename[0] == '/' ||
             (!is_kernel_mmap && event->mmap.filename[0] == '[')) {
                 map = machine__findnew_module_map(machine, event->mmap.start,
@@ -1316,7 +1316,7 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
                 map->end = map->start + event->mmap.len;
         } else if (is_kernel_mmap) {
                 const char *symbol_name = (event->mmap.filename +
-                                strlen(kmmap_prefix));
+                                strlen(machine->mmap_name));
                 /*
                  * Should be there already, from the build-id table in
                  * the header.
@@ -1357,7 +1357,7 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
                 up_read(&machine->dsos.lock);
 
                 if (kernel == NULL)
-                        kernel = machine__findnew_dso(machine, kmmap_prefix);
+                        kernel = machine__findnew_dso(machine, machine->mmap_name);
                 if (kernel == NULL)
                         goto out_problem;
 
@@ -1370,7 +1370,8 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
                 if (strstr(kernel->long_name, "vmlinux"))
                         dso__set_short_name(kernel, "[kernel.vmlinux]", false);
 
-                machine__set_kernel_mmap_len(machine, event);
+                machine__set_kernel_mmap(machine, event->mmap.start,
+                                         event->mmap.start + event->mmap.len);
 
                 /*
                  * Avoid using a zero address (kptr_restrict) for the ref reloc
@@ -1700,7 +1701,7 @@ static void ip__resolve_data(struct thread *thread,
 struct mem_info *sample__resolve_mem(struct perf_sample *sample,
                                      struct addr_location *al)
 {
-        struct mem_info *mi = zalloc(sizeof(*mi));
+        struct mem_info *mi = mem_info__new();
 
         if (!mi)
                 return NULL;
diff --git a/tools/perf/util/machine.h b/tools/perf/util/machine.h
index 5ce860b64c74..66cc200ef86f 100644
--- a/tools/perf/util/machine.h
+++ b/tools/perf/util/machine.h
@@ -43,6 +43,7 @@ struct machine {
         bool              comm_exec;
         bool              kptr_restrict_warned;
         char              *root_dir;
+        char              *mmap_name;
         struct threads    threads[THREADS__TABLE_SIZE];
         struct vdso_info  *vdso_info;
         struct perf_env   *env;
@@ -142,8 +143,6 @@ struct machine *machines__find(struct machines *machines, pid_t pid);
 struct machine *machines__findnew(struct machines *machines, pid_t pid);
 
 void machines__set_id_hdr_size(struct machines *machines, u16 id_hdr_size);
-char *machine__mmap_name(struct machine *machine, char *bf, size_t size);
-
 void machines__set_comm_exec(struct machines *machines, bool comm_exec);
 
 struct machine *machine__new_host(void);
@@ -226,8 +225,6 @@ struct map *machine__findnew_module_map(struct machine *machine, u64 start,
                                         const char *filename);
 int arch__fix_module_text_start(u64 *start, const char *name);
 
-int __machine__load_kallsyms(struct machine *machine, const char *filename,
-                             enum map_type type, bool no_kcore);
 int machine__load_kallsyms(struct machine *machine, const char *filename,
                            enum map_type type);
 int machine__load_vmlinux_path(struct machine *machine, enum map_type type);
@@ -239,7 +236,6 @@ size_t machines__fprintf_dsos_buildid(struct machines *machines, FILE *fp,
                                      bool (skip)(struct dso *dso, int parm), int parm);
 
 void machine__destroy_kernel_maps(struct machine *machine);
-int __machine__create_kernel_maps(struct machine *machine, struct dso *kernel);
 int machine__create_kernel_maps(struct machine *machine);
 
 int machines__create_kernel_maps(struct machines *machines, pid_t pid);
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index edeb7291c8e1..0e9bbe01b0ab 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -103,6 +103,10 @@ static inline u64 identity__map_ip(struct map *map __maybe_unused, u64 ip)
         return ip;
 }
 
+static inline size_t map__size(const struct map *map)
+{
+        return map->end - map->start;
+}
 
 /* rip/ip <-> addr suitable for passing to `objdump --start-address=` */
 u64 map__rip_2objdump(struct map *map, u64 rip);
diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
new file mode 100644
index 000000000000..c6fd81c02586
--- /dev/null
+++ b/tools/perf/util/mem2node.c
@@ -0,0 +1,134 @@
+#include <errno.h>
+#include <inttypes.h>
+#include <linux/bitmap.h>
+#include "mem2node.h"
+#include "util.h"
+
+struct phys_entry {
+        struct rb_node  rb_node;
+        u64     start;
+        u64     end;
+        u64     node;
+};
+
+static void phys_entry__insert(struct phys_entry *entry, struct rb_root *root)
+{
+        struct rb_node **p = &root->rb_node;
+        struct rb_node *parent = NULL;
+        struct phys_entry *e;
+
+        while (*p != NULL) {
+                parent = *p;
+                e = rb_entry(parent, struct phys_entry, rb_node);
+
+                if (entry->start < e->start)
+                        p = &(*p)->rb_left;
+                else
+                        p = &(*p)->rb_right;
+        }
+
+        rb_link_node(&entry->rb_node, parent, p);
+        rb_insert_color(&entry->rb_node, root);
+}
+
+static void
+phys_entry__init(struct phys_entry *entry, u64 start, u64 bsize, u64 node)
+{
+        entry->start = start;
+        entry->end   = start + bsize;
+        entry->node  = node;
+        RB_CLEAR_NODE(&entry->rb_node);
+}
+
+int mem2node__init(struct mem2node *map, struct perf_env *env)
+{
+        struct memory_node *n, *nodes = &env->memory_nodes[0];
+        struct phys_entry *entries, *tmp_entries;
+        u64 bsize = env->memory_bsize;
+        int i, j = 0, max = 0;
+
+        memset(map, 0x0, sizeof(*map));
+        map->root = RB_ROOT;
+
+        for (i = 0; i < env->nr_memory_nodes; i++) {
+                n = &nodes[i];
+                max += bitmap_weight(n->set, n->size);
+        }
+
+        entries = zalloc(sizeof(*entries) * max);
+        if (!entries)
+                return -ENOMEM;
+
+        for (i = 0; i < env->nr_memory_nodes; i++) {
+                u64 bit;
+
+                n = &nodes[i];
+
+                for (bit = 0; bit < n->size; bit++) {
+                        u64 start;
+
+                        if (!test_bit(bit, n->set))
+                                continue;
+
+                        start = bit * bsize;
+
+                        /*
+                         * Merge nearby areas, we walk in order
+                         * through the bitmap, so no need to sort.
+                         */
+                        if (j > 0) {
+                                struct phys_entry *prev = &entries[j - 1];
+
+                                if ((prev->end == start) &&
+                                    (prev->node == n->node)) {
+                                        prev->end += bsize;
+                                        continue;
+                                }
+                        }
+
+                        phys_entry__init(&entries[j++], start, bsize, n->node);
+                }
+        }
+
+        /* Cut unused entries, due to merging. */
+        tmp_entries = realloc(entries, sizeof(*entries) * j);
+        if (tmp_entries)
+                entries = tmp_entries;
+
+        for (i = 0; i < j; i++) {
+                pr_debug("mem2node %03" PRIu64 " [0x%016" PRIx64 "-0x%016" PRIx64 "]\n",
+                         entries[i].node, entries[i].start, entries[i].end);
+
+                phys_entry__insert(&entries[i], &map->root);
+        }
+
+        map->entries = entries;
+        return 0;
+}
+
+void mem2node__exit(struct mem2node *map)
+{
+        zfree(&map->entries);
+}
+
+int mem2node__node(struct mem2node *map, u64 addr)
+{
+        struct rb_node **p, *parent = NULL;
+        struct phys_entry *entry;
+
+        p = &map->root.rb_node;
+        while (*p != NULL) {
+                parent = *p;
+                entry = rb_entry(parent, struct phys_entry, rb_node);
+                if (addr < entry->start)
+                        p = &(*p)->rb_left;
+                else if (addr >= entry->end)
+                        p = &(*p)->rb_right;
+                else
+                        goto out;
+        }
+
+        entry = NULL;
+out:
+        return entry ? (int) entry->node : -1;
+}
diff --git a/tools/perf/util/mem2node.h b/tools/perf/util/mem2node.h
new file mode 100644
index 000000000000..59c4752a2181
--- /dev/null
+++ b/tools/perf/util/mem2node.h
@@ -0,0 +1,19 @@
+#ifndef __MEM2NODE_H
+#define __MEM2NODE_H
+
+#include <linux/rbtree.h>
+#include "env.h"
+
+struct phys_entry;
+
+struct mem2node {
+        struct rb_root           root;
+        struct phys_entry       *entries;
+        int                      cnt;
+};
+
+int  mem2node__init(struct mem2node *map, struct perf_env *env);
+void mem2node__exit(struct mem2node *map);
+int  mem2node__node(struct mem2node *map, u64 addr);
+
+#endif /* __MEM2NODE_H */
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 91531a7c8fbf..fc832676a798 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -64,25 +64,6 @@ static union perf_event *perf_mmap__read(struct perf_mmap *map,
 }
 
 /*
- * legacy interface for mmap read.
- * Don't use it. Use perf_mmap__read_event().
- */
-union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
-{
-        u64 head;
-
-        /*
-         * Check if event was unmapped due to a POLLHUP/POLLERR.
-         */
-        if (!refcount_read(&map->refcnt))
-                return NULL;
-
-        head = perf_mmap__read_head(map);
-
-        return perf_mmap__read(map, &map->prev, head);
-}
-
-/*
  * Read event from ring buffer one by one.
  * Return one event for each call.
  *
@@ -94,9 +75,7 @@ union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
  * }
  * perf_mmap__read_done()
  */
-union perf_event *perf_mmap__read_event(struct perf_mmap *map,
-                                        bool overwrite,
-                                        u64 *startp, u64 end)
+union perf_event *perf_mmap__read_event(struct perf_mmap *map)
 {
         union perf_event *event;
 
@@ -106,17 +85,14 @@ union perf_event *perf_mmap__read_event(struct perf_mmap *map,
         if (!refcount_read(&map->refcnt))
                 return NULL;
 
-        if (startp == NULL)
-                return NULL;
-
         /* non-overwirte doesn't pause the ringbuffer */
-        if (!overwrite)
-                end = perf_mmap__read_head(map);
+        if (!map->overwrite)
+                map->end = perf_mmap__read_head(map);
 
-        event = perf_mmap__read(map, startp, end);
+        event = perf_mmap__read(map, &map->start, map->end);
 
-        if (!overwrite)
-                map->prev = *startp;
+        if (!map->overwrite)
+                map->prev = map->start;
 
         return event;
 }
@@ -139,9 +115,9 @@ void perf_mmap__put(struct perf_mmap *map)
                 perf_mmap__munmap(map);
 }
 
-void perf_mmap__consume(struct perf_mmap *map, bool overwrite)
+void perf_mmap__consume(struct perf_mmap *map)
 {
-        if (!overwrite) {
+        if (!map->overwrite) {
                 u64 old = map->prev;
 
                 perf_mmap__write_tail(map, old);
@@ -191,7 +167,7 @@ void perf_mmap__munmap(struct perf_mmap *map)
 int perf_mmap__mmap(struct perf_mmap *map, struct mmap_params *mp, int fd)
 {
         /*
-         * The last one will be done at perf_evlist__mmap_consume(), so that we
+         * The last one will be done at perf_mmap__consume(), so that we
          * make sure we don't prevent tools from consuming every last event in
          * the ring buffer.
          *
@@ -223,19 +199,18 @@ int perf_mmap__mmap(struct perf_mmap *map, struct mmap_params *mp, int fd)
         return 0;
 }
 
-static int overwrite_rb_find_range(void *buf, int mask, u64 head, u64 *start, u64 *end)
+static int overwrite_rb_find_range(void *buf, int mask, u64 *start, u64 *end)
 {
         struct perf_event_header *pheader;
-        u64 evt_head = head;
+        u64 evt_head = *start;
         int size = mask + 1;
 
-        pr_debug2("overwrite_rb_find_range: buf=%p, head=%"PRIx64"\n", buf, head);
-        pheader = (struct perf_event_header *)(buf + (head & mask));
-        *start = head;
+        pr_debug2("%s: buf=%p, start=%"PRIx64"\n", __func__, buf, *start);
+        pheader = (struct perf_event_header *)(buf + (*start & mask));
         while (true) {
-                if (evt_head - head >= (unsigned int)size) {
+                if (evt_head - *start >= (unsigned int)size) {
                         pr_debug("Finished reading overwrite ring buffer: rewind\n");
-                        if (evt_head - head > (unsigned int)size)
+                        if (evt_head - *start > (unsigned int)size)
                                 evt_head -= pheader->size;
                         *end = evt_head;
                         return 0;
@@ -259,27 +234,26 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 head, u64 *start, u6
 /*
  * Report the start and end of the available data in ringbuffer
  */
-int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
-                         u64 *startp, u64 *endp)
+static int __perf_mmap__read_init(struct perf_mmap *md)
 {
         u64 head = perf_mmap__read_head(md);
         u64 old = md->prev;
         unsigned char *data = md->base + page_size;
         unsigned long size;
 
-        *startp = overwrite ? head : old;
-        *endp = overwrite ? old : head;
+        md->start = md->overwrite ? head : old;
+        md->end = md->overwrite ? old : head;
 
-        if (*startp == *endp)
+        if (md->start == md->end)
                 return -EAGAIN;
 
-        size = *endp - *startp;
+        size = md->end - md->start;
         if (size > (unsigned long)(md->mask) + 1) {
-                if (!overwrite) {
+                if (!md->overwrite) {
                         WARN_ONCE(1, "failed to keep up with mmap data. (warn only once)\n");
 
                         md->prev = head;
-                        perf_mmap__consume(md, overwrite);
+                        perf_mmap__consume(md);
                         return -EAGAIN;
                 }
 
@@ -287,33 +261,43 @@ int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
                  * Backward ring buffer is full. We still have a chance to read
                  * most of data from it.
                  */
-                if (overwrite_rb_find_range(data, md->mask, head, startp, endp))
+                if (overwrite_rb_find_range(data, md->mask, &md->start, &md->end))
                         return -EINVAL;
         }
 
         return 0;
 }
 
-int perf_mmap__push(struct perf_mmap *md, bool overwrite,
-                    void *to, int push(void *to, void *buf, size_t size))
+int perf_mmap__read_init(struct perf_mmap *map)
+{
+        /*
+         * Check if event was unmapped due to a POLLHUP/POLLERR.
+         */
+        if (!refcount_read(&map->refcnt))
+                return -ENOENT;
+
+        return __perf_mmap__read_init(map);
+}
+
+int perf_mmap__push(struct perf_mmap *md, void *to,
+                    int push(void *to, void *buf, size_t size))
 {
         u64 head = perf_mmap__read_head(md);
-        u64 end, start;
         unsigned char *data = md->base + page_size;
         unsigned long size;
         void *buf;
         int rc = 0;
 
-        rc = perf_mmap__read_init(md, overwrite, &start, &end);
+        rc = perf_mmap__read_init(md);
         if (rc < 0)
                 return (rc == -EAGAIN) ? 0 : -1;
 
-        size = end - start;
+        size = md->end - md->start;
 
-        if ((start & md->mask) + size != (end & md->mask)) {
-                buf = &data[start & md->mask];
-                size = md->mask + 1 - (start & md->mask);
-                start += size;
+        if ((md->start & md->mask) + size != (md->end & md->mask)) {
+                buf = &data[md->start & md->mask];
+                size = md->mask + 1 - (md->start & md->mask);
+                md->start += size;
 
                 if (push(to, buf, size) < 0) {
                         rc = -1;
@@ -321,9 +305,9 @@ int perf_mmap__push(struct perf_mmap *md, bool overwrite,
                 }
         }
 
-        buf = &data[start & md->mask];
-        size = end - start;
-        start += size;
+        buf = &data[md->start & md->mask];
+        size = md->end - md->start;
+        md->start += size;
 
         if (push(to, buf, size) < 0) {
                 rc = -1;
@@ -331,7 +315,7 @@ int perf_mmap__push(struct perf_mmap *md, bool overwrite,
         }
 
         md->prev = head;
-        perf_mmap__consume(md, overwrite);
+        perf_mmap__consume(md);
 out:
         return rc;
 }
@@ -344,5 +328,11 @@ out:
  */
 void perf_mmap__read_done(struct perf_mmap *map)
 {
+        /*
+         * Check if event was unmapped due to a POLLHUP/POLLERR.
+         */
+        if (!refcount_read(&map->refcnt))
+                return;
+
         map->prev = perf_mmap__read_head(map);
 }
diff --git a/tools/perf/util/mmap.h b/tools/perf/util/mmap.h
index ec7d3a24e276..d82294db1295 100644
--- a/tools/perf/util/mmap.h
+++ b/tools/perf/util/mmap.h
@@ -20,6 +20,9 @@ struct perf_mmap {
         int              fd;
         refcount_t       refcnt;
         u64              prev;
+        u64              start;
+        u64              end;
+        bool             overwrite;
         struct auxtrace_mmap auxtrace_mmap;
         char             event_copy[PERF_SAMPLE_MAX_SIZE] __aligned(8);
 };
@@ -63,7 +66,7 @@ void perf_mmap__munmap(struct perf_mmap *map);
 void perf_mmap__get(struct perf_mmap *map);
 void perf_mmap__put(struct perf_mmap *map);
 
-void perf_mmap__consume(struct perf_mmap *map, bool overwrite);
+void perf_mmap__consume(struct perf_mmap *map);
 
 static inline u64 perf_mmap__read_head(struct perf_mmap *mm)
 {
@@ -86,16 +89,13 @@ static inline void perf_mmap__write_tail(struct perf_mmap *md, u64 tail)
 
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map);
 
-union perf_event *perf_mmap__read_event(struct perf_mmap *map,
-                                        bool overwrite,
-                                        u64 *startp, u64 end);
+union perf_event *perf_mmap__read_event(struct perf_mmap *map);
 
-int perf_mmap__push(struct perf_mmap *md, bool backward,
-                    void *to, int push(void *to, void *buf, size_t size));
+int perf_mmap__push(struct perf_mmap *md, void *to,
+                    int push(void *to, void *buf, size_t size));
 
 size_t perf_mmap__mmap_len(struct perf_mmap *map);
 
-int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
-                         u64 *startp, u64 *endp);
+int perf_mmap__read_init(struct perf_mmap *md);
 void perf_mmap__read_done(struct perf_mmap *map);
 #endif /*__PERF_MMAP_H */
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 34589c427e52..b8b8a9558d32 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -206,8 +206,8 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config)
 
                 for_each_event(sys_dirent, evt_dir, evt_dirent) {
 
-                        snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
-                                 evt_dirent->d_name);
+                        scnprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
+                                  evt_dirent->d_name);
                         fd = open(evt_path, O_RDONLY);
                         if (fd < 0)
                                 continue;
@@ -1217,7 +1217,7 @@ int parse_events_add_numeric(struct parse_events_state *parse_state,
                          get_config_name(head_config), &config_terms);
 }
 
-static int __parse_events_add_pmu(struct parse_events_state *parse_state,
+int parse_events_add_pmu(struct parse_events_state *parse_state,
                          struct list_head *list, char *name,
                          struct list_head *head_config, bool auto_merge_stats)
 {
@@ -1247,7 +1247,12 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state,
         if (!head_config) {
                 attr.type = pmu->type;
                 evsel = __add_event(list, &parse_state->idx, &attr, NULL, pmu, NULL, auto_merge_stats);
-                return evsel ? 0 : -ENOMEM;
+                if (evsel) {
+                        evsel->pmu_name = name;
+                        return 0;
+                } else {
+                        return -ENOMEM;
+                }
         }
 
         if (perf_pmu__check_alias(pmu, head_config, &info))
@@ -1276,18 +1281,12 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state,
                 evsel->snapshot = info.snapshot;
                 evsel->metric_expr = info.metric_expr;
                 evsel->metric_name = info.metric_name;
+                evsel->pmu_name = name;
         }
 
         return evsel ? 0 : -ENOMEM;
 }
 
-int parse_events_add_pmu(struct parse_events_state *parse_state,
-                         struct list_head *list, char *name,
-                         struct list_head *head_config)
-{
-        return __parse_events_add_pmu(parse_state, list, name, head_config, false);
-}
-
 int parse_events_multi_pmu_add(struct parse_events_state *parse_state,
                                char *str, struct list_head **listp)
 {
@@ -1317,8 +1316,8 @@ int parse_events_multi_pmu_add(struct parse_events_state *parse_state,
                                         return -1;
                                 list_add_tail(&term->list, head);
 
-                                if (!__parse_events_add_pmu(parse_state, list,
-                                                            pmu->name, head, true)) {
+                                if (!parse_events_add_pmu(parse_state, list,
+                                                          pmu->name, head, true)) {
                                         pr_debug("%s -> %s/%s/\n", str,
                                                  pmu->name, alias->str);
                                         ok++;
@@ -1716,7 +1715,7 @@ int parse_events(struct perf_evlist *evlist, const char *str,
                 struct perf_evsel *last;
 
                 if (list_empty(&parse_state.list)) {
-                        WARN_ONCE(true, "WARNING: event parser found nothing");
+                        WARN_ONCE(true, "WARNING: event parser found nothing\n");
                         return -1;
                 }
 
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index 88108cd11b4c..5015cfd58277 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -167,7 +167,7 @@ int parse_events_add_breakpoint(struct list_head *list, int *idx,
                                 void *ptr, char *type, u64 len);
 int parse_events_add_pmu(struct parse_events_state *parse_state,
                          struct list_head *list, char *name,
-                         struct list_head *head_config);
+                         struct list_head *head_config, bool auto_merge_stats);
 
 int parse_events_multi_pmu_add(struct parse_events_state *parse_state,
                                char *str,
diff --git a/tools/perf/util/parse-events.l b/tools/perf/util/parse-events.l
index 655ecff636a8..a1a01b1ac8b8 100644
--- a/tools/perf/util/parse-events.l
+++ b/tools/perf/util/parse-events.l
@@ -175,7 +175,7 @@ bpf_source	[^,{}]+\.c[a-zA-Z0-9._]*
 num_dec         [0-9]+
 num_hex         0x[a-fA-F0-9]+
 num_raw_hex     [a-fA-F0-9]+
-name            [a-zA-Z_*?][a-zA-Z0-9_*?.]*
+name            [a-zA-Z_*?\[\]][a-zA-Z0-9_*?.\[\]]*
 name_minus      [a-zA-Z_*?][a-zA-Z0-9\-_*?.:]*
 drv_cfg_term    [a-zA-Z0-9_\.]+(=[a-zA-Z0-9_*?\.:]+)?
 /* If you add a modifier you need to update check_modifier() */
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index e81a20ea8d7d..7afeb80cc39e 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -8,6 +8,7 @@
 
 #define YYDEBUG 1
 
+#include <fnmatch.h>
 #include <linux/compiler.h>
 #include <linux/list.h>
 #include <linux/types.h>
@@ -231,9 +232,13 @@ PE_NAME opt_event_config
                 YYABORT;
 
         ALLOC_LIST(list);
-        if (parse_events_add_pmu(_parse_state, list, $1, $2)) {
+        if (parse_events_add_pmu(_parse_state, list, $1, $2, false)) {
                 struct perf_pmu *pmu = NULL;
                 int ok = 0;
+                char *pattern;
+
+                if (asprintf(&pattern, "%s*", $1) < 0)
+                        YYABORT;
 
                 while ((pmu = perf_pmu__scan(pmu)) != NULL) {
                         char *name = pmu->name;
@@ -241,14 +246,19 @@ PE_NAME opt_event_config
                         if (!strncmp(name, "uncore_", 7) &&
                             strncmp($1, "uncore_", 7))
                                 name += 7;
-                        if (!strncmp($1, name, strlen($1))) {
-                                if (parse_events_copy_term_list(orig_terms, &terms))
+                        if (!fnmatch(pattern, name, 0)) {
+                                if (parse_events_copy_term_list(orig_terms, &terms)) {
+                                        free(pattern);
                                         YYABORT;
-                                if (!parse_events_add_pmu(_parse_state, list, pmu->name, terms))
+                                }
+                                if (!parse_events_add_pmu(_parse_state, list, pmu->name, terms, true))
                                         ok++;
                                 parse_events_terms__delete(terms);
                         }
                 }
+
+                free(pattern);
+
                 if (!ok)
                         YYABORT;
         }
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 57e38fdf0b34..d2fb597c9a8c 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -351,7 +351,7 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
                 if (pmu_alias_info_file(name))
                         continue;
 
-                snprintf(path, PATH_MAX, "%s/%s", dir, name);
+                scnprintf(path, PATH_MAX, "%s/%s", dir, name);
 
                 file = fopen(path, "r");
                 if (!file) {
@@ -539,9 +539,10 @@ static bool pmu_is_uncore(const char *name)
 
 /*
  *  PMU CORE devices have different name other than cpu in sysfs on some
- *  platforms. looking for possible sysfs files to identify as core device.
+ *  platforms.
+ *  Looking for possible sysfs files to identify the arm core device.
  */
-static int is_pmu_core(const char *name)
+static int is_arm_pmu_core(const char *name)
 {
         struct stat st;
         char path[PATH_MAX];
@@ -550,18 +551,18 @@ static int is_pmu_core(const char *name)
         if (!sysfs)
                 return 0;
 
-        /* Look for cpu sysfs (x86 and others) */
-        scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/cpu", sysfs);
-        if ((stat(path, &st) == 0) &&
-                        (strncmp(name, "cpu", strlen("cpu")) == 0))
-                return 1;
-
         /* Look for cpu sysfs (specific to arm) */
         scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/%s/cpus",
                                 sysfs, name);
         if (stat(path, &st) == 0)
                 return 1;
 
+        /* Look for cpu sysfs (specific to s390) */
+        scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/%s",
+                  sysfs, name);
+        if (stat(path, &st) == 0 && !strncmp(name, "cpum_", 5))
+                return 1;
+
         return 0;
 }
 
@@ -576,6 +577,34 @@ char * __weak get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
         return NULL;
 }
 
+/* Return zero when the cpuid from the mapfile.csv matches the
+ * cpuid string generated on this platform.
+ * Otherwise return non-zero.
+ */
+int strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
+{
+        regex_t re;
+        regmatch_t pmatch[1];
+        int match;
+
+        if (regcomp(&re, mapcpuid, REG_EXTENDED) != 0) {
+                /* Warn unable to generate match particular string. */
+                pr_info("Invalid regular expression %s\n", mapcpuid);
+                return 1;
+        }
+
+        match = !regexec(&re, cpuid, 1, pmatch, 0);
+        regfree(&re);
+        if (match) {
+                size_t match_len = (pmatch[0].rm_eo - pmatch[0].rm_so);
+
+                /* Verify the entire string matched. */
+                if (match_len == strlen(cpuid))
+                        return 0;
+        }
+        return 1;
+}
+
 static char *perf_pmu__getcpuid(struct perf_pmu *pmu)
 {
         char *cpuid;
@@ -610,31 +639,14 @@ struct pmu_events_map *perf_pmu__find_map(struct perf_pmu *pmu)
 
         i = 0;
         for (;;) {
-                regex_t re;
-                regmatch_t pmatch[1];
-                int match;
-
                 map = &pmu_events_map[i++];
                 if (!map->table) {
                         map = NULL;
                         break;
                 }
 
-                if (regcomp(&re, map->cpuid, REG_EXTENDED) != 0) {
-                        /* Warn unable to generate match particular string. */
-                        pr_info("Invalid regular expression %s\n", map->cpuid);
+                if (!strcmp_cpuid_str(map->cpuid, cpuid))
                         break;
-                }
-
-                match = !regexec(&re, cpuid, 1, pmatch, 0);
-                regfree(&re);
-                if (match) {
-                        size_t match_len = (pmatch[0].rm_eo - pmatch[0].rm_so);
-
-                        /* Verify the entire string matched. */
-                        if (match_len == strlen(cpuid))
-                                break;
-                }
         }
         free(cpuid);
         return map;
@@ -651,6 +663,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
         struct pmu_events_map *map;
         struct pmu_event *pe;
         const char *name = pmu->name;
+        const char *pname;
 
         map = perf_pmu__find_map(pmu);
         if (!map)
@@ -669,11 +682,9 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
                         break;
                 }
 
-                if (!is_pmu_core(name)) {
-                        /* check for uncore devices */
-                        if (pe->pmu == NULL)
-                                continue;
-                        if (strncmp(pe->pmu, name, strlen(pe->pmu)))
+                if (!is_arm_pmu_core(name)) {
+                        pname = pe->pmu ? pe->pmu : "cpu";
+                        if (strncmp(pname, name, strlen(pname)))
                                 continue;
                 }
 
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index a5731de0e5eb..c37fbef1711d 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -423,20 +423,20 @@ static int convert_variable_fields(Dwarf_Die *vr_die, const char *varname,
                 pr_warning("Failed to get the type of %s.\n", varname);
                 return -ENOENT;
         }
-        pr_debug2("Var real type: (%x)\n", (unsigned)dwarf_dieoffset(&type));
+        pr_debug2("Var real type: %s (%x)\n", dwarf_diename(&type),
+                  (unsigned)dwarf_dieoffset(&type));
         tag = dwarf_tag(&type);
 
         if (field->name[0] == '[' &&
             (tag == DW_TAG_array_type || tag == DW_TAG_pointer_type)) {
-                if (field->next)
-                        /* Save original type for next field */
-                        memcpy(die_mem, &type, sizeof(*die_mem));
+                /* Save original type for next field or type */
+                memcpy(die_mem, &type, sizeof(*die_mem));
                 /* Get the type of this array */
                 if (die_get_real_type(&type, &type) == NULL) {
                         pr_warning("Failed to get the type of %s.\n", varname);
                         return -ENOENT;
                 }
-                pr_debug2("Array real type: (%x)\n",
+                pr_debug2("Array real type: %s (%x)\n", dwarf_diename(&type),
                          (unsigned)dwarf_dieoffset(&type));
                 if (tag == DW_TAG_pointer_type) {
                         ref = zalloc(sizeof(struct probe_trace_arg_ref));
@@ -448,9 +448,6 @@ static int convert_variable_fields(Dwarf_Die *vr_die, const char *varname,
                                 *ref_ptr = ref;
                 }
                 ref->offset += dwarf_bytesize(&type) * field->index;
-                if (!field->next)
-                        /* Save vr_die for converting types */
-                        memcpy(die_mem, vr_die, sizeof(*die_mem));
                 goto next;
         } else if (tag == DW_TAG_pointer_type) {
                 /* Check the pointer and dereference */
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index b1e999bd21ef..863b61478edd 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -12,6 +12,30 @@
 #include "print_binary.h"
 #include "thread_map.h"
 
+#if PY_MAJOR_VERSION < 3
+#define _PyUnicode_FromString(arg) \
+  PyString_FromString(arg)
+#define _PyUnicode_AsString(arg) \
+  PyString_AsString(arg)
+#define _PyUnicode_FromFormat(...) \
+  PyString_FromFormat(__VA_ARGS__)
+#define _PyLong_FromLong(arg) \
+  PyInt_FromLong(arg)
+
+#else
+
+#define _PyUnicode_FromString(arg) \
+  PyUnicode_FromString(arg)
+#define _PyUnicode_FromFormat(...) \
+  PyUnicode_FromFormat(__VA_ARGS__)
+#define _PyLong_FromLong(arg) \
+  PyLong_FromLong(arg)
+#endif
+
+#ifndef Py_TYPE
+#define Py_TYPE(ob) (((PyObject*)(ob))->ob_type)
+#endif
+
 /*
  * Provide these two so that we don't have to link against callchain.c and
  * start dragging hist.c, etc.
@@ -49,7 +73,11 @@ int eprintf(int level, int var, const char *fmt, ...)
 # define PyVarObject_HEAD_INIT(type, size) PyObject_HEAD_INIT(type) size,
 #endif
 
+#if PY_MAJOR_VERSION < 3
 PyMODINIT_FUNC initperf(void);
+#else
+PyMODINIT_FUNC PyInit_perf(void);
+#endif
 
 #define member_def(type, member, ptype, help) \
         { #member, ptype, \
@@ -107,7 +135,7 @@ static PyObject *pyrf_mmap_event__repr(struct pyrf_event *pevent)
                      pevent->event.mmap.pgoff, pevent->event.mmap.filename) < 0) {
                 ret = PyErr_NoMemory();
         } else {
-                ret = PyString_FromString(s);
+                ret = _PyUnicode_FromString(s);
                 free(s);
         }
         return ret;
@@ -138,7 +166,7 @@ static PyMemberDef pyrf_task_event__members[] = {
 
 static PyObject *pyrf_task_event__repr(struct pyrf_event *pevent)
 {
-        return PyString_FromFormat("{ type: %s, pid: %u, ppid: %u, tid: %u, "
+        return _PyUnicode_FromFormat("{ type: %s, pid: %u, ppid: %u, tid: %u, "
                                    "ptid: %u, time: %" PRIu64 "}",
                                    pevent->event.header.type == PERF_RECORD_FORK ? "fork" : "exit",
                                    pevent->event.fork.pid,
@@ -171,7 +199,7 @@ static PyMemberDef pyrf_comm_event__members[] = {
 
 static PyObject *pyrf_comm_event__repr(struct pyrf_event *pevent)
 {
-        return PyString_FromFormat("{ type: comm, pid: %u, tid: %u, comm: %s }",
+        return _PyUnicode_FromFormat("{ type: comm, pid: %u, tid: %u, comm: %s }",
                                    pevent->event.comm.pid,
                                    pevent->event.comm.tid,
                                    pevent->event.comm.comm);
@@ -202,7 +230,7 @@ static PyObject *pyrf_throttle_event__repr(struct pyrf_event *pevent)
 {
         struct throttle_event *te = (struct throttle_event *)(&pevent->event.header + 1);
 
-        return PyString_FromFormat("{ type: %sthrottle, time: %" PRIu64 ", id: %" PRIu64
+        return _PyUnicode_FromFormat("{ type: %sthrottle, time: %" PRIu64 ", id: %" PRIu64
                                    ", stream_id: %" PRIu64 " }",
                                    pevent->event.header.type == PERF_RECORD_THROTTLE ? "" : "un",
                                    te->time, te->id, te->stream_id);
@@ -237,7 +265,7 @@ static PyObject *pyrf_lost_event__repr(struct pyrf_event *pevent)
                      pevent->event.lost.id, pevent->event.lost.lost) < 0) {
                 ret = PyErr_NoMemory();
         } else {
-                ret = PyString_FromString(s);
+                ret = _PyUnicode_FromString(s);
                 free(s);
         }
         return ret;
@@ -264,7 +292,7 @@ static PyMemberDef pyrf_read_event__members[] = {
 
 static PyObject *pyrf_read_event__repr(struct pyrf_event *pevent)
 {
-        return PyString_FromFormat("{ type: read, pid: %u, tid: %u }",
+        return _PyUnicode_FromFormat("{ type: read, pid: %u, tid: %u }",
                                    pevent->event.read.pid,
                                    pevent->event.read.tid);
         /*
@@ -299,7 +327,7 @@ static PyObject *pyrf_sample_event__repr(struct pyrf_event *pevent)
         if (asprintf(&s, "{ type: sample }") < 0) {
                 ret = PyErr_NoMemory();
         } else {
-                ret = PyString_FromString(s);
+                ret = _PyUnicode_FromString(s);
                 free(s);
         }
         return ret;
@@ -330,7 +358,7 @@ tracepoint_field(struct pyrf_event *pe, struct format_field *field)
                 }
                 if (field->flags & FIELD_IS_STRING &&
                     is_printable_array(data + offset, len)) {
-                        ret = PyString_FromString((char *)data + offset);
+                        ret = _PyUnicode_FromString((char *)data + offset);
                 } else {
                         ret = PyByteArray_FromStringAndSize((const char *) data + offset, len);
                         field->flags &= ~FIELD_IS_STRING;
@@ -352,7 +380,7 @@ tracepoint_field(struct pyrf_event *pe, struct format_field *field)
 static PyObject*
 get_tracepoint_field(struct pyrf_event *pevent, PyObject *attr_name)
 {
-        const char *str = PyString_AsString(PyObject_Str(attr_name));
+        const char *str = _PyUnicode_AsString(PyObject_Str(attr_name));
         struct perf_evsel *evsel = pevent->evsel;
         struct format_field *field;
 
@@ -416,7 +444,7 @@ static PyObject *pyrf_context_switch_event__repr(struct pyrf_event *pevent)
                      !!(pevent->event.header.misc & PERF_RECORD_MISC_SWITCH_OUT)) < 0) {
                 ret = PyErr_NoMemory();
         } else {
-                ret = PyString_FromString(s);
+                ret = _PyUnicode_FromString(s);
                 free(s);
         }
         return ret;
@@ -528,7 +556,7 @@ static int pyrf_cpu_map__init(struct pyrf_cpu_map *pcpus,
 static void pyrf_cpu_map__delete(struct pyrf_cpu_map *pcpus)
 {
         cpu_map__put(pcpus->cpus);
-        pcpus->ob_type->tp_free((PyObject*)pcpus);
+        Py_TYPE(pcpus)->tp_free((PyObject*)pcpus);
 }
 
 static Py_ssize_t pyrf_cpu_map__length(PyObject *obj)
@@ -597,7 +625,7 @@ static int pyrf_thread_map__init(struct pyrf_thread_map *pthreads,
 static void pyrf_thread_map__delete(struct pyrf_thread_map *pthreads)
 {
         thread_map__put(pthreads->threads);
-        pthreads->ob_type->tp_free((PyObject*)pthreads);
+        Py_TYPE(pthreads)->tp_free((PyObject*)pthreads);
 }
 
 static Py_ssize_t pyrf_thread_map__length(PyObject *obj)
@@ -759,7 +787,7 @@ static int pyrf_evsel__init(struct pyrf_evsel *pevsel,
 static void pyrf_evsel__delete(struct pyrf_evsel *pevsel)
 {
         perf_evsel__exit(&pevsel->evsel);
-        pevsel->ob_type->tp_free((PyObject*)pevsel);
+        Py_TYPE(pevsel)->tp_free((PyObject*)pevsel);
 }
 
 static PyObject *pyrf_evsel__open(struct pyrf_evsel *pevsel,
@@ -850,7 +878,7 @@ static int pyrf_evlist__init(struct pyrf_evlist *pevlist,
 static void pyrf_evlist__delete(struct pyrf_evlist *pevlist)
 {
         perf_evlist__exit(&pevlist->evlist);
-        pevlist->ob_type->tp_free((PyObject*)pevlist);
+        Py_TYPE(pevlist)->tp_free((PyObject*)pevlist);
 }
 
 static PyObject *pyrf_evlist__mmap(struct pyrf_evlist *pevlist,
@@ -902,12 +930,16 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
 
         for (i = 0; i < evlist->pollfd.nr; ++i) {
                 PyObject *file;
+#if PY_MAJOR_VERSION < 3
                 FILE *fp = fdopen(evlist->pollfd.entries[i].fd, "r");
 
                 if (fp == NULL)
                         goto free_list;
 
                 file = PyFile_FromFile(fp, "perf", "r", NULL);
+#else
+                file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1, NULL, NULL, NULL, 1);
+#endif
                 if (file == NULL)
                         goto free_list;
 
@@ -951,13 +983,18 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
         union perf_event *event;
         int sample_id_all = 1, cpu;
         static char *kwlist[] = { "cpu", "sample_id_all", NULL };
+        struct perf_mmap *md;
         int err;
 
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "i|i", kwlist,
                                          &cpu, &sample_id_all))
                 return NULL;
 
-        event = perf_evlist__mmap_read(evlist, cpu);
+        md = &evlist->mmap[cpu];
+        if (perf_mmap__read_init(md) < 0)
+                goto end;
+
+        event = perf_mmap__read_event(md);
         if (event != NULL) {
                 PyObject *pyevent = pyrf_event__new(event);
                 struct pyrf_event *pevent = (struct pyrf_event *)pyevent;
@@ -967,22 +1004,24 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                         return PyErr_NoMemory();
 
                 evsel = perf_evlist__event2evsel(evlist, event);
-                if (!evsel)
+                if (!evsel) {
+                        Py_INCREF(Py_None);
                         return Py_None;
+                }
 
                 pevent->evsel = evsel;
 
                 err = perf_evsel__parse_sample(evsel, event, &pevent->sample);
 
                 /* Consume the even only after we parsed it out. */
-                perf_evlist__mmap_consume(evlist, cpu);
+                perf_mmap__consume(md);
 
                 if (err)
                         return PyErr_Format(PyExc_OSError,
                                             "perf: can't parse sample, err=%d", err);
                 return pyevent;
         }
-
+end:
         Py_INCREF(Py_None);
         return Py_None;
 }
@@ -1194,9 +1233,9 @@ static PyObject *pyrf__tracepoint(struct pyrf_evsel *pevsel,
 
         tp_format = trace_event__tp_format(sys, name);
         if (IS_ERR(tp_format))
-                return PyInt_FromLong(-1);
+                return _PyLong_FromLong(-1);
 
-        return PyInt_FromLong(tp_format->id);
+        return _PyLong_FromLong(tp_format->id);
 }
 
 static PyMethodDef perf__methods[] = {
@@ -1209,11 +1248,31 @@ static PyMethodDef perf__methods[] = {
         { .ml_name = NULL, }
 };
 
+#if PY_MAJOR_VERSION < 3
 PyMODINIT_FUNC initperf(void)
+#else
+PyMODINIT_FUNC PyInit_perf(void)
+#endif
 {
         PyObject *obj;
         int i;
-        PyObject *dict, *module = Py_InitModule("perf", perf__methods);
+        PyObject *dict;
+#if PY_MAJOR_VERSION < 3
+        PyObject *module = Py_InitModule("perf", perf__methods);
+#else
+        static struct PyModuleDef moduledef = {
+                PyModuleDef_HEAD_INIT,
+                "perf",                 /* m_name */
+                "",                     /* m_doc */
+                -1,                     /* m_size */
+                perf__methods,          /* m_methods */
+                NULL,                   /* m_reload */
+                NULL,                   /* m_traverse */
+                NULL,                   /* m_clear */
+                NULL,                   /* m_free */
+        };
+        PyObject *module = PyModule_Create(&moduledef);
+#endif
 
         if (module == NULL ||
             pyrf_event__setup_types() < 0 ||
@@ -1221,7 +1280,11 @@ PyMODINIT_FUNC initperf(void)
             pyrf_evsel__setup_types() < 0 ||
             pyrf_thread_map__setup_types() < 0 ||
             pyrf_cpu_map__setup_types() < 0)
+#if PY_MAJOR_VERSION < 3
                 return;
+#else
+                return module;
+#endif
 
         /* The page_size is placed in util object. */
         page_size = sysconf(_SC_PAGE_SIZE);
@@ -1270,7 +1333,7 @@ PyMODINIT_FUNC initperf(void)
                 goto error;
 
         for (i = 0; perf__constants[i].name != NULL; i++) {
-                obj = PyInt_FromLong(perf__constants[i].value);
+                obj = _PyLong_FromLong(perf__constants[i].value);
                 if (obj == NULL)
                         goto error;
                 PyDict_SetItemString(dict, perf__constants[i].name, obj);
@@ -1280,6 +1343,9 @@ PyMODINIT_FUNC initperf(void)
 error:
         if (PyErr_Occurred())
                 PyErr_SetString(PyExc_ImportError, "perf: Init failed!");
+#if PY_MAJOR_VERSION >= 3
+        return module;
+#endif
 }
 
 /*
diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c
index 6f09e4962dad..9cfc7bf16531 100644
--- a/tools/perf/util/record.c
+++ b/tools/perf/util/record.c
@@ -5,6 +5,7 @@
 #include "parse-events.h"
 #include <errno.h>
 #include <api/fs/fs.h>
+#include <subcmd/parse-options.h>
 #include "util.h"
 #include "cloexec.h"
 
@@ -219,11 +220,21 @@ static int record_opts__config_freq(struct record_opts *opts)
          * User specified frequency is over current maximum.
          */
         if (user_freq && (max_rate < opts->freq)) {
-                pr_err("Maximum frequency rate (%u) reached.\n"
-                   "Please use -F freq option with lower value or consider\n"
-                   "tweaking /proc/sys/kernel/perf_event_max_sample_rate.\n",
-                   max_rate);
-                return -1;
+                if (opts->strict_freq) {
+                        pr_err("error: Maximum frequency rate (%'u Hz) exceeded.\n"
+                               "       Please use -F freq option with a lower value or consider\n"
+                               "       tweaking /proc/sys/kernel/perf_event_max_sample_rate.\n",
+                               max_rate);
+                        return -1;
+                } else {
+                        pr_warning("warning: Maximum frequency rate (%'u Hz) exceeded, throttling from %'u Hz to %'u Hz.\n"
+                                   "         The limit can be raised via /proc/sys/kernel/perf_event_max_sample_rate.\n"
+                                   "         The kernel will lower it when perf's interrupts take too long.\n"
+                                   "         Use --strict-freq to disable this throttling, refusing to record.\n",
+                                   max_rate, opts->freq, max_rate);
+
+                        opts->freq = max_rate;
+                }
         }
 
         /*
@@ -291,3 +302,25 @@ out_delete:
         perf_evlist__delete(temp_evlist);
         return ret;
 }
+
+int record__parse_freq(const struct option *opt, const char *str, int unset __maybe_unused)
+{
+        unsigned int freq;
+        struct record_opts *opts = opt->value;
+
+        if (!str)
+                return -EINVAL;
+
+        if (strcasecmp(str, "max") == 0) {
+                if (get_max_rate(&freq)) {
+                        pr_err("couldn't read /proc/sys/kernel/perf_event_max_sample_rate\n");
+                        return -1;
+                }
+                pr_info("info: Using a maximum frequency rate of %'d Hz\n", freq);
+        } else {
+                freq = atoi(str);
+        }
+
+        opts->user_freq = freq;
+        return 0;
+}
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index ea070883c593..10dd5fce082b 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -49,7 +49,37 @@
 #include "print_binary.h"
 #include "stat.h"
 
+#if PY_MAJOR_VERSION < 3
+#define _PyUnicode_FromString(arg) \
+  PyString_FromString(arg)
+#define _PyUnicode_FromStringAndSize(arg1, arg2) \
+  PyString_FromStringAndSize((arg1), (arg2))
+#define _PyBytes_FromStringAndSize(arg1, arg2) \
+  PyString_FromStringAndSize((arg1), (arg2))
+#define _PyLong_FromLong(arg) \
+  PyInt_FromLong(arg)
+#define _PyLong_AsLong(arg) \
+  PyInt_AsLong(arg)
+#define _PyCapsule_New(arg1, arg2, arg3) \
+  PyCObject_FromVoidPtr((arg1), (arg2))
+
 PyMODINIT_FUNC initperf_trace_context(void);
+#else
+#define _PyUnicode_FromString(arg) \
+  PyUnicode_FromString(arg)
+#define _PyUnicode_FromStringAndSize(arg1, arg2) \
+  PyUnicode_FromStringAndSize((arg1), (arg2))
+#define _PyBytes_FromStringAndSize(arg1, arg2) \
+  PyBytes_FromStringAndSize((arg1), (arg2))
+#define _PyLong_FromLong(arg) \
+  PyLong_FromLong(arg)
+#define _PyLong_AsLong(arg) \
+  PyLong_AsLong(arg)
+#define _PyCapsule_New(arg1, arg2, arg3) \
+  PyCapsule_New((arg1), (arg2), (arg3))
+
+PyMODINIT_FUNC PyInit_perf_trace_context(void);
+#endif
 
 #define TRACE_EVENT_TYPE_MAX                            \
         ((1 << (sizeof(unsigned short) * 8)) - 1)
@@ -135,7 +165,7 @@ static int get_argument_count(PyObject *handler)
                 PyObject *arg_count_obj = PyObject_GetAttrString(code_obj,
                         "co_argcount");
                 if (arg_count_obj) {
-                        arg_count = (int) PyInt_AsLong(arg_count_obj);
+                        arg_count = (int) _PyLong_AsLong(arg_count_obj);
                         Py_DECREF(arg_count_obj);
                 }
                 Py_DECREF(code_obj);
@@ -182,10 +212,10 @@ static void define_value(enum print_arg_type field_type,
 
         value = eval_flag(field_value);
 
-        PyTuple_SetItem(t, n++, PyString_FromString(ev_name));
-        PyTuple_SetItem(t, n++, PyString_FromString(field_name));
-        PyTuple_SetItem(t, n++, PyInt_FromLong(value));
-        PyTuple_SetItem(t, n++, PyString_FromString(field_str));
+        PyTuple_SetItem(t, n++, _PyUnicode_FromString(ev_name));
+        PyTuple_SetItem(t, n++, _PyUnicode_FromString(field_name));
+        PyTuple_SetItem(t, n++, _PyLong_FromLong(value));
+        PyTuple_SetItem(t, n++, _PyUnicode_FromString(field_str));
 
         try_call_object(handler_name, t);
 
@@ -223,10 +253,10 @@ static void define_field(enum print_arg_type field_type,
         if (!t)
                 Py_FatalError("couldn't create Python tuple");
 
-        PyTuple_SetItem(t, n++, PyString_FromString(ev_name));
-        PyTuple_SetItem(t, n++, PyString_FromString(field_name));
+        PyTuple_SetItem(t, n++, _PyUnicode_FromString(ev_name));
+        PyTuple_SetItem(t, n++, _PyUnicode_FromString(field_name));
         if (field_type == PRINT_FLAGS)
-                PyTuple_SetItem(t, n++, PyString_FromString(delim));
+                PyTuple_SetItem(t, n++, _PyUnicode_FromString(delim));
 
         try_call_object(handler_name, t);
 
@@ -325,12 +355,12 @@ static PyObject *get_field_numeric_entry(struct event_format *event,
                 if (field->flags & FIELD_IS_SIGNED) {
                         if ((long long)val >= LONG_MIN &&
                                         (long long)val <= LONG_MAX)
-                                obj = PyInt_FromLong(val);
+                                obj = _PyLong_FromLong(val);
                         else
                                 obj = PyLong_FromLongLong(val);
                 } else {
                         if (val <= LONG_MAX)
-                                obj = PyInt_FromLong(val);
+                                obj = _PyLong_FromLong(val);
                         else
                                 obj = PyLong_FromUnsignedLongLong(val);
                 }
@@ -389,9 +419,9 @@ static PyObject *python_process_callchain(struct perf_sample *sample,
                         pydict_set_item_string_decref(pysym, "end",
                                         PyLong_FromUnsignedLongLong(node->sym->end));
                         pydict_set_item_string_decref(pysym, "binding",
-                                        PyInt_FromLong(node->sym->binding));
+                                        _PyLong_FromLong(node->sym->binding));
                         pydict_set_item_string_decref(pysym, "name",
-                                        PyString_FromStringAndSize(node->sym->name,
+                                        _PyUnicode_FromStringAndSize(node->sym->name,
                                                         node->sym->namelen));
                         pydict_set_item_string_decref(pyelem, "sym", pysym);
                 }
@@ -406,7 +436,7 @@ static PyObject *python_process_callchain(struct perf_sample *sample,
                                         dsoname = map->dso->name;
                         }
                         pydict_set_item_string_decref(pyelem, "dso",
-                                        PyString_FromString(dsoname));
+                                        _PyUnicode_FromString(dsoname));
                 }
 
                 callchain_cursor_advance(&callchain_cursor);
@@ -483,16 +513,16 @@ static PyObject *get_perf_sample_dict(struct perf_sample *sample,
         if (!dict_sample)
                 Py_FatalError("couldn't create Python dictionary");
 
-        pydict_set_item_string_decref(dict, "ev_name", PyString_FromString(perf_evsel__name(evsel)));
-        pydict_set_item_string_decref(dict, "attr", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "ev_name", _PyUnicode_FromString(perf_evsel__name(evsel)));
+        pydict_set_item_string_decref(dict, "attr", _PyUnicode_FromStringAndSize(
                         (const char *)&evsel->attr, sizeof(evsel->attr)));
 
         pydict_set_item_string_decref(dict_sample, "pid",
-                        PyInt_FromLong(sample->pid));
+                        _PyLong_FromLong(sample->pid));
         pydict_set_item_string_decref(dict_sample, "tid",
-                        PyInt_FromLong(sample->tid));
+                        _PyLong_FromLong(sample->tid));
         pydict_set_item_string_decref(dict_sample, "cpu",
-                        PyInt_FromLong(sample->cpu));
+                        _PyLong_FromLong(sample->cpu));
         pydict_set_item_string_decref(dict_sample, "ip",
                         PyLong_FromUnsignedLongLong(sample->ip));
         pydict_set_item_string_decref(dict_sample, "time",
@@ -504,17 +534,17 @@ static PyObject *get_perf_sample_dict(struct perf_sample *sample,
         set_sample_read_in_dict(dict_sample, sample, evsel);
         pydict_set_item_string_decref(dict, "sample", dict_sample);
 
-        pydict_set_item_string_decref(dict, "raw_buf", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "raw_buf", _PyBytes_FromStringAndSize(
                         (const char *)sample->raw_data, sample->raw_size));
         pydict_set_item_string_decref(dict, "comm",
-                        PyString_FromString(thread__comm_str(al->thread)));
+                        _PyUnicode_FromString(thread__comm_str(al->thread)));
         if (al->map) {
                 pydict_set_item_string_decref(dict, "dso",
-                        PyString_FromString(al->map->dso->name));
+                        _PyUnicode_FromString(al->map->dso->name));
         }
         if (al->sym) {
                 pydict_set_item_string_decref(dict, "symbol",
-                        PyString_FromString(al->sym->name));
+                        _PyUnicode_FromString(al->sym->name));
         }
 
         pydict_set_item_string_decref(dict, "callchain", callchain);
@@ -574,9 +604,9 @@ static void python_process_tracepoint(struct perf_sample *sample,
         scripting_context->event_data = data;
         scripting_context->pevent = evsel->tp_format->pevent;
 
-        context = PyCObject_FromVoidPtr(scripting_context, NULL);
+        context = _PyCapsule_New(scripting_context, NULL, NULL);
 
-        PyTuple_SetItem(t, n++, PyString_FromString(handler_name));
+        PyTuple_SetItem(t, n++, _PyUnicode_FromString(handler_name));
         PyTuple_SetItem(t, n++, context);
 
         /* ip unwinding */
@@ -585,18 +615,18 @@ static void python_process_tracepoint(struct perf_sample *sample,
         Py_INCREF(callchain);
 
         if (!dict) {
-                PyTuple_SetItem(t, n++, PyInt_FromLong(cpu));
-                PyTuple_SetItem(t, n++, PyInt_FromLong(s));
-                PyTuple_SetItem(t, n++, PyInt_FromLong(ns));
-                PyTuple_SetItem(t, n++, PyInt_FromLong(pid));
-                PyTuple_SetItem(t, n++, PyString_FromString(comm));
+                PyTuple_SetItem(t, n++, _PyLong_FromLong(cpu));
+                PyTuple_SetItem(t, n++, _PyLong_FromLong(s));
+                PyTuple_SetItem(t, n++, _PyLong_FromLong(ns));
+                PyTuple_SetItem(t, n++, _PyLong_FromLong(pid));
+                PyTuple_SetItem(t, n++, _PyUnicode_FromString(comm));
                 PyTuple_SetItem(t, n++, callchain);
         } else {
-                pydict_set_item_string_decref(dict, "common_cpu", PyInt_FromLong(cpu));
-                pydict_set_item_string_decref(dict, "common_s", PyInt_FromLong(s));
-                pydict_set_item_string_decref(dict, "common_ns", PyInt_FromLong(ns));
-                pydict_set_item_string_decref(dict, "common_pid", PyInt_FromLong(pid));
-                pydict_set_item_string_decref(dict, "common_comm", PyString_FromString(comm));
+                pydict_set_item_string_decref(dict, "common_cpu", _PyLong_FromLong(cpu));
+                pydict_set_item_string_decref(dict, "common_s", _PyLong_FromLong(s));
+                pydict_set_item_string_decref(dict, "common_ns", _PyLong_FromLong(ns));
+                pydict_set_item_string_decref(dict, "common_pid", _PyLong_FromLong(pid));
+                pydict_set_item_string_decref(dict, "common_comm", _PyUnicode_FromString(comm));
                 pydict_set_item_string_decref(dict, "common_callchain", callchain);
         }
         for (field = event->format.fields; field; field = field->next) {
@@ -615,7 +645,7 @@ static void python_process_tracepoint(struct perf_sample *sample,
                         }
                         if (field->flags & FIELD_IS_STRING &&
                             is_printable_array(data + offset, len)) {
-                                obj = PyString_FromString((char *) data + offset);
+                                obj = _PyUnicode_FromString((char *) data + offset);
                         } else {
                                 obj = PyByteArray_FromStringAndSize((const char *) data + offset, len);
                                 field->flags &= ~FIELD_IS_STRING;
@@ -668,7 +698,7 @@ static PyObject *tuple_new(unsigned int sz)
 static int tuple_set_u64(PyObject *t, unsigned int pos, u64 val)
 {
 #if BITS_PER_LONG == 64
-        return PyTuple_SetItem(t, pos, PyInt_FromLong(val));
+        return PyTuple_SetItem(t, pos, _PyLong_FromLong(val));
 #endif
 #if BITS_PER_LONG == 32
         return PyTuple_SetItem(t, pos, PyLong_FromLongLong(val));
@@ -677,12 +707,12 @@ static int tuple_set_u64(PyObject *t, unsigned int pos, u64 val)
 
 static int tuple_set_s32(PyObject *t, unsigned int pos, s32 val)
 {
-        return PyTuple_SetItem(t, pos, PyInt_FromLong(val));
+        return PyTuple_SetItem(t, pos, _PyLong_FromLong(val));
 }
 
 static int tuple_set_string(PyObject *t, unsigned int pos, const char *s)
 {
-        return PyTuple_SetItem(t, pos, PyString_FromString(s));
+        return PyTuple_SetItem(t, pos, _PyUnicode_FromString(s));
 }
 
 static int python_export_evsel(struct db_export *dbe, struct perf_evsel *evsel)
@@ -1029,8 +1059,8 @@ process_stat(struct perf_evsel *counter, int cpu, int thread, u64 tstamp,
                 return;
         }
 
-        PyTuple_SetItem(t, n++, PyInt_FromLong(cpu));
-        PyTuple_SetItem(t, n++, PyInt_FromLong(thread));
+        PyTuple_SetItem(t, n++, _PyLong_FromLong(cpu));
+        PyTuple_SetItem(t, n++, _PyLong_FromLong(thread));
 
         tuple_set_u64(t, n++, tstamp);
         tuple_set_u64(t, n++, count->val);
@@ -1212,27 +1242,58 @@ static void set_table_handlers(struct tables *tables)
         SET_TABLE_HANDLER(call_return);
 }
 
+#if PY_MAJOR_VERSION < 3
+static void _free_command_line(const char **command_line, int num)
+{
+        free(command_line);
+}
+#else
+static void _free_command_line(wchar_t **command_line, int num)
+{
+        int i;
+        for (i = 0; i < num; i++)
+                PyMem_RawFree(command_line[i]);
+        free(command_line);
+}
+#endif
+
+
 /*
  * Start trace script
  */
 static int python_start_script(const char *script, int argc, const char **argv)
 {
         struct tables *tables = &tables_global;
+#if PY_MAJOR_VERSION < 3
         const char **command_line;
+#else
+        wchar_t **command_line;
+#endif
         char buf[PATH_MAX];
         int i, err = 0;
         FILE *fp;
 
+#if PY_MAJOR_VERSION < 3
         command_line = malloc((argc + 1) * sizeof(const char *));
         command_line[0] = script;
         for (i = 1; i < argc + 1; i++)
                 command_line[i] = argv[i - 1];
+#else
+        command_line = malloc((argc + 1) * sizeof(wchar_t *));
+        command_line[0] = Py_DecodeLocale(script, NULL);
+        for (i = 1; i < argc + 1; i++)
+                command_line[i] = Py_DecodeLocale(argv[i - 1], NULL);
+#endif
 
         Py_Initialize();
 
+#if PY_MAJOR_VERSION < 3
         initperf_trace_context();
-
         PySys_SetArgv(argc + 1, (char **)command_line);
+#else
+        PyInit_perf_trace_context();
+        PySys_SetArgv(argc + 1, command_line);
+#endif
 
         fp = fopen(script, "r");
         if (!fp) {
@@ -1262,12 +1323,12 @@ static int python_start_script(const char *script, int argc, const char **argv)
                         goto error;
         }
 
-        free(command_line);
+        _free_command_line(command_line, argc + 1);
 
         return err;
 error:
         Py_Finalize();
-        free(command_line);
+        _free_command_line(command_line, argc + 1);
 
         return err;
 }
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index c71ced7db152..f4a7a437ee87 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1591,7 +1591,7 @@ static void perf_session__warn_about_errors(const struct perf_session *session)
                 drop_rate = (double)stats->total_lost_samples /
                             (double) (stats->nr_events[PERF_RECORD_SAMPLE] + stats->total_lost_samples);
                 if (drop_rate > 0.05) {
-                        ui__warning("Processed %" PRIu64 " samples and lost %3.2f%% samples!\n\n",
+                        ui__warning("Processed %" PRIu64 " samples and lost %3.2f%%!\n\n",
                                     stats->nr_events[PERF_RECORD_SAMPLE] + stats->total_lost_samples,
                                     drop_rate * 100.0);
                 }
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index af415febbc46..001be4f9d3b9 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python2
+#!/usr/bin/python
 
 from os import getenv
 
@@ -28,6 +28,8 @@ class install_lib(_install_lib):
 cflags = getenv('CFLAGS', '').split()
 # switch off several checks (need to be at the end of cflags list)
 cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ]
+if cc != "clang":
+    cflags += ['-Wno-cast-function-type' ]
 
 src_perf  = getenv('srctree') + '/tools/perf'
 build_lib = getenv('PYTHON_EXTBUILD_LIB')
@@ -35,11 +37,11 @@ build_tmp = getenv('PYTHON_EXTBUILD_TMP')
 libtraceevent = getenv('LIBTRACEEVENT')
 libapikfs = getenv('LIBAPI')
 
-ext_sources = [f.strip() for f in file('util/python-ext-sources')
+ext_sources = [f.strip() for f in open('util/python-ext-sources')
                                 if len(f.strip()) > 0 and f[0] != '#']
 
 # use full paths with source files
-ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources)
+ext_sources = list(map(lambda x: '%s/%s' % (src_perf, x) , ext_sources))
 
 perf = Extension('perf',
                   sources = ext_sources,
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 2da4d0456a03..26a68dfd8a4f 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -111,17 +111,20 @@ struct sort_entry sort_thread = {
 
 /* --sort comm */
 
+/*
+ * We can't use pointer comparison in functions below,
+ * because it gives different results based on pointer
+ * values, which could break some sorting assumptions.
+ */
 static int64_t
 sort__comm_cmp(struct hist_entry *left, struct hist_entry *right)
 {
-        /* Compare the addr that should be unique among comm */
         return strcmp(comm__str(right->comm), comm__str(left->comm));
 }
 
 static int64_t
 sort__comm_collapse(struct hist_entry *left, struct hist_entry *right)
 {
-        /* Compare the addr that should be unique among comm */
         return strcmp(comm__str(right->comm), comm__str(left->comm));
 }
 
@@ -1542,6 +1545,46 @@ struct sort_entry sort_sym_size = {
         .se_width_idx   = HISTC_SYM_SIZE,
 };
 
+/* --sort dso_size */
+
+static int64_t _sort__dso_size_cmp(struct map *map_l, struct map *map_r)
+{
+        int64_t size_l = map_l != NULL ? map__size(map_l) : 0;
+        int64_t size_r = map_r != NULL ? map__size(map_r) : 0;
+
+        return size_l < size_r ? -1 :
+                size_l == size_r ? 0 : 1;
+}
+
+static int64_t
+sort__dso_size_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        return _sort__dso_size_cmp(right->ms.map, left->ms.map);
+}
+
+static int _hist_entry__dso_size_snprintf(struct map *map, char *bf,
+                                          size_t bf_size, unsigned int width)
+{
+        if (map && map->dso)
+                return repsep_snprintf(bf, bf_size, "%*d", width,
+                                       map__size(map));
+
+        return repsep_snprintf(bf, bf_size, "%*s", width, "unknown");
+}
+
+static int hist_entry__dso_size_snprintf(struct hist_entry *he, char *bf,
+                                         size_t size, unsigned int width)
+{
+        return _hist_entry__dso_size_snprintf(he->ms.map, bf, size, width);
+}
+
+struct sort_entry sort_dso_size = {
+        .se_header      = "DSO size",
+        .se_cmp         = sort__dso_size_cmp,
+        .se_snprintf    = hist_entry__dso_size_snprintf,
+        .se_width_idx   = HISTC_DSO_SIZE,
+};
+
 
 struct sort_dimension {
         const char              *name;
@@ -1566,6 +1609,7 @@ static struct sort_dimension common_sort_dimensions[] = {
         DIM(SORT_TRANSACTION, "transaction", sort_transaction),
         DIM(SORT_TRACE, "trace", sort_trace),
         DIM(SORT_SYM_SIZE, "symbol_size", sort_sym_size),
+        DIM(SORT_DSO_SIZE, "dso_size", sort_dso_size),
         DIM(SORT_CGROUP_ID, "cgroup_id", sort_cgroup_id),
 };
 
diff --git a/tools/perf/util/sort.h b/tools/perf/util/sort.h
index f5901c10a563..035b62e2c60b 100644
--- a/tools/perf/util/sort.h
+++ b/tools/perf/util/sort.h
@@ -220,6 +220,7 @@ enum sort_type {
         SORT_TRANSACTION,
         SORT_TRACE,
         SORT_SYM_SIZE,
+        SORT_DSO_SIZE,
         SORT_CGROUP_ID,
 
         /* branch stack specific sort keys */
diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
index 32235657c1ac..a0061e0b0fad 100644
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -92,7 +92,7 @@ static const char *id_str[PERF_STAT_EVSEL_ID__MAX] = {
 };
 #undef ID
 
-void perf_stat_evsel_id_init(struct perf_evsel *evsel)
+static void perf_stat_evsel_id_init(struct perf_evsel *evsel)
 {
         struct perf_stat_evsel *ps = evsel->stats;
         int i;
diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h
index dbc6f7134f61..8f56ba4fd258 100644
--- a/tools/perf/util/stat.h
+++ b/tools/perf/util/stat.h
@@ -90,6 +90,8 @@ struct perf_stat_config {
         bool            scale;
         FILE            *output;
         unsigned int    interval;
+        unsigned int    timeout;
+        int             times;
         struct runtime_stat *stats;
         int             stats_num;
 };
@@ -126,8 +128,6 @@ bool __perf_evsel_stat__is(struct perf_evsel *evsel,
 #define perf_stat_evsel__is(evsel, id) \
         __perf_evsel_stat__is(evsel, PERF_STAT_EVSEL_ID__ ## id)
 
-void perf_stat_evsel_id_init(struct perf_evsel *evsel);
-
 extern struct runtime_stat rt_stat;
 extern struct stats walltime_nsecs_stats;
 
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index cc065d4bfafc..1466814ebada 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1582,7 +1582,7 @@ int dso__load(struct dso *dso, struct map *map)
                 bool next_slot = false;
                 bool is_reg;
                 bool nsexit;
-                int sirc;
+                int sirc = -1;
 
                 enum dso_binary_type symtab_type = binary_type_symtab[i];
 
@@ -1600,16 +1600,14 @@ int dso__load(struct dso *dso, struct map *map)
                         nsinfo__mountns_exit(&nsc);
 
                 is_reg = is_regular_file(name);
-                sirc = symsrc__init(ss, dso, name, symtab_type);
+                if (is_reg)
+                        sirc = symsrc__init(ss, dso, name, symtab_type);
 
                 if (nsexit)
                         nsinfo__mountns_enter(dso->nsinfo, &nsc);
 
-                if (!is_reg || sirc < 0) {
-                        if (sirc >= 0)
-                                symsrc__destroy(ss);
+                if (!is_reg || sirc < 0)
                         continue;
-                }
 
                 if (!syms_ss && symsrc__has_symtab(ss)) {
                         syms_ss = ss;
@@ -1960,8 +1958,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map)
                 pr_debug("Using %s for symbols\n", kallsyms_filename);
         if (err > 0 && !dso__is_kcore(dso)) {
                 dso->binary_type = DSO_BINARY_TYPE__GUEST_KALLSYMS;
-                machine__mmap_name(machine, path, sizeof(path));
-                dso__set_long_name(dso, strdup(path), true);
+                dso__set_long_name(dso, machine->mmap_name, false);
                 map__fixup_start(map);
                 map__fixup_end(map);
         }
@@ -2094,16 +2091,14 @@ static bool symbol__read_kptr_restrict(void)
 
 int symbol__annotation_init(void)
 {
+        if (symbol_conf.init_annotation)
+                return 0;
+
         if (symbol_conf.initialized) {
                 pr_err("Annotation needs to be init before symbol__init()\n");
                 return -1;
         }
 
-        if (symbol_conf.init_annotation) {
-                pr_warning("Annotation being initialized multiple times\n");
-                return 0;
-        }
-
         symbol_conf.priv_size += sizeof(struct annotation);
         symbol_conf.init_annotation = true;
         return 0;
@@ -2224,3 +2219,25 @@ int symbol__config_symfs(const struct option *opt __maybe_unused,
         free(bf);
         return 0;
 }
+
+struct mem_info *mem_info__get(struct mem_info *mi)
+{
+        if (mi)
+                refcount_inc(&mi->refcnt);
+        return mi;
+}
+
+void mem_info__put(struct mem_info *mi)
+{
+        if (mi && refcount_dec_and_test(&mi->refcnt))
+                free(mi);
+}
+
+struct mem_info *mem_info__new(void)
+{
+        struct mem_info *mi = zalloc(sizeof(*mi));
+
+        if (mi)
+                refcount_set(&mi->refcnt, 1);
+        return mi;
+}
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 0563f33c1eb3..70c16741f50a 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -200,9 +200,10 @@ struct branch_info {
 };
 
 struct mem_info {
-        struct addr_map_symbol iaddr;
-        struct addr_map_symbol daddr;
-        union perf_mem_data_src data_src;
+        struct addr_map_symbol  iaddr;
+        struct addr_map_symbol  daddr;
+        union perf_mem_data_src data_src;
+        refcount_t              refcnt;
 };
 
 struct addr_location {
@@ -389,4 +390,16 @@ int sdt_notes__get_count(struct list_head *start);
 #define SDT_NOTE_NAME "stapsdt"
 #define NR_ADDR 3
 
+struct mem_info *mem_info__new(void);
+struct mem_info *mem_info__get(struct mem_info *mi);
+void   mem_info__put(struct mem_info *mi);
+
+static inline void __mem_info__zput(struct mem_info **mi)
+{
+        mem_info__put(*mi);
+        *mi = NULL;
+}
+
+#define mem_info__zput(mi) __mem_info__zput(&mi)
+
 #endif /* __PERF_SYMBOL */
diff --git a/tools/perf/util/syscalltbl.c b/tools/perf/util/syscalltbl.c
index 303bdb84ab5a..0ee7f568d60c 100644
--- a/tools/perf/util/syscalltbl.c
+++ b/tools/perf/util/syscalltbl.c
@@ -17,7 +17,7 @@
 #include <stdlib.h>
 #include <linux/compiler.h>
 
-#ifdef HAVE_SYSCALL_TABLE
+#ifdef HAVE_SYSCALL_TABLE_SUPPORT
 #include <string.h>
 #include "string2.h"
 #include "util.h"
@@ -30,6 +30,14 @@ static const char **syscalltbl_native = syscalltbl_x86_64;
 #include <asm/syscalls_64.c>
 const int syscalltbl_native_max_id = SYSCALLTBL_S390_64_MAX_ID;
 static const char **syscalltbl_native = syscalltbl_s390_64;
+#elif defined(__powerpc64__)
+#include <asm/syscalls_64.c>
+const int syscalltbl_native_max_id = SYSCALLTBL_POWERPC_64_MAX_ID;
+static const char **syscalltbl_native = syscalltbl_powerpc_64;
+#elif defined(__powerpc__)
+#include <asm/syscalls_32.c>
+const int syscalltbl_native_max_id = SYSCALLTBL_POWERPC_32_MAX_ID;
+static const char **syscalltbl_native = syscalltbl_powerpc_32;
 #endif
 
 struct syscall {
@@ -131,7 +139,7 @@ int syscalltbl__strglobmatch_first(struct syscalltbl *tbl, const char *syscall_g
         return syscalltbl__strglobmatch_next(tbl, syscall_glob, idx);
 }
 
-#else /* HAVE_SYSCALL_TABLE */
+#else /* HAVE_SYSCALL_TABLE_SUPPORT */
 
 #include <libaudit.h>
 
@@ -168,4 +176,4 @@ int syscalltbl__strglobmatch_first(struct syscalltbl *tbl, const char *syscall_g
 {
         return syscalltbl__strglobmatch_next(tbl, syscall_glob, idx);
 }
-#endif /* HAVE_SYSCALL_TABLE */
+#endif /* HAVE_SYSCALL_TABLE_SUPPORT */
diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
index 40cfa36c022a..14d44c3235b8 100644
--- a/tools/perf/util/thread.h
+++ b/tools/perf/util/thread.h
@@ -26,7 +26,6 @@ struct thread {
         pid_t                   ppid;
         int                     cpu;
         refcount_t              refcnt;
-        char                    shortname[3];
         bool                    comm_set;
         int                     comm_len;
         bool                    dead; /* if set thread has exited */
diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
index 3e1038f6491c..5d467d8ae9ab 100644
--- a/tools/perf/util/thread_map.c
+++ b/tools/perf/util/thread_map.c
@@ -32,6 +32,7 @@ static void thread_map__reset(struct thread_map *map, int start, int nr)
         size_t size = (nr - start) * sizeof(map->map[0]);
 
         memset(&map->map[start], 0, size);
+        map->err_thread = -1;
 }
 
 static struct thread_map *thread_map__realloc(struct thread_map *map, int nr)
@@ -323,7 +324,7 @@ out_free_threads:
 }
 
 struct thread_map *thread_map__new_str(const char *pid, const char *tid,
-                                       uid_t uid, bool per_thread)
+                                       uid_t uid, bool all_threads)
 {
         if (pid)
                 return thread_map__new_by_pid_str(pid);
@@ -331,7 +332,7 @@ struct thread_map *thread_map__new_str(const char *pid, const char *tid,
         if (!tid && uid != UINT_MAX)
                 return thread_map__new_by_uid(uid);
 
-        if (per_thread)
+        if (all_threads)
                 return thread_map__new_all_cpus();
 
         return thread_map__new_by_tid_str(tid);
diff --git a/tools/perf/util/thread_map.h b/tools/perf/util/thread_map.h
index 0a806b99e73c..2f689c90a8c6 100644
--- a/tools/perf/util/thread_map.h
+++ b/tools/perf/util/thread_map.h
@@ -14,6 +14,7 @@ struct thread_map_data {
 struct thread_map {
         refcount_t refcnt;
         int nr;
+        int err_thread;
         struct thread_map_data map[];
 };
 
@@ -31,7 +32,7 @@ struct thread_map *thread_map__get(struct thread_map *map);
 void thread_map__put(struct thread_map *map);
 
 struct thread_map *thread_map__new_str(const char *pid,
-                const char *tid, uid_t uid, bool per_thread);
+                const char *tid, uid_t uid, bool all_threads);
 
 struct thread_map *thread_map__new_by_tid_str(const char *tid_str);
 
diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
index 0ac9077f62a2..b1e5c3a2b8e3 100644
--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -98,7 +98,7 @@ static void register_python_scripting(struct scripting_ops *scripting_ops)
         }
 }
 
-#ifdef NO_LIBPYTHON
+#ifndef HAVE_LIBPYTHON_SUPPORT
 void setup_python_scripting(void)
 {
         register_python_scripting(&python_scripting_unsupported_ops);
@@ -161,7 +161,7 @@ static void register_perl_scripting(struct scripting_ops *scripting_ops)
         }
 }
 
-#ifdef NO_LIBPERL
+#ifndef HAVE_LIBPERL_SUPPORT
 void setup_perl_scripting(void)
 {
         register_perl_scripting(&perl_scripting_unsupported_ops);
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index 1e9c974faf67..7bdd239c795c 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -50,7 +50,7 @@ static int __report_module(struct addr_location *al, u64 ip,
 
         if (!mod)
                 mod = dwfl_report_elf(ui->dwfl, dso->short_name,
-                                      dso->long_name, -1, al->map->start,
+                                      (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start,
                                       false);
 
         return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;
@@ -236,7 +236,8 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
         if (err)
                 goto out;
 
-        if (!dwfl_attach_state(ui->dwfl, EM_NONE, thread->tid, &callbacks, ui))
+        err = !dwfl_attach_state(ui->dwfl, EM_NONE, thread->tid, &callbacks, ui);
+        if (err)
                 goto out;
 
         err = dwfl_getthread_frames(ui->dwfl, thread->tid, frame_callback, ui);
diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
index 9496365da3d7..c9626c206208 100644
--- a/tools/perf/util/util.h
+++ b/tools/perf/util/util.h
@@ -11,8 +11,7 @@
 #include <stdlib.h>
 #include <stdarg.h>
 #include <linux/compiler.h>
-#include <linux/types.h>
-#include "namespaces.h"
+#include <sys/types.h>
 
 /* General helper functions */
 void usage(const char *err) __noreturn;
@@ -26,6 +25,7 @@ static inline void *zalloc(size_t size)
 #define zfree(ptr) ({ free(*ptr); *ptr = NULL; })
 
 struct dirent;
+struct nsinfo;
 struct strlist;
 
 int mkdir_p(char *path, mode_t mode);
diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
index 2cccbba64418..f304be71c278 100644
--- a/tools/power/acpi/Makefile.config
+++ b/tools/power/acpi/Makefile.config
@@ -56,6 +56,7 @@ INSTALL_SCRIPT = ${INSTALL_PROGRAM}
 # to compile vs uClibc, that can be done here as well.
 CROSS = #/usr/i386-linux-uclibc/usr/bin/i386-uclibc-
 CROSS_COMPILE ?= $(CROSS)
+LD = $(CC)
 HOSTCC = gcc
 
 # check if compiler option is supported
diff --git a/tools/power/acpi/common/cmfsize.c b/tools/power/acpi/common/cmfsize.c
index dfa6fee1b915..ff8025de8237 100644
--- a/tools/power/acpi/common/cmfsize.c
+++ b/tools/power/acpi/common/cmfsize.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: cfsize - Common get file size function
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
  *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *****************************************************************************/
 
 #include <acpi/acpi.h>
 #include "accommon.h"
diff --git a/tools/power/acpi/common/getopt.c b/tools/power/acpi/common/getopt.c
index f7032c9ab35e..7be89b873661 100644
--- a/tools/power/acpi/common/getopt.c
+++ b/tools/power/acpi/common/getopt.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: getopt
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
  *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *****************************************************************************/
 
 /*
  * ACPICA getopt() implementation
diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
index e7347edfd4f9..a20c703f8b7d 100644
--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: oslinuxtbl - Linux OSL for obtaining ACPI tables
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *
+ *****************************************************************************/
 
 #include "acpidump.h"
 
diff --git a/tools/power/acpi/os_specific/service_layers/osunixdir.c b/tools/power/acpi/os_specific/service_layers/osunixdir.c
index 9b5e61b636d9..4fd44e218a83 100644
--- a/tools/power/acpi/os_specific/service_layers/osunixdir.c
+++ b/tools/power/acpi/os_specific/service_layers/osunixdir.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: osunixdir - Unix directory access interfaces
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *
+ *****************************************************************************/
 
 #include <acpi/acpi.h>
 
diff --git a/tools/power/acpi/os_specific/service_layers/osunixmap.c b/tools/power/acpi/os_specific/service_layers/osunixmap.c
index 8b26924e2602..93d8359309b6 100644
--- a/tools/power/acpi/os_specific/service_layers/osunixmap.c
+++ b/tools/power/acpi/os_specific/service_layers/osunixmap.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: osunixmap - Unix OSL for file mappings
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *
+ *****************************************************************************/
 
 #include "acpidump.h"
 #include <unistd.h>
diff --git a/tools/power/acpi/os_specific/service_layers/osunixxf.c b/tools/power/acpi/os_specific/service_layers/osunixxf.c
index 34c044da433c..8a88e87778bd 100644
--- a/tools/power/acpi/os_specific/service_layers/osunixxf.c
+++ b/tools/power/acpi/os_specific/service_layers/osunixxf.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: osunixxf - UNIX OSL interfaces
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *
+ *****************************************************************************/
 
 /*
  * These interfaces are required in order to compile the ASL compiler and the
diff --git a/tools/power/acpi/tools/acpidump/acpidump.h b/tools/power/acpi/tools/acpidump/acpidump.h
index 3c679607d1c3..f69f1f559743 100644
--- a/tools/power/acpi/tools/acpidump/acpidump.h
+++ b/tools/power/acpi/tools/acpidump/acpidump.h
@@ -1,45 +1,11 @@
+/* SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 */
 /******************************************************************************
  *
  * Module Name: acpidump.h - Include file for acpi_dump utility
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
  *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *****************************************************************************/
 
 /*
  * Global variables. Defined in main.c only, externed in all other files
diff --git a/tools/power/acpi/tools/acpidump/apdump.c b/tools/power/acpi/tools/acpidump/apdump.c
index 9ad1712e4cf9..a9848de32d8e 100644
--- a/tools/power/acpi/tools/acpidump/apdump.c
+++ b/tools/power/acpi/tools/acpidump/apdump.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: apdump - Dump routines for ACPI tables (acpidump)
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *
+ *****************************************************************************/
 
 #include "acpidump.h"
 
diff --git a/tools/power/acpi/tools/acpidump/apfiles.c b/tools/power/acpi/tools/acpidump/apfiles.c
index 856e1b83407b..e86207e5afcf 100644
--- a/tools/power/acpi/tools/acpidump/apfiles.c
+++ b/tools/power/acpi/tools/acpidump/apfiles.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: apfiles - File-related functions for acpidump utility
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
  *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *****************************************************************************/
 
 #include "acpidump.h"
 
diff --git a/tools/power/acpi/tools/acpidump/apmain.c b/tools/power/acpi/tools/acpidump/apmain.c
index f4ef826800cf..db213171f8d9 100644
--- a/tools/power/acpi/tools/acpidump/apmain.c
+++ b/tools/power/acpi/tools/acpidump/apmain.c
@@ -1,45 +1,11 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
 /******************************************************************************
  *
  * Module Name: apmain - Main module for the acpidump utility
  *
- *****************************************************************************/
-
-/*
  * Copyright (C) 2000 - 2018, Intel Corp.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon
- *    including a substantially similar Disclaimer requirement for further
- *    binary redistribution.
- * 3. Neither the names of the above-listed copyright holders nor the names
- *    of any contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
  *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * NO WARRANTY
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGES.
- */
+ *****************************************************************************/
 
 #define _DECLARE_GLOBALS
 #include "acpidump.h"
diff --git a/tools/power/pm-graph/Makefile b/tools/power/pm-graph/Makefile
index 4e1e999e7b05..c1899cd72c80 100644
--- a/tools/power/pm-graph/Makefile
+++ b/tools/power/pm-graph/Makefile
@@ -7,11 +7,24 @@ all:
 
 install : uninstall
         install -d  $(DESTDIR)$(PREFIX)/lib/pm-graph
-        install analyze_suspend.py $(DESTDIR)$(PREFIX)/lib/pm-graph
-        install analyze_boot.py $(DESTDIR)$(PREFIX)/lib/pm-graph
+        install sleepgraph.py $(DESTDIR)$(PREFIX)/lib/pm-graph
+        install bootgraph.py $(DESTDIR)$(PREFIX)/lib/pm-graph
+        install -d  $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/cgskip.txt $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/freeze-callgraph.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/freeze.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/freeze-dev.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/standby-callgraph.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/standby.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/standby-dev.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/suspend-callgraph.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/suspend.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/suspend-dev.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
+        install -m 644 config/suspend-x2-proc.cfg $(DESTDIR)$(PREFIX)/lib/pm-graph/config
 
-        ln -s $(DESTDIR)$(PREFIX)/lib/pm-graph/analyze_boot.py $(DESTDIR)$(PREFIX)/bin/bootgraph
-        ln -s $(DESTDIR)$(PREFIX)/lib/pm-graph/analyze_suspend.py $(DESTDIR)$(PREFIX)/bin/sleepgraph
+        install -d  $(DESTDIR)$(PREFIX)/bin
+        ln -s $(DESTDIR)$(PREFIX)/lib/pm-graph/bootgraph.py $(DESTDIR)$(PREFIX)/bin/bootgraph
+        ln -s $(DESTDIR)$(PREFIX)/lib/pm-graph/sleepgraph.py $(DESTDIR)$(PREFIX)/bin/sleepgraph
 
         install -d  $(DESTDIR)$(PREFIX)/share/man/man8
         install bootgraph.8 $(DESTDIR)$(PREFIX)/share/man/man8
@@ -24,9 +37,11 @@ uninstall :
         rm -f $(DESTDIR)$(PREFIX)/bin/bootgraph
         rm -f $(DESTDIR)$(PREFIX)/bin/sleepgraph
 
-        rm -f $(DESTDIR)$(PREFIX)/lib/pm-graph/analyze_boot.py
-        rm -f $(DESTDIR)$(PREFIX)/lib/pm-graph/analyze_suspend.py
-        rm -f $(DESTDIR)$(PREFIX)/lib/pm-graph/*.pyc
+        rm -f $(DESTDIR)$(PREFIX)/lib/pm-graph/config/*
+        if [ -d $(DESTDIR)$(PREFIX)/lib/pm-graph/config ] ; then \
+                rmdir $(DESTDIR)$(PREFIX)/lib/pm-graph/config; \
+        fi;
+        rm -f $(DESTDIR)$(PREFIX)/lib/pm-graph/*
         if [ -d $(DESTDIR)$(PREFIX)/lib/pm-graph ] ; then \
                 rmdir $(DESTDIR)$(PREFIX)/lib/pm-graph; \
         fi;
diff --git a/tools/power/pm-graph/bootgraph.8 b/tools/power/pm-graph/bootgraph.8
index dbdafcf546df..64d513f80a2a 100644
--- a/tools/power/pm-graph/bootgraph.8
+++ b/tools/power/pm-graph/bootgraph.8
@@ -37,6 +37,9 @@ Print the current tool version
 Add the dmesg log to the html output. It will be viewable by
 clicking a button in the timeline.
 .TP
+\fB-result \fIfile\fR
+Export a results table to a text file for parsing.
+.TP
 \fB-o \fIname\fR
 Overrides the output subdirectory name when running a new test.
 Use {date}, {time}, {hostname} for current values.
@@ -44,14 +47,14 @@ Use {date}, {time}, {hostname} for current values.
 e.g. boot-{hostname}-{date}-{time}
 .SS "advanced"
 .TP
-\fB-f\fR
-Use ftrace to add function detail (default: disabled)
-.TP
-\fB-callgraph\fR
+\fB-f or -callgraph\fR
 Use ftrace to create initcall callgraphs (default: disabled). If -func
 is not used there will be one callgraph per initcall. This can produce
 very large outputs, i.e. 10MB - 100MB.
 .TP
+\fB-fstat\fR
+Use ftrace to add function detail (default: disabled)
+.TP
 \fB-maxdepth \fIlevel\fR
 limit the callgraph trace depth to \fIlevel\fR (default: 2). This is
 the best way to limit the output size when using -callgraph.
@@ -67,6 +70,13 @@ Reduce callgraph output in the timeline by limiting it to a list of calls. The
 argument can be a single function name or a comma delimited list.
 (default: none)
 .TP
+\fB-cgskip \fIfile\fR
+Reduce callgraph output in the timeline by skipping over uninteresting
+functions in the trace, e.g. printk or console_unlock. The functions listed
+in this file will show up as empty leaves in the callgraph with only the start/end
+times displayed.
+(default: none)
+.TP
 \fB-timeprec \fIn\fR
 Number of significant digits in timestamps (0:S, 3:ms, [6:us])
 .TP
diff --git a/tools/power/pm-graph/analyze_boot.py b/tools/power/pm-graph/bootgraph.py
index e83df141a597..abb4c38f029b 100755
--- a/tools/power/pm-graph/analyze_boot.py
+++ b/tools/power/pm-graph/bootgraph.py
@@ -32,7 +32,7 @@ import platform
 import shutil
 from datetime import datetime, timedelta
 from subprocess import call, Popen, PIPE
-import analyze_suspend as aslib
+import sleepgraph as aslib
 
 # ----------------- CLASSES --------------------
 
@@ -42,23 +42,18 @@ import analyze_suspend as aslib
 #        store system values and test parameters
 class SystemValues(aslib.SystemValues):
         title = 'BootGraph'
-        version = '2.1'
+        version = '2.2'
         hostname = 'localhost'
         testtime = ''
         kernel = ''
         dmesgfile = ''
         ftracefile = ''
         htmlfile = 'bootgraph.html'
-        outfile = ''
         testdir = ''
-        testdirprefix = 'boot'
-        embedded = False
-        testlog = False
-        dmesglog = False
-        ftracelog = False
+        kparams = ''
+        result = ''
         useftrace = False
         usecallgraph = False
-        usedevsrc = True
         suspendmode = 'boot'
         max_graph_depth = 2
         graph_filter = 'do_one_initcall'
@@ -69,11 +64,6 @@ class SystemValues(aslib.SystemValues):
         bootloader = 'grub'
         blexec = []
         def __init__(self):
-                if('LOG_FILE' in os.environ and 'TEST_RESULTS_IDENTIFIER' in os.environ):
-                        self.embedded = True
-                        self.dmesglog = True
-                        self.outfile = os.environ['LOG_FILE']
-                        self.htmlfile = os.environ['LOG_FILE']
                 self.hostname = platform.node()
                 self.testtime = datetime.now().strftime('%Y-%m-%d_%H:%M:%S')
                 if os.path.exists('/proc/version'):
@@ -148,11 +138,18 @@ class SystemValues(aslib.SystemValues):
                 cmdline = '%s -cronjob' % os.path.abspath(sys.argv[0])
                 args = iter(sys.argv[1:])
                 for arg in args:
-                        if arg in ['-h', '-v', '-cronjob', '-reboot']:
+                        if arg in ['-h', '-v', '-cronjob', '-reboot', '-verbose']:
                                 continue
                         elif arg in ['-o', '-dmesg', '-ftrace', '-func']:
                                 args.next()
                                 continue
+                        elif arg == '-result':
+                                cmdline += ' %s "%s"' % (arg, os.path.abspath(args.next()))
+                                continue
+                        elif arg == '-cgskip':
+                                file = self.configFile(args.next())
+                                cmdline += ' %s "%s"' % (arg, os.path.abspath(file))
+                                continue
                         cmdline += ' '+arg
                 if self.graph_filter != 'do_one_initcall':
                         cmdline += ' -func "%s"' % self.graph_filter
@@ -166,14 +163,6 @@ class SystemValues(aslib.SystemValues):
                 print '3. After reboot, re-run this tool with the same arguments but no command (w/o -reboot or -manual).\n'
                 print 'CMDLINE="%s"' % cmdline
                 sys.exit()
-        def getExec(self, cmd):
-                dirlist = ['/sbin', '/bin', '/usr/sbin', '/usr/bin',
-                        '/usr/local/sbin', '/usr/local/bin']
-                for path in dirlist:
-                        cmdfull = os.path.join(path, cmd)
-                        if os.path.exists(cmdfull):
-                                return cmdfull
-                return ''
         def blGrub(self):
                 blcmd = ''
                 for cmd in ['update-grub', 'grub-mkconfig', 'grub2-mkconfig']:
@@ -199,6 +188,14 @@ class SystemValues(aslib.SystemValues):
                         self.blGrub()
                 else:
                         doError('unknown boot loader: %s' % self.bootloader)
+        def writeDatafileHeader(self, filename):
+                self.kparams = open('/proc/cmdline', 'r').read().strip()
+                fp = open(filename, 'w')
+                fp.write(self.teststamp+'\n')
+                fp.write(self.sysstamp+'\n')
+                fp.write('# command | %s\n' % self.cmdline)
+                fp.write('# kparams | %s\n' % self.kparams)
+                fp.close()
 
 sysvals = SystemValues()
 
@@ -249,7 +246,7 @@ class Data(aslib.Data):
                 return name
         def deviceMatch(self, pid, cg):
                 if cg.end - cg.start == 0:
-                        return True
+                        return ''
                 for p in data.phases:
                         list = self.dmesg[p]['list']
                         for devname in list:
@@ -260,14 +257,25 @@ class Data(aslib.Data):
                                         if(cg.start <= dev['start'] and cg.end >= dev['end'] and dev['length'] > 0):
                                                 dev['ftrace'] = cg
                                                 self.do_one_initcall = True
-                                                return True
+                                                return devname
                                 else:
                                         if(cg.start > dev['start'] and cg.end < dev['end']):
                                                 if 'ftraces' not in dev:
                                                         dev['ftraces'] = []
                                                 dev['ftraces'].append(cg)
-                                                return True
-                return False
+                                                return devname
+                return ''
+        def printDetails(self):
+                sysvals.vprint('Timeline Details:')
+                sysvals.vprint('          Host: %s' % sysvals.hostname)
+                sysvals.vprint('        Kernel: %s' % sysvals.kernel)
+                sysvals.vprint('     Test time: %s' % sysvals.testtime)
+                sysvals.vprint('     Boot time: %s' % self.boottime)
+                for phase in self.phases:
+                        dc = len(self.dmesg[phase]['list'])
+                        sysvals.vprint('%9s mode: %.3f - %.3f (%d initcalls)' % (phase,
+                                self.dmesg[phase]['start']*1000,
+                                self.dmesg[phase]['end']*1000, dc))
 
 # ----------------- FUNCTIONS --------------------
 
@@ -275,6 +283,8 @@ class Data(aslib.Data):
 # Description:
 #        parse a kernel log for boot data
 def parseKernelLog():
+        sysvals.vprint('Analyzing the dmesg data (%s)...' % \
+                os.path.basename(sysvals.dmesgfile))
         phase = 'kernel'
         data = Data(0)
         data.dmesg['kernel']['start'] = data.start = ktime = 0.0
@@ -298,6 +308,12 @@ def parseKernelLog():
                 elif re.match(tp.sysinfofmt, line):
                         tp.sysinfo = line
                         continue
+                elif re.match(tp.cmdlinefmt, line):
+                        tp.cmdline = line
+                        continue
+                elif re.match(tp.kparamsfmt, line):
+                        tp.kparams = line
+                        continue
                 idx = line.find('[')
                 if idx > 1:
                         line = line[idx:]
@@ -353,6 +369,17 @@ def parseKernelLog():
 # Description:
 #        Check if trace is available and copy to a temp file
 def parseTraceLog(data):
+        sysvals.vprint('Analyzing the ftrace data (%s)...' % \
+                os.path.basename(sysvals.ftracefile))
+        # if available, calculate cgfilter allowable ranges
+        cgfilter = []
+        if len(sysvals.cgfilter) > 0:
+                for p in data.phases:
+                        list = data.dmesg[p]['list']
+                        for i in sysvals.cgfilter:
+                                if i in list:
+                                        cgfilter.append([list[i]['start']-0.0001,
+                                                list[i]['end']+0.0001])
         # parse the trace log
         ftemp = dict()
         tp = aslib.TestProps()
@@ -366,7 +393,16 @@ def parseTraceLog(data):
                         continue
                 m_time, m_proc, m_pid, m_msg, m_dur = \
                         m.group('time', 'proc', 'pid', 'msg', 'dur')
-                if float(m_time) > data.end:
+                t = float(m_time)
+                if len(cgfilter) > 0:
+                        allow = False
+                        for r in cgfilter:
+                                if t >= r[0] and t < r[1]:
+                                        allow = True
+                                        break
+                        if not allow:
+                                continue
+                if t > data.end:
                         break
                 if(m_time and m_pid and m_msg):
                         t = aslib.FTraceLine(m_time, m_msg, m_dur)
@@ -378,24 +414,36 @@ def parseTraceLog(data):
                 key = (m_proc, pid)
                 if(key not in ftemp):
                         ftemp[key] = []
-                        ftemp[key].append(aslib.FTraceCallGraph(pid))
+                        ftemp[key].append(aslib.FTraceCallGraph(pid, sysvals))
                 cg = ftemp[key][-1]
-                if(cg.addLine(t)):
-                        ftemp[key].append(aslib.FTraceCallGraph(pid))
+                res = cg.addLine(t)
+                if(res != 0):
+                        ftemp[key].append(aslib.FTraceCallGraph(pid, sysvals))
+                if(res == -1):
+                        ftemp[key][-1].addLine(t)
+
         tf.close()
 
         # add the callgraph data to the device hierarchy
         for key in ftemp:
                 proc, pid = key
                 for cg in ftemp[key]:
-                        if len(cg.list) < 1 or cg.invalid:
+                        if len(cg.list) < 1 or cg.invalid or (cg.end - cg.start == 0):
                                 continue
                         if(not cg.postProcess()):
                                 print('Sanity check failed for %s-%d' % (proc, pid))
                                 continue
                         # match cg data to devices
-                        if not data.deviceMatch(pid, cg):
-                                print ' BAD: %s %s-%d [%f - %f]' % (cg.name, proc, pid, cg.start, cg.end)
+                        devname = data.deviceMatch(pid, cg)
+                        if not devname:
+                                kind = 'Orphan'
+                                if cg.partial:
+                                        kind = 'Partial'
+                                sysvals.vprint('%s callgraph found for %s %s-%d [%f - %f]' %\
+                                        (kind, cg.name, proc, pid, cg.start, cg.end))
+                        elif len(cg.list) > 1000000:
+                                print 'WARNING: the callgraph found for %s is massive! (%d lines)' %\
+                                        (devname, len(cg.list))
 
 # Function: retrieveLogs
 # Description:
@@ -473,7 +521,7 @@ def createBootGraph(data):
         devtl = aslib.Timeline(100, 20)
 
         # write the test title and general info header
-        devtl.createHeader(sysvals)
+        devtl.createHeader(sysvals, sysvals.stamp)
 
         # Generate the header for this timeline
         t0 = data.start
@@ -574,12 +622,9 @@ def createBootGraph(data):
                         data.dmesg[phase]['color'], phase+'_mode', phase[0])
         devtl.html += '</div>\n'
 
-        if(sysvals.outfile == sysvals.htmlfile):
-                hf = open(sysvals.htmlfile, 'a')
-        else:
-                hf = open(sysvals.htmlfile, 'w')
+        hf = open(sysvals.htmlfile, 'w')
 
-        # add the css if this is not an embedded run
+        # add the css
         extra = '\
                 .c1 {background:rgba(209,0,0,0.4);}\n\
                 .c2 {background:rgba(255,102,34,0.4);}\n\
@@ -597,8 +642,7 @@ def createBootGraph(data):
                 .fstat td {text-align:left;width:35px;}\n\
                 .srccall {position:absolute;font-size:10px;z-index:7;overflow:hidden;color:black;text-align:center;white-space:nowrap;border-radius:5px;border:1px solid black;background:linear-gradient(to bottom right,#CCC,#969696);}\n\
                 .srccall:hover {color:white;font-weight:bold;border:1px solid white;}\n'
-        if(not sysvals.embedded):
-                aslib.addCSS(hf, sysvals, 1, False, extra)
+        aslib.addCSS(hf, sysvals, 1, False, extra)
 
         # write the device timeline
         hf.write(devtl.html)
@@ -631,6 +675,9 @@ def createBootGraph(data):
         if(sysvals.usecallgraph):
                 aslib.addCallgraphs(sysvals, hf, data)
 
+        # add the test log as a hidden div
+        if sysvals.testlog and sysvals.logmsg:
+                hf.write('<div id="testlog" style="display:none;">\n'+sysvals.logmsg+'</div>\n')
         # add the dmesg log as a hidden div
         if sysvals.dmesglog:
                 hf.write('<div id="dmesglog" style="display:none;">\n')
@@ -639,14 +686,9 @@ def createBootGraph(data):
                         hf.write(line)
                 hf.write('</div>\n')
 
-        if(not sysvals.embedded):
-                # write the footer and close
-                aslib.addScriptCode(hf, [data])
-                hf.write('</body>\n</html>\n')
-        else:
-                # embedded out will be loaded in a page, skip the js
-                hf.write('<div id=bounds style=display:none>%f,%f</div>' % \
-                        (data.start*1000, data.end*1000))
+        # write the footer and close
+        aslib.addScriptCode(hf, [data])
+        hf.write('</body>\n</html>\n')
         hf.close()
         return True
 
@@ -780,6 +822,7 @@ def doError(msg, help=False):
         if help == True:
                 printHelp()
         print 'ERROR: %s\n' % msg
+        sysvals.outputResult({'error':msg})
         sys.exit()
 
 # Function: printHelp
@@ -806,18 +849,21 @@ def printHelp():
         print('Options:')
         print('  -h            Print this help text')
         print('  -v            Print the current tool version')
+        print('  -verbose      Print extra information during execution and analysis')
         print('  -addlogs      Add the dmesg log to the html output')
+        print('  -result fn    Export a results table to a text file for parsing.')
         print('  -o name       Overrides the output subdirectory name when running a new test')
         print('                default: boot-{date}-{time}')
         print(' [advanced]')
-        print('  -f            Use ftrace to add function detail (default: disabled)')
-        print('  -callgraph    Add callgraph detail, can be very large (default: disabled)')
+        print('  -fstat        Use ftrace to add function detail and statistics (default: disabled)')
+        print('  -f/-callgraph Add callgraph detail, can be very large (default: disabled)')
         print('  -maxdepth N   limit the callgraph data to N call levels (default: 2)')
         print('  -mincg ms     Discard all callgraphs shorter than ms milliseconds (e.g. 0.001 for us)')
         print('  -timeprec N   Number of significant digits in timestamps (0:S, 3:ms, [6:us])')
         print('  -expandcg     pre-expand the callgraph data in the html output (default: disabled)')
         print('  -func list    Limit ftrace to comma-delimited list of functions (default: do_one_initcall)')
         print('  -cgfilter S   Filter the callgraph output in the timeline')
+        print('  -cgskip file  Callgraph functions to skip, off to disable (default: cgskip.txt)')
         print('  -bl name      Use the following boot loader for kernel params (default: grub)')
         print('  -reboot       Reboot the machine automatically and generate a new timeline')
         print('  -manual       Show the steps to generate a new timeline manually (used with -reboot)')
@@ -837,8 +883,13 @@ if __name__ == '__main__':
         # loop through the command line arguments
         cmd = ''
         testrun = True
+        switchoff = ['disable', 'off', 'false', '0']
         simplecmds = ['-sysinfo', '-kpupdate', '-flistall', '-checkbl']
+        cgskip = ''
+        if '-f' in sys.argv:
+                cgskip = sysvals.configFile('cgskip.txt')
         args = iter(sys.argv[1:])
+        mdset = False
         for arg in args:
                 if(arg == '-h'):
                         printHelp()
@@ -846,13 +897,17 @@ if __name__ == '__main__':
                 elif(arg == '-v'):
                         print("Version %s" % sysvals.version)
                         sys.exit()
+                elif(arg == '-verbose'):
+                        sysvals.verbose = True
                 elif(arg in simplecmds):
                         cmd = arg[1:]
-                elif(arg == '-f'):
+                elif(arg == '-fstat'):
                         sysvals.useftrace = True
-                elif(arg == '-callgraph'):
+                elif(arg == '-callgraph' or arg == '-f'):
                         sysvals.useftrace = True
                         sysvals.usecallgraph = True
+                elif(arg == '-cgdump'):
+                        sysvals.cgdump = True
                 elif(arg == '-mincg'):
                         sysvals.mincglen = aslib.getArgFloat('-mincg', args, 0.0, 10000.0)
                 elif(arg == '-cgfilter'):
@@ -860,7 +915,18 @@ if __name__ == '__main__':
                                 val = args.next()
                         except:
                                 doError('No callgraph functions supplied', True)
-                        sysvals.setDeviceFilter(val)
+                        sysvals.setCallgraphFilter(val)
+                elif(arg == '-cgskip'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('No file supplied', True)
+                        if val.lower() in switchoff:
+                                cgskip = ''
+                        else:
+                                cgskip = sysvals.configFile(val)
+                                if(not cgskip):
+                                        doError('%s does not exist' % cgskip)
                 elif(arg == '-bl'):
                         try:
                                 val = args.next()
@@ -872,6 +938,7 @@ if __name__ == '__main__':
                 elif(arg == '-timeprec'):
                         sysvals.setPrecision(aslib.getArgInt('-timeprec', args, 0, 6))
                 elif(arg == '-maxdepth'):
+                        mdset = True
                         sysvals.max_graph_depth = aslib.getArgInt('-maxdepth', args, 0, 1000)
                 elif(arg == '-func'):
                         try:
@@ -902,8 +969,6 @@ if __name__ == '__main__':
                                 doError('No dmesg file supplied', True)
                         if(os.path.exists(val) == False):
                                 doError('%s does not exist' % val)
-                        if(sysvals.htmlfile == val or sysvals.outfile == val):
-                                doError('Output filename collision')
                         testrun = False
                         sysvals.dmesgfile = val
                 elif(arg == '-o'):
@@ -912,6 +977,12 @@ if __name__ == '__main__':
                         except:
                                 doError('No subdirectory name supplied', True)
                         sysvals.testdir = sysvals.setOutputFolder(val)
+                elif(arg == '-result'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('No result file supplied', True)
+                        sysvals.result = val
                 elif(arg == '-reboot'):
                         sysvals.reboot = True
                 elif(arg == '-manual'):
@@ -947,7 +1018,7 @@ if __name__ == '__main__':
                         sysvals.getBootLoader()
                         print 'Boot Loader: %s\n%s' % (sysvals.bootloader, sysvals.blexec)
                 elif(cmd == 'sysinfo'):
-                        sysvals.printSystemInfo()
+                        sysvals.printSystemInfo(True)
                 sys.exit()
 
         # reboot: update grub, setup a cronjob, and reboot
@@ -963,6 +1034,10 @@ if __name__ == '__main__':
                         sysvals.manualRebootRequired()
                 sys.exit()
 
+        if sysvals.usecallgraph and cgskip:
+                sysvals.vprint('Using cgskip file: %s' % cgskip)
+                sysvals.setCallgraphBlacklist(cgskip)
+
         # cronjob: remove the cronjob, grub changes, and disable ftrace
         if sysvals.iscronjob:
                 updateCron(True)
@@ -980,29 +1055,23 @@ if __name__ == '__main__':
 
         # process the log data
         if sysvals.dmesgfile:
+                if not mdset:
+                        sysvals.max_graph_depth = 0
                 data = parseKernelLog()
                 if(not data.valid):
                         doError('No initcall data found in %s' % sysvals.dmesgfile)
                 if sysvals.useftrace and sysvals.ftracefile:
                         parseTraceLog(data)
+                if sysvals.cgdump:
+                        data.debugPrint()
+                        sys.exit()
         else:
                 doError('dmesg file required')
 
-        print('          Host: %s' % sysvals.hostname)
-        print('     Test time: %s' % sysvals.testtime)
-        print('     Boot time: %s' % data.boottime)
-        print('Kernel Version: %s' % sysvals.kernel)
-        print('  Kernel start: %.3f' % (data.start * 1000))
-        print('Usermode start: %.3f' % (data.tUserMode * 1000))
-        print('Last Init Call: %.3f' % (data.end * 1000))
-
-        # handle embedded output logs
-        if(sysvals.outfile and sysvals.embedded):
-                fp = open(sysvals.outfile, 'w')
-                fp.write('pass %s initstart %.3f end %.3f boot %s\n' %
-                        (data.valid, data.tUserMode*1000, data.end*1000, data.boottime))
-                fp.close()
-
+        sysvals.vprint('Creating the html timeline (%s)...' % sysvals.htmlfile)
+        sysvals.vprint('Command:\n    %s' % sysvals.cmdline)
+        sysvals.vprint('Kernel parameters:\n    %s' % sysvals.kparams)
+        data.printDetails()
         createBootGraph(data)
 
         # if running as root, change output dir owner to sudo_user
@@ -1010,3 +1079,7 @@ if __name__ == '__main__':
                 os.getuid() == 0 and 'SUDO_USER' in os.environ:
                 cmd = 'chown -R {0}:{0} {1} > /dev/null 2>&1'
                 call(cmd.format(os.environ['SUDO_USER'], sysvals.testdir), shell=True)
+
+        sysvals.stamp['boot'] = (data.tUserMode - data.start) * 1000
+        sysvals.stamp['lastinit'] = data.end * 1000
+        sysvals.outputResult(sysvals.stamp)
diff --git a/tools/power/pm-graph/config/cgskip.txt b/tools/power/pm-graph/config/cgskip.txt
new file mode 100644
index 000000000000..e48d588fbfb4
--- /dev/null
+++ b/tools/power/pm-graph/config/cgskip.txt
@@ -0,0 +1,65 @@
+# -----------------------------------------------
+# CallGraph function skip list
+#
+# This file contains a list of functions which are
+# meant to be skipped in the callgraph trace. It reduces
+# the callgraph html file size by treating these functions
+# as leaves with no child calls. It can be editted by
+# adding or removing function symbol names.
+#
+# The sleepgraph tool automatically pulls this file in when
+# it is found in the config folder. It can be ignored if
+# the tool is called with "-cgskip off".
+# -----------------------------------------------
+
+# low level scheduling and timing
+up
+down_timeout
+mutex_lock
+down_read
+complete_all
+schedule_timeout
+wake_up_process
+msleep
+__udelay
+ktime_get
+
+# console calls
+printk
+dev_printk
+console_unlock
+
+# memory handling
+__kmalloc
+__kmalloc_track_caller
+kmem_cache_alloc
+kmem_cache_alloc_trace
+kmem_cache_free
+kstrdup
+kstrdup_const
+kmalloc_slab
+new_slab
+__slab_alloc
+__slab_free
+raw_pci_read
+pci_read
+alloc_pages_current
+
+# debugfs and sysfs setup
+debugfs_remove_recursive
+debugfs_create_dir
+debugfs_create_files
+debugfs_create_dir
+debugfs_get_inode
+sysfs_add_file_mode_ns
+sysfs_add_file
+sysfs_create_dir_ns
+sysfs_create_link
+sysfs_create_group
+sysfs_create_groups
+sysfs_create_bin_file
+dpm_sysfs_add
+sysfs_create_file_ns
+sysfs_merge_group
+sysfs_add_link_to_group
+sysfs_create_link_sd
diff --git a/tools/power/pm-graph/config/custom-timeline-functions.cfg b/tools/power/pm-graph/config/custom-timeline-functions.cfg
new file mode 100644
index 000000000000..4f80ad7d7275
--- /dev/null
+++ b/tools/power/pm-graph/config/custom-timeline-functions.cfg
@@ -0,0 +1,205 @@
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config thisfile.txt
+#
+
+[Settings]
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: mem
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: true
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: suspend-{hostname}-{date}-{time}-custom
+
+# Override default timeline entries
+# Do not use the internal default functions for timeline entries (default: false)
+# Set this to true if you intend to only use the ones defined in this config
+override-timeline-functions: true
+
+# Override default dev timeline entries
+# Do not use the internal default functions for dev timeline entries (default: false)
+# Set this to true if you intend to only use the ones defined in this config
+override-dev-timeline-functions: true
+
+[timeline_functions_x86_64]
+#
+# Function calls to display in the timeline alongside device callbacks.
+# The tool has an internal set of these functions which should cover the
+# whole of kernel execution, but you can append or override here.
+#
+# This is a list of kprobes which use both symbol data and function arg data.
+# The function calls are displayed on the timeline alongside the device blocks.
+# The args are pulled directly from the stack using this architecture's registers
+# and stack formatting. Three pieces of info are required. The function name,
+# a format string, and an argument list
+#
+# Entry format:
+#
+#   function: format{fn_arg1}_{fn_arg2} fn_arg1 fn_arg2 ... [color=purple]
+#
+# Required Arguments:
+#
+#   function: The symbol name for the function you want probed, this is the
+#             minimum required for an entry, it will show up as the function
+#             name with no arguments.
+#
+#       example: _cpu_up:
+#
+# Optional Arguments:
+#
+#   format: The format to display the data on the timeline in. Use braces to
+#           enclose the arg names.
+#
+#       example: CPU_ON[{cpu}]
+#
+#   color: The color of the entry block in the timeline. The default color is
+#          transparent, so the entry shares the phase color. The color is an
+#          html color string, either a word, or an RGB.
+#
+#       example: [color=#CC00CC]
+#
+#   arglist: A list of arguments from registers/stack addresses. See URL:
+#            https://www.kernel.org/doc/Documentation/trace/kprobetrace.txt
+#
+#       example: cpu=%di:s32
+#
+# Example: Display cpu resume in the timeline
+#
+#       _cpu_up: CPU_ON[{cpu}] cpu=%di:s32 [color=orange]
+#
+_cpu_down: CPU_OFF[{cpu}] cpu=%di:s32
+_cpu_up: CPU_ON[{cpu}] cpu=%di:s32
+sys_sync:
+pm_prepare_console:
+pm_notifier_call_chain:
+freeze_processes:
+freeze_kernel_threads:
+pm_restrict_gfp_mask:
+acpi_suspend_begin:
+suspend_console:
+acpi_pm_prepare:
+syscore_suspend:
+arch_enable_nonboot_cpus_end:
+syscore_resume:
+acpi_pm_finish:
+resume_console:
+acpi_pm_end:
+pm_restore_gfp_mask:
+thaw_processes:
+pm_restore_console:
+
+[dev_timeline_functions_x86_64]
+#
+# Dev mode function calls to display inside timeline entries
+#
+# This is a list of kprobes which use both symbol data and function arg data.
+# The function calls are displayed on the timeline alongside the device blocks.
+# The args are pulled directly from the stack using this architecture's registers
+# and stack formatting. Three pieces of info are required. The function name,
+# a format string, and an argument list
+#
+# Entry format:
+#
+#   function: format{fn_arg1}_{fn_arg2} fn_arg1 fn_arg2 ... [color=purple]
+#
+# Required Arguments:
+#
+#   function: The symbol name for the function you want probed, this is the
+#             minimum required for an entry, it will show up as the function
+#             name with no arguments.
+#
+#       example: ata_eh_recover:
+#
+# Optional Arguments:
+#
+#   format: The format to display the data on the timeline in. Use braces to
+#           enclose the arg names.
+#
+#       example: ata{port}_port_reset
+# 
+#   color: The color of the entry block in the timeline. The default color is
+#          transparent, so the entry shares the phase color. The color is an
+#          html color string, either a word, or an RGB.
+#
+#       example: [color=#CC00CC]
+#
+#   arglist: A list of arguments from registers/stack addresses. See URL:
+#            https://www.kernel.org/doc/Documentation/trace/kprobetrace.txt
+#
+#       example: port=+36(%di):s32
+#
+# Example: Display ATA port reset as ataN_port_reset in the timeline
+#
+#       ata_eh_recover: ata{port}_port_reset port=+36(%di):s32
+#
+msleep: msleep time=%di:s32
+schedule_timeout_uninterruptible: schedule_timeout_uninterruptible timeout=%di:s32
+schedule_timeout: schedule_timeout timeout=%di:s32
+usleep_range: usleep_range min=%di:s32 max=%si:s32
+__const_udelay: udelay loops=%di:s32
+__mutex_lock_slowpath: mutex_lock_slowpath
+ata_eh_recover: ata_eh_recover port=+36(%di):s32
+acpi_os_stall:
+acpi_resume_power_resources:
+acpi_ps_parse_aml:
+ext4_sync_fs:
+i915_gem_resume:
+i915_restore_state:
+intel_opregion_setup:
+g4x_pre_enable_dp:
+vlv_pre_enable_dp:
+chv_pre_enable_dp:
+g4x_enable_dp:
+vlv_enable_dp:
+intel_hpd_init:
+intel_opregion_register:
+intel_dp_detect:
+intel_hdmi_detect:
+intel_opregion_init:
+intel_fbdev_set_suspend:
diff --git a/tools/power/pm-graph/config/example.cfg b/tools/power/pm-graph/config/example.cfg
new file mode 100644
index 000000000000..05b2efb9bb54
--- /dev/null
+++ b/tools/power/pm-graph/config/example.cfg
@@ -0,0 +1,133 @@
+#
+# Generic S3 (Suspend to Mem) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/example.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: mem
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: suspend-{hostname}-{date}-{time}
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: true
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# Skip HTML generation
+# Only capture the logs, don't generate the html timeline (default: false)
+skiphtml: false
+
+# Sync filesystem before suspend
+# run sync before the test, minimizes sys_sync call time (default: false)
+sync: true
+
+# Runtime suspend enable/disable
+# Enable/disable runtime suspend for all devices, restore all after test (default: no-action)
+# rs: disable
+
+# Turn display on/off for test
+# Switch the display on/off for the test using xset (default: no-action)
+# display: on
+
+# Print results to text file
+# Print the status of the test run in the given file (default: no-action)
+result: result.txt
+
+# Gzip the log files to save space
+# Gzip the generated log files, and read gzipped log files (default: false)
+gzip: true
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of suspend (default: "")
+# command: echo mem > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Multiple test runs
+# Run N tests D seconds apart, generates separate outputs with a summary (default: false)
+# multi: 3 5
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back and display in the same timeline (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 0.001
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Callgraph phase filter
+# Only enable callgraphs for one phase, i.e. resume_noirq (default: all)
+cgphase: suspend
+
+# Callgraph x2 test filter
+# Only enable callgraphs test 0 or 1 when using -x2 (default: 1)
+cgtest: 0
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 6
+
+# Device Filter
+# show only devices whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
+
+# Add kprobe functions to the timeline
+# Add functions to the timeline from a text file (default: no-action)
+# fadd: file.txt
diff --git a/tools/power/pm-graph/config/freeze-callgraph.cfg b/tools/power/pm-graph/config/freeze-callgraph.cfg
new file mode 100644
index 000000000000..f692821c4828
--- /dev/null
+++ b/tools/power/pm-graph/config/freeze-callgraph.cfg
@@ -0,0 +1,94 @@
+#
+# Full Callgraph for S2 (Freeze) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/freeze-callgraph.cfg
+#
+# NOTE: the output of this test is very large (> 30MB)
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: freeze
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: freeze-{hostname}-{date}-{time}-cg
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of freeze (default: "")
+# command: echo freeze > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: true
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 6
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/freeze-dev.cfg b/tools/power/pm-graph/config/freeze-dev.cfg
new file mode 100644
index 000000000000..c4ad5cea3cbf
--- /dev/null
+++ b/tools/power/pm-graph/config/freeze-dev.cfg
@@ -0,0 +1,93 @@
+#
+# Dev S2 (Freeze) test - includes src calls / kernel threads
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/freeze-dev.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: freeze
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: freeze-{hostname}-{date}-{time}-dev
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of freeze (default: "")
+# command: echo freeze > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: true
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/freeze.cfg b/tools/power/pm-graph/config/freeze.cfg
new file mode 100644
index 000000000000..0b70e0b74527
--- /dev/null
+++ b/tools/power/pm-graph/config/freeze.cfg
@@ -0,0 +1,93 @@
+#
+# Generic S2 (Freeze) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/freeze.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: freeze
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: freeze-{hostname}-{date}-{time}
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of freeze (default: "")
+# command: echo freeze > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 0.001
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/standby-callgraph.cfg b/tools/power/pm-graph/config/standby-callgraph.cfg
new file mode 100644
index 000000000000..f52a6b9d5c32
--- /dev/null
+++ b/tools/power/pm-graph/config/standby-callgraph.cfg
@@ -0,0 +1,94 @@
+#
+# Full Callgraph for S1 (Standby) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/standby-callgraph.cfg
+#
+# NOTE: the output of this test is very large (> 30MB)
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: standby
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: standby-{hostname}-{date}-{time}-cg
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of standby (default: "")
+# command: echo standby > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: true
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 6
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/standby-dev.cfg b/tools/power/pm-graph/config/standby-dev.cfg
new file mode 100644
index 000000000000..a5498ece3def
--- /dev/null
+++ b/tools/power/pm-graph/config/standby-dev.cfg
@@ -0,0 +1,93 @@
+#
+# Dev S1 (Standby) test - includes src calls / kernel threads
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/standby-dev.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: standby
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: standby-{hostname}-{date}-{time}-dev
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of standby (default: "")
+# command: echo standby > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: true
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/standby.cfg b/tools/power/pm-graph/config/standby.cfg
new file mode 100644
index 000000000000..f0dd264dfeff
--- /dev/null
+++ b/tools/power/pm-graph/config/standby.cfg
@@ -0,0 +1,93 @@
+#
+# Generic S1 (Standby) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/standby.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: standby
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: standby-{hostname}-{date}-{time}
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of standby (default: "")
+# command: echo standby > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 0.001
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/suspend-callgraph.cfg b/tools/power/pm-graph/config/suspend-callgraph.cfg
new file mode 100644
index 000000000000..11b8cbc12d34
--- /dev/null
+++ b/tools/power/pm-graph/config/suspend-callgraph.cfg
@@ -0,0 +1,98 @@
+#
+# Full Callgraph for S3 (Suspend to Mem) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/suspend.cfg
+#
+# NOTE: the output of this test is very large (> 30MB)
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: mem
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: suspend-{hostname}-{date}-{time}-cg
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of suspend (default: "")
+# command: echo mem > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 0.001
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: true
+
+# Max graph depth
+# limit the callgraph trace to this depth (default: 0 = all)
+maxdepth: 5
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 6
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/suspend-dev.cfg b/tools/power/pm-graph/config/suspend-dev.cfg
new file mode 100644
index 000000000000..56f1d21cc79b
--- /dev/null
+++ b/tools/power/pm-graph/config/suspend-dev.cfg
@@ -0,0 +1,93 @@
+#
+# Dev S3 (Suspend to Mem) test - includes src calls / kernel threads
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/suspend-dev.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: mem
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: suspend-{hostname}-{date}-{time}-dev
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of suspend (default: "")
+# command: echo mem > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: true
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/suspend-x2-proc.cfg b/tools/power/pm-graph/config/suspend-x2-proc.cfg
new file mode 100644
index 000000000000..0ecca0ede138
--- /dev/null
+++ b/tools/power/pm-graph/config/suspend-x2-proc.cfg
@@ -0,0 +1,93 @@
+#
+# Proc S3 (Suspend to Mem) x2 test - includes user processes
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/suspend-proc.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: mem
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: suspend-{hostname}-{date}-{time}-x2-proc
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of suspend (default: "")
+# command: echo mem > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: true
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: true
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 1000
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 1000
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 1000
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 1
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/config/suspend.cfg b/tools/power/pm-graph/config/suspend.cfg
new file mode 100644
index 000000000000..70d293231b06
--- /dev/null
+++ b/tools/power/pm-graph/config/suspend.cfg
@@ -0,0 +1,93 @@
+#
+# Generic S3 (Suspend to Mem) test
+#
+# This is the configuration file for sleepgraph. It contains
+# all the tool arguments so that they don't have to be given on the
+# command line. It also includes advanced settings for functions
+# and kprobes. It is run like this
+#
+#    sudo ./sleepgraph.py -config config/suspend.cfg
+#
+
+[Settings]
+
+# ---- General Options ----
+
+# Verbosity
+# print verbose messages (default: false)
+verbose: false
+
+# Suspend Mode
+# e.g. standby, mem, freeze, disk (default: mem)
+mode: mem
+
+# Output Directory Format
+# output folder for html, ftrace, and dmesg. Use {date} and {time} for current values
+output-dir: suspend-{hostname}-{date}-{time}
+
+# Automatic Wakeup
+# Use rtcwake to autoresume after X seconds, or off to disable (default: 15)
+rtcwake: 15
+
+# Add Logs
+# add the dmesg and ftrace log to the html output (default: false)
+addlogs: false
+
+# Suspend/Resume Gap
+# insert a small visible gap between suspend and resume on the timeline (default: false)
+srgap: false
+
+# ---- Advanced Options ----
+
+# Command to execute in lieu of suspend (default: "")
+# command: echo mem > /sys/power/state
+
+# Display user processes
+# graph user processes and cpu usage in the timeline (default: false)
+proc: false
+
+# Display function calls
+# graph source functions in the timeline (default: false)
+dev: false
+
+# Back to Back Suspend/Resume
+# Run two suspend/resumes back to back (default: false)
+x2: false
+
+# Back to Back Suspend Delay
+# Time delay between the two test runs in ms (default: 0 ms)
+x2delay: 0
+
+# Pre Suspend Delay
+# Include an N ms delay before (1st) suspend (default: 0 ms)
+predelay: 0
+
+# Post Resume Delay
+# Include an N ms delay after (last) resume (default: 0 ms)
+postdelay: 0
+
+# Minimum Device Length
+# graph only devices longer than min in the timeline (default: 0.001 ms)
+mindev: 0.001
+
+# ---- Debug Options ----
+
+# Callgraph
+# gather detailed ftrace callgraph data on all timeline events (default: false)
+callgraph: false
+
+# Expand Callgraph
+# pre-expand the callgraph data in the html output (default: disabled)
+expandcg: false
+
+# Minimum Callgraph Length
+# provide callgraph data for blocks longer than min (default: 0.001 ms)
+mincg: 1
+
+# Timestamp Precision
+# Number of significant digits in timestamps (0:S, [3:ms], 6:us)
+timeprec: 3
+
+# Device Filter
+# show only devs whose name/driver includes one of these strings
+# devicefilter: _cpu_up,_cpu_down,i915,usb
diff --git a/tools/power/pm-graph/sleepgraph.8 b/tools/power/pm-graph/sleepgraph.8
index fbe7bd3eae8e..18baaf6300c9 100644
--- a/tools/power/pm-graph/sleepgraph.8
+++ b/tools/power/pm-graph/sleepgraph.8
@@ -52,9 +52,32 @@ disable rtcwake and require a user keypress to resume.
 \fB-addlogs\fR
 Add the dmesg and ftrace logs to the html output. They will be viewable by
 clicking buttons in the timeline.
+.TP
+\fB-result \fIfile\fR
+Export a results table to a text file for parsing.
+.TP
+\fB-sync\fR
+Sync the filesystems before starting the test. This reduces the size of
+the sys_sync call which happens in the suspend_prepare phase.
+.TP
+\fB-rs \fIenable/disable\fR
+During test, enable/disable runtime suspend for all devices. The test is delayed
+by 5 seconds to allow runtime suspend changes to occur. The settings are restored
+after the test is complete.
+.TP
+\fB-display \fIon/off\fR
+Turn the display on or off for the test using the xset command. This helps
+maintain the consistecy of test data for better comparison.
+.TP
+\fB-skiphtml\fR
+Run the test and capture the trace logs, but skip the timeline generation.
 
 .SS "advanced"
 .TP
+\fB-gzip\fR
+Gzip the trace and dmesg logs to save space. The tool can also read in gzipped
+logs for processing.
+.TP
 \fB-cmd \fIstr\fR
 Run the timeline over a custom suspend command, e.g. pm-suspend. By default
 the tool forces suspend via /sys/power/state so this allows testing over
@@ -114,6 +137,18 @@ This reduces the html file size as there can be many tiny callgraphs
 which are barely visible in the timeline.
 The value is a float: e.g. 0.001 represents 1 us.
 .TP
+\fB-cgfilter \fI"func1,func2,..."\fR
+Reduce callgraph output in the timeline by limiting it to a list of calls. The
+argument can be a single function name or a comma delimited list.
+(default: none)
+.TP
+\fB-cgskip \fIfile\fR
+Reduce callgraph timeline size by skipping over uninteresting functions
+in the trace, e.g. printk or console_unlock. The functions listed
+in this file will show up as empty leaves in the callgraph with only the start/end
+times displayed. cgskip.txt is used automatically if found in the path, so
+use "off" to disable completely (default: cgskip.txt)
+.TP
 \fB-cgphase \fIp\fR
 Only show callgraph data for phase \fIp\fR (e.g. suspend_late).
 .TP
@@ -122,6 +157,9 @@ In an x2 run, only show callgraph data for test \fIn\fR (e.g. 0 or 1).
 .TP
 \fB-timeprec \fIn\fR
 Number of significant digits in timestamps (0:S, [3:ms], 6:us).
+.TP
+\fB-bufsize \fIN\fR
+Set trace buffer size to N kilo-bytes (default: all of free memory up to 3GB)
 
 .SH COMMANDS
 .TP
@@ -144,11 +182,8 @@ Print out the contents of the ACPI Firmware Performance Data Table.
 \fB-sysinfo\fR
 Print out system info extracted from BIOS. Reads /dev/mem directly instead of going through dmidecode.
 .TP
-\fB-usbtopo\fR
-Print out the current USB topology with power info.
-.TP
-\fB-usbauto\fR
-Enable autosuspend for all connected USB devices.
+\fB-devinfo\fR
+Print out the pm settings of all devices which support runtime suspend.
 .TP
 \fB-flist\fR
 Print the list of ftrace functions currently being captured. Functions
@@ -198,7 +233,7 @@ Execute a mem suspend with a 15 second wakeup. Include the logs in the html.
 .PP
 Execute a standby with a 15 second wakeup. Change the output folder name.
 .IP
-\f(CW$ sudo sleepgraph -m standby -rtcwake 15 -o "standby-{hostname}-{date}-{time}"\fR
+\f(CW$ sudo sleepgraph -m standby -rtcwake 15 -o "standby-{host}-{date}-{time}"\fR
 .PP
 Execute a freeze with no wakeup (require keypress). Change output folder name.
 .IP
diff --git a/tools/power/pm-graph/analyze_suspend.py b/tools/power/pm-graph/sleepgraph.py
index 1b60fe203741..266409fb27ae 100755
--- a/tools/power/pm-graph/analyze_suspend.py
+++ b/tools/power/pm-graph/sleepgraph.py
@@ -19,7 +19,7 @@
 #        Home Page
 #          https://01.org/suspendresume
 #        Source repo
-#          https://github.com/01org/pm-graph
+#          git@github.com:01org/pm-graph
 #
 # Description:
 #        This tool is designed to assist kernel and OS developers in optimizing
@@ -57,6 +57,7 @@ import platform
 from datetime import datetime
 import struct
 import ConfigParser
+import gzip
 from threading import Thread
 from subprocess import call, Popen, PIPE
 
@@ -68,8 +69,12 @@ from subprocess import call, Popen, PIPE
 #        store system values and test parameters
 class SystemValues:
         title = 'SleepGraph'
-        version = '4.7'
+        version = '5.0'
         ansi = False
+        rs = 0
+        display = 0
+        gzip = False
+        sync = False
         verbose = False
         testlog = True
         dmesglog = False
@@ -78,14 +83,19 @@ class SystemValues:
         mincglen = 0.0
         cgphase = ''
         cgtest = -1
+        cgskip = ''
+        multitest = {'run': False, 'count': 0, 'delay': 0}
         max_graph_depth = 0
         callloopmaxgap = 0.0001
         callloopmaxlen = 0.005
+        bufsize = 0
         cpucount = 0
         memtotal = 204800
+        memfree = 204800
         srgap = 0
         cgexp = False
         testdir = ''
+        outdir = ''
         tpath = '/sys/kernel/debug/tracing/'
         fpdtpath = '/sys/firmware/acpi/tables/FPDT'
         epath = '/sys/kernel/debug/tracing/events/power/'
@@ -109,22 +119,24 @@ class SystemValues:
         dmesgfile = ''
         ftracefile = ''
         htmlfile = 'output.html'
-        embedded = False
+        result = ''
         rtcwake = True
         rtcwaketime = 15
         rtcpath = ''
         devicefilter = []
+        cgfilter = []
         stamp = 0
         execcount = 1
         x2delay = 0
+        skiphtml = False
         usecallgraph = False
         usetraceevents = False
-        usetraceeventsonly = False
         usetracemarkers = True
         usekprobes = True
         usedevsrc = False
         useprocmon = False
         notestrun = False
+        cgdump = False
         mixedphaseheight = True
         devprops = dict()
         predelay = 0
@@ -134,24 +146,33 @@ class SystemValues:
         tracertypefmt = '# tracer: (?P<t>.*)'
         firmwarefmt = '# fwsuspend (?P<s>[0-9]*) fwresume (?P<r>[0-9]*)$'
         tracefuncs = {
-                'sys_sync': dict(),
-                'pm_prepare_console': dict(),
-                'pm_notifier_call_chain': dict(),
-                'freeze_processes': dict(),
-                'freeze_kernel_threads': dict(),
-                'pm_restrict_gfp_mask': dict(),
-                'acpi_suspend_begin': dict(),
-                'suspend_console': dict(),
-                'acpi_pm_prepare': dict(),
-                'syscore_suspend': dict(),
-                'arch_enable_nonboot_cpus_end': dict(),
-                'syscore_resume': dict(),
-                'acpi_pm_finish': dict(),
-                'resume_console': dict(),
-                'acpi_pm_end': dict(),
-                'pm_restore_gfp_mask': dict(),
-                'thaw_processes': dict(),
-                'pm_restore_console': dict(),
+                'sys_sync': {},
+                '__pm_notifier_call_chain': {},
+                'pm_prepare_console': {},
+                'pm_notifier_call_chain': {},
+                'freeze_processes': {},
+                'freeze_kernel_threads': {},
+                'pm_restrict_gfp_mask': {},
+                'acpi_suspend_begin': {},
+                'acpi_hibernation_begin': {},
+                'acpi_hibernation_enter': {},
+                'acpi_hibernation_leave': {},
+                'acpi_pm_freeze': {},
+                'acpi_pm_thaw': {},
+                'hibernate_preallocate_memory': {},
+                'create_basic_memory_bitmaps': {},
+                'swsusp_write': {},
+                'suspend_console': {},
+                'acpi_pm_prepare': {},
+                'syscore_suspend': {},
+                'arch_enable_nonboot_cpus_end': {},
+                'syscore_resume': {},
+                'acpi_pm_finish': {},
+                'resume_console': {},
+                'acpi_pm_end': {},
+                'pm_restore_gfp_mask': {},
+                'thaw_processes': {},
+                'pm_restore_console': {},
                 'CPU_OFF': {
                         'func':'_cpu_down',
                         'args_x86_64': {'cpu':'%di:s32'},
@@ -173,56 +194,54 @@ class SystemValues:
                 'mutex_lock_slowpath': { 'func':'__mutex_lock_slowpath', 'ub': 1 },
                 'acpi_os_stall': {'ub': 1},
                 # ACPI
-                'acpi_resume_power_resources': dict(),
-                'acpi_ps_parse_aml': dict(),
+                'acpi_resume_power_resources': {},
+                'acpi_ps_parse_aml': {},
                 # filesystem
-                'ext4_sync_fs': dict(),
+                'ext4_sync_fs': {},
                 # 80211
-                'iwlagn_mac_start': dict(),
-                'iwlagn_alloc_bcast_station': dict(),
-                'iwl_trans_pcie_start_hw': dict(),
-                'iwl_trans_pcie_start_fw': dict(),
-                'iwl_run_init_ucode': dict(),
-                'iwl_load_ucode_wait_alive': dict(),
-                'iwl_alive_start': dict(),
-                'iwlagn_mac_stop': dict(),
-                'iwlagn_mac_suspend': dict(),
-                'iwlagn_mac_resume': dict(),
-                'iwlagn_mac_add_interface': dict(),
-                'iwlagn_mac_remove_interface': dict(),
-                'iwlagn_mac_change_interface': dict(),
-                'iwlagn_mac_config': dict(),
-                'iwlagn_configure_filter': dict(),
-                'iwlagn_mac_hw_scan': dict(),
-                'iwlagn_bss_info_changed': dict(),
-                'iwlagn_mac_channel_switch': dict(),
-                'iwlagn_mac_flush': dict(),
+                'iwlagn_mac_start': {},
+                'iwlagn_alloc_bcast_station': {},
+                'iwl_trans_pcie_start_hw': {},
+                'iwl_trans_pcie_start_fw': {},
+                'iwl_run_init_ucode': {},
+                'iwl_load_ucode_wait_alive': {},
+                'iwl_alive_start': {},
+                'iwlagn_mac_stop': {},
+                'iwlagn_mac_suspend': {},
+                'iwlagn_mac_resume': {},
+                'iwlagn_mac_add_interface': {},
+                'iwlagn_mac_remove_interface': {},
+                'iwlagn_mac_change_interface': {},
+                'iwlagn_mac_config': {},
+                'iwlagn_configure_filter': {},
+                'iwlagn_mac_hw_scan': {},
+                'iwlagn_bss_info_changed': {},
+                'iwlagn_mac_channel_switch': {},
+                'iwlagn_mac_flush': {},
                 # ATA
                 'ata_eh_recover': { 'args_x86_64': {'port':'+36(%di):s32'} },
                 # i915
-                'i915_gem_resume': dict(),
-                'i915_restore_state': dict(),
-                'intel_opregion_setup': dict(),
-                'g4x_pre_enable_dp': dict(),
-                'vlv_pre_enable_dp': dict(),
-                'chv_pre_enable_dp': dict(),
-                'g4x_enable_dp': dict(),
-                'vlv_enable_dp': dict(),
-                'intel_hpd_init': dict(),
-                'intel_opregion_register': dict(),
-                'intel_dp_detect': dict(),
-                'intel_hdmi_detect': dict(),
-                'intel_opregion_init': dict(),
-                'intel_fbdev_set_suspend': dict(),
+                'i915_gem_resume': {},
+                'i915_restore_state': {},
+                'intel_opregion_setup': {},
+                'g4x_pre_enable_dp': {},
+                'vlv_pre_enable_dp': {},
+                'chv_pre_enable_dp': {},
+                'g4x_enable_dp': {},
+                'vlv_enable_dp': {},
+                'intel_hpd_init': {},
+                'intel_opregion_register': {},
+                'intel_dp_detect': {},
+                'intel_hdmi_detect': {},
+                'intel_opregion_init': {},
+                'intel_fbdev_set_suspend': {},
         }
+        cgblacklist = []
         kprobes = dict()
         timeformat = '%.3f'
+        cmdline = '%s %s' % \
+                        (os.path.basename(sys.argv[0]), string.join(sys.argv[1:], ' '))
         def __init__(self):
-                # if this is a phoronix test run, set some default options
-                if('LOG_FILE' in os.environ and 'TEST_RESULTS_IDENTIFIER' in os.environ):
-                        self.embedded = True
-                        self.dmesglog = self.ftracelog = True
-                        self.htmlfile = os.environ['LOG_FILE']
                 self.archargs = 'args_'+platform.machine()
                 self.hostname = platform.node()
                 if(self.hostname == ''):
@@ -237,18 +256,36 @@ class SystemValues:
                 if (hasattr(sys.stdout, 'isatty') and sys.stdout.isatty()):
                         self.ansi = True
                 self.testdir = datetime.now().strftime('suspend-%y%m%d-%H%M%S')
+        def vprint(self, msg):
+                self.logmsg += msg+'\n'
+                if(self.verbose):
+                        print(msg)
         def rootCheck(self, fatal=True):
                 if(os.access(self.powerfile, os.W_OK)):
                         return True
                 if fatal:
-                        doError('This command requires sysfs mount and root access')
+                        msg = 'This command requires sysfs mount and root access'
+                        print('ERROR: %s\n') % msg
+                        self.outputResult({'error':msg})
+                        sys.exit()
                 return False
         def rootUser(self, fatal=False):
                 if 'USER' in os.environ and os.environ['USER'] == 'root':
                         return True
                 if fatal:
-                        doError('This command must be run as root')
+                        msg = 'This command must be run as root'
+                        print('ERROR: %s\n') % msg
+                        self.outputResult({'error':msg})
+                        sys.exit()
                 return False
+        def getExec(self, cmd):
+                dirlist = ['/sbin', '/bin', '/usr/sbin', '/usr/bin',
+                        '/usr/local/sbin', '/usr/local/bin']
+                for path in dirlist:
+                        cmdfull = os.path.join(path, cmd)
+                        if os.path.exists(cmdfull):
+                                return cmdfull
+                return ''
         def setPrecision(self, num):
                 if num < 0 or num > 6:
                         return
@@ -258,15 +295,15 @@ class SystemValues:
                 n = datetime.now()
                 args['date'] = n.strftime('%y%m%d')
                 args['time'] = n.strftime('%H%M%S')
-                args['hostname'] = self.hostname
+                args['hostname'] = args['host'] = self.hostname
                 return value.format(**args)
         def setOutputFile(self):
                 if self.dmesgfile != '':
-                        m = re.match('(?P<name>.*)_dmesg\.txt$', self.dmesgfile)
+                        m = re.match('(?P<name>.*)_dmesg\.txt.*', self.dmesgfile)
                         if(m):
                                 self.htmlfile = m.group('name')+'.html'
                 if self.ftracefile != '':
-                        m = re.match('(?P<name>.*)_ftrace\.txt$', self.ftracefile)
+                        m = re.match('(?P<name>.*)_ftrace\.txt.*', self.ftracefile)
                         if(m):
                                 self.htmlfile = m.group('name')+'.html'
         def systemInfo(self, info):
@@ -283,16 +320,19 @@ class SystemValues:
                         c = info['processor-version']
                 if 'bios-version' in info:
                         b = info['bios-version']
-                self.sysstamp = '# sysinfo | man:%s | plat:%s | cpu:%s | bios:%s | numcpu:%d | memsz:%d' % \
-                        (m, p, c, b, self.cpucount, self.memtotal)
-        def printSystemInfo(self):
+                self.sysstamp = '# sysinfo | man:%s | plat:%s | cpu:%s | bios:%s | numcpu:%d | memsz:%d | memfr:%d' % \
+                        (m, p, c, b, self.cpucount, self.memtotal, self.memfree)
+        def printSystemInfo(self, fatal=False):
                 self.rootCheck(True)
-                out = dmidecode(self.mempath, True)
+                out = dmidecode(self.mempath, fatal)
+                if len(out) < 1:
+                        return
                 fmt = '%-24s: %s'
                 for name in sorted(out):
                         print fmt % (name, out[name])
                 print fmt % ('cpucount', ('%d' % self.cpucount))
                 print fmt % ('memtotal', ('%d kB' % self.memtotal))
+                print fmt % ('memfree', ('%d kB' % self.memfree))
         def cpuInfo(self):
                 self.cpucount = 0
                 fp = open('/proc/cpuinfo', 'r')
@@ -305,7 +345,9 @@ class SystemValues:
                         m = re.match('^MemTotal:[ \t]*(?P<sz>[0-9]*) *kB', line)
                         if m:
                                 self.memtotal = int(m.group('sz'))
-                                break
+                        m = re.match('^MemFree:[ \t]*(?P<sz>[0-9]*) *kB', line)
+                        if m:
+                                self.memfree = int(m.group('sz'))
                 fp.close()
         def initTestOutput(self, name):
                 self.prefix = self.hostname
@@ -315,39 +357,34 @@ class SystemValues:
                 testtime = datetime.now().strftime(fmt)
                 self.teststamp = \
                         '# '+testtime+' '+self.prefix+' '+self.suspendmode+' '+kver
-                if(self.embedded):
-                        self.dmesgfile = \
-                                '/tmp/'+testtime+'_'+self.suspendmode+'_dmesg.txt'
-                        self.ftracefile = \
-                                '/tmp/'+testtime+'_'+self.suspendmode+'_ftrace.txt'
-                        return
+                ext = ''
+                if self.gzip:
+                        ext = '.gz'
                 self.dmesgfile = \
-                        self.testdir+'/'+self.prefix+'_'+self.suspendmode+'_dmesg.txt'
+                        self.testdir+'/'+self.prefix+'_'+self.suspendmode+'_dmesg.txt'+ext
                 self.ftracefile = \
-                        self.testdir+'/'+self.prefix+'_'+self.suspendmode+'_ftrace.txt'
+                        self.testdir+'/'+self.prefix+'_'+self.suspendmode+'_ftrace.txt'+ext
                 self.htmlfile = \
                         self.testdir+'/'+self.prefix+'_'+self.suspendmode+'.html'
                 if not os.path.isdir(self.testdir):
                         os.mkdir(self.testdir)
+        def getValueList(self, value):
+                out = []
+                for i in value.split(','):
+                        if i.strip():
+                                out.append(i.strip())
+                return out
         def setDeviceFilter(self, value):
-                self.devicefilter = []
-                if value:
-                        value = value.split(',')
-                for i in value:
-                        self.devicefilter.append(i.strip())
+                self.devicefilter = self.getValueList(value)
+        def setCallgraphFilter(self, value):
+                self.cgfilter = self.getValueList(value)
+        def setCallgraphBlacklist(self, file):
+                self.cgblacklist = self.listFromFile(file)
         def rtcWakeAlarmOn(self):
                 call('echo 0 > '+self.rtcpath+'/wakealarm', shell=True)
-                outD = open(self.rtcpath+'/date', 'r').read().strip()
-                outT = open(self.rtcpath+'/time', 'r').read().strip()
-                mD = re.match('^(?P<y>[0-9]*)-(?P<m>[0-9]*)-(?P<d>[0-9]*)', outD)
-                mT = re.match('^(?P<h>[0-9]*):(?P<m>[0-9]*):(?P<s>[0-9]*)', outT)
-                if(mD and mT):
-                        # get the current time from hardware
-                        utcoffset = int((datetime.now() - datetime.utcnow()).total_seconds())
-                        dt = datetime(\
-                                int(mD.group('y')), int(mD.group('m')), int(mD.group('d')),
-                                int(mT.group('h')), int(mT.group('m')), int(mT.group('s')))
-                        nowtime = int(dt.strftime('%s')) + utcoffset
+                nowtime = open(self.rtcpath+'/since_epoch', 'r').read().strip()
+                if nowtime:
+                        nowtime = int(nowtime)
                 else:
                         # if hardware time fails, use the software time
                         nowtime = int(datetime.now().strftime('%s'))
@@ -369,10 +406,10 @@ class SystemValues:
                                 ktime = m.group('ktime')
                 fp.close()
                 self.dmesgstart = float(ktime)
-        def getdmesg(self):
+        def getdmesg(self, fwdata=[]):
+                op = self.writeDatafileHeader(sysvals.dmesgfile, fwdata)
                 # store all new dmesg lines since initdmesg was called
                 fp = Popen('dmesg', stdout=PIPE).stdout
-                op = open(self.dmesgfile, 'a')
                 for line in fp:
                         line = line.replace('\r\n', '')
                         idx = line.find('[')
@@ -386,11 +423,17 @@ class SystemValues:
                                 op.write(line)
                 fp.close()
                 op.close()
-        def addFtraceFilterFunctions(self, file):
+        def listFromFile(self, file):
+                list = []
                 fp = open(file)
-                list = fp.read().split('\n')
+                for i in fp.read().split('\n'):
+                        i = i.strip()
+                        if i and i[0] != '#':
+                                list.append(i)
                 fp.close()
-                for i in list:
+                return list
+        def addFtraceFilterFunctions(self, file):
+                for i in self.listFromFile(file):
                         if len(i) < 2:
                                 continue
                         self.tracefuncs[i] = dict()
@@ -399,9 +442,7 @@ class SystemValues:
                 if not current:
                         call('cat '+self.tpath+'available_filter_functions', shell=True)
                         return
-                fp = open(self.tpath+'available_filter_functions')
-                master = fp.read().split('\n')
-                fp.close()
+                master = self.listFromFile(self.tpath+'available_filter_functions')
                 for i in self.tracefuncs:
                         if 'func' in self.tracefuncs[i]:
                                 i = self.tracefuncs[i]['func']
@@ -410,9 +451,7 @@ class SystemValues:
                         else:
                                 print self.colorText(i)
         def setFtraceFilterFunctions(self, list):
-                fp = open(self.tpath+'available_filter_functions')
-                master = fp.read().split('\n')
-                fp.close()
+                master = self.listFromFile(self.tpath+'available_filter_functions')
                 flist = ''
                 for i in list:
                         if i not in master:
@@ -501,6 +540,7 @@ class SystemValues:
                 rejects = []
                 # sort kprobes: trace, ub-dev, custom, dev
                 kpl = [[], [], [], []]
+                linesout = len(self.kprobes)
                 for name in sorted(self.kprobes):
                         res = self.colorText('YES', 32)
                         if not self.testKprobe(name, self.kprobes[name]):
@@ -528,17 +568,10 @@ class SystemValues:
                 for kp in kplist:
                         kprobeevents += self.kprobeText(kp, self.kprobes[kp])
                 self.fsetVal(kprobeevents, 'kprobe_events')
-                # verify that the kprobes were set as ordered
-                check = self.fgetVal('kprobe_events')
-                linesout = len(kprobeevents.split('\n')) - 1
-                linesack = len(check.split('\n')) - 1
                 if output:
-                        res = '%d/%d' % (linesack, linesout)
-                        if linesack < linesout:
-                                res = self.colorText(res, 31)
-                        else:
-                                res = self.colorText(res, 32)
-                        print('    working kprobe functions enabled: %s' % res)
+                        check = self.fgetVal('kprobe_events')
+                        linesack = (len(check.split('\n')) - 1) / 2
+                        print('    kprobe functions enabled: %d/%d' % (linesack, linesout))
                 self.fsetVal('1', 'events/kprobes/enable')
         def testKprobe(self, kname, kprobe):
                 self.fsetVal('0', 'events/kprobes/enable')
@@ -555,8 +588,7 @@ class SystemValues:
                 if linesack < linesout:
                         return False
                 return True
-        def fsetVal(self, val, path, mode='w'):
-                file = self.tpath+path
+        def setVal(self, val, file, mode='w'):
                 if not os.path.exists(file):
                         return False
                 try:
@@ -567,8 +599,9 @@ class SystemValues:
                 except:
                         return False
                 return True
-        def fgetVal(self, path):
-                file = self.tpath+path
+        def fsetVal(self, val, path, mode='w'):
+                return self.setVal(val, self.tpath+path, mode)
+        def getVal(self, file):
                 res = ''
                 if not os.path.exists(file):
                         return res
@@ -579,10 +612,13 @@ class SystemValues:
                 except:
                         pass
                 return res
+        def fgetVal(self, path):
+                return self.getVal(self.tpath+path)
         def cleanupFtrace(self):
-                if(self.usecallgraph or self.usetraceevents):
+                if(self.usecallgraph or self.usetraceevents or self.usedevsrc):
                         self.fsetVal('0', 'events/kprobes/enable')
                         self.fsetVal('', 'kprobe_events')
+                        self.fsetVal('1024', 'buffer_size_kb')
         def setupAllKprobes(self):
                 for name in self.tracefuncs:
                         self.defaultKprobe(name, self.tracefuncs[name])
@@ -599,7 +635,8 @@ class SystemValues:
                         if name == f:
                                 return True
                 return False
-        def initFtrace(self, testing=False):
+        def initFtrace(self):
+                self.printSystemInfo(False)
                 print('INITIALIZING FTRACE...')
                 # turn trace off
                 self.fsetVal('0', 'tracing_on')
@@ -607,17 +644,21 @@ class SystemValues:
                 # set the trace clock to global
                 self.fsetVal('global', 'trace_clock')
                 self.fsetVal('nop', 'current_tracer')
-                # set trace buffer to a huge value
-                if self.usecallgraph or self.usedevsrc:
-                        tgtsize = min(self.memtotal / 2, 2*1024*1024)
-                        maxbuf = '%d' % (tgtsize / max(1, self.cpucount))
-                        if self.cpucount < 1 or not self.fsetVal(maxbuf, 'buffer_size_kb'):
-                                self.fsetVal('131072', 'buffer_size_kb')
+                # set trace buffer to an appropriate value
+                cpus = max(1, self.cpucount)
+                if self.bufsize > 0:
+                        tgtsize = self.bufsize
+                elif self.usecallgraph or self.usedevsrc:
+                        tgtsize = min(self.memfree, 3*1024*1024)
                 else:
-                        self.fsetVal('16384', 'buffer_size_kb')
-                # go no further if this is just a status check
-                if testing:
-                        return
+                        tgtsize = 65536
+                while not self.fsetVal('%d' % (tgtsize / cpus), 'buffer_size_kb'):
+                        # if the size failed to set, lower it and keep trying
+                        tgtsize -= 65536
+                        if tgtsize < 65536:
+                                tgtsize = int(self.fgetVal('buffer_size_kb')) * cpus
+                                break
+                print 'Setting trace buffers to %d kB (%d kB per cpu)' % (tgtsize, tgtsize/cpus)
                 # initialize the callgraph trace
                 if(self.usecallgraph):
                         # set trace type
@@ -635,7 +676,7 @@ class SystemValues:
                         self.fsetVal('graph-time', 'trace_options')
                         self.fsetVal('%d' % self.max_graph_depth, 'max_graph_depth')
                         cf = ['dpm_run_callback']
-                        if(self.usetraceeventsonly):
+                        if(self.usetraceevents):
                                 cf += ['dpm_prepare', 'dpm_complete']
                         for fn in self.tracefuncs:
                                 if 'func' in self.tracefuncs[fn]:
@@ -688,16 +729,65 @@ class SystemValues:
                         return str
                 return '\x1B[%d;40m%s\x1B[m' % (color, str)
         def writeDatafileHeader(self, filename, fwdata=[]):
-                fp = open(filename, 'w')
-                fp.write(self.teststamp+'\n')
-                fp.write(self.sysstamp+'\n')
+                fp = self.openlog(filename, 'w')
+                fp.write('%s\n%s\n# command | %s\n' % (self.teststamp, self.sysstamp, self.cmdline))
                 if(self.suspendmode == 'mem' or self.suspendmode == 'command'):
                         for fw in fwdata:
                                 if(fw):
                                         fp.write('# fwsuspend %u fwresume %u\n' % (fw[0], fw[1]))
+                return fp
+        def sudouser(self, dir):
+                if os.path.exists(dir) and os.getuid() == 0 and \
+                        'SUDO_USER' in os.environ:
+                        cmd = 'chown -R {0}:{0} {1} > /dev/null 2>&1'
+                        call(cmd.format(os.environ['SUDO_USER'], dir), shell=True)
+        def outputResult(self, testdata, num=0):
+                if not self.result:
+                        return
+                n = ''
+                if num > 0:
+                        n = '%d' % num
+                fp = open(self.result, 'a')
+                if 'error' in testdata:
+                        fp.write('result%s: fail\n' % n)
+                        fp.write('error%s: %s\n' % (n, testdata['error']))
+                else:
+                        fp.write('result%s: pass\n' % n)
+                for v in ['suspend', 'resume', 'boot', 'lastinit']:
+                        if v in testdata:
+                                fp.write('%s%s: %.3f\n' % (v, n, testdata[v]))
+                for v in ['fwsuspend', 'fwresume']:
+                        if v in testdata:
+                                fp.write('%s%s: %.3f\n' % (v, n, testdata[v] / 1000000.0))
+                if 'bugurl' in testdata:
+                        fp.write('url%s: %s\n' % (n, testdata['bugurl']))
                 fp.close()
+                self.sudouser(self.result)
+        def configFile(self, file):
+                dir = os.path.dirname(os.path.realpath(__file__))
+                if os.path.exists(file):
+                        return file
+                elif os.path.exists(dir+'/'+file):
+                        return dir+'/'+file
+                elif os.path.exists(dir+'/config/'+file):
+                        return dir+'/config/'+file
+                return ''
+        def openlog(self, filename, mode):
+                isgz = self.gzip
+                if mode == 'r':
+                        try:
+                                with gzip.open(filename, mode+'b') as fp:
+                                        test = fp.read(64)
+                                isgz = True
+                        except:
+                                isgz = False
+                if isgz:
+                        return gzip.open(filename, mode+'b')
+                return open(filename, mode)
 
 sysvals = SystemValues()
+switchvalues = ['enable', 'disable', 'on', 'off', 'true', 'false', '1', '0']
+switchoff = ['disable', 'off', 'false', '0']
 suspendmodename = {
         'freeze': 'Freeze (S0)',
         'standby': 'Standby (S1)',
@@ -826,34 +916,65 @@ class Data:
                 for phase in self.phases:
                         self.devicegroups.append([phase])
                 self.errorinfo = {'suspend':[],'resume':[]}
-        def extractErrorInfo(self, dmesg):
-                error = ''
-                tm = 0.0
-                for i in range(len(dmesg)):
-                        if 'Call Trace:' in dmesg[i]:
-                                m = re.match('[ \t]*(\[ *)(?P<ktime>[0-9\.]*)(\]) .*', dmesg[i])
-                                if not m:
-                                        continue
-                                tm = float(m.group('ktime'))
-                                if tm < self.start or tm > self.end:
-                                        continue
-                                for j in range(i-10, i+1):
-                                        error += dmesg[j]
+        def extractErrorInfo(self):
+                lf = sysvals.openlog(sysvals.dmesgfile, 'r')
+                i = 0
+                list = []
+                # sl = start line, et = error time, el = error line
+                type = 'ERROR'
+                sl = et = el = -1
+                for line in lf:
+                        i += 1
+                        m = re.match('[ \t]*(\[ *)(?P<ktime>[0-9\.]*)(\]) (?P<msg>.*)', line)
+                        if not m:
                                 continue
-                        if error:
-                                m = re.match('[ \t]*\[ *[0-9\.]*\]  \[\<[0-9a-fA-F]*\>\] .*', dmesg[i])
-                                if m:
-                                        error += dmesg[i]
-                                else:
-                                        if tm < self.tSuspended:
-                                                dir = 'suspend'
-                                        else:
-                                                dir = 'resume'
-                                        error = error.replace('<', '&lt').replace('>', '&gt')
-                                        vprint('kernel error found in %s at %f' % (dir, tm))
-                                        self.errorinfo[dir].append((tm, error))
+                        t = float(m.group('ktime'))
+                        if t < self.start or t > self.end:
+                                continue
+                        if t < self.tSuspended:
+                                dir = 'suspend'
+                        else:
+                                dir = 'resume'
+                        msg = m.group('msg')
+                        if re.match('-*\[ *cut here *\]-*', msg):
+                                type = 'WARNING'
+                                sl = i
+                        elif re.match('genirq: .*', msg):
+                                type = 'IRQ'
+                                sl = i
+                        elif re.match('BUG: .*', msg) or re.match('kernel BUG .*', msg):
+                                type = 'BUG'
+                                sl = i
+                        elif re.match('-*\[ *end trace .*\]-*', msg) or \
+                                re.match('R13: .*', msg):
+                                if et >= 0 and sl >= 0:
+                                        list.append((type, dir, et, sl, i))
                                         self.kerror = True
-                                        error = ''
+                                        sl = et = el = -1
+                                        type = 'ERROR'
+                        elif 'Call Trace:' in msg:
+                                if el >= 0 and et >= 0:
+                                        list.append((type, dir, et, el, el))
+                                        self.kerror = True
+                                et, el = t, i
+                                if sl < 0 or type == 'BUG':
+                                        slval = i
+                                        if sl >= 0:
+                                                slval = sl
+                                        list.append((type, dir, et, slval, i))
+                                        self.kerror = True
+                                        sl = et = el = -1
+                                        type = 'ERROR'
+                if el >= 0 and et >= 0:
+                        list.append((type, dir, et, el, el))
+                        self.kerror = True
+                for e in list:
+                        type, dir, t, idx1, idx2 = e
+                        sysvals.vprint('kernel %s found in %s at %f' % (type, dir, t))
+                        self.errorinfo[dir].append((type, t, idx1, idx2))
+                if self.kerror:
+                        sysvals.dmesglog = True
+                lf.close()
         def setStart(self, time):
                 self.start = time
         def setEnd(self, time):
@@ -867,6 +988,14 @@ class Data:
                                         time < d['end']):
                                         return False
                 return True
+        def phaseCollision(self, phase, isbegin, line):
+                key = 'end'
+                if isbegin:
+                        key = 'start'
+                if self.dmesg[phase][key] >= 0:
+                        sysvals.vprint('IGNORE: %s' % line.strip())
+                        return True
+                return False
         def sourcePhase(self, start):
                 for phase in self.phases:
                         pend = self.dmesg[phase]['end']
@@ -918,7 +1047,7 @@ class Data:
                         return self.addDeviceFunctionCall(displayname, kprobename, proc, pid, start, end, cdata, rdata)
                 # this should not happen
                 if not tgtdev:
-                        vprint('[%f - %f] %s-%d %s %s %s' % \
+                        sysvals.vprint('[%f - %f] %s-%d %s %s %s' % \
                                 (start, end, proc, pid, kprobename, cdata, rdata))
                         return False
                 # place the call data inside the src element of the tgtdev
@@ -1054,6 +1183,13 @@ class Data:
                                 if('src' in d):
                                         for e in d['src']:
                                                 e.time = self.trimTimeVal(e.time, t0, dT, left)
+                for dir in ['suspend', 'resume']:
+                        list = []
+                        for e in self.errorinfo[dir]:
+                                type, tm, idx1, idx2 = e
+                                tm = self.trimTimeVal(tm, t0, dT, left)
+                                list.append((type, tm, idx1, idx2))
+                        self.errorinfo[dir] = list
         def normalizeTime(self, tZero):
                 # trim out any standby or freeze clock time
                 if(self.tSuspended != self.tResumed):
@@ -1100,7 +1236,7 @@ class Data:
                                         if self.dmesg[p]['end'] > dev['start']:
                                                 dev['end'] = self.dmesg[p]['end']
                                                 break
-                                vprint('%s (%s): callback didnt return' % (devname, phase))
+                                sysvals.vprint('%s (%s): callback didnt return' % (devname, phase))
         def deviceFilter(self, devicefilter):
                 for phase in self.phases:
                         list = self.dmesg[phase]['list']
@@ -1200,15 +1336,15 @@ class Data:
                                 devlist.append(child)
                 return devlist
         def printDetails(self):
-                vprint('Timeline Details:')
-                vprint('          test start: %f' % self.start)
-                vprint('kernel suspend start: %f' % self.tKernSus)
+                sysvals.vprint('Timeline Details:')
+                sysvals.vprint('          test start: %f' % self.start)
+                sysvals.vprint('kernel suspend start: %f' % self.tKernSus)
                 for phase in self.phases:
                         dc = len(self.dmesg[phase]['list'])
-                        vprint('    %16s: %f - %f (%d devices)' % (phase, \
+                        sysvals.vprint('    %16s: %f - %f (%d devices)' % (phase, \
                                 self.dmesg[phase]['start'], self.dmesg[phase]['end'], dc))
-                vprint('   kernel resume end: %f' % self.tKernRes)
-                vprint('            test end: %f' % self.end)
+                sysvals.vprint('   kernel resume end: %f' % self.tKernRes)
+                sysvals.vprint('            test end: %f' % self.end)
         def deviceChildrenAllPhases(self, devname):
                 devlist = []
                 for phase in self.phases:
@@ -1358,14 +1494,21 @@ class Data:
                                 tres.append(t)
                 # process the events for suspend and resume
                 if len(proclist) > 0:
-                        vprint('Process Execution:')
+                        sysvals.vprint('Process Execution:')
                 for ps in proclist:
                         c = self.addProcessUsageEvent(ps, tsus)
                         if c > 0:
-                                vprint('%25s (sus): %d' % (ps, c))
+                                sysvals.vprint('%25s (sus): %d' % (ps, c))
                         c = self.addProcessUsageEvent(ps, tres)
                         if c > 0:
-                                vprint('%25s (res): %d' % (ps, c))
+                                sysvals.vprint('%25s (res): %d' % (ps, c))
+        def debugPrint(self):
+                for p in self.phases:
+                        list = self.dmesg[p]['list']
+                        for devname in list:
+                                dev = list[devname]
+                                if 'ftrace' in dev:
+                                        dev['ftrace'].debugPrint(' [%s]' % devname)
 
 # Class: DevFunction
 # Description:
@@ -1504,18 +1647,24 @@ class FTraceLine:
                         # something else (possibly a trace marker)
                         else:
                                 self.name = m
+        def isCall(self):
+                return self.fcall and not self.freturn
+        def isReturn(self):
+                return self.freturn and not self.fcall
+        def isLeaf(self):
+                return self.fcall and self.freturn
         def getDepth(self, str):
                 return len(str)/2
-        def debugPrint(self, dev=''):
-                if(self.freturn and self.fcall):
-                        print('%s -- %f (%02d): %s(); (%.3f us)' % (dev, self.time, \
-                                self.depth, self.name, self.length*1000000))
-                elif(self.freturn):
-                        print('%s -- %f (%02d): %s} (%.3f us)' % (dev, self.time, \
-                                self.depth, self.name, self.length*1000000))
+        def debugPrint(self, info=''):
+                if self.isLeaf():
+                        print(' -- %12.6f (depth=%02d): %s(); (%.3f us) %s' % (self.time, \
+                                self.depth, self.name, self.length*1000000, info))
+                elif self.freturn:
+                        print(' -- %12.6f (depth=%02d): %s} (%.3f us) %s' % (self.time, \
+                                self.depth, self.name, self.length*1000000, info))
                 else:
-                        print('%s -- %f (%02d): %s() { (%.3f us)' % (dev, self.time, \
-                                self.depth, self.name, self.length*1000000))
+                        print(' -- %12.6f (depth=%02d): %s() { (%.3f us) %s' % (self.time, \
+                                self.depth, self.name, self.length*1000000, info))
         def startMarker(self):
                 # Is this the starting line of a suspend?
                 if not self.fevent:
@@ -1558,107 +1707,160 @@ class FTraceCallGraph:
         depth = 0
         pid = 0
         name = ''
-        def __init__(self, pid):
+        partial = False
+        vfname = 'missing_function_name'
+        ignore = False
+        sv = 0
+        def __init__(self, pid, sv):
                 self.start = -1.0
                 self.end = -1.0
                 self.list = []
                 self.depth = 0
                 self.pid = pid
-        def addLine(self, line, debug=False):
+                self.sv = sv
+        def addLine(self, line):
                 # if this is already invalid, just leave
                 if(self.invalid):
-                        return False
-                # invalidate on too much data or bad depth
-                if(len(self.list) >= 1000000 or self.depth < 0):
+                        if(line.depth == 0 and line.freturn):
+                                return 1
+                        return 0
+                # invalidate on bad depth
+                if(self.depth < 0):
                         self.invalidate(line)
-                        return False
+                        return 0
+                # ignore data til we return to the current depth
+                if self.ignore:
+                        if line.depth > self.depth:
+                                return 0
+                        else:
+                                self.list[-1].freturn = True
+                                self.list[-1].length = line.time - self.list[-1].time
+                                self.ignore = False
+                                # if this is a return at self.depth, no more work is needed
+                                if line.depth == self.depth and line.isReturn():
+                                        if line.depth == 0:
+                                                self.end = line.time
+                                                return 1
+                                        return 0
                 # compare current depth with this lines pre-call depth
                 prelinedep = line.depth
-                if(line.freturn and not line.fcall):
+                if line.isReturn():
                         prelinedep += 1
                 last = 0
                 lasttime = line.time
-                virtualfname = 'missing_function_name'
                 if len(self.list) > 0:
                         last = self.list[-1]
                         lasttime = last.time
+                        if last.isLeaf():
+                                lasttime += last.length
                 # handle low misalignments by inserting returns
-                if prelinedep < self.depth:
-                        if debug and last:
-                                print '-------- task %d --------' % self.pid
-                                last.debugPrint()
+                mismatch = prelinedep - self.depth
+                warning = self.sv.verbose and abs(mismatch) > 1
+                info = []
+                if mismatch < 0:
                         idx = 0
                         # add return calls to get the depth down
                         while prelinedep < self.depth:
-                                if debug:
-                                        print 'MISALIGN LOW (add returns): C%d - eC%d' % (self.depth, prelinedep)
                                 self.depth -= 1
-                                if idx == 0 and last and last.fcall and not last.freturn:
+                                if idx == 0 and last and last.isCall():
                                         # special case, turn last call into a leaf
                                         last.depth = self.depth
                                         last.freturn = True
                                         last.length = line.time - last.time
-                                        if debug:
-                                                last.debugPrint()
+                                        if warning:
+                                                info.append(('[make leaf]', last))
                                 else:
                                         vline = FTraceLine(lasttime)
                                         vline.depth = self.depth
-                                        vline.name = virtualfname
+                                        vline.name = self.vfname
                                         vline.freturn = True
                                         self.list.append(vline)
-                                        if debug:
-                                                vline.debugPrint()
+                                        if warning:
+                                                if idx == 0:
+                                                        info.append(('', last))
+                                                info.append(('[add return]', vline))
                                 idx += 1
-                        if debug:
-                                line.debugPrint()
-                                print ''
+                        if warning:
+                                info.append(('', line))
                 # handle high misalignments by inserting calls
-                elif prelinedep > self.depth:
-                        if debug and last:
-                                print '-------- task %d --------' % self.pid
-                                last.debugPrint()
+                elif mismatch > 0:
                         idx = 0
+                        if warning:
+                                info.append(('', last))
                         # add calls to get the depth up
                         while prelinedep > self.depth:
-                                if debug:
-                                        print 'MISALIGN HIGH (add calls): C%d - eC%d' % (self.depth, prelinedep)
-                                if idx == 0 and line.freturn and not line.fcall:
+                                if idx == 0 and line.isReturn():
                                         # special case, turn this return into a leaf
                                         line.fcall = True
                                         prelinedep -= 1
+                                        if warning:
+                                                info.append(('[make leaf]', line))
                                 else:
                                         vline = FTraceLine(lasttime)
                                         vline.depth = self.depth
-                                        vline.name = virtualfname
+                                        vline.name = self.vfname
                                         vline.fcall = True
-                                        if debug:
-                                                vline.debugPrint()
                                         self.list.append(vline)
                                         self.depth += 1
                                         if not last:
                                                 self.start = vline.time
+                                        if warning:
+                                                info.append(('[add call]', vline))
                                 idx += 1
-                        if debug:
-                                line.debugPrint()
-                                print ''
+                        if warning and ('[make leaf]', line) not in info:
+                                info.append(('', line))
+                if warning:
+                        print 'WARNING: ftrace data missing, corrections made:'
+                        for i in info:
+                                t, obj = i
+                                if obj:
+                                        obj.debugPrint(t)
                 # process the call and set the new depth
-                if(line.fcall and not line.freturn):
-                        self.depth += 1
-                elif(line.freturn and not line.fcall):
+                skipadd = False
+                md = self.sv.max_graph_depth
+                if line.isCall():
+                        # ignore blacklisted/overdepth funcs
+                        if (md and self.depth >= md - 1) or (line.name in self.sv.cgblacklist):
+                                self.ignore = True
+                        else:
+                                self.depth += 1
+                elif line.isReturn():
                         self.depth -= 1
+                        # remove blacklisted/overdepth/empty funcs that slipped through
+                        if (last and last.isCall() and last.depth == line.depth) or \
+                                (md and last and last.depth >= md) or \
+                                (line.name in self.sv.cgblacklist):
+                                while len(self.list) > 0 and self.list[-1].depth > line.depth:
+                                        self.list.pop(-1)
+                                if len(self.list) == 0:
+                                        self.invalid = True
+                                        return 1
+                                self.list[-1].freturn = True
+                                self.list[-1].length = line.time - self.list[-1].time
+                                self.list[-1].name = line.name
+                                skipadd = True
                 if len(self.list) < 1:
                         self.start = line.time
-                self.list.append(line)
+                # check for a mismatch that returned all the way to callgraph end
+                res = 1
+                if mismatch < 0 and self.list[-1].depth == 0 and self.list[-1].freturn:
+                        line = self.list[-1]
+                        skipadd = True
+                        res = -1
+                if not skipadd:
+                        self.list.append(line)
                 if(line.depth == 0 and line.freturn):
                         if(self.start < 0):
                                 self.start = line.time
                         self.end = line.time
                         if line.fcall:
                                 self.end += line.length
-                        if self.list[0].name == virtualfname:
+                        if self.list[0].name == self.vfname:
                                 self.invalid = True
-                        return True
-                return False
+                        if res == -1:
+                                self.partial = True
+                        return res
+                return 0
         def invalidate(self, line):
                 if(len(self.list) > 0):
                         first = self.list[0]
@@ -1668,29 +1870,30 @@ class FTraceCallGraph:
                 id = 'task %s' % (self.pid)
                 window = '(%f - %f)' % (self.start, line.time)
                 if(self.depth < 0):
-                        vprint('Too much data for '+id+\
+                        print('Data misalignment for '+id+\
                                 ' (buffer overflow), ignoring this callback')
                 else:
-                        vprint('Too much data for '+id+\
+                        print('Too much data for '+id+\
                                 ' '+window+', ignoring this callback')
-        def slice(self, t0, tN):
-                minicg = FTraceCallGraph(0)
-                count = -1
-                firstdepth = 0
+        def slice(self, dev):
+                minicg = FTraceCallGraph(dev['pid'], self.sv)
+                minicg.name = self.name
+                mydepth = -1
+                good = False
                 for l in self.list:
-                        if(l.time < t0 or l.time > tN):
+                        if(l.time < dev['start'] or l.time > dev['end']):
                                 continue
-                        if(count < 0):
-                                if(not l.fcall or l.name == 'dev_driver_string'):
-                                        continue
-                                firstdepth = l.depth
-                                count = 0
-                        l.depth -= firstdepth
-                        minicg.addLine(l)
-                        if((count == 0 and l.freturn and l.fcall) or
-                                (count > 0 and l.depth <= 0)):
+                        if mydepth < 0:
+                                if l.name == 'mutex_lock' and l.freturn:
+                                        mydepth = l.depth
+                                continue
+                        elif l.depth == mydepth and l.name == 'mutex_unlock' and l.fcall:
+                                good = True
                                 break
-                        count += 1
+                        l.depth -= mydepth
+                        minicg.addLine(l)
+                if not good or len(minicg.list) < 1:
+                        return 0
                 return minicg
         def repair(self, enddepth):
                 # bring the depth back to 0 with additional returns
@@ -1701,11 +1904,11 @@ class FTraceCallGraph:
                         t.depth = i
                         t.freturn = True
                         fixed = self.addLine(t)
-                        if fixed:
+                        if fixed != 0:
                                 self.end = last.time
                                 return True
                 return False
-        def postProcess(self, debug=False):
+        def postProcess(self):
                 if len(self.list) > 0:
                         self.name = self.list[0].name
                 stack = dict()
@@ -1714,20 +1917,23 @@ class FTraceCallGraph:
                 for l in self.list:
                         # ftrace bug: reported duration is not reliable
                         # check each leaf and clip it at max possible length
-                        if(last and last.freturn and last.fcall):
+                        if last and last.isLeaf():
                                 if last.length > l.time - last.time:
                                         last.length = l.time - last.time
-                        if(l.fcall and not l.freturn):
+                        if l.isCall():
                                 stack[l.depth] = l
                                 cnt += 1
-                        elif(l.freturn and not l.fcall):
+                        elif l.isReturn():
                                 if(l.depth not in stack):
-                                        if debug:
+                                        if self.sv.verbose:
                                                 print 'Post Process Error: Depth missing'
                                                 l.debugPrint()
                                         return False
                                 # calculate call length from call/return lines
-                                stack[l.depth].length = l.time - stack[l.depth].time
+                                cl = stack[l.depth]
+                                cl.length = l.time - cl.time
+                                if cl.name == self.vfname:
+                                        cl.name = l.name
                                 stack.pop(l.depth)
                                 l.length = 0
                                 cnt -= 1
@@ -1736,13 +1942,13 @@ class FTraceCallGraph:
                         # trace caught the whole call tree
                         return True
                 elif(cnt < 0):
-                        if debug:
+                        if self.sv.verbose:
                                 print 'Post Process Error: Depth is less than 0'
                         return False
                 # trace ended before call tree finished
                 return self.repair(cnt)
         def deviceMatch(self, pid, data):
-                found = False
+                found = ''
                 # add the callgraph data to the device hierarchy
                 borderphase = {
                         'dpm_prepare': 'suspend_prepare',
@@ -1756,8 +1962,10 @@ class FTraceCallGraph:
                                 if(pid == dev['pid'] and
                                         self.start <= dev['start'] and
                                         self.end >= dev['end']):
-                                        dev['ftrace'] = self.slice(dev['start'], dev['end'])
-                                        found = True
+                                        cg = self.slice(dev)
+                                        if cg:
+                                                dev['ftrace'] = cg
+                                        found = devname
                         return found
                 for p in data.phases:
                         if(data.dmesg[p]['start'] <= self.start and
@@ -1769,7 +1977,7 @@ class FTraceCallGraph:
                                                 self.start <= dev['start'] and
                                                 self.end >= dev['end']):
                                                 dev['ftrace'] = self
-                                                found = True
+                                                found = devname
                                                 break
                                 break
                 return found
@@ -1793,18 +2001,20 @@ class FTraceCallGraph:
                 if out:
                         phase, myname = out
                         data.dmesg[phase]['list'][myname]['ftrace'] = self
-        def debugPrint(self):
-                print('[%f - %f] %s (%d)') % (self.start, self.end, self.name, self.pid)
+        def debugPrint(self, info=''):
+                print('%s pid=%d [%f - %f] %.3f us') % \
+                        (self.name, self.pid, self.start, self.end,
+                        (self.end - self.start)*1000000)
                 for l in self.list:
-                        if(l.freturn and l.fcall):
-                                print('%f (%02d): %s(); (%.3f us)' % (l.time, \
-                                        l.depth, l.name, l.length*1000000))
-                        elif(l.freturn):
-                                print('%f (%02d): %s} (%.3f us)' % (l.time, \
-                                        l.depth, l.name, l.length*1000000))
+                        if l.isLeaf():
+                                print('%f (%02d): %s(); (%.3f us)%s' % (l.time, \
+                                        l.depth, l.name, l.length*1000000, info))
+                        elif l.freturn:
+                                print('%f (%02d): %s} (%.3f us)%s' % (l.time, \
+                                        l.depth, l.name, l.length*1000000, info))
                         else:
-                                print('%f (%02d): %s() { (%.3f us)' % (l.time, \
-                                        l.depth, l.name, l.length*1000000))
+                                print('%f (%02d): %s() { (%.3f us)%s' % (l.time, \
+                                        l.depth, l.name, l.length*1000000, info))
                 print(' ')
 
 class DevItem:
@@ -1839,8 +2049,8 @@ class Timeline:
                 self.rowH = rowheight
                 self.scaleH = scaleheight
                 self.html = ''
-        def createHeader(self, sv):
-                if(not sv.stamp['time']):
+        def createHeader(self, sv, stamp):
+                if(not stamp['time']):
                         return
                 self.html += '<div class="version"><a href="https://01.org/suspendresume">%s v%s</a></div>' \
                         % (sv.title, sv.version)
@@ -1851,12 +2061,12 @@ class Timeline:
                 if sv.ftracelog:
                         self.html += '<button id="showftrace" class="logbtn btnfmt">ftrace</button>'
                 headline_stamp = '<div class="stamp">{0} {1} {2} {3}</div>\n'
-                self.html += headline_stamp.format(sv.stamp['host'], sv.stamp['kernel'],
-                        sv.stamp['mode'], sv.stamp['time'])
-                if 'man' in sv.stamp and 'plat' in sv.stamp and 'cpu' in sv.stamp:
+                self.html += headline_stamp.format(stamp['host'], stamp['kernel'],
+                        stamp['mode'], stamp['time'])
+                if 'man' in stamp and 'plat' in stamp and 'cpu' in stamp and \
+                        stamp['man'] and stamp['plat'] and stamp['cpu']:
                         headline_sysinfo = '<div class="stamp sysinfo">{0} {1} <i>with</i> {2}</div>\n'
-                        self.html += headline_sysinfo.format(sv.stamp['man'],
-                                sv.stamp['plat'], sv.stamp['cpu'])
+                        self.html += headline_sysinfo.format(stamp['man'], stamp['plat'], stamp['cpu'])
 
         # Function: getDeviceRows
         # Description:
@@ -2067,12 +2277,16 @@ class Timeline:
 class TestProps:
         stamp = ''
         sysinfo = ''
+        cmdline = ''
+        kparams = ''
         S0i3 = False
         fwdata = []
         stampfmt = '# [a-z]*-(?P<m>[0-9]{2})(?P<d>[0-9]{2})(?P<y>[0-9]{2})-'+\
                                 '(?P<H>[0-9]{2})(?P<M>[0-9]{2})(?P<S>[0-9]{2})'+\
                                 ' (?P<host>.*) (?P<mode>.*) (?P<kernel>.*)$'
         sysinfofmt = '^# sysinfo .*'
+        cmdlinefmt = '^# command \| (?P<cmd>.*)'
+        kparamsfmt = '^# kparams \| (?P<kp>.*)'
         ftrace_line_fmt_fg = \
                 '^ *(?P<time>[0-9\.]*) *\| *(?P<cpu>[0-9]*)\)'+\
                 ' *(?P<proc>.*)-(?P<pid>[0-9]*) *\|'+\
@@ -2116,13 +2330,20 @@ class TestProps:
                 sv.hostname = data.stamp['host']
                 sv.suspendmode = data.stamp['mode']
                 if sv.suspendmode == 'command' and sv.ftracefile != '':
-                        modes = ['on', 'freeze', 'standby', 'mem']
-                        out = Popen(['grep', 'suspend_enter', sv.ftracefile],
+                        modes = ['on', 'freeze', 'standby', 'mem', 'disk']
+                        out = Popen(['grep', 'machine_suspend', sv.ftracefile],
                                 stderr=PIPE, stdout=PIPE).stdout.read()
-                        m = re.match('.* suspend_enter\[(?P<mode>.*)\]', out)
-                        if m and m.group('mode') in ['1', '2', '3']:
+                        m = re.match('.* machine_suspend\[(?P<mode>.*)\]', out)
+                        if m and m.group('mode') in ['1', '2', '3', '4']:
                                 sv.suspendmode = modes[int(m.group('mode'))]
                                 data.stamp['mode'] = sv.suspendmode
+                m = re.match(self.cmdlinefmt, self.cmdline)
+                if m:
+                        sv.cmdline = m.group('cmd')
+                if self.kparams:
+                        m = re.match(self.kparamsfmt, self.kparams)
+                        if m:
+                                sv.kparams = m.group('kp')
                 if not sv.stamp:
                         sv.stamp = data.stamp
 
@@ -2186,47 +2407,43 @@ class ProcessMonitor:
 
 # ----------------- FUNCTIONS --------------------
 
-# Function: vprint
-# Description:
-#        verbose print (prints only with -verbose option)
-# Arguments:
-#        msg: the debug/log message to print
-def vprint(msg):
-        sysvals.logmsg += msg+'\n'
-        if(sysvals.verbose):
-                print(msg)
-
 # Function: doesTraceLogHaveTraceEvents
 # Description:
-#        Quickly determine if the ftrace log has some or all of the trace events
-#        required for primary parsing. Set the usetraceevents and/or
-#        usetraceeventsonly flags in the global sysvals object
+#        Quickly determine if the ftrace log has all of the trace events,
+#        markers, and/or kprobes required for primary parsing.
 def doesTraceLogHaveTraceEvents():
-        # check for kprobes
+        kpcheck = ['_cal: (', '_cpu_down()']
+        techeck = sysvals.traceevents[:]
+        tmcheck = ['SUSPEND START', 'RESUME COMPLETE']
         sysvals.usekprobes = False
-        out = call('grep -q "_cal: (" '+sysvals.ftracefile, shell=True)
-        if(out == 0):
-                sysvals.usekprobes = True
-        # check for callgraph data on trace event blocks
-        out = call('grep -q "_cpu_down()" '+sysvals.ftracefile, shell=True)
-        if(out == 0):
-                sysvals.usekprobes = True
-        out = Popen(['head', '-1', sysvals.ftracefile],
-                stderr=PIPE, stdout=PIPE).stdout.read().replace('\n', '')
-        # figure out what level of trace events are supported
-        sysvals.usetraceeventsonly = True
-        sysvals.usetraceevents = False
-        for e in sysvals.traceevents:
-                out = call('grep -q "'+e+': " '+sysvals.ftracefile, shell=True)
-                if(out != 0):
-                        sysvals.usetraceeventsonly = False
-                if(e == 'suspend_resume' and out == 0):
-                        sysvals.usetraceevents = True
-        # determine is this log is properly formatted
-        for e in ['SUSPEND START', 'RESUME COMPLETE']:
-                out = call('grep -q "'+e+'" '+sysvals.ftracefile, shell=True)
-                if(out != 0):
-                        sysvals.usetracemarkers = False
+        fp = sysvals.openlog(sysvals.ftracefile, 'r')
+        for line in fp:
+                # check for kprobes
+                if not sysvals.usekprobes:
+                        for i in kpcheck:
+                                if i in line:
+                                        sysvals.usekprobes = True
+                # check for all necessary trace events
+                check = techeck[:]
+                for i in techeck:
+                        if i in line:
+                                check.remove(i)
+                techeck = check
+                # check for all necessary trace markers
+                check = tmcheck[:]
+                for i in tmcheck:
+                        if i in line:
+                                check.remove(i)
+                tmcheck = check
+        fp.close()
+        if len(techeck) == 0:
+                sysvals.usetraceevents = True
+        else:
+                sysvals.usetraceevents = False
+        if len(tmcheck) == 0:
+                sysvals.usetracemarkers = True
+        else:
+                sysvals.usetracemarkers = False
 
 # Function: appendIncompleteTraceLog
 # Description:
@@ -2247,9 +2464,10 @@ def appendIncompleteTraceLog(testruns):
                 testrun.append(TestRun(data))
 
         # extract the callgraph and traceevent data
-        vprint('Analyzing the ftrace data...')
+        sysvals.vprint('Analyzing the ftrace data (%s)...' % \
+                os.path.basename(sysvals.ftracefile))
         tp = TestProps()
-        tf = open(sysvals.ftracefile, 'r')
+        tf = sysvals.openlog(sysvals.ftracefile, 'r')
         data = 0
         for line in tf:
                 # remove any latent carriage returns
@@ -2261,6 +2479,9 @@ def appendIncompleteTraceLog(testruns):
                 elif re.match(tp.sysinfofmt, line):
                         tp.sysinfo = line
                         continue
+                elif re.match(tp.cmdlinefmt, line):
+                        tp.cmdline = line
+                        continue
                 # determine the trace data type (required for further parsing)
                 m = re.match(sysvals.tracertypefmt, line)
                 if(m):
@@ -2393,11 +2614,14 @@ def appendIncompleteTraceLog(testruns):
                         # create a callgraph object for the data
                         if(pid not in testrun[testidx].ftemp):
                                 testrun[testidx].ftemp[pid] = []
-                                testrun[testidx].ftemp[pid].append(FTraceCallGraph(pid))
+                                testrun[testidx].ftemp[pid].append(FTraceCallGraph(pid, sysvals))
                         # when the call is finished, see which device matches it
                         cg = testrun[testidx].ftemp[pid][-1]
-                        if(cg.addLine(t)):
-                                testrun[testidx].ftemp[pid].append(FTraceCallGraph(pid))
+                        res = cg.addLine(t)
+                        if(res != 0):
+                                testrun[testidx].ftemp[pid].append(FTraceCallGraph(pid, sysvals))
+                        if(res == -1):
+                                testrun[testidx].ftemp[pid][-1].addLine(t)
         tf.close()
 
         for test in testrun:
@@ -2410,11 +2634,11 @@ def appendIncompleteTraceLog(testruns):
                 # add the callgraph data to the device hierarchy
                 for pid in test.ftemp:
                         for cg in test.ftemp[pid]:
-                                if len(cg.list) < 1 or cg.invalid:
+                                if len(cg.list) < 1 or cg.invalid or (cg.end - cg.start == 0):
                                         continue
                                 if(not cg.postProcess()):
                                         id = 'task %s cpu %s' % (pid, m.group('cpu'))
-                                        vprint('Sanity check failed for '+\
+                                        sysvals.vprint('Sanity check failed for '+\
                                                 id+', ignoring this callback')
                                         continue
                                 callstart = cg.start
@@ -2431,8 +2655,6 @@ def appendIncompleteTraceLog(testruns):
                                                                 dev['ftrace'] = cg
                                                 break
 
-                test.data.printDetails()
-
 # Function: parseTraceLog
 # Description:
 #        Analyze an ftrace log output file generated from this app during
@@ -2441,12 +2663,13 @@ def appendIncompleteTraceLog(testruns):
 #        The ftrace filename is taken from sysvals
 # Output:
 #        An array of Data objects
-def parseTraceLog():
-        vprint('Analyzing the ftrace data...')
+def parseTraceLog(live=False):
+        sysvals.vprint('Analyzing the ftrace data (%s)...' % \
+                os.path.basename(sysvals.ftracefile))
         if(os.path.exists(sysvals.ftracefile) == False):
                 doError('%s does not exist' % sysvals.ftracefile)
-
-        sysvals.setupAllKprobes()
+        if not live:
+                sysvals.setupAllKprobes()
         tracewatch = []
         if sysvals.usekprobes:
                 tracewatch += ['sync_filesystems', 'freeze_processes', 'syscore_suspend',
@@ -2458,7 +2681,7 @@ def parseTraceLog():
         testdata = []
         testrun = 0
         data = 0
-        tf = open(sysvals.ftracefile, 'r')
+        tf = sysvals.openlog(sysvals.ftracefile, 'r')
         phase = 'suspend_prepare'
         for line in tf:
                 # remove any latent carriage returns
@@ -2470,6 +2693,9 @@ def parseTraceLog():
                 elif re.match(tp.sysinfofmt, line):
                         tp.sysinfo = line
                         continue
+                elif re.match(tp.cmdlinefmt, line):
+                        tp.cmdline = line
+                        continue
                 # firmware line: pull out any firmware data
                 m = re.match(sysvals.firmwarefmt, line)
                 if(m):
@@ -2591,6 +2817,8 @@ def parseTraceLog():
                                         phase = 'suspend_prepare'
                                         if(not isbegin):
                                                 data.dmesg[phase]['end'] = t.time
+                                                if data.dmesg[phase]['start'] < 0:
+                                                        data.dmesg[phase]['start'] = data.start
                                         continue
                                 # suspend start
                                 elif(re.match('dpm_suspend\[.*', t.name)):
@@ -2604,6 +2832,8 @@ def parseTraceLog():
                                         continue
                                 # suspend_noirq start
                                 elif(re.match('dpm_suspend_noirq\[.*', t.name)):
+                                        if data.phaseCollision('suspend_noirq', isbegin, line):
+                                                continue
                                         phase = 'suspend_noirq'
                                         data.setPhase(phase, t.time, isbegin)
                                         if(not isbegin):
@@ -2636,6 +2866,8 @@ def parseTraceLog():
                                         continue
                                 # resume_noirq start
                                 elif(re.match('dpm_resume_noirq\[.*', t.name)):
+                                        if data.phaseCollision('resume_noirq', isbegin, line):
+                                                continue
                                         phase = 'resume_noirq'
                                         data.setPhase(phase, t.time, isbegin)
                                         if(isbegin):
@@ -2742,11 +2974,14 @@ def parseTraceLog():
                         key = (m_proc, pid)
                         if(key not in testrun.ftemp):
                                 testrun.ftemp[key] = []
-                                testrun.ftemp[key].append(FTraceCallGraph(pid))
+                                testrun.ftemp[key].append(FTraceCallGraph(pid, sysvals))
                         # when the call is finished, see which device matches it
                         cg = testrun.ftemp[key][-1]
-                        if(cg.addLine(t)):
-                                testrun.ftemp[key].append(FTraceCallGraph(pid))
+                        res = cg.addLine(t)
+                        if(res != 0):
+                                testrun.ftemp[key].append(FTraceCallGraph(pid, sysvals))
+                        if(res == -1):
+                                testrun.ftemp[key][-1].addLine(t)
         tf.close()
 
         if sysvals.suspendmode == 'command':
@@ -2812,28 +3047,31 @@ def parseTraceLog():
                         for key in test.ftemp:
                                 proc, pid = key
                                 for cg in test.ftemp[key]:
-                                        if len(cg.list) < 1 or cg.invalid:
+                                        if len(cg.list) < 1 or cg.invalid or (cg.end - cg.start == 0):
                                                 continue
                                         if(not cg.postProcess()):
                                                 id = 'task %s' % (pid)
-                                                vprint('Sanity check failed for '+\
+                                                sysvals.vprint('Sanity check failed for '+\
                                                         id+', ignoring this callback')
                                                 continue
                                         # match cg data to devices
-                                        if sysvals.suspendmode == 'command' or not cg.deviceMatch(pid, data):
+                                        devname = ''
+                                        if sysvals.suspendmode != 'command':
+                                                devname = cg.deviceMatch(pid, data)
+                                        if not devname:
                                                 sortkey = '%f%f%d' % (cg.start, cg.end, pid)
                                                 sortlist[sortkey] = cg
+                                        elif len(cg.list) > 1000000:
+                                                print 'WARNING: the callgraph for %s is massive (%d lines)' %\
+                                                        (devname, len(cg.list))
                         # create blocks for orphan cg data
                         for sortkey in sorted(sortlist):
                                 cg = sortlist[sortkey]
                                 name = cg.name
                                 if sysvals.isCallgraphFunc(name):
-                                        vprint('Callgraph found for task %d: %.3fms, %s' % (cg.pid, (cg.end - cg.start)*1000, name))
+                                        sysvals.vprint('Callgraph found for task %d: %.3fms, %s' % (cg.pid, (cg.end - cg.start)*1000, name))
                                         cg.newActionFromFunction(data)
-
         if sysvals.suspendmode == 'command':
-                for data in testdata:
-                        data.printDetails()
                 return testdata
 
         # fill in any missing phases
@@ -2841,7 +3079,7 @@ def parseTraceLog():
                 lp = data.phases[0]
                 for p in data.phases:
                         if(data.dmesg[p]['start'] < 0 and data.dmesg[p]['end'] < 0):
-                                vprint('WARNING: phase "%s" is missing!' % p)
+                                sysvals.vprint('WARNING: phase "%s" is missing!' % p)
                         if(data.dmesg[p]['start'] < 0):
                                 data.dmesg[p]['start'] = data.dmesg[lp]['end']
                                 if(p == 'resume_machine'):
@@ -2859,7 +3097,6 @@ def parseTraceLog():
                 data.fixupInitcallsThatDidntReturn()
                 if sysvals.usedevsrc:
                         data.optimizeDevSrc()
-                data.printDetails()
 
         # x2: merge any overlapping devices between test runs
         if sysvals.usedevsrc and len(testdata) > 1:
@@ -2878,19 +3115,18 @@ def parseTraceLog():
 #        The dmesg filename is taken from sysvals
 # Output:
 #        An array of empty Data objects with only their dmesgtext attributes set
-def loadKernelLog(justtext=False):
-        vprint('Analyzing the dmesg data...')
+def loadKernelLog():
+        sysvals.vprint('Analyzing the dmesg data (%s)...' % \
+                os.path.basename(sysvals.dmesgfile))
         if(os.path.exists(sysvals.dmesgfile) == False):
                 doError('%s does not exist' % sysvals.dmesgfile)
 
-        if justtext:
-                dmesgtext = []
         # there can be multiple test runs in a single file
         tp = TestProps()
         tp.stamp = datetime.now().strftime('# suspend-%m%d%y-%H%M%S localhost mem unknown')
         testruns = []
         data = 0
-        lf = open(sysvals.dmesgfile, 'r')
+        lf = sysvals.openlog(sysvals.dmesgfile, 'r')
         for line in lf:
                 line = line.replace('\r\n', '')
                 idx = line.find('[')
@@ -2903,6 +3139,9 @@ def loadKernelLog(justtext=False):
                 elif re.match(tp.sysinfofmt, line):
                         tp.sysinfo = line
                         continue
+                elif re.match(tp.cmdlinefmt, line):
+                        tp.cmdline = line
+                        continue
                 m = re.match(sysvals.firmwarefmt, line)
                 if(m):
                         tp.fwdata.append((int(m.group('s')), int(m.group('r'))))
@@ -2911,9 +3150,6 @@ def loadKernelLog(justtext=False):
                 if(not m):
                         continue
                 msg = m.group("msg")
-                if justtext:
-                        dmesgtext.append(line)
-                        continue
                 if(re.match('PM: Syncing filesystems.*', msg)):
                         if(data):
                                 testruns.append(data)
@@ -2934,8 +3170,6 @@ def loadKernelLog(justtext=False):
                 data.dmesgtext.append(line)
         lf.close()
 
-        if justtext:
-                return dmesgtext
         if data:
                 testruns.append(data)
         if len(testruns) < 1:
@@ -2975,7 +3209,7 @@ def parseKernelLog(data):
         phase = 'suspend_runtime'
 
         if(data.fwValid):
-                vprint('Firmware Suspend = %u ns, Firmware Resume = %u ns' % \
+                sysvals.vprint('Firmware Suspend = %u ns, Firmware Resume = %u ns' % \
                         (data.fwSuspend, data.fwResume))
 
         # dmesg phase match table
@@ -3201,7 +3435,6 @@ def parseKernelLog(data):
                 for event in actions[name]:
                         data.newActionGlobal(name, event['begin'], event['end'])
 
-        data.printDetails()
         if(len(sysvals.devicefilter) > 0):
                 data.deviceFilter(sysvals.devicefilter)
         data.fixupInitcallsThatDidntReturn()
@@ -3230,9 +3463,9 @@ def callgraphHTML(sv, hf, num, cg, title, color, devid):
                 else:
                         fmt = '<n>(%.3f ms @ '+sv.timeformat+')</n>'
                         flen = fmt % (line.length*1000, line.time)
-                if(line.freturn and line.fcall):
+                if line.isLeaf():
                         hf.write(html_func_leaf.format(line.name, flen))
-                elif(line.freturn):
+                elif line.freturn:
                         hf.write(html_func_end)
                 else:
                         hf.write(html_func_start.format(num, line.name, flen))
@@ -3249,7 +3482,7 @@ def addCallgraphs(sv, hf, data):
                         continue
                 list = data.dmesg[p]['list']
                 for devname in data.sortedDevices(p):
-                        if len(sv.devicefilter) > 0 and devname not in sv.devicefilter:
+                        if len(sv.cgfilter) > 0 and devname not in sv.cgfilter:
                                 continue
                         dev = list[devname]
                         color = 'white'
@@ -3270,7 +3503,6 @@ def addCallgraphs(sv, hf, data):
                                 for cg in dev['ftraces']:
                                         num = callgraphHTML(sv, hf, num, cg,
                                                 name+' &rarr; '+cg.name, color, dev['id'])
-
         hf.write('\n\n    </section>\n')
 
 # Function: createHTMLSummarySimple
@@ -3311,7 +3543,7 @@ def createHTMLSummarySimple(testruns, htmlfile, folder):
         sTimeAvg = rTimeAvg = 0.0
         mode = ''
         num = 0
-        for data in sorted(testruns, key=lambda v:(v['mode'], v['host'], v['kernel'])):
+        for data in sorted(testruns, key=lambda v:(v['mode'], v['host'], v['kernel'], v['time'])):
                 if mode != data['mode']:
                         # test average line
                         if(num > 0):
@@ -3387,7 +3619,7 @@ def createHTML(testruns):
                 data.normalizeTime(testruns[-1].tSuspended)
 
         # html function templates
-        html_error = '<div id="{1}" title="kernel error/warning" class="err" style="right:{0}%">ERROR&rarr;</div>\n'
+        html_error = '<div id="{1}" title="kernel error/warning" class="err" style="right:{0}%">{2}&rarr;</div>\n'
         html_traceevent = '<div title="{0}" class="traceevent{6}" style="left:{1}%;top:{2}px;height:{3}px;width:{4}%;line-height:{3}px;{7}">{5}</div>\n'
         html_cpuexec = '<div class="jiffie" style="left:{0}%;top:{1}px;height:{2}px;width:{3}%;background:{4};"></div>\n'
         html_timetotal = '<table class="time1">\n<tr>'\
@@ -3416,20 +3648,17 @@ def createHTML(testruns):
                 scaleH = 40
 
         # device timeline
-        vprint('Creating Device Timeline...')
-
         devtl = Timeline(30, scaleH)
 
         # write the test title and general info header
-        devtl.createHeader(sysvals)
+        devtl.createHeader(sysvals, testruns[0].stamp)
 
         # Generate the header for this timeline
         for data in testruns:
                 tTotal = data.end - data.start
                 sktime, rktime = data.getTimeValues()
                 if(tTotal == 0):
-                        print('ERROR: No timeline data')
-                        sys.exit()
+                        doError('No timeline data')
                 if(data.tLow > 0):
                         low_time = '%.0f'%(data.tLow*1000)
                 if sysvals.suspendmode == 'command':
@@ -3567,9 +3796,10 @@ def createHTML(testruns):
                                         data.dmesg[b]['color'], '')
                         for e in data.errorinfo[dir]:
                                 # draw red lines for any kernel errors found
-                                t, err = e
+                                type, t, idx1, idx2 = e
+                                id = '%d_%d' % (idx1, idx2)
                                 right = '%f' % (((mMax-t)*100.0)/mTotal)
-                                devtl.html += html_error.format(right, err)
+                                devtl.html += html_error.format(right, id, type)
                         for b in sorted(phases[dir]):
                                 # draw the devices for this phase
                                 phaselist = data.dmesg[b]['list']
@@ -3663,14 +3893,7 @@ def createHTML(testruns):
                 devtl.html += '</div>\n'
 
         hf = open(sysvals.htmlfile, 'w')
-
-        # no header or css if its embedded
-        if(sysvals.embedded):
-                hf.write('pass True tSus %.3f tRes %.3f tLow %.3f fwvalid %s tSus %.3f tRes %.3f\n' %
-                        (data.tSuspended-data.start, data.end-data.tSuspended, data.tLow, data.fwValid, \
-                                data.fwSuspend/1000000, data.fwResume/1000000))
-        else:
-                addCSS(hf, sysvals, len(testruns), kerror)
+        addCSS(hf, sysvals, len(testruns), kerror)
 
         # write the device timeline
         hf.write(devtl.html)
@@ -3701,7 +3924,7 @@ def createHTML(testruns):
                 data = testruns[sysvals.cgtest]
         else:
                 data = testruns[-1]
-        if(sysvals.usecallgraph and not sysvals.embedded):
+        if sysvals.usecallgraph:
                 addCallgraphs(sysvals, hf, data)
 
         # add the test log as a hidden div
@@ -3710,7 +3933,7 @@ def createHTML(testruns):
         # add the dmesg log as a hidden div
         if sysvals.dmesglog and sysvals.dmesgfile:
                 hf.write('<div id="dmesglog" style="display:none;">\n')
-                lf = open(sysvals.dmesgfile, 'r')
+                lf = sysvals.openlog(sysvals.dmesgfile, 'r')
                 for line in lf:
                         line = line.replace('<', '&lt').replace('>', '&gt')
                         hf.write(line)
@@ -3719,28 +3942,15 @@ def createHTML(testruns):
         # add the ftrace log as a hidden div
         if sysvals.ftracelog and sysvals.ftracefile:
                 hf.write('<div id="ftracelog" style="display:none;">\n')
-                lf = open(sysvals.ftracefile, 'r')
+                lf = sysvals.openlog(sysvals.ftracefile, 'r')
                 for line in lf:
                         hf.write(line)
                 lf.close()
                 hf.write('</div>\n')
 
-        if(not sysvals.embedded):
-                # write the footer and close
-                addScriptCode(hf, testruns)
-                hf.write('</body>\n</html>\n')
-        else:
-                # embedded out will be loaded in a page, skip the js
-                t0 = (testruns[0].start - testruns[-1].tSuspended) * 1000
-                tMax = (testruns[-1].end - testruns[-1].tSuspended) * 1000
-                # add js code in a div entry for later evaluation
-                detail = 'var bounds = [%f,%f];\n' % (t0, tMax)
-                detail += 'var devtable = [\n'
-                for data in testruns:
-                        topo = data.deviceTopology()
-                        detail += '\t"%s",\n' % (topo)
-                detail += '];\n'
-                hf.write('<div id=customcode style=display:none>\n'+detail+'</div>\n')
+        # write the footer and close
+        addScriptCode(hf, testruns)
+        hf.write('</body>\n</html>\n')
         hf.close()
         return True
 
@@ -4149,9 +4359,25 @@ def addScriptCode(hf, testruns):
         '               win.document.write(html+dt);\n'\
         '       }\n'\
         '       function errWindow() {\n'\
-        '               var text = this.id;\n'\
+        '               var range = this.id.split("_");\n'\
+        '               var idx1 = parseInt(range[0]);\n'\
+        '               var idx2 = parseInt(range[1]);\n'\
         '               var win = window.open();\n'\
-        '               win.document.write("<pre>"+text+"</pre>");\n'\
+        '               var log = document.getElementById("dmesglog");\n'\
+        '               var title = "<title>dmesg log</title>";\n'\
+        '               var text = log.innerHTML.split("\\n");\n'\
+        '               var html = "";\n'\
+        '               for(var i = 0; i < text.length; i++) {\n'\
+        '                       if(i == idx1) {\n'\
+        '                               html += "<e id=target>"+text[i]+"</e>\\n";\n'\
+        '                       } else if(i > idx1 && i <= idx2) {\n'\
+        '                               html += "<e>"+text[i]+"</e>\\n";\n'\
+        '                       } else {\n'\
+        '                               html += text[i]+"\\n";\n'\
+        '                       }\n'\
+        '               }\n'\
+        '               win.document.write("<style>e{color:red}</style>"+title+"<pre>"+html+"</pre>");\n'\
+        '               win.location.hash = "#target";\n'\
         '               win.document.close();\n'\
         '       }\n'\
         '       function logWindow(e) {\n'\
@@ -4219,6 +4445,30 @@ def addScriptCode(hf, testruns):
         '</script>\n'
         hf.write(script_code);
 
+def setRuntimeSuspend(before=True):
+        global sysvals
+        sv = sysvals
+        if sv.rs == 0:
+                return
+        if before:
+                # runtime suspend disable or enable
+                if sv.rs > 0:
+                        sv.rstgt, sv.rsval, sv.rsdir = 'on', 'auto', 'enabled'
+                else:
+                        sv.rstgt, sv.rsval, sv.rsdir = 'auto', 'on', 'disabled'
+                print('CONFIGURING RUNTIME SUSPEND...')
+                sv.rslist = deviceInfo(sv.rstgt)
+                for i in sv.rslist:
+                        sv.setVal(sv.rsval, i)
+                print('runtime suspend %s on all devices (%d changed)' % (sv.rsdir, len(sv.rslist)))
+                print('waiting 5 seconds...')
+                time.sleep(5)
+        else:
+                # runtime suspend re-enable or re-disable
+                for i in sv.rslist:
+                        sv.setVal(sv.rstgt, i)
+                print('runtime suspend settings restored on %d devices' % len(sv.rslist))
+
 # Function: executeSuspend
 # Description:
 #        Execute system suspend through the sysfs interface, then copy the output
@@ -4227,6 +4477,19 @@ def executeSuspend():
         pm = ProcessMonitor()
         tp = sysvals.tpath
         fwdata = []
+        # run these commands to prepare the system for suspend
+        if sysvals.display:
+                if sysvals.display > 0:
+                        print('TURN DISPLAY ON')
+                        call('xset -d :0.0 dpms force suspend', shell=True)
+                        call('xset -d :0.0 dpms force on', shell=True)
+                else:
+                        print('TURN DISPLAY OFF')
+                        call('xset -d :0.0 dpms force suspend', shell=True)
+                time.sleep(1)
+        if sysvals.sync:
+                print('SYNCING FILESYSTEMS')
+                call('sync', shell=True)
         # mark the start point in the kernel ring buffer just as we start
         sysvals.initdmesg()
         # start ftrace
@@ -4298,47 +4561,22 @@ def executeSuspend():
                         pm.stop()
                 sysvals.fsetVal('0', 'tracing_on')
                 print('CAPTURING TRACE')
-                sysvals.writeDatafileHeader(sysvals.ftracefile, fwdata)
-                call('cat '+tp+'trace >> '+sysvals.ftracefile, shell=True)
+                op = sysvals.writeDatafileHeader(sysvals.ftracefile, fwdata)
+                fp = open(tp+'trace', 'r')
+                for line in fp:
+                        op.write(line)
+                op.close()
                 sysvals.fsetVal('', 'trace')
                 devProps()
         # grab a copy of the dmesg output
         print('CAPTURING DMESG')
-        sysvals.writeDatafileHeader(sysvals.dmesgfile, fwdata)
-        sysvals.getdmesg()
+        sysvals.getdmesg(fwdata)
 
-# Function: setUSBDevicesAuto
-# Description:
-#        Set the autosuspend control parameter of all USB devices to auto
-#        This can be dangerous, so use at your own risk, most devices are set
-#        to always-on since the kernel cant determine if the device can
-#        properly autosuspend
-def setUSBDevicesAuto():
-        sysvals.rootCheck(True)
-        for dirname, dirnames, filenames in os.walk('/sys/devices'):
-                if(re.match('.*/usb[0-9]*.*', dirname) and
-                        'idVendor' in filenames and 'idProduct' in filenames):
-                        call('echo auto > %s/power/control' % dirname, shell=True)
-                        name = dirname.split('/')[-1]
-                        desc = Popen(['cat', '%s/product' % dirname],
-                                stderr=PIPE, stdout=PIPE).stdout.read().replace('\n', '')
-                        ctrl = Popen(['cat', '%s/power/control' % dirname],
-                                stderr=PIPE, stdout=PIPE).stdout.read().replace('\n', '')
-                        print('control is %s for %6s: %s' % (ctrl, name, desc))
-
-# Function: yesno
-# Description:
-#        Print out an equivalent Y or N for a set of known parameter values
-# Output:
-#        'Y', 'N', or ' ' if the value is unknown
-def yesno(val):
-        yesvals = ['auto', 'enabled', 'active', '1']
-        novals = ['on', 'disabled', 'suspended', 'forbidden', 'unsupported']
-        if val in yesvals:
-                return 'Y'
-        elif val in novals:
-                return 'N'
-        return ' '
+def readFile(file):
+        if os.path.islink(file):
+                return os.readlink(file).split('/')[-1]
+        else:
+                return sysvals.getVal(file).strip()
 
 # Function: ms2nice
 # Description:
@@ -4346,69 +4584,81 @@ def yesno(val):
 # Output:
 #        The time string, e.g. "1901m16s"
 def ms2nice(val):
-        ms = 0
-        try:
-                ms = int(val)
-        except:
-                return 0.0
-        m = ms / 60000
-        s = (ms / 1000) - (m * 60)
-        return '%3dm%2ds' % (m, s)
+        val = int(val)
+        h = val / 3600000
+        m = (val / 60000) % 60
+        s = (val / 1000) % 60
+        if h > 0:
+                return '%d:%02d:%02d' % (h, m, s)
+        if m > 0:
+                return '%02d:%02d' % (m, s)
+        return '%ds' % s
 
-# Function: detectUSB
+def yesno(val):
+        list = {'enabled':'A', 'disabled':'S', 'auto':'E', 'on':'D',
+                'active':'A', 'suspended':'S', 'suspending':'S'}
+        if val not in list:
+                return ' '
+        return list[val]
+
+# Function: deviceInfo
 # Description:
 #        Detect all the USB hosts and devices currently connected and add
 #        a list of USB device names to sysvals for better timeline readability
-def detectUSB():
-        field = {'idVendor':'', 'idProduct':'', 'product':'', 'speed':''}
-        power = {'async':'', 'autosuspend':'', 'autosuspend_delay_ms':'',
-                         'control':'', 'persist':'', 'runtime_enabled':'',
-                         'runtime_status':'', 'runtime_usage':'',
-                        'runtime_active_time':'',
-                        'runtime_suspended_time':'',
-                        'active_duration':'',
-                        'connected_duration':''}
-
-        print('LEGEND')
-        print('---------------------------------------------------------------------------------------------')
-        print('  A = async/sync PM queue Y/N                       D = autosuspend delay (seconds)')
-        print('  S = autosuspend Y/N                         rACTIVE = runtime active (min/sec)')
-        print('  P = persist across suspend Y/N              rSUSPEN = runtime suspend (min/sec)')
-        print('  E = runtime suspend enabled/forbidden Y/N    ACTIVE = active duration (min/sec)')
-        print('  R = runtime status active/suspended Y/N     CONNECT = connected duration (min/sec)')
-        print('  U = runtime usage count')
-        print('---------------------------------------------------------------------------------------------')
-        print('  NAME       ID      DESCRIPTION         SPEED A S P E R U D rACTIVE rSUSPEN  ACTIVE CONNECT')
-        print('---------------------------------------------------------------------------------------------')
-
+def deviceInfo(output=''):
+        if not output:
+                print('LEGEND')
+                print('---------------------------------------------------------------------------------------------')
+                print('  A = async/sync PM queue (A/S)               C = runtime active children')
+                print('  R = runtime suspend enabled/disabled (E/D)  rACTIVE = runtime active (min/sec)')
+                print('  S = runtime status active/suspended (A/S)   rSUSPEND = runtime suspend (min/sec)')
+                print('  U = runtime usage count')
+                print('---------------------------------------------------------------------------------------------')
+                print('DEVICE                     NAME                       A R S U C    rACTIVE   rSUSPEND')
+                print('---------------------------------------------------------------------------------------------')
+
+        res = []
+        tgtval = 'runtime_status'
+        lines = dict()
         for dirname, dirnames, filenames in os.walk('/sys/devices'):
-                if(re.match('.*/usb[0-9]*.*', dirname) and
-                        'idVendor' in filenames and 'idProduct' in filenames):
-                        for i in field:
-                                field[i] = Popen(['cat', '%s/%s' % (dirname, i)],
-                                        stderr=PIPE, stdout=PIPE).stdout.read().replace('\n', '')
-                        name = dirname.split('/')[-1]
-                        for i in power:
-                                power[i] = Popen(['cat', '%s/power/%s' % (dirname, i)],
-                                        stderr=PIPE, stdout=PIPE).stdout.read().replace('\n', '')
-                        if(re.match('usb[0-9]*', name)):
-                                first = '%-8s' % name
-                        else:
-                                first = '%8s' % name
-                        print('%s [%s:%s] %-20s %-4s %1s %1s %1s %1s %1s %1s %1s %s %s %s %s' % \
-                                (first, field['idVendor'], field['idProduct'], \
-                                field['product'][0:20], field['speed'], \
-                                yesno(power['async']), \
-                                yesno(power['control']), \
-                                yesno(power['persist']), \
-                                yesno(power['runtime_enabled']), \
-                                yesno(power['runtime_status']), \
-                                power['runtime_usage'], \
-                                power['autosuspend'], \
-                                ms2nice(power['runtime_active_time']), \
-                                ms2nice(power['runtime_suspended_time']), \
-                                ms2nice(power['active_duration']), \
-                                ms2nice(power['connected_duration'])))
+                if(not re.match('.*/power', dirname) or
+                        'control' not in filenames or
+                        tgtval not in filenames):
+                        continue
+                name = ''
+                dirname = dirname[:-6]
+                device = dirname.split('/')[-1]
+                power = dict()
+                power[tgtval] = readFile('%s/power/%s' % (dirname, tgtval))
+                # only list devices which support runtime suspend
+                if power[tgtval] not in ['active', 'suspended', 'suspending']:
+                        continue
+                for i in ['product', 'driver', 'subsystem']:
+                        file = '%s/%s' % (dirname, i)
+                        if os.path.exists(file):
+                                name = readFile(file)
+                                break
+                for i in ['async', 'control', 'runtime_status', 'runtime_usage',
+                        'runtime_active_kids', 'runtime_active_time',
+                        'runtime_suspended_time']:
+                        if i in filenames:
+                                power[i] = readFile('%s/power/%s' % (dirname, i))
+                if output:
+                        if power['control'] == output:
+                                res.append('%s/power/control' % dirname)
+                        continue
+                lines[dirname] = '%-26s %-26s %1s %1s %1s %1s %1s %10s %10s' % \
+                        (device[:26], name[:26],
+                        yesno(power['async']), \
+                        yesno(power['control']), \
+                        yesno(power['runtime_status']), \
+                        power['runtime_usage'], \
+                        power['runtime_active_kids'], \
+                        ms2nice(power['runtime_active_time']), \
+                        ms2nice(power['runtime_suspended_time']))
+        for i in sorted(lines):
+                print lines[i]
+        return res
 
 # Function: devProps
 # Description:
@@ -4444,7 +4694,7 @@ def devProps(data=0):
         msghead = 'Additional data added by AnalyzeSuspend'
         alreadystamped = False
         tp = TestProps()
-        tf = open(sysvals.ftracefile, 'r')
+        tf = sysvals.openlog(sysvals.ftracefile, 'r')
         for line in tf:
                 if msghead in line:
                         alreadystamped = True
@@ -4469,7 +4719,7 @@ def devProps(data=0):
         if not alreadystamped and sysvals.suspendmode == 'command':
                 out = '#\n# '+msghead+'\n# Device Properties: '
                 out += 'testcommandstring,%s,0;' % (sysvals.testcommand)
-                with open(sysvals.ftracefile, 'a') as fp:
+                with sysvals.openlog(sysvals.ftracefile, 'a') as fp:
                         fp.write(out+'\n')
                 sysvals.devprops = props
                 return
@@ -4526,7 +4776,7 @@ def devProps(data=0):
                 out = '#\n# '+msghead+'\n# Device Properties: '
                 for dev in sorted(props):
                         out += props[dev].out(dev)
-                with open(sysvals.ftracefile, 'a') as fp:
+                with sysvals.openlog(sysvals.ftracefile, 'a') as fp:
                         fp.write(out+'\n')
 
         sysvals.devprops = props
@@ -4869,20 +5119,12 @@ def statusCheck(probecheck=False):
         # what data source are we using
         res = 'DMESG'
         if(ftgood):
-                sysvals.usetraceeventsonly = True
-                sysvals.usetraceevents = False
+                sysvals.usetraceevents = True
                 for e in sysvals.traceevents:
-                        check = False
-                        if(os.path.exists(sysvals.epath+e)):
-                                check = True
-                        if(not check):
-                                sysvals.usetraceeventsonly = False
-                        if(e == 'suspend_resume' and check):
-                                sysvals.usetraceevents = True
-                if(sysvals.usetraceevents and sysvals.usetraceeventsonly):
+                        if not os.path.exists(sysvals.epath+e):
+                                sysvals.usetraceevents = False
+                if(sysvals.usetraceevents):
                         res = 'FTRACE (all trace events found)'
-                elif(sysvals.usetraceevents):
-                        res = 'DMESG and FTRACE (suspend_resume trace event found)'
         print('    timeline data source: %s' % res)
 
         # check if rtcwake
@@ -4917,6 +5159,7 @@ def doError(msg, help=False):
         if(help == True):
                 printHelp()
         print('ERROR: %s\n') % msg
+        sysvals.outputResult({'error':msg})
         sys.exit()
 
 # Function: getArgInt
@@ -4957,22 +5200,36 @@ def getArgFloat(name, args, min, max, main=True):
                 doError(name+': value should be between %f and %f' % (min, max), True)
         return val
 
-def processData():
+def processData(live=False):
         print('PROCESSING DATA')
-        if(sysvals.usetraceeventsonly):
-                testruns = parseTraceLog()
+        if(sysvals.usetraceevents):
+                testruns = parseTraceLog(live)
                 if sysvals.dmesgfile:
-                        dmesgtext = loadKernelLog(True)
                         for data in testruns:
-                                data.extractErrorInfo(dmesgtext)
+                                data.extractErrorInfo()
         else:
                 testruns = loadKernelLog()
                 for data in testruns:
                         parseKernelLog(data)
                 if(sysvals.ftracefile and (sysvals.usecallgraph or sysvals.usetraceevents)):
                         appendIncompleteTraceLog(testruns)
+        sysvals.vprint('Command:\n    %s' % sysvals.cmdline)
+        for data in testruns:
+                data.printDetails()
+        if sysvals.cgdump:
+                for data in testruns:
+                        data.debugPrint()
+                sys.exit()
+
+        sysvals.vprint('Creating the html timeline (%s)...' % sysvals.htmlfile)
         createHTML(testruns)
-        return testruns
+        print('DONE')
+        data = testruns[0]
+        stamp = data.stamp
+        stamp['suspend'], stamp['resume'] = data.getTimeValues()
+        if data.fwValid:
+                stamp['fwsuspend'], stamp['fwresume'] = data.fwSuspend, data.fwResume
+        return (testruns, stamp)
 
 # Function: rerunTest
 # Description:
@@ -4980,37 +5237,36 @@ def processData():
 def rerunTest():
         if sysvals.ftracefile:
                 doesTraceLogHaveTraceEvents()
-        if not sysvals.dmesgfile and not sysvals.usetraceeventsonly:
+        if not sysvals.dmesgfile and not sysvals.usetraceevents:
                 doError('recreating this html output requires a dmesg file')
         sysvals.setOutputFile()
-        vprint('Output file: %s' % sysvals.htmlfile)
         if os.path.exists(sysvals.htmlfile):
                 if not os.path.isfile(sysvals.htmlfile):
                         doError('a directory already exists with this name: %s' % sysvals.htmlfile)
                 elif not os.access(sysvals.htmlfile, os.W_OK):
                         doError('missing permission to write to %s' % sysvals.htmlfile)
-        return processData()
+        testruns, stamp = processData(False)
+        return stamp
 
 # Function: runTest
 # Description:
 #        execute a suspend/resume, gather the logs, and generate the output
-def runTest():
+def runTest(n=0):
         # prepare for the test
         sysvals.initFtrace()
         sysvals.initTestOutput('suspend')
-        vprint('Output files:\n\t%s\n\t%s\n\t%s' % \
-                (sysvals.dmesgfile, sysvals.ftracefile, sysvals.htmlfile))
 
         # execute the test
         executeSuspend()
         sysvals.cleanupFtrace()
-        processData()
-
-        # if running as root, change output dir owner to sudo_user
-        if os.path.isdir(sysvals.testdir) and os.getuid() == 0 and \
-                'SUDO_USER' in os.environ:
-                cmd = 'chown -R {0}:{0} {1} > /dev/null 2>&1'
-                call(cmd.format(os.environ['SUDO_USER'], sysvals.testdir), shell=True)
+        if sysvals.skiphtml:
+                sysvals.sudouser(sysvals.testdir)
+                return
+        testruns, stamp = processData(True)
+        for data in testruns:
+                del data
+        sysvals.sudouser(sysvals.testdir)
+        sysvals.outputResult(stamp, n)
 
 def find_in_html(html, strs, div=False):
         for str in strs:
@@ -5072,10 +5328,12 @@ def runSummary(subdir, local=True):
 # Function: checkArgBool
 # Description:
 #        check if a boolean string value is true or false
-def checkArgBool(value):
-        yes = ['1', 'true', 'yes', 'on']
-        if value.lower() in yes:
+def checkArgBool(name, value):
+        if value in switchvalues:
+                if value in switchoff:
+                        return False
                 return True
+        doError('invalid boolean --> (%s: %s), use "true/false" or "1/0"' % (name, value), True)
         return False
 
 # Function: configFromFile
@@ -5091,60 +5349,116 @@ def configFromFile(file):
         if 'Settings' in sections:
                 for opt in Config.options('Settings'):
                         value = Config.get('Settings', opt).lower()
-                        if(opt.lower() == 'verbose'):
-                                sysvals.verbose = checkArgBool(value)
-                        elif(opt.lower() == 'addlogs'):
-                                sysvals.dmesglog = sysvals.ftracelog = checkArgBool(value)
-                        elif(opt.lower() == 'dev'):
-                                sysvals.usedevsrc = checkArgBool(value)
-                        elif(opt.lower() == 'proc'):
-                                sysvals.useprocmon = checkArgBool(value)
-                        elif(opt.lower() == 'x2'):
-                                if checkArgBool(value):
+                        option = opt.lower()
+                        if(option == 'verbose'):
+                                sysvals.verbose = checkArgBool(option, value)
+                        elif(option == 'addlogs'):
+                                sysvals.dmesglog = sysvals.ftracelog = checkArgBool(option, value)
+                        elif(option == 'dev'):
+                                sysvals.usedevsrc = checkArgBool(option, value)
+                        elif(option == 'proc'):
+                                sysvals.useprocmon = checkArgBool(option, value)
+                        elif(option == 'x2'):
+                                if checkArgBool(option, value):
                                         sysvals.execcount = 2
-                        elif(opt.lower() == 'callgraph'):
-                                sysvals.usecallgraph = checkArgBool(value)
-                        elif(opt.lower() == 'override-timeline-functions'):
-                                overridekprobes = checkArgBool(value)
-                        elif(opt.lower() == 'override-dev-timeline-functions'):
-                                overridedevkprobes = checkArgBool(value)
-                        elif(opt.lower() == 'devicefilter'):
+                        elif(option == 'callgraph'):
+                                sysvals.usecallgraph = checkArgBool(option, value)
+                        elif(option == 'override-timeline-functions'):
+                                overridekprobes = checkArgBool(option, value)
+                        elif(option == 'override-dev-timeline-functions'):
+                                overridedevkprobes = checkArgBool(option, value)
+                        elif(option == 'skiphtml'):
+                                sysvals.skiphtml = checkArgBool(option, value)
+                        elif(option == 'sync'):
+                                sysvals.sync = checkArgBool(option, value)
+                        elif(option == 'rs' or option == 'runtimesuspend'):
+                                if value in switchvalues:
+                                        if value in switchoff:
+                                                sysvals.rs = -1
+                                        else:
+                                                sysvals.rs = 1
+                                else:
+                                        doError('invalid value --> (%s: %s), use "enable/disable"' % (option, value), True)
+                        elif(option == 'display'):
+                                if value in switchvalues:
+                                        if value in switchoff:
+                                                sysvals.display = -1
+                                        else:
+                                                sysvals.display = 1
+                                else:
+                                        doError('invalid value --> (%s: %s), use "on/off"' % (option, value), True)
+                        elif(option == 'gzip'):
+                                sysvals.gzip = checkArgBool(option, value)
+                        elif(option == 'cgfilter'):
+                                sysvals.setCallgraphFilter(value)
+                        elif(option == 'cgskip'):
+                                if value in switchoff:
+                                        sysvals.cgskip = ''
+                                else:
+                                        sysvals.cgskip = sysvals.configFile(val)
+                                        if(not sysvals.cgskip):
+                                                doError('%s does not exist' % sysvals.cgskip)
+                        elif(option == 'cgtest'):
+                                sysvals.cgtest = getArgInt('cgtest', value, 0, 1, False)
+                        elif(option == 'cgphase'):
+                                d = Data(0)
+                                if value not in d.phases:
+                                        doError('invalid phase --> (%s: %s), valid phases are %s'\
+                                                % (option, value, d.phases), True)
+                                sysvals.cgphase = value
+                        elif(option == 'fadd'):
+                                file = sysvals.configFile(value)
+                                if(not file):
+                                        doError('%s does not exist' % value)
+                                sysvals.addFtraceFilterFunctions(file)
+                        elif(option == 'result'):
+                                sysvals.result = value
+                        elif(option == 'multi'):
+                                nums = value.split()
+                                if len(nums) != 2:
+                                        doError('multi requires 2 integers (exec_count and delay)', True)
+                                sysvals.multitest['run'] = True
+                                sysvals.multitest['count'] = getArgInt('multi: n d (exec count)', nums[0], 2, 1000000, False)
+                                sysvals.multitest['delay'] = getArgInt('multi: n d (delay between tests)', nums[1], 0, 3600, False)
+                        elif(option == 'devicefilter'):
                                 sysvals.setDeviceFilter(value)
-                        elif(opt.lower() == 'expandcg'):
-                                sysvals.cgexp = checkArgBool(value)
-                        elif(opt.lower() == 'srgap'):
-                                if checkArgBool(value):
+                        elif(option == 'expandcg'):
+                                sysvals.cgexp = checkArgBool(option, value)
+                        elif(option == 'srgap'):
+                                if checkArgBool(option, value):
                                         sysvals.srgap = 5
-                        elif(opt.lower() == 'mode'):
+                        elif(option == 'mode'):
                                 sysvals.suspendmode = value
-                        elif(opt.lower() == 'command'):
+                        elif(option == 'command' or option == 'cmd'):
                                 sysvals.testcommand = value
-                        elif(opt.lower() == 'x2delay'):
-                                sysvals.x2delay = getArgInt('-x2delay', value, 0, 60000, False)
-                        elif(opt.lower() == 'predelay'):
-                                sysvals.predelay = getArgInt('-predelay', value, 0, 60000, False)
-                        elif(opt.lower() == 'postdelay'):
-                                sysvals.postdelay = getArgInt('-postdelay', value, 0, 60000, False)
-                        elif(opt.lower() == 'maxdepth'):
-                                sysvals.max_graph_depth = getArgInt('-maxdepth', value, 0, 1000, False)
-                        elif(opt.lower() == 'rtcwake'):
-                                if value.lower() == 'off':
+                        elif(option == 'x2delay'):
+                                sysvals.x2delay = getArgInt('x2delay', value, 0, 60000, False)
+                        elif(option == 'predelay'):
+                                sysvals.predelay = getArgInt('predelay', value, 0, 60000, False)
+                        elif(option == 'postdelay'):
+                                sysvals.postdelay = getArgInt('postdelay', value, 0, 60000, False)
+                        elif(option == 'maxdepth'):
+                                sysvals.max_graph_depth = getArgInt('maxdepth', value, 0, 1000, False)
+                        elif(option == 'rtcwake'):
+                                if value in switchoff:
                                         sysvals.rtcwake = False
                                 else:
                                         sysvals.rtcwake = True
-                                        sysvals.rtcwaketime = getArgInt('-rtcwake', value, 0, 3600, False)
-                        elif(opt.lower() == 'timeprec'):
-                                sysvals.setPrecision(getArgInt('-timeprec', value, 0, 6, False))
-                        elif(opt.lower() == 'mindev'):
-                                sysvals.mindevlen = getArgFloat('-mindev', value, 0.0, 10000.0, False)
-                        elif(opt.lower() == 'callloop-maxgap'):
-                                sysvals.callloopmaxgap = getArgFloat('-callloop-maxgap', value, 0.0, 1.0, False)
-                        elif(opt.lower() == 'callloop-maxlen'):
-                                sysvals.callloopmaxgap = getArgFloat('-callloop-maxlen', value, 0.0, 1.0, False)
-                        elif(opt.lower() == 'mincg'):
-                                sysvals.mincglen = getArgFloat('-mincg', value, 0.0, 10000.0, False)
-                        elif(opt.lower() == 'output-dir'):
-                                sysvals.testdir = sysvals.setOutputFolder(value)
+                                        sysvals.rtcwaketime = getArgInt('rtcwake', value, 0, 3600, False)
+                        elif(option == 'timeprec'):
+                                sysvals.setPrecision(getArgInt('timeprec', value, 0, 6, False))
+                        elif(option == 'mindev'):
+                                sysvals.mindevlen = getArgFloat('mindev', value, 0.0, 10000.0, False)
+                        elif(option == 'callloop-maxgap'):
+                                sysvals.callloopmaxgap = getArgFloat('callloop-maxgap', value, 0.0, 1.0, False)
+                        elif(option == 'callloop-maxlen'):
+                                sysvals.callloopmaxgap = getArgFloat('callloop-maxlen', value, 0.0, 1.0, False)
+                        elif(option == 'mincg'):
+                                sysvals.mincglen = getArgFloat('mincg', value, 0.0, 10000.0, False)
+                        elif(option == 'bufsize'):
+                                sysvals.bufsize = getArgInt('bufsize', value, 1, 1024*1024*8, False)
+                        elif(option == 'output-dir'):
+                                sysvals.outdir = sysvals.setOutputFolder(value)
 
         if sysvals.suspendmode == 'command' and not sysvals.testcommand:
                 doError('No command supplied for mode "command"')
@@ -5259,7 +5573,14 @@ def printHelp():
         print('   -rtcwake t   Wakeup t seconds after suspend, set t to "off" to disable (default: 15)')
         print('   -addlogs     Add the dmesg and ftrace logs to the html output')
         print('   -srgap       Add a visible gap in the timeline between sus/res (default: disabled)')
+        print('   -skiphtml    Run the test and capture the trace logs, but skip the timeline (default: disabled)')
+        print('   -result fn   Export a results table to a text file for parsing.')
+        print('  [testprep]')
+        print('   -sync        Sync the filesystems before starting the test')
+        print('   -rs on/off   Enable/disable runtime suspend for all devices, restore all after test')
+        print('   -display on/off  Turn the display on or off for the test')
         print('  [advanced]')
+        print('   -gzip        Gzip the trace and dmesg logs to save space')
         print('   -cmd {s}     Run the timeline over a custom command, e.g. "sync -d"')
         print('   -proc        Add usermode process info into the timeline (default: disabled)')
         print('   -dev         Add kernel function calls and threads to the timeline (default: disabled)')
@@ -5280,14 +5601,16 @@ def printHelp():
         print('   -cgphase P   Only show callgraph data for phase P (e.g. suspend_late)')
         print('   -cgtest N    Only show callgraph data for test N (e.g. 0 or 1 in an x2 run)')
         print('   -timeprec N  Number of significant digits in timestamps (0:S, [3:ms], 6:us)')
+        print('   -cgfilter S  Filter the callgraph output in the timeline')
+        print('   -cgskip file Callgraph functions to skip, off to disable (default: cgskip.txt)')
+        print('   -bufsize N   Set trace buffer size to N kilo-bytes (default: all of free memory)')
         print('')
         print('Other commands:')
         print('   -modes       List available suspend modes')
         print('   -status      Test to see if the system is enabled to run this tool')
         print('   -fpdt        Print out the contents of the ACPI Firmware Performance Data Table')
         print('   -sysinfo     Print out system info extracted from BIOS')
-        print('   -usbtopo     Print out the current USB topology with power info')
-        print('   -usbauto     Enable autosuspend for all connected USB devices')
+        print('   -devinfo     Print out the pm settings of all devices which support runtime suspend')
         print('   -flist       Print the list of functions currently being captured in ftrace')
         print('   -flistall    Print all functions capable of being captured in ftrace')
         print('   -summary directory  Create a summary of all test in this dir')
@@ -5301,9 +5624,9 @@ def printHelp():
 # exec start (skipped if script is loaded as library)
 if __name__ == '__main__':
         cmd = ''
-        outdir = ''
-        multitest = {'run': False, 'count': 0, 'delay': 0}
-        simplecmds = ['-sysinfo', '-modes', '-fpdt', '-flist', '-flistall', '-usbtopo', '-usbauto', '-status']
+        simplecmds = ['-sysinfo', '-modes', '-fpdt', '-flist', '-flistall', '-devinfo', '-status']
+        if '-f' in sys.argv:
+                sysvals.cgskip = sysvals.configFile('cgskip.txt')
         # loop through the command line arguments
         args = iter(sys.argv[1:])
         for arg in args:
@@ -5333,6 +5656,10 @@ if __name__ == '__main__':
                         sysvals.postdelay = getArgInt('-postdelay', args, 0, 60000)
                 elif(arg == '-f'):
                         sysvals.usecallgraph = True
+                elif(arg == '-skiphtml'):
+                        sysvals.skiphtml = True
+                elif(arg == '-cgdump'):
+                        sysvals.cgdump = True
                 elif(arg == '-addlogs'):
                         sysvals.dmesglog = sysvals.ftracelog = True
                 elif(arg == '-verbose'):
@@ -5341,6 +5668,34 @@ if __name__ == '__main__':
                         sysvals.useprocmon = True
                 elif(arg == '-dev'):
                         sysvals.usedevsrc = True
+                elif(arg == '-sync'):
+                        sysvals.sync = True
+                elif(arg == '-gzip'):
+                        sysvals.gzip = True
+                elif(arg == '-rs'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('-rs requires "enable" or "disable"', True)
+                        if val.lower() in switchvalues:
+                                if val.lower() in switchoff:
+                                        sysvals.rs = -1
+                                else:
+                                        sysvals.rs = 1
+                        else:
+                                doError('invalid option: %s, use "enable/disable" or "on/off"' % val, True)
+                elif(arg == '-display'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('-display requires "on" or "off"', True)
+                        if val.lower() in switchvalues:
+                                if val.lower() in switchoff:
+                                        sysvals.display = -1
+                                else:
+                                        sysvals.display = 1
+                        else:
+                                doError('invalid option: %s, use "on/off"' % val, True)
                 elif(arg == '-maxdepth'):
                         sysvals.max_graph_depth = getArgInt('-maxdepth', args, 0, 1000)
                 elif(arg == '-rtcwake'):
@@ -5348,7 +5703,7 @@ if __name__ == '__main__':
                                 val = args.next()
                         except:
                                 doError('No rtcwake time supplied', True)
-                        if val.lower() == 'off':
+                        if val.lower() in switchoff:
                                 sysvals.rtcwake = False
                         else:
                                 sysvals.rtcwake = True
@@ -5359,6 +5714,8 @@ if __name__ == '__main__':
                         sysvals.mindevlen = getArgFloat('-mindev', args, 0.0, 10000.0)
                 elif(arg == '-mincg'):
                         sysvals.mincglen = getArgFloat('-mincg', args, 0.0, 10000.0)
+                elif(arg == '-bufsize'):
+                        sysvals.bufsize = getArgInt('-bufsize', args, 1, 1024*1024*8)
                 elif(arg == '-cgtest'):
                         sysvals.cgtest = getArgInt('-cgtest', args, 0, 1)
                 elif(arg == '-cgphase'):
@@ -5368,8 +5725,26 @@ if __name__ == '__main__':
                                 doError('No phase name supplied', True)
                         d = Data(0)
                         if val not in d.phases:
-                                doError('Invalid phase, valid phaess are %s' % d.phases, True)
+                                doError('invalid phase --> (%s: %s), valid phases are %s'\
+                                        % (arg, val, d.phases), True)
                         sysvals.cgphase = val
+                elif(arg == '-cgfilter'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('No callgraph functions supplied', True)
+                        sysvals.setCallgraphFilter(val)
+                elif(arg == '-cgskip'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('No file supplied', True)
+                        if val.lower() in switchoff:
+                                sysvals.cgskip = ''
+                        else:
+                                sysvals.cgskip = sysvals.configFile(val)
+                                if(not sysvals.cgskip):
+                                        doError('%s does not exist' % sysvals.cgskip)
                 elif(arg == '-callloop-maxgap'):
                         sysvals.callloopmaxgap = getArgFloat('-callloop-maxgap', args, 0.0, 1.0)
                 elif(arg == '-callloop-maxlen'):
@@ -5386,31 +5761,33 @@ if __name__ == '__main__':
                 elif(arg == '-srgap'):
                         sysvals.srgap = 5
                 elif(arg == '-multi'):
-                        multitest['run'] = True
-                        multitest['count'] = getArgInt('-multi n (exec count)', args, 2, 1000000)
-                        multitest['delay'] = getArgInt('-multi d (delay between tests)', args, 0, 3600)
+                        sysvals.multitest['run'] = True
+                        sysvals.multitest['count'] = getArgInt('-multi n d (exec count)', args, 2, 1000000)
+                        sysvals.multitest['delay'] = getArgInt('-multi n d (delay between tests)', args, 0, 3600)
                 elif(arg == '-o'):
                         try:
                                 val = args.next()
                         except:
                                 doError('No subdirectory name supplied', True)
-                        outdir = sysvals.setOutputFolder(val)
+                        sysvals.outdir = sysvals.setOutputFolder(val)
                 elif(arg == '-config'):
                         try:
                                 val = args.next()
                         except:
                                 doError('No text file supplied', True)
-                        if(os.path.exists(val) == False):
+                        file = sysvals.configFile(val)
+                        if(not file):
                                 doError('%s does not exist' % val)
-                        configFromFile(val)
+                        configFromFile(file)
                 elif(arg == '-fadd'):
                         try:
                                 val = args.next()
                         except:
                                 doError('No text file supplied', True)
-                        if(os.path.exists(val) == False):
+                        file = sysvals.configFile(val)
+                        if(not file):
                                 doError('%s does not exist' % val)
-                        sysvals.addFtraceFilterFunctions(val)
+                        sysvals.addFtraceFilterFunctions(file)
                 elif(arg == '-dmesg'):
                         try:
                                 val = args.next()
@@ -5435,7 +5812,7 @@ if __name__ == '__main__':
                         except:
                                 doError('No directory supplied', True)
                         cmd = 'summary'
-                        outdir = val
+                        sysvals.outdir = val
                         sysvals.notestrun = True
                         if(os.path.isdir(val) == False):
                                 doError('%s is not accesible' % val)
@@ -5445,6 +5822,12 @@ if __name__ == '__main__':
                         except:
                                 doError('No devnames supplied', True)
                         sysvals.setDeviceFilter(val)
+                elif(arg == '-result'):
+                        try:
+                                val = args.next()
+                        except:
+                                doError('No result file supplied', True)
+                        sysvals.result = val
                 else:
                         doError('Invalid argument: '+arg, True)
 
@@ -5454,42 +5837,48 @@ if __name__ == '__main__':
         if(sysvals.usecallgraph and sysvals.useprocmon):
                 doError('-proc is not compatible with -f')
 
+        if sysvals.usecallgraph and sysvals.cgskip:
+                sysvals.vprint('Using cgskip file: %s' % sysvals.cgskip)
+                sysvals.setCallgraphBlacklist(sysvals.cgskip)
+
         # callgraph size cannot exceed device size
         if sysvals.mincglen < sysvals.mindevlen:
                 sysvals.mincglen = sysvals.mindevlen
 
-        # just run a utility command and exit
+        # remove existing buffers before calculating memory
+        if(sysvals.usecallgraph or sysvals.usedevsrc):
+                sysvals.fsetVal('16', 'buffer_size_kb')
         sysvals.cpuInfo()
+
+        # just run a utility command and exit
         if(cmd != ''):
                 if(cmd == 'status'):
                         statusCheck(True)
                 elif(cmd == 'fpdt'):
                         getFPDT(True)
                 elif(cmd == 'sysinfo'):
-                        sysvals.printSystemInfo()
-                elif(cmd == 'usbtopo'):
-                        detectUSB()
+                        sysvals.printSystemInfo(True)
+                elif(cmd == 'devinfo'):
+                        deviceInfo()
                 elif(cmd == 'modes'):
                         print getModes()
                 elif(cmd == 'flist'):
                         sysvals.getFtraceFilterFunctions(True)
                 elif(cmd == 'flistall'):
                         sysvals.getFtraceFilterFunctions(False)
-                elif(cmd == 'usbauto'):
-                        setUSBDevicesAuto()
                 elif(cmd == 'summary'):
-                        runSummary(outdir, True)
+                        runSummary(sysvals.outdir, True)
                 sys.exit()
 
         # if instructed, re-analyze existing data files
         if(sysvals.notestrun):
-                rerunTest()
+                stamp = rerunTest()
+                sysvals.outputResult(stamp)
                 sys.exit()
 
         # verify that we can run a test
         if(not statusCheck()):
-                print('Check FAILED, aborting the test run!')
-                sys.exit()
+                doError('Check FAILED, aborting the test run!')
 
         # extract mem modes and convert
         mode = sysvals.suspendmode
@@ -5509,25 +5898,35 @@ if __name__ == '__main__':
 
         sysvals.systemInfo(dmidecode(sysvals.mempath))
 
-        if multitest['run']:
+        setRuntimeSuspend(True)
+        if sysvals.display:
+                call('xset -d :0.0 dpms 0 0 0', shell=True)
+                call('xset -d :0.0 s off', shell=True)
+        if sysvals.multitest['run']:
                 # run multiple tests in a separate subdirectory
-                if not outdir:
-                        s = 'suspend-x%d' % multitest['count']
-                        outdir = datetime.now().strftime(s+'-%y%m%d-%H%M%S')
-                if not os.path.isdir(outdir):
-                        os.mkdir(outdir)
-                for i in range(multitest['count']):
+                if not sysvals.outdir:
+                        s = 'suspend-x%d' % sysvals.multitest['count']
+                        sysvals.outdir = datetime.now().strftime(s+'-%y%m%d-%H%M%S')
+                if not os.path.isdir(sysvals.outdir):
+                        os.mkdir(sysvals.outdir)
+                for i in range(sysvals.multitest['count']):
                         if(i != 0):
-                                print('Waiting %d seconds...' % (multitest['delay']))
-                                time.sleep(multitest['delay'])
-                        print('TEST (%d/%d) START' % (i+1, multitest['count']))
+                                print('Waiting %d seconds...' % (sysvals.multitest['delay']))
+                                time.sleep(sysvals.multitest['delay'])
+                        print('TEST (%d/%d) START' % (i+1, sysvals.multitest['count']))
                         fmt = 'suspend-%y%m%d-%H%M%S'
-                        sysvals.testdir = os.path.join(outdir, datetime.now().strftime(fmt))
-                        runTest()
-                        print('TEST (%d/%d) COMPLETE' % (i+1, multitest['count']))
-                runSummary(outdir, False)
+                        sysvals.testdir = os.path.join(sysvals.outdir, datetime.now().strftime(fmt))
+                        runTest(i+1)
+                        print('TEST (%d/%d) COMPLETE' % (i+1, sysvals.multitest['count']))
+                        sysvals.logmsg = ''
+                if not sysvals.skiphtml:
+                        runSummary(sysvals.outdir, False)
+                sysvals.sudouser(sysvals.outdir)
         else:
-                if outdir:
-                        sysvals.testdir = outdir
+                if sysvals.outdir:
+                        sysvals.testdir = sysvals.outdir
                 # run the test in the current directory
                 runTest()
+        if sysvals.display:
+                call('xset -d :0.0 s reset', shell=True)
+        setRuntimeSuspend(False)
diff --git a/tools/scripts/Makefile.arch b/tools/scripts/Makefile.arch
index 78d90a249e88..b10b7a27c33f 100644
--- a/tools/scripts/Makefile.arch
+++ b/tools/scripts/Makefile.arch
@@ -4,8 +4,7 @@ HOSTARCH := $(shell uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ \
                                   -e /arm64/!s/arm.*/arm/ -e s/sa110/arm/ \
                                   -e s/s390x/s390/ -e s/parisc64/parisc/ \
                                   -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
-                                  -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ \
-                                  -e s/tile.*/tile/ )
+                                  -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
 
 ifndef ARCH
 ARCH := $(HOSTARCH)
@@ -34,14 +33,6 @@ ifeq ($(ARCH),sh64)
        SRCARCH := sh
 endif
 
-# Additional ARCH settings for tile
-ifeq ($(ARCH),tilepro)
-       SRCARCH := tile
-endif
-ifeq ($(ARCH),tilegx)
-       SRCARCH := tile
-endif
-
 LP64 := $(shell echo __LP64__ | ${CC} ${CFLAGS} -E -x c - | tail -n 1)
 ifeq ($(LP64), 1)
   IS_64_BIT := 1
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index dd614463d4d6..495066bafbe3 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -120,3 +120,5 @@ ifneq ($(silent),1)
         QUIET_UNINST   = @printf '  UNINST   %s\n' $1;
   endif
 endif
+
+pound := \#
diff --git a/tools/testing/ktest/config-bisect.pl b/tools/testing/ktest/config-bisect.pl
new file mode 100755
index 000000000000..b28feea7c363
--- /dev/null
+++ b/tools/testing/ktest/config-bisect.pl
@@ -0,0 +1,770 @@
+#!/usr/bin/perl -w
+#
+# Copyright 2015 - Steven Rostedt, Red Hat Inc.
+# Copyright 2017 - Steven Rostedt, VMware, Inc.
+#
+# Licensed under the terms of the GNU GPL License version 2
+#
+
+# usage:
+#  config-bisect.pl [options] good-config bad-config [good|bad]
+#
+
+# Compares a good config to a bad config, then takes half of the diffs
+# and produces a config that is somewhere between the good config and
+# the bad config. That is, the resulting config will start with the
+# good config and will try to make half of the differences of between
+# the good and bad configs match the bad config. It tries because of
+# dependencies between the two configs it may not be able to change
+# exactly half of the configs that are different between the two config
+# files.
+
+# Here's a normal way to use it:
+#
+#  $ cd /path/to/linux/kernel
+#  $ config-bisect.pl /path/to/good/config /path/to/bad/config
+
+# This will now pull in good config (blowing away .config in that directory
+# so do not make that be one of the good or bad configs), and then
+# build the config with "make oldconfig" to make sure it matches the
+# current kernel. It will then store the configs in that result for
+# the good config. It does the same for the bad config as well.
+# The algorithm will run, merging half of the differences between
+# the two configs and building them with "make oldconfig" to make sure
+# the result changes (dependencies may reset changes the tool had made).
+# It then copies the result of its good config to /path/to/good/config.tmp
+# and the bad config to /path/to/bad/config.tmp (just appends ".tmp" to the
+# files passed in). And the ".config" that you should test will be in
+# directory
+
+# After the first run, determine if the result is good or bad then
+# run the same command appending the result
+
+# For good results:
+#  $ config-bisect.pl /path/to/good/config /path/to/bad/config good
+
+# For bad results:
+#  $ config-bisect.pl /path/to/good/config /path/to/bad/config bad
+
+# Do not change the good-config or bad-config, config-bisect.pl will
+# copy the good-config to a temp file with the same name as good-config
+# but with a ".tmp" after it. It will do the same with the bad-config.
+
+# If "good" or "bad" is not stated at the end, it will copy the good and
+# bad configs to the .tmp versions. If a .tmp version already exists, it will
+# warn before writing over them (-r will not warn, and just write over them).
+# If the last config is labeled "good", then it will copy it to the good .tmp
+# version. If the last config is labeled "bad", it will copy it to the bad
+# .tmp version. It will continue this until it can not merge the two any more
+# without the result being equal to either the good or bad .tmp configs.
+
+my $start = 0;
+my $val = "";
+
+my $pwd = `pwd`;
+chomp $pwd;
+my $tree = $pwd;
+my $build;
+
+my $output_config;
+my $reset_bisect;
+
+sub usage {
+    print << "EOF"
+
+usage: config-bisect.pl [-l linux-tree][-b build-dir] good-config bad-config [good|bad]
+  -l [optional] define location of linux-tree (default is current directory)
+  -b [optional] define location to build (O=build-dir) (default is linux-tree)
+  good-config the config that is considered good
+  bad-config the config that does not work
+  "good" add this if the last run produced a good config
+  "bad" add this if the last run produced a bad config
+  If "good" or "bad" is not specified, then it is the start of a new bisect
+
+  Note, each run will create copy of good and bad configs with ".tmp" appended.
+
+EOF
+;
+
+    exit(-1);
+}
+
+sub doprint {
+    print @_;
+}
+
+sub dodie {
+    doprint "CRITICAL FAILURE... ", @_, "\n";
+
+    die @_, "\n";
+}
+
+sub expand_path {
+    my ($file) = @_;
+
+    if ($file =~ m,^/,) {
+        return $file;
+    }
+    return "$pwd/$file";
+}
+
+sub read_prompt {
+    my ($cancel, $prompt) = @_;
+
+    my $ans;
+
+    for (;;) {
+        if ($cancel) {
+            print "$prompt [y/n/C] ";
+        } else {
+            print "$prompt [y/N] ";
+        }
+        $ans = <STDIN>;
+        chomp $ans;
+        if ($ans =~ /^\s*$/) {
+            if ($cancel) {
+                $ans = "c";
+            } else {
+                $ans = "n";
+            }
+        }
+        last if ($ans =~ /^y$/i || $ans =~ /^n$/i);
+        if ($cancel) {
+            last if ($ans =~ /^c$/i);
+            print "Please answer either 'y', 'n' or 'c'.\n";
+        } else {
+            print "Please answer either 'y' or 'n'.\n";
+        }
+    }
+    if ($ans =~ /^c/i) {
+        exit;
+    }
+    if ($ans !~ /^y$/i) {
+        return 0;
+    }
+    return 1;
+}
+
+sub read_yn {
+    my ($prompt) = @_;
+
+    return read_prompt 0, $prompt;
+}
+
+sub read_ync {
+    my ($prompt) = @_;
+
+    return read_prompt 1, $prompt;
+}
+
+sub run_command {
+    my ($command, $redirect) = @_;
+    my $start_time;
+    my $end_time;
+    my $dord = 0;
+    my $pid;
+
+    $start_time = time;
+
+    doprint("$command ... ");
+
+    $pid = open(CMD, "$command 2>&1 |") or
+        dodie "unable to exec $command";
+
+    if (defined($redirect)) {
+        open (RD, ">$redirect") or
+            dodie "failed to write to redirect $redirect";
+        $dord = 1;
+    }
+
+    while (<CMD>) {
+        print RD  if ($dord);
+    }
+
+    waitpid($pid, 0);
+    my $failed = $?;
+
+    close(CMD);
+    close(RD)  if ($dord);
+
+    $end_time = time;
+    my $delta = $end_time - $start_time;
+
+    if ($delta == 1) {
+        doprint "[1 second] ";
+    } else {
+        doprint "[$delta seconds] ";
+    }
+
+    if ($failed) {
+        doprint "FAILED!\n";
+    } else {
+        doprint "SUCCESS\n";
+    }
+
+    return !$failed;
+}
+
+###### CONFIG BISECT ######
+
+# config_ignore holds the configs that were set (or unset) for
+# a good config and we will ignore these configs for the rest
+# of a config bisect. These configs stay as they were.
+my %config_ignore;
+
+# config_set holds what all configs were set as.
+my %config_set;
+
+# config_off holds the set of configs that the bad config had disabled.
+# We need to record them and set them in the .config when running
+# olddefconfig, because olddefconfig keeps the defaults.
+my %config_off;
+
+# config_off_tmp holds a set of configs to turn off for now
+my @config_off_tmp;
+
+# config_list is the set of configs that are being tested
+my %config_list;
+my %null_config;
+
+my %dependency;
+
+my $make;
+
+sub make_oldconfig {
+
+    if (!run_command "$make olddefconfig") {
+        # Perhaps olddefconfig doesn't exist in this version of the kernel
+        # try oldnoconfig
+        doprint "olddefconfig failed, trying make oldnoconfig\n";
+        if (!run_command "$make oldnoconfig") {
+            doprint "oldnoconfig failed, trying yes '' | make oldconfig\n";
+            # try a yes '' | oldconfig
+            run_command "yes '' | $make oldconfig" or
+                dodie "failed make config oldconfig";
+        }
+    }
+}
+
+sub assign_configs {
+    my ($hash, $config) = @_;
+
+    doprint "Reading configs from $config\n";
+
+    open (IN, $config)
+        or dodie "Failed to read $config";
+
+    while (<IN>) {
+        chomp;
+        if (/^((CONFIG\S*)=.*)/) {
+            ${$hash}{$2} = $1;
+        } elsif (/^(# (CONFIG\S*) is not set)/) {
+            ${$hash}{$2} = $1;
+        }
+    }
+
+    close(IN);
+}
+
+sub process_config_ignore {
+    my ($config) = @_;
+
+    assign_configs \%config_ignore, $config;
+}
+
+sub get_dependencies {
+    my ($config) = @_;
+
+    my $arr = $dependency{$config};
+    if (!defined($arr)) {
+        return ();
+    }
+
+    my @deps = @{$arr};
+
+    foreach my $dep (@{$arr}) {
+        print "ADD DEP $dep\n";
+        @deps = (@deps, get_dependencies $dep);
+    }
+
+    return @deps;
+}
+
+sub save_config {
+    my ($pc, $file) = @_;
+
+    my %configs = %{$pc};
+
+    doprint "Saving configs into $file\n";
+
+    open(OUT, ">$file") or dodie "Can not write to $file";
+
+    foreach my $config (keys %configs) {
+        print OUT "$configs{$config}\n";
+    }
+    close(OUT);
+}
+
+sub create_config {
+    my ($name, $pc) = @_;
+
+    doprint "Creating old config from $name configs\n";
+
+    save_config $pc, $output_config;
+
+    make_oldconfig;
+}
+
+# compare two config hashes, and return configs with different vals.
+# It returns B's config values, but you can use A to see what A was.
+sub diff_config_vals {
+    my ($pa, $pb) = @_;
+
+    # crappy Perl way to pass in hashes.
+    my %a = %{$pa};
+    my %b = %{$pb};
+
+    my %ret;
+
+    foreach my $item (keys %a) {
+        if (defined($b{$item}) && $b{$item} ne $a{$item}) {
+            $ret{$item} = $b{$item};
+        }
+    }
+
+    return %ret;
+}
+
+# compare two config hashes and return the configs in B but not A
+sub diff_configs {
+    my ($pa, $pb) = @_;
+
+    my %ret;
+
+    # crappy Perl way to pass in hashes.
+    my %a = %{$pa};
+    my %b = %{$pb};
+
+    foreach my $item (keys %b) {
+        if (!defined($a{$item})) {
+            $ret{$item} = $b{$item};
+        }
+    }
+
+    return %ret;
+}
+
+# return if two configs are equal or not
+# 0 is equal +1 b has something a does not
+# +1 if a and b have a different item.
+# -1 if a has something b does not
+sub compare_configs {
+    my ($pa, $pb) = @_;
+
+    my %ret;
+
+    # crappy Perl way to pass in hashes.
+    my %a = %{$pa};
+    my %b = %{$pb};
+
+    foreach my $item (keys %b) {
+        if (!defined($a{$item})) {
+            return 1;
+        }
+        if ($a{$item} ne $b{$item}) {
+            return 1;
+        }
+    }
+
+    foreach my $item (keys %a) {
+        if (!defined($b{$item})) {
+            return -1;
+        }
+    }
+
+    return 0;
+}
+
+sub process_failed {
+    my ($config) = @_;
+
+    doprint "\n\n***************************************\n";
+    doprint "Found bad config: $config\n";
+    doprint "***************************************\n\n";
+}
+
+sub process_new_config {
+    my ($tc, $nc, $gc, $bc) = @_;
+
+    my %tmp_config = %{$tc};
+    my %good_configs = %{$gc};
+    my %bad_configs = %{$bc};
+
+    my %new_configs;
+
+    my $runtest = 1;
+    my $ret;
+
+    create_config "tmp_configs", \%tmp_config;
+    assign_configs \%new_configs, $output_config;
+
+    $ret = compare_configs \%new_configs, \%bad_configs;
+    if (!$ret) {
+        doprint "New config equals bad config, try next test\n";
+        $runtest = 0;
+    }
+
+    if ($runtest) {
+        $ret = compare_configs \%new_configs, \%good_configs;
+        if (!$ret) {
+            doprint "New config equals good config, try next test\n";
+            $runtest = 0;
+        }
+    }
+
+    %{$nc} = %new_configs;
+
+    return $runtest;
+}
+
+sub convert_config {
+    my ($config) = @_;
+
+    if ($config =~ /^# (.*) is not set/) {
+        $config = "$1=n";
+    }
+
+    $config =~ s/^CONFIG_//;
+    return $config;
+}
+
+sub print_config {
+    my ($sym, $config) = @_;
+
+    $config = convert_config $config;
+    doprint "$sym$config\n";
+}
+
+sub print_config_compare {
+    my ($good_config, $bad_config) = @_;
+
+    $good_config = convert_config $good_config;
+    $bad_config = convert_config $bad_config;
+
+    my $good_value = $good_config;
+    my $bad_value = $bad_config;
+    $good_value =~ s/(.*)=//;
+    my $config = $1;
+
+    $bad_value =~ s/.*=//;
+
+    doprint " $config $good_value -> $bad_value\n";
+}
+
+# Pass in:
+# $phalf: half of the configs names you want to add
+# $oconfigs: The orginial configs to start with
+# $sconfigs: The source to update $oconfigs with (from $phalf)
+# $which: The name of which half that is updating (top / bottom)
+# $type: The name of the source type (good / bad)
+sub make_half {
+    my ($phalf, $oconfigs, $sconfigs, $which, $type) = @_;
+
+    my @half = @{$phalf};
+    my %orig_configs = %{$oconfigs};
+    my %source_configs = %{$sconfigs};
+
+    my %tmp_config = %orig_configs;
+
+    doprint "Settings bisect with $which half of $type configs:\n";
+    foreach my $item (@half) {
+        doprint "Updating $item to $source_configs{$item}\n";
+        $tmp_config{$item} = $source_configs{$item};
+    }
+
+    return %tmp_config;
+}
+
+sub run_config_bisect {
+    my ($pgood, $pbad) = @_;
+
+    my %good_configs = %{$pgood};
+    my %bad_configs = %{$pbad};
+
+    my %diff_configs = diff_config_vals \%good_configs, \%bad_configs;
+    my %b_configs = diff_configs \%good_configs, \%bad_configs;
+    my %g_configs = diff_configs \%bad_configs, \%good_configs;
+
+    # diff_arr is what is in both good and bad but are different (y->n)
+    my @diff_arr = keys %diff_configs;
+    my $len_diff = $#diff_arr + 1;
+
+    # b_arr is what is in bad but not in good (has depends)
+    my @b_arr = keys %b_configs;
+    my $len_b = $#b_arr + 1;
+
+    # g_arr is what is in good but not in bad
+    my @g_arr = keys %g_configs;
+    my $len_g = $#g_arr + 1;
+
+    my $runtest = 0;
+    my %new_configs;
+    my $ret;
+
+    # Look at the configs that are different between good and bad.
+    # This does not include those that depend on other configs
+    #  (configs depending on other configs that are not set would
+    #   not show up even as a "# CONFIG_FOO is not set"
+
+
+    doprint "# of configs to check:             $len_diff\n";
+    doprint "# of configs showing only in good: $len_g\n";
+    doprint "# of configs showing only in bad:  $len_b\n";
+
+    if ($len_diff > 0) {
+        # Now test for different values
+
+        doprint "Configs left to check:\n";
+        doprint "  Good Config\t\t\tBad Config\n";
+        doprint "  -----------\t\t\t----------\n";
+        foreach my $item (@diff_arr) {
+            doprint "  $good_configs{$item}\t$bad_configs{$item}\n";
+        }
+
+        my $half = int($#diff_arr / 2);
+        my @tophalf = @diff_arr[0 .. $half];
+
+        doprint "Set tmp config to be good config with some bad config values\n";
+
+        my %tmp_config = make_half \@tophalf, \%good_configs,
+            \%bad_configs, "top", "bad";
+
+        $runtest = process_new_config \%tmp_config, \%new_configs,
+                            \%good_configs, \%bad_configs;
+
+        if (!$runtest) {
+            doprint "Set tmp config to be bad config with some good config values\n";
+
+            my %tmp_config = make_half \@tophalf, \%bad_configs,
+                \%good_configs, "top", "good";
+
+            $runtest = process_new_config \%tmp_config, \%new_configs,
+                \%good_configs, \%bad_configs;
+        }
+    }
+
+    if (!$runtest && $len_diff > 0) {
+        # do the same thing, but this time with bottom half
+
+        my $half = int($#diff_arr / 2);
+        my @bottomhalf = @diff_arr[$half+1 .. $#diff_arr];
+
+        doprint "Set tmp config to be good config with some bad config values\n";
+
+        my %tmp_config = make_half \@bottomhalf, \%good_configs,
+            \%bad_configs, "bottom", "bad";
+
+        $runtest = process_new_config \%tmp_config, \%new_configs,
+                            \%good_configs, \%bad_configs;
+
+        if (!$runtest) {
+            doprint "Set tmp config to be bad config with some good config values\n";
+
+            my %tmp_config = make_half \@bottomhalf, \%bad_configs,
+                \%good_configs, "bottom", "good";
+
+            $runtest = process_new_config \%tmp_config, \%new_configs,
+                \%good_configs, \%bad_configs;
+        }
+    }
+
+    if ($runtest) {
+        make_oldconfig;
+        doprint "READY TO TEST .config IN $build\n";
+        return 0;
+    }
+
+    doprint "\n%%%%%%%% FAILED TO FIND SINGLE BAD CONFIG %%%%%%%%\n";
+    doprint "Hmm, can't make any more changes without making good == bad?\n";
+    doprint "Difference between good (+) and bad (-)\n";
+
+    foreach my $item (keys %bad_configs) {
+        if (!defined($good_configs{$item})) {
+            print_config "-", $bad_configs{$item};
+        }
+    }
+
+    foreach my $item (keys %good_configs) {
+        next if (!defined($bad_configs{$item}));
+        if ($good_configs{$item} ne $bad_configs{$item}) {
+            print_config_compare $good_configs{$item}, $bad_configs{$item};
+        }
+    }
+
+    foreach my $item (keys %good_configs) {
+        if (!defined($bad_configs{$item})) {
+            print_config "+", $good_configs{$item};
+        }
+    }
+    return -1;
+}
+
+sub config_bisect {
+    my ($good_config, $bad_config) = @_;
+    my $ret;
+
+    my %good_configs;
+    my %bad_configs;
+    my %tmp_configs;
+
+    doprint "Run good configs through make oldconfig\n";
+    assign_configs \%tmp_configs, $good_config;
+    create_config "$good_config", \%tmp_configs;
+    assign_configs \%good_configs, $output_config;
+
+    doprint "Run bad configs through make oldconfig\n";
+    assign_configs \%tmp_configs, $bad_config;
+    create_config "$bad_config", \%tmp_configs;
+    assign_configs \%bad_configs, $output_config;
+
+    save_config \%good_configs, $good_config;
+    save_config \%bad_configs, $bad_config;
+
+    return run_config_bisect \%good_configs, \%bad_configs;
+}
+
+while ($#ARGV >= 0) {
+    if ($ARGV[0] !~ m/^-/) {
+        last;
+    }
+    my $opt = shift @ARGV;
+
+    if ($opt eq "-b") {
+        $val = shift @ARGV;
+        if (!defined($val)) {
+            die "-b requires value\n";
+        }
+        $build = $val;
+    }
+
+    elsif ($opt eq "-l") {
+        $val = shift @ARGV;
+        if (!defined($val)) {
+            die "-l requires value\n";
+        }
+        $tree = $val;
+    }
+
+    elsif ($opt eq "-r") {
+        $reset_bisect = 1;
+    }
+
+    elsif ($opt eq "-h") {
+        usage;
+    }
+
+    else {
+        die "Unknow option $opt\n";
+    }
+}
+
+$build = $tree if (!defined($build));
+
+$tree = expand_path $tree;
+$build = expand_path $build;
+
+if ( ! -d $tree ) {
+    die "$tree not a directory\n";
+}
+
+if ( ! -d $build ) {
+    die "$build not a directory\n";
+}
+
+usage if $#ARGV < 1;
+
+if ($#ARGV == 1) {
+    $start = 1;
+} elsif ($#ARGV == 2) {
+    $val = $ARGV[2];
+    if ($val ne "good" && $val ne "bad") {
+        die "Unknown command '$val', bust be either \"good\" or \"bad\"\n";
+    }
+} else {
+    usage;
+}
+
+my $good_start = expand_path $ARGV[0];
+my $bad_start = expand_path $ARGV[1];
+
+my $good = "$good_start.tmp";
+my $bad = "$bad_start.tmp";
+
+$make = "make";
+
+if ($build ne $tree) {
+    $make = "make O=$build"
+}
+
+$output_config = "$build/.config";
+
+if ($start) {
+    if ( ! -f $good_start ) {
+        die "$good_start not found\n";
+    }
+    if ( ! -f $bad_start ) {
+        die "$bad_start not found\n";
+    }
+    if ( -f $good || -f $bad ) {
+        my $p = "";
+
+        if ( -f $good ) {
+            $p = "$good exists\n";
+        }
+
+        if ( -f $bad ) {
+            $p = "$p$bad exists\n";
+        }
+
+        if (!defined($reset_bisect)) {
+            if (!read_yn "${p}Overwrite and start new bisect anyway?") {
+                exit (-1);
+            }
+        }
+    }
+    run_command "cp $good_start $good" or die "failed to copy to $good\n";
+    run_command "cp $bad_start $bad" or die "faield to copy to $bad\n";
+} else {
+    if ( ! -f $good ) {
+        die "Can not find file $good\n";
+    }
+    if ( ! -f $bad ) {
+        die "Can not find file $bad\n";
+    }
+    if ($val eq "good") {
+        run_command "cp $output_config $good" or die "failed to copy $config to $good\n";
+    } elsif ($val eq "bad") {
+        run_command "cp $output_config $bad" or die "failed to copy $config to $bad\n";
+    }
+}
+
+chdir $tree || die "can't change directory to $tree";
+
+my $ret = config_bisect $good, $bad;
+
+if (!$ret) {
+    exit(0);
+}
+
+if ($ret > 0) {
+    doprint "Cleaning temp files\n";
+    run_command "rm $good";
+    run_command "rm $bad";
+    exit(1);
+} else {
+    doprint "See good and bad configs for details:\n";
+    doprint "good: $good\n";
+    doprint "bad:  $bad\n";
+    doprint "%%%%%%%% FAILED TO FIND SINGLE BAD CONFIG %%%%%%%%\n";
+}
+exit(2);
diff --git a/tools/testing/ktest/examples/crosstests.conf b/tools/testing/ktest/examples/crosstests.conf
index a1203148dfa1..6907f32590b2 100644
--- a/tools/testing/ktest/examples/crosstests.conf
+++ b/tools/testing/ktest/examples/crosstests.conf
@@ -59,7 +59,7 @@ DO_DEFAULT := 1
 
 # By setting both DO_FAILED and DO_DEFAULT to zero, you can pick a single
 # arch that you want to test. (uncomment RUN and chose your arch)
-#RUN := m32r
+#RUN := arm
 
 # At the bottom of the config file exists a bisect test. You can update that
 # test and set DO_FAILED and DO_DEFAULT to zero, and uncomment this variable
@@ -106,33 +106,11 @@ TEST_START IF ${RUN} == arm || ${DO_DEFAULT}
 CROSS = arm-unknown-linux-gnueabi
 ARCH = arm
 
-# black fin
-TEST_START IF ${RUN} == bfin || ${DO_DEFAULT}
-CROSS = bfin-uclinux
-ARCH = blackfin
-BUILD_OPTIONS = -j8 vmlinux
-
-# cris - FAILS?
-TEST_START IF ${RUN} == cris || ${RUN} == cris64 || ${DO_FAILED}
-CROSS = cris-linux
-ARCH = cris
-
-# cris32 - not right arch?
-TEST_START IF ${RUN} == cris || ${RUN} == cris32 || ${DO_FAILED}
-CROSS = crisv32-linux
-ARCH = cris
-
 # ia64
 TEST_START IF ${RUN} == ia64 || ${DO_DEFAULT}
 CROSS = ia64-linux
 ARCH = ia64
 
-# frv
-TEST_START IF ${RUN} == frv || ${DO_FAILED}
-CROSS = frv-linux
-ARCH = frv
-GCC_VER = 4.5.1
-
 # m68k fails with error?
 TEST_START IF ${RUN} == m68k || ${DO_DEFAULT}
 CROSS = m68k-linux
@@ -148,13 +126,6 @@ TEST_START IF ${RUN} == mips || ${RUN} == mips32 || ${DO_DEFAULT}
 CROSS = mips-linux
 ARCH = mips
 
-# m32r
-TEST_START IF ${RUN} == m32r || ${DO_FAILED}
-CROSS = m32r-linux
-ARCH = m32r
-GCC_VER = 4.5.1
-BUILD_OPTIONS = -j8 vmlinux
-
 # parisc64 failed?
 TEST_START IF ${RUN} == hppa || ${RUN} == hppa64 || ${DO_FAILED}
 CROSS = hppa64-linux
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 0c8b61f8398e..87af8a68ab25 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -10,6 +10,7 @@ use Fcntl qw(F_GETFL F_SETFL O_NONBLOCK);
 use File::Path qw(mkpath);
 use File::Copy qw(cp);
 use FileHandle;
+use FindBin;
 
 my $VERSION = "0.2";
 
@@ -22,6 +23,11 @@ my %evals;
 
 #default opts
 my %default = (
+    "MAILER"                    => "sendmail",  # default mailer
+    "EMAIL_ON_ERROR"            => 1,
+    "EMAIL_WHEN_FINISHED"       => 1,
+    "EMAIL_WHEN_CANCELED"       => 0,
+    "EMAIL_WHEN_STARTED"        => 0,
     "NUM_TESTS"                 => 1,
     "TEST_TYPE"                 => "build",
     "BUILD_TYPE"                => "randconfig",
@@ -59,6 +65,7 @@ my %default = (
     "GRUB_REBOOT"               => "grub2-reboot",
     "SYSLINUX"                  => "extlinux",
     "SYSLINUX_PATH"             => "/boot/extlinux",
+    "CONNECT_TIMEOUT"           => 25,
 
 # required, and we will ask users if they don't have them but we keep the default
 # value something that is common.
@@ -163,6 +170,8 @@ my $store_failures;
 my $store_successes;
 my $test_name;
 my $timeout;
+my $connect_timeout;
+my $config_bisect_exec;
 my $booted_timeout;
 my $detect_triplefault;
 my $console;
@@ -204,6 +213,20 @@ my $install_time;
 my $reboot_time;
 my $test_time;
 
+my $pwd;
+my $dirname = $FindBin::Bin;
+
+my $mailto;
+my $mailer;
+my $mail_path;
+my $mail_command;
+my $email_on_error;
+my $email_when_finished;
+my $email_when_started;
+my $email_when_canceled;
+
+my $script_start_time = localtime();
+
 # set when a test is something other that just building or install
 # which would require more options.
 my $buildonly = 1;
@@ -229,6 +252,14 @@ my $no_reboot = 1;
 my $reboot_success = 0;
 
 my %option_map = (
+    "MAILTO"                    => \$mailto,
+    "MAILER"                    => \$mailer,
+    "MAIL_PATH"                 => \$mail_path,
+    "MAIL_COMMAND"              => \$mail_command,
+    "EMAIL_ON_ERROR"            => \$email_on_error,
+    "EMAIL_WHEN_FINISHED"       => \$email_when_finished,
+    "EMAIL_WHEN_STARTED"        => \$email_when_started,
+    "EMAIL_WHEN_CANCELED"       => \$email_when_canceled,
     "MACHINE"                   => \$machine,
     "SSH_USER"                  => \$ssh_user,
     "TMP_DIR"                   => \$tmpdir,
@@ -296,6 +327,8 @@ my %option_map = (
     "STORE_SUCCESSES"           => \$store_successes,
     "TEST_NAME"                 => \$test_name,
     "TIMEOUT"                   => \$timeout,
+    "CONNECT_TIMEOUT"           => \$connect_timeout,
+    "CONFIG_BISECT_EXEC"        => \$config_bisect_exec,
     "BOOTED_TIMEOUT"            => \$booted_timeout,
     "CONSOLE"                   => \$console,
     "CLOSE_CONSOLE_SIGNAL"      => \$close_console_signal,
@@ -337,6 +370,7 @@ my %used_options;
 
 # default variables that can be used
 chomp ($variable{"PWD"} = `pwd`);
+$pwd = $variable{"PWD"};
 
 $config_help{"MACHINE"} = << "EOF"
  The machine hostname that you will test.
@@ -718,22 +752,14 @@ sub set_value {
 
     my $prvalue = process_variables($rvalue);
 
-    if ($buildonly && $lvalue =~ /^TEST_TYPE(\[.*\])?$/ && $prvalue ne "build") {
+    if ($lvalue =~ /^(TEST|BISECT|CONFIG_BISECT)_TYPE(\[.*\])?$/ &&
+        $prvalue !~ /^(config_|)bisect$/ &&
+        $prvalue !~ /^build$/ &&
+        $buildonly) {
+
         # Note if a test is something other than build, then we
         # will need other mandatory options.
         if ($prvalue ne "install") {
-            # for bisect, we need to check BISECT_TYPE
-            if ($prvalue ne "bisect") {
-                $buildonly = 0;
-            }
-        } else {
-            # install still limits some mandatory options.
-            $buildonly = 2;
-        }
-    }
-
-    if ($buildonly && $lvalue =~ /^BISECT_TYPE(\[.*\])?$/ && $prvalue ne "build") {
-        if ($prvalue ne "install") {
             $buildonly = 0;
         } else {
             # install still limits some mandatory options.
@@ -1140,7 +1166,8 @@ sub __read_config {
 sub get_test_case {
         print "What test case would you like to run?\n";
         print " (build, install or boot)\n";
-        print " Other tests are available but require editing the config file\n";
+        print " Other tests are available but require editing ktest.conf\n";
+        print " (see tools/testing/ktest/sample.conf)\n";
         my $ans = <STDIN>;
         chomp $ans;
         $default{"TEST_TYPE"} = $ans;
@@ -1328,8 +1355,8 @@ sub reboot {
     my ($time) = @_;
     my $powercycle = 0;
 
-    # test if the machine can be connected to within 5 seconds
-    my $stat = run_ssh("echo check machine status", 5);
+    # test if the machine can be connected to within a few seconds
+    my $stat = run_ssh("echo check machine status", $connect_timeout);
     if (!$stat) {
         doprint("power cycle\n");
         $powercycle = 1;
@@ -1404,10 +1431,18 @@ sub do_not_reboot {
 
     return $test_type eq "build" || $no_reboot ||
         ($test_type eq "patchcheck" && $opt{"PATCHCHECK_TYPE[$i]"} eq "build") ||
-        ($test_type eq "bisect" && $opt{"BISECT_TYPE[$i]"} eq "build");
+        ($test_type eq "bisect" && $opt{"BISECT_TYPE[$i]"} eq "build") ||
+        ($test_type eq "config_bisect" && $opt{"CONFIG_BISECT_TYPE[$i]"} eq "build");
 }
 
+my $in_die = 0;
+
 sub dodie {
+
+    # avoid recusion
+    return if ($in_die);
+    $in_die = 1;
+
     doprint "CRITICAL FAILURE... ", @_, "\n";
 
     my $i = $iteration;
@@ -1426,6 +1461,11 @@ sub dodie {
         print " See $opt{LOG_FILE} for more info.\n";
     }
 
+    if ($email_on_error) {
+        send_email("KTEST: critical failure for your [$test_type] test",
+                "Your test started at $script_start_time has failed with:\n@_\n");
+    }
+
     if ($monitor_cnt) {
             # restore terminal settings
             system("stty $stty_orig");
@@ -1477,7 +1517,7 @@ sub exec_console {
     close($pts);
 
     exec $console or
-        die "Can't open console $console";
+        dodie "Can't open console $console";
 }
 
 sub open_console {
@@ -1515,6 +1555,9 @@ sub close_console {
     doprint "kill child process $pid\n";
     kill $close_console_signal, $pid;
 
+    doprint "wait for child process $pid to exit\n";
+    waitpid($pid, 0);
+
     print "closing!\n";
     close($fp);
 
@@ -1625,7 +1668,7 @@ sub save_logs {
 
         if (!-d $dir) {
             mkpath($dir) or
-                die "can't create $dir";
+                dodie "can't create $dir";
         }
 
         my %files = (
@@ -1638,7 +1681,7 @@ sub save_logs {
         while (my ($name, $source) = each(%files)) {
                 if (-f "$source") {
                         cp "$source", "$dir/$name" or
-                                die "failed to copy $source";
+                                dodie "failed to copy $source";
                 }
         }
 
@@ -1692,6 +1735,7 @@ sub run_command {
     my $end_time;
     my $dolog = 0;
     my $dord = 0;
+    my $dostdout = 0;
     my $pid;
 
     $command =~ s/\$SSH_USER/$ssh_user/g;
@@ -1710,9 +1754,15 @@ sub run_command {
     }
 
     if (defined($redirect)) {
-        open (RD, ">$redirect") or
-            dodie "failed to write to redirect $redirect";
-        $dord = 1;
+        if ($redirect eq 1) {
+            $dostdout = 1;
+            # Have the output of the command on its own line
+            doprint "\n";
+        } else {
+            open (RD, ">$redirect") or
+                dodie "failed to write to redirect $redirect";
+            $dord = 1;
+        }
     }
 
     my $hit_timeout = 0;
@@ -1734,6 +1784,7 @@ sub run_command {
         }
         print LOG $line if ($dolog);
         print RD $line if ($dord);
+        print $line if ($dostdout);
     }
 
     waitpid($pid, 0);
@@ -1812,7 +1863,7 @@ sub get_grub2_index {
     $ssh_grub =~ s,\$SSH_COMMAND,cat $grub_file,g;
 
     open(IN, "$ssh_grub |")
-        or die "unable to get $grub_file";
+        or dodie "unable to get $grub_file";
 
     my $found = 0;
 
@@ -1821,13 +1872,13 @@ sub get_grub2_index {
             $grub_number++;
             $found = 1;
             last;
-        } elsif (/^menuentry\s/) {
+        } elsif (/^menuentry\s|^submenu\s/) {
             $grub_number++;
         }
     }
     close(IN);
 
-    die "Could not find '$grub_menu' in $grub_file on $machine"
+    dodie "Could not find '$grub_menu' in $grub_file on $machine"
         if (!$found);
     doprint "$grub_number\n";
     $last_grub_menu = $grub_menu;
@@ -1855,7 +1906,7 @@ sub get_grub_index {
     $ssh_grub =~ s,\$SSH_COMMAND,cat /boot/grub/menu.lst,g;
 
     open(IN, "$ssh_grub |")
-        or die "unable to get menu.lst";
+        or dodie "unable to get menu.lst";
 
     my $found = 0;
 
@@ -1870,7 +1921,7 @@ sub get_grub_index {
     }
     close(IN);
 
-    die "Could not find '$grub_menu' in /boot/grub/menu on $machine"
+    dodie "Could not find '$grub_menu' in /boot/grub/menu on $machine"
         if (!$found);
     doprint "$grub_number\n";
     $last_grub_menu = $grub_menu;
@@ -1983,7 +2034,7 @@ sub monitor {
     my $full_line = "";
 
     open(DMESG, "> $dmesg") or
-        die "unable to write to $dmesg";
+        dodie "unable to write to $dmesg";
 
     reboot_to;
 
@@ -2862,7 +2913,7 @@ sub run_bisect {
 sub update_bisect_replay {
     my $tmp_log = "$tmpdir/ktest_bisect_log";
     run_command "git bisect log > $tmp_log" or
-        die "can't create bisect log";
+        dodie "can't create bisect log";
     return $tmp_log;
 }
 
@@ -2871,9 +2922,9 @@ sub bisect {
 
     my $result;
 
-    die "BISECT_GOOD[$i] not defined\n" if (!defined($bisect_good));
-    die "BISECT_BAD[$i] not defined\n"  if (!defined($bisect_bad));
-    die "BISECT_TYPE[$i] not defined\n" if (!defined($bisect_type));
+    dodie "BISECT_GOOD[$i] not defined\n"       if (!defined($bisect_good));
+    dodie "BISECT_BAD[$i] not defined\n"        if (!defined($bisect_bad));
+    dodie "BISECT_TYPE[$i] not defined\n"       if (!defined($bisect_type));
 
     my $good = $bisect_good;
     my $bad = $bisect_bad;
@@ -2936,7 +2987,7 @@ sub bisect {
         if ($check ne "good") {
             doprint "TESTING BISECT BAD [$bad]\n";
             run_command "git checkout $bad" or
-                die "Failed to checkout $bad";
+                dodie "Failed to checkout $bad";
 
             $result = run_bisect $type;
 
@@ -2948,7 +2999,7 @@ sub bisect {
         if ($check ne "bad") {
             doprint "TESTING BISECT GOOD [$good]\n";
             run_command "git checkout $good" or
-                die "Failed to checkout $good";
+                dodie "Failed to checkout $good";
 
             $result = run_bisect $type;
 
@@ -2959,7 +3010,7 @@ sub bisect {
 
         # checkout where we started
         run_command "git checkout $head" or
-            die "Failed to checkout $head";
+            dodie "Failed to checkout $head";
     }
 
     run_command "git bisect start$start_files" or
@@ -3092,76 +3143,6 @@ sub create_config {
     make_oldconfig;
 }
 
-# compare two config hashes, and return configs with different vals.
-# It returns B's config values, but you can use A to see what A was.
-sub diff_config_vals {
-    my ($pa, $pb) = @_;
-
-    # crappy Perl way to pass in hashes.
-    my %a = %{$pa};
-    my %b = %{$pb};
-
-    my %ret;
-
-    foreach my $item (keys %a) {
-        if (defined($b{$item}) && $b{$item} ne $a{$item}) {
-            $ret{$item} = $b{$item};
-        }
-    }
-
-    return %ret;
-}
-
-# compare two config hashes and return the configs in B but not A
-sub diff_configs {
-    my ($pa, $pb) = @_;
-
-    my %ret;
-
-    # crappy Perl way to pass in hashes.
-    my %a = %{$pa};
-    my %b = %{$pb};
-
-    foreach my $item (keys %b) {
-        if (!defined($a{$item})) {
-            $ret{$item} = $b{$item};
-        }
-    }
-
-    return %ret;
-}
-
-# return if two configs are equal or not
-# 0 is equal +1 b has something a does not
-# +1 if a and b have a different item.
-# -1 if a has something b does not
-sub compare_configs {
-    my ($pa, $pb) = @_;
-
-    my %ret;
-
-    # crappy Perl way to pass in hashes.
-    my %a = %{$pa};
-    my %b = %{$pb};
-
-    foreach my $item (keys %b) {
-        if (!defined($a{$item})) {
-            return 1;
-        }
-        if ($a{$item} ne $b{$item}) {
-            return 1;
-        }
-    }
-
-    foreach my $item (keys %a) {
-        if (!defined($b{$item})) {
-            return -1;
-        }
-    }
-
-    return 0;
-}
-
 sub run_config_bisect_test {
     my ($type) = @_;
 
@@ -3174,166 +3155,57 @@ sub run_config_bisect_test {
     return $ret;
 }
 
-sub process_failed {
-    my ($config) = @_;
+sub config_bisect_end {
+    my ($good, $bad) = @_;
+    my $diffexec = "diff -u";
 
+    if (-f "$builddir/scripts/diffconfig") {
+        $diffexec = "$builddir/scripts/diffconfig";
+    }
     doprint "\n\n***************************************\n";
-    doprint "Found bad config: $config\n";
+    doprint "No more config bisecting possible.\n";
+    run_command "$diffexec $good $bad", 1;
     doprint "***************************************\n\n";
 }
 
-# used for config bisecting
-my $good_config;
-my $bad_config;
-
-sub process_new_config {
-    my ($tc, $nc, $gc, $bc) = @_;
-
-    my %tmp_config = %{$tc};
-    my %good_configs = %{$gc};
-    my %bad_configs = %{$bc};
-
-    my %new_configs;
-
-    my $runtest = 1;
-    my $ret;
-
-    create_config "tmp_configs", \%tmp_config;
-    assign_configs \%new_configs, $output_config;
-
-    $ret = compare_configs \%new_configs, \%bad_configs;
-    if (!$ret) {
-        doprint "New config equals bad config, try next test\n";
-        $runtest = 0;
-    }
-
-    if ($runtest) {
-        $ret = compare_configs \%new_configs, \%good_configs;
-        if (!$ret) {
-            doprint "New config equals good config, try next test\n";
-            $runtest = 0;
-        }
-    }
-
-    %{$nc} = %new_configs;
-
-    return $runtest;
-}
-
 sub run_config_bisect {
-    my ($pgood, $pbad) = @_;
-
-    my $type = $config_bisect_type;
-
-    my %good_configs = %{$pgood};
-    my %bad_configs = %{$pbad};
-
-    my %diff_configs = diff_config_vals \%good_configs, \%bad_configs;
-    my %b_configs = diff_configs \%good_configs, \%bad_configs;
-    my %g_configs = diff_configs \%bad_configs, \%good_configs;
-
-    my @diff_arr = keys %diff_configs;
-    my $len_diff = $#diff_arr + 1;
-
-    my @b_arr = keys %b_configs;
-    my $len_b = $#b_arr + 1;
-
-    my @g_arr = keys %g_configs;
-    my $len_g = $#g_arr + 1;
-
-    my $runtest = 1;
-    my %new_configs;
+    my ($good, $bad, $last_result) = @_;
+    my $reset = "";
+    my $cmd;
     my $ret;
 
-    # First, lets get it down to a single subset.
-    # Is the problem with a difference in values?
-    # Is the problem with a missing config?
-    # Is the problem with a config that breaks things?
-
-    # Enable all of one set and see if we get a new bad
-    # or good config.
-
-    # first set the good config to the bad values.
-
-    doprint "d=$len_diff g=$len_g b=$len_b\n";
-
-    # first lets enable things in bad config that are enabled in good config
-
-    if ($len_diff > 0) {
-        if ($len_b > 0 || $len_g > 0) {
-            my %tmp_config = %bad_configs;
-
-            doprint "Set tmp config to be bad config with good config values\n";
-            foreach my $item (@diff_arr) {
-                $tmp_config{$item} = $good_configs{$item};
-            }
-
-            $runtest = process_new_config \%tmp_config, \%new_configs,
-                            \%good_configs, \%bad_configs;
-        }
+    if (!length($last_result)) {
+        $reset = "-r";
     }
+    run_command "$config_bisect_exec $reset -b $outputdir $good $bad $last_result", 1;
 
-    if (!$runtest && $len_diff > 0) {
-
-        if ($len_diff == 1) {
-            process_failed $diff_arr[0];
-            return 1;
-        }
-        my %tmp_config = %bad_configs;
-
-        my $half = int($#diff_arr / 2);
-        my @tophalf = @diff_arr[0 .. $half];
-
-        doprint "Settings bisect with top half:\n";
-        doprint "Set tmp config to be bad config with some good config values\n";
-        foreach my $item (@tophalf) {
-            $tmp_config{$item} = $good_configs{$item};
-        }
-
-        $runtest = process_new_config \%tmp_config, \%new_configs,
-                            \%good_configs, \%bad_configs;
-
-        if (!$runtest) {
-            my %tmp_config = %bad_configs;
-
-            doprint "Try bottom half\n";
-
-            my @bottomhalf = @diff_arr[$half+1 .. $#diff_arr];
-
-            foreach my $item (@bottomhalf) {
-                $tmp_config{$item} = $good_configs{$item};
-            }
-
-            $runtest = process_new_config \%tmp_config, \%new_configs,
-                            \%good_configs, \%bad_configs;
-        }
+    # config-bisect returns:
+    #   0 if there is more to bisect
+    #   1 for finding a good config
+    #   2 if it can not find any more configs
+    #  -1 (255) on error
+    if ($run_command_status) {
+        return $run_command_status;
     }
 
-    if ($runtest) {
-        $ret = run_config_bisect_test $type;
-        if ($ret) {
-            doprint "NEW GOOD CONFIG\n";
-            %good_configs = %new_configs;
-            run_command "mv $good_config ${good_config}.last";
-            save_config \%good_configs, $good_config;
-            %{$pgood} = %good_configs;
-        } else {
-            doprint "NEW BAD CONFIG\n";
-            %bad_configs = %new_configs;
-            run_command "mv $bad_config ${bad_config}.last";
-            save_config \%bad_configs, $bad_config;
-            %{$pbad} = %bad_configs;
-        }
-        return 0;
+    $ret = run_config_bisect_test $config_bisect_type;
+    if ($ret) {
+        doprint "NEW GOOD CONFIG\n";
+        # Return 3 for good config
+        return 3;
+    } else {
+        doprint "NEW BAD CONFIG\n";
+        # Return 4 for bad config
+        return 4;
     }
-
-    fail "Hmm, need to do a mix match?\n";
-    return -1;
 }
 
 sub config_bisect {
     my ($i) = @_;
 
+    my $good_config;
+    my $bad_config;
+
     my $type = $config_bisect_type;
     my $ret;
 
@@ -3353,6 +3225,24 @@ sub config_bisect {
         $good_config = $output_config;
     }
 
+    if (!defined($config_bisect_exec)) {
+        # First check the location that ktest.pl ran
+        my @locations = ( "$pwd/config-bisect.pl",
+                          "$dirname/config-bisect.pl",
+                          "$builddir/tools/testing/ktest/config-bisect.pl",
+                          undef );
+        foreach my $loc (@locations) {
+            doprint "loc = $loc\n";
+            $config_bisect_exec = $loc;
+            last if (defined($config_bisect_exec && -x $config_bisect_exec));
+        }
+        if (!defined($config_bisect_exec)) {
+            fail "Could not find an executable config-bisect.pl\n",
+                "  Set CONFIG_BISECT_EXEC to point to config-bisect.pl";
+            return 1;
+        }
+    }
+
     # we don't want min configs to cause issues here.
     doprint "Disabling 'MIN_CONFIG' for this test\n";
     undef $minconfig;
@@ -3361,21 +3251,31 @@ sub config_bisect {
     my %bad_configs;
     my %tmp_configs;
 
+    if (-f "$tmpdir/good_config.tmp" || -f "$tmpdir/bad_config.tmp") {
+        if (read_yn "Interrupted config-bisect. Continue (n - will start new)?") {
+            if (-f "$tmpdir/good_config.tmp") {
+                $good_config = "$tmpdir/good_config.tmp";
+            } else {
+                $good_config = "$tmpdir/good_config";
+            }
+            if (-f "$tmpdir/bad_config.tmp") {
+                $bad_config = "$tmpdir/bad_config.tmp";
+            } else {
+                $bad_config = "$tmpdir/bad_config";
+            }
+        }
+    }
     doprint "Run good configs through make oldconfig\n";
     assign_configs \%tmp_configs, $good_config;
     create_config "$good_config", \%tmp_configs;
-    assign_configs \%good_configs, $output_config;
+    $good_config = "$tmpdir/good_config";
+    system("cp $output_config $good_config") == 0 or dodie "cp good config";
 
     doprint "Run bad configs through make oldconfig\n";
     assign_configs \%tmp_configs, $bad_config;
     create_config "$bad_config", \%tmp_configs;
-    assign_configs \%bad_configs, $output_config;
-
-    $good_config = "$tmpdir/good_config";
     $bad_config = "$tmpdir/bad_config";
-
-    save_config \%good_configs, $good_config;
-    save_config \%bad_configs, $bad_config;
+    system("cp $output_config $bad_config") == 0 or dodie "cp bad config";
 
     if (defined($config_bisect_check) && $config_bisect_check ne "0") {
         if ($config_bisect_check ne "good") {
@@ -3398,10 +3298,21 @@ sub config_bisect {
         }
     }
 
+    my $last_run = "";
+
     do {
-        $ret = run_config_bisect \%good_configs, \%bad_configs;
+        $ret = run_config_bisect $good_config, $bad_config, $last_run;
+        if ($ret == 3) {
+            $last_run = "good";
+        } elsif ($ret == 4) {
+            $last_run = "bad";
+        }
         print_times;
-    } while (!$ret);
+    } while ($ret == 3 || $ret == 4);
+
+    if ($ret == 2) {
+        config_bisect_end "$good_config.tmp", "$bad_config.tmp";
+    }
 
     return $ret if ($ret < 0);
 
@@ -3416,9 +3327,9 @@ sub patchcheck_reboot {
 sub patchcheck {
     my ($i) = @_;
 
-    die "PATCHCHECK_START[$i] not defined\n"
+    dodie "PATCHCHECK_START[$i] not defined\n"
         if (!defined($patchcheck_start));
-    die "PATCHCHECK_TYPE[$i] not defined\n"
+    dodie "PATCHCHECK_TYPE[$i] not defined\n"
         if (!defined($patchcheck_type));
 
     my $start = $patchcheck_start;
@@ -3432,7 +3343,7 @@ sub patchcheck {
     if (defined($patchcheck_end)) {
         $end = $patchcheck_end;
     } elsif ($cherry) {
-        die "PATCHCHECK_END must be defined with PATCHCHECK_CHERRY\n";
+        dodie "PATCHCHECK_END must be defined with PATCHCHECK_CHERRY\n";
     }
 
     # Get the true sha1's since we can use things like HEAD~3
@@ -3496,7 +3407,7 @@ sub patchcheck {
         doprint "\nProcessing commit \"$item\"\n\n";
 
         run_command "git checkout $sha1" or
-            die "Failed to checkout $sha1";
+            dodie "Failed to checkout $sha1";
 
         # only clean on the first and last patch
         if ($item eq $list[0] ||
@@ -3587,7 +3498,7 @@ sub read_kconfig {
     }
 
     open(KIN, "$kconfig")
-        or die "Can't open $kconfig";
+        or dodie "Can't open $kconfig";
     while (<KIN>) {
         chomp;
 
@@ -3683,8 +3594,6 @@ sub read_depends {
     # what directory to look at.
     if ($arch eq "i386" || $arch eq "x86_64") {
         $arch = "x86";
-    } elsif ($arch =~ /^tile/) {
-        $arch = "tile";
     }
 
     my $kconfig = "$builddir/arch/$arch/Kconfig";
@@ -3748,7 +3657,7 @@ sub get_depends {
 
             $dep =~ s/^[^$valid]*[$valid]+//;
         } else {
-            die "this should never happen";
+            dodie "this should never happen";
         }
     }
 
@@ -4009,7 +3918,7 @@ sub make_min_config {
             # update new ignore configs
             if (defined($ignore_config)) {
                 open (OUT, ">$temp_config")
-                    or die "Can't write to $temp_config";
+                    or dodie "Can't write to $temp_config";
                 foreach my $config (keys %save_configs) {
                     print OUT "$save_configs{$config}\n";
                 }
@@ -4037,7 +3946,7 @@ sub make_min_config {
 
             # Save off all the current mandatory configs
             open (OUT, ">$temp_config")
-                or die "Can't write to $temp_config";
+                or dodie "Can't write to $temp_config";
             foreach my $config (keys %keep_configs) {
                 print OUT "$keep_configs{$config}\n";
             }
@@ -4224,6 +4133,74 @@ sub set_test_option {
     return eval_option($name, $option, $i);
 }
 
+sub find_mailer {
+    my ($mailer) = @_;
+
+    my @paths = split /:/, $ENV{PATH};
+
+    # sendmail is usually in /usr/sbin
+    $paths[$#paths + 1] = "/usr/sbin";
+
+    foreach my $path (@paths) {
+        if (-x "$path/$mailer") {
+            return $path;
+        }
+    }
+
+    return undef;
+}
+
+sub do_send_mail {
+    my ($subject, $message) = @_;
+
+    if (!defined($mail_path)) {
+        # find the mailer
+        $mail_path = find_mailer $mailer;
+        if (!defined($mail_path)) {
+            die "\nCan not find $mailer in PATH\n";
+        }
+    }
+
+    if (!defined($mail_command)) {
+        if ($mailer eq "mail" || $mailer eq "mailx") {
+            $mail_command = "\$MAIL_PATH/\$MAILER -s \'\$SUBJECT\' \$MAILTO <<< \'\$MESSAGE\'";
+        } elsif ($mailer eq "sendmail" ) {
+            $mail_command =  "echo \'Subject: \$SUBJECT\n\n\$MESSAGE\' | \$MAIL_PATH/\$MAILER -t \$MAILTO";
+        } else {
+            die "\nYour mailer: $mailer is not supported.\n";
+        }
+    }
+
+    $mail_command =~ s/\$MAILER/$mailer/g;
+    $mail_command =~ s/\$MAIL_PATH/$mail_path/g;
+    $mail_command =~ s/\$MAILTO/$mailto/g;
+    $mail_command =~ s/\$SUBJECT/$subject/g;
+    $mail_command =~ s/\$MESSAGE/$message/g;
+
+    run_command $mail_command;
+}
+
+sub send_email {
+
+    if (defined($mailto)) {
+        if (!defined($mailer)) {
+            doprint "No email sent: email or mailer not specified in config.\n";
+            return;
+        }
+        do_send_mail @_;
+    }
+}
+
+sub cancel_test {
+    if ($email_when_canceled) {
+        send_email("KTEST: Your [$test_type] test was cancelled",
+                "Your test started at $script_start_time was cancelled: sig int");
+    }
+    die "\nCaught Sig Int, test interrupted: $!\n"
+}
+
+$SIG{INT} = qw(cancel_test);
+
 # First we need to do is the builds
 for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
@@ -4247,11 +4224,11 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
     $outputdir = set_test_option("OUTPUT_DIR", $i);
     $builddir = set_test_option("BUILD_DIR", $i);
 
-    chdir $builddir || die "can't change directory to $builddir";
+    chdir $builddir || dodie "can't change directory to $builddir";
 
     if (!-d $outputdir) {
         mkpath($outputdir) or
-            die "can't create $outputdir";
+            dodie "can't create $outputdir";
     }
 
     $make = "$makecmd O=$outputdir";
@@ -4264,9 +4241,15 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
     $start_minconfig_defined = 1;
 
     # The first test may override the PRE_KTEST option
-    if (defined($pre_ktest) && $i == 1) {
-        doprint "\n";
-        run_command $pre_ktest;
+    if ($i == 1) {
+        if (defined($pre_ktest)) {
+            doprint "\n";
+            run_command $pre_ktest;
+        }
+        if ($email_when_started) {
+            send_email("KTEST: Your [$test_type] test was started",
+                "Your test was started on $script_start_time");
+        }
     }
 
     # Any test can override the POST_KTEST option
@@ -4282,7 +4265,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
     if (!-d $tmpdir) {
         mkpath($tmpdir) or
-            die "can't create $tmpdir";
+            dodie "can't create $tmpdir";
     }
 
     $ENV{"SSH_USER"} = $ssh_user;
@@ -4355,7 +4338,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
     if (defined($checkout)) {
         run_command "git checkout $checkout" or
-            die "failed to checkout $checkout";
+            dodie "failed to checkout $checkout";
     }
 
     $no_reboot = 0;
@@ -4430,4 +4413,8 @@ if ($opt{"POWEROFF_ON_SUCCESS"}) {
 
 doprint "\n    $successes of $opt{NUM_TESTS} tests were successful\n\n";
 
+if ($email_when_finished) {
+    send_email("KTEST: Your [$test_type] test has finished!",
+            "$successes of $opt{NUM_TESTS} tests started at $script_start_time were successful!");
+}
 exit 0;
diff --git a/tools/testing/ktest/sample.conf b/tools/testing/ktest/sample.conf
index 6c58cd8bbbae..6ca6ca0ce695 100644
--- a/tools/testing/ktest/sample.conf
+++ b/tools/testing/ktest/sample.conf
@@ -1,6 +1,11 @@
 #
 # Config file for ktest.pl
 #
+# Place your customized version of this, in the working directory that
+# ktest.pl is run from. By default, ktest.pl will look for a file
+# called "ktest.conf", but you can name it anything you like and specify
+# the name of your config file as the first argument of ktest.pl.
+#
 # Note, all paths must be absolute
 #
 
@@ -396,6 +401,44 @@
 
 #### Optional Config Options (all have defaults) ####
 
+# Email options for receiving notifications. Users must setup
+# the specified mailer prior to using this feature.
+#
+# (default undefined)
+#MAILTO =
+#
+# Supported mailers: sendmail, mail, mailx
+# (default sendmail)
+#MAILER = sendmail
+#
+# The executable to run
+# (default: for sendmail "/usr/sbin/sendmail", otherwise equals ${MAILER})
+#MAIL_EXEC = /usr/sbin/sendmail
+#
+# The command used to send mail, which uses the above options
+# can be modified. By default if the mailer is "sendmail" then
+#  MAIL_COMMAND = echo \'Subject: $SUBJECT\n\n$MESSAGE\' | $MAIL_PATH/$MAILER -t $MAILTO
+# For mail or mailx:
+#  MAIL_COMMAND = "$MAIL_PATH/$MAILER -s \'$SUBJECT\' $MAILTO <<< \'$MESSAGE\'
+# ktest.pl will do the substitution for MAIL_PATH, MAILER, MAILTO at the time
+#    it sends the mail if "$FOO" format is used. If "${FOO}" format is used,
+#    then the substitutions will occur at the time the config file is read.
+#    But note, MAIL_PATH and MAILER require being set by the config file if
+#     ${MAIL_PATH} or ${MAILER} are used, but not if $MAIL_PATH or $MAILER are.
+#MAIL_COMMAND = echo \'Subject: $SUBJECT\n\n$MESSAGE\' | $MAIL_PATH/$MAILER -t $MAILTO
+#
+# Errors are defined as those would terminate the script
+# (default 1)
+#EMAIL_ON_ERROR = 1
+# (default 1)
+#EMAIL_WHEN_FINISHED = 1
+# (default 0)
+#EMAIL_WHEN_STARTED = 1
+#
+# Users can cancel the test by Ctrl^C
+# (default 0)
+#EMAIL_WHEN_CANCELED = 1
+
 # Start a test setup. If you leave this off, all options
 # will be default and the test will run once.
 # This is a label and not really an option (it takes no value).
@@ -725,6 +768,13 @@
 # (default 120)
 #TIMEOUT = 120
 
+# The timeout in seconds when to test if the box can be rebooted
+# or not. Before issuing the reboot command, a ssh connection
+# is attempted to see if the target machine is still active.
+# If the target does not connect within this timeout, a power cycle
+# is issued instead of a reboot.
+# CONNECT_TIMEOUT = 25
+
 # In between tests, a reboot of the box may occur, and this
 # is the time to wait for the console after it stops producing
 # output. Some machines may not produce a large lag on reboot
@@ -1167,6 +1217,16 @@
 #  Set it to "good" to test only the good config and set it
 #  to "bad" to only test the bad config.
 #
+# CONFIG_BISECT_EXEC (optional)
+#  The config bisect is a separate program that comes with ktest.pl.
+#  By befault, it will look for:
+#    `pwd`/config-bisect.pl # the location ktest.pl was executed from.
+#  If it does not find it there, it will look for:
+#    `dirname <ktest.pl>`/config-bisect.pl # The directory that holds ktest.pl
+#  If it does not find it there, it will look for:
+#    ${BUILD_DIR}/tools/testing/ktest/config-bisect.pl
+#  Setting CONFIG_BISECT_EXEC will override where it looks.
+#
 # Example:
 #   TEST_START
 #   TEST_TYPE = config_bisect
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index 620fa78b3b1b..4ea385be528f 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -104,7 +104,8 @@ enum {
         NUM_HINTS = 8,
         NUM_BDW = NUM_DCR,
         NUM_SPA = NUM_PM + NUM_DCR + NUM_BDW,
-        NUM_MEM = NUM_DCR + NUM_BDW + 2 /* spa0 iset */ + 4 /* spa1 iset */,
+        NUM_MEM = NUM_DCR + NUM_BDW + 2 /* spa0 iset */
+                + 4 /* spa1 iset */ + 1 /* spa11 iset */,
         DIMM_SIZE = SZ_32M,
         LABEL_SIZE = SZ_128K,
         SPA_VCD_SIZE = SZ_4M,
@@ -137,6 +138,7 @@ static u32 handle[] = {
 };
 
 static unsigned long dimm_fail_cmd_flags[NUM_DCR];
+static int dimm_fail_cmd_code[NUM_DCR];
 
 struct nfit_test_fw {
         enum intel_fw_update_state state;
@@ -153,6 +155,7 @@ struct nfit_test {
         void *nfit_buf;
         dma_addr_t nfit_dma;
         size_t nfit_size;
+        size_t nfit_filled;
         int dcr_idx;
         int num_dcr;
         int num_pm;
@@ -709,7 +712,9 @@ static void smart_notify(struct device *bus_dev,
                                 >= thresh->media_temperature)
                         || ((thresh->alarm_control & ND_INTEL_SMART_CTEMP_TRIP)
                                 && smart->ctrl_temperature
-                                >= thresh->ctrl_temperature)) {
+                                >= thresh->ctrl_temperature)
+                        || (smart->health != ND_INTEL_SMART_NON_CRITICAL_HEALTH)
+                        || (smart->shutdown_state != 0)) {
                 device_lock(bus_dev);
                 __acpi_nvdimm_notify(dimm_dev, 0x81);
                 device_unlock(bus_dev);
@@ -735,6 +740,32 @@ static int nfit_test_cmd_smart_set_threshold(
         return 0;
 }
 
+static int nfit_test_cmd_smart_inject(
+                struct nd_intel_smart_inject *inj,
+                unsigned int buf_len,
+                struct nd_intel_smart_threshold *thresh,
+                struct nd_intel_smart *smart,
+                struct device *bus_dev, struct device *dimm_dev)
+{
+        if (buf_len != sizeof(*inj))
+                return -EINVAL;
+
+        if (inj->mtemp_enable)
+                smart->media_temperature = inj->media_temperature;
+        if (inj->spare_enable)
+                smart->spares = inj->spares;
+        if (inj->fatal_enable)
+                smart->health = ND_INTEL_SMART_FATAL_HEALTH;
+        if (inj->unsafe_shutdown_enable) {
+                smart->shutdown_state = 1;
+                smart->shutdown_count++;
+        }
+        inj->status = 0;
+        smart_notify(bus_dev, dimm_dev, smart, thresh);
+
+        return 0;
+}
+
 static void uc_error_notify(struct work_struct *work)
 {
         struct nfit_test *t = container_of(work, typeof(*t), work);
@@ -862,8 +893,11 @@ static int get_dimm(struct nfit_mem *nfit_mem, unsigned int func)
         if (i >= ARRAY_SIZE(handle))
                 return -ENXIO;
 
-        if ((1 << func) & dimm_fail_cmd_flags[i])
+        if ((1 << func) & dimm_fail_cmd_flags[i]) {
+                if (dimm_fail_cmd_code[i])
+                        return dimm_fail_cmd_code[i];
                 return -EIO;
+        }
 
         return i;
 }
@@ -935,6 +969,13 @@ static int nfit_test_ctl(struct nvdimm_bus_descriptor *nd_desc,
                                                         t->dcr_idx],
                                                 &t->smart[i - t->dcr_idx],
                                                 &t->pdev.dev, t->dimm_dev[i]);
+                        case ND_INTEL_SMART_INJECT:
+                                return nfit_test_cmd_smart_inject(buf,
+                                                buf_len,
+                                                &t->smart_threshold[i -
+                                                        t->dcr_idx],
+                                                &t->smart[i - t->dcr_idx],
+                                                &t->pdev.dev, t->dimm_dev[i]);
                         default:
                                 return -ENOTTY;
                         }
@@ -1125,12 +1166,12 @@ static int ars_state_init(struct device *dev, struct ars_state *ars_state)
 
 static void put_dimms(void *data)
 {
-        struct device **dimm_dev = data;
+        struct nfit_test *t = data;
         int i;
 
-        for (i = 0; i < NUM_DCR; i++)
-                if (dimm_dev[i])
-                        device_unregister(dimm_dev[i]);
+        for (i = 0; i < t->num_dcr; i++)
+                if (t->dimm_dev[i])
+                        device_unregister(t->dimm_dev[i]);
 }
 
 static struct class *nfit_test_dimm;
@@ -1139,13 +1180,11 @@ static int dimm_name_to_id(struct device *dev)
 {
         int dimm;
 
-        if (sscanf(dev_name(dev), "test_dimm%d", &dimm) != 1
-                        || dimm >= NUM_DCR || dimm < 0)
+        if (sscanf(dev_name(dev), "test_dimm%d", &dimm) != 1)
                 return -ENXIO;
         return dimm;
 }
 
-
 static ssize_t handle_show(struct device *dev, struct device_attribute *attr,
                 char *buf)
 {
@@ -1154,7 +1193,7 @@ static ssize_t handle_show(struct device *dev, struct device_attribute *attr,
         if (dimm < 0)
                 return dimm;
 
-        return sprintf(buf, "%#x", handle[dimm]);
+        return sprintf(buf, "%#x\n", handle[dimm]);
 }
 DEVICE_ATTR_RO(handle);
 
@@ -1188,8 +1227,39 @@ static ssize_t fail_cmd_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RW(fail_cmd);
 
+static ssize_t fail_cmd_code_show(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        int dimm = dimm_name_to_id(dev);
+
+        if (dimm < 0)
+                return dimm;
+
+        return sprintf(buf, "%d\n", dimm_fail_cmd_code[dimm]);
+}
+
+static ssize_t fail_cmd_code_store(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t size)
+{
+        int dimm = dimm_name_to_id(dev);
+        unsigned long val;
+        ssize_t rc;
+
+        if (dimm < 0)
+                return dimm;
+
+        rc = kstrtol(buf, 0, &val);
+        if (rc)
+                return rc;
+
+        dimm_fail_cmd_code[dimm] = val;
+        return size;
+}
+static DEVICE_ATTR_RW(fail_cmd_code);
+
 static struct attribute *nfit_test_dimm_attributes[] = {
         &dev_attr_fail_cmd.attr,
+        &dev_attr_fail_cmd_code.attr,
         &dev_attr_handle.attr,
         NULL,
 };
@@ -1203,6 +1273,23 @@ static const struct attribute_group *nfit_test_dimm_attribute_groups[] = {
         NULL,
 };
 
+static int nfit_test_dimm_init(struct nfit_test *t)
+{
+        int i;
+
+        if (devm_add_action_or_reset(&t->pdev.dev, put_dimms, t))
+                return -ENOMEM;
+        for (i = 0; i < t->num_dcr; i++) {
+                t->dimm_dev[i] = device_create_with_groups(nfit_test_dimm,
+                                &t->pdev.dev, 0, NULL,
+                                nfit_test_dimm_attribute_groups,
+                                "test_dimm%d", i + t->dcr_idx);
+                if (!t->dimm_dev[i])
+                        return -ENOMEM;
+        }
+        return 0;
+}
+
 static void smart_init(struct nfit_test *t)
 {
         int i;
@@ -1222,7 +1309,7 @@ static void smart_init(struct nfit_test *t)
                         | ND_INTEL_SMART_MTEMP_VALID,
                 .health = ND_INTEL_SMART_NON_CRITICAL_HEALTH,
                 .media_temperature = 23 * 16,
-                .ctrl_temperature = 30 * 16,
+                .ctrl_temperature = 25 * 16,
                 .pmic_temperature = 40 * 16,
                 .spares = 75,
                 .alarm_flags = ND_INTEL_SMART_SPARE_TRIP
@@ -1298,17 +1385,8 @@ static int nfit_test0_alloc(struct nfit_test *t)
         if (!t->_fit)
                 return -ENOMEM;
 
-        if (devm_add_action_or_reset(&t->pdev.dev, put_dimms, t->dimm_dev))
+        if (nfit_test_dimm_init(t))
                 return -ENOMEM;
-        for (i = 0; i < NUM_DCR; i++) {
-                t->dimm_dev[i] = device_create_with_groups(nfit_test_dimm,
-                                &t->pdev.dev, 0, NULL,
-                                nfit_test_dimm_attribute_groups,
-                                "test_dimm%d", i);
-                if (!t->dimm_dev[i])
-                        return -ENOMEM;
-        }
-
         smart_init(t);
         return ars_state_init(&t->pdev.dev, &t->ars_state);
 }
@@ -1340,6 +1418,8 @@ static int nfit_test1_alloc(struct nfit_test *t)
         if (!t->spa_set[1])
                 return -ENOMEM;
 
+        if (nfit_test_dimm_init(t))
+                return -ENOMEM;
         smart_init(t);
         return ars_state_init(&t->pdev.dev, &t->ars_state);
 }
@@ -1366,7 +1446,7 @@ static void nfit_test0_setup(struct nfit_test *t)
         struct acpi_nfit_data_region *bdw;
         struct acpi_nfit_flush_address *flush;
         struct acpi_nfit_capabilities *pcap;
-        unsigned int offset, i;
+        unsigned int offset = 0, i;
 
         /*
          * spa0 (interleave first half of dimm0 and dimm1, note storage
@@ -1380,93 +1460,102 @@ static void nfit_test0_setup(struct nfit_test *t)
         spa->range_index = 0+1;
         spa->address = t->spa_set_dma[0];
         spa->length = SPA0_SIZE;
+        offset += spa->header.length;
 
         /*
          * spa1 (interleave last half of the 4 DIMMS, note storage
          * does not actually alias the related block-data-window
          * regions)
          */
-        spa = nfit_buf + sizeof(*spa);
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_PM), 16);
         spa->range_index = 1+1;
         spa->address = t->spa_set_dma[1];
         spa->length = SPA1_SIZE;
+        offset += spa->header.length;
 
         /* spa2 (dcr0) dimm0 */
-        spa = nfit_buf + sizeof(*spa) * 2;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_DCR), 16);
         spa->range_index = 2+1;
         spa->address = t->dcr_dma[0];
         spa->length = DCR_SIZE;
+        offset += spa->header.length;
 
         /* spa3 (dcr1) dimm1 */
-        spa = nfit_buf + sizeof(*spa) * 3;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_DCR), 16);
         spa->range_index = 3+1;
         spa->address = t->dcr_dma[1];
         spa->length = DCR_SIZE;
+        offset += spa->header.length;
 
         /* spa4 (dcr2) dimm2 */
-        spa = nfit_buf + sizeof(*spa) * 4;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_DCR), 16);
         spa->range_index = 4+1;
         spa->address = t->dcr_dma[2];
         spa->length = DCR_SIZE;
+        offset += spa->header.length;
 
         /* spa5 (dcr3) dimm3 */
-        spa = nfit_buf + sizeof(*spa) * 5;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_DCR), 16);
         spa->range_index = 5+1;
         spa->address = t->dcr_dma[3];
         spa->length = DCR_SIZE;
+        offset += spa->header.length;
 
         /* spa6 (bdw for dcr0) dimm0 */
-        spa = nfit_buf + sizeof(*spa) * 6;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_BDW), 16);
         spa->range_index = 6+1;
         spa->address = t->dimm_dma[0];
         spa->length = DIMM_SIZE;
+        offset += spa->header.length;
 
         /* spa7 (bdw for dcr1) dimm1 */
-        spa = nfit_buf + sizeof(*spa) * 7;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_BDW), 16);
         spa->range_index = 7+1;
         spa->address = t->dimm_dma[1];
         spa->length = DIMM_SIZE;
+        offset += spa->header.length;
 
         /* spa8 (bdw for dcr2) dimm2 */
-        spa = nfit_buf + sizeof(*spa) * 8;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_BDW), 16);
         spa->range_index = 8+1;
         spa->address = t->dimm_dma[2];
         spa->length = DIMM_SIZE;
+        offset += spa->header.length;
 
         /* spa9 (bdw for dcr3) dimm3 */
-        spa = nfit_buf + sizeof(*spa) * 9;
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_BDW), 16);
         spa->range_index = 9+1;
         spa->address = t->dimm_dma[3];
         spa->length = DIMM_SIZE;
+        offset += spa->header.length;
 
-        offset = sizeof(*spa) * 10;
         /* mem-region0 (spa0, dimm0) */
         memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
@@ -1481,9 +1570,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 2;
+        offset += memdev->header.length;
 
         /* mem-region1 (spa0, dimm1) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map);
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[1];
@@ -1497,9 +1587,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->interleave_index = 0;
         memdev->interleave_ways = 2;
         memdev->flags = ACPI_NFIT_MEM_HEALTH_ENABLED;
+        offset += memdev->header.length;
 
         /* mem-region2 (spa1, dimm0) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 2;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[0];
@@ -1513,9 +1604,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->interleave_index = 0;
         memdev->interleave_ways = 4;
         memdev->flags = ACPI_NFIT_MEM_HEALTH_ENABLED;
+        offset += memdev->header.length;
 
         /* mem-region3 (spa1, dimm1) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 3;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[1];
@@ -1528,9 +1620,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = SPA0_SIZE/2;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 4;
+        offset += memdev->header.length;
 
         /* mem-region4 (spa1, dimm2) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 4;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[2];
@@ -1544,9 +1637,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->interleave_index = 0;
         memdev->interleave_ways = 4;
         memdev->flags = ACPI_NFIT_MEM_HEALTH_ENABLED;
+        offset += memdev->header.length;
 
         /* mem-region5 (spa1, dimm3) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 5;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[3];
@@ -1559,9 +1653,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = SPA0_SIZE/2;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 4;
+        offset += memdev->header.length;
 
         /* mem-region6 (spa/dcr0, dimm0) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 6;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[0];
@@ -1574,9 +1669,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region7 (spa/dcr1, dimm1) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 7;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[1];
@@ -1589,9 +1685,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region8 (spa/dcr2, dimm2) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 8;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[2];
@@ -1604,9 +1701,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region9 (spa/dcr3, dimm3) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 9;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[3];
@@ -1619,9 +1717,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region10 (spa/bdw0, dimm0) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 10;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[0];
@@ -1634,9 +1733,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region11 (spa/bdw1, dimm1) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 11;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[1];
@@ -1649,9 +1749,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region12 (spa/bdw2, dimm2) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 12;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[2];
@@ -1664,9 +1765,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->address = 0;
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
+        offset += memdev->header.length;
 
         /* mem-region13 (spa/dcr3, dimm3) */
-        memdev = nfit_buf + offset + sizeof(struct acpi_nfit_memory_map) * 13;
+        memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
         memdev->device_handle = handle[3];
@@ -1680,12 +1782,12 @@ static void nfit_test0_setup(struct nfit_test *t)
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
         memdev->flags = ACPI_NFIT_MEM_HEALTH_ENABLED;
+        offset += memdev->header.length;
 
-        offset = offset + sizeof(struct acpi_nfit_memory_map) * 14;
         /* dcr-descriptor0: blk */
         dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
-        dcr->header.length = sizeof(struct acpi_nfit_control_region);
+        dcr->header.length = sizeof(*dcr);
         dcr->region_index = 0+1;
         dcr_common_init(dcr);
         dcr->serial_number = ~handle[0];
@@ -1696,11 +1798,12 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->command_size = 8;
         dcr->status_offset = 8;
         dcr->status_size = 4;
+        offset += dcr->header.length;
 
         /* dcr-descriptor1: blk */
-        dcr = nfit_buf + offset + sizeof(struct acpi_nfit_control_region);
+        dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
-        dcr->header.length = sizeof(struct acpi_nfit_control_region);
+        dcr->header.length = sizeof(*dcr);
         dcr->region_index = 1+1;
         dcr_common_init(dcr);
         dcr->serial_number = ~handle[1];
@@ -1711,11 +1814,12 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->command_size = 8;
         dcr->status_offset = 8;
         dcr->status_size = 4;
+        offset += dcr->header.length;
 
         /* dcr-descriptor2: blk */
-        dcr = nfit_buf + offset + sizeof(struct acpi_nfit_control_region) * 2;
+        dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
-        dcr->header.length = sizeof(struct acpi_nfit_control_region);
+        dcr->header.length = sizeof(*dcr);
         dcr->region_index = 2+1;
         dcr_common_init(dcr);
         dcr->serial_number = ~handle[2];
@@ -1726,11 +1830,12 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->command_size = 8;
         dcr->status_offset = 8;
         dcr->status_size = 4;
+        offset += dcr->header.length;
 
         /* dcr-descriptor3: blk */
-        dcr = nfit_buf + offset + sizeof(struct acpi_nfit_control_region) * 3;
+        dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
-        dcr->header.length = sizeof(struct acpi_nfit_control_region);
+        dcr->header.length = sizeof(*dcr);
         dcr->region_index = 3+1;
         dcr_common_init(dcr);
         dcr->serial_number = ~handle[3];
@@ -1741,8 +1846,8 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->command_size = 8;
         dcr->status_offset = 8;
         dcr->status_size = 4;
+        offset += dcr->header.length;
 
-        offset = offset + sizeof(struct acpi_nfit_control_region) * 4;
         /* dcr-descriptor0: pmem */
         dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
@@ -1753,10 +1858,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->serial_number = ~handle[0];
         dcr->code = NFIT_FIC_BYTEN;
         dcr->windows = 0;
+        offset += dcr->header.length;
 
         /* dcr-descriptor1: pmem */
-        dcr = nfit_buf + offset + offsetof(struct acpi_nfit_control_region,
-                        window_size);
+        dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
         dcr->header.length = offsetof(struct acpi_nfit_control_region,
                         window_size);
@@ -1765,10 +1870,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->serial_number = ~handle[1];
         dcr->code = NFIT_FIC_BYTEN;
         dcr->windows = 0;
+        offset += dcr->header.length;
 
         /* dcr-descriptor2: pmem */
-        dcr = nfit_buf + offset + offsetof(struct acpi_nfit_control_region,
-                        window_size) * 2;
+        dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
         dcr->header.length = offsetof(struct acpi_nfit_control_region,
                         window_size);
@@ -1777,10 +1882,10 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->serial_number = ~handle[2];
         dcr->code = NFIT_FIC_BYTEN;
         dcr->windows = 0;
+        offset += dcr->header.length;
 
         /* dcr-descriptor3: pmem */
-        dcr = nfit_buf + offset + offsetof(struct acpi_nfit_control_region,
-                        window_size) * 3;
+        dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
         dcr->header.length = offsetof(struct acpi_nfit_control_region,
                         window_size);
@@ -1789,54 +1894,56 @@ static void nfit_test0_setup(struct nfit_test *t)
         dcr->serial_number = ~handle[3];
         dcr->code = NFIT_FIC_BYTEN;
         dcr->windows = 0;
+        offset += dcr->header.length;
 
-        offset = offset + offsetof(struct acpi_nfit_control_region,
-                        window_size) * 4;
         /* bdw0 (spa/dcr0, dimm0) */
         bdw = nfit_buf + offset;
         bdw->header.type = ACPI_NFIT_TYPE_DATA_REGION;
-        bdw->header.length = sizeof(struct acpi_nfit_data_region);
+        bdw->header.length = sizeof(*bdw);
         bdw->region_index = 0+1;
         bdw->windows = 1;
         bdw->offset = 0;
         bdw->size = BDW_SIZE;
         bdw->capacity = DIMM_SIZE;
         bdw->start_address = 0;
+        offset += bdw->header.length;
 
         /* bdw1 (spa/dcr1, dimm1) */
-        bdw = nfit_buf + offset + sizeof(struct acpi_nfit_data_region);
+        bdw = nfit_buf + offset;
         bdw->header.type = ACPI_NFIT_TYPE_DATA_REGION;
-        bdw->header.length = sizeof(struct acpi_nfit_data_region);
+        bdw->header.length = sizeof(*bdw);
         bdw->region_index = 1+1;
         bdw->windows = 1;
         bdw->offset = 0;
         bdw->size = BDW_SIZE;
         bdw->capacity = DIMM_SIZE;
         bdw->start_address = 0;
+        offset += bdw->header.length;
 
         /* bdw2 (spa/dcr2, dimm2) */
-        bdw = nfit_buf + offset + sizeof(struct acpi_nfit_data_region) * 2;
+        bdw = nfit_buf + offset;
         bdw->header.type = ACPI_NFIT_TYPE_DATA_REGION;
-        bdw->header.length = sizeof(struct acpi_nfit_data_region);
+        bdw->header.length = sizeof(*bdw);
         bdw->region_index = 2+1;
         bdw->windows = 1;
         bdw->offset = 0;
         bdw->size = BDW_SIZE;
         bdw->capacity = DIMM_SIZE;
         bdw->start_address = 0;
+        offset += bdw->header.length;
 
         /* bdw3 (spa/dcr3, dimm3) */
-        bdw = nfit_buf + offset + sizeof(struct acpi_nfit_data_region) * 3;
+        bdw = nfit_buf + offset;
         bdw->header.type = ACPI_NFIT_TYPE_DATA_REGION;
-        bdw->header.length = sizeof(struct acpi_nfit_data_region);
+        bdw->header.length = sizeof(*bdw);
         bdw->region_index = 3+1;
         bdw->windows = 1;
         bdw->offset = 0;
         bdw->size = BDW_SIZE;
         bdw->capacity = DIMM_SIZE;
         bdw->start_address = 0;
+        offset += bdw->header.length;
 
-        offset = offset + sizeof(struct acpi_nfit_data_region) * 4;
         /* flush0 (dimm0) */
         flush = nfit_buf + offset;
         flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
@@ -1845,48 +1952,52 @@ static void nfit_test0_setup(struct nfit_test *t)
         flush->hint_count = NUM_HINTS;
         for (i = 0; i < NUM_HINTS; i++)
                 flush->hint_address[i] = t->flush_dma[0] + i * sizeof(u64);
+        offset += flush->header.length;
 
         /* flush1 (dimm1) */
-        flush = nfit_buf + offset + flush_hint_size * 1;
+        flush = nfit_buf + offset;
         flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
         flush->header.length = flush_hint_size;
         flush->device_handle = handle[1];
         flush->hint_count = NUM_HINTS;
         for (i = 0; i < NUM_HINTS; i++)
                 flush->hint_address[i] = t->flush_dma[1] + i * sizeof(u64);
+        offset += flush->header.length;
 
         /* flush2 (dimm2) */
-        flush = nfit_buf + offset + flush_hint_size  * 2;
+        flush = nfit_buf + offset;
         flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
         flush->header.length = flush_hint_size;
         flush->device_handle = handle[2];
         flush->hint_count = NUM_HINTS;
         for (i = 0; i < NUM_HINTS; i++)
                 flush->hint_address[i] = t->flush_dma[2] + i * sizeof(u64);
+        offset += flush->header.length;
 
         /* flush3 (dimm3) */
-        flush = nfit_buf + offset + flush_hint_size * 3;
+        flush = nfit_buf + offset;
         flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
         flush->header.length = flush_hint_size;
         flush->device_handle = handle[3];
         flush->hint_count = NUM_HINTS;
         for (i = 0; i < NUM_HINTS; i++)
                 flush->hint_address[i] = t->flush_dma[3] + i * sizeof(u64);
+        offset += flush->header.length;
 
         /* platform capabilities */
-        pcap = nfit_buf + offset + flush_hint_size * 4;
+        pcap = nfit_buf + offset;
         pcap->header.type = ACPI_NFIT_TYPE_CAPABILITIES;
         pcap->header.length = sizeof(*pcap);
         pcap->highest_capability = 1;
         pcap->capabilities = ACPI_NFIT_CAPABILITY_CACHE_FLUSH |
                 ACPI_NFIT_CAPABILITY_MEM_FLUSH;
+        offset += pcap->header.length;
 
         if (t->setup_hotplug) {
-                offset = offset + flush_hint_size * 4 + sizeof(*pcap);
                 /* dcr-descriptor4: blk */
                 dcr = nfit_buf + offset;
                 dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
-                dcr->header.length = sizeof(struct acpi_nfit_control_region);
+                dcr->header.length = sizeof(*dcr);
                 dcr->region_index = 8+1;
                 dcr_common_init(dcr);
                 dcr->serial_number = ~handle[4];
@@ -1897,8 +2008,8 @@ static void nfit_test0_setup(struct nfit_test *t)
                 dcr->command_size = 8;
                 dcr->status_offset = 8;
                 dcr->status_size = 4;
+                offset += dcr->header.length;
 
-                offset = offset + sizeof(struct acpi_nfit_control_region);
                 /* dcr-descriptor4: pmem */
                 dcr = nfit_buf + offset;
                 dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
@@ -1909,21 +2020,20 @@ static void nfit_test0_setup(struct nfit_test *t)
                 dcr->serial_number = ~handle[4];
                 dcr->code = NFIT_FIC_BYTEN;
                 dcr->windows = 0;
+                offset += dcr->header.length;
 
-                offset = offset + offsetof(struct acpi_nfit_control_region,
-                                window_size);
                 /* bdw4 (spa/dcr4, dimm4) */
                 bdw = nfit_buf + offset;
                 bdw->header.type = ACPI_NFIT_TYPE_DATA_REGION;
-                bdw->header.length = sizeof(struct acpi_nfit_data_region);
+                bdw->header.length = sizeof(*bdw);
                 bdw->region_index = 8+1;
                 bdw->windows = 1;
                 bdw->offset = 0;
                 bdw->size = BDW_SIZE;
                 bdw->capacity = DIMM_SIZE;
                 bdw->start_address = 0;
+                offset += bdw->header.length;
 
-                offset = offset + sizeof(struct acpi_nfit_data_region);
                 /* spa10 (dcr4) dimm4 */
                 spa = nfit_buf + offset;
                 spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
@@ -1932,30 +2042,32 @@ static void nfit_test0_setup(struct nfit_test *t)
                 spa->range_index = 10+1;
                 spa->address = t->dcr_dma[4];
                 spa->length = DCR_SIZE;
+                offset += spa->header.length;
 
                 /*
                  * spa11 (single-dimm interleave for hotplug, note storage
                  * does not actually alias the related block-data-window
                  * regions)
                  */
-                spa = nfit_buf + offset + sizeof(*spa);
+                spa = nfit_buf + offset;
                 spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
                 spa->header.length = sizeof(*spa);
                 memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_PM), 16);
                 spa->range_index = 11+1;
                 spa->address = t->spa_set_dma[2];
                 spa->length = SPA0_SIZE;
+                offset += spa->header.length;
 
                 /* spa12 (bdw for dcr4) dimm4 */
-                spa = nfit_buf + offset + sizeof(*spa) * 2;
+                spa = nfit_buf + offset;
                 spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
                 spa->header.length = sizeof(*spa);
                 memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_BDW), 16);
                 spa->range_index = 12+1;
                 spa->address = t->dimm_dma[4];
                 spa->length = DIMM_SIZE;
+                offset += spa->header.length;
 
-                offset = offset + sizeof(*spa) * 3;
                 /* mem-region14 (spa/dcr4, dimm4) */
                 memdev = nfit_buf + offset;
                 memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
@@ -1970,10 +2082,10 @@ static void nfit_test0_setup(struct nfit_test *t)
                 memdev->address = 0;
                 memdev->interleave_index = 0;
                 memdev->interleave_ways = 1;
+                offset += memdev->header.length;
 
-                /* mem-region15 (spa0, dimm4) */
-                memdev = nfit_buf + offset +
-                                sizeof(struct acpi_nfit_memory_map);
+                /* mem-region15 (spa11, dimm4) */
+                memdev = nfit_buf + offset;
                 memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
                 memdev->header.length = sizeof(*memdev);
                 memdev->device_handle = handle[4];
@@ -1987,10 +2099,10 @@ static void nfit_test0_setup(struct nfit_test *t)
                 memdev->interleave_index = 0;
                 memdev->interleave_ways = 1;
                 memdev->flags = ACPI_NFIT_MEM_HEALTH_ENABLED;
+                offset += memdev->header.length;
 
                 /* mem-region16 (spa/bdw4, dimm4) */
-                memdev = nfit_buf + offset +
-                                sizeof(struct acpi_nfit_memory_map) * 2;
+                memdev = nfit_buf + offset;
                 memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
                 memdev->header.length = sizeof(*memdev);
                 memdev->device_handle = handle[4];
@@ -2003,8 +2115,8 @@ static void nfit_test0_setup(struct nfit_test *t)
                 memdev->address = 0;
                 memdev->interleave_index = 0;
                 memdev->interleave_ways = 1;
+                offset += memdev->header.length;
 
-                offset = offset + sizeof(struct acpi_nfit_memory_map) * 3;
                 /* flush3 (dimm4) */
                 flush = nfit_buf + offset;
                 flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
@@ -2014,8 +2126,14 @@ static void nfit_test0_setup(struct nfit_test *t)
                 for (i = 0; i < NUM_HINTS; i++)
                         flush->hint_address[i] = t->flush_dma[4]
                                 + i * sizeof(u64);
+                offset += flush->header.length;
+
+                /* sanity check to make sure we've filled the buffer */
+                WARN_ON(offset != t->nfit_size);
         }
 
+        t->nfit_filled = offset;
+
         post_ars_status(&t->ars_state, &t->badrange, t->spa_set_dma[0],
                         SPA0_SIZE);
 
@@ -2026,6 +2144,7 @@ static void nfit_test0_setup(struct nfit_test *t)
         set_bit(ND_INTEL_SMART, &acpi_desc->dimm_cmd_force_en);
         set_bit(ND_INTEL_SMART_THRESHOLD, &acpi_desc->dimm_cmd_force_en);
         set_bit(ND_INTEL_SMART_SET_THRESHOLD, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_INTEL_SMART_INJECT, &acpi_desc->dimm_cmd_force_en);
         set_bit(ND_CMD_ARS_CAP, &acpi_desc->bus_cmd_force_en);
         set_bit(ND_CMD_ARS_START, &acpi_desc->bus_cmd_force_en);
         set_bit(ND_CMD_ARS_STATUS, &acpi_desc->bus_cmd_force_en);
@@ -2061,17 +2180,18 @@ static void nfit_test1_setup(struct nfit_test *t)
         spa->range_index = 0+1;
         spa->address = t->spa_set_dma[0];
         spa->length = SPA2_SIZE;
+        offset += spa->header.length;
 
         /* virtual cd region */
-        spa = nfit_buf + sizeof(*spa);
+        spa = nfit_buf + offset;
         spa->header.type = ACPI_NFIT_TYPE_SYSTEM_ADDRESS;
         spa->header.length = sizeof(*spa);
         memcpy(spa->range_guid, to_nfit_uuid(NFIT_SPA_VCD), 16);
         spa->range_index = 0;
         spa->address = t->spa_set_dma[1];
         spa->length = SPA_VCD_SIZE;
+        offset += spa->header.length;
 
-        offset += sizeof(*spa) * 2;
         /* mem-region0 (spa0, dimm0) */
         memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
@@ -2089,8 +2209,8 @@ static void nfit_test1_setup(struct nfit_test *t)
         memdev->flags = ACPI_NFIT_MEM_SAVE_FAILED | ACPI_NFIT_MEM_RESTORE_FAILED
                 | ACPI_NFIT_MEM_FLUSH_FAILED | ACPI_NFIT_MEM_HEALTH_OBSERVED
                 | ACPI_NFIT_MEM_NOT_ARMED;
+        offset += memdev->header.length;
 
-        offset += sizeof(*memdev);
         /* dcr-descriptor0 */
         dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
@@ -2101,8 +2221,8 @@ static void nfit_test1_setup(struct nfit_test *t)
         dcr->serial_number = ~handle[5];
         dcr->code = NFIT_FIC_BYTE;
         dcr->windows = 0;
-
         offset += dcr->header.length;
+
         memdev = nfit_buf + offset;
         memdev->header.type = ACPI_NFIT_TYPE_MEMORY_MAP;
         memdev->header.length = sizeof(*memdev);
@@ -2117,9 +2237,9 @@ static void nfit_test1_setup(struct nfit_test *t)
         memdev->interleave_index = 0;
         memdev->interleave_ways = 1;
         memdev->flags = ACPI_NFIT_MEM_MAP_FAILED;
+        offset += memdev->header.length;
 
         /* dcr-descriptor1 */
-        offset += sizeof(*memdev);
         dcr = nfit_buf + offset;
         dcr->header.type = ACPI_NFIT_TYPE_CONTROL_REGION;
         dcr->header.length = offsetof(struct acpi_nfit_control_region,
@@ -2129,6 +2249,12 @@ static void nfit_test1_setup(struct nfit_test *t)
         dcr->serial_number = ~handle[6];
         dcr->code = NFIT_FIC_BYTE;
         dcr->windows = 0;
+        offset += dcr->header.length;
+
+        /* sanity check to make sure we've filled the buffer */
+        WARN_ON(offset != t->nfit_size);
+
+        t->nfit_filled = offset;
 
         post_ars_status(&t->ars_state, &t->badrange, t->spa_set_dma[0],
                         SPA2_SIZE);
@@ -2139,6 +2265,9 @@ static void nfit_test1_setup(struct nfit_test *t)
         set_bit(ND_CMD_ARS_STATUS, &acpi_desc->bus_cmd_force_en);
         set_bit(ND_CMD_CLEAR_ERROR, &acpi_desc->bus_cmd_force_en);
         set_bit(ND_INTEL_ENABLE_LSS_STATUS, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_CMD_GET_CONFIG_SIZE, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_CMD_GET_CONFIG_DATA, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_CMD_SET_CONFIG_DATA, &acpi_desc->dimm_cmd_force_en);
 }
 
 static int nfit_test_blk_do_io(struct nd_blk_region *ndbr, resource_size_t dpa,
@@ -2487,7 +2616,7 @@ static int nfit_test_probe(struct platform_device *pdev)
         nd_desc->ndctl = nfit_test_ctl;
 
         rc = acpi_nfit_init(acpi_desc, nfit_test->nfit_buf,
-                        nfit_test->nfit_size);
+                        nfit_test->nfit_filled);
         if (rc)
                 return rc;
 
diff --git a/tools/testing/nvdimm/test/nfit_test.h b/tools/testing/nvdimm/test/nfit_test.h
index 428344519cdf..33752e06ff8d 100644
--- a/tools/testing/nvdimm/test/nfit_test.h
+++ b/tools/testing/nvdimm/test/nfit_test.h
@@ -93,6 +93,7 @@ struct nd_cmd_ars_err_inj_stat {
 #define ND_INTEL_FW_FINISH_UPDATE       15
 #define ND_INTEL_FW_FINISH_QUERY        16
 #define ND_INTEL_SMART_SET_THRESHOLD    17
+#define ND_INTEL_SMART_INJECT           18
 
 #define ND_INTEL_SMART_HEALTH_VALID             (1 << 0)
 #define ND_INTEL_SMART_SPARES_VALID             (1 << 1)
@@ -111,6 +112,10 @@ struct nd_cmd_ars_err_inj_stat {
 #define ND_INTEL_SMART_NON_CRITICAL_HEALTH      (1 << 0)
 #define ND_INTEL_SMART_CRITICAL_HEALTH          (1 << 1)
 #define ND_INTEL_SMART_FATAL_HEALTH             (1 << 2)
+#define ND_INTEL_SMART_INJECT_MTEMP             (1 << 0)
+#define ND_INTEL_SMART_INJECT_SPARE             (1 << 1)
+#define ND_INTEL_SMART_INJECT_FATAL             (1 << 2)
+#define ND_INTEL_SMART_INJECT_SHUTDOWN          (1 << 3)
 
 struct nd_intel_smart {
         __u32 status;
@@ -158,6 +163,17 @@ struct nd_intel_smart_set_threshold {
         __u32 status;
 } __packed;
 
+struct nd_intel_smart_inject {
+        __u64 flags;
+        __u8 mtemp_enable;
+        __u16 media_temperature;
+        __u8 spare_enable;
+        __u8 spares;
+        __u8 fatal_enable;
+        __u8 unsafe_shutdown_enable;
+        __u32 status;
+} __packed;
+
 #define INTEL_FW_STORAGE_SIZE           0x100000
 #define INTEL_FW_MAX_SEND_LEN           0xFFEC
 #define INTEL_FW_QUERY_INTERVAL         250000
diff --git a/tools/testing/radix-tree/Makefile b/tools/testing/radix-tree/Makefile
index fa7ee369b3c9..db66f8a0d4be 100644
--- a/tools/testing/radix-tree/Makefile
+++ b/tools/testing/radix-tree/Makefile
@@ -17,7 +17,7 @@ ifeq ($(BUILD), 32)
         LDFLAGS += -m32
 endif
 
-targets: mapshift $(TARGETS)
+targets: generated/map-shift.h $(TARGETS)
 
 main:   $(OFILES)
 
@@ -42,9 +42,7 @@ radix-tree.c: ../../../lib/radix-tree.c
 idr.c: ../../../lib/idr.c
         sed -e 's/^static //' -e 's/__always_inline //' -e 's/inline //' < $< > $@
 
-.PHONY: mapshift
-
-mapshift:
+generated/map-shift.h:
         @if ! grep -qws $(SHIFT) generated/map-shift.h; then            \
                 echo "#define RADIX_TREE_MAP_SHIFT $(SHIFT)" >          \
                                 generated/map-shift.h;                  \
diff --git a/tools/testing/radix-tree/linux/gfp.h b/tools/testing/radix-tree/linux/gfp.h
index e3201ccf54c3..32159c08a52e 100644
--- a/tools/testing/radix-tree/linux/gfp.h
+++ b/tools/testing/radix-tree/linux/gfp.h
@@ -19,6 +19,7 @@
 
 #define __GFP_RECLAIM   (__GFP_DIRECT_RECLAIM|__GFP_KSWAPD_RECLAIM)
 
+#define GFP_ZONEMASK    0x0fu
 #define GFP_ATOMIC      (__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM)
 #define GFP_KERNEL      (__GFP_RECLAIM | __GFP_IO | __GFP_FS)
 #define GFP_NOWAIT      (__GFP_KSWAPD_RECLAIM)
diff --git a/tools/testing/radix-tree/multiorder.c b/tools/testing/radix-tree/multiorder.c
index 59245b3d587c..7bf405638b0b 100644
--- a/tools/testing/radix-tree/multiorder.c
+++ b/tools/testing/radix-tree/multiorder.c
@@ -16,6 +16,7 @@
 #include <linux/radix-tree.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
+#include <pthread.h>
 
 #include "test.h"
 
@@ -624,6 +625,67 @@ static void multiorder_account(void)
         item_kill_tree(&tree);
 }
 
+bool stop_iteration = false;
+
+static void *creator_func(void *ptr)
+{
+        /* 'order' is set up to ensure we have sibling entries */
+        unsigned int order = RADIX_TREE_MAP_SHIFT - 1;
+        struct radix_tree_root *tree = ptr;
+        int i;
+
+        for (i = 0; i < 10000; i++) {
+                item_insert_order(tree, 0, order);
+                item_delete_rcu(tree, 0);
+        }
+
+        stop_iteration = true;
+        return NULL;
+}
+
+static void *iterator_func(void *ptr)
+{
+        struct radix_tree_root *tree = ptr;
+        struct radix_tree_iter iter;
+        struct item *item;
+        void **slot;
+
+        while (!stop_iteration) {
+                rcu_read_lock();
+                radix_tree_for_each_slot(slot, tree, &iter, 0) {
+                        item = radix_tree_deref_slot(slot);
+
+                        if (!item)
+                                continue;
+                        if (radix_tree_deref_retry(item)) {
+                                slot = radix_tree_iter_retry(&iter);
+                                continue;
+                        }
+
+                        item_sanity(item, iter.index);
+                }
+                rcu_read_unlock();
+        }
+        return NULL;
+}
+
+static void multiorder_iteration_race(void)
+{
+        const int num_threads = sysconf(_SC_NPROCESSORS_ONLN);
+        pthread_t worker_thread[num_threads];
+        RADIX_TREE(tree, GFP_KERNEL);
+        int i;
+
+        pthread_create(&worker_thread[0], NULL, &creator_func, &tree);
+        for (i = 1; i < num_threads; i++)
+                pthread_create(&worker_thread[i], NULL, &iterator_func, &tree);
+
+        for (i = 0; i < num_threads; i++)
+                pthread_join(worker_thread[i], NULL);
+
+        item_kill_tree(&tree);
+}
+
 void multiorder_checks(void)
 {
         int i;
@@ -644,6 +706,7 @@ void multiorder_checks(void)
         multiorder_join();
         multiorder_split();
         multiorder_account();
+        multiorder_iteration_race();
 
         radix_tree_cpu_dead(0);
 }
diff --git a/tools/testing/radix-tree/test.c b/tools/testing/radix-tree/test.c
index 5978ab1f403d..def6015570b2 100644
--- a/tools/testing/radix-tree/test.c
+++ b/tools/testing/radix-tree/test.c
@@ -75,6 +75,25 @@ int item_delete(struct radix_tree_root *root, unsigned long index)
         return 0;
 }
 
+static void item_free_rcu(struct rcu_head *head)
+{
+        struct item *item = container_of(head, struct item, rcu_head);
+
+        free(item);
+}
+
+int item_delete_rcu(struct radix_tree_root *root, unsigned long index)
+{
+        struct item *item = radix_tree_delete(root, index);
+
+        if (item) {
+                item_sanity(item, index);
+                call_rcu(&item->rcu_head, item_free_rcu);
+                return 1;
+        }
+        return 0;
+}
+
 void item_check_present(struct radix_tree_root *root, unsigned long index)
 {
         struct item *item;
diff --git a/tools/testing/radix-tree/test.h b/tools/testing/radix-tree/test.h
index d9c031dbeb1a..31f1d9b6f506 100644
--- a/tools/testing/radix-tree/test.h
+++ b/tools/testing/radix-tree/test.h
@@ -5,6 +5,7 @@
 #include <linux/rcupdate.h>
 
 struct item {
+        struct rcu_head rcu_head;
         unsigned long index;
         unsigned int order;
 };
@@ -12,9 +13,11 @@ struct item {
 struct item *item_create(unsigned long index, unsigned int order);
 int __item_insert(struct radix_tree_root *root, struct item *item);
 int item_insert(struct radix_tree_root *root, unsigned long index);
+void item_sanity(struct item *item, unsigned long index);
 int item_insert_order(struct radix_tree_root *root, unsigned long index,
                         unsigned order);
 int item_delete(struct radix_tree_root *root, unsigned long index);
+int item_delete_rcu(struct radix_tree_root *root, unsigned long index);
 struct item *item_lookup(struct radix_tree_root *root, unsigned long index);
 
 void item_check_present(struct radix_tree_root *root, unsigned long index);
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 7442dfb73b7f..32aafa92074c 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -7,6 +7,7 @@ TARGETS += cpufreq
 TARGETS += cpu-hotplug
 TARGETS += efivarfs
 TARGETS += exec
+TARGETS += filesystems
 TARGETS += firmware
 TARGETS += ftrace
 TARGETS += futex
@@ -14,6 +15,7 @@ TARGETS += gpio
 TARGETS += intel_pstate
 TARGETS += ipc
 TARGETS += kcmp
+TARGETS += kvm
 TARGETS += lib
 TARGETS += membarrier
 TARGETS += memfd
@@ -23,6 +25,7 @@ TARGETS += mqueue
 TARGETS += net
 TARGETS += nsfs
 TARGETS += powerpc
+TARGETS += proc
 TARGETS += pstore
 TARGETS += ptrace
 TARGETS += seccomp
@@ -66,6 +69,12 @@ ifndef BUILD
   BUILD := $(shell pwd)
 endif
 
+# KSFT_TAP_LEVEL is used from KSFT framework to prevent nested TAP header
+# printing from tests. Applicable to run_tests case where run_tests adds
+# TAP header prior running tests and when a test program invokes another
+# with system() call. Export it here to cover override RUN_TESTS defines.
+export KSFT_TAP_LEVEL=`echo 1`
+
 export BUILD
 all:
         @for TARGET in $(TARGETS); do           \
@@ -125,11 +134,14 @@ ifdef INSTALL_PATH
         echo "else" >> $(ALL_SCRIPT)
         echo "  OUTPUT=/dev/stdout" >> $(ALL_SCRIPT)
         echo "fi" >> $(ALL_SCRIPT)
+        echo "export KSFT_TAP_LEVEL=`echo 1`" >> $(ALL_SCRIPT)
 
         for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
-                echo "echo ; echo Running tests in $$TARGET" >> $(ALL_SCRIPT); \
+                echo "echo ; echo TAP version 13" >> $(ALL_SCRIPT);     \
+                echo "echo Running tests in $$TARGET" >> $(ALL_SCRIPT); \
                 echo "echo ========================================" >> $(ALL_SCRIPT); \
+                echo "[ -w /dev/kmsg ] && echo \"kselftest: Running tests in $$TARGET\" >> /dev/kmsg" >> $(ALL_SCRIPT); \
                 echo "cd $$TARGET" >> $(ALL_SCRIPT); \
                 make -s --no-print-directory OUTPUT=$$BUILD_TARGET -C $$TARGET emit_tests >> $(ALL_SCRIPT); \
                 echo "cd \$$ROOT" >> $(ALL_SCRIPT); \
diff --git a/tools/testing/selftests/android/ion/.gitignore b/tools/testing/selftests/android/ion/.gitignore
index 67e6f391b2a9..95e8f4561474 100644
--- a/tools/testing/selftests/android/ion/.gitignore
+++ b/tools/testing/selftests/android/ion/.gitignore
@@ -1,2 +1,3 @@
 ionapp_export
 ionapp_import
+ionmap_test
diff --git a/tools/testing/selftests/android/ion/Makefile b/tools/testing/selftests/android/ion/Makefile
index 96e0c448b39d..e03695287f76 100644
--- a/tools/testing/selftests/android/ion/Makefile
+++ b/tools/testing/selftests/android/ion/Makefile
@@ -1,8 +1,8 @@
 
-INCLUDEDIR := -I. -I../../../../../drivers/staging/android/uapi/
+INCLUDEDIR := -I. -I../../../../../drivers/staging/android/uapi/ -I../../../../../usr/include/
 CFLAGS := $(CFLAGS) $(INCLUDEDIR) -Wall -O2 -g
 
-TEST_GEN_FILES := ionapp_export ionapp_import
+TEST_GEN_FILES := ionapp_export ionapp_import ionmap_test
 
 all: $(TEST_GEN_FILES)
 
@@ -14,3 +14,4 @@ include ../../lib.mk
 
 $(OUTPUT)/ionapp_export: ionapp_export.c ipcsocket.c ionutils.c
 $(OUTPUT)/ionapp_import: ionapp_import.c ipcsocket.c ionutils.c
+$(OUTPUT)/ionmap_test: ionmap_test.c ionutils.c
diff --git a/tools/testing/selftests/android/ion/config b/tools/testing/selftests/android/ion/config
index 19db6ca9aa2b..b4ad748a9dd9 100644
--- a/tools/testing/selftests/android/ion/config
+++ b/tools/testing/selftests/android/ion/config
@@ -2,3 +2,4 @@ CONFIG_ANDROID=y
 CONFIG_STAGING=y
 CONFIG_ION=y
 CONFIG_ION_SYSTEM_HEAP=y
+CONFIG_DRM_VGEM=y
diff --git a/tools/testing/selftests/android/ion/ionmap_test.c b/tools/testing/selftests/android/ion/ionmap_test.c
new file mode 100644
index 000000000000..dab36b06b37d
--- /dev/null
+++ b/tools/testing/selftests/android/ion/ionmap_test.c
@@ -0,0 +1,136 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <linux/dma-buf.h>
+
+#include <drm/drm.h>
+
+#include "ion.h"
+#include "ionutils.h"
+
+int check_vgem(int fd)
+{
+        drm_version_t version = { 0 };
+        char name[5];
+        int ret;
+
+        version.name_len = 4;
+        version.name = name;
+
+        ret = ioctl(fd, DRM_IOCTL_VERSION, &version);
+        if (ret)
+                return 1;
+
+        return strcmp(name, "vgem");
+}
+
+int open_vgem(void)
+{
+        int i, fd;
+        const char *drmstr = "/dev/dri/card";
+
+        fd = -1;
+        for (i = 0; i < 16; i++) {
+                char name[80];
+
+                sprintf(name, "%s%u", drmstr, i);
+
+                fd = open(name, O_RDWR);
+                if (fd < 0)
+                        continue;
+
+                if (check_vgem(fd)) {
+                        close(fd);
+                        continue;
+                } else {
+                        break;
+                }
+
+        }
+        return fd;
+}
+
+int import_vgem_fd(int vgem_fd, int dma_buf_fd, uint32_t *handle)
+{
+        struct drm_prime_handle import_handle = { 0 };
+        int ret;
+
+        import_handle.fd = dma_buf_fd;
+        import_handle.flags = 0;
+        import_handle.handle = 0;
+
+        ret = ioctl(vgem_fd, DRM_IOCTL_PRIME_FD_TO_HANDLE, &import_handle);
+        if (ret == 0)
+                *handle = import_handle.handle;
+        return ret;
+}
+
+void close_handle(int vgem_fd, uint32_t handle)
+{
+        struct drm_gem_close close = { 0 };
+
+        close.handle = handle;
+        ioctl(vgem_fd, DRM_IOCTL_GEM_CLOSE, &close);
+}
+
+int main()
+{
+        int ret, vgem_fd;
+        struct ion_buffer_info info;
+        uint32_t handle = 0;
+        struct dma_buf_sync sync = { 0 };
+
+        info.heap_type = ION_HEAP_TYPE_SYSTEM;
+        info.heap_size = 4096;
+        info.flag_type = ION_FLAG_CACHED;
+
+        ret = ion_export_buffer_fd(&info);
+        if (ret < 0) {
+                printf("ion buffer alloc failed\n");
+                return -1;
+        }
+
+        vgem_fd = open_vgem();
+        if (vgem_fd < 0) {
+                ret = vgem_fd;
+                printf("Failed to open vgem\n");
+                goto out_ion;
+        }
+
+        ret = import_vgem_fd(vgem_fd, info.buffd, &handle);
+
+        if (ret < 0) {
+                printf("Failed to import buffer\n");
+                goto out_vgem;
+        }
+
+        sync.flags = DMA_BUF_SYNC_START | DMA_BUF_SYNC_RW;
+        ret = ioctl(info.buffd, DMA_BUF_IOCTL_SYNC, &sync);
+        if (ret)
+                printf("sync start failed %d\n", errno);
+
+        memset(info.buffer, 0xff, 4096);
+
+        sync.flags = DMA_BUF_SYNC_END | DMA_BUF_SYNC_RW;
+        ret = ioctl(info.buffd, DMA_BUF_IOCTL_SYNC, &sync);
+        if (ret)
+                printf("sync end failed %d\n", errno);
+
+        close_handle(vgem_fd, handle);
+        ret = 0;
+
+out_vgem:
+        close(vgem_fd);
+out_ion:
+        ion_close_buffer_fd(&info);
+        printf("done.\n");
+        return ret;
+}
diff --git a/tools/testing/selftests/android/ion/ionutils.c b/tools/testing/selftests/android/ion/ionutils.c
index ce69c14f51fa..7d1d37c4ef6a 100644
--- a/tools/testing/selftests/android/ion/ionutils.c
+++ b/tools/testing/selftests/android/ion/ionutils.c
@@ -80,11 +80,6 @@ int ion_export_buffer_fd(struct ion_buffer_info *ion_info)
         heap_id = MAX_HEAP_COUNT + 1;
         for (i = 0; i < query.cnt; i++) {
                 if (heap_data[i].type == ion_info->heap_type) {
-                        printf("--------------------------------------\n");
-                        printf("heap type: %d\n", heap_data[i].type);
-                        printf("  heap id: %d\n", heap_data[i].heap_id);
-                        printf("heap name: %s\n", heap_data[i].name);
-                        printf("--------------------------------------\n");
                         heap_id = heap_data[i].heap_id;
                         break;
                 }
@@ -204,7 +199,6 @@ void ion_close_buffer_fd(struct ion_buffer_info *ion_info)
                 /* Finally, close the client fd */
                 if (ion_info->ionfd > 0)
                         close(ion_info->ionfd);
-                printf("<%s>: buffer release successfully....\n", __func__);
         }
 }
 
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index 9cf83f895d98..5e1ab2f0eb79 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -12,3 +12,6 @@ test_tcpbpf_user
 test_verifier_log
 feature
 test_libbpf_open
+test_sock
+test_sock_addr
+urandom_read
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 5c43c187f27c..0a315ddabbf4 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -13,34 +13,49 @@ endif
 CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS) -I../../../include
 LDLIBS += -lcap -lelf -lrt -lpthread
 
+TEST_CUSTOM_PROGS = $(OUTPUT)/urandom_read
+all: $(TEST_CUSTOM_PROGS)
+
+$(TEST_CUSTOM_PROGS): urandom_read
+
+urandom_read: urandom_read.c
+        $(CC) -o $(TEST_CUSTOM_PROGS) -static $<
+
 # Order correspond to 'make run_tests' order
 TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs \
-        test_align test_verifier_log test_dev_cgroup test_tcpbpf_user
+        test_align test_verifier_log test_dev_cgroup test_tcpbpf_user \
+        test_sock test_sock_addr
 
 TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o test_obj_id.o \
         test_pkt_md_access.o test_xdp_redirect.o test_xdp_meta.o sockmap_parse_prog.o     \
         sockmap_verdict_prog.o dev_cgroup.o sample_ret0.o test_tracepoint.o \
         test_l4lb_noinline.o test_xdp_noinline.o test_stacktrace_map.o \
-        sample_map_ret0.o test_tcpbpf_kern.o
+        sample_map_ret0.o test_tcpbpf_kern.o test_stacktrace_build_id.o \
+        sockmap_tcp_msg_prog.o connect4_prog.o connect6_prog.o
 
 # Order correspond to 'make run_tests' order
 TEST_PROGS := test_kmod.sh \
         test_libbpf.sh \
         test_xdp_redirect.sh \
         test_xdp_meta.sh \
-        test_offload.py
+        test_offload.py \
+        test_sock_addr.sh
 
 # Compile but not part of 'make run_tests'
 TEST_GEN_PROGS_EXTENDED = test_libbpf_open
 
 include ../lib.mk
 
-BPFOBJ := $(OUTPUT)/libbpf.a cgroup_helpers.c
+BPFOBJ := $(OUTPUT)/libbpf.a
 
 $(TEST_GEN_PROGS): $(BPFOBJ)
 
 $(TEST_GEN_PROGS_EXTENDED): $(OUTPUT)/libbpf.a
 
+$(OUTPUT)/test_dev_cgroup: cgroup_helpers.c
+$(OUTPUT)/test_sock: cgroup_helpers.c
+$(OUTPUT)/test_sock_addr: cgroup_helpers.c
+
 .PHONY: force
 
 # force a rebuild of BPFOBJ when its dependencies are updated
@@ -72,3 +87,5 @@ $(OUTPUT)/%.o: %.c
         $(CLANG) $(CLANG_FLAGS) \
                  -O2 -target bpf -emit-llvm -c $< -o - |      \
         $(LLC) -march=bpf -mcpu=$(CPU) -filetype=obj -o $@
+
+EXTRA_CLEAN := $(TEST_CUSTOM_PROGS)
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index dde2c11d7771..d8223d99f96d 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -86,6 +86,16 @@ static int (*bpf_perf_prog_read_value)(void *ctx, void *buf,
         (void *) BPF_FUNC_perf_prog_read_value;
 static int (*bpf_override_return)(void *ctx, unsigned long rc) =
         (void *) BPF_FUNC_override_return;
+static int (*bpf_msg_redirect_map)(void *ctx, void *map, int key, int flags) =
+        (void *) BPF_FUNC_msg_redirect_map;
+static int (*bpf_msg_apply_bytes)(void *ctx, int len) =
+        (void *) BPF_FUNC_msg_apply_bytes;
+static int (*bpf_msg_cork_bytes)(void *ctx, int len) =
+        (void *) BPF_FUNC_msg_cork_bytes;
+static int (*bpf_msg_pull_data)(void *ctx, int start, int end, int flags) =
+        (void *) BPF_FUNC_msg_pull_data;
+static int (*bpf_bind)(void *ctx, void *addr, int addr_len) =
+        (void *) BPF_FUNC_bind;
 
 /* llvm builtin functions that eBPF C program may use to
  * emit BPF_LD_ABS and BPF_LD_IND instructions
@@ -123,6 +133,8 @@ static int (*bpf_skb_under_cgroup)(void *ctx, void *map, int index) =
         (void *) BPF_FUNC_skb_under_cgroup;
 static int (*bpf_skb_change_head)(void *, int len, int flags) =
         (void *) BPF_FUNC_skb_change_head;
+static int (*bpf_skb_pull_data)(void *, int len) =
+        (void *) BPF_FUNC_skb_pull_data;
 
 /* Scan the ARCH passed in from ARCH env variable (see Makefile) */
 #if defined(__TARGET_ARCH_x86)
diff --git a/tools/testing/selftests/bpf/bpf_rlimit.h b/tools/testing/selftests/bpf/bpf_rlimit.h
new file mode 100644
index 000000000000..9dac9b30f8ef
--- /dev/null
+++ b/tools/testing/selftests/bpf/bpf_rlimit.h
@@ -0,0 +1,28 @@
+#include <sys/resource.h>
+#include <stdio.h>
+
+static  __attribute__((constructor)) void bpf_rlimit_ctor(void)
+{
+        struct rlimit rlim_old, rlim_new = {
+                .rlim_cur       = RLIM_INFINITY,
+                .rlim_max       = RLIM_INFINITY,
+        };
+
+        getrlimit(RLIMIT_MEMLOCK, &rlim_old);
+        /* For the sake of running the test cases, we temporarily
+         * set rlimit to infinity in order for kernel to focus on
+         * errors from actual test cases and not getting noise
+         * from hitting memlock limits. The limit is on per-process
+         * basis and not a global one, hence destructor not really
+         * needed here.
+         */
+        if (setrlimit(RLIMIT_MEMLOCK, &rlim_new) < 0) {
+                perror("Unable to lift memlock rlimit");
+                /* Trying out lower limit, but expect potential test
+                 * case failures from this!
+                 */
+                rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
+                rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
+                setrlimit(RLIMIT_MEMLOCK, &rlim_new);
+        }
+}
diff --git a/tools/testing/selftests/bpf/connect4_prog.c b/tools/testing/selftests/bpf/connect4_prog.c
new file mode 100644
index 000000000000..5a88a681d2ab
--- /dev/null
+++ b/tools/testing/selftests/bpf/connect4_prog.c
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2018 Facebook
+
+#include <string.h>
+
+#include <linux/stddef.h>
+#include <linux/bpf.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <sys/socket.h>
+
+#include "bpf_helpers.h"
+#include "bpf_endian.h"
+
+#define SRC_REWRITE_IP4         0x7f000004U
+#define DST_REWRITE_IP4         0x7f000001U
+#define DST_REWRITE_PORT4       4444
+
+int _version SEC("version") = 1;
+
+SEC("cgroup/connect4")
+int connect_v4_prog(struct bpf_sock_addr *ctx)
+{
+        struct sockaddr_in sa;
+
+        /* Rewrite destination. */
+        ctx->user_ip4 = bpf_htonl(DST_REWRITE_IP4);
+        ctx->user_port = bpf_htons(DST_REWRITE_PORT4);
+
+        if (ctx->type == SOCK_DGRAM || ctx->type == SOCK_STREAM) {
+                ///* Rewrite source. */
+                memset(&sa, 0, sizeof(sa));
+
+                sa.sin_family = AF_INET;
+                sa.sin_port = bpf_htons(0);
+                sa.sin_addr.s_addr = bpf_htonl(SRC_REWRITE_IP4);
+
+                if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
+                        return 0;
+        }
+
+        return 1;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/connect6_prog.c b/tools/testing/selftests/bpf/connect6_prog.c
new file mode 100644
index 000000000000..8ea3f7d12dee
--- /dev/null
+++ b/tools/testing/selftests/bpf/connect6_prog.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2018 Facebook
+
+#include <string.h>
+
+#include <linux/stddef.h>
+#include <linux/bpf.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <sys/socket.h>
+
+#include "bpf_helpers.h"
+#include "bpf_endian.h"
+
+#define SRC_REWRITE_IP6_0       0
+#define SRC_REWRITE_IP6_1       0
+#define SRC_REWRITE_IP6_2       0
+#define SRC_REWRITE_IP6_3       6
+
+#define DST_REWRITE_IP6_0       0
+#define DST_REWRITE_IP6_1       0
+#define DST_REWRITE_IP6_2       0
+#define DST_REWRITE_IP6_3       1
+
+#define DST_REWRITE_PORT6       6666
+
+int _version SEC("version") = 1;
+
+SEC("cgroup/connect6")
+int connect_v6_prog(struct bpf_sock_addr *ctx)
+{
+        struct sockaddr_in6 sa;
+
+        /* Rewrite destination. */
+        ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0);
+        ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1);
+        ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2);
+        ctx->user_ip6[3] = bpf_htonl(DST_REWRITE_IP6_3);
+
+        ctx->user_port = bpf_htons(DST_REWRITE_PORT6);
+
+        if (ctx->type == SOCK_DGRAM || ctx->type == SOCK_STREAM) {
+                /* Rewrite source. */
+                memset(&sa, 0, sizeof(sa));
+
+                sa.sin6_family = AF_INET6;
+                sa.sin6_port = bpf_htons(0);
+
+                sa.sin6_addr.s6_addr32[0] = bpf_htonl(SRC_REWRITE_IP6_0);
+                sa.sin6_addr.s6_addr32[1] = bpf_htonl(SRC_REWRITE_IP6_1);
+                sa.sin6_addr.s6_addr32[2] = bpf_htonl(SRC_REWRITE_IP6_2);
+                sa.sin6_addr.s6_addr32[3] = bpf_htonl(SRC_REWRITE_IP6_3);
+
+                if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
+                        return 0;
+        }
+
+        return 1;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/sockmap_parse_prog.c b/tools/testing/selftests/bpf/sockmap_parse_prog.c
index a1dec2b6d9c5..0f92858f6226 100644
--- a/tools/testing/selftests/bpf/sockmap_parse_prog.c
+++ b/tools/testing/selftests/bpf/sockmap_parse_prog.c
@@ -20,14 +20,25 @@ int bpf_prog1(struct __sk_buff *skb)
         __u32 lport = skb->local_port;
         __u32 rport = skb->remote_port;
         __u8 *d = data;
+        __u32 len = (__u32) data_end - (__u32) data;
+        int err;
 
-        if (data + 10 > data_end)
-                return skb->len;
+        if (data + 10 > data_end) {
+                err = bpf_skb_pull_data(skb, 10);
+                if (err)
+                        return SK_DROP;
+
+                data_end = (void *)(long)skb->data_end;
+                data = (void *)(long)skb->data;
+                if (data + 10 > data_end)
+                        return SK_DROP;
+        }
 
         /* This write/read is a bit pointless but tests the verifier and
          * strparser handler for read/write pkt data and access into sk
          * fields.
          */
+        d = data;
         d[7] = 1;
         return skb->len;
 }
diff --git a/tools/testing/selftests/bpf/sockmap_tcp_msg_prog.c b/tools/testing/selftests/bpf/sockmap_tcp_msg_prog.c
new file mode 100644
index 000000000000..12a7b5c82ed6
--- /dev/null
+++ b/tools/testing/selftests/bpf/sockmap_tcp_msg_prog.c
@@ -0,0 +1,33 @@
+#include <linux/bpf.h>
+#include "bpf_helpers.h"
+#include "bpf_util.h"
+#include "bpf_endian.h"
+
+int _version SEC("version") = 1;
+
+#define bpf_printk(fmt, ...)                                    \
+({                                                              \
+               char ____fmt[] = fmt;                            \
+               bpf_trace_printk(____fmt, sizeof(____fmt),       \
+                                ##__VA_ARGS__);                 \
+})
+
+SEC("sk_msg1")
+int bpf_prog1(struct sk_msg_md *msg)
+{
+        void *data_end = (void *)(long) msg->data_end;
+        void *data = (void *)(long) msg->data;
+
+        char *d;
+
+        if (data + 8 > data_end)
+                return SK_DROP;
+
+        bpf_printk("data length %i\n", (__u64)msg->data_end - (__u64)msg->data);
+        d = (char *)data;
+        bpf_printk("hello sendmsg hook %i %i\n", d[0], d[1]);
+
+        return SK_PASS;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/sockmap_verdict_prog.c b/tools/testing/selftests/bpf/sockmap_verdict_prog.c
index d7bea972cb21..2ce7634a4012 100644
--- a/tools/testing/selftests/bpf/sockmap_verdict_prog.c
+++ b/tools/testing/selftests/bpf/sockmap_verdict_prog.c
@@ -26,6 +26,13 @@ struct bpf_map_def SEC("maps") sock_map_tx = {
         .max_entries = 20,
 };
 
+struct bpf_map_def SEC("maps") sock_map_msg = {
+        .type = BPF_MAP_TYPE_SOCKMAP,
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .max_entries = 20,
+};
+
 struct bpf_map_def SEC("maps") sock_map_break = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(int),
diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
index ff8bd7e3e50c..6b1b302310fe 100644
--- a/tools/testing/selftests/bpf/test_align.c
+++ b/tools/testing/selftests/bpf/test_align.c
@@ -9,8 +9,6 @@
 #include <stddef.h>
 #include <stdbool.h>
 
-#include <sys/resource.h>
-
 #include <linux/unistd.h>
 #include <linux/filter.h>
 #include <linux/bpf_perf_event.h>
@@ -19,6 +17,7 @@
 #include <bpf/bpf.h>
 
 #include "../../../include/linux/filter.h"
+#include "bpf_rlimit.h"
 
 #ifndef ARRAY_SIZE
 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
@@ -702,9 +701,6 @@ static int do_test(unsigned int from, unsigned int to)
 int main(int argc, char **argv)
 {
         unsigned int from = 0, to = ARRAY_SIZE(tests);
-        struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
-
-        setrlimit(RLIMIT_MEMLOCK, &rinf);
 
         if (argc == 3) {
                 unsigned int l = atoi(argv[argc - 2]);
diff --git a/tools/testing/selftests/bpf/test_dev_cgroup.c b/tools/testing/selftests/bpf/test_dev_cgroup.c
index 3489cc283433..9c8b50bac7e0 100644
--- a/tools/testing/selftests/bpf/test_dev_cgroup.c
+++ b/tools/testing/selftests/bpf/test_dev_cgroup.c
@@ -11,13 +11,13 @@
 #include <errno.h>
 #include <assert.h>
 #include <sys/time.h>
-#include <sys/resource.h>
 
 #include <linux/bpf.h>
 #include <bpf/bpf.h>
 #include <bpf/libbpf.h>
 
 #include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
 
 #define DEV_CGROUP_PROG "./dev_cgroup.o"
 
@@ -25,15 +25,11 @@
 
 int main(int argc, char **argv)
 {
-        struct rlimit limit  = { RLIM_INFINITY, RLIM_INFINITY };
         struct bpf_object *obj;
         int error = EXIT_FAILURE;
         int prog_fd, cgroup_fd;
         __u32 prog_cnt;
 
-        if (setrlimit(RLIMIT_MEMLOCK, &limit) < 0)
-                perror("Unable to lift memlock rlimit");
-
         if (bpf_prog_load(DEV_CGROUP_PROG, BPF_PROG_TYPE_CGROUP_DEVICE,
                           &obj, &prog_fd)) {
                 printf("Failed to load DEV_CGROUP program\n");
diff --git a/tools/testing/selftests/bpf/test_lpm_map.c b/tools/testing/selftests/bpf/test_lpm_map.c
index 2be87e9ee28d..147e34cfceb7 100644
--- a/tools/testing/selftests/bpf/test_lpm_map.c
+++ b/tools/testing/selftests/bpf/test_lpm_map.c
@@ -22,10 +22,11 @@
 #include <unistd.h>
 #include <arpa/inet.h>
 #include <sys/time.h>
-#include <sys/resource.h>
 
 #include <bpf/bpf.h>
+
 #include "bpf_util.h"
+#include "bpf_rlimit.h"
 
 struct tlpm_node {
         struct tlpm_node *next;
@@ -736,17 +737,11 @@ static void test_lpm_multi_thread(void)
 
 int main(void)
 {
-        struct rlimit limit  = { RLIM_INFINITY, RLIM_INFINITY };
-        int i, ret;
+        int i;
 
         /* we want predictable, pseudo random tests */
         srand(0xf00ba1);
 
-        /* allow unlimited locked memory */
-        ret = setrlimit(RLIMIT_MEMLOCK, &limit);
-        if (ret < 0)
-                perror("Unable to lift memlock rlimit");
-
         test_lpm_basic();
         test_lpm_order();
 
@@ -755,11 +750,8 @@ int main(void)
                 test_lpm_map(i);
 
         test_lpm_ipaddr();
-
         test_lpm_delete();
-
         test_lpm_get_next_key();
-
         test_lpm_multi_thread();
 
         printf("test_lpm: OK\n");
diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c
index 8c10c9180c1a..781c7de343be 100644
--- a/tools/testing/selftests/bpf/test_lru_map.c
+++ b/tools/testing/selftests/bpf/test_lru_map.c
@@ -16,10 +16,11 @@
 #include <time.h>
 
 #include <sys/wait.h>
-#include <sys/resource.h>
 
 #include <bpf/bpf.h>
+
 #include "bpf_util.h"
+#include "bpf_rlimit.h"
 
 #define LOCAL_FREE_TARGET       (128)
 #define PERCPU_FREE_TARGET      (4)
@@ -613,7 +614,6 @@ static void test_lru_sanity6(int map_type, int map_flags, int tgt_free)
 
 int main(int argc, char **argv)
 {
-        struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
         int map_types[] = {BPF_MAP_TYPE_LRU_HASH,
                              BPF_MAP_TYPE_LRU_PERCPU_HASH};
         int map_flags[] = {0, BPF_F_NO_COMMON_LRU};
@@ -621,8 +621,6 @@ int main(int argc, char **argv)
 
         setbuf(stdout, NULL);
 
-        assert(!setrlimit(RLIMIT_MEMLOCK, &r));
-
         nr_cpus = bpf_num_possible_cpus();
         assert(nr_cpus != -1);
         printf("nr_cpus:%d\n\n", nr_cpus);
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index 9e03a4c356a4..6c253343a6f9 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -17,13 +17,14 @@
 #include <stdlib.h>
 
 #include <sys/wait.h>
-#include <sys/resource.h>
 
 #include <linux/bpf.h>
 
 #include <bpf/bpf.h>
 #include <bpf/libbpf.h>
+
 #include "bpf_util.h"
+#include "bpf_rlimit.h"
 
 static int map_flags;
 
@@ -463,15 +464,17 @@ static void test_devmap(int task, void *data)
 #include <linux/err.h>
 #define SOCKMAP_PARSE_PROG "./sockmap_parse_prog.o"
 #define SOCKMAP_VERDICT_PROG "./sockmap_verdict_prog.o"
+#define SOCKMAP_TCP_MSG_PROG "./sockmap_tcp_msg_prog.o"
 static void test_sockmap(int tasks, void *data)
 {
-        int one = 1, map_fd_rx = 0, map_fd_tx = 0, map_fd_break, s, sc, rc;
-        struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_break;
+        struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_msg, *bpf_map_break;
+        int map_fd_msg = 0, map_fd_rx = 0, map_fd_tx = 0, map_fd_break;
         int ports[] = {50200, 50201, 50202, 50204};
         int err, i, fd, udp, sfd[6] = {0xdeadbeef};
         u8 buf[20] = {0x0, 0x5, 0x3, 0x2, 0x1, 0x0};
-        int parse_prog, verdict_prog;
+        int parse_prog, verdict_prog, msg_prog;
         struct sockaddr_in addr;
+        int one = 1, s, sc, rc;
         struct bpf_object *obj;
         struct timeval to;
         __u32 key, value;
@@ -583,6 +586,12 @@ static void test_sockmap(int tasks, void *data)
                 goto out_sockmap;
         }
 
+        err = bpf_prog_attach(-1, fd, BPF_SK_MSG_VERDICT, 0);
+        if (!err) {
+                printf("Failed invalid msg verdict prog attach\n");
+                goto out_sockmap;
+        }
+
         err = bpf_prog_attach(-1, fd, __MAX_BPF_ATTACH_TYPE, 0);
         if (!err) {
                 printf("Failed unknown prog attach\n");
@@ -601,6 +610,12 @@ static void test_sockmap(int tasks, void *data)
                 goto out_sockmap;
         }
 
+        err = bpf_prog_detach(fd, BPF_SK_MSG_VERDICT);
+        if (err) {
+                printf("Failed empty msg verdict prog detach\n");
+                goto out_sockmap;
+        }
+
         err = bpf_prog_detach(fd, __MAX_BPF_ATTACH_TYPE);
         if (!err) {
                 printf("Detach invalid prog successful\n");
@@ -615,6 +630,13 @@ static void test_sockmap(int tasks, void *data)
                 goto out_sockmap;
         }
 
+        err = bpf_prog_load(SOCKMAP_TCP_MSG_PROG,
+                            BPF_PROG_TYPE_SK_MSG, &obj, &msg_prog);
+        if (err) {
+                printf("Failed to load SK_SKB msg prog\n");
+                goto out_sockmap;
+        }
+
         err = bpf_prog_load(SOCKMAP_VERDICT_PROG,
                             BPF_PROG_TYPE_SK_SKB, &obj, &verdict_prog);
         if (err) {
@@ -630,7 +652,7 @@ static void test_sockmap(int tasks, void *data)
 
         map_fd_rx = bpf_map__fd(bpf_map_rx);
         if (map_fd_rx < 0) {
-                printf("Failed to get map fd\n");
+                printf("Failed to get map rx fd\n");
                 goto out_sockmap;
         }
 
@@ -646,6 +668,18 @@ static void test_sockmap(int tasks, void *data)
                 goto out_sockmap;
         }
 
+        bpf_map_msg = bpf_object__find_map_by_name(obj, "sock_map_msg");
+        if (IS_ERR(bpf_map_msg)) {
+                printf("Failed to load map msg from msg_verdict prog\n");
+                goto out_sockmap;
+        }
+
+        map_fd_msg = bpf_map__fd(bpf_map_msg);
+        if (map_fd_msg < 0) {
+                printf("Failed to get map msg fd\n");
+                goto out_sockmap;
+        }
+
         bpf_map_break = bpf_object__find_map_by_name(obj, "sock_map_break");
         if (IS_ERR(bpf_map_break)) {
                 printf("Failed to load map tx from verdict prog\n");
@@ -679,6 +713,12 @@ static void test_sockmap(int tasks, void *data)
                 goto out_sockmap;
         }
 
+        err = bpf_prog_attach(msg_prog, map_fd_msg, BPF_SK_MSG_VERDICT, 0);
+        if (err) {
+                printf("Failed msg verdict bpf prog attach\n");
+                goto out_sockmap;
+        }
+
         err = bpf_prog_attach(verdict_prog, map_fd_rx,
                               __MAX_BPF_ATTACH_TYPE, 0);
         if (!err) {
@@ -718,6 +758,14 @@ static void test_sockmap(int tasks, void *data)
                 }
         }
 
+        /* Put sfd[2] (sending fd below) into msg map to test sendmsg bpf */
+        i = 0;
+        err = bpf_map_update_elem(map_fd_msg, &i, &sfd[2], BPF_ANY);
+        if (err) {
+                printf("Failed map_fd_msg update sockmap %i\n", err);
+                goto out_sockmap;
+        }
+
         /* Test map send/recv */
         for (i = 0; i < 2; i++) {
                 buf[0] = i;
@@ -1126,10 +1174,6 @@ static void run_all_tests(void)
 
 int main(void)
 {
-        struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
-
-        setrlimit(RLIMIT_MEMLOCK, &rinf);
-
         map_flags = 0;
         run_all_tests();
 
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index b549308abd19..4123d0ab90ba 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -26,7 +26,6 @@ typedef __u16 __sum16;
 
 #include <sys/ioctl.h>
 #include <sys/wait.h>
-#include <sys/resource.h>
 #include <sys/types.h>
 #include <fcntl.h>
 
@@ -34,9 +33,11 @@ typedef __u16 __sum16;
 #include <linux/err.h>
 #include <bpf/bpf.h>
 #include <bpf/libbpf.h>
+
 #include "test_iptunnel_common.h"
 #include "bpf_util.h"
 #include "bpf_endian.h"
+#include "bpf_rlimit.h"
 
 static int error_cnt, pass_cnt;
 
@@ -840,7 +841,8 @@ static void test_tp_attach_query(void)
 static int compare_map_keys(int map1_fd, int map2_fd)
 {
         __u32 key, next_key;
-        char val_buf[PERF_MAX_STACK_DEPTH * sizeof(__u64)];
+        char val_buf[PERF_MAX_STACK_DEPTH *
+                     sizeof(struct bpf_stack_build_id)];
         int err;
 
         err = bpf_map_get_next_key(map1_fd, NULL, &key);
@@ -875,7 +877,7 @@ static void test_stacktrace_map()
 
         err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
         if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
-                goto out;
+                return;
 
         /* Get the ID for the sched/sched_switch tracepoint */
         snprintf(buf, sizeof(buf),
@@ -886,6 +888,181 @@ static void test_stacktrace_map()
 
         bytes = read(efd, buf, sizeof(buf));
         close(efd);
+        if (bytes <= 0 || bytes >= sizeof(buf))
+                goto close_prog;
+
+        /* Open the perf event and attach bpf progrram */
+        attr.config = strtol(buf, NULL, 0);
+        attr.type = PERF_TYPE_TRACEPOINT;
+        attr.sample_type = PERF_SAMPLE_RAW | PERF_SAMPLE_CALLCHAIN;
+        attr.sample_period = 1;
+        attr.wakeup_events = 1;
+        pmu_fd = syscall(__NR_perf_event_open, &attr, -1 /* pid */,
+                         0 /* cpu 0 */, -1 /* group id */,
+                         0 /* flags */);
+        if (CHECK(pmu_fd < 0, "perf_event_open", "err %d errno %d\n",
+                  pmu_fd, errno))
+                goto close_prog;
+
+        err = ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0);
+        if (err)
+                goto disable_pmu;
+
+        err = ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd);
+        if (err)
+                goto disable_pmu;
+
+        /* find map fds */
+        control_map_fd = bpf_find_map(__func__, obj, "control_map");
+        if (control_map_fd < 0)
+                goto disable_pmu;
+
+        stackid_hmap_fd = bpf_find_map(__func__, obj, "stackid_hmap");
+        if (stackid_hmap_fd < 0)
+                goto disable_pmu;
+
+        stackmap_fd = bpf_find_map(__func__, obj, "stackmap");
+        if (stackmap_fd < 0)
+                goto disable_pmu;
+
+        /* give some time for bpf program run */
+        sleep(1);
+
+        /* disable stack trace collection */
+        key = 0;
+        val = 1;
+        bpf_map_update_elem(control_map_fd, &key, &val, 0);
+
+        /* for every element in stackid_hmap, we can find a corresponding one
+         * in stackmap, and vise versa.
+         */
+        err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+        if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
+                  "err %d errno %d\n", err, errno))
+                goto disable_pmu_noerr;
+
+        err = compare_map_keys(stackmap_fd, stackid_hmap_fd);
+        if (CHECK(err, "compare_map_keys stackmap vs. stackid_hmap",
+                  "err %d errno %d\n", err, errno))
+                goto disable_pmu_noerr;
+
+        goto disable_pmu_noerr;
+disable_pmu:
+        error_cnt++;
+disable_pmu_noerr:
+        ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+        close(pmu_fd);
+close_prog:
+        bpf_object__close(obj);
+}
+
+static void test_stacktrace_map_raw_tp()
+{
+        int control_map_fd, stackid_hmap_fd, stackmap_fd;
+        const char *file = "./test_stacktrace_map.o";
+        int efd, err, prog_fd;
+        __u32 key, val, duration = 0;
+        struct bpf_object *obj;
+
+        err = bpf_prog_load(file, BPF_PROG_TYPE_RAW_TRACEPOINT, &obj, &prog_fd);
+        if (CHECK(err, "prog_load raw tp", "err %d errno %d\n", err, errno))
+                return;
+
+        efd = bpf_raw_tracepoint_open("sched_switch", prog_fd);
+        if (CHECK(efd < 0, "raw_tp_open", "err %d errno %d\n", efd, errno))
+                goto close_prog;
+
+        /* find map fds */
+        control_map_fd = bpf_find_map(__func__, obj, "control_map");
+        if (control_map_fd < 0)
+                goto close_prog;
+
+        stackid_hmap_fd = bpf_find_map(__func__, obj, "stackid_hmap");
+        if (stackid_hmap_fd < 0)
+                goto close_prog;
+
+        stackmap_fd = bpf_find_map(__func__, obj, "stackmap");
+        if (stackmap_fd < 0)
+                goto close_prog;
+
+        /* give some time for bpf program run */
+        sleep(1);
+
+        /* disable stack trace collection */
+        key = 0;
+        val = 1;
+        bpf_map_update_elem(control_map_fd, &key, &val, 0);
+
+        /* for every element in stackid_hmap, we can find a corresponding one
+         * in stackmap, and vise versa.
+         */
+        err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+        if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
+                  "err %d errno %d\n", err, errno))
+                goto close_prog;
+
+        err = compare_map_keys(stackmap_fd, stackid_hmap_fd);
+        if (CHECK(err, "compare_map_keys stackmap vs. stackid_hmap",
+                  "err %d errno %d\n", err, errno))
+                goto close_prog;
+
+        goto close_prog_noerr;
+close_prog:
+        error_cnt++;
+close_prog_noerr:
+        bpf_object__close(obj);
+}
+
+static int extract_build_id(char *build_id, size_t size)
+{
+        FILE *fp;
+        char *line = NULL;
+        size_t len = 0;
+
+        fp = popen("readelf -n ./urandom_read | grep 'Build ID'", "r");
+        if (fp == NULL)
+                return -1;
+
+        if (getline(&line, &len, fp) == -1)
+                goto err;
+        fclose(fp);
+
+        if (len > size)
+                len = size;
+        memcpy(build_id, line, len);
+        build_id[len] = '\0';
+        return 0;
+err:
+        fclose(fp);
+        return -1;
+}
+
+static void test_stacktrace_build_id(void)
+{
+        int control_map_fd, stackid_hmap_fd, stackmap_fd;
+        const char *file = "./test_stacktrace_build_id.o";
+        int bytes, efd, err, pmu_fd, prog_fd;
+        struct perf_event_attr attr = {};
+        __u32 key, previous_key, val, duration = 0;
+        struct bpf_object *obj;
+        char buf[256];
+        int i, j;
+        struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+        int build_id_matches = 0;
+
+        err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
+        if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+                goto out;
+
+        /* Get the ID for the sched/sched_switch tracepoint */
+        snprintf(buf, sizeof(buf),
+                 "/sys/kernel/debug/tracing/events/random/urandom_read/id");
+        efd = open(buf, O_RDONLY, 0);
+        if (CHECK(efd < 0, "open", "err %d errno %d\n", efd, errno))
+                goto close_prog;
+
+        bytes = read(efd, buf, sizeof(buf));
+        close(efd);
         if (CHECK(bytes <= 0 || bytes >= sizeof(buf),
                   "read", "bytes %d errno %d\n", bytes, errno))
                 goto close_prog;
@@ -929,9 +1106,9 @@ static void test_stacktrace_map()
                   err, errno))
                 goto disable_pmu;
 
-        /* give some time for bpf program run */
-        sleep(1);
-
+        assert(system("dd if=/dev/urandom of=/dev/zero count=4 2> /dev/null")
+               == 0);
+        assert(system("./urandom_read") == 0);
         /* disable stack trace collection */
         key = 0;
         val = 1;
@@ -948,7 +1125,40 @@ static void test_stacktrace_map()
         err = compare_map_keys(stackmap_fd, stackid_hmap_fd);
         if (CHECK(err, "compare_map_keys stackmap vs. stackid_hmap",
                   "err %d errno %d\n", err, errno))
-                ; /* fall through */
+                goto disable_pmu;
+
+        err = extract_build_id(buf, 256);
+
+        if (CHECK(err, "get build_id with readelf",
+                  "err %d errno %d\n", err, errno))
+                goto disable_pmu;
+
+        err = bpf_map_get_next_key(stackmap_fd, NULL, &key);
+        if (CHECK(err, "get_next_key from stackmap",
+                  "err %d, errno %d\n", err, errno))
+                goto disable_pmu;
+
+        do {
+                char build_id[64];
+
+                err = bpf_map_lookup_elem(stackmap_fd, &key, id_offs);
+                if (CHECK(err, "lookup_elem from stackmap",
+                          "err %d, errno %d\n", err, errno))
+                        goto disable_pmu;
+                for (i = 0; i < PERF_MAX_STACK_DEPTH; ++i)
+                        if (id_offs[i].status == BPF_STACK_BUILD_ID_VALID &&
+                            id_offs[i].offset != 0) {
+                                for (j = 0; j < 20; ++j)
+                                        sprintf(build_id + 2 * j, "%02x",
+                                                id_offs[i].build_id[j] & 0xff);
+                                if (strstr(buf, build_id) != NULL)
+                                        build_id_matches = 1;
+                        }
+                previous_key = key;
+        } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
+        CHECK(build_id_matches < 1, "build id match",
+              "Didn't find expected build ID from the map\n");
 
 disable_pmu:
         ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
@@ -965,10 +1175,6 @@ out:
 
 int main(void)
 {
-        struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
-
-        setrlimit(RLIMIT_MEMLOCK, &rinf);
-
         test_pkt_access();
         test_xdp();
         test_l4lb_all();
@@ -979,6 +1185,8 @@ int main(void)
         test_obj_name();
         test_tp_attach_query();
         test_stacktrace_map();
+        test_stacktrace_build_id();
+        test_stacktrace_map_raw_tp();
 
         printf("Summary: %d PASSED, %d FAILED\n", pass_cnt, error_cnt);
         return error_cnt ? EXIT_FAILURE : EXIT_SUCCESS;
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
new file mode 100644
index 000000000000..f4d99fabc56d
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -0,0 +1,480 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2018 Facebook
+
+#include <stdio.h>
+#include <unistd.h>
+
+#include <arpa/inet.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <linux/filter.h>
+
+#include <bpf/bpf.h>
+
+#include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
+
+#ifndef ARRAY_SIZE
+# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
+#define CG_PATH         "/foo"
+#define MAX_INSNS       512
+
+char bpf_log_buf[BPF_LOG_BUF_SIZE];
+
+struct sock_test {
+        const char *descr;
+        /* BPF prog properties */
+        struct bpf_insn insns[MAX_INSNS];
+        enum bpf_attach_type expected_attach_type;
+        enum bpf_attach_type attach_type;
+        /* Socket properties */
+        int domain;
+        int type;
+        /* Endpoint to bind() to */
+        const char *ip;
+        unsigned short port;
+        /* Expected test result */
+        enum {
+                LOAD_REJECT,
+                ATTACH_REJECT,
+                BIND_REJECT,
+                SUCCESS,
+        } result;
+};
+
+static struct sock_test tests[] = {
+        {
+                "bind4 load with invalid access: src_ip6",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_ip6[0])),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET4_POST_BIND,
+                BPF_CGROUP_INET4_POST_BIND,
+                0,
+                0,
+                NULL,
+                0,
+                LOAD_REJECT,
+        },
+        {
+                "bind4 load with invalid access: mark",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, mark)),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET4_POST_BIND,
+                BPF_CGROUP_INET4_POST_BIND,
+                0,
+                0,
+                NULL,
+                0,
+                LOAD_REJECT,
+        },
+        {
+                "bind6 load with invalid access: src_ip4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_ip4)),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET6_POST_BIND,
+                BPF_CGROUP_INET6_POST_BIND,
+                0,
+                0,
+                NULL,
+                0,
+                LOAD_REJECT,
+        },
+        {
+                "sock_create load with invalid access: src_port",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_port)),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET_SOCK_CREATE,
+                BPF_CGROUP_INET_SOCK_CREATE,
+                0,
+                0,
+                NULL,
+                0,
+                LOAD_REJECT,
+        },
+        {
+                "sock_create load w/o expected_attach_type (compat mode)",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                0,
+                BPF_CGROUP_INET_SOCK_CREATE,
+                AF_INET,
+                SOCK_STREAM,
+                "127.0.0.1",
+                8097,
+                SUCCESS,
+        },
+        {
+                "sock_create load w/ expected_attach_type",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET_SOCK_CREATE,
+                BPF_CGROUP_INET_SOCK_CREATE,
+                AF_INET,
+                SOCK_STREAM,
+                "127.0.0.1",
+                8097,
+                SUCCESS,
+        },
+        {
+                "attach type mismatch bind4 vs bind6",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET4_POST_BIND,
+                BPF_CGROUP_INET6_POST_BIND,
+                0,
+                0,
+                NULL,
+                0,
+                ATTACH_REJECT,
+        },
+        {
+                "attach type mismatch bind6 vs bind4",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET6_POST_BIND,
+                BPF_CGROUP_INET4_POST_BIND,
+                0,
+                0,
+                NULL,
+                0,
+                ATTACH_REJECT,
+        },
+        {
+                "attach type mismatch default vs bind4",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                0,
+                BPF_CGROUP_INET4_POST_BIND,
+                0,
+                0,
+                NULL,
+                0,
+                ATTACH_REJECT,
+        },
+        {
+                "attach type mismatch bind6 vs sock_create",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET6_POST_BIND,
+                BPF_CGROUP_INET_SOCK_CREATE,
+                0,
+                0,
+                NULL,
+                0,
+                ATTACH_REJECT,
+        },
+        {
+                "bind4 reject all",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET4_POST_BIND,
+                BPF_CGROUP_INET4_POST_BIND,
+                AF_INET,
+                SOCK_STREAM,
+                "0.0.0.0",
+                0,
+                BIND_REJECT,
+        },
+        {
+                "bind6 reject all",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET6_POST_BIND,
+                BPF_CGROUP_INET6_POST_BIND,
+                AF_INET6,
+                SOCK_STREAM,
+                "::",
+                0,
+                BIND_REJECT,
+        },
+        {
+                "bind6 deny specific IP & port",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+
+                        /* if (ip == expected && port == expected) */
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_ip6[3])),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_port)),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
+
+                        /* return DENY; */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_A(1),
+
+                        /* else return ALLOW; */
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET6_POST_BIND,
+                BPF_CGROUP_INET6_POST_BIND,
+                AF_INET6,
+                SOCK_STREAM,
+                "::1",
+                8193,
+                BIND_REJECT,
+        },
+        {
+                "bind4 allow specific IP & port",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+
+                        /* if (ip == expected && port == expected) */
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_ip4)),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                                    offsetof(struct bpf_sock, src_port)),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
+
+                        /* return ALLOW; */
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_JMP_A(1),
+
+                        /* else return DENY; */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET4_POST_BIND,
+                BPF_CGROUP_INET4_POST_BIND,
+                AF_INET,
+                SOCK_STREAM,
+                "127.0.0.1",
+                4098,
+                SUCCESS,
+        },
+        {
+                "bind4 allow all",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET4_POST_BIND,
+                BPF_CGROUP_INET4_POST_BIND,
+                AF_INET,
+                SOCK_STREAM,
+                "0.0.0.0",
+                0,
+                SUCCESS,
+        },
+        {
+                "bind6 allow all",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                BPF_CGROUP_INET6_POST_BIND,
+                BPF_CGROUP_INET6_POST_BIND,
+                AF_INET6,
+                SOCK_STREAM,
+                "::",
+                0,
+                SUCCESS,
+        },
+};
+
+static size_t probe_prog_length(const struct bpf_insn *fp)
+{
+        size_t len;
+
+        for (len = MAX_INSNS - 1; len > 0; --len)
+                if (fp[len].code != 0 || fp[len].imm != 0)
+                        break;
+        return len + 1;
+}
+
+static int load_sock_prog(const struct bpf_insn *prog,
+                          enum bpf_attach_type attach_type)
+{
+        struct bpf_load_program_attr attr;
+
+        memset(&attr, 0, sizeof(struct bpf_load_program_attr));
+        attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK;
+        attr.expected_attach_type = attach_type;
+        attr.insns = prog;
+        attr.insns_cnt = probe_prog_length(attr.insns);
+        attr.license = "GPL";
+
+        return bpf_load_program_xattr(&attr, bpf_log_buf, BPF_LOG_BUF_SIZE);
+}
+
+static int attach_sock_prog(int cgfd, int progfd,
+                            enum bpf_attach_type attach_type)
+{
+        return bpf_prog_attach(progfd, cgfd, attach_type, BPF_F_ALLOW_OVERRIDE);
+}
+
+static int bind_sock(int domain, int type, const char *ip, unsigned short port)
+{
+        struct sockaddr_storage addr;
+        struct sockaddr_in6 *addr6;
+        struct sockaddr_in *addr4;
+        int sockfd = -1;
+        socklen_t len;
+        int err = 0;
+
+        sockfd = socket(domain, type, 0);
+        if (sockfd < 0)
+                goto err;
+
+        memset(&addr, 0, sizeof(addr));
+
+        if (domain == AF_INET) {
+                len = sizeof(struct sockaddr_in);
+                addr4 = (struct sockaddr_in *)&addr;
+                addr4->sin_family = domain;
+                addr4->sin_port = htons(port);
+                if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1)
+                        goto err;
+        } else if (domain == AF_INET6) {
+                len = sizeof(struct sockaddr_in6);
+                addr6 = (struct sockaddr_in6 *)&addr;
+                addr6->sin6_family = domain;
+                addr6->sin6_port = htons(port);
+                if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1)
+                        goto err;
+        } else {
+                goto err;
+        }
+
+        if (bind(sockfd, (const struct sockaddr *)&addr, len) == -1)
+                goto err;
+
+        goto out;
+err:
+        err = -1;
+out:
+        close(sockfd);
+        return err;
+}
+
+static int run_test_case(int cgfd, const struct sock_test *test)
+{
+        int progfd = -1;
+        int err = 0;
+
+        printf("Test case: %s .. ", test->descr);
+        progfd = load_sock_prog(test->insns, test->expected_attach_type);
+        if (progfd < 0) {
+                if (test->result == LOAD_REJECT)
+                        goto out;
+                else
+                        goto err;
+        }
+
+        if (attach_sock_prog(cgfd, progfd, test->attach_type) == -1) {
+                if (test->result == ATTACH_REJECT)
+                        goto out;
+                else
+                        goto err;
+        }
+
+        if (bind_sock(test->domain, test->type, test->ip, test->port) == -1) {
+                /* sys_bind() may fail for different reasons, errno has to be
+                 * checked to confirm that BPF program rejected it.
+                 */
+                if (test->result == BIND_REJECT && errno == EPERM)
+                        goto out;
+                else
+                        goto err;
+        }
+
+
+        if (test->result != SUCCESS)
+                goto err;
+
+        goto out;
+err:
+        err = -1;
+out:
+        /* Detaching w/o checking return code: best effort attempt. */
+        if (progfd != -1)
+                bpf_prog_detach(cgfd, test->attach_type);
+        close(progfd);
+        printf("[%s]\n", err ? "FAIL" : "PASS");
+        return err;
+}
+
+static int run_tests(int cgfd)
+{
+        int passes = 0;
+        int fails = 0;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+                if (run_test_case(cgfd, &tests[i]))
+                        ++fails;
+                else
+                        ++passes;
+        }
+        printf("Summary: %d PASSED, %d FAILED\n", passes, fails);
+        return fails ? -1 : 0;
+}
+
+int main(int argc, char **argv)
+{
+        int cgfd = -1;
+        int err = 0;
+
+        if (setup_cgroup_environment())
+                goto err;
+
+        cgfd = create_and_get_cgroup(CG_PATH);
+        if (!cgfd)
+                goto err;
+
+        if (join_cgroup(CG_PATH))
+                goto err;
+
+        if (run_tests(cgfd))
+                goto err;
+
+        goto out;
+err:
+        err = -1;
+out:
+        close(cgfd);
+        cleanup_cgroup_environment();
+        return err;
+}
diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
new file mode 100644
index 000000000000..2950f80ba7fb
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_sock_addr.c
@@ -0,0 +1,589 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2018 Facebook
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <arpa/inet.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <linux/filter.h>
+
+#include <bpf/bpf.h>
+#include <bpf/libbpf.h>
+
+#include "cgroup_helpers.h"
+#include "bpf_rlimit.h"
+
+#define CG_PATH "/foo"
+#define CONNECT4_PROG_PATH      "./connect4_prog.o"
+#define CONNECT6_PROG_PATH      "./connect6_prog.o"
+
+#define SERV4_IP                "192.168.1.254"
+#define SERV4_REWRITE_IP        "127.0.0.1"
+#define SERV4_PORT              4040
+#define SERV4_REWRITE_PORT      4444
+
+#define SERV6_IP                "face:b00c:1234:5678::abcd"
+#define SERV6_REWRITE_IP        "::1"
+#define SERV6_PORT              6060
+#define SERV6_REWRITE_PORT      6666
+
+#define INET_NTOP_BUF   40
+
+typedef int (*load_fn)(enum bpf_attach_type, const char *comment);
+typedef int (*info_fn)(int, struct sockaddr *, socklen_t *);
+
+struct program {
+        enum bpf_attach_type type;
+        load_fn loadfn;
+        int fd;
+        const char *name;
+        enum bpf_attach_type invalid_type;
+};
+
+char bpf_log_buf[BPF_LOG_BUF_SIZE];
+
+static int mk_sockaddr(int domain, const char *ip, unsigned short port,
+                       struct sockaddr *addr, socklen_t addr_len)
+{
+        struct sockaddr_in6 *addr6;
+        struct sockaddr_in *addr4;
+
+        if (domain != AF_INET && domain != AF_INET6) {
+                log_err("Unsupported address family");
+                return -1;
+        }
+
+        memset(addr, 0, addr_len);
+
+        if (domain == AF_INET) {
+                if (addr_len < sizeof(struct sockaddr_in))
+                        return -1;
+                addr4 = (struct sockaddr_in *)addr;
+                addr4->sin_family = domain;
+                addr4->sin_port = htons(port);
+                if (inet_pton(domain, ip, (void *)&addr4->sin_addr) != 1) {
+                        log_err("Invalid IPv4: %s", ip);
+                        return -1;
+                }
+        } else if (domain == AF_INET6) {
+                if (addr_len < sizeof(struct sockaddr_in6))
+                        return -1;
+                addr6 = (struct sockaddr_in6 *)addr;
+                addr6->sin6_family = domain;
+                addr6->sin6_port = htons(port);
+                if (inet_pton(domain, ip, (void *)&addr6->sin6_addr) != 1) {
+                        log_err("Invalid IPv6: %s", ip);
+                        return -1;
+                }
+        }
+
+        return 0;
+}
+
+static int load_insns(enum bpf_attach_type attach_type,
+                      const struct bpf_insn *insns, size_t insns_cnt,
+                      const char *comment)
+{
+        struct bpf_load_program_attr load_attr;
+        int ret;
+
+        memset(&load_attr, 0, sizeof(struct bpf_load_program_attr));
+        load_attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
+        load_attr.expected_attach_type = attach_type;
+        load_attr.insns = insns;
+        load_attr.insns_cnt = insns_cnt;
+        load_attr.license = "GPL";
+
+        ret = bpf_load_program_xattr(&load_attr, bpf_log_buf, BPF_LOG_BUF_SIZE);
+        if (ret < 0 && comment) {
+                log_err(">>> Loading %s program error.\n"
+                        ">>> Output from verifier:\n%s\n-------\n",
+                        comment, bpf_log_buf);
+        }
+
+        return ret;
+}
+
+/* [1] These testing programs try to read different context fields, including
+ * narrow loads of different sizes from user_ip4 and user_ip6, and write to
+ * those allowed to be overridden.
+ *
+ * [2] BPF_LD_IMM64 & BPF_JMP_REG are used below whenever there is a need to
+ * compare a register with unsigned 32bit integer. BPF_JMP_IMM can't be used
+ * in such cases since it accepts only _signed_ 32bit integer as IMM
+ * argument. Also note that BPF_LD_IMM64 contains 2 instructions what matters
+ * to count jumps properly.
+ */
+
+static int bind4_prog_load(enum bpf_attach_type attach_type,
+                           const char *comment)
+{
+        union {
+                uint8_t u4_addr8[4];
+                uint16_t u4_addr16[2];
+                uint32_t u4_addr32;
+        } ip4;
+        struct sockaddr_in addr4_rw;
+
+        if (inet_pton(AF_INET, SERV4_IP, (void *)&ip4) != 1) {
+                log_err("Invalid IPv4: %s", SERV4_IP);
+                return -1;
+        }
+
+        if (mk_sockaddr(AF_INET, SERV4_REWRITE_IP, SERV4_REWRITE_PORT,
+                        (struct sockaddr *)&addr4_rw, sizeof(addr4_rw)) == -1)
+                return -1;
+
+        /* See [1]. */
+        struct bpf_insn insns[] = {
+                BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+
+                /* if (sk.family == AF_INET && */
+                BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, family)),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, AF_INET, 16),
+
+                /*     (sk.type == SOCK_DGRAM || sk.type == SOCK_STREAM) && */
+                BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, type)),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, SOCK_DGRAM, 1),
+                BPF_JMP_A(1),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, SOCK_STREAM, 12),
+
+                /*     1st_byte_of_user_ip4 == expected && */
+                BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, user_ip4)),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip4.u4_addr8[0], 10),
+
+                /*     1st_half_of_user_ip4 == expected && */
+                BPF_LDX_MEM(BPF_H, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, user_ip4)),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip4.u4_addr16[0], 8),
+
+                /*     whole_user_ip4 == expected) { */
+                BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, user_ip4)),
+                BPF_LD_IMM64(BPF_REG_8, ip4.u4_addr32), /* See [2]. */
+                BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_8, 4),
+
+                /*      user_ip4 = addr4_rw.sin_addr */
+                BPF_MOV32_IMM(BPF_REG_7, addr4_rw.sin_addr.s_addr),
+                BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
+                            offsetof(struct bpf_sock_addr, user_ip4)),
+
+                /*      user_port = addr4_rw.sin_port */
+                BPF_MOV32_IMM(BPF_REG_7, addr4_rw.sin_port),
+                BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
+                            offsetof(struct bpf_sock_addr, user_port)),
+                /* } */
+
+                /* return 1 */
+                BPF_MOV64_IMM(BPF_REG_0, 1),
+                BPF_EXIT_INSN(),
+        };
+
+        return load_insns(attach_type, insns,
+                          sizeof(insns) / sizeof(struct bpf_insn), comment);
+}
+
+static int bind6_prog_load(enum bpf_attach_type attach_type,
+                           const char *comment)
+{
+        struct sockaddr_in6 addr6_rw;
+        struct in6_addr ip6;
+
+        if (inet_pton(AF_INET6, SERV6_IP, (void *)&ip6) != 1) {
+                log_err("Invalid IPv6: %s", SERV6_IP);
+                return -1;
+        }
+
+        if (mk_sockaddr(AF_INET6, SERV6_REWRITE_IP, SERV6_REWRITE_PORT,
+                        (struct sockaddr *)&addr6_rw, sizeof(addr6_rw)) == -1)
+                return -1;
+
+        /* See [1]. */
+        struct bpf_insn insns[] = {
+                BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+
+                /* if (sk.family == AF_INET6 && */
+                BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, family)),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, AF_INET6, 18),
+
+                /*            5th_byte_of_user_ip6 == expected && */
+                BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, user_ip6[1])),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip6.s6_addr[4], 16),
+
+                /*            3rd_half_of_user_ip6 == expected && */
+                BPF_LDX_MEM(BPF_H, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, user_ip6[1])),
+                BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ip6.s6_addr16[2], 14),
+
+                /*            last_word_of_user_ip6 == expected) { */
+                BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+                            offsetof(struct bpf_sock_addr, user_ip6[3])),
+                BPF_LD_IMM64(BPF_REG_8, ip6.s6_addr32[3]),  /* See [2]. */
+                BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_8, 10),
+
+
+#define STORE_IPV6_WORD(N)                                                     \
+                BPF_MOV32_IMM(BPF_REG_7, addr6_rw.sin6_addr.s6_addr32[N]),     \
+                BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,                       \
+                            offsetof(struct bpf_sock_addr, user_ip6[N]))
+
+                /*      user_ip6 = addr6_rw.sin6_addr */
+                STORE_IPV6_WORD(0),
+                STORE_IPV6_WORD(1),
+                STORE_IPV6_WORD(2),
+                STORE_IPV6_WORD(3),
+
+                /*      user_port = addr6_rw.sin6_port */
+                BPF_MOV32_IMM(BPF_REG_7, addr6_rw.sin6_port),
+                BPF_STX_MEM(BPF_W, BPF_REG_6, BPF_REG_7,
+                            offsetof(struct bpf_sock_addr, user_port)),
+
+                /* } */
+
+                /* return 1 */
+                BPF_MOV64_IMM(BPF_REG_0, 1),
+                BPF_EXIT_INSN(),
+        };
+
+        return load_insns(attach_type, insns,
+                          sizeof(insns) / sizeof(struct bpf_insn), comment);
+}
+
+static int connect_prog_load_path(const char *path,
+                                  enum bpf_attach_type attach_type,
+                                  const char *comment)
+{
+        struct bpf_prog_load_attr attr;
+        struct bpf_object *obj;
+        int prog_fd;
+
+        memset(&attr, 0, sizeof(struct bpf_prog_load_attr));
+        attr.file = path;
+        attr.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
+        attr.expected_attach_type = attach_type;
+
+        if (bpf_prog_load_xattr(&attr, &obj, &prog_fd)) {
+                if (comment)
+                        log_err(">>> Loading %s program at %s error.\n",
+                                comment, path);
+                return -1;
+        }
+
+        return prog_fd;
+}
+
+static int connect4_prog_load(enum bpf_attach_type attach_type,
+                              const char *comment)
+{
+        return connect_prog_load_path(CONNECT4_PROG_PATH, attach_type, comment);
+}
+
+static int connect6_prog_load(enum bpf_attach_type attach_type,
+                              const char *comment)
+{
+        return connect_prog_load_path(CONNECT6_PROG_PATH, attach_type, comment);
+}
+
+static void print_ip_port(int sockfd, info_fn fn, const char *fmt)
+{
+        char addr_buf[INET_NTOP_BUF];
+        struct sockaddr_storage addr;
+        struct sockaddr_in6 *addr6;
+        struct sockaddr_in *addr4;
+        socklen_t addr_len;
+        unsigned short port;
+        void *nip;
+
+        addr_len = sizeof(struct sockaddr_storage);
+        memset(&addr, 0, addr_len);
+
+        if (fn(sockfd, (struct sockaddr *)&addr, (socklen_t *)&addr_len) == 0) {
+                if (addr.ss_family == AF_INET) {
+                        addr4 = (struct sockaddr_in *)&addr;
+                        nip = (void *)&addr4->sin_addr;
+                        port = ntohs(addr4->sin_port);
+                } else if (addr.ss_family == AF_INET6) {
+                        addr6 = (struct sockaddr_in6 *)&addr;
+                        nip = (void *)&addr6->sin6_addr;
+                        port = ntohs(addr6->sin6_port);
+                } else {
+                        return;
+                }
+                const char *addr_str =
+                        inet_ntop(addr.ss_family, nip, addr_buf, INET_NTOP_BUF);
+                printf(fmt, addr_str ? addr_str : "??", port);
+        }
+}
+
+static void print_local_ip_port(int sockfd, const char *fmt)
+{
+        print_ip_port(sockfd, getsockname, fmt);
+}
+
+static void print_remote_ip_port(int sockfd, const char *fmt)
+{
+        print_ip_port(sockfd, getpeername, fmt);
+}
+
+static int start_server(int type, const struct sockaddr_storage *addr,
+                        socklen_t addr_len)
+{
+
+        int fd;
+
+        fd = socket(addr->ss_family, type, 0);
+        if (fd == -1) {
+                log_err("Failed to create server socket");
+                goto out;
+        }
+
+        if (bind(fd, (const struct sockaddr *)addr, addr_len) == -1) {
+                log_err("Failed to bind server socket");
+                goto close_out;
+        }
+
+        if (type == SOCK_STREAM) {
+                if (listen(fd, 128) == -1) {
+                        log_err("Failed to listen on server socket");
+                        goto close_out;
+                }
+        }
+
+        print_local_ip_port(fd, "\t   Actual: bind(%s, %d)\n");
+
+        goto out;
+close_out:
+        close(fd);
+        fd = -1;
+out:
+        return fd;
+}
+
+static int connect_to_server(int type, const struct sockaddr_storage *addr,
+                             socklen_t addr_len)
+{
+        int domain;
+        int fd;
+
+        domain = addr->ss_family;
+
+        if (domain != AF_INET && domain != AF_INET6) {
+                log_err("Unsupported address family");
+                return -1;
+        }
+
+        fd = socket(domain, type, 0);
+        if (fd == -1) {
+                log_err("Failed to creating client socket");
+                return -1;
+        }
+
+        if (connect(fd, (const struct sockaddr *)addr, addr_len) == -1) {
+                log_err("Fail to connect to server");
+                goto err;
+        }
+
+        print_remote_ip_port(fd, "\t   Actual: connect(%s, %d)");
+        print_local_ip_port(fd, " from (%s, %d)\n");
+
+        return 0;
+err:
+        close(fd);
+        return -1;
+}
+
+static void print_test_case_num(int domain, int type)
+{
+        static int test_num;
+
+        printf("Test case #%d (%s/%s):\n", ++test_num,
+               (domain == AF_INET ? "IPv4" :
+                domain == AF_INET6 ? "IPv6" :
+                "unknown_domain"),
+               (type == SOCK_STREAM ? "TCP" :
+                type == SOCK_DGRAM ? "UDP" :
+                "unknown_type"));
+}
+
+static int run_test_case(int domain, int type, const char *ip,
+                         unsigned short port)
+{
+        struct sockaddr_storage addr;
+        socklen_t addr_len = sizeof(addr);
+        int servfd = -1;
+        int err = 0;
+
+        print_test_case_num(domain, type);
+
+        if (mk_sockaddr(domain, ip, port, (struct sockaddr *)&addr,
+                        addr_len) == -1)
+                return -1;
+
+        printf("\tRequested: bind(%s, %d) ..\n", ip, port);
+        servfd = start_server(type, &addr, addr_len);
+        if (servfd == -1)
+                goto err;
+
+        printf("\tRequested: connect(%s, %d) from (*, *) ..\n", ip, port);
+        if (connect_to_server(type, &addr, addr_len))
+                goto err;
+
+        goto out;
+err:
+        err = -1;
+out:
+        close(servfd);
+        return err;
+}
+
+static void close_progs_fds(struct program *progs, size_t prog_cnt)
+{
+        size_t i;
+
+        for (i = 0; i < prog_cnt; ++i) {
+                close(progs[i].fd);
+                progs[i].fd = -1;
+        }
+}
+
+static int load_and_attach_progs(int cgfd, struct program *progs,
+                                 size_t prog_cnt)
+{
+        size_t i;
+
+        for (i = 0; i < prog_cnt; ++i) {
+                printf("Load %s with invalid type (can pollute stderr) ",
+                       progs[i].name);
+                fflush(stdout);
+                progs[i].fd = progs[i].loadfn(progs[i].invalid_type, NULL);
+                if (progs[i].fd != -1) {
+                        log_err("Load with invalid type accepted for %s",
+                                progs[i].name);
+                        goto err;
+                }
+                printf("... REJECTED\n");
+
+                printf("Load %s with valid type", progs[i].name);
+                progs[i].fd = progs[i].loadfn(progs[i].type, progs[i].name);
+                if (progs[i].fd == -1) {
+                        log_err("Failed to load program %s", progs[i].name);
+                        goto err;
+                }
+                printf(" ... OK\n");
+
+                printf("Attach %s with invalid type", progs[i].name);
+                if (bpf_prog_attach(progs[i].fd, cgfd, progs[i].invalid_type,
+                                    BPF_F_ALLOW_OVERRIDE) != -1) {
+                        log_err("Attach with invalid type accepted for %s",
+                                progs[i].name);
+                        goto err;
+                }
+                printf(" ... REJECTED\n");
+
+                printf("Attach %s with valid type", progs[i].name);
+                if (bpf_prog_attach(progs[i].fd, cgfd, progs[i].type,
+                                    BPF_F_ALLOW_OVERRIDE) == -1) {
+                        log_err("Failed to attach program %s", progs[i].name);
+                        goto err;
+                }
+                printf(" ... OK\n");
+        }
+
+        return 0;
+err:
+        close_progs_fds(progs, prog_cnt);
+        return -1;
+}
+
+static int run_domain_test(int domain, int cgfd, struct program *progs,
+                           size_t prog_cnt, const char *ip, unsigned short port)
+{
+        int err = 0;
+
+        if (load_and_attach_progs(cgfd, progs, prog_cnt) == -1)
+                goto err;
+
+        if (run_test_case(domain, SOCK_STREAM, ip, port) == -1)
+                goto err;
+
+        if (run_test_case(domain, SOCK_DGRAM, ip, port) == -1)
+                goto err;
+
+        goto out;
+err:
+        err = -1;
+out:
+        close_progs_fds(progs, prog_cnt);
+        return err;
+}
+
+static int run_test(void)
+{
+        size_t inet6_prog_cnt;
+        size_t inet_prog_cnt;
+        int cgfd = -1;
+        int err = 0;
+
+        struct program inet6_progs[] = {
+                {BPF_CGROUP_INET6_BIND, bind6_prog_load, -1, "bind6",
+                 BPF_CGROUP_INET4_BIND},
+                {BPF_CGROUP_INET6_CONNECT, connect6_prog_load, -1, "connect6",
+                 BPF_CGROUP_INET4_CONNECT},
+        };
+        inet6_prog_cnt = sizeof(inet6_progs) / sizeof(struct program);
+
+        struct program inet_progs[] = {
+                {BPF_CGROUP_INET4_BIND, bind4_prog_load, -1, "bind4",
+                 BPF_CGROUP_INET6_BIND},
+                {BPF_CGROUP_INET4_CONNECT, connect4_prog_load, -1, "connect4",
+                 BPF_CGROUP_INET6_CONNECT},
+        };
+        inet_prog_cnt = sizeof(inet_progs) / sizeof(struct program);
+
+        if (setup_cgroup_environment())
+                goto err;
+
+        cgfd = create_and_get_cgroup(CG_PATH);
+        if (!cgfd)
+                goto err;
+
+        if (join_cgroup(CG_PATH))
+                goto err;
+
+        if (run_domain_test(AF_INET, cgfd, inet_progs, inet_prog_cnt, SERV4_IP,
+                            SERV4_PORT) == -1)
+                goto err;
+
+        if (run_domain_test(AF_INET6, cgfd, inet6_progs, inet6_prog_cnt,
+                            SERV6_IP, SERV6_PORT) == -1)
+                goto err;
+
+        goto out;
+err:
+        err = -1;
+out:
+        close(cgfd);
+        cleanup_cgroup_environment();
+        printf(err ? "### FAIL\n" : "### SUCCESS\n");
+        return err;
+}
+
+int main(int argc, char **argv)
+{
+        if (argc < 2) {
+                fprintf(stderr,
+                        "%s has to be run via %s.sh. Skip direct run.\n",
+                        argv[0], argv[0]);
+                exit(0);
+        }
+        return run_test();
+}
diff --git a/tools/testing/selftests/bpf/test_sock_addr.sh b/tools/testing/selftests/bpf/test_sock_addr.sh
new file mode 100755
index 000000000000..9832a875a828
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_sock_addr.sh
@@ -0,0 +1,57 @@
+#!/bin/sh
+
+set -eu
+
+ping_once()
+{
+        ping -${1} -q -c 1 -W 1 ${2%%/*} >/dev/null 2>&1
+}
+
+wait_for_ip()
+{
+        local _i
+        echo -n "Wait for testing IPv4/IPv6 to become available "
+        for _i in $(seq ${MAX_PING_TRIES}); do
+                echo -n "."
+                if ping_once 4 ${TEST_IPv4} && ping_once 6 ${TEST_IPv6}; then
+                        echo " OK"
+                        return
+                fi
+        done
+        echo 1>&2 "ERROR: Timeout waiting for test IP to become available."
+        exit 1
+}
+
+setup()
+{
+        # Create testing interfaces not to interfere with current environment.
+        ip link add dev ${TEST_IF} type veth peer name ${TEST_IF_PEER}
+        ip link set ${TEST_IF} up
+        ip link set ${TEST_IF_PEER} up
+
+        ip -4 addr add ${TEST_IPv4} dev ${TEST_IF}
+        ip -6 addr add ${TEST_IPv6} dev ${TEST_IF}
+        wait_for_ip
+}
+
+cleanup()
+{
+        ip link del ${TEST_IF} 2>/dev/null || :
+        ip link del ${TEST_IF_PEER} 2>/dev/null || :
+}
+
+main()
+{
+        trap cleanup EXIT 2 3 6 15
+        setup
+        ./test_sock_addr setup_done
+}
+
+BASENAME=$(basename $0 .sh)
+TEST_IF="${BASENAME}1"
+TEST_IF_PEER="${BASENAME}2"
+TEST_IPv4="127.0.0.4/8"
+TEST_IPv6="::6/128"
+MAX_PING_TRIES=5
+
+main
diff --git a/tools/testing/selftests/bpf/test_stacktrace_build_id.c b/tools/testing/selftests/bpf/test_stacktrace_build_id.c
new file mode 100644
index 000000000000..b755bd783ce5
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_stacktrace_build_id.c
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2018 Facebook
+
+#include <linux/bpf.h>
+#include "bpf_helpers.h"
+
+#ifndef PERF_MAX_STACK_DEPTH
+#define PERF_MAX_STACK_DEPTH         127
+#endif
+
+struct bpf_map_def SEC("maps") control_map = {
+        .type = BPF_MAP_TYPE_ARRAY,
+        .key_size = sizeof(__u32),
+        .value_size = sizeof(__u32),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps") stackid_hmap = {
+        .type = BPF_MAP_TYPE_HASH,
+        .key_size = sizeof(__u32),
+        .value_size = sizeof(__u32),
+        .max_entries = 10000,
+};
+
+struct bpf_map_def SEC("maps") stackmap = {
+        .type = BPF_MAP_TYPE_STACK_TRACE,
+        .key_size = sizeof(__u32),
+        .value_size = sizeof(struct bpf_stack_build_id)
+                * PERF_MAX_STACK_DEPTH,
+        .max_entries = 128,
+        .map_flags = BPF_F_STACK_BUILD_ID,
+};
+
+/* taken from /sys/kernel/debug/tracing/events/random/urandom_read/format */
+struct random_urandom_args {
+        unsigned long long pad;
+        int got_bits;
+        int pool_left;
+        int input_left;
+};
+
+SEC("tracepoint/random/urandom_read")
+int oncpu(struct random_urandom_args *args)
+{
+        __u32 key = 0, val = 0, *value_p;
+
+        value_p = bpf_map_lookup_elem(&control_map, &key);
+        if (value_p && *value_p)
+                return 0; /* skip if non-zero *value_p */
+
+        /* The size of stackmap and stackid_hmap should be the same */
+        key = bpf_get_stackid(args, &stackmap, BPF_F_USER_STACK);
+        if ((int)key >= 0)
+                bpf_map_update_elem(&stackid_hmap, &key, &val, 0);
+
+        return 0;
+}
+
+char _license[] SEC("license") = "GPL";
+__u32 _version SEC("version") = 1; /* ignored by tracepoints, required by libbpf.a */
diff --git a/tools/testing/selftests/bpf/test_tag.c b/tools/testing/selftests/bpf/test_tag.c
index 8b201895c569..6272c784ca2a 100644
--- a/tools/testing/selftests/bpf/test_tag.c
+++ b/tools/testing/selftests/bpf/test_tag.c
@@ -12,7 +12,6 @@
 #include <assert.h>
 
 #include <sys/socket.h>
-#include <sys/resource.h>
 
 #include <linux/filter.h>
 #include <linux/bpf.h>
@@ -21,6 +20,7 @@
 #include <bpf/bpf.h>
 
 #include "../../../include/linux/filter.h"
+#include "bpf_rlimit.h"
 
 static struct bpf_insn prog[BPF_MAXINSNS];
 
@@ -184,11 +184,9 @@ static void do_test(uint32_t *tests, int start_insns, int fd_map,
 
 int main(void)
 {
-        struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
         uint32_t tests = 0;
         int i, fd_map;
 
-        setrlimit(RLIMIT_MEMLOCK, &rinf);
         fd_map = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(int),
                                 sizeof(int), 1, BPF_F_NO_PREALLOC);
         assert(fd_map > 0);
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
index 95a370f3d378..84ab5163c828 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
@@ -11,12 +11,14 @@
 #include <linux/ptrace.h>
 #include <linux/bpf.h>
 #include <sys/ioctl.h>
+#include <sys/time.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <bpf/bpf.h>
 #include <bpf/libbpf.h>
 #include "bpf_util.h"
+#include "bpf_rlimit.h"
 #include <linux/perf_event.h>
 #include "test_tcpbpf.h"
 
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 437c0b1c9d21..3e7718b1a9ae 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -24,7 +24,6 @@
 #include <limits.h>
 
 #include <sys/capability.h>
-#include <sys/resource.h>
 
 #include <linux/unistd.h>
 #include <linux/filter.h>
@@ -41,7 +40,7 @@
 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
 # endif
 #endif
-
+#include "bpf_rlimit.h"
 #include "../../../include/linux/filter.h"
 
 #ifndef ARRAY_SIZE
@@ -57,6 +56,9 @@
 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
 
+#define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
+static bool unpriv_disabled = false;
+
 struct bpf_test {
         const char *descr;
         struct bpf_insn insns[MAX_INSNS];
@@ -1595,6 +1597,60 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SK_SKB,
         },
         {
+                "direct packet read for SK_MSG",
+                .insns = {
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct sk_msg_md, data)),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct sk_msg_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SK_MSG,
+        },
+        {
+                "direct packet write for SK_MSG",
+                .insns = {
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct sk_msg_md, data)),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct sk_msg_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+                        BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SK_MSG,
+        },
+        {
+                "overlapping checks for direct packet access SK_MSG",
+                .insns = {
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct sk_msg_md, data)),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct sk_msg_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SK_MSG,
+        },
+        {
                 "check skb->mark is not writeable by sockets",
                 .insns = {
                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
@@ -2587,17 +2643,74 @@ static struct bpf_test tests[] = {
                 .result = ACCEPT,
         },
         {
+                "runtime/jit: tail_call within bounds, prog once",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_tail_call),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_prog = { 1 },
+                .result = ACCEPT,
+                .retval = 42,
+        },
+        {
+                "runtime/jit: tail_call within bounds, prog loop",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 1),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_tail_call),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_prog = { 1 },
+                .result = ACCEPT,
+                .retval = 41,
+        },
+        {
+                "runtime/jit: tail_call within bounds, no prog",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 2),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_tail_call),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_prog = { 1 },
+                .result = ACCEPT,
+                .retval = 1,
+        },
+        {
+                "runtime/jit: tail_call out of bounds",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 256),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_tail_call),
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_prog = { 1 },
+                .result = ACCEPT,
+                .retval = 2,
+        },
+        {
                 "runtime/jit: pass negative index to tail_call",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_3, -1),
                         BPF_LD_MAP_FD(BPF_REG_2, 0),
                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
                                      BPF_FUNC_tail_call),
-                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
                         BPF_EXIT_INSN(),
                 },
                 .fixup_prog = { 1 },
                 .result = ACCEPT,
+                .retval = 2,
         },
         {
                 "runtime/jit: pass > 32bit index to tail_call",
@@ -2606,11 +2719,12 @@ static struct bpf_test tests[] = {
                         BPF_LD_MAP_FD(BPF_REG_2, 0),
                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
                                      BPF_FUNC_tail_call),
-                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
                         BPF_EXIT_INSN(),
                 },
                 .fixup_prog = { 2 },
                 .result = ACCEPT,
+                .retval = 42,
         },
         {
                 "stack pointer arithmetic",
@@ -11164,6 +11278,94 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
         },
         {
+                "jit: lsh, rsh, arsh by 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_MOV64_IMM(BPF_REG_1, 0xff),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
+                        BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
+                        BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .retval = 2,
+        },
+        {
+                "jit: mov32 for ldimm64, 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
+                        BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
+                        BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .retval = 2,
+        },
+        {
+                "jit: mov32 for ldimm64, 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
+                        BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .retval = 2,
+        },
+        {
+                "jit: various mul tests",
+                .insns = {
+                        BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
+                        BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
+                        BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
+                        BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
+                        BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
+                        BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
+                        BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
+                        BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
+                        BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
+                        BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
+                        BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
+                        BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV64_IMM(BPF_REG_0, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .retval = 2,
+        },
+        {
                 "xadd/w check unaligned stack",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_0, 1),
@@ -11245,16 +11447,61 @@ static int create_map(uint32_t size_value, uint32_t max_elem)
         return fd;
 }
 
+static int create_prog_dummy1(void)
+{
+        struct bpf_insn prog[] = {
+                BPF_MOV64_IMM(BPF_REG_0, 42),
+                BPF_EXIT_INSN(),
+        };
+
+        return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
+                                ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
+}
+
+static int create_prog_dummy2(int mfd, int idx)
+{
+        struct bpf_insn prog[] = {
+                BPF_MOV64_IMM(BPF_REG_3, idx),
+                BPF_LD_MAP_FD(BPF_REG_2, mfd),
+                BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                             BPF_FUNC_tail_call),
+                BPF_MOV64_IMM(BPF_REG_0, 41),
+                BPF_EXIT_INSN(),
+        };
+
+        return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
+                                ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
+}
+
 static int create_prog_array(void)
 {
-        int fd;
+        int p1key = 0, p2key = 1;
+        int mfd, p1fd, p2fd;
 
-        fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
-                            sizeof(int), 4, 0);
-        if (fd < 0)
+        mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
+                             sizeof(int), 4, 0);
+        if (mfd < 0) {
                 printf("Failed to create prog array '%s'!\n", strerror(errno));
+                return -1;
+        }
 
-        return fd;
+        p1fd = create_prog_dummy1();
+        p2fd = create_prog_dummy2(mfd, p2key);
+        if (p1fd < 0 || p2fd < 0)
+                goto out;
+        if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
+                goto out;
+        if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
+                goto out;
+        close(p2fd);
+        close(p1fd);
+
+        return mfd;
+out:
+        close(p2fd);
+        close(p1fd);
+        close(mfd);
+        return -1;
 }
 
 static int create_map_in_map(void)
@@ -11375,7 +11622,8 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
                         goto fail_log;
                 }
                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
-                        printf("FAIL\nUnexpected error message!\n");
+                        printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
+                              expected_err, bpf_vlog);
                         goto fail_log;
                 }
         }
@@ -11459,9 +11707,20 @@ out:
         return ret;
 }
 
+static void get_unpriv_disabled()
+{
+        char buf[2];
+        FILE *fd;
+
+        fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
+        if (fgets(buf, 2, fd) == buf && atoi(buf))
+                unpriv_disabled = true;
+        fclose(fd);
+}
+
 static int do_test(bool unpriv, unsigned int from, unsigned int to)
 {
-        int i, passes = 0, errors = 0;
+        int i, passes = 0, errors = 0, skips = 0;
 
         for (i = from; i < to; i++) {
                 struct bpf_test *test = &tests[i];
@@ -11469,7 +11728,10 @@ static int do_test(bool unpriv, unsigned int from, unsigned int to)
                 /* Program types that are not supported by non-root we
                  * skip right away.
                  */
-                if (!test->prog_type) {
+                if (!test->prog_type && unpriv_disabled) {
+                        printf("#%d/u %s SKIP\n", i, test->descr);
+                        skips++;
+                } else if (!test->prog_type) {
                         if (!unpriv)
                                 set_admin(false);
                         printf("#%d/u %s ", i, test->descr);
@@ -11478,20 +11740,22 @@ static int do_test(bool unpriv, unsigned int from, unsigned int to)
                                 set_admin(true);
                 }
 
-                if (!unpriv) {
+                if (unpriv) {
+                        printf("#%d/p %s SKIP\n", i, test->descr);
+                        skips++;
+                } else {
                         printf("#%d/p %s ", i, test->descr);
                         do_test_single(test, false, &passes, &errors);
                 }
         }
 
-        printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
+        printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
+               skips, errors);
         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
 }
 
 int main(int argc, char **argv)
 {
-        struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
-        struct rlimit rlim = { 1 << 20, 1 << 20 };
         unsigned int from = 0, to = ARRAY_SIZE(tests);
         bool unpriv = !is_admin();
 
@@ -11512,6 +11776,12 @@ int main(int argc, char **argv)
                 }
         }
 
-        setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
+        get_unpriv_disabled();
+        if (unpriv && unpriv_disabled) {
+                printf("Cannot run as unprivileged user with sysctl %s.\n",
+                       UNPRIV_SYSCTL);
+                return EXIT_FAILURE;
+        }
+
         return do_test(unpriv, from, to);
 }
diff --git a/tools/testing/selftests/bpf/test_verifier_log.c b/tools/testing/selftests/bpf/test_verifier_log.c
index e9626cf5607a..8d6918c3b4a2 100644
--- a/tools/testing/selftests/bpf/test_verifier_log.c
+++ b/tools/testing/selftests/bpf/test_verifier_log.c
@@ -4,7 +4,6 @@
 #include <string.h>
 #include <unistd.h>
 #include <sys/time.h>
-#include <sys/resource.h>
 
 #include <linux/bpf.h>
 #include <linux/filter.h>
@@ -12,6 +11,8 @@
 
 #include <bpf/bpf.h>
 
+#include "bpf_rlimit.h"
+
 #define LOG_SIZE (1 << 20)
 
 #define err(str...)     printf("ERROR: " str)
@@ -133,16 +134,11 @@ static void test_log_bad(char *log, size_t log_len, int log_level)
 
 int main(int argc, char **argv)
 {
-        struct rlimit limit  = { RLIM_INFINITY, RLIM_INFINITY };
         char full_log[LOG_SIZE];
         char log[LOG_SIZE];
         size_t want_len;
         int i;
 
-        /* allow unlimited locked memory to have more consistent error code */
-        if (setrlimit(RLIMIT_MEMLOCK, &limit) < 0)
-                perror("Unable to lift memlock rlimit");
-
         memset(log, 1, LOG_SIZE);
 
         /* Test incorrect attr */
diff --git a/tools/testing/selftests/bpf/urandom_read.c b/tools/testing/selftests/bpf/urandom_read.c
new file mode 100644
index 000000000000..4acfdebf36fa
--- /dev/null
+++ b/tools/testing/selftests/bpf/urandom_read.c
@@ -0,0 +1,22 @@
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdlib.h>
+
+#define BUF_SIZE 256
+int main(void)
+{
+        int fd = open("/dev/urandom", O_RDONLY);
+        int i;
+        char buf[BUF_SIZE];
+
+        if (fd < 0)
+                return 1;
+        for (i = 0; i < 4; ++i)
+                read(fd, buf, BUF_SIZE);
+
+        close(fd);
+        return 0;
+}
diff --git a/tools/testing/selftests/filesystems/.gitignore b/tools/testing/selftests/filesystems/.gitignore
index 31d6e426b6d4..8449cf6716ce 100644
--- a/tools/testing/selftests/filesystems/.gitignore
+++ b/tools/testing/selftests/filesystems/.gitignore
@@ -1 +1,2 @@
 dnotify_test
+devpts_pts
diff --git a/tools/testing/selftests/filesystems/Makefile b/tools/testing/selftests/filesystems/Makefile
index 13a73bf725b5..5c7d7001ad37 100644
--- a/tools/testing/selftests/filesystems/Makefile
+++ b/tools/testing/selftests/filesystems/Makefile
@@ -1,8 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
-TEST_PROGS := dnotify_test
-all: $(TEST_PROGS)
 
-include ../lib.mk
+TEST_GEN_PROGS := devpts_pts
+TEST_GEN_PROGS_EXTENDED := dnotify_test
 
-clean:
-        rm -fr $(TEST_PROGS)
+include ../lib.mk
diff --git a/tools/testing/selftests/filesystems/devpts_pts.c b/tools/testing/selftests/filesystems/devpts_pts.c
new file mode 100644
index 000000000000..b9055e974289
--- /dev/null
+++ b/tools/testing/selftests/filesystems/devpts_pts.c
@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/mount.h>
+#include <sys/wait.h>
+
+static bool terminal_dup2(int duplicate, int original)
+{
+        int ret;
+
+        ret = dup2(duplicate, original);
+        if (ret < 0)
+                return false;
+
+        return true;
+}
+
+static int terminal_set_stdfds(int fd)
+{
+        int i;
+
+        if (fd < 0)
+                return 0;
+
+        for (i = 0; i < 3; i++)
+                if (!terminal_dup2(fd, (int[]){STDIN_FILENO, STDOUT_FILENO,
+                                               STDERR_FILENO}[i]))
+                        return -1;
+
+        return 0;
+}
+
+static int login_pty(int fd)
+{
+        int ret;
+
+        setsid();
+
+        ret = ioctl(fd, TIOCSCTTY, NULL);
+        if (ret < 0)
+                return -1;
+
+        ret = terminal_set_stdfds(fd);
+        if (ret < 0)
+                return -1;
+
+        if (fd > STDERR_FILENO)
+                close(fd);
+
+        return 0;
+}
+
+static int wait_for_pid(pid_t pid)
+{
+        int status, ret;
+
+again:
+        ret = waitpid(pid, &status, 0);
+        if (ret == -1) {
+                if (errno == EINTR)
+                        goto again;
+                return -1;
+        }
+        if (ret != pid)
+                goto again;
+
+        if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
+                return -1;
+
+        return 0;
+}
+
+static int resolve_procfd_symlink(int fd, char *buf, size_t buflen)
+{
+        int ret;
+        char procfd[4096];
+
+        ret = snprintf(procfd, 4096, "/proc/self/fd/%d", fd);
+        if (ret < 0 || ret >= 4096)
+                return -1;
+
+        ret = readlink(procfd, buf, buflen);
+        if (ret < 0 || (size_t)ret >= buflen)
+                return -1;
+
+        buf[ret] = '\0';
+
+        return 0;
+}
+
+static int do_tiocgptpeer(char *ptmx, char *expected_procfd_contents)
+{
+        int ret;
+        int master = -1, slave = -1, fret = -1;
+
+        master = open(ptmx, O_RDWR | O_NOCTTY | O_CLOEXEC);
+        if (master < 0) {
+                fprintf(stderr, "Failed to open \"%s\": %s\n", ptmx,
+                        strerror(errno));
+                return -1;
+        }
+
+        /*
+         * grantpt() makes assumptions about /dev/pts/ so ignore it. It's also
+         * not really needed.
+         */
+        ret = unlockpt(master);
+        if (ret < 0) {
+                fprintf(stderr, "Failed to unlock terminal\n");
+                goto do_cleanup;
+        }
+
+#ifdef TIOCGPTPEER
+        slave = ioctl(master, TIOCGPTPEER, O_RDWR | O_NOCTTY | O_CLOEXEC);
+#endif
+        if (slave < 0) {
+                if (errno == EINVAL) {
+                        fprintf(stderr, "TIOCGPTPEER is not supported. "
+                                        "Skipping test.\n");
+                        fret = EXIT_SUCCESS;
+                }
+
+                fprintf(stderr, "Failed to perform TIOCGPTPEER ioctl\n");
+                goto do_cleanup;
+        }
+
+        pid_t pid = fork();
+        if (pid < 0)
+                goto do_cleanup;
+
+        if (pid == 0) {
+                char buf[4096];
+
+                ret = login_pty(slave);
+                if (ret < 0) {
+                        fprintf(stderr, "Failed to setup terminal\n");
+                        _exit(EXIT_FAILURE);
+                }
+
+                ret = resolve_procfd_symlink(STDIN_FILENO, buf, sizeof(buf));
+                if (ret < 0) {
+                        fprintf(stderr, "Failed to retrieve pathname of pts "
+                                        "slave file descriptor\n");
+                        _exit(EXIT_FAILURE);
+                }
+
+                if (strncmp(expected_procfd_contents, buf,
+                            strlen(expected_procfd_contents)) != 0) {
+                        fprintf(stderr, "Received invalid contents for "
+                                        "\"/proc/<pid>/fd/%d\" symlink: %s\n",
+                                        STDIN_FILENO, buf);
+                        _exit(-1);
+                }
+
+                fprintf(stderr, "Contents of \"/proc/<pid>/fd/%d\" "
+                                "symlink are valid: %s\n", STDIN_FILENO, buf);
+
+                _exit(EXIT_SUCCESS);
+        }
+
+        ret = wait_for_pid(pid);
+        if (ret < 0)
+                goto do_cleanup;
+
+        fret = EXIT_SUCCESS;
+
+do_cleanup:
+        if (master >= 0)
+                close(master);
+        if (slave >= 0)
+                close(slave);
+
+        return fret;
+}
+
+static int verify_non_standard_devpts_mount(void)
+{
+        char *mntpoint;
+        int ret = -1;
+        char devpts[] = P_tmpdir "/devpts_fs_XXXXXX";
+        char ptmx[] = P_tmpdir "/devpts_fs_XXXXXX/ptmx";
+
+        ret = umount("/dev/pts");
+        if (ret < 0) {
+                fprintf(stderr, "Failed to unmount \"/dev/pts\": %s\n",
+                                strerror(errno));
+                return -1;
+        }
+
+        (void)umount("/dev/ptmx");
+
+        mntpoint = mkdtemp(devpts);
+        if (!mntpoint) {
+                fprintf(stderr, "Failed to create temporary mountpoint: %s\n",
+                                 strerror(errno));
+                return -1;
+        }
+
+        ret = mount("devpts", mntpoint, "devpts", MS_NOSUID | MS_NOEXEC,
+                    "newinstance,ptmxmode=0666,mode=0620,gid=5");
+        if (ret < 0) {
+                fprintf(stderr, "Failed to mount devpts fs to \"%s\" in new "
+                                "mount namespace: %s\n", mntpoint,
+                                strerror(errno));
+                unlink(mntpoint);
+                return -1;
+        }
+
+        ret = snprintf(ptmx, sizeof(ptmx), "%s/ptmx", devpts);
+        if (ret < 0 || (size_t)ret >= sizeof(ptmx)) {
+                unlink(mntpoint);
+                return -1;
+        }
+
+        ret = do_tiocgptpeer(ptmx, mntpoint);
+        unlink(mntpoint);
+        if (ret < 0)
+                return -1;
+
+        return 0;
+}
+
+static int verify_ptmx_bind_mount(void)
+{
+        int ret;
+
+        ret = mount("/dev/pts/ptmx", "/dev/ptmx", NULL, MS_BIND, NULL);
+        if (ret < 0) {
+                fprintf(stderr, "Failed to bind mount \"/dev/pts/ptmx\" to "
+                                "\"/dev/ptmx\" mount namespace\n");
+                return -1;
+        }
+
+        ret = do_tiocgptpeer("/dev/ptmx", "/dev/pts/");
+        if (ret < 0)
+                return -1;
+
+        return 0;
+}
+
+static int verify_invalid_ptmx_bind_mount(void)
+{
+        int ret;
+        char mntpoint_fd;
+        char ptmx[] = P_tmpdir "/devpts_ptmx_XXXXXX";
+
+        mntpoint_fd = mkstemp(ptmx);
+        if (mntpoint_fd < 0) {
+                fprintf(stderr, "Failed to create temporary directory: %s\n",
+                                 strerror(errno));
+                return -1;
+        }
+
+        ret = mount("/dev/pts/ptmx", ptmx, NULL, MS_BIND, NULL);
+        close(mntpoint_fd);
+        if (ret < 0) {
+                fprintf(stderr, "Failed to bind mount \"/dev/pts/ptmx\" to "
+                                "\"%s\" mount namespace\n", ptmx);
+                return -1;
+        }
+
+        ret = do_tiocgptpeer(ptmx, "/dev/pts/");
+        if (ret == 0)
+                return -1;
+
+        return 0;
+}
+
+int main(int argc, char *argv[])
+{
+        int ret;
+
+        if (!isatty(STDIN_FILENO)) {
+                fprintf(stderr, "Standard input file desciptor is not attached "
+                                "to a terminal. Skipping test\n");
+                exit(EXIT_FAILURE);
+        }
+
+        ret = unshare(CLONE_NEWNS);
+        if (ret < 0) {
+                fprintf(stderr, "Failed to unshare mount namespace\n");
+                exit(EXIT_FAILURE);
+        }
+
+        ret = mount("", "/", NULL, MS_PRIVATE | MS_REC, 0);
+        if (ret < 0) {
+                fprintf(stderr, "Failed to make \"/\" MS_PRIVATE in new mount "
+                                "namespace\n");
+                exit(EXIT_FAILURE);
+        }
+
+        ret = verify_ptmx_bind_mount();
+        if (ret < 0)
+                exit(EXIT_FAILURE);
+
+        ret = verify_invalid_ptmx_bind_mount();
+        if (ret < 0)
+                exit(EXIT_FAILURE);
+
+        ret = verify_non_standard_devpts_mount();
+        if (ret < 0)
+                exit(EXIT_FAILURE);
+
+        exit(EXIT_SUCCESS);
+}
diff --git a/tools/testing/selftests/firmware/Makefile b/tools/testing/selftests/firmware/Makefile
index 1894d625af2d..261c81f08606 100644
--- a/tools/testing/selftests/firmware/Makefile
+++ b/tools/testing/selftests/firmware/Makefile
@@ -3,7 +3,8 @@
 # No binaries, but make sure arg-less "make" doesn't trigger "run_tests"
 all:
 
-TEST_PROGS := fw_filesystem.sh fw_fallback.sh
+TEST_PROGS := fw_run_tests.sh
+TEST_FILES := fw_fallback.sh fw_filesystem.sh fw_lib.sh
 
 include ../lib.mk
 
diff --git a/tools/testing/selftests/firmware/config b/tools/testing/selftests/firmware/config
index c8137f70e291..bf634dda0720 100644
--- a/tools/testing/selftests/firmware/config
+++ b/tools/testing/selftests/firmware/config
@@ -1 +1,5 @@
 CONFIG_TEST_FIRMWARE=y
+CONFIG_FW_LOADER=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
diff --git a/tools/testing/selftests/firmware/fw_fallback.sh b/tools/testing/selftests/firmware/fw_fallback.sh
index 722cad91df74..8e2e34a2ca69 100755
--- a/tools/testing/selftests/firmware/fw_fallback.sh
+++ b/tools/testing/selftests/firmware/fw_fallback.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 # This validates that the kernel will fall back to using the fallback mechanism
 # to load firmware it can't find on disk itself. We must request a firmware
@@ -6,31 +6,17 @@
 # won't find so that we can do the load ourself manually.
 set -e
 
-modprobe test_firmware
+TEST_REQS_FW_SYSFS_FALLBACK="yes"
+TEST_REQS_FW_SET_CUSTOM_PATH="no"
+TEST_DIR=$(dirname $0)
+source $TEST_DIR/fw_lib.sh
 
-DIR=/sys/devices/virtual/misc/test_firmware
+check_mods
+check_setup
+verify_reqs
+setup_tmp_file
 
-# CONFIG_FW_LOADER_USER_HELPER has a sysfs class under /sys/class/firmware/
-# These days no one enables CONFIG_FW_LOADER_USER_HELPER so check for that
-# as an indicator for CONFIG_FW_LOADER_USER_HELPER.
-HAS_FW_LOADER_USER_HELPER=$(if [ -d /sys/class/firmware/ ]; then echo yes; else echo no; fi)
-
-if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
-       OLD_TIMEOUT=$(cat /sys/class/firmware/timeout)
-else
-        echo "usermode helper disabled so ignoring test"
-        exit 0
-fi
-
-FWPATH=$(mktemp -d)
-FW="$FWPATH/test-firmware.bin"
-
-test_finish()
-{
-        echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
-        rm -f "$FW"
-        rmdir "$FWPATH"
-}
+trap "test_finish" EXIT
 
 load_fw()
 {
@@ -169,12 +155,6 @@ load_fw_fallback_with_child()
         return $RET
 }
 
-trap "test_finish" EXIT
-
-# This is an unlikely real-world firmware content. :)
-echo "ABCD0123" >"$FW"
-NAME=$(basename "$FW")
-
 test_syfs_timeout()
 {
         DEVPATH="$DIR"/"nope-$NAME"/loading
@@ -258,8 +238,10 @@ run_sysfs_main_tests()
 
 run_sysfs_custom_load_tests()
 {
-        if load_fw_custom "$NAME" "$FW" ; then
-                if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
+        RANDOM_FILE_PATH=$(setup_random_file)
+        RANDOM_FILE="$(basename $RANDOM_FILE_PATH)"
+        if load_fw_custom "$RANDOM_FILE" "$RANDOM_FILE_PATH" ; then
+                if ! diff -q "$RANDOM_FILE_PATH" /dev/test_firmware >/dev/null ; then
                         echo "$0: firmware was not loaded" >&2
                         exit 1
                 else
@@ -267,8 +249,10 @@ run_sysfs_custom_load_tests()
                 fi
         fi
 
-        if load_fw_custom "$NAME" "$FW" ; then
-                if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
+        RANDOM_FILE_PATH=$(setup_random_file)
+        RANDOM_FILE="$(basename $RANDOM_FILE_PATH)"
+        if load_fw_custom "$RANDOM_FILE" "$RANDOM_FILE_PATH" ; then
+                if ! diff -q "$RANDOM_FILE_PATH" /dev/test_firmware >/dev/null ; then
                         echo "$0: firmware was not loaded" >&2
                         exit 1
                 else
@@ -276,8 +260,12 @@ run_sysfs_custom_load_tests()
                 fi
         fi
 
-        if load_fw_custom_cancel "nope-$NAME" "$FW" ; then
-                if diff -q "$FW" /dev/test_firmware >/dev/null ; then
+        RANDOM_FILE_REAL="$RANDOM_FILE_PATH"
+        FAKE_RANDOM_FILE_PATH=$(setup_random_file_fake)
+        FAKE_RANDOM_FILE="$(basename $FAKE_RANDOM_FILE_PATH)"
+
+        if load_fw_custom_cancel "$FAKE_RANDOM_FILE" "$RANDOM_FILE_REAL" ; then
+                if diff -q "$RANDOM_FILE_PATH" /dev/test_firmware >/dev/null ; then
                         echo "$0: firmware was expected to be cancelled" >&2
                         exit 1
                 else
@@ -286,7 +274,10 @@ run_sysfs_custom_load_tests()
         fi
 }
 
-run_sysfs_main_tests
+if [ "$HAS_FW_LOADER_USER_HELPER_FALLBACK" = "yes" ]; then
+        run_sysfs_main_tests
+fi
+
 run_sysfs_custom_load_tests
 
 exit 0
diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh
index f9508e1a4058..6452d2129cd9 100755
--- a/tools/testing/selftests/firmware/fw_filesystem.sh
+++ b/tools/testing/selftests/firmware/fw_filesystem.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 # This validates that the kernel will load firmware out of its list of
 # firmware locations on disk. Since the user helper does similar work,
@@ -6,52 +6,15 @@
 # know so we can be sure we're not accidentally testing the user helper.
 set -e
 
-DIR=/sys/devices/virtual/misc/test_firmware
+TEST_REQS_FW_SYSFS_FALLBACK="no"
+TEST_REQS_FW_SET_CUSTOM_PATH="yes"
 TEST_DIR=$(dirname $0)
+source $TEST_DIR/fw_lib.sh
 
-test_modprobe()
-{
-        if [ ! -d $DIR ]; then
-                echo "$0: $DIR not present"
-                echo "You must have the following enabled in your kernel:"
-                cat $TEST_DIR/config
-                exit 1
-        fi
-}
-
-trap "test_modprobe" EXIT
-
-if [ ! -d $DIR ]; then
-        modprobe test_firmware
-fi
-
-# CONFIG_FW_LOADER_USER_HELPER has a sysfs class under /sys/class/firmware/
-# These days most distros enable CONFIG_FW_LOADER_USER_HELPER but disable
-# CONFIG_FW_LOADER_USER_HELPER_FALLBACK. We use /sys/class/firmware/ as an
-# indicator for CONFIG_FW_LOADER_USER_HELPER.
-HAS_FW_LOADER_USER_HELPER=$(if [ -d /sys/class/firmware/ ]; then echo yes; else echo no; fi)
-
-if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
-        OLD_TIMEOUT=$(cat /sys/class/firmware/timeout)
-fi
-
-OLD_FWPATH=$(cat /sys/module/firmware_class/parameters/path)
-
-FWPATH=$(mktemp -d)
-FW="$FWPATH/test-firmware.bin"
-
-test_finish()
-{
-        if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
-                echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
-        fi
-        if [ "$OLD_FWPATH" = "" ]; then
-                OLD_FWPATH=" "
-        fi
-        echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
-        rm -f "$FW"
-        rmdir "$FWPATH"
-}
+check_mods
+check_setup
+verify_reqs
+setup_tmp_file
 
 trap "test_finish" EXIT
 
@@ -60,14 +23,6 @@ if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
         echo 1 >/sys/class/firmware/timeout
 fi
 
-# Set the kernel search path.
-echo -n "$FWPATH" >/sys/module/firmware_class/parameters/path
-
-# This is an unlikely real-world firmware content. :)
-echo "ABCD0123" >"$FW"
-
-NAME=$(basename "$FW")
-
 if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then
         echo "$0: empty filename should not succeed" >&2
         exit 1
@@ -275,10 +230,13 @@ test_wait_and_cancel_custom_load()
 test_request_firmware_nowait_custom_nofile()
 {
         echo -n "Batched request_firmware_nowait(uevent=false) nofile try #$1: "
+        config_reset
         config_unset_uevent
-        config_set_name nope-test-firmware.bin
+        RANDOM_FILE_PATH=$(setup_random_file_fake)
+        RANDOM_FILE="$(basename $RANDOM_FILE_PATH)"
+        config_set_name $RANDOM_FILE
         config_trigger_async &
-        test_wait_and_cancel_custom_load nope-test-firmware.bin
+        test_wait_and_cancel_custom_load $RANDOM_FILE
         wait
         release_all_firmware
         echo "OK"
@@ -316,7 +274,11 @@ test_request_firmware_nowait_uevent()
 test_request_firmware_nowait_custom()
 {
         echo -n "Batched request_firmware_nowait(uevent=false) try #$1: "
+        config_reset
         config_unset_uevent
+        RANDOM_FILE_PATH=$(setup_random_file)
+        RANDOM_FILE="$(basename $RANDOM_FILE_PATH)"
+        config_set_name $RANDOM_FILE
         config_trigger_async
         release_all_firmware
         echo "OK"
diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh
new file mode 100755
index 000000000000..962d7f4ac627
--- /dev/null
+++ b/tools/testing/selftests/firmware/fw_lib.sh
@@ -0,0 +1,196 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# Library of helpers for test scripts.
+set -e
+
+DIR=/sys/devices/virtual/misc/test_firmware
+
+PROC_CONFIG="/proc/config.gz"
+TEST_DIR=$(dirname $0)
+
+print_reqs_exit()
+{
+        echo "You must have the following enabled in your kernel:" >&2
+        cat $TEST_DIR/config >&2
+        exit 1
+}
+
+test_modprobe()
+{
+        if [ ! -d $DIR ]; then
+                print_reqs_exit
+        fi
+}
+
+check_mods()
+{
+        trap "test_modprobe" EXIT
+        if [ ! -d $DIR ]; then
+                modprobe test_firmware
+        fi
+        if [ ! -f $PROC_CONFIG ]; then
+                if modprobe configs 2>/dev/null; then
+                        echo "Loaded configs module"
+                        if [ ! -f $PROC_CONFIG ]; then
+                                echo "You must have the following enabled in your kernel:" >&2
+                                cat $TEST_DIR/config >&2
+                                echo "Resorting to old heuristics" >&2
+                        fi
+                else
+                        echo "Failed to load configs module, using old heuristics" >&2
+                fi
+        fi
+}
+
+check_setup()
+{
+        HAS_FW_LOADER_USER_HELPER="$(kconfig_has CONFIG_FW_LOADER_USER_HELPER=y)"
+        HAS_FW_LOADER_USER_HELPER_FALLBACK="$(kconfig_has CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y)"
+        PROC_FW_IGNORE_SYSFS_FALLBACK="0"
+        PROC_FW_FORCE_SYSFS_FALLBACK="0"
+
+        if [ -z $PROC_SYS_DIR ]; then
+                PROC_SYS_DIR="/proc/sys/kernel"
+        fi
+
+        FW_PROC="${PROC_SYS_DIR}/firmware_config"
+        FW_FORCE_SYSFS_FALLBACK="$FW_PROC/force_sysfs_fallback"
+        FW_IGNORE_SYSFS_FALLBACK="$FW_PROC/ignore_sysfs_fallback"
+
+        if [ -f $FW_FORCE_SYSFS_FALLBACK ]; then
+                PROC_FW_FORCE_SYSFS_FALLBACK="$(cat $FW_FORCE_SYSFS_FALLBACK)"
+        fi
+
+        if [ -f $FW_IGNORE_SYSFS_FALLBACK ]; then
+                PROC_FW_IGNORE_SYSFS_FALLBACK="$(cat $FW_IGNORE_SYSFS_FALLBACK)"
+        fi
+
+        if [ "$PROC_FW_FORCE_SYSFS_FALLBACK" = "1" ]; then
+                HAS_FW_LOADER_USER_HELPER="yes"
+                HAS_FW_LOADER_USER_HELPER_FALLBACK="yes"
+        fi
+
+        if [ "$PROC_FW_IGNORE_SYSFS_FALLBACK" = "1" ]; then
+                HAS_FW_LOADER_USER_HELPER_FALLBACK="no"
+                HAS_FW_LOADER_USER_HELPER="no"
+        fi
+
+        if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
+               OLD_TIMEOUT="$(cat /sys/class/firmware/timeout)"
+        fi
+
+        OLD_FWPATH="$(cat /sys/module/firmware_class/parameters/path)"
+}
+
+verify_reqs()
+{
+        if [ "$TEST_REQS_FW_SYSFS_FALLBACK" = "yes" ]; then
+                if [ ! "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
+                        echo "usermode helper disabled so ignoring test"
+                        exit 0
+                fi
+        fi
+}
+
+setup_tmp_file()
+{
+        FWPATH=$(mktemp -d)
+        FW="$FWPATH/test-firmware.bin"
+        echo "ABCD0123" >"$FW"
+        NAME=$(basename "$FW")
+        if [ "$TEST_REQS_FW_SET_CUSTOM_PATH" = "yes" ]; then
+                echo -n "$FWPATH" >/sys/module/firmware_class/parameters/path
+        fi
+}
+
+__setup_random_file()
+{
+        RANDOM_FILE_PATH="$(mktemp -p $FWPATH)"
+        # mktemp says dry-run -n is unsafe, so...
+        if [[ "$1" = "fake" ]]; then
+                rm -rf $RANDOM_FILE_PATH
+                sync
+        else
+                echo "ABCD0123" >"$RANDOM_FILE_PATH"
+        fi
+        echo $RANDOM_FILE_PATH
+}
+
+setup_random_file()
+{
+        echo $(__setup_random_file)
+}
+
+setup_random_file_fake()
+{
+        echo $(__setup_random_file fake)
+}
+
+proc_set_force_sysfs_fallback()
+{
+        if [ -f $FW_FORCE_SYSFS_FALLBACK ]; then
+                echo -n $1 > $FW_FORCE_SYSFS_FALLBACK
+                check_setup
+        fi
+}
+
+proc_set_ignore_sysfs_fallback()
+{
+        if [ -f $FW_IGNORE_SYSFS_FALLBACK ]; then
+                echo -n $1 > $FW_IGNORE_SYSFS_FALLBACK
+                check_setup
+        fi
+}
+
+proc_restore_defaults()
+{
+        proc_set_force_sysfs_fallback 0
+        proc_set_ignore_sysfs_fallback 0
+}
+
+test_finish()
+{
+        if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
+                echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
+        fi
+        if [ "$TEST_REQS_FW_SET_CUSTOM_PATH" = "yes" ]; then
+                if [ "$OLD_FWPATH" = "" ]; then
+                        # A zero-length write won't work; write a null byte
+                        printf '\000' >/sys/module/firmware_class/parameters/path
+                else
+                        echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+                fi
+        fi
+        if [ -f $FW ]; then
+                rm -f "$FW"
+        fi
+        if [ -d $FWPATH ]; then
+                rm -rf "$FWPATH"
+        fi
+        proc_restore_defaults
+}
+
+kconfig_has()
+{
+        if [ -f $PROC_CONFIG ]; then
+                if zgrep -q $1 $PROC_CONFIG 2>/dev/null; then
+                        echo "yes"
+                else
+                        echo "no"
+                fi
+        else
+                # We currently don't have easy heuristics to infer this
+                # so best we can do is just try to use the kernel assuming
+                # you had enabled it. This matches the old behaviour.
+                if [ "$1" = "CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y" ]; then
+                        echo "yes"
+                elif [ "$1" = "CONFIG_FW_LOADER_USER_HELPER=y" ]; then
+                        if [ -d /sys/class/firmware/ ]; then
+                                echo yes
+                        else
+                                echo no
+                        fi
+                fi
+        fi
+}
diff --git a/tools/testing/selftests/firmware/fw_run_tests.sh b/tools/testing/selftests/firmware/fw_run_tests.sh
new file mode 100755
index 000000000000..cffdd4eb0a57
--- /dev/null
+++ b/tools/testing/selftests/firmware/fw_run_tests.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# This runs all known tests across all known possible configurations we could
+# emulate in one run.
+
+set -e
+
+TEST_DIR=$(dirname $0)
+source $TEST_DIR/fw_lib.sh
+
+export HAS_FW_LOADER_USER_HELPER=""
+export HAS_FW_LOADER_USER_HELPER_FALLBACK=""
+
+run_tests()
+{
+        proc_set_force_sysfs_fallback $1
+        proc_set_ignore_sysfs_fallback $2
+        $TEST_DIR/fw_filesystem.sh
+
+        proc_set_force_sysfs_fallback $1
+        proc_set_ignore_sysfs_fallback $2
+        $TEST_DIR/fw_fallback.sh
+}
+
+run_test_config_0001()
+{
+        echo "-----------------------------------------------------"
+        echo "Running kernel configuration test 1 -- rare"
+        echo "Emulates:"
+        echo "CONFIG_FW_LOADER=y"
+        echo "CONFIG_FW_LOADER_USER_HELPER=n"
+        echo "CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n"
+        run_tests 0 1
+}
+
+run_test_config_0002()
+{
+        echo "-----------------------------------------------------"
+        echo "Running kernel configuration test 2 -- distro"
+        echo "Emulates:"
+        echo "CONFIG_FW_LOADER=y"
+        echo "CONFIG_FW_LOADER_USER_HELPER=y"
+        echo "CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n"
+        proc_set_ignore_sysfs_fallback 0
+        run_tests 0 0
+}
+
+run_test_config_0003()
+{
+        echo "-----------------------------------------------------"
+        echo "Running kernel configuration test 3 -- android"
+        echo "Emulates:"
+        echo "CONFIG_FW_LOADER=y"
+        echo "CONFIG_FW_LOADER_USER_HELPER=y"
+        echo "CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y"
+        run_tests 1 0
+}
+
+check_mods
+check_setup
+
+if [ -f $FW_FORCE_SYSFS_FALLBACK ]; then
+        run_test_config_0001
+        run_test_config_0002
+        run_test_config_0003
+else
+        echo "Running basic kernel configuration, working with your config"
+        run_tests
+fi
diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions
index df3dd7fe5f9b..2a4f16fc9819 100644
--- a/tools/testing/selftests/ftrace/test.d/functions
+++ b/tools/testing/selftests/ftrace/test.d/functions
@@ -59,6 +59,13 @@ disable_events() {
     echo 0 > events/enable
 }
 
+clear_synthetic_events() { # reset all current synthetic events
+    grep -v ^# synthetic_events |
+    while read line; do
+        echo "!$line" >> synthetic_events
+    done
+}
+
 initialize_ftrace() { # Reset ftrace to initial-state
 # As the initial state, ftrace will be set to nop tracer,
 # no events, no triggers, no filters, no function filters,
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
new file mode 100644
index 000000000000..2aabab363cfb
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
@@ -0,0 +1,39 @@
+#!/bin/sh
+# description: event trigger - test extended error support
+
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+reset_tracer
+do_reset
+
+echo "Test extended error support"
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_wakeup/trigger
+! echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger 2> /dev/null
+if ! grep -q "ERROR:" events/sched/sched_wakeup/hist; then
+    fail "Failed to generate extended error in histogram"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc
new file mode 100644
index 000000000000..7fd5b4a8f060
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc
@@ -0,0 +1,54 @@
+#!/bin/sh
+# description: event trigger - test field variable support
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test field variable support"
+
+echo 'wakeup_latency u64 lat; pid_t pid; int prio; char comm[16]' > synthetic_events
+echo 'hist:keys=comm:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_waking/trigger
+echo 'hist:keys=next_comm:wakeup_lat=common_timestamp.usecs-$ts0:onmatch(sched.sched_waking).wakeup_latency($wakeup_lat,next_pid,sched.sched_waking.prio,next_comm) if next_comm=="ping"' > events/sched/sched_switch/trigger
+echo 'hist:keys=pid,prio,comm:vals=lat:sort=pid,prio' > events/synthetic/wakeup_latency/trigger
+
+ping localhost -c 3
+if ! grep -q "ping" events/synthetic/wakeup_latency/hist; then
+    fail "Failed to create inter-event histogram"
+fi
+
+if ! grep -q "synthetic_prio=prio" events/sched/sched_waking/hist; then
+    fail "Failed to create histogram with field variable"
+fi
+
+echo '!hist:keys=next_comm:wakeup_lat=common_timestamp.usecs-$ts0:onmatch(sched.sched_waking).wakeup_latency($wakeup_lat,next_pid,sched.sched_waking.prio,next_comm) if next_comm=="ping"' >> events/sched/sched_switch/trigger
+
+if grep -q "synthetic_prio=prio" events/sched/sched_waking/hist; then
+    fail "Failed to remove histogram with field variable"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc
new file mode 100644
index 000000000000..c93dbe38b5df
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc
@@ -0,0 +1,58 @@
+#!/bin/sh
+# description: event trigger - test inter-event combined histogram trigger
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+reset_tracer
+do_reset
+clear_synthetic_events
+
+echo "Test create synthetic event"
+
+echo 'waking_latency  u64 lat pid_t pid' > synthetic_events
+if [ ! -d events/synthetic/waking_latency ]; then
+    fail "Failed to create waking_latency synthetic event"
+fi
+
+echo "Test combined histogram"
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_waking/trigger
+echo 'hist:keys=pid:waking_lat=common_timestamp.usecs-$ts0:onmatch(sched.sched_waking).waking_latency($waking_lat,pid) if comm=="ping"' > events/sched/sched_wakeup/trigger
+echo 'hist:keys=pid,lat:sort=pid,lat' > events/synthetic/waking_latency/trigger
+
+echo 'wakeup_latency u64 lat pid_t pid' >> synthetic_events
+echo 'hist:keys=pid:ts1=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts1:onmatch(sched.sched_wakeup).wakeup_latency($wakeup_lat,next_pid) if next_comm=="ping"' > events/sched/sched_switch/trigger
+
+echo 'waking+wakeup_latency u64 lat; pid_t pid' >> synthetic_events
+echo 'hist:keys=pid,lat:sort=pid,lat:ww_lat=$waking_lat+$wakeup_lat:onmatch(synthetic.wakeup_latency).waking+wakeup_latency($ww_lat,pid)' >> events/synthetic/wakeup_latency/trigger
+echo 'hist:keys=pid,lat:sort=pid,lat' >> events/synthetic/waking+wakeup_latency/trigger
+
+ping localhost -c 3
+if ! grep -q "pid:" events/synthetic/waking+wakeup_latency/hist; then
+    fail "Failed to create combined histogram"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
new file mode 100644
index 000000000000..c193dce611a2
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
@@ -0,0 +1,44 @@
+#!/bin/sh
+# description: event trigger - test multiple actions on hist trigger
+
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test multiple actions on hist trigger"
+echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events
+TRIGGER1=events/sched/sched_wakeup/trigger
+TRIGGER2=events/sched/sched_switch/trigger
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc
new file mode 100644
index 000000000000..e84e7d048566
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc
@@ -0,0 +1,50 @@
+#!/bin/sh
+# description: event trigger - test inter-event histogram trigger onmatch action
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test create synthetic event"
+
+echo 'wakeup_latency  u64 lat pid_t pid char comm[16]' > synthetic_events
+if [ ! -d events/synthetic/wakeup_latency ]; then
+    fail "Failed to create wakeup_latency synthetic event"
+fi
+
+echo "Test create histogram for synthetic event"
+echo "Test histogram variables,simple expression support and onmatch action"
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_wakeup/trigger
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:onmatch(sched.sched_wakeup).wakeup_latency($wakeup_lat,next_pid,next_comm) if next_comm=="ping"' > events/sched/sched_switch/trigger
+echo 'hist:keys=comm,pid,lat:wakeup_lat=lat:sort=lat' > events/synthetic/wakeup_latency/trigger
+ping localhost -c 5
+if ! grep -q "ping" events/synthetic/wakeup_latency/hist; then
+    fail "Failed to create onmatch action inter-event histogram"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc
new file mode 100644
index 000000000000..7907d8aacde3
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc
@@ -0,0 +1,50 @@
+#!/bin/sh
+# description: event trigger - test inter-event histogram trigger onmatch-onmax action
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test create synthetic event"
+
+echo 'wakeup_latency  u64 lat pid_t pid char comm[16]' > synthetic_events
+if [ ! -d events/synthetic/wakeup_latency ]; then
+    fail "Failed to create wakeup_latency synthetic event"
+fi
+
+echo "Test create histogram for synthetic event"
+echo "Test histogram variables,simple expression support and onmatch-onmax action"
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_wakeup/trigger
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:onmatch(sched.sched_wakeup).wakeup_latency($wakeup_lat,next_pid,next_comm):onmax($wakeup_lat).save(next_comm,prev_pid,prev_prio,prev_comm) if next_comm=="ping"' >> events/sched/sched_switch/trigger
+echo 'hist:keys=comm,pid,lat:wakeup_lat=lat:sort=lat' > events/synthetic/wakeup_latency/trigger
+ping localhost -c 5
+if [ ! grep -q "ping" events/synthetic/wakeup_latency/hist -o ! grep -q "max:" events/sched/sched_switch/hist]; then
+    fail "Failed to create onmatch-onmax action inter-event histogram"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc
new file mode 100644
index 000000000000..38b7ed6242b2
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc
@@ -0,0 +1,48 @@
+#!/bin/sh
+# description: event trigger - test inter-event histogram trigger onmax action
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test create synthetic event"
+
+echo 'wakeup_latency  u64 lat pid_t pid char comm[16]' > synthetic_events
+if [ ! -d events/synthetic/wakeup_latency ]; then
+    fail "Failed to create wakeup_latency synthetic event"
+fi
+
+echo "Test onmax action"
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_waking/trigger
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:onmax($wakeup_lat).save(next_comm,prev_pid,prev_prio,prev_comm) if next_comm=="ping"' >> events/sched/sched_switch/trigger
+ping localhost -c 3
+if ! grep -q "max:" events/sched/sched_switch/hist; then
+    fail "Failed to create onmax action inter-event histogram"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
new file mode 100644
index 000000000000..cef11377dcbd
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
@@ -0,0 +1,54 @@
+#!/bin/sh
+# description: event trigger - test synthetic event create remove
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test create synthetic event"
+
+echo 'wakeup_latency  u64 lat pid_t pid char comm[16]' > synthetic_events
+if [ ! -d events/synthetic/wakeup_latency ]; then
+    fail "Failed to create wakeup_latency synthetic event"
+fi
+
+reset_trigger
+
+echo "Test create synthetic event with an error"
+echo 'wakeup_latency  u64 lat pid_t pid char' > synthetic_events > /dev/null
+if [ -d events/synthetic/wakeup_latency ]; then
+    fail "Created wakeup_latency synthetic event with an invalid format"
+fi
+
+reset_trigger
+
+echo "Test remove synthetic event"
+echo '!wakeup_latency  u64 lat pid_t pid char comm[16]' > synthetic_events
+if [ -d events/synthetic/wakeup_latency ]; then
+    fail "Failed to delete wakeup_latency synthetic event"
+fi
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index a63e8453984d..8497a376ef9d 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -18,6 +18,10 @@ all:
         done
 
 override define RUN_TESTS
+        @export KSFT_TAP_LEVEL=`echo 1`;
+        @echo "TAP version 13";
+        @echo "selftests: futex";
+        @echo "========================================";
         @cd $(OUTPUT); ./run.sh
 endef
 
diff --git a/tools/testing/selftests/intel_pstate/Makefile b/tools/testing/selftests/intel_pstate/Makefile
index 5a3f7d37e912..7340fd6a9a9f 100644
--- a/tools/testing/selftests/intel_pstate/Makefile
+++ b/tools/testing/selftests/intel_pstate/Makefile
@@ -2,7 +2,10 @@
 CFLAGS := $(CFLAGS) -Wall -D_GNU_SOURCE
 LDLIBS := $(LDLIBS) -lm
 
-ifeq (,$(filter $(ARCH),x86))
+uname_M := $(shell uname -m 2>/dev/null || echo not)
+ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
+
+ifeq (x86,$(ARCH))
 TEST_GEN_FILES := msr aperf
 endif
 
diff --git a/tools/testing/selftests/kselftest.h b/tools/testing/selftests/kselftest.h
index 1a52b03962a3..1b9d8ecdebce 100644
--- a/tools/testing/selftests/kselftest.h
+++ b/tools/testing/selftests/kselftest.h
@@ -57,7 +57,8 @@ static inline int ksft_get_error_cnt(void) { return ksft_cnt.ksft_error; }
 
 static inline void ksft_print_header(void)
 {
-        printf("TAP version 13\n");
+        if (!(getenv("KSFT_TAP_LEVEL")))
+                printf("TAP version 13\n");
 }
 
 static inline void ksft_print_cnts(void)
diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h
index e81bd28bdd89..6ae3730c4ee3 100644
--- a/tools/testing/selftests/kselftest_harness.h
+++ b/tools/testing/selftests/kselftest_harness.h
@@ -107,6 +107,27 @@
                         __FILE__, __LINE__, _metadata->name, ##__VA_ARGS__)
 
 /**
+ * XFAIL(statement, fmt, ...)
+ *
+ * @statement: statement to run after reporting XFAIL
+ * @fmt: format string
+ * @...: optional arguments
+ *
+ * This forces a "pass" after reporting a failure with an XFAIL prefix,
+ * and runs "statement", which is usually "return" or "goto skip".
+ */
+#define XFAIL(statement, fmt, ...) do { \
+        if (TH_LOG_ENABLED) { \
+                fprintf(TH_LOG_STREAM, "[  XFAIL!  ] " fmt "\n", \
+                        ##__VA_ARGS__); \
+        } \
+        /* TODO: find a way to pass xfail to test runner process. */ \
+        _metadata->passed = 1; \
+        _metadata->trigger = 0; \
+        statement; \
+} while (0)
+
+/**
  * TEST(test_name) - Defines the test function and creates the registration
  * stub
  *
@@ -198,7 +219,7 @@
 
 /**
  * FIXTURE_SETUP(fixture_name) - Prepares the setup function for the fixture.
- * *_metadata* is included so that ASSERT_* work as a convenience
+ * *_metadata* is included so that EXPECT_* and ASSERT_* work correctly.
  *
  * @fixture_name: fixture name
  *
@@ -221,6 +242,7 @@
                 FIXTURE_DATA(fixture_name) __attribute__((unused)) *self)
 /**
  * FIXTURE_TEARDOWN(fixture_name)
+ * *_metadata* is included so that EXPECT_* and ASSERT_* work correctly.
  *
  * @fixture_name: fixture name
  *
@@ -253,6 +275,8 @@
  * Defines a test that depends on a fixture (e.g., is part of a test case).
  * Very similar to TEST() except that *self* is the setup instance of fixture's
  * datatype exposed for use by the implementation.
+ *
+ * Warning: use of ASSERT_* here will skip TEARDOWN.
  */
 /* TODO(wad) register fixtures on dedicated test lists. */
 #define TEST_F(fixture_name, test_name) \
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
new file mode 100644
index 000000000000..d9d00319b07c
--- /dev/null
+++ b/tools/testing/selftests/kvm/Makefile
@@ -0,0 +1,40 @@
+all:
+
+top_srcdir = ../../../../
+UNAME_M := $(shell uname -m)
+
+LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/sparsebit.c
+LIBKVM_x86_64 = lib/x86.c lib/vmx.c
+
+TEST_GEN_PROGS_x86_64 = set_sregs_test
+TEST_GEN_PROGS_x86_64 += sync_regs_test
+TEST_GEN_PROGS_x86_64 += vmx_tsc_adjust_test
+
+TEST_GEN_PROGS += $(TEST_GEN_PROGS_$(UNAME_M))
+LIBKVM += $(LIBKVM_$(UNAME_M))
+
+INSTALL_HDR_PATH = $(top_srcdir)/usr
+LINUX_HDR_PATH = $(INSTALL_HDR_PATH)/include/
+CFLAGS += -O2 -g -std=gnu99 -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -I..
+
+# After inclusion, $(OUTPUT) is defined and
+# $(TEST_GEN_PROGS) starts with $(OUTPUT)/
+include ../lib.mk
+
+STATIC_LIBS := $(OUTPUT)/libkvm.a
+LIBKVM_OBJ := $(patsubst %.c, $(OUTPUT)/%.o, $(LIBKVM))
+EXTRA_CLEAN += $(LIBKVM_OBJ) $(STATIC_LIBS)
+
+x := $(shell mkdir -p $(sort $(dir $(LIBKVM_OBJ))))
+$(LIBKVM_OBJ): $(OUTPUT)/%.o: %.c
+        $(CC) $(CFLAGS) $(CPPFLAGS) $(TARGET_ARCH) -c $< -o $@
+
+$(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
+        $(AR) crs $@ $^
+
+$(LINUX_HDR_PATH):
+        make -C $(top_srcdir) headers_install
+
+all: $(STATIC_LIBS) $(LINUX_HDR_PATH)
+$(TEST_GEN_PROGS): $(STATIC_LIBS)
+$(TEST_GEN_PROGS) $(LIBKVM_OBJ): | $(LINUX_HDR_PATH)
diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
new file mode 100644
index 000000000000..637b7017b6ee
--- /dev/null
+++ b/tools/testing/selftests/kvm/include/kvm_util.h
@@ -0,0 +1,145 @@
+/*
+ * tools/testing/selftests/kvm/include/kvm_util.h
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ */
+#ifndef SELFTEST_KVM_UTIL_H
+#define SELFTEST_KVM_UTIL_H 1
+
+#include "test_util.h"
+
+#include "asm/kvm.h"
+#include "linux/kvm.h"
+#include <sys/ioctl.h>
+
+#include "sparsebit.h"
+
+/*
+ * Memslots can't cover the gfn starting at this gpa otherwise vCPUs can't be
+ * created. Only applies to VMs using EPT.
+ */
+#define KVM_DEFAULT_IDENTITY_MAP_ADDRESS 0xfffbc000ul
+
+
+/* Callers of kvm_util only have an incomplete/opaque description of the
+ * structure kvm_util is using to maintain the state of a VM.
+ */
+struct kvm_vm;
+
+typedef uint64_t vm_paddr_t; /* Virtual Machine (Guest) physical address */
+typedef uint64_t vm_vaddr_t; /* Virtual Machine (Guest) virtual address */
+
+/* Minimum allocated guest virtual and physical addresses */
+#define KVM_UTIL_MIN_VADDR 0x2000
+
+#define DEFAULT_GUEST_PHY_PAGES         512
+#define DEFAULT_GUEST_STACK_VADDR_MIN   0xab6000
+#define DEFAULT_STACK_PGS               5
+
+enum vm_guest_mode {
+        VM_MODE_FLAT48PG,
+};
+
+enum vm_mem_backing_src_type {
+        VM_MEM_SRC_ANONYMOUS,
+        VM_MEM_SRC_ANONYMOUS_THP,
+        VM_MEM_SRC_ANONYMOUS_HUGETLB,
+};
+
+int kvm_check_cap(long cap);
+
+struct kvm_vm *vm_create(enum vm_guest_mode mode, uint64_t phy_pages, int perm);
+void kvm_vm_free(struct kvm_vm *vmp);
+
+int kvm_memcmp_hva_gva(void *hva,
+        struct kvm_vm *vm, const vm_vaddr_t gva, size_t len);
+
+void kvm_vm_elf_load(struct kvm_vm *vm, const char *filename,
+        uint32_t data_memslot, uint32_t pgd_memslot);
+
+void vm_dump(FILE *stream, struct kvm_vm *vm, uint8_t indent);
+void vcpu_dump(FILE *stream, struct kvm_vm *vm,
+        uint32_t vcpuid, uint8_t indent);
+
+void vm_create_irqchip(struct kvm_vm *vm);
+
+void vm_userspace_mem_region_add(struct kvm_vm *vm,
+        enum vm_mem_backing_src_type src_type,
+        uint64_t guest_paddr, uint32_t slot, uint64_t npages,
+        uint32_t flags);
+
+void vcpu_ioctl(struct kvm_vm *vm,
+        uint32_t vcpuid, unsigned long ioctl, void *arg);
+void vm_ioctl(struct kvm_vm *vm, unsigned long ioctl, void *arg);
+void vm_mem_region_set_flags(struct kvm_vm *vm, uint32_t slot, uint32_t flags);
+void vm_vcpu_add(struct kvm_vm *vm, uint32_t vcpuid);
+vm_vaddr_t vm_vaddr_alloc(struct kvm_vm *vm, size_t sz, vm_vaddr_t vaddr_min,
+        uint32_t data_memslot, uint32_t pgd_memslot);
+void *addr_gpa2hva(struct kvm_vm *vm, vm_paddr_t gpa);
+void *addr_gva2hva(struct kvm_vm *vm, vm_vaddr_t gva);
+vm_paddr_t addr_hva2gpa(struct kvm_vm *vm, void *hva);
+vm_paddr_t addr_gva2gpa(struct kvm_vm *vm, vm_vaddr_t gva);
+
+struct kvm_run *vcpu_state(struct kvm_vm *vm, uint32_t vcpuid);
+void vcpu_run(struct kvm_vm *vm, uint32_t vcpuid);
+int _vcpu_run(struct kvm_vm *vm, uint32_t vcpuid);
+void vcpu_set_mp_state(struct kvm_vm *vm, uint32_t vcpuid,
+        struct kvm_mp_state *mp_state);
+void vcpu_regs_get(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_regs *regs);
+void vcpu_regs_set(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_regs *regs);
+void vcpu_args_set(struct kvm_vm *vm, uint32_t vcpuid, unsigned int num, ...);
+void vcpu_sregs_get(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_sregs *sregs);
+void vcpu_sregs_set(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_sregs *sregs);
+int _vcpu_sregs_set(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_sregs *sregs);
+void vcpu_events_get(struct kvm_vm *vm, uint32_t vcpuid,
+                          struct kvm_vcpu_events *events);
+void vcpu_events_set(struct kvm_vm *vm, uint32_t vcpuid,
+                          struct kvm_vcpu_events *events);
+
+const char *exit_reason_str(unsigned int exit_reason);
+
+void virt_pgd_alloc(struct kvm_vm *vm, uint32_t pgd_memslot);
+void virt_pg_map(struct kvm_vm *vm, uint64_t vaddr, uint64_t paddr,
+        uint32_t pgd_memslot);
+vm_paddr_t vm_phy_page_alloc(struct kvm_vm *vm,
+        vm_paddr_t paddr_min, uint32_t memslot);
+
+struct kvm_cpuid2 *kvm_get_supported_cpuid(void);
+void vcpu_set_cpuid(
+        struct kvm_vm *vm, uint32_t vcpuid, struct kvm_cpuid2 *cpuid);
+
+struct kvm_cpuid_entry2 *
+kvm_get_supported_cpuid_index(uint32_t function, uint32_t index);
+
+static inline struct kvm_cpuid_entry2 *
+kvm_get_supported_cpuid_entry(uint32_t function)
+{
+        return kvm_get_supported_cpuid_index(function, 0);
+}
+
+struct kvm_vm *vm_create_default(uint32_t vcpuid, void *guest_code);
+void vm_vcpu_add_default(struct kvm_vm *vm, uint32_t vcpuid, void *guest_code);
+
+typedef void (*vmx_guest_code_t)(vm_vaddr_t vmxon_vaddr,
+                                 vm_paddr_t vmxon_paddr,
+                                 vm_vaddr_t vmcs_vaddr,
+                                 vm_paddr_t vmcs_paddr);
+
+struct kvm_userspace_memory_region *
+kvm_userspace_memory_region_find(struct kvm_vm *vm, uint64_t start,
+                                 uint64_t end);
+
+struct kvm_dirty_log *
+allocate_kvm_dirty_log(struct kvm_userspace_memory_region *region);
+
+int vm_create_device(struct kvm_vm *vm, struct kvm_create_device *cd);
+
+#endif /* SELFTEST_KVM_UTIL_H */
diff --git a/tools/testing/selftests/kvm/include/sparsebit.h b/tools/testing/selftests/kvm/include/sparsebit.h
new file mode 100644
index 000000000000..54cfeb6568d3
--- /dev/null
+++ b/tools/testing/selftests/kvm/include/sparsebit.h
@@ -0,0 +1,75 @@
+/*
+ * tools/testing/selftests/kvm/include/sparsebit.h
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ *
+ * Header file that describes API to the sparsebit library.
+ * This library provides a memory efficient means of storing
+ * the settings of bits indexed via a uint64_t.  Memory usage
+ * is reasonable, significantly less than (2^64 / 8) bytes, as
+ * long as bits that are mostly set or mostly cleared are close
+ * to each other.  This library is efficient in memory usage
+ * even in the case where most bits are set.
+ */
+
+#ifndef _TEST_SPARSEBIT_H_
+#define _TEST_SPARSEBIT_H_
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct sparsebit;
+typedef uint64_t sparsebit_idx_t;
+typedef uint64_t sparsebit_num_t;
+
+struct sparsebit *sparsebit_alloc(void);
+void sparsebit_free(struct sparsebit **sbitp);
+void sparsebit_copy(struct sparsebit *dstp, struct sparsebit *src);
+
+bool sparsebit_is_set(struct sparsebit *sbit, sparsebit_idx_t idx);
+bool sparsebit_is_set_num(struct sparsebit *sbit,
+                          sparsebit_idx_t idx, sparsebit_num_t num);
+bool sparsebit_is_clear(struct sparsebit *sbit, sparsebit_idx_t idx);
+bool sparsebit_is_clear_num(struct sparsebit *sbit,
+                            sparsebit_idx_t idx, sparsebit_num_t num);
+sparsebit_num_t sparsebit_num_set(struct sparsebit *sbit);
+bool sparsebit_any_set(struct sparsebit *sbit);
+bool sparsebit_any_clear(struct sparsebit *sbit);
+bool sparsebit_all_set(struct sparsebit *sbit);
+bool sparsebit_all_clear(struct sparsebit *sbit);
+sparsebit_idx_t sparsebit_first_set(struct sparsebit *sbit);
+sparsebit_idx_t sparsebit_first_clear(struct sparsebit *sbit);
+sparsebit_idx_t sparsebit_next_set(struct sparsebit *sbit, sparsebit_idx_t prev);
+sparsebit_idx_t sparsebit_next_clear(struct sparsebit *sbit, sparsebit_idx_t prev);
+sparsebit_idx_t sparsebit_next_set_num(struct sparsebit *sbit,
+                                       sparsebit_idx_t start, sparsebit_num_t num);
+sparsebit_idx_t sparsebit_next_clear_num(struct sparsebit *sbit,
+                                         sparsebit_idx_t start, sparsebit_num_t num);
+
+void sparsebit_set(struct sparsebit *sbitp, sparsebit_idx_t idx);
+void sparsebit_set_num(struct sparsebit *sbitp, sparsebit_idx_t start,
+                       sparsebit_num_t num);
+void sparsebit_set_all(struct sparsebit *sbitp);
+
+void sparsebit_clear(struct sparsebit *sbitp, sparsebit_idx_t idx);
+void sparsebit_clear_num(struct sparsebit *sbitp,
+                         sparsebit_idx_t start, sparsebit_num_t num);
+void sparsebit_clear_all(struct sparsebit *sbitp);
+
+void sparsebit_dump(FILE *stream, struct sparsebit *sbit,
+                    unsigned int indent);
+void sparsebit_validate_internal(struct sparsebit *sbit);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _TEST_SPARSEBIT_H_ */
diff --git a/tools/testing/selftests/kvm/include/test_util.h b/tools/testing/selftests/kvm/include/test_util.h
new file mode 100644
index 000000000000..ac53730b30aa
--- /dev/null
+++ b/tools/testing/selftests/kvm/include/test_util.h
@@ -0,0 +1,46 @@
+/*
+ * tools/testing/selftests/kvm/include/test_util.h
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ */
+
+#ifndef TEST_UTIL_H
+#define TEST_UTIL_H 1
+
+#include <stdlib.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include "kselftest.h"
+
+ssize_t test_write(int fd, const void *buf, size_t count);
+ssize_t test_read(int fd, void *buf, size_t count);
+int test_seq_read(const char *path, char **bufp, size_t *sizep);
+
+void test_assert(bool exp, const char *exp_str,
+                 const char *file, unsigned int line, const char *fmt, ...);
+
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
+
+#define TEST_ASSERT(e, fmt, ...) \
+        test_assert((e), #e, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+
+#define ASSERT_EQ(a, b) do { \
+        typeof(a) __a = (a); \
+        typeof(b) __b = (b); \
+        TEST_ASSERT(__a == __b, \
+                    "ASSERT_EQ(%s, %s) failed.\n" \
+                    "\t%s is %#lx\n" \
+                    "\t%s is %#lx", \
+                    #a, #b, #a, (unsigned long) __a, #b, (unsigned long) __b); \
+} while (0)
+
+#endif /* TEST_UTIL_H */
diff --git a/tools/testing/selftests/kvm/include/vmx.h b/tools/testing/selftests/kvm/include/vmx.h
new file mode 100644
index 000000000000..6ed8499807fd
--- /dev/null
+++ b/tools/testing/selftests/kvm/include/vmx.h
@@ -0,0 +1,494 @@
+/*
+ * tools/testing/selftests/kvm/include/vmx.h
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ */
+
+#ifndef SELFTEST_KVM_VMX_H
+#define SELFTEST_KVM_VMX_H
+
+#include <stdint.h>
+#include "x86.h"
+
+#define CPUID_VMX_BIT                           5
+
+#define CPUID_VMX                               (1 << 5)
+
+/*
+ * Definitions of Primary Processor-Based VM-Execution Controls.
+ */
+#define CPU_BASED_VIRTUAL_INTR_PENDING          0x00000004
+#define CPU_BASED_USE_TSC_OFFSETING             0x00000008
+#define CPU_BASED_HLT_EXITING                   0x00000080
+#define CPU_BASED_INVLPG_EXITING                0x00000200
+#define CPU_BASED_MWAIT_EXITING                 0x00000400
+#define CPU_BASED_RDPMC_EXITING                 0x00000800
+#define CPU_BASED_RDTSC_EXITING                 0x00001000
+#define CPU_BASED_CR3_LOAD_EXITING              0x00008000
+#define CPU_BASED_CR3_STORE_EXITING             0x00010000
+#define CPU_BASED_CR8_LOAD_EXITING              0x00080000
+#define CPU_BASED_CR8_STORE_EXITING             0x00100000
+#define CPU_BASED_TPR_SHADOW                    0x00200000
+#define CPU_BASED_VIRTUAL_NMI_PENDING           0x00400000
+#define CPU_BASED_MOV_DR_EXITING                0x00800000
+#define CPU_BASED_UNCOND_IO_EXITING             0x01000000
+#define CPU_BASED_USE_IO_BITMAPS                0x02000000
+#define CPU_BASED_MONITOR_TRAP                  0x08000000
+#define CPU_BASED_USE_MSR_BITMAPS               0x10000000
+#define CPU_BASED_MONITOR_EXITING               0x20000000
+#define CPU_BASED_PAUSE_EXITING                 0x40000000
+#define CPU_BASED_ACTIVATE_SECONDARY_CONTROLS   0x80000000
+
+#define CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR     0x0401e172
+
+/*
+ * Definitions of Secondary Processor-Based VM-Execution Controls.
+ */
+#define SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES 0x00000001
+#define SECONDARY_EXEC_ENABLE_EPT               0x00000002
+#define SECONDARY_EXEC_DESC                     0x00000004
+#define SECONDARY_EXEC_RDTSCP                   0x00000008
+#define SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE   0x00000010
+#define SECONDARY_EXEC_ENABLE_VPID              0x00000020
+#define SECONDARY_EXEC_WBINVD_EXITING           0x00000040
+#define SECONDARY_EXEC_UNRESTRICTED_GUEST       0x00000080
+#define SECONDARY_EXEC_APIC_REGISTER_VIRT       0x00000100
+#define SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY    0x00000200
+#define SECONDARY_EXEC_PAUSE_LOOP_EXITING       0x00000400
+#define SECONDARY_EXEC_RDRAND_EXITING           0x00000800
+#define SECONDARY_EXEC_ENABLE_INVPCID           0x00001000
+#define SECONDARY_EXEC_ENABLE_VMFUNC            0x00002000
+#define SECONDARY_EXEC_SHADOW_VMCS              0x00004000
+#define SECONDARY_EXEC_RDSEED_EXITING           0x00010000
+#define SECONDARY_EXEC_ENABLE_PML               0x00020000
+#define SECONDARY_EPT_VE                        0x00040000
+#define SECONDARY_ENABLE_XSAV_RESTORE           0x00100000
+#define SECONDARY_EXEC_TSC_SCALING              0x02000000
+
+#define PIN_BASED_EXT_INTR_MASK                 0x00000001
+#define PIN_BASED_NMI_EXITING                   0x00000008
+#define PIN_BASED_VIRTUAL_NMIS                  0x00000020
+#define PIN_BASED_VMX_PREEMPTION_TIMER          0x00000040
+#define PIN_BASED_POSTED_INTR                   0x00000080
+
+#define PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR     0x00000016
+
+#define VM_EXIT_SAVE_DEBUG_CONTROLS             0x00000004
+#define VM_EXIT_HOST_ADDR_SPACE_SIZE            0x00000200
+#define VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL      0x00001000
+#define VM_EXIT_ACK_INTR_ON_EXIT                0x00008000
+#define VM_EXIT_SAVE_IA32_PAT                   0x00040000
+#define VM_EXIT_LOAD_IA32_PAT                   0x00080000
+#define VM_EXIT_SAVE_IA32_EFER                  0x00100000
+#define VM_EXIT_LOAD_IA32_EFER                  0x00200000
+#define VM_EXIT_SAVE_VMX_PREEMPTION_TIMER       0x00400000
+
+#define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR       0x00036dff
+
+#define VM_ENTRY_LOAD_DEBUG_CONTROLS            0x00000004
+#define VM_ENTRY_IA32E_MODE                     0x00000200
+#define VM_ENTRY_SMM                            0x00000400
+#define VM_ENTRY_DEACT_DUAL_MONITOR             0x00000800
+#define VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL     0x00002000
+#define VM_ENTRY_LOAD_IA32_PAT                  0x00004000
+#define VM_ENTRY_LOAD_IA32_EFER                 0x00008000
+
+#define VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR      0x000011ff
+
+#define VMX_MISC_PREEMPTION_TIMER_RATE_MASK     0x0000001f
+#define VMX_MISC_SAVE_EFER_LMA                  0x00000020
+
+#define EXIT_REASON_FAILED_VMENTRY      0x80000000
+#define EXIT_REASON_EXCEPTION_NMI       0
+#define EXIT_REASON_EXTERNAL_INTERRUPT  1
+#define EXIT_REASON_TRIPLE_FAULT        2
+#define EXIT_REASON_PENDING_INTERRUPT   7
+#define EXIT_REASON_NMI_WINDOW          8
+#define EXIT_REASON_TASK_SWITCH         9
+#define EXIT_REASON_CPUID               10
+#define EXIT_REASON_HLT                 12
+#define EXIT_REASON_INVD                13
+#define EXIT_REASON_INVLPG              14
+#define EXIT_REASON_RDPMC               15
+#define EXIT_REASON_RDTSC               16
+#define EXIT_REASON_VMCALL              18
+#define EXIT_REASON_VMCLEAR             19
+#define EXIT_REASON_VMLAUNCH            20
+#define EXIT_REASON_VMPTRLD             21
+#define EXIT_REASON_VMPTRST             22
+#define EXIT_REASON_VMREAD              23
+#define EXIT_REASON_VMRESUME            24
+#define EXIT_REASON_VMWRITE             25
+#define EXIT_REASON_VMOFF               26
+#define EXIT_REASON_VMON                27
+#define EXIT_REASON_CR_ACCESS           28
+#define EXIT_REASON_DR_ACCESS           29
+#define EXIT_REASON_IO_INSTRUCTION      30
+#define EXIT_REASON_MSR_READ            31
+#define EXIT_REASON_MSR_WRITE           32
+#define EXIT_REASON_INVALID_STATE       33
+#define EXIT_REASON_MWAIT_INSTRUCTION   36
+#define EXIT_REASON_MONITOR_INSTRUCTION 39
+#define EXIT_REASON_PAUSE_INSTRUCTION   40
+#define EXIT_REASON_MCE_DURING_VMENTRY  41
+#define EXIT_REASON_TPR_BELOW_THRESHOLD 43
+#define EXIT_REASON_APIC_ACCESS         44
+#define EXIT_REASON_EOI_INDUCED         45
+#define EXIT_REASON_EPT_VIOLATION       48
+#define EXIT_REASON_EPT_MISCONFIG       49
+#define EXIT_REASON_INVEPT              50
+#define EXIT_REASON_RDTSCP              51
+#define EXIT_REASON_PREEMPTION_TIMER    52
+#define EXIT_REASON_INVVPID             53
+#define EXIT_REASON_WBINVD              54
+#define EXIT_REASON_XSETBV              55
+#define EXIT_REASON_APIC_WRITE          56
+#define EXIT_REASON_INVPCID             58
+#define EXIT_REASON_PML_FULL            62
+#define EXIT_REASON_XSAVES              63
+#define EXIT_REASON_XRSTORS             64
+#define LAST_EXIT_REASON                64
+
+enum vmcs_field {
+        VIRTUAL_PROCESSOR_ID            = 0x00000000,
+        POSTED_INTR_NV                  = 0x00000002,
+        GUEST_ES_SELECTOR               = 0x00000800,
+        GUEST_CS_SELECTOR               = 0x00000802,
+        GUEST_SS_SELECTOR               = 0x00000804,
+        GUEST_DS_SELECTOR               = 0x00000806,
+        GUEST_FS_SELECTOR               = 0x00000808,
+        GUEST_GS_SELECTOR               = 0x0000080a,
+        GUEST_LDTR_SELECTOR             = 0x0000080c,
+        GUEST_TR_SELECTOR               = 0x0000080e,
+        GUEST_INTR_STATUS               = 0x00000810,
+        GUEST_PML_INDEX                 = 0x00000812,
+        HOST_ES_SELECTOR                = 0x00000c00,
+        HOST_CS_SELECTOR                = 0x00000c02,
+        HOST_SS_SELECTOR                = 0x00000c04,
+        HOST_DS_SELECTOR                = 0x00000c06,
+        HOST_FS_SELECTOR                = 0x00000c08,
+        HOST_GS_SELECTOR                = 0x00000c0a,
+        HOST_TR_SELECTOR                = 0x00000c0c,
+        IO_BITMAP_A                     = 0x00002000,
+        IO_BITMAP_A_HIGH                = 0x00002001,
+        IO_BITMAP_B                     = 0x00002002,
+        IO_BITMAP_B_HIGH                = 0x00002003,
+        MSR_BITMAP                      = 0x00002004,
+        MSR_BITMAP_HIGH                 = 0x00002005,
+        VM_EXIT_MSR_STORE_ADDR          = 0x00002006,
+        VM_EXIT_MSR_STORE_ADDR_HIGH     = 0x00002007,
+        VM_EXIT_MSR_LOAD_ADDR           = 0x00002008,
+        VM_EXIT_MSR_LOAD_ADDR_HIGH      = 0x00002009,
+        VM_ENTRY_MSR_LOAD_ADDR          = 0x0000200a,
+        VM_ENTRY_MSR_LOAD_ADDR_HIGH     = 0x0000200b,
+        PML_ADDRESS                     = 0x0000200e,
+        PML_ADDRESS_HIGH                = 0x0000200f,
+        TSC_OFFSET                      = 0x00002010,
+        TSC_OFFSET_HIGH                 = 0x00002011,
+        VIRTUAL_APIC_PAGE_ADDR          = 0x00002012,
+        VIRTUAL_APIC_PAGE_ADDR_HIGH     = 0x00002013,
+        APIC_ACCESS_ADDR                = 0x00002014,
+        APIC_ACCESS_ADDR_HIGH           = 0x00002015,
+        POSTED_INTR_DESC_ADDR           = 0x00002016,
+        POSTED_INTR_DESC_ADDR_HIGH      = 0x00002017,
+        EPT_POINTER                     = 0x0000201a,
+        EPT_POINTER_HIGH                = 0x0000201b,
+        EOI_EXIT_BITMAP0                = 0x0000201c,
+        EOI_EXIT_BITMAP0_HIGH           = 0x0000201d,
+        EOI_EXIT_BITMAP1                = 0x0000201e,
+        EOI_EXIT_BITMAP1_HIGH           = 0x0000201f,
+        EOI_EXIT_BITMAP2                = 0x00002020,
+        EOI_EXIT_BITMAP2_HIGH           = 0x00002021,
+        EOI_EXIT_BITMAP3                = 0x00002022,
+        EOI_EXIT_BITMAP3_HIGH           = 0x00002023,
+        VMREAD_BITMAP                   = 0x00002026,
+        VMREAD_BITMAP_HIGH              = 0x00002027,
+        VMWRITE_BITMAP                  = 0x00002028,
+        VMWRITE_BITMAP_HIGH             = 0x00002029,
+        XSS_EXIT_BITMAP                 = 0x0000202C,
+        XSS_EXIT_BITMAP_HIGH            = 0x0000202D,
+        TSC_MULTIPLIER                  = 0x00002032,
+        TSC_MULTIPLIER_HIGH             = 0x00002033,
+        GUEST_PHYSICAL_ADDRESS          = 0x00002400,
+        GUEST_PHYSICAL_ADDRESS_HIGH     = 0x00002401,
+        VMCS_LINK_POINTER               = 0x00002800,
+        VMCS_LINK_POINTER_HIGH          = 0x00002801,
+        GUEST_IA32_DEBUGCTL             = 0x00002802,
+        GUEST_IA32_DEBUGCTL_HIGH        = 0x00002803,
+        GUEST_IA32_PAT                  = 0x00002804,
+        GUEST_IA32_PAT_HIGH             = 0x00002805,
+        GUEST_IA32_EFER                 = 0x00002806,
+        GUEST_IA32_EFER_HIGH            = 0x00002807,
+        GUEST_IA32_PERF_GLOBAL_CTRL     = 0x00002808,
+        GUEST_IA32_PERF_GLOBAL_CTRL_HIGH= 0x00002809,
+        GUEST_PDPTR0                    = 0x0000280a,
+        GUEST_PDPTR0_HIGH               = 0x0000280b,
+        GUEST_PDPTR1                    = 0x0000280c,
+        GUEST_PDPTR1_HIGH               = 0x0000280d,
+        GUEST_PDPTR2                    = 0x0000280e,
+        GUEST_PDPTR2_HIGH               = 0x0000280f,
+        GUEST_PDPTR3                    = 0x00002810,
+        GUEST_PDPTR3_HIGH               = 0x00002811,
+        GUEST_BNDCFGS                   = 0x00002812,
+        GUEST_BNDCFGS_HIGH              = 0x00002813,
+        HOST_IA32_PAT                   = 0x00002c00,
+        HOST_IA32_PAT_HIGH              = 0x00002c01,
+        HOST_IA32_EFER                  = 0x00002c02,
+        HOST_IA32_EFER_HIGH             = 0x00002c03,
+        HOST_IA32_PERF_GLOBAL_CTRL      = 0x00002c04,
+        HOST_IA32_PERF_GLOBAL_CTRL_HIGH = 0x00002c05,
+        PIN_BASED_VM_EXEC_CONTROL       = 0x00004000,
+        CPU_BASED_VM_EXEC_CONTROL       = 0x00004002,
+        EXCEPTION_BITMAP                = 0x00004004,
+        PAGE_FAULT_ERROR_CODE_MASK      = 0x00004006,
+        PAGE_FAULT_ERROR_CODE_MATCH     = 0x00004008,
+        CR3_TARGET_COUNT                = 0x0000400a,
+        VM_EXIT_CONTROLS                = 0x0000400c,
+        VM_EXIT_MSR_STORE_COUNT         = 0x0000400e,
+        VM_EXIT_MSR_LOAD_COUNT          = 0x00004010,
+        VM_ENTRY_CONTROLS               = 0x00004012,
+        VM_ENTRY_MSR_LOAD_COUNT         = 0x00004014,
+        VM_ENTRY_INTR_INFO_FIELD        = 0x00004016,
+        VM_ENTRY_EXCEPTION_ERROR_CODE   = 0x00004018,
+        VM_ENTRY_INSTRUCTION_LEN        = 0x0000401a,
+        TPR_THRESHOLD                   = 0x0000401c,
+        SECONDARY_VM_EXEC_CONTROL       = 0x0000401e,
+        PLE_GAP                         = 0x00004020,
+        PLE_WINDOW                      = 0x00004022,
+        VM_INSTRUCTION_ERROR            = 0x00004400,
+        VM_EXIT_REASON                  = 0x00004402,
+        VM_EXIT_INTR_INFO               = 0x00004404,
+        VM_EXIT_INTR_ERROR_CODE         = 0x00004406,
+        IDT_VECTORING_INFO_FIELD        = 0x00004408,
+        IDT_VECTORING_ERROR_CODE        = 0x0000440a,
+        VM_EXIT_INSTRUCTION_LEN         = 0x0000440c,
+        VMX_INSTRUCTION_INFO            = 0x0000440e,
+        GUEST_ES_LIMIT                  = 0x00004800,
+        GUEST_CS_LIMIT                  = 0x00004802,
+        GUEST_SS_LIMIT                  = 0x00004804,
+        GUEST_DS_LIMIT                  = 0x00004806,
+        GUEST_FS_LIMIT                  = 0x00004808,
+        GUEST_GS_LIMIT                  = 0x0000480a,
+        GUEST_LDTR_LIMIT                = 0x0000480c,
+        GUEST_TR_LIMIT                  = 0x0000480e,
+        GUEST_GDTR_LIMIT                = 0x00004810,
+        GUEST_IDTR_LIMIT                = 0x00004812,
+        GUEST_ES_AR_BYTES               = 0x00004814,
+        GUEST_CS_AR_BYTES               = 0x00004816,
+        GUEST_SS_AR_BYTES               = 0x00004818,
+        GUEST_DS_AR_BYTES               = 0x0000481a,
+        GUEST_FS_AR_BYTES               = 0x0000481c,
+        GUEST_GS_AR_BYTES               = 0x0000481e,
+        GUEST_LDTR_AR_BYTES             = 0x00004820,
+        GUEST_TR_AR_BYTES               = 0x00004822,
+        GUEST_INTERRUPTIBILITY_INFO     = 0x00004824,
+        GUEST_ACTIVITY_STATE            = 0X00004826,
+        GUEST_SYSENTER_CS               = 0x0000482A,
+        VMX_PREEMPTION_TIMER_VALUE      = 0x0000482E,
+        HOST_IA32_SYSENTER_CS           = 0x00004c00,
+        CR0_GUEST_HOST_MASK             = 0x00006000,
+        CR4_GUEST_HOST_MASK             = 0x00006002,
+        CR0_READ_SHADOW                 = 0x00006004,
+        CR4_READ_SHADOW                 = 0x00006006,
+        CR3_TARGET_VALUE0               = 0x00006008,
+        CR3_TARGET_VALUE1               = 0x0000600a,
+        CR3_TARGET_VALUE2               = 0x0000600c,
+        CR3_TARGET_VALUE3               = 0x0000600e,
+        EXIT_QUALIFICATION              = 0x00006400,
+        GUEST_LINEAR_ADDRESS            = 0x0000640a,
+        GUEST_CR0                       = 0x00006800,
+        GUEST_CR3                       = 0x00006802,
+        GUEST_CR4                       = 0x00006804,
+        GUEST_ES_BASE                   = 0x00006806,
+        GUEST_CS_BASE                   = 0x00006808,
+        GUEST_SS_BASE                   = 0x0000680a,
+        GUEST_DS_BASE                   = 0x0000680c,
+        GUEST_FS_BASE                   = 0x0000680e,
+        GUEST_GS_BASE                   = 0x00006810,
+        GUEST_LDTR_BASE                 = 0x00006812,
+        GUEST_TR_BASE                   = 0x00006814,
+        GUEST_GDTR_BASE                 = 0x00006816,
+        GUEST_IDTR_BASE                 = 0x00006818,
+        GUEST_DR7                       = 0x0000681a,
+        GUEST_RSP                       = 0x0000681c,
+        GUEST_RIP                       = 0x0000681e,
+        GUEST_RFLAGS                    = 0x00006820,
+        GUEST_PENDING_DBG_EXCEPTIONS    = 0x00006822,
+        GUEST_SYSENTER_ESP              = 0x00006824,
+        GUEST_SYSENTER_EIP              = 0x00006826,
+        HOST_CR0                        = 0x00006c00,
+        HOST_CR3                        = 0x00006c02,
+        HOST_CR4                        = 0x00006c04,
+        HOST_FS_BASE                    = 0x00006c06,
+        HOST_GS_BASE                    = 0x00006c08,
+        HOST_TR_BASE                    = 0x00006c0a,
+        HOST_GDTR_BASE                  = 0x00006c0c,
+        HOST_IDTR_BASE                  = 0x00006c0e,
+        HOST_IA32_SYSENTER_ESP          = 0x00006c10,
+        HOST_IA32_SYSENTER_EIP          = 0x00006c12,
+        HOST_RSP                        = 0x00006c14,
+        HOST_RIP                        = 0x00006c16,
+};
+
+struct vmx_msr_entry {
+        uint32_t index;
+        uint32_t reserved;
+        uint64_t value;
+} __attribute__ ((aligned(16)));
+
+static inline int vmxon(uint64_t phys)
+{
+        uint8_t ret;
+
+        __asm__ __volatile__ ("vmxon %[pa]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [pa]"m"(phys)
+                : "cc", "memory");
+
+        return ret;
+}
+
+static inline void vmxoff(void)
+{
+        __asm__ __volatile__("vmxoff");
+}
+
+static inline int vmclear(uint64_t vmcs_pa)
+{
+        uint8_t ret;
+
+        __asm__ __volatile__ ("vmclear %[pa]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [pa]"m"(vmcs_pa)
+                : "cc", "memory");
+
+        return ret;
+}
+
+static inline int vmptrld(uint64_t vmcs_pa)
+{
+        uint8_t ret;
+
+        __asm__ __volatile__ ("vmptrld %[pa]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [pa]"m"(vmcs_pa)
+                : "cc", "memory");
+
+        return ret;
+}
+
+/*
+ * No guest state (e.g. GPRs) is established by this vmlaunch.
+ */
+static inline int vmlaunch(void)
+{
+        int ret;
+
+        __asm__ __volatile__("push %%rbp;"
+                             "push %%rcx;"
+                             "push %%rdx;"
+                             "push %%rsi;"
+                             "push %%rdi;"
+                             "push $0;"
+                             "vmwrite %%rsp, %[host_rsp];"
+                             "lea 1f(%%rip), %%rax;"
+                             "vmwrite %%rax, %[host_rip];"
+                             "vmlaunch;"
+                             "incq (%%rsp);"
+                             "1: pop %%rax;"
+                             "pop %%rdi;"
+                             "pop %%rsi;"
+                             "pop %%rdx;"
+                             "pop %%rcx;"
+                             "pop %%rbp;"
+                             : [ret]"=&a"(ret)
+                             : [host_rsp]"r"((uint64_t)HOST_RSP),
+                               [host_rip]"r"((uint64_t)HOST_RIP)
+                             : "memory", "cc", "rbx", "r8", "r9", "r10",
+                               "r11", "r12", "r13", "r14", "r15");
+        return ret;
+}
+
+/*
+ * No guest state (e.g. GPRs) is established by this vmresume.
+ */
+static inline int vmresume(void)
+{
+        int ret;
+
+        __asm__ __volatile__("push %%rbp;"
+                             "push %%rcx;"
+                             "push %%rdx;"
+                             "push %%rsi;"
+                             "push %%rdi;"
+                             "push $0;"
+                             "vmwrite %%rsp, %[host_rsp];"
+                             "lea 1f(%%rip), %%rax;"
+                             "vmwrite %%rax, %[host_rip];"
+                             "vmresume;"
+                             "incq (%%rsp);"
+                             "1: pop %%rax;"
+                             "pop %%rdi;"
+                             "pop %%rsi;"
+                             "pop %%rdx;"
+                             "pop %%rcx;"
+                             "pop %%rbp;"
+                             : [ret]"=&a"(ret)
+                             : [host_rsp]"r"((uint64_t)HOST_RSP),
+                               [host_rip]"r"((uint64_t)HOST_RIP)
+                             : "memory", "cc", "rbx", "r8", "r9", "r10",
+                               "r11", "r12", "r13", "r14", "r15");
+        return ret;
+}
+
+static inline int vmread(uint64_t encoding, uint64_t *value)
+{
+        uint64_t tmp;
+        uint8_t ret;
+
+        __asm__ __volatile__("vmread %[encoding], %[value]; setna %[ret]"
+                : [value]"=rm"(tmp), [ret]"=rm"(ret)
+                : [encoding]"r"(encoding)
+                : "cc", "memory");
+
+        *value = tmp;
+        return ret;
+}
+
+/*
+ * A wrapper around vmread that ignores errors and returns zero if the
+ * vmread instruction fails.
+ */
+static inline uint64_t vmreadz(uint64_t encoding)
+{
+        uint64_t value = 0;
+        vmread(encoding, &value);
+        return value;
+}
+
+static inline int vmwrite(uint64_t encoding, uint64_t value)
+{
+        uint8_t ret;
+
+        __asm__ __volatile__ ("vmwrite %[value], %[encoding]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [value]"rm"(value), [encoding]"r"(encoding)
+                : "cc", "memory");
+
+        return ret;
+}
+
+static inline uint32_t vmcs_revision(void)
+{
+        return rdmsr(MSR_IA32_VMX_BASIC);
+}
+
+void prepare_for_vmx_operation(void);
+void prepare_vmcs(void *guest_rip, void *guest_rsp);
+struct kvm_vm *vm_create_default_vmx(uint32_t vcpuid,
+                                     vmx_guest_code_t guest_code);
+
+#endif /* !SELFTEST_KVM_VMX_H */
diff --git a/tools/testing/selftests/kvm/include/x86.h b/tools/testing/selftests/kvm/include/x86.h
new file mode 100644
index 000000000000..4a5b2c4c1a0f
--- /dev/null
+++ b/tools/testing/selftests/kvm/include/x86.h
@@ -0,0 +1,1043 @@
+/*
+ * tools/testing/selftests/kvm/include/x86.h
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ */
+
+#ifndef SELFTEST_KVM_X86_H
+#define SELFTEST_KVM_X86_H
+
+#include <assert.h>
+#include <stdint.h>
+
+#define X86_EFLAGS_FIXED         (1u << 1)
+
+#define X86_CR4_VME             (1ul << 0)
+#define X86_CR4_PVI             (1ul << 1)
+#define X86_CR4_TSD             (1ul << 2)
+#define X86_CR4_DE              (1ul << 3)
+#define X86_CR4_PSE             (1ul << 4)
+#define X86_CR4_PAE             (1ul << 5)
+#define X86_CR4_MCE             (1ul << 6)
+#define X86_CR4_PGE             (1ul << 7)
+#define X86_CR4_PCE             (1ul << 8)
+#define X86_CR4_OSFXSR          (1ul << 9)
+#define X86_CR4_OSXMMEXCPT      (1ul << 10)
+#define X86_CR4_UMIP            (1ul << 11)
+#define X86_CR4_VMXE            (1ul << 13)
+#define X86_CR4_SMXE            (1ul << 14)
+#define X86_CR4_FSGSBASE        (1ul << 16)
+#define X86_CR4_PCIDE           (1ul << 17)
+#define X86_CR4_OSXSAVE         (1ul << 18)
+#define X86_CR4_SMEP            (1ul << 20)
+#define X86_CR4_SMAP            (1ul << 21)
+#define X86_CR4_PKE             (1ul << 22)
+
+/* The enum values match the intruction encoding of each register */
+enum x86_register {
+        RAX = 0,
+        RCX,
+        RDX,
+        RBX,
+        RSP,
+        RBP,
+        RSI,
+        RDI,
+        R8,
+        R9,
+        R10,
+        R11,
+        R12,
+        R13,
+        R14,
+        R15,
+};
+
+struct desc64 {
+        uint16_t limit0;
+        uint16_t base0;
+        unsigned base1:8, type:5, dpl:2, p:1;
+        unsigned limit1:4, zero0:3, g:1, base2:8;
+        uint32_t base3;
+        uint32_t zero1;
+} __attribute__((packed));
+
+struct desc_ptr {
+        uint16_t size;
+        uint64_t address;
+} __attribute__((packed));
+
+static inline uint64_t get_desc64_base(const struct desc64 *desc)
+{
+        return ((uint64_t)desc->base3 << 32) |
+                (desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
+}
+
+static inline uint64_t rdtsc(void)
+{
+        uint32_t eax, edx;
+
+        /*
+         * The lfence is to wait (on Intel CPUs) until all previous
+         * instructions have been executed.
+         */
+        __asm__ __volatile__("lfence; rdtsc" : "=a"(eax), "=d"(edx));
+        return ((uint64_t)edx) << 32 | eax;
+}
+
+static inline uint64_t rdtscp(uint32_t *aux)
+{
+        uint32_t eax, edx;
+
+        __asm__ __volatile__("rdtscp" : "=a"(eax), "=d"(edx), "=c"(*aux));
+        return ((uint64_t)edx) << 32 | eax;
+}
+
+static inline uint64_t rdmsr(uint32_t msr)
+{
+        uint32_t a, d;
+
+        __asm__ __volatile__("rdmsr" : "=a"(a), "=d"(d) : "c"(msr) : "memory");
+
+        return a | ((uint64_t) d << 32);
+}
+
+static inline void wrmsr(uint32_t msr, uint64_t value)
+{
+        uint32_t a = value;
+        uint32_t d = value >> 32;
+
+        __asm__ __volatile__("wrmsr" :: "a"(a), "d"(d), "c"(msr) : "memory");
+}
+
+
+static inline uint16_t inw(uint16_t port)
+{
+        uint16_t tmp;
+
+        __asm__ __volatile__("in %%dx, %%ax"
+                : /* output */ "=a" (tmp)
+                : /* input */ "d" (port));
+
+        return tmp;
+}
+
+static inline uint16_t get_es(void)
+{
+        uint16_t es;
+
+        __asm__ __volatile__("mov %%es, %[es]"
+                             : /* output */ [es]"=rm"(es));
+        return es;
+}
+
+static inline uint16_t get_cs(void)
+{
+        uint16_t cs;
+
+        __asm__ __volatile__("mov %%cs, %[cs]"
+                             : /* output */ [cs]"=rm"(cs));
+        return cs;
+}
+
+static inline uint16_t get_ss(void)
+{
+        uint16_t ss;
+
+        __asm__ __volatile__("mov %%ss, %[ss]"
+                             : /* output */ [ss]"=rm"(ss));
+        return ss;
+}
+
+static inline uint16_t get_ds(void)
+{
+        uint16_t ds;
+
+        __asm__ __volatile__("mov %%ds, %[ds]"
+                             : /* output */ [ds]"=rm"(ds));
+        return ds;
+}
+
+static inline uint16_t get_fs(void)
+{
+        uint16_t fs;
+
+        __asm__ __volatile__("mov %%fs, %[fs]"
+                             : /* output */ [fs]"=rm"(fs));
+        return fs;
+}
+
+static inline uint16_t get_gs(void)
+{
+        uint16_t gs;
+
+        __asm__ __volatile__("mov %%gs, %[gs]"
+                             : /* output */ [gs]"=rm"(gs));
+        return gs;
+}
+
+static inline uint16_t get_tr(void)
+{
+        uint16_t tr;
+
+        __asm__ __volatile__("str %[tr]"
+                             : /* output */ [tr]"=rm"(tr));
+        return tr;
+}
+
+static inline uint64_t get_cr0(void)
+{
+        uint64_t cr0;
+
+        __asm__ __volatile__("mov %%cr0, %[cr0]"
+                             : /* output */ [cr0]"=r"(cr0));
+        return cr0;
+}
+
+static inline uint64_t get_cr3(void)
+{
+        uint64_t cr3;
+
+        __asm__ __volatile__("mov %%cr3, %[cr3]"
+                             : /* output */ [cr3]"=r"(cr3));
+        return cr3;
+}
+
+static inline uint64_t get_cr4(void)
+{
+        uint64_t cr4;
+
+        __asm__ __volatile__("mov %%cr4, %[cr4]"
+                             : /* output */ [cr4]"=r"(cr4));
+        return cr4;
+}
+
+static inline void set_cr4(uint64_t val)
+{
+        __asm__ __volatile__("mov %0, %%cr4" : : "r" (val) : "memory");
+}
+
+static inline uint64_t get_gdt_base(void)
+{
+        struct desc_ptr gdt;
+        __asm__ __volatile__("sgdt %[gdt]"
+                             : /* output */ [gdt]"=m"(gdt));
+        return gdt.address;
+}
+
+static inline uint64_t get_idt_base(void)
+{
+        struct desc_ptr idt;
+        __asm__ __volatile__("sidt %[idt]"
+                             : /* output */ [idt]"=m"(idt));
+        return idt.address;
+}
+
+#define SET_XMM(__var, __xmm) \
+        asm volatile("movq %0, %%"#__xmm : : "r"(__var) : #__xmm)
+
+static inline void set_xmm(int n, unsigned long val)
+{
+        switch (n) {
+        case 0:
+                SET_XMM(val, xmm0);
+                break;
+        case 1:
+                SET_XMM(val, xmm1);
+                break;
+        case 2:
+                SET_XMM(val, xmm2);
+                break;
+        case 3:
+                SET_XMM(val, xmm3);
+                break;
+        case 4:
+                SET_XMM(val, xmm4);
+                break;
+        case 5:
+                SET_XMM(val, xmm5);
+                break;
+        case 6:
+                SET_XMM(val, xmm6);
+                break;
+        case 7:
+                SET_XMM(val, xmm7);
+                break;
+        }
+}
+
+typedef unsigned long v1di __attribute__ ((vector_size (8)));
+static inline unsigned long get_xmm(int n)
+{
+        assert(n >= 0 && n <= 7);
+
+        register v1di xmm0 __asm__("%xmm0");
+        register v1di xmm1 __asm__("%xmm1");
+        register v1di xmm2 __asm__("%xmm2");
+        register v1di xmm3 __asm__("%xmm3");
+        register v1di xmm4 __asm__("%xmm4");
+        register v1di xmm5 __asm__("%xmm5");
+        register v1di xmm6 __asm__("%xmm6");
+        register v1di xmm7 __asm__("%xmm7");
+        switch (n) {
+        case 0:
+                return (unsigned long)xmm0;
+        case 1:
+                return (unsigned long)xmm1;
+        case 2:
+                return (unsigned long)xmm2;
+        case 3:
+                return (unsigned long)xmm3;
+        case 4:
+                return (unsigned long)xmm4;
+        case 5:
+                return (unsigned long)xmm5;
+        case 6:
+                return (unsigned long)xmm6;
+        case 7:
+                return (unsigned long)xmm7;
+        }
+        return 0;
+}
+
+/*
+ * Basic CPU control in CR0
+ */
+#define X86_CR0_PE          (1UL<<0) /* Protection Enable */
+#define X86_CR0_MP          (1UL<<1) /* Monitor Coprocessor */
+#define X86_CR0_EM          (1UL<<2) /* Emulation */
+#define X86_CR0_TS          (1UL<<3) /* Task Switched */
+#define X86_CR0_ET          (1UL<<4) /* Extension Type */
+#define X86_CR0_NE          (1UL<<5) /* Numeric Error */
+#define X86_CR0_WP          (1UL<<16) /* Write Protect */
+#define X86_CR0_AM          (1UL<<18) /* Alignment Mask */
+#define X86_CR0_NW          (1UL<<29) /* Not Write-through */
+#define X86_CR0_CD          (1UL<<30) /* Cache Disable */
+#define X86_CR0_PG          (1UL<<31) /* Paging */
+
+/*
+ * CPU model specific register (MSR) numbers.
+ */
+
+/* x86-64 specific MSRs */
+#define MSR_EFER                0xc0000080 /* extended feature register */
+#define MSR_STAR                0xc0000081 /* legacy mode SYSCALL target */
+#define MSR_LSTAR               0xc0000082 /* long mode SYSCALL target */
+#define MSR_CSTAR               0xc0000083 /* compat mode SYSCALL target */
+#define MSR_SYSCALL_MASK        0xc0000084 /* EFLAGS mask for syscall */
+#define MSR_FS_BASE             0xc0000100 /* 64bit FS base */
+#define MSR_GS_BASE             0xc0000101 /* 64bit GS base */
+#define MSR_KERNEL_GS_BASE      0xc0000102 /* SwapGS GS shadow */
+#define MSR_TSC_AUX             0xc0000103 /* Auxiliary TSC */
+
+/* EFER bits: */
+#define EFER_SCE                (1<<0)  /* SYSCALL/SYSRET */
+#define EFER_LME                (1<<8)  /* Long mode enable */
+#define EFER_LMA                (1<<10) /* Long mode active (read-only) */
+#define EFER_NX                 (1<<11) /* No execute enable */
+#define EFER_SVME               (1<<12) /* Enable virtualization */
+#define EFER_LMSLE              (1<<13) /* Long Mode Segment Limit Enable */
+#define EFER_FFXSR              (1<<14) /* Enable Fast FXSAVE/FXRSTOR */
+
+/* Intel MSRs. Some also available on other CPUs */
+
+#define MSR_PPIN_CTL                    0x0000004e
+#define MSR_PPIN                        0x0000004f
+
+#define MSR_IA32_PERFCTR0               0x000000c1
+#define MSR_IA32_PERFCTR1               0x000000c2
+#define MSR_FSB_FREQ                    0x000000cd
+#define MSR_PLATFORM_INFO               0x000000ce
+#define MSR_PLATFORM_INFO_CPUID_FAULT_BIT       31
+#define MSR_PLATFORM_INFO_CPUID_FAULT           BIT_ULL(MSR_PLATFORM_INFO_CPUID_FAULT_BIT)
+
+#define MSR_PKG_CST_CONFIG_CONTROL      0x000000e2
+#define NHM_C3_AUTO_DEMOTE              (1UL << 25)
+#define NHM_C1_AUTO_DEMOTE              (1UL << 26)
+#define ATM_LNC_C6_AUTO_DEMOTE          (1UL << 25)
+#define SNB_C1_AUTO_UNDEMOTE            (1UL << 27)
+#define SNB_C3_AUTO_UNDEMOTE            (1UL << 28)
+
+#define MSR_MTRRcap                     0x000000fe
+#define MSR_IA32_BBL_CR_CTL             0x00000119
+#define MSR_IA32_BBL_CR_CTL3            0x0000011e
+
+#define MSR_IA32_SYSENTER_CS            0x00000174
+#define MSR_IA32_SYSENTER_ESP           0x00000175
+#define MSR_IA32_SYSENTER_EIP           0x00000176
+
+#define MSR_IA32_MCG_CAP                0x00000179
+#define MSR_IA32_MCG_STATUS             0x0000017a
+#define MSR_IA32_MCG_CTL                0x0000017b
+#define MSR_IA32_MCG_EXT_CTL            0x000004d0
+
+#define MSR_OFFCORE_RSP_0               0x000001a6
+#define MSR_OFFCORE_RSP_1               0x000001a7
+#define MSR_TURBO_RATIO_LIMIT           0x000001ad
+#define MSR_TURBO_RATIO_LIMIT1          0x000001ae
+#define MSR_TURBO_RATIO_LIMIT2          0x000001af
+
+#define MSR_LBR_SELECT                  0x000001c8
+#define MSR_LBR_TOS                     0x000001c9
+#define MSR_LBR_NHM_FROM                0x00000680
+#define MSR_LBR_NHM_TO                  0x000006c0
+#define MSR_LBR_CORE_FROM               0x00000040
+#define MSR_LBR_CORE_TO                 0x00000060
+
+#define MSR_LBR_INFO_0                  0x00000dc0 /* ... 0xddf for _31 */
+#define LBR_INFO_MISPRED                BIT_ULL(63)
+#define LBR_INFO_IN_TX                  BIT_ULL(62)
+#define LBR_INFO_ABORT                  BIT_ULL(61)
+#define LBR_INFO_CYCLES                 0xffff
+
+#define MSR_IA32_PEBS_ENABLE            0x000003f1
+#define MSR_IA32_DS_AREA                0x00000600
+#define MSR_IA32_PERF_CAPABILITIES      0x00000345
+#define MSR_PEBS_LD_LAT_THRESHOLD       0x000003f6
+
+#define MSR_IA32_RTIT_CTL               0x00000570
+#define MSR_IA32_RTIT_STATUS            0x00000571
+#define MSR_IA32_RTIT_ADDR0_A           0x00000580
+#define MSR_IA32_RTIT_ADDR0_B           0x00000581
+#define MSR_IA32_RTIT_ADDR1_A           0x00000582
+#define MSR_IA32_RTIT_ADDR1_B           0x00000583
+#define MSR_IA32_RTIT_ADDR2_A           0x00000584
+#define MSR_IA32_RTIT_ADDR2_B           0x00000585
+#define MSR_IA32_RTIT_ADDR3_A           0x00000586
+#define MSR_IA32_RTIT_ADDR3_B           0x00000587
+#define MSR_IA32_RTIT_CR3_MATCH         0x00000572
+#define MSR_IA32_RTIT_OUTPUT_BASE       0x00000560
+#define MSR_IA32_RTIT_OUTPUT_MASK       0x00000561
+
+#define MSR_MTRRfix64K_00000            0x00000250
+#define MSR_MTRRfix16K_80000            0x00000258
+#define MSR_MTRRfix16K_A0000            0x00000259
+#define MSR_MTRRfix4K_C0000             0x00000268
+#define MSR_MTRRfix4K_C8000             0x00000269
+#define MSR_MTRRfix4K_D0000             0x0000026a
+#define MSR_MTRRfix4K_D8000             0x0000026b
+#define MSR_MTRRfix4K_E0000             0x0000026c
+#define MSR_MTRRfix4K_E8000             0x0000026d
+#define MSR_MTRRfix4K_F0000             0x0000026e
+#define MSR_MTRRfix4K_F8000             0x0000026f
+#define MSR_MTRRdefType                 0x000002ff
+
+#define MSR_IA32_CR_PAT                 0x00000277
+
+#define MSR_IA32_DEBUGCTLMSR            0x000001d9
+#define MSR_IA32_LASTBRANCHFROMIP       0x000001db
+#define MSR_IA32_LASTBRANCHTOIP         0x000001dc
+#define MSR_IA32_LASTINTFROMIP          0x000001dd
+#define MSR_IA32_LASTINTTOIP            0x000001de
+
+/* DEBUGCTLMSR bits (others vary by model): */
+#define DEBUGCTLMSR_LBR                 (1UL <<  0) /* last branch recording */
+#define DEBUGCTLMSR_BTF_SHIFT           1
+#define DEBUGCTLMSR_BTF                 (1UL <<  1) /* single-step on branches */
+#define DEBUGCTLMSR_TR                  (1UL <<  6)
+#define DEBUGCTLMSR_BTS                 (1UL <<  7)
+#define DEBUGCTLMSR_BTINT               (1UL <<  8)
+#define DEBUGCTLMSR_BTS_OFF_OS          (1UL <<  9)
+#define DEBUGCTLMSR_BTS_OFF_USR         (1UL << 10)
+#define DEBUGCTLMSR_FREEZE_LBRS_ON_PMI  (1UL << 11)
+#define DEBUGCTLMSR_FREEZE_IN_SMM_BIT   14
+#define DEBUGCTLMSR_FREEZE_IN_SMM       (1UL << DEBUGCTLMSR_FREEZE_IN_SMM_BIT)
+
+#define MSR_PEBS_FRONTEND               0x000003f7
+
+#define MSR_IA32_POWER_CTL              0x000001fc
+
+#define MSR_IA32_MC0_CTL                0x00000400
+#define MSR_IA32_MC0_STATUS             0x00000401
+#define MSR_IA32_MC0_ADDR               0x00000402
+#define MSR_IA32_MC0_MISC               0x00000403
+
+/* C-state Residency Counters */
+#define MSR_PKG_C3_RESIDENCY            0x000003f8
+#define MSR_PKG_C6_RESIDENCY            0x000003f9
+#define MSR_ATOM_PKG_C6_RESIDENCY       0x000003fa
+#define MSR_PKG_C7_RESIDENCY            0x000003fa
+#define MSR_CORE_C3_RESIDENCY           0x000003fc
+#define MSR_CORE_C6_RESIDENCY           0x000003fd
+#define MSR_CORE_C7_RESIDENCY           0x000003fe
+#define MSR_KNL_CORE_C6_RESIDENCY       0x000003ff
+#define MSR_PKG_C2_RESIDENCY            0x0000060d
+#define MSR_PKG_C8_RESIDENCY            0x00000630
+#define MSR_PKG_C9_RESIDENCY            0x00000631
+#define MSR_PKG_C10_RESIDENCY           0x00000632
+
+/* Interrupt Response Limit */
+#define MSR_PKGC3_IRTL                  0x0000060a
+#define MSR_PKGC6_IRTL                  0x0000060b
+#define MSR_PKGC7_IRTL                  0x0000060c
+#define MSR_PKGC8_IRTL                  0x00000633
+#define MSR_PKGC9_IRTL                  0x00000634
+#define MSR_PKGC10_IRTL                 0x00000635
+
+/* Run Time Average Power Limiting (RAPL) Interface */
+
+#define MSR_RAPL_POWER_UNIT             0x00000606
+
+#define MSR_PKG_POWER_LIMIT             0x00000610
+#define MSR_PKG_ENERGY_STATUS           0x00000611
+#define MSR_PKG_PERF_STATUS             0x00000613
+#define MSR_PKG_POWER_INFO              0x00000614
+
+#define MSR_DRAM_POWER_LIMIT            0x00000618
+#define MSR_DRAM_ENERGY_STATUS          0x00000619
+#define MSR_DRAM_PERF_STATUS            0x0000061b
+#define MSR_DRAM_POWER_INFO             0x0000061c
+
+#define MSR_PP0_POWER_LIMIT             0x00000638
+#define MSR_PP0_ENERGY_STATUS           0x00000639
+#define MSR_PP0_POLICY                  0x0000063a
+#define MSR_PP0_PERF_STATUS             0x0000063b
+
+#define MSR_PP1_POWER_LIMIT             0x00000640
+#define MSR_PP1_ENERGY_STATUS           0x00000641
+#define MSR_PP1_POLICY                  0x00000642
+
+/* Config TDP MSRs */
+#define MSR_CONFIG_TDP_NOMINAL          0x00000648
+#define MSR_CONFIG_TDP_LEVEL_1          0x00000649
+#define MSR_CONFIG_TDP_LEVEL_2          0x0000064A
+#define MSR_CONFIG_TDP_CONTROL          0x0000064B
+#define MSR_TURBO_ACTIVATION_RATIO      0x0000064C
+
+#define MSR_PLATFORM_ENERGY_STATUS      0x0000064D
+
+#define MSR_PKG_WEIGHTED_CORE_C0_RES    0x00000658
+#define MSR_PKG_ANY_CORE_C0_RES         0x00000659
+#define MSR_PKG_ANY_GFXE_C0_RES         0x0000065A
+#define MSR_PKG_BOTH_CORE_GFXE_C0_RES   0x0000065B
+
+#define MSR_CORE_C1_RES                 0x00000660
+#define MSR_MODULE_C6_RES_MS            0x00000664
+
+#define MSR_CC6_DEMOTION_POLICY_CONFIG  0x00000668
+#define MSR_MC6_DEMOTION_POLICY_CONFIG  0x00000669
+
+#define MSR_ATOM_CORE_RATIOS            0x0000066a
+#define MSR_ATOM_CORE_VIDS              0x0000066b
+#define MSR_ATOM_CORE_TURBO_RATIOS      0x0000066c
+#define MSR_ATOM_CORE_TURBO_VIDS        0x0000066d
+
+
+#define MSR_CORE_PERF_LIMIT_REASONS     0x00000690
+#define MSR_GFX_PERF_LIMIT_REASONS      0x000006B0
+#define MSR_RING_PERF_LIMIT_REASONS     0x000006B1
+
+/* Hardware P state interface */
+#define MSR_PPERF                       0x0000064e
+#define MSR_PERF_LIMIT_REASONS          0x0000064f
+#define MSR_PM_ENABLE                   0x00000770
+#define MSR_HWP_CAPABILITIES            0x00000771
+#define MSR_HWP_REQUEST_PKG             0x00000772
+#define MSR_HWP_INTERRUPT               0x00000773
+#define MSR_HWP_REQUEST                 0x00000774
+#define MSR_HWP_STATUS                  0x00000777
+
+/* CPUID.6.EAX */
+#define HWP_BASE_BIT                    (1<<7)
+#define HWP_NOTIFICATIONS_BIT           (1<<8)
+#define HWP_ACTIVITY_WINDOW_BIT         (1<<9)
+#define HWP_ENERGY_PERF_PREFERENCE_BIT  (1<<10)
+#define HWP_PACKAGE_LEVEL_REQUEST_BIT   (1<<11)
+
+/* IA32_HWP_CAPABILITIES */
+#define HWP_HIGHEST_PERF(x)             (((x) >> 0) & 0xff)
+#define HWP_GUARANTEED_PERF(x)          (((x) >> 8) & 0xff)
+#define HWP_MOSTEFFICIENT_PERF(x)       (((x) >> 16) & 0xff)
+#define HWP_LOWEST_PERF(x)              (((x) >> 24) & 0xff)
+
+/* IA32_HWP_REQUEST */
+#define HWP_MIN_PERF(x)                 (x & 0xff)
+#define HWP_MAX_PERF(x)                 ((x & 0xff) << 8)
+#define HWP_DESIRED_PERF(x)             ((x & 0xff) << 16)
+#define HWP_ENERGY_PERF_PREFERENCE(x)   (((unsigned long long) x & 0xff) << 24)
+#define HWP_EPP_PERFORMANCE             0x00
+#define HWP_EPP_BALANCE_PERFORMANCE     0x80
+#define HWP_EPP_BALANCE_POWERSAVE       0xC0
+#define HWP_EPP_POWERSAVE               0xFF
+#define HWP_ACTIVITY_WINDOW(x)          ((unsigned long long)(x & 0xff3) << 32)
+#define HWP_PACKAGE_CONTROL(x)          ((unsigned long long)(x & 0x1) << 42)
+
+/* IA32_HWP_STATUS */
+#define HWP_GUARANTEED_CHANGE(x)        (x & 0x1)
+#define HWP_EXCURSION_TO_MINIMUM(x)     (x & 0x4)
+
+/* IA32_HWP_INTERRUPT */
+#define HWP_CHANGE_TO_GUARANTEED_INT(x) (x & 0x1)
+#define HWP_EXCURSION_TO_MINIMUM_INT(x) (x & 0x2)
+
+#define MSR_AMD64_MC0_MASK              0xc0010044
+
+#define MSR_IA32_MCx_CTL(x)             (MSR_IA32_MC0_CTL + 4*(x))
+#define MSR_IA32_MCx_STATUS(x)          (MSR_IA32_MC0_STATUS + 4*(x))
+#define MSR_IA32_MCx_ADDR(x)            (MSR_IA32_MC0_ADDR + 4*(x))
+#define MSR_IA32_MCx_MISC(x)            (MSR_IA32_MC0_MISC + 4*(x))
+
+#define MSR_AMD64_MCx_MASK(x)           (MSR_AMD64_MC0_MASK + (x))
+
+/* These are consecutive and not in the normal 4er MCE bank block */
+#define MSR_IA32_MC0_CTL2               0x00000280
+#define MSR_IA32_MCx_CTL2(x)            (MSR_IA32_MC0_CTL2 + (x))
+
+#define MSR_P6_PERFCTR0                 0x000000c1
+#define MSR_P6_PERFCTR1                 0x000000c2
+#define MSR_P6_EVNTSEL0                 0x00000186
+#define MSR_P6_EVNTSEL1                 0x00000187
+
+#define MSR_KNC_PERFCTR0               0x00000020
+#define MSR_KNC_PERFCTR1               0x00000021
+#define MSR_KNC_EVNTSEL0               0x00000028
+#define MSR_KNC_EVNTSEL1               0x00000029
+
+/* Alternative perfctr range with full access. */
+#define MSR_IA32_PMC0                   0x000004c1
+
+/* AMD64 MSRs. Not complete. See the architecture manual for a more
+   complete list. */
+
+#define MSR_AMD64_PATCH_LEVEL           0x0000008b
+#define MSR_AMD64_TSC_RATIO             0xc0000104
+#define MSR_AMD64_NB_CFG                0xc001001f
+#define MSR_AMD64_PATCH_LOADER          0xc0010020
+#define MSR_AMD64_OSVW_ID_LENGTH        0xc0010140
+#define MSR_AMD64_OSVW_STATUS           0xc0010141
+#define MSR_AMD64_LS_CFG                0xc0011020
+#define MSR_AMD64_DC_CFG                0xc0011022
+#define MSR_AMD64_BU_CFG2               0xc001102a
+#define MSR_AMD64_IBSFETCHCTL           0xc0011030
+#define MSR_AMD64_IBSFETCHLINAD         0xc0011031
+#define MSR_AMD64_IBSFETCHPHYSAD        0xc0011032
+#define MSR_AMD64_IBSFETCH_REG_COUNT    3
+#define MSR_AMD64_IBSFETCH_REG_MASK     ((1UL<<MSR_AMD64_IBSFETCH_REG_COUNT)-1)
+#define MSR_AMD64_IBSOPCTL              0xc0011033
+#define MSR_AMD64_IBSOPRIP              0xc0011034
+#define MSR_AMD64_IBSOPDATA             0xc0011035
+#define MSR_AMD64_IBSOPDATA2            0xc0011036
+#define MSR_AMD64_IBSOPDATA3            0xc0011037
+#define MSR_AMD64_IBSDCLINAD            0xc0011038
+#define MSR_AMD64_IBSDCPHYSAD           0xc0011039
+#define MSR_AMD64_IBSOP_REG_COUNT       7
+#define MSR_AMD64_IBSOP_REG_MASK        ((1UL<<MSR_AMD64_IBSOP_REG_COUNT)-1)
+#define MSR_AMD64_IBSCTL                0xc001103a
+#define MSR_AMD64_IBSBRTARGET           0xc001103b
+#define MSR_AMD64_IBSOPDATA4            0xc001103d
+#define MSR_AMD64_IBS_REG_COUNT_MAX     8 /* includes MSR_AMD64_IBSBRTARGET */
+#define MSR_AMD64_SEV                   0xc0010131
+#define MSR_AMD64_SEV_ENABLED_BIT       0
+#define MSR_AMD64_SEV_ENABLED           BIT_ULL(MSR_AMD64_SEV_ENABLED_BIT)
+
+/* Fam 17h MSRs */
+#define MSR_F17H_IRPERF                 0xc00000e9
+
+/* Fam 16h MSRs */
+#define MSR_F16H_L2I_PERF_CTL           0xc0010230
+#define MSR_F16H_L2I_PERF_CTR           0xc0010231
+#define MSR_F16H_DR1_ADDR_MASK          0xc0011019
+#define MSR_F16H_DR2_ADDR_MASK          0xc001101a
+#define MSR_F16H_DR3_ADDR_MASK          0xc001101b
+#define MSR_F16H_DR0_ADDR_MASK          0xc0011027
+
+/* Fam 15h MSRs */
+#define MSR_F15H_PERF_CTL               0xc0010200
+#define MSR_F15H_PERF_CTR               0xc0010201
+#define MSR_F15H_NB_PERF_CTL            0xc0010240
+#define MSR_F15H_NB_PERF_CTR            0xc0010241
+#define MSR_F15H_PTSC                   0xc0010280
+#define MSR_F15H_IC_CFG                 0xc0011021
+
+/* Fam 10h MSRs */
+#define MSR_FAM10H_MMIO_CONF_BASE       0xc0010058
+#define FAM10H_MMIO_CONF_ENABLE         (1<<0)
+#define FAM10H_MMIO_CONF_BUSRANGE_MASK  0xf
+#define FAM10H_MMIO_CONF_BUSRANGE_SHIFT 2
+#define FAM10H_MMIO_CONF_BASE_MASK      0xfffffffULL
+#define FAM10H_MMIO_CONF_BASE_SHIFT     20
+#define MSR_FAM10H_NODE_ID              0xc001100c
+#define MSR_F10H_DECFG                  0xc0011029
+#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT     1
+#define MSR_F10H_DECFG_LFENCE_SERIALIZE         BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT)
+
+/* K8 MSRs */
+#define MSR_K8_TOP_MEM1                 0xc001001a
+#define MSR_K8_TOP_MEM2                 0xc001001d
+#define MSR_K8_SYSCFG                   0xc0010010
+#define MSR_K8_SYSCFG_MEM_ENCRYPT_BIT   23
+#define MSR_K8_SYSCFG_MEM_ENCRYPT       BIT_ULL(MSR_K8_SYSCFG_MEM_ENCRYPT_BIT)
+#define MSR_K8_INT_PENDING_MSG          0xc0010055
+/* C1E active bits in int pending message */
+#define K8_INTP_C1E_ACTIVE_MASK         0x18000000
+#define MSR_K8_TSEG_ADDR                0xc0010112
+#define MSR_K8_TSEG_MASK                0xc0010113
+#define K8_MTRRFIXRANGE_DRAM_ENABLE     0x00040000 /* MtrrFixDramEn bit    */
+#define K8_MTRRFIXRANGE_DRAM_MODIFY     0x00080000 /* MtrrFixDramModEn bit */
+#define K8_MTRR_RDMEM_WRMEM_MASK        0x18181818 /* Mask: RdMem|WrMem    */
+
+/* K7 MSRs */
+#define MSR_K7_EVNTSEL0                 0xc0010000
+#define MSR_K7_PERFCTR0                 0xc0010004
+#define MSR_K7_EVNTSEL1                 0xc0010001
+#define MSR_K7_PERFCTR1                 0xc0010005
+#define MSR_K7_EVNTSEL2                 0xc0010002
+#define MSR_K7_PERFCTR2                 0xc0010006
+#define MSR_K7_EVNTSEL3                 0xc0010003
+#define MSR_K7_PERFCTR3                 0xc0010007
+#define MSR_K7_CLK_CTL                  0xc001001b
+#define MSR_K7_HWCR                     0xc0010015
+#define MSR_K7_HWCR_SMMLOCK_BIT         0
+#define MSR_K7_HWCR_SMMLOCK             BIT_ULL(MSR_K7_HWCR_SMMLOCK_BIT)
+#define MSR_K7_FID_VID_CTL              0xc0010041
+#define MSR_K7_FID_VID_STATUS           0xc0010042
+
+/* K6 MSRs */
+#define MSR_K6_WHCR                     0xc0000082
+#define MSR_K6_UWCCR                    0xc0000085
+#define MSR_K6_EPMR                     0xc0000086
+#define MSR_K6_PSOR                     0xc0000087
+#define MSR_K6_PFIR                     0xc0000088
+
+/* Centaur-Hauls/IDT defined MSRs. */
+#define MSR_IDT_FCR1                    0x00000107
+#define MSR_IDT_FCR2                    0x00000108
+#define MSR_IDT_FCR3                    0x00000109
+#define MSR_IDT_FCR4                    0x0000010a
+
+#define MSR_IDT_MCR0                    0x00000110
+#define MSR_IDT_MCR1                    0x00000111
+#define MSR_IDT_MCR2                    0x00000112
+#define MSR_IDT_MCR3                    0x00000113
+#define MSR_IDT_MCR4                    0x00000114
+#define MSR_IDT_MCR5                    0x00000115
+#define MSR_IDT_MCR6                    0x00000116
+#define MSR_IDT_MCR7                    0x00000117
+#define MSR_IDT_MCR_CTRL                0x00000120
+
+/* VIA Cyrix defined MSRs*/
+#define MSR_VIA_FCR                     0x00001107
+#define MSR_VIA_LONGHAUL                0x0000110a
+#define MSR_VIA_RNG                     0x0000110b
+#define MSR_VIA_BCR2                    0x00001147
+
+/* Transmeta defined MSRs */
+#define MSR_TMTA_LONGRUN_CTRL           0x80868010
+#define MSR_TMTA_LONGRUN_FLAGS          0x80868011
+#define MSR_TMTA_LRTI_READOUT           0x80868018
+#define MSR_TMTA_LRTI_VOLT_MHZ          0x8086801a
+
+/* Intel defined MSRs. */
+#define MSR_IA32_P5_MC_ADDR             0x00000000
+#define MSR_IA32_P5_MC_TYPE             0x00000001
+#define MSR_IA32_TSC                    0x00000010
+#define MSR_IA32_PLATFORM_ID            0x00000017
+#define MSR_IA32_EBL_CR_POWERON         0x0000002a
+#define MSR_EBC_FREQUENCY_ID            0x0000002c
+#define MSR_SMI_COUNT                   0x00000034
+#define MSR_IA32_FEATURE_CONTROL        0x0000003a
+#define MSR_IA32_TSC_ADJUST             0x0000003b
+#define MSR_IA32_BNDCFGS                0x00000d90
+
+#define MSR_IA32_BNDCFGS_RSVD           0x00000ffc
+
+#define MSR_IA32_XSS                    0x00000da0
+
+#define FEATURE_CONTROL_LOCKED                          (1<<0)
+#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX        (1<<1)
+#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX       (1<<2)
+#define FEATURE_CONTROL_LMCE                            (1<<20)
+
+#define MSR_IA32_APICBASE               0x0000001b
+#define MSR_IA32_APICBASE_BSP           (1<<8)
+#define MSR_IA32_APICBASE_ENABLE        (1<<11)
+#define MSR_IA32_APICBASE_BASE          (0xfffff<<12)
+
+#define MSR_IA32_TSCDEADLINE            0x000006e0
+
+#define MSR_IA32_UCODE_WRITE            0x00000079
+#define MSR_IA32_UCODE_REV              0x0000008b
+
+#define MSR_IA32_SMM_MONITOR_CTL        0x0000009b
+#define MSR_IA32_SMBASE                 0x0000009e
+
+#define MSR_IA32_PERF_STATUS            0x00000198
+#define MSR_IA32_PERF_CTL               0x00000199
+#define INTEL_PERF_CTL_MASK             0xffff
+#define MSR_AMD_PSTATE_DEF_BASE         0xc0010064
+#define MSR_AMD_PERF_STATUS             0xc0010063
+#define MSR_AMD_PERF_CTL                0xc0010062
+
+#define MSR_IA32_MPERF                  0x000000e7
+#define MSR_IA32_APERF                  0x000000e8
+
+#define MSR_IA32_THERM_CONTROL          0x0000019a
+#define MSR_IA32_THERM_INTERRUPT        0x0000019b
+
+#define THERM_INT_HIGH_ENABLE           (1 << 0)
+#define THERM_INT_LOW_ENABLE            (1 << 1)
+#define THERM_INT_PLN_ENABLE            (1 << 24)
+
+#define MSR_IA32_THERM_STATUS           0x0000019c
+
+#define THERM_STATUS_PROCHOT            (1 << 0)
+#define THERM_STATUS_POWER_LIMIT        (1 << 10)
+
+#define MSR_THERM2_CTL                  0x0000019d
+
+#define MSR_THERM2_CTL_TM_SELECT        (1ULL << 16)
+
+#define MSR_IA32_MISC_ENABLE            0x000001a0
+
+#define MSR_IA32_TEMPERATURE_TARGET     0x000001a2
+
+#define MSR_MISC_FEATURE_CONTROL        0x000001a4
+#define MSR_MISC_PWR_MGMT               0x000001aa
+
+#define MSR_IA32_ENERGY_PERF_BIAS       0x000001b0
+#define ENERGY_PERF_BIAS_PERFORMANCE            0
+#define ENERGY_PERF_BIAS_BALANCE_PERFORMANCE    4
+#define ENERGY_PERF_BIAS_NORMAL                 6
+#define ENERGY_PERF_BIAS_BALANCE_POWERSAVE      8
+#define ENERGY_PERF_BIAS_POWERSAVE              15
+
+#define MSR_IA32_PACKAGE_THERM_STATUS           0x000001b1
+
+#define PACKAGE_THERM_STATUS_PROCHOT            (1 << 0)
+#define PACKAGE_THERM_STATUS_POWER_LIMIT        (1 << 10)
+
+#define MSR_IA32_PACKAGE_THERM_INTERRUPT        0x000001b2
+
+#define PACKAGE_THERM_INT_HIGH_ENABLE           (1 << 0)
+#define PACKAGE_THERM_INT_LOW_ENABLE            (1 << 1)
+#define PACKAGE_THERM_INT_PLN_ENABLE            (1 << 24)
+
+/* Thermal Thresholds Support */
+#define THERM_INT_THRESHOLD0_ENABLE    (1 << 15)
+#define THERM_SHIFT_THRESHOLD0        8
+#define THERM_MASK_THRESHOLD0          (0x7f << THERM_SHIFT_THRESHOLD0)
+#define THERM_INT_THRESHOLD1_ENABLE    (1 << 23)
+#define THERM_SHIFT_THRESHOLD1        16
+#define THERM_MASK_THRESHOLD1          (0x7f << THERM_SHIFT_THRESHOLD1)
+#define THERM_STATUS_THRESHOLD0        (1 << 6)
+#define THERM_LOG_THRESHOLD0           (1 << 7)
+#define THERM_STATUS_THRESHOLD1        (1 << 8)
+#define THERM_LOG_THRESHOLD1           (1 << 9)
+
+/* MISC_ENABLE bits: architectural */
+#define MSR_IA32_MISC_ENABLE_FAST_STRING_BIT            0
+#define MSR_IA32_MISC_ENABLE_FAST_STRING                (1ULL << MSR_IA32_MISC_ENABLE_FAST_STRING_BIT)
+#define MSR_IA32_MISC_ENABLE_TCC_BIT                    1
+#define MSR_IA32_MISC_ENABLE_TCC                        (1ULL << MSR_IA32_MISC_ENABLE_TCC_BIT)
+#define MSR_IA32_MISC_ENABLE_EMON_BIT                   7
+#define MSR_IA32_MISC_ENABLE_EMON                       (1ULL << MSR_IA32_MISC_ENABLE_EMON_BIT)
+#define MSR_IA32_MISC_ENABLE_BTS_UNAVAIL_BIT            11
+#define MSR_IA32_MISC_ENABLE_BTS_UNAVAIL                (1ULL << MSR_IA32_MISC_ENABLE_BTS_UNAVAIL_BIT)
+#define MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL_BIT           12
+#define MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL               (1ULL << MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL_BIT)
+#define MSR_IA32_MISC_ENABLE_ENHANCED_SPEEDSTEP_BIT     16
+#define MSR_IA32_MISC_ENABLE_ENHANCED_SPEEDSTEP         (1ULL << MSR_IA32_MISC_ENABLE_ENHANCED_SPEEDSTEP_BIT)
+#define MSR_IA32_MISC_ENABLE_MWAIT_BIT                  18
+#define MSR_IA32_MISC_ENABLE_MWAIT                      (1ULL << MSR_IA32_MISC_ENABLE_MWAIT_BIT)
+#define MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT            22
+#define MSR_IA32_MISC_ENABLE_LIMIT_CPUID                (1ULL << MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT)
+#define MSR_IA32_MISC_ENABLE_XTPR_DISABLE_BIT           23
+#define MSR_IA32_MISC_ENABLE_XTPR_DISABLE               (1ULL << MSR_IA32_MISC_ENABLE_XTPR_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_XD_DISABLE_BIT             34
+#define MSR_IA32_MISC_ENABLE_XD_DISABLE                 (1ULL << MSR_IA32_MISC_ENABLE_XD_DISABLE_BIT)
+
+/* MISC_ENABLE bits: model-specific, meaning may vary from core to core */
+#define MSR_IA32_MISC_ENABLE_X87_COMPAT_BIT             2
+#define MSR_IA32_MISC_ENABLE_X87_COMPAT                 (1ULL << MSR_IA32_MISC_ENABLE_X87_COMPAT_BIT)
+#define MSR_IA32_MISC_ENABLE_TM1_BIT                    3
+#define MSR_IA32_MISC_ENABLE_TM1                        (1ULL << MSR_IA32_MISC_ENABLE_TM1_BIT)
+#define MSR_IA32_MISC_ENABLE_SPLIT_LOCK_DISABLE_BIT     4
+#define MSR_IA32_MISC_ENABLE_SPLIT_LOCK_DISABLE         (1ULL << MSR_IA32_MISC_ENABLE_SPLIT_LOCK_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_L3CACHE_DISABLE_BIT        6
+#define MSR_IA32_MISC_ENABLE_L3CACHE_DISABLE            (1ULL << MSR_IA32_MISC_ENABLE_L3CACHE_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_SUPPRESS_LOCK_BIT          8
+#define MSR_IA32_MISC_ENABLE_SUPPRESS_LOCK              (1ULL << MSR_IA32_MISC_ENABLE_SUPPRESS_LOCK_BIT)
+#define MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE_BIT       9
+#define MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE           (1ULL << MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_FERR_BIT                   10
+#define MSR_IA32_MISC_ENABLE_FERR                       (1ULL << MSR_IA32_MISC_ENABLE_FERR_BIT)
+#define MSR_IA32_MISC_ENABLE_FERR_MULTIPLEX_BIT         10
+#define MSR_IA32_MISC_ENABLE_FERR_MULTIPLEX             (1ULL << MSR_IA32_MISC_ENABLE_FERR_MULTIPLEX_BIT)
+#define MSR_IA32_MISC_ENABLE_TM2_BIT                    13
+#define MSR_IA32_MISC_ENABLE_TM2                        (1ULL << MSR_IA32_MISC_ENABLE_TM2_BIT)
+#define MSR_IA32_MISC_ENABLE_ADJ_PREF_DISABLE_BIT       19
+#define MSR_IA32_MISC_ENABLE_ADJ_PREF_DISABLE           (1ULL << MSR_IA32_MISC_ENABLE_ADJ_PREF_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_SPEEDSTEP_LOCK_BIT         20
+#define MSR_IA32_MISC_ENABLE_SPEEDSTEP_LOCK             (1ULL << MSR_IA32_MISC_ENABLE_SPEEDSTEP_LOCK_BIT)
+#define MSR_IA32_MISC_ENABLE_L1D_CONTEXT_BIT            24
+#define MSR_IA32_MISC_ENABLE_L1D_CONTEXT                (1ULL << MSR_IA32_MISC_ENABLE_L1D_CONTEXT_BIT)
+#define MSR_IA32_MISC_ENABLE_DCU_PREF_DISABLE_BIT       37
+#define MSR_IA32_MISC_ENABLE_DCU_PREF_DISABLE           (1ULL << MSR_IA32_MISC_ENABLE_DCU_PREF_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_TURBO_DISABLE_BIT          38
+#define MSR_IA32_MISC_ENABLE_TURBO_DISABLE              (1ULL << MSR_IA32_MISC_ENABLE_TURBO_DISABLE_BIT)
+#define MSR_IA32_MISC_ENABLE_IP_PREF_DISABLE_BIT        39
+#define MSR_IA32_MISC_ENABLE_IP_PREF_DISABLE            (1ULL << MSR_IA32_MISC_ENABLE_IP_PREF_DISABLE_BIT)
+
+/* MISC_FEATURES_ENABLES non-architectural features */
+#define MSR_MISC_FEATURES_ENABLES       0x00000140
+
+#define MSR_MISC_FEATURES_ENABLES_CPUID_FAULT_BIT       0
+#define MSR_MISC_FEATURES_ENABLES_CPUID_FAULT           BIT_ULL(MSR_MISC_FEATURES_ENABLES_CPUID_FAULT_BIT)
+#define MSR_MISC_FEATURES_ENABLES_RING3MWAIT_BIT        1
+
+#define MSR_IA32_TSC_DEADLINE           0x000006E0
+
+/* P4/Xeon+ specific */
+#define MSR_IA32_MCG_EAX                0x00000180
+#define MSR_IA32_MCG_EBX                0x00000181
+#define MSR_IA32_MCG_ECX                0x00000182
+#define MSR_IA32_MCG_EDX                0x00000183
+#define MSR_IA32_MCG_ESI                0x00000184
+#define MSR_IA32_MCG_EDI                0x00000185
+#define MSR_IA32_MCG_EBP                0x00000186
+#define MSR_IA32_MCG_ESP                0x00000187
+#define MSR_IA32_MCG_EFLAGS             0x00000188
+#define MSR_IA32_MCG_EIP                0x00000189
+#define MSR_IA32_MCG_RESERVED           0x0000018a
+
+/* Pentium IV performance counter MSRs */
+#define MSR_P4_BPU_PERFCTR0             0x00000300
+#define MSR_P4_BPU_PERFCTR1             0x00000301
+#define MSR_P4_BPU_PERFCTR2             0x00000302
+#define MSR_P4_BPU_PERFCTR3             0x00000303
+#define MSR_P4_MS_PERFCTR0              0x00000304
+#define MSR_P4_MS_PERFCTR1              0x00000305
+#define MSR_P4_MS_PERFCTR2              0x00000306
+#define MSR_P4_MS_PERFCTR3              0x00000307
+#define MSR_P4_FLAME_PERFCTR0           0x00000308
+#define MSR_P4_FLAME_PERFCTR1           0x00000309
+#define MSR_P4_FLAME_PERFCTR2           0x0000030a
+#define MSR_P4_FLAME_PERFCTR3           0x0000030b
+#define MSR_P4_IQ_PERFCTR0              0x0000030c
+#define MSR_P4_IQ_PERFCTR1              0x0000030d
+#define MSR_P4_IQ_PERFCTR2              0x0000030e
+#define MSR_P4_IQ_PERFCTR3              0x0000030f
+#define MSR_P4_IQ_PERFCTR4              0x00000310
+#define MSR_P4_IQ_PERFCTR5              0x00000311
+#define MSR_P4_BPU_CCCR0                0x00000360
+#define MSR_P4_BPU_CCCR1                0x00000361
+#define MSR_P4_BPU_CCCR2                0x00000362
+#define MSR_P4_BPU_CCCR3                0x00000363
+#define MSR_P4_MS_CCCR0                 0x00000364
+#define MSR_P4_MS_CCCR1                 0x00000365
+#define MSR_P4_MS_CCCR2                 0x00000366
+#define MSR_P4_MS_CCCR3                 0x00000367
+#define MSR_P4_FLAME_CCCR0              0x00000368
+#define MSR_P4_FLAME_CCCR1              0x00000369
+#define MSR_P4_FLAME_CCCR2              0x0000036a
+#define MSR_P4_FLAME_CCCR3              0x0000036b
+#define MSR_P4_IQ_CCCR0                 0x0000036c
+#define MSR_P4_IQ_CCCR1                 0x0000036d
+#define MSR_P4_IQ_CCCR2                 0x0000036e
+#define MSR_P4_IQ_CCCR3                 0x0000036f
+#define MSR_P4_IQ_CCCR4                 0x00000370
+#define MSR_P4_IQ_CCCR5                 0x00000371
+#define MSR_P4_ALF_ESCR0                0x000003ca
+#define MSR_P4_ALF_ESCR1                0x000003cb
+#define MSR_P4_BPU_ESCR0                0x000003b2
+#define MSR_P4_BPU_ESCR1                0x000003b3
+#define MSR_P4_BSU_ESCR0                0x000003a0
+#define MSR_P4_BSU_ESCR1                0x000003a1
+#define MSR_P4_CRU_ESCR0                0x000003b8
+#define MSR_P4_CRU_ESCR1                0x000003b9
+#define MSR_P4_CRU_ESCR2                0x000003cc
+#define MSR_P4_CRU_ESCR3                0x000003cd
+#define MSR_P4_CRU_ESCR4                0x000003e0
+#define MSR_P4_CRU_ESCR5                0x000003e1
+#define MSR_P4_DAC_ESCR0                0x000003a8
+#define MSR_P4_DAC_ESCR1                0x000003a9
+#define MSR_P4_FIRM_ESCR0               0x000003a4
+#define MSR_P4_FIRM_ESCR1               0x000003a5
+#define MSR_P4_FLAME_ESCR0              0x000003a6
+#define MSR_P4_FLAME_ESCR1              0x000003a7
+#define MSR_P4_FSB_ESCR0                0x000003a2
+#define MSR_P4_FSB_ESCR1                0x000003a3
+#define MSR_P4_IQ_ESCR0                 0x000003ba
+#define MSR_P4_IQ_ESCR1                 0x000003bb
+#define MSR_P4_IS_ESCR0                 0x000003b4
+#define MSR_P4_IS_ESCR1                 0x000003b5
+#define MSR_P4_ITLB_ESCR0               0x000003b6
+#define MSR_P4_ITLB_ESCR1               0x000003b7
+#define MSR_P4_IX_ESCR0                 0x000003c8
+#define MSR_P4_IX_ESCR1                 0x000003c9
+#define MSR_P4_MOB_ESCR0                0x000003aa
+#define MSR_P4_MOB_ESCR1                0x000003ab
+#define MSR_P4_MS_ESCR0                 0x000003c0
+#define MSR_P4_MS_ESCR1                 0x000003c1
+#define MSR_P4_PMH_ESCR0                0x000003ac
+#define MSR_P4_PMH_ESCR1                0x000003ad
+#define MSR_P4_RAT_ESCR0                0x000003bc
+#define MSR_P4_RAT_ESCR1                0x000003bd
+#define MSR_P4_SAAT_ESCR0               0x000003ae
+#define MSR_P4_SAAT_ESCR1               0x000003af
+#define MSR_P4_SSU_ESCR0                0x000003be
+#define MSR_P4_SSU_ESCR1                0x000003bf /* guess: not in manual */
+
+#define MSR_P4_TBPU_ESCR0               0x000003c2
+#define MSR_P4_TBPU_ESCR1               0x000003c3
+#define MSR_P4_TC_ESCR0                 0x000003c4
+#define MSR_P4_TC_ESCR1                 0x000003c5
+#define MSR_P4_U2L_ESCR0                0x000003b0
+#define MSR_P4_U2L_ESCR1                0x000003b1
+
+#define MSR_P4_PEBS_MATRIX_VERT         0x000003f2
+
+/* Intel Core-based CPU performance counters */
+#define MSR_CORE_PERF_FIXED_CTR0        0x00000309
+#define MSR_CORE_PERF_FIXED_CTR1        0x0000030a
+#define MSR_CORE_PERF_FIXED_CTR2        0x0000030b
+#define MSR_CORE_PERF_FIXED_CTR_CTRL    0x0000038d
+#define MSR_CORE_PERF_GLOBAL_STATUS     0x0000038e
+#define MSR_CORE_PERF_GLOBAL_CTRL       0x0000038f
+#define MSR_CORE_PERF_GLOBAL_OVF_CTRL   0x00000390
+
+/* Geode defined MSRs */
+#define MSR_GEODE_BUSCONT_CONF0         0x00001900
+
+/* Intel VT MSRs */
+#define MSR_IA32_VMX_BASIC              0x00000480
+#define MSR_IA32_VMX_PINBASED_CTLS      0x00000481
+#define MSR_IA32_VMX_PROCBASED_CTLS     0x00000482
+#define MSR_IA32_VMX_EXIT_CTLS          0x00000483
+#define MSR_IA32_VMX_ENTRY_CTLS         0x00000484
+#define MSR_IA32_VMX_MISC               0x00000485
+#define MSR_IA32_VMX_CR0_FIXED0         0x00000486
+#define MSR_IA32_VMX_CR0_FIXED1         0x00000487
+#define MSR_IA32_VMX_CR4_FIXED0         0x00000488
+#define MSR_IA32_VMX_CR4_FIXED1         0x00000489
+#define MSR_IA32_VMX_VMCS_ENUM          0x0000048a
+#define MSR_IA32_VMX_PROCBASED_CTLS2    0x0000048b
+#define MSR_IA32_VMX_EPT_VPID_CAP       0x0000048c
+#define MSR_IA32_VMX_TRUE_PINBASED_CTLS  0x0000048d
+#define MSR_IA32_VMX_TRUE_PROCBASED_CTLS 0x0000048e
+#define MSR_IA32_VMX_TRUE_EXIT_CTLS      0x0000048f
+#define MSR_IA32_VMX_TRUE_ENTRY_CTLS     0x00000490
+#define MSR_IA32_VMX_VMFUNC             0x00000491
+
+/* VMX_BASIC bits and bitmasks */
+#define VMX_BASIC_VMCS_SIZE_SHIFT       32
+#define VMX_BASIC_TRUE_CTLS             (1ULL << 55)
+#define VMX_BASIC_64            0x0001000000000000LLU
+#define VMX_BASIC_MEM_TYPE_SHIFT        50
+#define VMX_BASIC_MEM_TYPE_MASK 0x003c000000000000LLU
+#define VMX_BASIC_MEM_TYPE_WB   6LLU
+#define VMX_BASIC_INOUT         0x0040000000000000LLU
+
+/* MSR_IA32_VMX_MISC bits */
+#define MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS (1ULL << 29)
+#define MSR_IA32_VMX_MISC_PREEMPTION_TIMER_SCALE   0x1F
+/* AMD-V MSRs */
+
+#define MSR_VM_CR                       0xc0010114
+#define MSR_VM_IGNNE                    0xc0010115
+#define MSR_VM_HSAVE_PA                 0xc0010117
+
+#endif /* !SELFTEST_KVM_X86_H */
diff --git a/tools/testing/selftests/kvm/lib/assert.c b/tools/testing/selftests/kvm/lib/assert.c
new file mode 100644
index 000000000000..c9f5b7d4ce38
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/assert.c
@@ -0,0 +1,87 @@
+/*
+ * tools/testing/selftests/kvm/lib/assert.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#define _GNU_SOURCE /* for getline(3) and strchrnul(3)*/
+
+#include "test_util.h"
+
+#include <execinfo.h>
+#include <sys/syscall.h>
+
+/* Dumps the current stack trace to stderr. */
+static void __attribute__((noinline)) test_dump_stack(void);
+static void test_dump_stack(void)
+{
+        /*
+         * Build and run this command:
+         *
+         *      addr2line -s -e /proc/$PPID/exe -fpai {backtrace addresses} | \
+         *              grep -v test_dump_stack | cat -n 1>&2
+         *
+         * Note that the spacing is different and there's no newline.
+         */
+        size_t i;
+        size_t n = 20;
+        void *stack[n];
+        const char *addr2line = "addr2line -s -e /proc/$PPID/exe -fpai";
+        const char *pipeline = "|cat -n 1>&2";
+        char cmd[strlen(addr2line) + strlen(pipeline) +
+                 /* N bytes per addr * 2 digits per byte + 1 space per addr: */
+                 n * (((sizeof(void *)) * 2) + 1) +
+                 /* Null terminator: */
+                 1];
+        char *c;
+
+        n = backtrace(stack, n);
+        c = &cmd[0];
+        c += sprintf(c, "%s", addr2line);
+        /*
+         * Skip the first 3 frames: backtrace, test_dump_stack, and
+         * test_assert. We hope that backtrace isn't inlined and the other two
+         * we've declared noinline.
+         */
+        for (i = 2; i < n; i++)
+                c += sprintf(c, " %lx", ((unsigned long) stack[i]) - 1);
+        c += sprintf(c, "%s", pipeline);
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-result"
+        system(cmd);
+#pragma GCC diagnostic pop
+}
+
+static pid_t gettid(void)
+{
+        return syscall(SYS_gettid);
+}
+
+void __attribute__((noinline))
+test_assert(bool exp, const char *exp_str,
+        const char *file, unsigned int line, const char *fmt, ...)
+{
+        va_list ap;
+
+        if (!(exp)) {
+                va_start(ap, fmt);
+
+                fprintf(stderr, "==== Test Assertion Failure ====\n"
+                        "  %s:%u: %s\n"
+                        "  pid=%d tid=%d\n",
+                        file, line, exp_str, getpid(), gettid());
+                test_dump_stack();
+                if (fmt) {
+                        fputs("  ", stderr);
+                        vfprintf(stderr, fmt, ap);
+                        fputs("\n", stderr);
+                }
+                va_end(ap);
+
+                exit(254);
+        }
+
+        return;
+}
diff --git a/tools/testing/selftests/kvm/lib/elf.c b/tools/testing/selftests/kvm/lib/elf.c
new file mode 100644
index 000000000000..5eb857584aa3
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/elf.c
@@ -0,0 +1,197 @@
+/*
+ * tools/testing/selftests/kvm/lib/elf.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#include "test_util.h"
+
+#include <bits/endian.h>
+#include <linux/elf.h>
+
+#include "kvm_util.h"
+#include "kvm_util_internal.h"
+
+static void elfhdr_get(const char *filename, Elf64_Ehdr *hdrp)
+{
+        off_t offset_rv;
+
+        /* Open the ELF file. */
+        int fd;
+        fd = open(filename, O_RDONLY);
+        TEST_ASSERT(fd >= 0, "Failed to open ELF file,\n"
+                "  filename: %s\n"
+                "  rv: %i errno: %i", filename, fd, errno);
+
+        /* Read in and validate ELF Identification Record.
+         * The ELF Identification record is the first 16 (EI_NIDENT) bytes
+         * of the ELF header, which is at the beginning of the ELF file.
+         * For now it is only safe to read the first EI_NIDENT bytes.  Once
+         * read and validated, the value of e_ehsize can be used to determine
+         * the real size of the ELF header.
+         */
+        unsigned char ident[EI_NIDENT];
+        test_read(fd, ident, sizeof(ident));
+        TEST_ASSERT((ident[EI_MAG0] == ELFMAG0) && (ident[EI_MAG1] == ELFMAG1)
+                && (ident[EI_MAG2] == ELFMAG2) && (ident[EI_MAG3] == ELFMAG3),
+                "ELF MAGIC Mismatch,\n"
+                "  filename: %s\n"
+                "  ident[EI_MAG0 - EI_MAG3]: %02x %02x %02x %02x\n"
+                "  Expected: %02x %02x %02x %02x",
+                filename,
+                ident[EI_MAG0], ident[EI_MAG1], ident[EI_MAG2], ident[EI_MAG3],
+                ELFMAG0, ELFMAG1, ELFMAG2, ELFMAG3);
+        TEST_ASSERT(ident[EI_CLASS] == ELFCLASS64,
+                "Current implementation only able to handle ELFCLASS64,\n"
+                "  filename: %s\n"
+                "  ident[EI_CLASS]: %02x\n"
+                "  expected: %02x",
+                filename,
+                ident[EI_CLASS], ELFCLASS64);
+        TEST_ASSERT(((BYTE_ORDER == LITTLE_ENDIAN)
+                        && (ident[EI_DATA] == ELFDATA2LSB))
+                || ((BYTE_ORDER == BIG_ENDIAN)
+                        && (ident[EI_DATA] == ELFDATA2MSB)), "Current "
+                "implementation only able to handle\n"
+                "cases where the host and ELF file endianness\n"
+                "is the same:\n"
+                "  host BYTE_ORDER: %u\n"
+                "  host LITTLE_ENDIAN: %u\n"
+                "  host BIG_ENDIAN: %u\n"
+                "  ident[EI_DATA]: %u\n"
+                "  ELFDATA2LSB: %u\n"
+                "  ELFDATA2MSB: %u",
+                BYTE_ORDER, LITTLE_ENDIAN, BIG_ENDIAN,
+                ident[EI_DATA], ELFDATA2LSB, ELFDATA2MSB);
+        TEST_ASSERT(ident[EI_VERSION] == EV_CURRENT,
+                "Current implementation only able to handle current "
+                "ELF version,\n"
+                "  filename: %s\n"
+                "  ident[EI_VERSION]: %02x\n"
+                "  expected: %02x",
+                filename, ident[EI_VERSION], EV_CURRENT);
+
+        /* Read in the ELF header.
+         * With the ELF Identification portion of the ELF header
+         * validated, especially that the value at EI_VERSION is
+         * as expected, it is now safe to read the entire ELF header.
+         */
+        offset_rv = lseek(fd, 0, SEEK_SET);
+        TEST_ASSERT(offset_rv == 0, "Seek to ELF header failed,\n"
+                "  rv: %zi expected: %i", offset_rv, 0);
+        test_read(fd, hdrp, sizeof(*hdrp));
+        TEST_ASSERT(hdrp->e_phentsize == sizeof(Elf64_Phdr),
+                "Unexpected physical header size,\n"
+                "  hdrp->e_phentsize: %x\n"
+                "  expected: %zx",
+                hdrp->e_phentsize, sizeof(Elf64_Phdr));
+        TEST_ASSERT(hdrp->e_shentsize == sizeof(Elf64_Shdr),
+                "Unexpected section header size,\n"
+                "  hdrp->e_shentsize: %x\n"
+                "  expected: %zx",
+                hdrp->e_shentsize, sizeof(Elf64_Shdr));
+}
+
+/* VM ELF Load
+ *
+ * Input Args:
+ *   filename - Path to ELF file
+ *
+ * Output Args: None
+ *
+ * Input/Output Args:
+ *   vm - Pointer to opaque type that describes the VM.
+ *
+ * Return: None, TEST_ASSERT failures for all error conditions
+ *
+ * Loads the program image of the ELF file specified by filename,
+ * into the virtual address space of the VM pointed to by vm.  On entry
+ * the VM needs to not be using any of the virtual address space used
+ * by the image and it needs to have sufficient available physical pages, to
+ * back the virtual pages used to load the image.
+ */
+void kvm_vm_elf_load(struct kvm_vm *vm, const char *filename,
+        uint32_t data_memslot, uint32_t pgd_memslot)
+{
+        off_t offset, offset_rv;
+        Elf64_Ehdr hdr;
+
+        /* Open the ELF file. */
+        int fd;
+        fd = open(filename, O_RDONLY);
+        TEST_ASSERT(fd >= 0, "Failed to open ELF file,\n"
+                "  filename: %s\n"
+                "  rv: %i errno: %i", filename, fd, errno);
+
+        /* Read in the ELF header. */
+        elfhdr_get(filename, &hdr);
+
+        /* For each program header.
+         * The following ELF header members specify the location
+         * and size of the program headers:
+         *
+         *   e_phoff - File offset to start of program headers
+         *   e_phentsize - Size of each program header
+         *   e_phnum - Number of program header entries
+         */
+        for (unsigned int n1 = 0; n1 < hdr.e_phnum; n1++) {
+                /* Seek to the beginning of the program header. */
+                offset = hdr.e_phoff + (n1 * hdr.e_phentsize);
+                offset_rv = lseek(fd, offset, SEEK_SET);
+                TEST_ASSERT(offset_rv == offset,
+                        "Failed to seek to begining of program header %u,\n"
+                        "  filename: %s\n"
+                        "  rv: %jd errno: %i",
+                        n1, filename, (intmax_t) offset_rv, errno);
+
+                /* Read in the program header. */
+                Elf64_Phdr phdr;
+                test_read(fd, &phdr, sizeof(phdr));
+
+                /* Skip if this header doesn't describe a loadable segment. */
+                if (phdr.p_type != PT_LOAD)
+                        continue;
+
+                /* Allocate memory for this segment within the VM. */
+                TEST_ASSERT(phdr.p_memsz > 0, "Unexpected loadable segment "
+                        "memsize of 0,\n"
+                        "  phdr index: %u p_memsz: 0x%" PRIx64,
+                        n1, (uint64_t) phdr.p_memsz);
+                vm_vaddr_t seg_vstart = phdr.p_vaddr;
+                seg_vstart &= ~(vm_vaddr_t)(vm->page_size - 1);
+                vm_vaddr_t seg_vend = phdr.p_vaddr + phdr.p_memsz - 1;
+                seg_vend |= vm->page_size - 1;
+                size_t seg_size = seg_vend - seg_vstart + 1;
+
+                vm_vaddr_t vaddr = vm_vaddr_alloc(vm, seg_size, seg_vstart,
+                        data_memslot, pgd_memslot);
+                TEST_ASSERT(vaddr == seg_vstart, "Unable to allocate "
+                        "virtual memory for segment at requested min addr,\n"
+                        "  segment idx: %u\n"
+                        "  seg_vstart: 0x%lx\n"
+                        "  vaddr: 0x%lx",
+                        n1, seg_vstart, vaddr);
+                memset(addr_gva2hva(vm, vaddr), 0, seg_size);
+                /* TODO(lhuemill): Set permissions of each memory segment
+                 * based on the least-significant 3 bits of phdr.p_flags.
+                 */
+
+                /* Load portion of initial state that is contained within
+                 * the ELF file.
+                 */
+                if (phdr.p_filesz) {
+                        offset_rv = lseek(fd, phdr.p_offset, SEEK_SET);
+                        TEST_ASSERT(offset_rv == phdr.p_offset,
+                                "Seek to program segment offset failed,\n"
+                                "  program header idx: %u errno: %i\n"
+                                "  offset_rv: 0x%jx\n"
+                                "  expected: 0x%jx\n",
+                                n1, errno, (intmax_t) offset_rv,
+                                (intmax_t) phdr.p_offset);
+                        test_read(fd, addr_gva2hva(vm, phdr.p_vaddr),
+                                phdr.p_filesz);
+                }
+        }
+}
diff --git a/tools/testing/selftests/kvm/lib/io.c b/tools/testing/selftests/kvm/lib/io.c
new file mode 100644
index 000000000000..cff869ffe6ee
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/io.c
@@ -0,0 +1,158 @@
+/*
+ * tools/testing/selftests/kvm/lib/io.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#include "test_util.h"
+
+/* Test Write
+ *
+ * A wrapper for write(2), that automatically handles the following
+ * special conditions:
+ *
+ *   + Interrupted system call (EINTR)
+ *   + Write of less than requested amount
+ *   + Non-block return (EAGAIN)
+ *
+ * For each of the above, an additional write is performed to automatically
+ * continue writing the requested data.
+ * There are also many cases where write(2) can return an unexpected
+ * error (e.g. EIO).  Such errors cause a TEST_ASSERT failure.
+ *
+ * Note, for function signature compatibility with write(2), this function
+ * returns the number of bytes written, but that value will always be equal
+ * to the number of requested bytes.  All other conditions in this and
+ * future enhancements to this function either automatically issue another
+ * write(2) or cause a TEST_ASSERT failure.
+ *
+ * Args:
+ *  fd    - Opened file descriptor to file to be written.
+ *  count - Number of bytes to write.
+ *
+ * Output:
+ *  buf   - Starting address of data to be written.
+ *
+ * Return:
+ *  On success, number of bytes written.
+ *  On failure, a TEST_ASSERT failure is caused.
+ */
+ssize_t test_write(int fd, const void *buf, size_t count)
+{
+        ssize_t rc;
+        ssize_t num_written = 0;
+        size_t num_left = count;
+        const char *ptr = buf;
+
+        /* Note: Count of zero is allowed (see "RETURN VALUE" portion of
+         * write(2) manpage for details.
+         */
+        TEST_ASSERT(count >= 0, "Unexpected count, count: %li", count);
+
+        do {
+                rc = write(fd, ptr, num_left);
+
+                switch (rc) {
+                case -1:
+                        TEST_ASSERT(errno == EAGAIN || errno == EINTR,
+                                    "Unexpected write failure,\n"
+                                    "  rc: %zi errno: %i", rc, errno);
+                        continue;
+
+                case 0:
+                        TEST_ASSERT(false, "Unexpected EOF,\n"
+                                    "  rc: %zi num_written: %zi num_left: %zu",
+                                    rc, num_written, num_left);
+                        break;
+
+                default:
+                        TEST_ASSERT(rc >= 0, "Unexpected ret from write,\n"
+                                "  rc: %zi errno: %i", rc, errno);
+                        num_written += rc;
+                        num_left -= rc;
+                        ptr += rc;
+                        break;
+                }
+        } while (num_written < count);
+
+        return num_written;
+}
+
+/* Test Read
+ *
+ * A wrapper for read(2), that automatically handles the following
+ * special conditions:
+ *
+ *   + Interrupted system call (EINTR)
+ *   + Read of less than requested amount
+ *   + Non-block return (EAGAIN)
+ *
+ * For each of the above, an additional read is performed to automatically
+ * continue reading the requested data.
+ * There are also many cases where read(2) can return an unexpected
+ * error (e.g. EIO).  Such errors cause a TEST_ASSERT failure.  Note,
+ * it is expected that the file opened by fd at the current file position
+ * contains at least the number of requested bytes to be read.  A TEST_ASSERT
+ * failure is produced if an End-Of-File condition occurs, before all the
+ * data is read.  It is the callers responsibility to assure that sufficient
+ * data exists.
+ *
+ * Note, for function signature compatibility with read(2), this function
+ * returns the number of bytes read, but that value will always be equal
+ * to the number of requested bytes.  All other conditions in this and
+ * future enhancements to this function either automatically issue another
+ * read(2) or cause a TEST_ASSERT failure.
+ *
+ * Args:
+ *  fd    - Opened file descriptor to file to be read.
+ *  count - Number of bytes to read.
+ *
+ * Output:
+ *  buf   - Starting address of where to write the bytes read.
+ *
+ * Return:
+ *  On success, number of bytes read.
+ *  On failure, a TEST_ASSERT failure is caused.
+ */
+ssize_t test_read(int fd, void *buf, size_t count)
+{
+        ssize_t rc;
+        ssize_t num_read = 0;
+        size_t num_left = count;
+        char *ptr = buf;
+
+        /* Note: Count of zero is allowed (see "If count is zero" portion of
+         * read(2) manpage for details.
+         */
+        TEST_ASSERT(count >= 0, "Unexpected count, count: %li", count);
+
+        do {
+                rc = read(fd, ptr, num_left);
+
+                switch (rc) {
+                case -1:
+                        TEST_ASSERT(errno == EAGAIN || errno == EINTR,
+                                    "Unexpected read failure,\n"
+                                    "  rc: %zi errno: %i", rc, errno);
+                        break;
+
+                case 0:
+                        TEST_ASSERT(false, "Unexpected EOF,\n"
+                                    "  rc: %zi num_read: %zi num_left: %zu",
+                                    rc, num_read, num_left);
+                        break;
+
+                default:
+                        TEST_ASSERT(rc > 0, "Unexpected ret from read,\n"
+                                    "  rc: %zi errno: %i", rc, errno);
+                        num_read += rc;
+                        num_left -= rc;
+                        ptr += rc;
+                        break;
+                }
+        } while (num_read < count);
+
+        return num_read;
+}
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
new file mode 100644
index 000000000000..37e2a787d2fc
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -0,0 +1,1486 @@
+/*
+ * tools/testing/selftests/kvm/lib/kvm_util.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "kvm_util_internal.h"
+
+#include <assert.h>
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#define KVM_DEV_PATH "/dev/kvm"
+
+#define KVM_UTIL_PGS_PER_HUGEPG 512
+#define KVM_UTIL_MIN_PADDR      0x2000
+
+/* Aligns x up to the next multiple of size. Size must be a power of 2. */
+static void *align(void *x, size_t size)
+{
+        size_t mask = size - 1;
+        TEST_ASSERT(size != 0 && !(size & (size - 1)),
+                    "size not a power of 2: %lu", size);
+        return (void *) (((size_t) x + mask) & ~mask);
+}
+
+/* Capability
+ *
+ * Input Args:
+ *   cap - Capability
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   On success, the Value corresponding to the capability (KVM_CAP_*)
+ *   specified by the value of cap.  On failure a TEST_ASSERT failure
+ *   is produced.
+ *
+ * Looks up and returns the value corresponding to the capability
+ * (KVM_CAP_*) given by cap.
+ */
+int kvm_check_cap(long cap)
+{
+        int ret;
+        int kvm_fd;
+
+        kvm_fd = open(KVM_DEV_PATH, O_RDONLY);
+        if (kvm_fd < 0)
+                exit(KSFT_SKIP);
+
+        ret = ioctl(kvm_fd, KVM_CHECK_EXTENSION, cap);
+        TEST_ASSERT(ret != -1, "KVM_CHECK_EXTENSION IOCTL failed,\n"
+                "  rc: %i errno: %i", ret, errno);
+
+        close(kvm_fd);
+
+        return ret;
+}
+
+/* VM Create
+ *
+ * Input Args:
+ *   mode - VM Mode (e.g. VM_MODE_FLAT48PG)
+ *   phy_pages - Physical memory pages
+ *   perm - permission
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to opaque structure that describes the created VM.
+ *
+ * Creates a VM with the mode specified by mode (e.g. VM_MODE_FLAT48PG).
+ * When phy_pages is non-zero, a memory region of phy_pages physical pages
+ * is created and mapped starting at guest physical address 0.  The file
+ * descriptor to control the created VM is created with the permissions
+ * given by perm (e.g. O_RDWR).
+ */
+struct kvm_vm *vm_create(enum vm_guest_mode mode, uint64_t phy_pages, int perm)
+{
+        struct kvm_vm *vm;
+        int kvm_fd;
+
+        /* Allocate memory. */
+        vm = calloc(1, sizeof(*vm));
+        TEST_ASSERT(vm != NULL, "Insufficent Memory");
+
+        vm->mode = mode;
+        kvm_fd = open(KVM_DEV_PATH, perm);
+        if (kvm_fd < 0)
+                exit(KSFT_SKIP);
+
+        /* Create VM. */
+        vm->fd = ioctl(kvm_fd, KVM_CREATE_VM, NULL);
+        TEST_ASSERT(vm->fd >= 0, "KVM_CREATE_VM ioctl failed, "
+                "rc: %i errno: %i", vm->fd, errno);
+
+        close(kvm_fd);
+
+        /* Setup mode specific traits. */
+        switch (vm->mode) {
+        case VM_MODE_FLAT48PG:
+                vm->page_size = 0x1000;
+                vm->page_shift = 12;
+
+                /* Limit to 48-bit canonical virtual addresses. */
+                vm->vpages_valid = sparsebit_alloc();
+                sparsebit_set_num(vm->vpages_valid,
+                        0, (1ULL << (48 - 1)) >> vm->page_shift);
+                sparsebit_set_num(vm->vpages_valid,
+                        (~((1ULL << (48 - 1)) - 1)) >> vm->page_shift,
+                        (1ULL << (48 - 1)) >> vm->page_shift);
+
+                /* Limit physical addresses to 52-bits. */
+                vm->max_gfn = ((1ULL << 52) >> vm->page_shift) - 1;
+                break;
+
+        default:
+                TEST_ASSERT(false, "Unknown guest mode, mode: 0x%x", mode);
+        }
+
+        /* Allocate and setup memory for guest. */
+        vm->vpages_mapped = sparsebit_alloc();
+        if (phy_pages != 0)
+                vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
+                                            0, 0, phy_pages, 0);
+
+        return vm;
+}
+
+/* Userspace Memory Region Find
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   start - Starting VM physical address
+ *   end - Ending VM physical address, inclusive.
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to overlapping region, NULL if no such region.
+ *
+ * Searches for a region with any physical memory that overlaps with
+ * any portion of the guest physical addresses from start to end
+ * inclusive.  If multiple overlapping regions exist, a pointer to any
+ * of the regions is returned.  Null is returned only when no overlapping
+ * region exists.
+ */
+static struct userspace_mem_region *userspace_mem_region_find(
+        struct kvm_vm *vm, uint64_t start, uint64_t end)
+{
+        struct userspace_mem_region *region;
+
+        for (region = vm->userspace_mem_region_head; region;
+                region = region->next) {
+                uint64_t existing_start = region->region.guest_phys_addr;
+                uint64_t existing_end = region->region.guest_phys_addr
+                        + region->region.memory_size - 1;
+                if (start <= existing_end && end >= existing_start)
+                        return region;
+        }
+
+        return NULL;
+}
+
+/* KVM Userspace Memory Region Find
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   start - Starting VM physical address
+ *   end - Ending VM physical address, inclusive.
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to overlapping region, NULL if no such region.
+ *
+ * Public interface to userspace_mem_region_find. Allows tests to look up
+ * the memslot datastructure for a given range of guest physical memory.
+ */
+struct kvm_userspace_memory_region *
+kvm_userspace_memory_region_find(struct kvm_vm *vm, uint64_t start,
+                                 uint64_t end)
+{
+        struct userspace_mem_region *region;
+
+        region = userspace_mem_region_find(vm, start, end);
+        if (!region)
+                return NULL;
+
+        return &region->region;
+}
+
+/* VCPU Find
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to VCPU structure
+ *
+ * Locates a vcpu structure that describes the VCPU specified by vcpuid and
+ * returns a pointer to it.  Returns NULL if the VM doesn't contain a VCPU
+ * for the specified vcpuid.
+ */
+struct vcpu *vcpu_find(struct kvm_vm *vm,
+        uint32_t vcpuid)
+{
+        struct vcpu *vcpup;
+
+        for (vcpup = vm->vcpu_head; vcpup; vcpup = vcpup->next) {
+                if (vcpup->id == vcpuid)
+                        return vcpup;
+        }
+
+        return NULL;
+}
+
+/* VM VCPU Remove
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args: None
+ *
+ * Return: None, TEST_ASSERT failures for all error conditions
+ *
+ * Within the VM specified by vm, removes the VCPU given by vcpuid.
+ */
+static void vm_vcpu_rm(struct kvm_vm *vm, uint32_t vcpuid)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+
+        int ret = close(vcpu->fd);
+        TEST_ASSERT(ret == 0, "Close of VCPU fd failed, rc: %i "
+                "errno: %i", ret, errno);
+
+        if (vcpu->next)
+                vcpu->next->prev = vcpu->prev;
+        if (vcpu->prev)
+                vcpu->prev->next = vcpu->next;
+        else
+                vm->vcpu_head = vcpu->next;
+        free(vcpu);
+}
+
+
+/* Destroys and frees the VM pointed to by vmp.
+ */
+void kvm_vm_free(struct kvm_vm *vmp)
+{
+        int ret;
+
+        if (vmp == NULL)
+                return;
+
+        /* Free userspace_mem_regions. */
+        while (vmp->userspace_mem_region_head) {
+                struct userspace_mem_region *region
+                        = vmp->userspace_mem_region_head;
+
+                region->region.memory_size = 0;
+                ret = ioctl(vmp->fd, KVM_SET_USER_MEMORY_REGION,
+                        &region->region);
+                TEST_ASSERT(ret == 0, "KVM_SET_USER_MEMORY_REGION IOCTL failed, "
+                        "rc: %i errno: %i", ret, errno);
+
+                vmp->userspace_mem_region_head = region->next;
+                sparsebit_free(&region->unused_phy_pages);
+                ret = munmap(region->mmap_start, region->mmap_size);
+                TEST_ASSERT(ret == 0, "munmap failed, rc: %i errno: %i",
+                            ret, errno);
+
+                free(region);
+        }
+
+        /* Free VCPUs. */
+        while (vmp->vcpu_head)
+                vm_vcpu_rm(vmp, vmp->vcpu_head->id);
+
+        /* Free sparsebit arrays. */
+        sparsebit_free(&vmp->vpages_valid);
+        sparsebit_free(&vmp->vpages_mapped);
+
+        /* Close file descriptor for the VM. */
+        ret = close(vmp->fd);
+        TEST_ASSERT(ret == 0, "Close of vm fd failed,\n"
+                "  vmp->fd: %i rc: %i errno: %i", vmp->fd, ret, errno);
+
+        /* Free the structure describing the VM. */
+        free(vmp);
+}
+
+/* Memory Compare, host virtual to guest virtual
+ *
+ * Input Args:
+ *   hva - Starting host virtual address
+ *   vm - Virtual Machine
+ *   gva - Starting guest virtual address
+ *   len - number of bytes to compare
+ *
+ * Output Args: None
+ *
+ * Input/Output Args: None
+ *
+ * Return:
+ *   Returns 0 if the bytes starting at hva for a length of len
+ *   are equal the guest virtual bytes starting at gva.  Returns
+ *   a value < 0, if bytes at hva are less than those at gva.
+ *   Otherwise a value > 0 is returned.
+ *
+ * Compares the bytes starting at the host virtual address hva, for
+ * a length of len, to the guest bytes starting at the guest virtual
+ * address given by gva.
+ */
+int kvm_memcmp_hva_gva(void *hva,
+        struct kvm_vm *vm, vm_vaddr_t gva, size_t len)
+{
+        size_t amt;
+
+        /* Compare a batch of bytes until either a match is found
+         * or all the bytes have been compared.
+         */
+        for (uintptr_t offset = 0; offset < len; offset += amt) {
+                uintptr_t ptr1 = (uintptr_t)hva + offset;
+
+                /* Determine host address for guest virtual address
+                 * at offset.
+                 */
+                uintptr_t ptr2 = (uintptr_t)addr_gva2hva(vm, gva + offset);
+
+                /* Determine amount to compare on this pass.
+                 * Don't allow the comparsion to cross a page boundary.
+                 */
+                amt = len - offset;
+                if ((ptr1 >> vm->page_shift) != ((ptr1 + amt) >> vm->page_shift))
+                        amt = vm->page_size - (ptr1 % vm->page_size);
+                if ((ptr2 >> vm->page_shift) != ((ptr2 + amt) >> vm->page_shift))
+                        amt = vm->page_size - (ptr2 % vm->page_size);
+
+                assert((ptr1 >> vm->page_shift) == ((ptr1 + amt - 1) >> vm->page_shift));
+                assert((ptr2 >> vm->page_shift) == ((ptr2 + amt - 1) >> vm->page_shift));
+
+                /* Perform the comparison.  If there is a difference
+                 * return that result to the caller, otherwise need
+                 * to continue on looking for a mismatch.
+                 */
+                int ret = memcmp((void *)ptr1, (void *)ptr2, amt);
+                if (ret != 0)
+                        return ret;
+        }
+
+        /* No mismatch found.  Let the caller know the two memory
+         * areas are equal.
+         */
+        return 0;
+}
+
+/* Allocate an instance of struct kvm_cpuid2
+ *
+ * Input Args: None
+ *
+ * Output Args: None
+ *
+ * Return: A pointer to the allocated struct. The caller is responsible
+ * for freeing this struct.
+ *
+ * Since kvm_cpuid2 uses a 0-length array to allow a the size of the
+ * array to be decided at allocation time, allocation is slightly
+ * complicated. This function uses a reasonable default length for
+ * the array and performs the appropriate allocation.
+ */
+static struct kvm_cpuid2 *allocate_kvm_cpuid2(void)
+{
+        struct kvm_cpuid2 *cpuid;
+        int nent = 100;
+        size_t size;
+
+        size = sizeof(*cpuid);
+        size += nent * sizeof(struct kvm_cpuid_entry2);
+        cpuid = malloc(size);
+        if (!cpuid) {
+                perror("malloc");
+                abort();
+        }
+
+        cpuid->nent = nent;
+
+        return cpuid;
+}
+
+/* KVM Supported CPUID Get
+ *
+ * Input Args: None
+ *
+ * Output Args:
+ *
+ * Return: The supported KVM CPUID
+ *
+ * Get the guest CPUID supported by KVM.
+ */
+struct kvm_cpuid2 *kvm_get_supported_cpuid(void)
+{
+        static struct kvm_cpuid2 *cpuid;
+        int ret;
+        int kvm_fd;
+
+        if (cpuid)
+                return cpuid;
+
+        cpuid = allocate_kvm_cpuid2();
+        kvm_fd = open(KVM_DEV_PATH, O_RDONLY);
+        if (kvm_fd < 0)
+                exit(KSFT_SKIP);
+
+        ret = ioctl(kvm_fd, KVM_GET_SUPPORTED_CPUID, cpuid);
+        TEST_ASSERT(ret == 0, "KVM_GET_SUPPORTED_CPUID failed %d %d\n",
+                    ret, errno);
+
+        close(kvm_fd);
+        return cpuid;
+}
+
+/* Locate a cpuid entry.
+ *
+ * Input Args:
+ *   cpuid: The cpuid.
+ *   function: The function of the cpuid entry to find.
+ *
+ * Output Args: None
+ *
+ * Return: A pointer to the cpuid entry. Never returns NULL.
+ */
+struct kvm_cpuid_entry2 *
+kvm_get_supported_cpuid_index(uint32_t function, uint32_t index)
+{
+        struct kvm_cpuid2 *cpuid;
+        struct kvm_cpuid_entry2 *entry = NULL;
+        int i;
+
+        cpuid = kvm_get_supported_cpuid();
+        for (i = 0; i < cpuid->nent; i++) {
+                if (cpuid->entries[i].function == function &&
+                    cpuid->entries[i].index == index) {
+                        entry = &cpuid->entries[i];
+                        break;
+                }
+        }
+
+        TEST_ASSERT(entry, "Guest CPUID entry not found: (EAX=%x, ECX=%x).",
+                    function, index);
+        return entry;
+}
+
+/* VM Userspace Memory Region Add
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   backing_src - Storage source for this region.
+ *                 NULL to use anonymous memory.
+ *   guest_paddr - Starting guest physical address
+ *   slot - KVM region slot
+ *   npages - Number of physical pages
+ *   flags - KVM memory region flags (e.g. KVM_MEM_LOG_DIRTY_PAGES)
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Allocates a memory area of the number of pages specified by npages
+ * and maps it to the VM specified by vm, at a starting physical address
+ * given by guest_paddr.  The region is created with a KVM region slot
+ * given by slot, which must be unique and < KVM_MEM_SLOTS_NUM.  The
+ * region is created with the flags given by flags.
+ */
+void vm_userspace_mem_region_add(struct kvm_vm *vm,
+        enum vm_mem_backing_src_type src_type,
+        uint64_t guest_paddr, uint32_t slot, uint64_t npages,
+        uint32_t flags)
+{
+        int ret;
+        unsigned long pmem_size = 0;
+        struct userspace_mem_region *region;
+        size_t huge_page_size = KVM_UTIL_PGS_PER_HUGEPG * vm->page_size;
+
+        TEST_ASSERT((guest_paddr % vm->page_size) == 0, "Guest physical "
+                "address not on a page boundary.\n"
+                "  guest_paddr: 0x%lx vm->page_size: 0x%x",
+                guest_paddr, vm->page_size);
+        TEST_ASSERT((((guest_paddr >> vm->page_shift) + npages) - 1)
+                <= vm->max_gfn, "Physical range beyond maximum "
+                "supported physical address,\n"
+                "  guest_paddr: 0x%lx npages: 0x%lx\n"
+                "  vm->max_gfn: 0x%lx vm->page_size: 0x%x",
+                guest_paddr, npages, vm->max_gfn, vm->page_size);
+
+        /* Confirm a mem region with an overlapping address doesn't
+         * already exist.
+         */
+        region = (struct userspace_mem_region *) userspace_mem_region_find(
+                vm, guest_paddr, guest_paddr + npages * vm->page_size);
+        if (region != NULL)
+                TEST_ASSERT(false, "overlapping userspace_mem_region already "
+                        "exists\n"
+                        "  requested guest_paddr: 0x%lx npages: 0x%lx "
+                        "page_size: 0x%x\n"
+                        "  existing guest_paddr: 0x%lx size: 0x%lx",
+                        guest_paddr, npages, vm->page_size,
+                        (uint64_t) region->region.guest_phys_addr,
+                        (uint64_t) region->region.memory_size);
+
+        /* Confirm no region with the requested slot already exists. */
+        for (region = vm->userspace_mem_region_head; region;
+                region = region->next) {
+                if (region->region.slot == slot)
+                        break;
+                if ((guest_paddr <= (region->region.guest_phys_addr
+                                + region->region.memory_size))
+                        && ((guest_paddr + npages * vm->page_size)
+                                >= region->region.guest_phys_addr))
+                        break;
+        }
+        if (region != NULL)
+                TEST_ASSERT(false, "A mem region with the requested slot "
+                        "or overlapping physical memory range already exists.\n"
+                        "  requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
+                        "  existing slot: %u paddr: 0x%lx size: 0x%lx",
+                        slot, guest_paddr, npages,
+                        region->region.slot,
+                        (uint64_t) region->region.guest_phys_addr,
+                        (uint64_t) region->region.memory_size);
+
+        /* Allocate and initialize new mem region structure. */
+        region = calloc(1, sizeof(*region));
+        TEST_ASSERT(region != NULL, "Insufficient Memory");
+        region->mmap_size = npages * vm->page_size;
+
+        /* Enough memory to align up to a huge page. */
+        if (src_type == VM_MEM_SRC_ANONYMOUS_THP)
+                region->mmap_size += huge_page_size;
+        region->mmap_start = mmap(NULL, region->mmap_size,
+                                  PROT_READ | PROT_WRITE,
+                                  MAP_PRIVATE | MAP_ANONYMOUS
+                                  | (src_type == VM_MEM_SRC_ANONYMOUS_HUGETLB ? MAP_HUGETLB : 0),
+                                  -1, 0);
+        TEST_ASSERT(region->mmap_start != MAP_FAILED,
+                    "test_malloc failed, mmap_start: %p errno: %i",
+                    region->mmap_start, errno);
+
+        /* Align THP allocation up to start of a huge page. */
+        region->host_mem = align(region->mmap_start,
+                                 src_type == VM_MEM_SRC_ANONYMOUS_THP ?  huge_page_size : 1);
+
+        /* As needed perform madvise */
+        if (src_type == VM_MEM_SRC_ANONYMOUS || src_type == VM_MEM_SRC_ANONYMOUS_THP) {
+                ret = madvise(region->host_mem, npages * vm->page_size,
+                             src_type == VM_MEM_SRC_ANONYMOUS ? MADV_NOHUGEPAGE : MADV_HUGEPAGE);
+                TEST_ASSERT(ret == 0, "madvise failed,\n"
+                            "  addr: %p\n"
+                            "  length: 0x%lx\n"
+                            "  src_type: %x",
+                            region->host_mem, npages * vm->page_size, src_type);
+        }
+
+        region->unused_phy_pages = sparsebit_alloc();
+        sparsebit_set_num(region->unused_phy_pages,
+                guest_paddr >> vm->page_shift, npages);
+        region->region.slot = slot;
+        region->region.flags = flags;
+        region->region.guest_phys_addr = guest_paddr;
+        region->region.memory_size = npages * vm->page_size;
+        region->region.userspace_addr = (uintptr_t) region->host_mem;
+        ret = ioctl(vm->fd, KVM_SET_USER_MEMORY_REGION, &region->region);
+        TEST_ASSERT(ret == 0, "KVM_SET_USER_MEMORY_REGION IOCTL failed,\n"
+                "  rc: %i errno: %i\n"
+                "  slot: %u flags: 0x%x\n"
+                "  guest_phys_addr: 0x%lx size: 0x%lx",
+                ret, errno, slot, flags,
+                guest_paddr, (uint64_t) region->region.memory_size);
+
+        /* Add to linked-list of memory regions. */
+        if (vm->userspace_mem_region_head)
+                vm->userspace_mem_region_head->prev = region;
+        region->next = vm->userspace_mem_region_head;
+        vm->userspace_mem_region_head = region;
+}
+
+/* Memslot to region
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   memslot - KVM memory slot ID
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to memory region structure that describe memory region
+ *   using kvm memory slot ID given by memslot.  TEST_ASSERT failure
+ *   on error (e.g. currently no memory region using memslot as a KVM
+ *   memory slot ID).
+ */
+static struct userspace_mem_region *memslot2region(struct kvm_vm *vm,
+        uint32_t memslot)
+{
+        struct userspace_mem_region *region;
+
+        for (region = vm->userspace_mem_region_head; region;
+                region = region->next) {
+                if (region->region.slot == memslot)
+                        break;
+        }
+        if (region == NULL) {
+                fprintf(stderr, "No mem region with the requested slot found,\n"
+                        "  requested slot: %u\n", memslot);
+                fputs("---- vm dump ----\n", stderr);
+                vm_dump(stderr, vm, 2);
+                TEST_ASSERT(false, "Mem region not found");
+        }
+
+        return region;
+}
+
+/* VM Memory Region Flags Set
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   flags - Starting guest physical address
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Sets the flags of the memory region specified by the value of slot,
+ * to the values given by flags.
+ */
+void vm_mem_region_set_flags(struct kvm_vm *vm, uint32_t slot, uint32_t flags)
+{
+        int ret;
+        struct userspace_mem_region *region;
+
+        /* Locate memory region. */
+        region = memslot2region(vm, slot);
+
+        region->region.flags = flags;
+
+        ret = ioctl(vm->fd, KVM_SET_USER_MEMORY_REGION, &region->region);
+
+        TEST_ASSERT(ret == 0, "KVM_SET_USER_MEMORY_REGION IOCTL failed,\n"
+                "  rc: %i errno: %i slot: %u flags: 0x%x",
+                ret, errno, slot, flags);
+}
+
+/* VCPU mmap Size
+ *
+ * Input Args: None
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Size of VCPU state
+ *
+ * Returns the size of the structure pointed to by the return value
+ * of vcpu_state().
+ */
+static int vcpu_mmap_sz(void)
+{
+        int dev_fd, ret;
+
+        dev_fd = open(KVM_DEV_PATH, O_RDONLY);
+        if (dev_fd < 0)
+                exit(KSFT_SKIP);
+
+        ret = ioctl(dev_fd, KVM_GET_VCPU_MMAP_SIZE, NULL);
+        TEST_ASSERT(ret >= sizeof(struct kvm_run),
+                "%s KVM_GET_VCPU_MMAP_SIZE ioctl failed, rc: %i errno: %i",
+                __func__, ret, errno);
+
+        close(dev_fd);
+
+        return ret;
+}
+
+/* VM VCPU Add
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Creates and adds to the VM specified by vm and virtual CPU with
+ * the ID given by vcpuid.
+ */
+void vm_vcpu_add(struct kvm_vm *vm, uint32_t vcpuid)
+{
+        struct vcpu *vcpu;
+
+        /* Confirm a vcpu with the specified id doesn't already exist. */
+        vcpu = vcpu_find(vm, vcpuid);
+        if (vcpu != NULL)
+                TEST_ASSERT(false, "vcpu with the specified id "
+                        "already exists,\n"
+                        "  requested vcpuid: %u\n"
+                        "  existing vcpuid: %u state: %p",
+                        vcpuid, vcpu->id, vcpu->state);
+
+        /* Allocate and initialize new vcpu structure. */
+        vcpu = calloc(1, sizeof(*vcpu));
+        TEST_ASSERT(vcpu != NULL, "Insufficient Memory");
+        vcpu->id = vcpuid;
+        vcpu->fd = ioctl(vm->fd, KVM_CREATE_VCPU, vcpuid);
+        TEST_ASSERT(vcpu->fd >= 0, "KVM_CREATE_VCPU failed, rc: %i errno: %i",
+                vcpu->fd, errno);
+
+        TEST_ASSERT(vcpu_mmap_sz() >= sizeof(*vcpu->state), "vcpu mmap size "
+                "smaller than expected, vcpu_mmap_sz: %i expected_min: %zi",
+                vcpu_mmap_sz(), sizeof(*vcpu->state));
+        vcpu->state = (struct kvm_run *) mmap(NULL, sizeof(*vcpu->state),
+                PROT_READ | PROT_WRITE, MAP_SHARED, vcpu->fd, 0);
+        TEST_ASSERT(vcpu->state != MAP_FAILED, "mmap vcpu_state failed, "
+                "vcpu id: %u errno: %i", vcpuid, errno);
+
+        /* Add to linked-list of VCPUs. */
+        if (vm->vcpu_head)
+                vm->vcpu_head->prev = vcpu;
+        vcpu->next = vm->vcpu_head;
+        vm->vcpu_head = vcpu;
+
+        vcpu_setup(vm, vcpuid);
+}
+
+/* VM Virtual Address Unused Gap
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   sz - Size (bytes)
+ *   vaddr_min - Minimum Virtual Address
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Lowest virtual address at or below vaddr_min, with at least
+ *   sz unused bytes.  TEST_ASSERT failure if no area of at least
+ *   size sz is available.
+ *
+ * Within the VM specified by vm, locates the lowest starting virtual
+ * address >= vaddr_min, that has at least sz unallocated bytes.  A
+ * TEST_ASSERT failure occurs for invalid input or no area of at least
+ * sz unallocated bytes >= vaddr_min is available.
+ */
+static vm_vaddr_t vm_vaddr_unused_gap(struct kvm_vm *vm, size_t sz,
+        vm_vaddr_t vaddr_min)
+{
+        uint64_t pages = (sz + vm->page_size - 1) >> vm->page_shift;
+
+        /* Determine lowest permitted virtual page index. */
+        uint64_t pgidx_start = (vaddr_min + vm->page_size - 1) >> vm->page_shift;
+        if ((pgidx_start * vm->page_size) < vaddr_min)
+                        goto no_va_found;
+
+        /* Loop over section with enough valid virtual page indexes. */
+        if (!sparsebit_is_set_num(vm->vpages_valid,
+                pgidx_start, pages))
+                pgidx_start = sparsebit_next_set_num(vm->vpages_valid,
+                        pgidx_start, pages);
+        do {
+                /*
+                 * Are there enough unused virtual pages available at
+                 * the currently proposed starting virtual page index.
+                 * If not, adjust proposed starting index to next
+                 * possible.
+                 */
+                if (sparsebit_is_clear_num(vm->vpages_mapped,
+                        pgidx_start, pages))
+                        goto va_found;
+                pgidx_start = sparsebit_next_clear_num(vm->vpages_mapped,
+                        pgidx_start, pages);
+                if (pgidx_start == 0)
+                        goto no_va_found;
+
+                /*
+                 * If needed, adjust proposed starting virtual address,
+                 * to next range of valid virtual addresses.
+                 */
+                if (!sparsebit_is_set_num(vm->vpages_valid,
+                        pgidx_start, pages)) {
+                        pgidx_start = sparsebit_next_set_num(
+                                vm->vpages_valid, pgidx_start, pages);
+                        if (pgidx_start == 0)
+                                goto no_va_found;
+                }
+        } while (pgidx_start != 0);
+
+no_va_found:
+        TEST_ASSERT(false, "No vaddr of specified pages available, "
+                "pages: 0x%lx", pages);
+
+        /* NOT REACHED */
+        return -1;
+
+va_found:
+        TEST_ASSERT(sparsebit_is_set_num(vm->vpages_valid,
+                pgidx_start, pages),
+                "Unexpected, invalid virtual page index range,\n"
+                "  pgidx_start: 0x%lx\n"
+                "  pages: 0x%lx",
+                pgidx_start, pages);
+        TEST_ASSERT(sparsebit_is_clear_num(vm->vpages_mapped,
+                pgidx_start, pages),
+                "Unexpected, pages already mapped,\n"
+                "  pgidx_start: 0x%lx\n"
+                "  pages: 0x%lx",
+                pgidx_start, pages);
+
+        return pgidx_start * vm->page_size;
+}
+
+/* VM Virtual Address Allocate
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   sz - Size in bytes
+ *   vaddr_min - Minimum starting virtual address
+ *   data_memslot - Memory region slot for data pages
+ *   pgd_memslot - Memory region slot for new virtual translation tables
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Starting guest virtual address
+ *
+ * Allocates at least sz bytes within the virtual address space of the vm
+ * given by vm.  The allocated bytes are mapped to a virtual address >=
+ * the address given by vaddr_min.  Note that each allocation uses a
+ * a unique set of pages, with the minimum real allocation being at least
+ * a page.
+ */
+vm_vaddr_t vm_vaddr_alloc(struct kvm_vm *vm, size_t sz, vm_vaddr_t vaddr_min,
+        uint32_t data_memslot, uint32_t pgd_memslot)
+{
+        uint64_t pages = (sz >> vm->page_shift) + ((sz % vm->page_size) != 0);
+
+        virt_pgd_alloc(vm, pgd_memslot);
+
+        /* Find an unused range of virtual page addresses of at least
+         * pages in length.
+         */
+        vm_vaddr_t vaddr_start = vm_vaddr_unused_gap(vm, sz, vaddr_min);
+
+        /* Map the virtual pages. */
+        for (vm_vaddr_t vaddr = vaddr_start; pages > 0;
+                pages--, vaddr += vm->page_size) {
+                vm_paddr_t paddr;
+
+                paddr = vm_phy_page_alloc(vm, KVM_UTIL_MIN_PADDR, data_memslot);
+
+                virt_pg_map(vm, vaddr, paddr, pgd_memslot);
+
+                sparsebit_set(vm->vpages_mapped,
+                        vaddr >> vm->page_shift);
+        }
+
+        return vaddr_start;
+}
+
+/* Address VM Physical to Host Virtual
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   gpa - VM physical address
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Equivalent host virtual address
+ *
+ * Locates the memory region containing the VM physical address given
+ * by gpa, within the VM given by vm.  When found, the host virtual
+ * address providing the memory to the vm physical address is returned.
+ * A TEST_ASSERT failure occurs if no region containing gpa exists.
+ */
+void *addr_gpa2hva(struct kvm_vm *vm, vm_paddr_t gpa)
+{
+        struct userspace_mem_region *region;
+        for (region = vm->userspace_mem_region_head; region;
+             region = region->next) {
+                if ((gpa >= region->region.guest_phys_addr)
+                        && (gpa <= (region->region.guest_phys_addr
+                                + region->region.memory_size - 1)))
+                        return (void *) ((uintptr_t) region->host_mem
+                                + (gpa - region->region.guest_phys_addr));
+        }
+
+        TEST_ASSERT(false, "No vm physical memory at 0x%lx", gpa);
+        return NULL;
+}
+
+/* Address Host Virtual to VM Physical
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   hva - Host virtual address
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Equivalent VM physical address
+ *
+ * Locates the memory region containing the host virtual address given
+ * by hva, within the VM given by vm.  When found, the equivalent
+ * VM physical address is returned. A TEST_ASSERT failure occurs if no
+ * region containing hva exists.
+ */
+vm_paddr_t addr_hva2gpa(struct kvm_vm *vm, void *hva)
+{
+        struct userspace_mem_region *region;
+        for (region = vm->userspace_mem_region_head; region;
+             region = region->next) {
+                if ((hva >= region->host_mem)
+                        && (hva <= (region->host_mem
+                                + region->region.memory_size - 1)))
+                        return (vm_paddr_t) ((uintptr_t)
+                                region->region.guest_phys_addr
+                                + (hva - (uintptr_t) region->host_mem));
+        }
+
+        TEST_ASSERT(false, "No mapping to a guest physical address, "
+                "hva: %p", hva);
+        return -1;
+}
+
+/* VM Create IRQ Chip
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Creates an interrupt controller chip for the VM specified by vm.
+ */
+void vm_create_irqchip(struct kvm_vm *vm)
+{
+        int ret;
+
+        ret = ioctl(vm->fd, KVM_CREATE_IRQCHIP, 0);
+        TEST_ASSERT(ret == 0, "KVM_CREATE_IRQCHIP IOCTL failed, "
+                "rc: %i errno: %i", ret, errno);
+}
+
+/* VM VCPU State
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to structure that describes the state of the VCPU.
+ *
+ * Locates and returns a pointer to a structure that describes the
+ * state of the VCPU with the given vcpuid.
+ */
+struct kvm_run *vcpu_state(struct kvm_vm *vm, uint32_t vcpuid)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        return vcpu->state;
+}
+
+/* VM VCPU Run
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Switch to executing the code for the VCPU given by vcpuid, within the VM
+ * given by vm.
+ */
+void vcpu_run(struct kvm_vm *vm, uint32_t vcpuid)
+{
+        int ret = _vcpu_run(vm, vcpuid);
+        TEST_ASSERT(ret == 0, "KVM_RUN IOCTL failed, "
+                "rc: %i errno: %i", ret, errno);
+}
+
+int _vcpu_run(struct kvm_vm *vm, uint32_t vcpuid)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int rc;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+        do {
+                rc = ioctl(vcpu->fd, KVM_RUN, NULL);
+        } while (rc == -1 && errno == EINTR);
+        return rc;
+}
+
+/* VM VCPU Set MP State
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *   mp_state - mp_state to be set
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Sets the MP state of the VCPU given by vcpuid, to the state given
+ * by mp_state.
+ */
+void vcpu_set_mp_state(struct kvm_vm *vm, uint32_t vcpuid,
+        struct kvm_mp_state *mp_state)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        ret = ioctl(vcpu->fd, KVM_SET_MP_STATE, mp_state);
+        TEST_ASSERT(ret == 0, "KVM_SET_MP_STATE IOCTL failed, "
+                "rc: %i errno: %i", ret, errno);
+}
+
+/* VM VCPU Regs Get
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args:
+ *   regs - current state of VCPU regs
+ *
+ * Return: None
+ *
+ * Obtains the current register state for the VCPU specified by vcpuid
+ * and stores it at the location given by regs.
+ */
+void vcpu_regs_get(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_regs *regs)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        /* Get the regs. */
+        ret = ioctl(vcpu->fd, KVM_GET_REGS, regs);
+        TEST_ASSERT(ret == 0, "KVM_GET_REGS failed, rc: %i errno: %i",
+                ret, errno);
+}
+
+/* VM VCPU Regs Set
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *   regs - Values to set VCPU regs to
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Sets the regs of the VCPU specified by vcpuid to the values
+ * given by regs.
+ */
+void vcpu_regs_set(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_regs *regs)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        /* Set the regs. */
+        ret = ioctl(vcpu->fd, KVM_SET_REGS, regs);
+        TEST_ASSERT(ret == 0, "KVM_SET_REGS failed, rc: %i errno: %i",
+                ret, errno);
+}
+
+void vcpu_events_get(struct kvm_vm *vm, uint32_t vcpuid,
+                          struct kvm_vcpu_events *events)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        /* Get the regs. */
+        ret = ioctl(vcpu->fd, KVM_GET_VCPU_EVENTS, events);
+        TEST_ASSERT(ret == 0, "KVM_GET_VCPU_EVENTS, failed, rc: %i errno: %i",
+                ret, errno);
+}
+
+void vcpu_events_set(struct kvm_vm *vm, uint32_t vcpuid,
+                          struct kvm_vcpu_events *events)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        /* Set the regs. */
+        ret = ioctl(vcpu->fd, KVM_SET_VCPU_EVENTS, events);
+        TEST_ASSERT(ret == 0, "KVM_SET_VCPU_EVENTS, failed, rc: %i errno: %i",
+                ret, errno);
+}
+
+/* VM VCPU Args Set
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *   num - number of arguments
+ *   ... - arguments, each of type uint64_t
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Sets the first num function input arguments to the values
+ * given as variable args.  Each of the variable args is expected to
+ * be of type uint64_t.
+ */
+void vcpu_args_set(struct kvm_vm *vm, uint32_t vcpuid, unsigned int num, ...)
+{
+        va_list ap;
+        struct kvm_regs regs;
+
+        TEST_ASSERT(num >= 1 && num <= 6, "Unsupported number of args,\n"
+                    "  num: %u\n",
+                    num);
+
+        va_start(ap, num);
+        vcpu_regs_get(vm, vcpuid, &regs);
+
+        if (num >= 1)
+                regs.rdi = va_arg(ap, uint64_t);
+
+        if (num >= 2)
+                regs.rsi = va_arg(ap, uint64_t);
+
+        if (num >= 3)
+                regs.rdx = va_arg(ap, uint64_t);
+
+        if (num >= 4)
+                regs.rcx = va_arg(ap, uint64_t);
+
+        if (num >= 5)
+                regs.r8 = va_arg(ap, uint64_t);
+
+        if (num >= 6)
+                regs.r9 = va_arg(ap, uint64_t);
+
+        vcpu_regs_set(vm, vcpuid, &regs);
+        va_end(ap);
+}
+
+/* VM VCPU System Regs Get
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *
+ * Output Args:
+ *   sregs - current state of VCPU system regs
+ *
+ * Return: None
+ *
+ * Obtains the current system register state for the VCPU specified by
+ * vcpuid and stores it at the location given by sregs.
+ */
+void vcpu_sregs_get(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_sregs *sregs)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        /* Get the regs. */
+        /* Get the regs. */
+        ret = ioctl(vcpu->fd, KVM_GET_SREGS, sregs);
+        TEST_ASSERT(ret == 0, "KVM_GET_SREGS failed, rc: %i errno: %i",
+                ret, errno);
+}
+
+/* VM VCPU System Regs Set
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *   sregs - Values to set VCPU system regs to
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Sets the system regs of the VCPU specified by vcpuid to the values
+ * given by sregs.
+ */
+void vcpu_sregs_set(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_sregs *sregs)
+{
+        int ret = _vcpu_sregs_set(vm, vcpuid, sregs);
+        TEST_ASSERT(ret == 0, "KVM_RUN IOCTL failed, "
+                "rc: %i errno: %i", ret, errno);
+}
+
+int _vcpu_sregs_set(struct kvm_vm *vm,
+        uint32_t vcpuid, struct kvm_sregs *sregs)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        /* Get the regs. */
+        return ioctl(vcpu->fd, KVM_SET_SREGS, sregs);
+}
+
+/* VCPU Ioctl
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *   cmd - Ioctl number
+ *   arg - Argument to pass to the ioctl
+ *
+ * Return: None
+ *
+ * Issues an arbitrary ioctl on a VCPU fd.
+ */
+void vcpu_ioctl(struct kvm_vm *vm,
+        uint32_t vcpuid, unsigned long cmd, void *arg)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        ret = ioctl(vcpu->fd, cmd, arg);
+        TEST_ASSERT(ret == 0, "vcpu ioctl %lu failed, rc: %i errno: %i (%s)",
+                cmd, ret, errno, strerror(errno));
+}
+
+/* VM Ioctl
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   cmd - Ioctl number
+ *   arg - Argument to pass to the ioctl
+ *
+ * Return: None
+ *
+ * Issues an arbitrary ioctl on a VM fd.
+ */
+void vm_ioctl(struct kvm_vm *vm, unsigned long cmd, void *arg)
+{
+        int ret;
+
+        ret = ioctl(vm->fd, cmd, arg);
+        TEST_ASSERT(ret == 0, "vm ioctl %lu failed, rc: %i errno: %i (%s)",
+                cmd, ret, errno, strerror(errno));
+}
+
+/* VM Dump
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   indent - Left margin indent amount
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps the current state of the VM given by vm, to the FILE stream
+ * given by stream.
+ */
+void vm_dump(FILE *stream, struct kvm_vm *vm, uint8_t indent)
+{
+        struct userspace_mem_region *region;
+        struct vcpu *vcpu;
+
+        fprintf(stream, "%*smode: 0x%x\n", indent, "", vm->mode);
+        fprintf(stream, "%*sfd: %i\n", indent, "", vm->fd);
+        fprintf(stream, "%*spage_size: 0x%x\n", indent, "", vm->page_size);
+        fprintf(stream, "%*sMem Regions:\n", indent, "");
+        for (region = vm->userspace_mem_region_head; region;
+                region = region->next) {
+                fprintf(stream, "%*sguest_phys: 0x%lx size: 0x%lx "
+                        "host_virt: %p\n", indent + 2, "",
+                        (uint64_t) region->region.guest_phys_addr,
+                        (uint64_t) region->region.memory_size,
+                        region->host_mem);
+                fprintf(stream, "%*sunused_phy_pages: ", indent + 2, "");
+                sparsebit_dump(stream, region->unused_phy_pages, 0);
+        }
+        fprintf(stream, "%*sMapped Virtual Pages:\n", indent, "");
+        sparsebit_dump(stream, vm->vpages_mapped, indent + 2);
+        fprintf(stream, "%*spgd_created: %u\n", indent, "",
+                vm->pgd_created);
+        if (vm->pgd_created) {
+                fprintf(stream, "%*sVirtual Translation Tables:\n",
+                        indent + 2, "");
+                virt_dump(stream, vm, indent + 4);
+        }
+        fprintf(stream, "%*sVCPUs:\n", indent, "");
+        for (vcpu = vm->vcpu_head; vcpu; vcpu = vcpu->next)
+                vcpu_dump(stream, vm, vcpu->id, indent + 2);
+}
+
+/* VM VCPU Dump
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU ID
+ *   indent - Left margin indent amount
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps the current state of the VCPU specified by vcpuid, within the VM
+ * given by vm, to the FILE stream given by stream.
+ */
+void vcpu_dump(FILE *stream, struct kvm_vm *vm,
+        uint32_t vcpuid, uint8_t indent)
+{
+                struct kvm_regs regs;
+                struct kvm_sregs sregs;
+
+                fprintf(stream, "%*scpuid: %u\n", indent, "", vcpuid);
+
+                fprintf(stream, "%*sregs:\n", indent + 2, "");
+                vcpu_regs_get(vm, vcpuid, &regs);
+                regs_dump(stream, &regs, indent + 4);
+
+                fprintf(stream, "%*ssregs:\n", indent + 2, "");
+                vcpu_sregs_get(vm, vcpuid, &sregs);
+                sregs_dump(stream, &sregs, indent + 4);
+}
+
+/* Known KVM exit reasons */
+static struct exit_reason {
+        unsigned int reason;
+        const char *name;
+} exit_reasons_known[] = {
+        {KVM_EXIT_UNKNOWN, "UNKNOWN"},
+        {KVM_EXIT_EXCEPTION, "EXCEPTION"},
+        {KVM_EXIT_IO, "IO"},
+        {KVM_EXIT_HYPERCALL, "HYPERCALL"},
+        {KVM_EXIT_DEBUG, "DEBUG"},
+        {KVM_EXIT_HLT, "HLT"},
+        {KVM_EXIT_MMIO, "MMIO"},
+        {KVM_EXIT_IRQ_WINDOW_OPEN, "IRQ_WINDOW_OPEN"},
+        {KVM_EXIT_SHUTDOWN, "SHUTDOWN"},
+        {KVM_EXIT_FAIL_ENTRY, "FAIL_ENTRY"},
+        {KVM_EXIT_INTR, "INTR"},
+        {KVM_EXIT_SET_TPR, "SET_TPR"},
+        {KVM_EXIT_TPR_ACCESS, "TPR_ACCESS"},
+        {KVM_EXIT_S390_SIEIC, "S390_SIEIC"},
+        {KVM_EXIT_S390_RESET, "S390_RESET"},
+        {KVM_EXIT_DCR, "DCR"},
+        {KVM_EXIT_NMI, "NMI"},
+        {KVM_EXIT_INTERNAL_ERROR, "INTERNAL_ERROR"},
+        {KVM_EXIT_OSI, "OSI"},
+        {KVM_EXIT_PAPR_HCALL, "PAPR_HCALL"},
+#ifdef KVM_EXIT_MEMORY_NOT_PRESENT
+        {KVM_EXIT_MEMORY_NOT_PRESENT, "MEMORY_NOT_PRESENT"},
+#endif
+};
+
+/* Exit Reason String
+ *
+ * Input Args:
+ *   exit_reason - Exit reason
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Constant string pointer describing the exit reason.
+ *
+ * Locates and returns a constant string that describes the KVM exit
+ * reason given by exit_reason.  If no such string is found, a constant
+ * string of "Unknown" is returned.
+ */
+const char *exit_reason_str(unsigned int exit_reason)
+{
+        unsigned int n1;
+
+        for (n1 = 0; n1 < ARRAY_SIZE(exit_reasons_known); n1++) {
+                if (exit_reason == exit_reasons_known[n1].reason)
+                        return exit_reasons_known[n1].name;
+        }
+
+        return "Unknown";
+}
+
+/* Physical Page Allocate
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   paddr_min - Physical address minimum
+ *   memslot - Memory region to allocate page from
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Starting physical address
+ *
+ * Within the VM specified by vm, locates an available physical page
+ * at or above paddr_min.  If found, the page is marked as in use
+ * and its address is returned.  A TEST_ASSERT failure occurs if no
+ * page is available at or above paddr_min.
+ */
+vm_paddr_t vm_phy_page_alloc(struct kvm_vm *vm,
+        vm_paddr_t paddr_min, uint32_t memslot)
+{
+        struct userspace_mem_region *region;
+        sparsebit_idx_t pg;
+
+        TEST_ASSERT((paddr_min % vm->page_size) == 0, "Min physical address "
+                "not divisible by page size.\n"
+                "  paddr_min: 0x%lx page_size: 0x%x",
+                paddr_min, vm->page_size);
+
+        /* Locate memory region. */
+        region = memslot2region(vm, memslot);
+
+        /* Locate next available physical page at or above paddr_min. */
+        pg = paddr_min >> vm->page_shift;
+
+        if (!sparsebit_is_set(region->unused_phy_pages, pg)) {
+                pg = sparsebit_next_set(region->unused_phy_pages, pg);
+                if (pg == 0) {
+                        fprintf(stderr, "No guest physical page available, "
+                                "paddr_min: 0x%lx page_size: 0x%x memslot: %u",
+                                paddr_min, vm->page_size, memslot);
+                        fputs("---- vm dump ----\n", stderr);
+                        vm_dump(stderr, vm, 2);
+                        abort();
+                }
+        }
+
+        /* Specify page as in use and return its address. */
+        sparsebit_clear(region->unused_phy_pages, pg);
+
+        return pg * vm->page_size;
+}
+
+/* Address Guest Virtual to Host Virtual
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   gva - VM virtual address
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Equivalent host virtual address
+ */
+void *addr_gva2hva(struct kvm_vm *vm, vm_vaddr_t gva)
+{
+        return addr_gpa2hva(vm, addr_gva2gpa(vm, gva));
+}
diff --git a/tools/testing/selftests/kvm/lib/kvm_util_internal.h b/tools/testing/selftests/kvm/lib/kvm_util_internal.h
new file mode 100644
index 000000000000..a0bd1980c81c
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/kvm_util_internal.h
@@ -0,0 +1,67 @@
+/*
+ * tools/testing/selftests/kvm/lib/kvm_util.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#ifndef KVM_UTIL_INTERNAL_H
+#define KVM_UTIL_INTERNAL_H 1
+
+#include "sparsebit.h"
+
+#ifndef BITS_PER_BYTE
+#define BITS_PER_BYTE           8
+#endif
+
+#ifndef BITS_PER_LONG
+#define BITS_PER_LONG (BITS_PER_BYTE * sizeof(long))
+#endif
+
+#define DIV_ROUND_UP(n, d)      (((n) + (d) - 1) / (d))
+#define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_LONG)
+
+/* Concrete definition of struct kvm_vm. */
+struct userspace_mem_region {
+        struct userspace_mem_region *next, *prev;
+        struct kvm_userspace_memory_region region;
+        struct sparsebit *unused_phy_pages;
+        int fd;
+        off_t offset;
+        void *host_mem;
+        void *mmap_start;
+        size_t mmap_size;
+};
+
+struct vcpu {
+        struct vcpu *next, *prev;
+        uint32_t id;
+        int fd;
+        struct kvm_run *state;
+};
+
+struct kvm_vm {
+        int mode;
+        int fd;
+        unsigned int page_size;
+        unsigned int page_shift;
+        uint64_t max_gfn;
+        struct vcpu *vcpu_head;
+        struct userspace_mem_region *userspace_mem_region_head;
+        struct sparsebit *vpages_valid;
+        struct sparsebit *vpages_mapped;
+        bool pgd_created;
+        vm_paddr_t pgd;
+};
+
+struct vcpu *vcpu_find(struct kvm_vm *vm,
+        uint32_t vcpuid);
+void vcpu_setup(struct kvm_vm *vm, int vcpuid);
+void virt_dump(FILE *stream, struct kvm_vm *vm, uint8_t indent);
+void regs_dump(FILE *stream, struct kvm_regs *regs,
+        uint8_t indent);
+void sregs_dump(FILE *stream, struct kvm_sregs *sregs,
+        uint8_t indent);
+
+#endif
diff --git a/tools/testing/selftests/kvm/lib/sparsebit.c b/tools/testing/selftests/kvm/lib/sparsebit.c
new file mode 100644
index 000000000000..b132bc95d183
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/sparsebit.c
@@ -0,0 +1,2087 @@
+/*
+ * Sparse bit array
+ *
+ * Copyright (C) 2018, Google LLC.
+ * Copyright (C) 2018, Red Hat, Inc. (code style cleanup and fuzzing driver)
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ * This library provides functions to support a memory efficient bit array,
+ * with an index size of 2^64.  A sparsebit array is allocated through
+ * the use sparsebit_alloc() and free'd via sparsebit_free(),
+ * such as in the following:
+ *
+ *   struct sparsebit *s;
+ *   s = sparsebit_alloc();
+ *   sparsebit_free(&s);
+ *
+ * The struct sparsebit type resolves down to a struct sparsebit.
+ * Note that, sparsebit_free() takes a pointer to the sparsebit
+ * structure.  This is so that sparsebit_free() is able to poison
+ * the pointer (e.g. set it to NULL) to the struct sparsebit before
+ * returning to the caller.
+ *
+ * Between the return of sparsebit_alloc() and the call of
+ * sparsebit_free(), there are multiple query and modifying operations
+ * that can be performed on the allocated sparsebit array.  All of
+ * these operations take as a parameter the value returned from
+ * sparsebit_alloc() and most also take a bit index.  Frequently
+ * used routines include:
+ *
+ *  ---- Query Operations
+ *  sparsebit_is_set(s, idx)
+ *  sparsebit_is_clear(s, idx)
+ *  sparsebit_any_set(s)
+ *  sparsebit_first_set(s)
+ *  sparsebit_next_set(s, prev_idx)
+ *
+ *  ---- Modifying Operations
+ *  sparsebit_set(s, idx)
+ *  sparsebit_clear(s, idx)
+ *  sparsebit_set_num(s, idx, num);
+ *  sparsebit_clear_num(s, idx, num);
+ *
+ * A common operation, is to itterate over all the bits set in a test
+ * sparsebit array.  This can be done via code with the following structure:
+ *
+ *   sparsebit_idx_t idx;
+ *   if (sparsebit_any_set(s)) {
+ *     idx = sparsebit_first_set(s);
+ *     do {
+ *       ...
+ *       idx = sparsebit_next_set(s, idx);
+ *     } while (idx != 0);
+ *   }
+ *
+ * The index of the first bit set needs to be obtained via
+ * sparsebit_first_set(), because sparsebit_next_set(), needs
+ * the index of the previously set.  The sparsebit_idx_t type is
+ * unsigned, so there is no previous index before 0 that is available.
+ * Also, the call to sparsebit_first_set() is not made unless there
+ * is at least 1 bit in the array set.  This is because sparsebit_first_set()
+ * aborts if sparsebit_first_set() is called with no bits set.
+ * It is the callers responsibility to assure that the
+ * sparsebit array has at least a single bit set before calling
+ * sparsebit_first_set().
+ *
+ * ==== Implementation Overview ====
+ * For the most part the internal implementation of sparsebit is
+ * opaque to the caller.  One important implementation detail that the
+ * caller may need to be aware of is the spatial complexity of the
+ * implementation.  This implementation of a sparsebit array is not
+ * only sparse, in that it uses memory proportional to the number of bits
+ * set.  It is also efficient in memory usage when most of the bits are
+ * set.
+ *
+ * At a high-level the state of the bit settings are maintained through
+ * the use of a binary-search tree, where each node contains at least
+ * the following members:
+ *
+ *   typedef uint64_t sparsebit_idx_t;
+ *   typedef uint64_t sparsebit_num_t;
+ *
+ *   sparsebit_idx_t idx;
+ *   uint32_t mask;
+ *   sparsebit_num_t num_after;
+ *
+ * The idx member contains the bit index of the first bit described by this
+ * node, while the mask member stores the setting of the first 32-bits.
+ * The setting of the bit at idx + n, where 0 <= n < 32, is located in the
+ * mask member at 1 << n.
+ *
+ * Nodes are sorted by idx and the bits described by two nodes will never
+ * overlap. The idx member is always aligned to the mask size, i.e. a
+ * multiple of 32.
+ *
+ * Beyond a typical implementation, the nodes in this implementation also
+ * contains a member named num_after.  The num_after member holds the
+ * number of bits immediately after the mask bits that are contiguously set.
+ * The use of the num_after member allows this implementation to efficiently
+ * represent cases where most bits are set.  For example, the case of all
+ * but the last two bits set, is represented by the following two nodes:
+ *
+ *   node 0 - idx: 0x0 mask: 0xffffffff num_after: 0xffffffffffffffc0
+ *   node 1 - idx: 0xffffffffffffffe0 mask: 0x3fffffff num_after: 0
+ *
+ * ==== Invariants ====
+ * This implementation usses the following invariants:
+ *
+ *   + Node are only used to represent bits that are set.
+ *     Nodes with a mask of 0 and num_after of 0 are not allowed.
+ *
+ *   + Sum of bits set in all the nodes is equal to the value of
+ *     the struct sparsebit_pvt num_set member.
+ *
+ *   + The setting of at least one bit is always described in a nodes
+ *     mask (mask >= 1).
+ *
+ *   + A node with all mask bits set only occurs when the last bit
+ *     described by the previous node is not equal to this nodes
+ *     starting index - 1.  All such occurences of this condition are
+ *     avoided by moving the setting of the nodes mask bits into
+ *     the previous nodes num_after setting.
+ *
+ *   + Node starting index is evenly divisible by the number of bits
+ *     within a nodes mask member.
+ *
+ *   + Nodes never represent a range of bits that wrap around the
+ *     highest supported index.
+ *
+ *      (idx + MASK_BITS + num_after - 1) <= ((sparsebit_idx_t) 0) - 1)
+ *
+ *     As a consequence of the above, the num_after member of a node
+ *     will always be <=:
+ *
+ *       maximum_index - nodes_starting_index - number_of_mask_bits
+ *
+ *   + Nodes within the binary search tree are sorted based on each
+ *     nodes starting index.
+ *
+ *   + The range of bits described by any two nodes do not overlap.  The
+ *     range of bits described by a single node is:
+ *
+ *       start: node->idx
+ *       end (inclusive): node->idx + MASK_BITS + node->num_after - 1;
+ *
+ * Note, at times these invariants are temporarily violated for a
+ * specific portion of the code.  For example, when setting a mask
+ * bit, there is a small delay between when the mask bit is set and the
+ * value in the struct sparsebit_pvt num_set member is updated.  Other
+ * temporary violations occur when node_split() is called with a specified
+ * index and assures that a node where its mask represents the bit
+ * at the specified index exists.  At times to do this node_split()
+ * must split an existing node into two nodes or create a node that
+ * has no bits set.  Such temporary violations must be corrected before
+ * returning to the caller.  These corrections are typically performed
+ * by the local function node_reduce().
+ */
+
+#include "test_util.h"
+#include "sparsebit.h"
+#include <limits.h>
+#include <assert.h>
+
+#define DUMP_LINE_MAX 100 /* Does not include indent amount */
+
+typedef uint32_t mask_t;
+#define MASK_BITS (sizeof(mask_t) * CHAR_BIT)
+
+struct node {
+        struct node *parent;
+        struct node *left;
+        struct node *right;
+        sparsebit_idx_t idx; /* index of least-significant bit in mask */
+        sparsebit_num_t num_after; /* num contiguously set after mask */
+        mask_t mask;
+};
+
+struct sparsebit {
+        /*
+         * Points to root node of the binary search
+         * tree.  Equal to NULL when no bits are set in
+         * the entire sparsebit array.
+         */
+        struct node *root;
+
+        /*
+         * A redundant count of the total number of bits set.  Used for
+         * diagnostic purposes and to change the time complexity of
+         * sparsebit_num_set() from O(n) to O(1).
+         * Note: Due to overflow, a value of 0 means none or all set.
+         */
+        sparsebit_num_t num_set;
+};
+
+/* Returns the number of set bits described by the settings
+ * of the node pointed to by nodep.
+ */
+static sparsebit_num_t node_num_set(struct node *nodep)
+{
+        return nodep->num_after + __builtin_popcount(nodep->mask);
+}
+
+/* Returns a pointer to the node that describes the
+ * lowest bit index.
+ */
+static struct node *node_first(struct sparsebit *s)
+{
+        struct node *nodep;
+
+        for (nodep = s->root; nodep && nodep->left; nodep = nodep->left)
+                ;
+
+        return nodep;
+}
+
+/* Returns a pointer to the node that describes the
+ * lowest bit index > the index of the node pointed to by np.
+ * Returns NULL if no node with a higher index exists.
+ */
+static struct node *node_next(struct sparsebit *s, struct node *np)
+{
+        struct node *nodep = np;
+
+        /*
+         * If current node has a right child, next node is the left-most
+         * of the right child.
+         */
+        if (nodep->right) {
+                for (nodep = nodep->right; nodep->left; nodep = nodep->left)
+                        ;
+                return nodep;
+        }
+
+        /*
+         * No right child.  Go up until node is left child of a parent.
+         * That parent is then the next node.
+         */
+        while (nodep->parent && nodep == nodep->parent->right)
+                nodep = nodep->parent;
+
+        return nodep->parent;
+}
+
+/* Searches for and returns a pointer to the node that describes the
+ * highest index < the index of the node pointed to by np.
+ * Returns NULL if no node with a lower index exists.
+ */
+static struct node *node_prev(struct sparsebit *s, struct node *np)
+{
+        struct node *nodep = np;
+
+        /*
+         * If current node has a left child, next node is the right-most
+         * of the left child.
+         */
+        if (nodep->left) {
+                for (nodep = nodep->left; nodep->right; nodep = nodep->right)
+                        ;
+                return (struct node *) nodep;
+        }
+
+        /*
+         * No left child.  Go up until node is right child of a parent.
+         * That parent is then the next node.
+         */
+        while (nodep->parent && nodep == nodep->parent->left)
+                nodep = nodep->parent;
+
+        return (struct node *) nodep->parent;
+}
+
+
+/* Allocates space to hold a copy of the node sub-tree pointed to by
+ * subtree and duplicates the bit settings to the newly allocated nodes.
+ * Returns the newly allocated copy of subtree.
+ */
+static struct node *node_copy_subtree(struct node *subtree)
+{
+        struct node *root;
+
+        /* Duplicate the node at the root of the subtree */
+        root = calloc(1, sizeof(*root));
+        if (!root) {
+                perror("calloc");
+                abort();
+        }
+
+        root->idx = subtree->idx;
+        root->mask = subtree->mask;
+        root->num_after = subtree->num_after;
+
+        /* As needed, recursively duplicate the left and right subtrees */
+        if (subtree->left) {
+                root->left = node_copy_subtree(subtree->left);
+                root->left->parent = root;
+        }
+
+        if (subtree->right) {
+                root->right = node_copy_subtree(subtree->right);
+                root->right->parent = root;
+        }
+
+        return root;
+}
+
+/* Searches for and returns a pointer to the node that describes the setting
+ * of the bit given by idx.  A node describes the setting of a bit if its
+ * index is within the bits described by the mask bits or the number of
+ * contiguous bits set after the mask.  Returns NULL if there is no such node.
+ */
+static struct node *node_find(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        struct node *nodep;
+
+        /* Find the node that describes the setting of the bit at idx */
+        for (nodep = s->root; nodep;
+             nodep = nodep->idx > idx ? nodep->left : nodep->right) {
+                if (idx >= nodep->idx &&
+                    idx <= nodep->idx + MASK_BITS + nodep->num_after - 1)
+                        break;
+        }
+
+        return nodep;
+}
+
+/* Entry Requirements:
+ *   + A node that describes the setting of idx is not already present.
+ *
+ * Adds a new node to describe the setting of the bit at the index given
+ * by idx.  Returns a pointer to the newly added node.
+ *
+ * TODO(lhuemill): Degenerate cases causes the tree to get unbalanced.
+ */
+static struct node *node_add(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        struct node *nodep, *parentp, *prev;
+
+        /* Allocate and initialize the new node. */
+        nodep = calloc(1, sizeof(*nodep));
+        if (!nodep) {
+                perror("calloc");
+                abort();
+        }
+
+        nodep->idx = idx & -MASK_BITS;
+
+        /* If no nodes, set it up as the root node. */
+        if (!s->root) {
+                s->root = nodep;
+                return nodep;
+        }
+
+        /*
+         * Find the parent where the new node should be attached
+         * and add the node there.
+         */
+        parentp = s->root;
+        while (true) {
+                if (idx < parentp->idx) {
+                        if (!parentp->left) {
+                                parentp->left = nodep;
+                                nodep->parent = parentp;
+                                break;
+                        }
+                        parentp = parentp->left;
+                } else {
+                        assert(idx > parentp->idx + MASK_BITS + parentp->num_after - 1);
+                        if (!parentp->right) {
+                                parentp->right = nodep;
+                                nodep->parent = parentp;
+                                break;
+                        }
+                        parentp = parentp->right;
+                }
+        }
+
+        /*
+         * Does num_after bits of previous node overlap with the mask
+         * of the new node?  If so set the bits in the new nodes mask
+         * and reduce the previous nodes num_after.
+         */
+        prev = node_prev(s, nodep);
+        while (prev && prev->idx + MASK_BITS + prev->num_after - 1 >= nodep->idx) {
+                unsigned int n1 = (prev->idx + MASK_BITS + prev->num_after - 1)
+                        - nodep->idx;
+                assert(prev->num_after > 0);
+                assert(n1 < MASK_BITS);
+                assert(!(nodep->mask & (1 << n1)));
+                nodep->mask |= (1 << n1);
+                prev->num_after--;
+        }
+
+        return nodep;
+}
+
+/* Returns whether all the bits in the sparsebit array are set.  */
+bool sparsebit_all_set(struct sparsebit *s)
+{
+        /*
+         * If any nodes there must be at least one bit set.  Only case
+         * where a bit is set and total num set is 0, is when all bits
+         * are set.
+         */
+        return s->root && s->num_set == 0;
+}
+
+/* Clears all bits described by the node pointed to by nodep, then
+ * removes the node.
+ */
+static void node_rm(struct sparsebit *s, struct node *nodep)
+{
+        struct node *tmp;
+        sparsebit_num_t num_set;
+
+        num_set = node_num_set(nodep);
+        assert(s->num_set >= num_set || sparsebit_all_set(s));
+        s->num_set -= node_num_set(nodep);
+
+        /* Have both left and right child */
+        if (nodep->left && nodep->right) {
+                /*
+                 * Move left children to the leftmost leaf node
+                 * of the right child.
+                 */
+                for (tmp = nodep->right; tmp->left; tmp = tmp->left)
+                        ;
+                tmp->left = nodep->left;
+                nodep->left = NULL;
+                tmp->left->parent = tmp;
+        }
+
+        /* Left only child */
+        if (nodep->left) {
+                if (!nodep->parent) {
+                        s->root = nodep->left;
+                        nodep->left->parent = NULL;
+                } else {
+                        nodep->left->parent = nodep->parent;
+                        if (nodep == nodep->parent->left)
+                                nodep->parent->left = nodep->left;
+                        else {
+                                assert(nodep == nodep->parent->right);
+                                nodep->parent->right = nodep->left;
+                        }
+                }
+
+                nodep->parent = nodep->left = nodep->right = NULL;
+                free(nodep);
+
+                return;
+        }
+
+
+        /* Right only child */
+        if (nodep->right) {
+                if (!nodep->parent) {
+                        s->root = nodep->right;
+                        nodep->right->parent = NULL;
+                } else {
+                        nodep->right->parent = nodep->parent;
+                        if (nodep == nodep->parent->left)
+                                nodep->parent->left = nodep->right;
+                        else {
+                                assert(nodep == nodep->parent->right);
+                                nodep->parent->right = nodep->right;
+                        }
+                }
+
+                nodep->parent = nodep->left = nodep->right = NULL;
+                free(nodep);
+
+                return;
+        }
+
+        /* Leaf Node */
+        if (!nodep->parent) {
+                s->root = NULL;
+        } else {
+                if (nodep->parent->left == nodep)
+                        nodep->parent->left = NULL;
+                else {
+                        assert(nodep == nodep->parent->right);
+                        nodep->parent->right = NULL;
+                }
+        }
+
+        nodep->parent = nodep->left = nodep->right = NULL;
+        free(nodep);
+
+        return;
+}
+
+/* Splits the node containing the bit at idx so that there is a node
+ * that starts at the specified index.  If no such node exists, a new
+ * node at the specified index is created.  Returns the new node.
+ *
+ * idx must start of a mask boundary.
+ */
+static struct node *node_split(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        struct node *nodep1, *nodep2;
+        sparsebit_idx_t offset;
+        sparsebit_num_t orig_num_after;
+
+        assert(!(idx % MASK_BITS));
+
+        /*
+         * Is there a node that describes the setting of idx?
+         * If not, add it.
+         */
+        nodep1 = node_find(s, idx);
+        if (!nodep1)
+                return node_add(s, idx);
+
+        /*
+         * All done if the starting index of the node is where the
+         * split should occur.
+         */
+        if (nodep1->idx == idx)
+                return nodep1;
+
+        /*
+         * Split point not at start of mask, so it must be part of
+         * bits described by num_after.
+         */
+
+        /*
+         * Calculate offset within num_after for where the split is
+         * to occur.
+         */
+        offset = idx - (nodep1->idx + MASK_BITS);
+        orig_num_after = nodep1->num_after;
+
+        /*
+         * Add a new node to describe the bits starting at
+         * the split point.
+         */
+        nodep1->num_after = offset;
+        nodep2 = node_add(s, idx);
+
+        /* Move bits after the split point into the new node */
+        nodep2->num_after = orig_num_after - offset;
+        if (nodep2->num_after >= MASK_BITS) {
+                nodep2->mask = ~(mask_t) 0;
+                nodep2->num_after -= MASK_BITS;
+        } else {
+                nodep2->mask = (1 << nodep2->num_after) - 1;
+                nodep2->num_after = 0;
+        }
+
+        return nodep2;
+}
+
+/* Iteratively reduces the node pointed to by nodep and its adjacent
+ * nodes into a more compact form.  For example, a node with a mask with
+ * all bits set adjacent to a previous node, will get combined into a
+ * single node with an increased num_after setting.
+ *
+ * After each reduction, a further check is made to see if additional
+ * reductions are possible with the new previous and next nodes.  Note,
+ * a search for a reduction is only done across the nodes nearest nodep
+ * and those that became part of a reduction.  Reductions beyond nodep
+ * and the adjacent nodes that are reduced are not discovered.  It is the
+ * responsibility of the caller to pass a nodep that is within one node
+ * of each possible reduction.
+ *
+ * This function does not fix the temporary violation of all invariants.
+ * For example it does not fix the case where the bit settings described
+ * by two or more nodes overlap.  Such a violation introduces the potential
+ * complication of a bit setting for a specific index having different settings
+ * in different nodes.  This would then introduce the further complication
+ * of which node has the correct setting of the bit and thus such conditions
+ * are not allowed.
+ *
+ * This function is designed to fix invariant violations that are introduced
+ * by node_split() and by changes to the nodes mask or num_after members.
+ * For example, when setting a bit within a nodes mask, the function that
+ * sets the bit doesn't have to worry about whether the setting of that
+ * bit caused the mask to have leading only or trailing only bits set.
+ * Instead, the function can call node_reduce(), with nodep equal to the
+ * node address that it set a mask bit in, and node_reduce() will notice
+ * the cases of leading or trailing only bits and that there is an
+ * adjacent node that the bit settings could be merged into.
+ *
+ * This implementation specifically detects and corrects violation of the
+ * following invariants:
+ *
+ *   + Node are only used to represent bits that are set.
+ *     Nodes with a mask of 0 and num_after of 0 are not allowed.
+ *
+ *   + The setting of at least one bit is always described in a nodes
+ *     mask (mask >= 1).
+ *
+ *   + A node with all mask bits set only occurs when the last bit
+ *     described by the previous node is not equal to this nodes
+ *     starting index - 1.  All such occurences of this condition are
+ *     avoided by moving the setting of the nodes mask bits into
+ *     the previous nodes num_after setting.
+ */
+static void node_reduce(struct sparsebit *s, struct node *nodep)
+{
+        bool reduction_performed;
+
+        do {
+                reduction_performed = false;
+                struct node *prev, *next, *tmp;
+
+                /* 1) Potential reductions within the current node. */
+
+                /* Nodes with all bits cleared may be removed. */
+                if (nodep->mask == 0 && nodep->num_after == 0) {
+                        /*
+                         * About to remove the node pointed to by
+                         * nodep, which normally would cause a problem
+                         * for the next pass through the reduction loop,
+                         * because the node at the starting point no longer
+                         * exists.  This potential problem is handled
+                         * by first remembering the location of the next
+                         * or previous nodes.  Doesn't matter which, because
+                         * once the node at nodep is removed, there will be
+                         * no other nodes between prev and next.
+                         *
+                         * Note, the checks performed on nodep against both
+                         * both prev and next both check for an adjacent
+                         * node that can be reduced into a single node.  As
+                         * such, after removing the node at nodep, doesn't
+                         * matter whether the nodep for the next pass
+                         * through the loop is equal to the previous pass
+                         * prev or next node.  Either way, on the next pass
+                         * the one not selected will become either the
+                         * prev or next node.
+                         */
+                        tmp = node_next(s, nodep);
+                        if (!tmp)
+                                tmp = node_prev(s, nodep);
+
+                        node_rm(s, nodep);
+                        nodep = NULL;
+
+                        nodep = tmp;
+                        reduction_performed = true;
+                        continue;
+                }
+
+                /*
+                 * When the mask is 0, can reduce the amount of num_after
+                 * bits by moving the initial num_after bits into the mask.
+                 */
+                if (nodep->mask == 0) {
+                        assert(nodep->num_after != 0);
+                        assert(nodep->idx + MASK_BITS > nodep->idx);
+
+                        nodep->idx += MASK_BITS;
+
+                        if (nodep->num_after >= MASK_BITS) {
+                                nodep->mask = ~0;
+                                nodep->num_after -= MASK_BITS;
+                        } else {
+                                nodep->mask = (1u << nodep->num_after) - 1;
+                                nodep->num_after = 0;
+                        }
+
+                        reduction_performed = true;
+                        continue;
+                }
+
+                /*
+                 * 2) Potential reductions between the current and
+                 * previous nodes.
+                 */
+                prev = node_prev(s, nodep);
+                if (prev) {
+                        sparsebit_idx_t prev_highest_bit;
+
+                        /* Nodes with no bits set can be removed. */
+                        if (prev->mask == 0 && prev->num_after == 0) {
+                                node_rm(s, prev);
+
+                                reduction_performed = true;
+                                continue;
+                        }
+
+                        /*
+                         * All mask bits set and previous node has
+                         * adjacent index.
+                         */
+                        if (nodep->mask + 1 == 0 &&
+                            prev->idx + MASK_BITS == nodep->idx) {
+                                prev->num_after += MASK_BITS + nodep->num_after;
+                                nodep->mask = 0;
+                                nodep->num_after = 0;
+
+                                reduction_performed = true;
+                                continue;
+                        }
+
+                        /*
+                         * Is node adjacent to previous node and the node
+                         * contains a single contiguous range of bits
+                         * starting from the beginning of the mask?
+                         */
+                        prev_highest_bit = prev->idx + MASK_BITS - 1 + prev->num_after;
+                        if (prev_highest_bit + 1 == nodep->idx &&
+                            (nodep->mask | (nodep->mask >> 1)) == nodep->mask) {
+                                /*
+                                 * How many contiguous bits are there?
+                                 * Is equal to the total number of set
+                                 * bits, due to an earlier check that
+                                 * there is a single contiguous range of
+                                 * set bits.
+                                 */
+                                unsigned int num_contiguous
+                                        = __builtin_popcount(nodep->mask);
+                                assert((num_contiguous > 0) &&
+                                       ((1ULL << num_contiguous) - 1) == nodep->mask);
+
+                                prev->num_after += num_contiguous;
+                                nodep->mask = 0;
+
+                                /*
+                                 * For predictable performance, handle special
+                                 * case where all mask bits are set and there
+                                 * is a non-zero num_after setting.  This code
+                                 * is functionally correct without the following
+                                 * conditionalized statements, but without them
+                                 * the value of num_after is only reduced by
+                                 * the number of mask bits per pass.  There are
+                                 * cases where num_after can be close to 2^64.
+                                 * Without this code it could take nearly
+                                 * (2^64) / 32 passes to perform the full
+                                 * reduction.
+                                 */
+                                if (num_contiguous == MASK_BITS) {
+                                        prev->num_after += nodep->num_after;
+                                        nodep->num_after = 0;
+                                }
+
+                                reduction_performed = true;
+                                continue;
+                        }
+                }
+
+                /*
+                 * 3) Potential reductions between the current and
+                 * next nodes.
+                 */
+                next = node_next(s, nodep);
+                if (next) {
+                        /* Nodes with no bits set can be removed. */
+                        if (next->mask == 0 && next->num_after == 0) {
+                                node_rm(s, next);
+                                reduction_performed = true;
+                                continue;
+                        }
+
+                        /*
+                         * Is next node index adjacent to current node
+                         * and has a mask with all bits set?
+                         */
+                        if (next->idx == nodep->idx + MASK_BITS + nodep->num_after &&
+                            next->mask == ~(mask_t) 0) {
+                                nodep->num_after += MASK_BITS;
+                                next->mask = 0;
+                                nodep->num_after += next->num_after;
+                                next->num_after = 0;
+
+                                node_rm(s, next);
+                                next = NULL;
+
+                                reduction_performed = true;
+                                continue;
+                        }
+                }
+        } while (nodep && reduction_performed);
+}
+
+/* Returns whether the bit at the index given by idx, within the
+ * sparsebit array is set or not.
+ */
+bool sparsebit_is_set(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        struct node *nodep;
+
+        /* Find the node that describes the setting of the bit at idx */
+        for (nodep = s->root; nodep;
+             nodep = nodep->idx > idx ? nodep->left : nodep->right)
+                if (idx >= nodep->idx &&
+                    idx <= nodep->idx + MASK_BITS + nodep->num_after - 1)
+                        goto have_node;
+
+        return false;
+
+have_node:
+        /* Bit is set if it is any of the bits described by num_after */
+        if (nodep->num_after && idx >= nodep->idx + MASK_BITS)
+                return true;
+
+        /* Is the corresponding mask bit set */
+        assert(idx >= nodep->idx && idx - nodep->idx < MASK_BITS);
+        return !!(nodep->mask & (1 << (idx - nodep->idx)));
+}
+
+/* Within the sparsebit array pointed to by s, sets the bit
+ * at the index given by idx.
+ */
+static void bit_set(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        struct node *nodep;
+
+        /* Skip bits that are already set */
+        if (sparsebit_is_set(s, idx))
+                return;
+
+        /*
+         * Get a node where the bit at idx is described by the mask.
+         * The node_split will also create a node, if there isn't
+         * already a node that describes the setting of bit.
+         */
+        nodep = node_split(s, idx & -MASK_BITS);
+
+        /* Set the bit within the nodes mask */
+        assert(idx >= nodep->idx && idx <= nodep->idx + MASK_BITS - 1);
+        assert(!(nodep->mask & (1 << (idx - nodep->idx))));
+        nodep->mask |= 1 << (idx - nodep->idx);
+        s->num_set++;
+
+        node_reduce(s, nodep);
+}
+
+/* Within the sparsebit array pointed to by s, clears the bit
+ * at the index given by idx.
+ */
+static void bit_clear(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        struct node *nodep;
+
+        /* Skip bits that are already cleared */
+        if (!sparsebit_is_set(s, idx))
+                return;
+
+        /* Is there a node that describes the setting of this bit? */
+        nodep = node_find(s, idx);
+        if (!nodep)
+                return;
+
+        /*
+         * If a num_after bit, split the node, so that the bit is
+         * part of a node mask.
+         */
+        if (idx >= nodep->idx + MASK_BITS)
+                nodep = node_split(s, idx & -MASK_BITS);
+
+        /*
+         * After node_split above, bit at idx should be within the mask.
+         * Clear that bit.
+         */
+        assert(idx >= nodep->idx && idx <= nodep->idx + MASK_BITS - 1);
+        assert(nodep->mask & (1 << (idx - nodep->idx)));
+        nodep->mask &= ~(1 << (idx - nodep->idx));
+        assert(s->num_set > 0 || sparsebit_all_set(s));
+        s->num_set--;
+
+        node_reduce(s, nodep);
+}
+
+/* Recursively dumps to the FILE stream given by stream the contents
+ * of the sub-tree of nodes pointed to by nodep.  Each line of output
+ * is prefixed by the number of spaces given by indent.  On each
+ * recursion, the indent amount is increased by 2.  This causes nodes
+ * at each level deeper into the binary search tree to be displayed
+ * with a greater indent.
+ */
+static void dump_nodes(FILE *stream, struct node *nodep,
+        unsigned int indent)
+{
+        char *node_type;
+
+        /* Dump contents of node */
+        if (!nodep->parent)
+                node_type = "root";
+        else if (nodep == nodep->parent->left)
+                node_type = "left";
+        else {
+                assert(nodep == nodep->parent->right);
+                node_type = "right";
+        }
+        fprintf(stream, "%*s---- %s nodep: %p\n", indent, "", node_type, nodep);
+        fprintf(stream, "%*s  parent: %p left: %p right: %p\n", indent, "",
+                nodep->parent, nodep->left, nodep->right);
+        fprintf(stream, "%*s  idx: 0x%lx mask: 0x%x num_after: 0x%lx\n",
+                indent, "", nodep->idx, nodep->mask, nodep->num_after);
+
+        /* If present, dump contents of left child nodes */
+        if (nodep->left)
+                dump_nodes(stream, nodep->left, indent + 2);
+
+        /* If present, dump contents of right child nodes */
+        if (nodep->right)
+                dump_nodes(stream, nodep->right, indent + 2);
+}
+
+static inline sparsebit_idx_t node_first_set(struct node *nodep, int start)
+{
+        mask_t leading = (mask_t)1 << start;
+        int n1 = __builtin_ctz(nodep->mask & -leading);
+
+        return nodep->idx + n1;
+}
+
+static inline sparsebit_idx_t node_first_clear(struct node *nodep, int start)
+{
+        mask_t leading = (mask_t)1 << start;
+        int n1 = __builtin_ctz(~nodep->mask & -leading);
+
+        return nodep->idx + n1;
+}
+
+/* Dumps to the FILE stream specified by stream, the implementation dependent
+ * internal state of s.  Each line of output is prefixed with the number
+ * of spaces given by indent.  The output is completely implementation
+ * dependent and subject to change.  Output from this function should only
+ * be used for diagnostic purposes.  For example, this function can be
+ * used by test cases after they detect an unexpected condition, as a means
+ * to capture diagnostic information.
+ */
+static void sparsebit_dump_internal(FILE *stream, struct sparsebit *s,
+        unsigned int indent)
+{
+        /* Dump the contents of s */
+        fprintf(stream, "%*sroot: %p\n", indent, "", s->root);
+        fprintf(stream, "%*snum_set: 0x%lx\n", indent, "", s->num_set);
+
+        if (s->root)
+                dump_nodes(stream, s->root, indent);
+}
+
+/* Allocates and returns a new sparsebit array. The initial state
+ * of the newly allocated sparsebit array has all bits cleared.
+ */
+struct sparsebit *sparsebit_alloc(void)
+{
+        struct sparsebit *s;
+
+        /* Allocate top level structure. */
+        s = calloc(1, sizeof(*s));
+        if (!s) {
+                perror("calloc");
+                abort();
+        }
+
+        return s;
+}
+
+/* Frees the implementation dependent data for the sparsebit array
+ * pointed to by s and poisons the pointer to that data.
+ */
+void sparsebit_free(struct sparsebit **sbitp)
+{
+        struct sparsebit *s = *sbitp;
+
+        if (!s)
+                return;
+
+        sparsebit_clear_all(s);
+        free(s);
+        *sbitp = NULL;
+}
+
+/* Makes a copy of the sparsebit array given by s, to the sparsebit
+ * array given by d.  Note, d must have already been allocated via
+ * sparsebit_alloc().  It can though already have bits set, which
+ * if different from src will be cleared.
+ */
+void sparsebit_copy(struct sparsebit *d, struct sparsebit *s)
+{
+        /* First clear any bits already set in the destination */
+        sparsebit_clear_all(d);
+
+        if (s->root) {
+                d->root = node_copy_subtree(s->root);
+                d->num_set = s->num_set;
+        }
+}
+
+/* Returns whether num consecutive bits starting at idx are all set.  */
+bool sparsebit_is_set_num(struct sparsebit *s,
+        sparsebit_idx_t idx, sparsebit_num_t num)
+{
+        sparsebit_idx_t next_cleared;
+
+        assert(num > 0);
+        assert(idx + num - 1 >= idx);
+
+        /* With num > 0, the first bit must be set. */
+        if (!sparsebit_is_set(s, idx))
+                return false;
+
+        /* Find the next cleared bit */
+        next_cleared = sparsebit_next_clear(s, idx);
+
+        /*
+         * If no cleared bits beyond idx, then there are at least num
+         * set bits. idx + num doesn't wrap.  Otherwise check if
+         * there are enough set bits between idx and the next cleared bit.
+         */
+        return next_cleared == 0 || next_cleared - idx >= num;
+}
+
+/* Returns whether the bit at the index given by idx.  */
+bool sparsebit_is_clear(struct sparsebit *s,
+        sparsebit_idx_t idx)
+{
+        return !sparsebit_is_set(s, idx);
+}
+
+/* Returns whether num consecutive bits starting at idx are all cleared.  */
+bool sparsebit_is_clear_num(struct sparsebit *s,
+        sparsebit_idx_t idx, sparsebit_num_t num)
+{
+        sparsebit_idx_t next_set;
+
+        assert(num > 0);
+        assert(idx + num - 1 >= idx);
+
+        /* With num > 0, the first bit must be cleared. */
+        if (!sparsebit_is_clear(s, idx))
+                return false;
+
+        /* Find the next set bit */
+        next_set = sparsebit_next_set(s, idx);
+
+        /*
+         * If no set bits beyond idx, then there are at least num
+         * cleared bits. idx + num doesn't wrap.  Otherwise check if
+         * there are enough cleared bits between idx and the next set bit.
+         */
+        return next_set == 0 || next_set - idx >= num;
+}
+
+/* Returns the total number of bits set.  Note: 0 is also returned for
+ * the case of all bits set.  This is because with all bits set, there
+ * is 1 additional bit set beyond what can be represented in the return
+ * value.  Use sparsebit_any_set(), instead of sparsebit_num_set() > 0,
+ * to determine if the sparsebit array has any bits set.
+ */
+sparsebit_num_t sparsebit_num_set(struct sparsebit *s)
+{
+        return s->num_set;
+}
+
+/* Returns whether any bit is set in the sparsebit array.  */
+bool sparsebit_any_set(struct sparsebit *s)
+{
+        /*
+         * Nodes only describe set bits.  If any nodes then there
+         * is at least 1 bit set.
+         */
+        if (!s->root)
+                return false;
+
+        /*
+         * Every node should have a non-zero mask.  For now will
+         * just assure that the root node has a non-zero mask,
+         * which is a quick check that at least 1 bit is set.
+         */
+        assert(s->root->mask != 0);
+        assert(s->num_set > 0 ||
+               (s->root->num_after == ((sparsebit_num_t) 0) - MASK_BITS &&
+                s->root->mask == ~(mask_t) 0));
+
+        return true;
+}
+
+/* Returns whether all the bits in the sparsebit array are cleared.  */
+bool sparsebit_all_clear(struct sparsebit *s)
+{
+        return !sparsebit_any_set(s);
+}
+
+/* Returns whether all the bits in the sparsebit array are set.  */
+bool sparsebit_any_clear(struct sparsebit *s)
+{
+        return !sparsebit_all_set(s);
+}
+
+/* Returns the index of the first set bit.  Abort if no bits are set.
+ */
+sparsebit_idx_t sparsebit_first_set(struct sparsebit *s)
+{
+        struct node *nodep;
+
+        /* Validate at least 1 bit is set */
+        assert(sparsebit_any_set(s));
+
+        nodep = node_first(s);
+        return node_first_set(nodep, 0);
+}
+
+/* Returns the index of the first cleared bit.  Abort if
+ * no bits are cleared.
+ */
+sparsebit_idx_t sparsebit_first_clear(struct sparsebit *s)
+{
+        struct node *nodep1, *nodep2;
+
+        /* Validate at least 1 bit is cleared. */
+        assert(sparsebit_any_clear(s));
+
+        /* If no nodes or first node index > 0 then lowest cleared is 0 */
+        nodep1 = node_first(s);
+        if (!nodep1 || nodep1->idx > 0)
+                return 0;
+
+        /* Does the mask in the first node contain any cleared bits. */
+        if (nodep1->mask != ~(mask_t) 0)
+                return node_first_clear(nodep1, 0);
+
+        /*
+         * All mask bits set in first node.  If there isn't a second node
+         * then the first cleared bit is the first bit after the bits
+         * described by the first node.
+         */
+        nodep2 = node_next(s, nodep1);
+        if (!nodep2) {
+                /*
+                 * No second node.  First cleared bit is first bit beyond
+                 * bits described by first node.
+                 */
+                assert(nodep1->mask == ~(mask_t) 0);
+                assert(nodep1->idx + MASK_BITS + nodep1->num_after != (sparsebit_idx_t) 0);
+                return nodep1->idx + MASK_BITS + nodep1->num_after;
+        }
+
+        /*
+         * There is a second node.
+         * If it is not adjacent to the first node, then there is a gap
+         * of cleared bits between the nodes, and the first cleared bit
+         * is the first bit within the gap.
+         */
+        if (nodep1->idx + MASK_BITS + nodep1->num_after != nodep2->idx)
+                return nodep1->idx + MASK_BITS + nodep1->num_after;
+
+        /*
+         * Second node is adjacent to the first node.
+         * Because it is adjacent, its mask should be non-zero.  If all
+         * its mask bits are set, then with it being adjacent, it should
+         * have had the mask bits moved into the num_after setting of the
+         * previous node.
+         */
+        return node_first_clear(nodep2, 0);
+}
+
+/* Returns index of next bit set within s after the index given by prev.
+ * Returns 0 if there are no bits after prev that are set.
+ */
+sparsebit_idx_t sparsebit_next_set(struct sparsebit *s,
+        sparsebit_idx_t prev)
+{
+        sparsebit_idx_t lowest_possible = prev + 1;
+        sparsebit_idx_t start;
+        struct node *nodep;
+
+        /* A bit after the highest index can't be set. */
+        if (lowest_possible == 0)
+                return 0;
+
+        /*
+         * Find the leftmost 'candidate' overlapping or to the right
+         * of lowest_possible.
+         */
+        struct node *candidate = NULL;
+
+        /* True iff lowest_possible is within candidate */
+        bool contains = false;
+
+        /*
+         * Find node that describes setting of bit at lowest_possible.
+         * If such a node doesn't exist, find the node with the lowest
+         * starting index that is > lowest_possible.
+         */
+        for (nodep = s->root; nodep;) {
+                if ((nodep->idx + MASK_BITS + nodep->num_after - 1)
+                        >= lowest_possible) {
+                        candidate = nodep;
+                        if (candidate->idx <= lowest_possible) {
+                                contains = true;
+                                break;
+                        }
+                        nodep = nodep->left;
+                } else {
+                        nodep = nodep->right;
+                }
+        }
+        if (!candidate)
+                return 0;
+
+        assert(candidate->mask != 0);
+
+        /* Does the candidate node describe the setting of lowest_possible? */
+        if (!contains) {
+                /*
+                 * Candidate doesn't describe setting of bit at lowest_possible.
+                 * Candidate points to the first node with a starting index
+                 * > lowest_possible.
+                 */
+                assert(candidate->idx > lowest_possible);
+
+                return node_first_set(candidate, 0);
+        }
+
+        /*
+         * Candidate describes setting of bit at lowest_possible.
+         * Note: although the node describes the setting of the bit
+         * at lowest_possible, its possible that its setting and the
+         * setting of all latter bits described by this node are 0.
+         * For now, just handle the cases where this node describes
+         * a bit at or after an index of lowest_possible that is set.
+         */
+        start = lowest_possible - candidate->idx;
+
+        if (start < MASK_BITS && candidate->mask >= (1 << start))
+                return node_first_set(candidate, start);
+
+        if (candidate->num_after) {
+                sparsebit_idx_t first_num_after_idx = candidate->idx + MASK_BITS;
+
+                return lowest_possible < first_num_after_idx
+                        ? first_num_after_idx : lowest_possible;
+        }
+
+        /*
+         * Although candidate node describes setting of bit at
+         * the index of lowest_possible, all bits at that index and
+         * latter that are described by candidate are cleared.  With
+         * this, the next bit is the first bit in the next node, if
+         * such a node exists.  If a next node doesn't exist, then
+         * there is no next set bit.
+         */
+        candidate = node_next(s, candidate);
+        if (!candidate)
+                return 0;
+
+        return node_first_set(candidate, 0);
+}
+
+/* Returns index of next bit cleared within s after the index given by prev.
+ * Returns 0 if there are no bits after prev that are cleared.
+ */
+sparsebit_idx_t sparsebit_next_clear(struct sparsebit *s,
+        sparsebit_idx_t prev)
+{
+        sparsebit_idx_t lowest_possible = prev + 1;
+        sparsebit_idx_t idx;
+        struct node *nodep1, *nodep2;
+
+        /* A bit after the highest index can't be set. */
+        if (lowest_possible == 0)
+                return 0;
+
+        /*
+         * Does a node describing the setting of lowest_possible exist?
+         * If not, the bit at lowest_possible is cleared.
+         */
+        nodep1 = node_find(s, lowest_possible);
+        if (!nodep1)
+                return lowest_possible;
+
+        /* Does a mask bit in node 1 describe the next cleared bit. */
+        for (idx = lowest_possible - nodep1->idx; idx < MASK_BITS; idx++)
+                if (!(nodep1->mask & (1 << idx)))
+                        return nodep1->idx + idx;
+
+        /*
+         * Next cleared bit is not described by node 1.  If there
+         * isn't a next node, then next cleared bit is described
+         * by bit after the bits described by the first node.
+         */
+        nodep2 = node_next(s, nodep1);
+        if (!nodep2)
+                return nodep1->idx + MASK_BITS + nodep1->num_after;
+
+        /*
+         * There is a second node.
+         * If it is not adjacent to the first node, then there is a gap
+         * of cleared bits between the nodes, and the next cleared bit
+         * is the first bit within the gap.
+         */
+        if (nodep1->idx + MASK_BITS + nodep1->num_after != nodep2->idx)
+                return nodep1->idx + MASK_BITS + nodep1->num_after;
+
+        /*
+         * Second node is adjacent to the first node.
+         * Because it is adjacent, its mask should be non-zero.  If all
+         * its mask bits are set, then with it being adjacent, it should
+         * have had the mask bits moved into the num_after setting of the
+         * previous node.
+         */
+        return node_first_clear(nodep2, 0);
+}
+
+/* Starting with the index 1 greater than the index given by start, finds
+ * and returns the index of the first sequence of num consecutively set
+ * bits.  Returns a value of 0 of no such sequence exists.
+ */
+sparsebit_idx_t sparsebit_next_set_num(struct sparsebit *s,
+        sparsebit_idx_t start, sparsebit_num_t num)
+{
+        sparsebit_idx_t idx;
+
+        assert(num >= 1);
+
+        for (idx = sparsebit_next_set(s, start);
+                idx != 0 && idx + num - 1 >= idx;
+                idx = sparsebit_next_set(s, idx)) {
+                assert(sparsebit_is_set(s, idx));
+
+                /*
+                 * Does the sequence of bits starting at idx consist of
+                 * num set bits?
+                 */
+                if (sparsebit_is_set_num(s, idx, num))
+                        return idx;
+
+                /*
+                 * Sequence of set bits at idx isn't large enough.
+                 * Skip this entire sequence of set bits.
+                 */
+                idx = sparsebit_next_clear(s, idx);
+                if (idx == 0)
+                        return 0;
+        }
+
+        return 0;
+}
+
+/* Starting with the index 1 greater than the index given by start, finds
+ * and returns the index of the first sequence of num consecutively cleared
+ * bits.  Returns a value of 0 of no such sequence exists.
+ */
+sparsebit_idx_t sparsebit_next_clear_num(struct sparsebit *s,
+        sparsebit_idx_t start, sparsebit_num_t num)
+{
+        sparsebit_idx_t idx;
+
+        assert(num >= 1);
+
+        for (idx = sparsebit_next_clear(s, start);
+                idx != 0 && idx + num - 1 >= idx;
+                idx = sparsebit_next_clear(s, idx)) {
+                assert(sparsebit_is_clear(s, idx));
+
+                /*
+                 * Does the sequence of bits starting at idx consist of
+                 * num cleared bits?
+                 */
+                if (sparsebit_is_clear_num(s, idx, num))
+                        return idx;
+
+                /*
+                 * Sequence of cleared bits at idx isn't large enough.
+                 * Skip this entire sequence of cleared bits.
+                 */
+                idx = sparsebit_next_set(s, idx);
+                if (idx == 0)
+                        return 0;
+        }
+
+        return 0;
+}
+
+/* Sets the bits * in the inclusive range idx through idx + num - 1.  */
+void sparsebit_set_num(struct sparsebit *s,
+        sparsebit_idx_t start, sparsebit_num_t num)
+{
+        struct node *nodep, *next;
+        unsigned int n1;
+        sparsebit_idx_t idx;
+        sparsebit_num_t n;
+        sparsebit_idx_t middle_start, middle_end;
+
+        assert(num > 0);
+        assert(start + num - 1 >= start);
+
+        /*
+         * Leading - bits before first mask boundary.
+         *
+         * TODO(lhuemill): With some effort it may be possible to
+         *   replace the following loop with a sequential sequence
+         *   of statements.  High level sequence would be:
+         *
+         *     1. Use node_split() to force node that describes setting
+         *        of idx to be within the mask portion of a node.
+         *     2. Form mask of bits to be set.
+         *     3. Determine number of mask bits already set in the node
+         *        and store in a local variable named num_already_set.
+         *     4. Set the appropriate mask bits within the node.
+         *     5. Increment struct sparsebit_pvt num_set member
+         *        by the number of bits that were actually set.
+         *        Exclude from the counts bits that were already set.
+         *     6. Before returning to the caller, use node_reduce() to
+         *        handle the multiple corner cases that this method
+         *        introduces.
+         */
+        for (idx = start, n = num; n > 0 && idx % MASK_BITS != 0; idx++, n--)
+                bit_set(s, idx);
+
+        /* Middle - bits spanning one or more entire mask */
+        middle_start = idx;
+        middle_end = middle_start + (n & -MASK_BITS) - 1;
+        if (n >= MASK_BITS) {
+                nodep = node_split(s, middle_start);
+
+                /*
+                 * As needed, split just after end of middle bits.
+                 * No split needed if end of middle bits is at highest
+                 * supported bit index.
+                 */
+                if (middle_end + 1 > middle_end)
+                        (void) node_split(s, middle_end + 1);
+
+                /* Delete nodes that only describe bits within the middle. */
+                for (next = node_next(s, nodep);
+                        next && (next->idx < middle_end);
+                        next = node_next(s, nodep)) {
+                        assert(next->idx + MASK_BITS + next->num_after - 1 <= middle_end);
+                        node_rm(s, next);
+                        next = NULL;
+                }
+
+                /* As needed set each of the mask bits */
+                for (n1 = 0; n1 < MASK_BITS; n1++) {
+                        if (!(nodep->mask & (1 << n1))) {
+                                nodep->mask |= 1 << n1;
+                                s->num_set++;
+                        }
+                }
+
+                s->num_set -= nodep->num_after;
+                nodep->num_after = middle_end - middle_start + 1 - MASK_BITS;
+                s->num_set += nodep->num_after;
+
+                node_reduce(s, nodep);
+        }
+        idx = middle_end + 1;
+        n -= middle_end - middle_start + 1;
+
+        /* Trailing - bits at and beyond last mask boundary */
+        assert(n < MASK_BITS);
+        for (; n > 0; idx++, n--)
+                bit_set(s, idx);
+}
+
+/* Clears the bits * in the inclusive range idx through idx + num - 1.  */
+void sparsebit_clear_num(struct sparsebit *s,
+        sparsebit_idx_t start, sparsebit_num_t num)
+{
+        struct node *nodep, *next;
+        unsigned int n1;
+        sparsebit_idx_t idx;
+        sparsebit_num_t n;
+        sparsebit_idx_t middle_start, middle_end;
+
+        assert(num > 0);
+        assert(start + num - 1 >= start);
+
+        /* Leading - bits before first mask boundary */
+        for (idx = start, n = num; n > 0 && idx % MASK_BITS != 0; idx++, n--)
+                bit_clear(s, idx);
+
+        /* Middle - bits spanning one or more entire mask */
+        middle_start = idx;
+        middle_end = middle_start + (n & -MASK_BITS) - 1;
+        if (n >= MASK_BITS) {
+                nodep = node_split(s, middle_start);
+
+                /*
+                 * As needed, split just after end of middle bits.
+                 * No split needed if end of middle bits is at highest
+                 * supported bit index.
+                 */
+                if (middle_end + 1 > middle_end)
+                        (void) node_split(s, middle_end + 1);
+
+                /* Delete nodes that only describe bits within the middle. */
+                for (next = node_next(s, nodep);
+                        next && (next->idx < middle_end);
+                        next = node_next(s, nodep)) {
+                        assert(next->idx + MASK_BITS + next->num_after - 1 <= middle_end);
+                        node_rm(s, next);
+                        next = NULL;
+                }
+
+                /* As needed clear each of the mask bits */
+                for (n1 = 0; n1 < MASK_BITS; n1++) {
+                        if (nodep->mask & (1 << n1)) {
+                                nodep->mask &= ~(1 << n1);
+                                s->num_set--;
+                        }
+                }
+
+                /* Clear any bits described by num_after */
+                s->num_set -= nodep->num_after;
+                nodep->num_after = 0;
+
+                /*
+                 * Delete the node that describes the beginning of
+                 * the middle bits and perform any allowed reductions
+                 * with the nodes prev or next of nodep.
+                 */
+                node_reduce(s, nodep);
+                nodep = NULL;
+        }
+        idx = middle_end + 1;
+        n -= middle_end - middle_start + 1;
+
+        /* Trailing - bits at and beyond last mask boundary */
+        assert(n < MASK_BITS);
+        for (; n > 0; idx++, n--)
+                bit_clear(s, idx);
+}
+
+/* Sets the bit at the index given by idx.  */
+void sparsebit_set(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        sparsebit_set_num(s, idx, 1);
+}
+
+/* Clears the bit at the index given by idx.  */
+void sparsebit_clear(struct sparsebit *s, sparsebit_idx_t idx)
+{
+        sparsebit_clear_num(s, idx, 1);
+}
+
+/* Sets the bits in the entire addressable range of the sparsebit array.  */
+void sparsebit_set_all(struct sparsebit *s)
+{
+        sparsebit_set(s, 0);
+        sparsebit_set_num(s, 1, ~(sparsebit_idx_t) 0);
+        assert(sparsebit_all_set(s));
+}
+
+/* Clears the bits in the entire addressable range of the sparsebit array.  */
+void sparsebit_clear_all(struct sparsebit *s)
+{
+        sparsebit_clear(s, 0);
+        sparsebit_clear_num(s, 1, ~(sparsebit_idx_t) 0);
+        assert(!sparsebit_any_set(s));
+}
+
+static size_t display_range(FILE *stream, sparsebit_idx_t low,
+        sparsebit_idx_t high, bool prepend_comma_space)
+{
+        char *fmt_str;
+        size_t sz;
+
+        /* Determine the printf format string */
+        if (low == high)
+                fmt_str = prepend_comma_space ? ", 0x%lx" : "0x%lx";
+        else
+                fmt_str = prepend_comma_space ? ", 0x%lx:0x%lx" : "0x%lx:0x%lx";
+
+        /*
+         * When stream is NULL, just determine the size of what would
+         * have been printed, else print the range.
+         */
+        if (!stream)
+                sz = snprintf(NULL, 0, fmt_str, low, high);
+        else
+                sz = fprintf(stream, fmt_str, low, high);
+
+        return sz;
+}
+
+
+/* Dumps to the FILE stream given by stream, the bit settings
+ * of s.  Each line of output is prefixed with the number of
+ * spaces given by indent.  The length of each line is implementation
+ * dependent and does not depend on the indent amount.  The following
+ * is an example output of a sparsebit array that has bits:
+ *
+ *   0x5, 0x8, 0xa:0xe, 0x12
+ *
+ * This corresponds to a sparsebit whose bits 5, 8, 10, 11, 12, 13, 14, 18
+ * are set.  Note that a ':', instead of a '-' is used to specify a range of
+ * contiguous bits.  This is done because '-' is used to specify command-line
+ * options, and sometimes ranges are specified as command-line arguments.
+ */
+void sparsebit_dump(FILE *stream, struct sparsebit *s,
+        unsigned int indent)
+{
+        size_t current_line_len = 0;
+        size_t sz;
+        struct node *nodep;
+
+        if (!sparsebit_any_set(s))
+                return;
+
+        /* Display initial indent */
+        fprintf(stream, "%*s", indent, "");
+
+        /* For each node */
+        for (nodep = node_first(s); nodep; nodep = node_next(s, nodep)) {
+                unsigned int n1;
+                sparsebit_idx_t low, high;
+
+                /* For each group of bits in the mask */
+                for (n1 = 0; n1 < MASK_BITS; n1++) {
+                        if (nodep->mask & (1 << n1)) {
+                                low = high = nodep->idx + n1;
+
+                                for (; n1 < MASK_BITS; n1++) {
+                                        if (nodep->mask & (1 << n1))
+                                                high = nodep->idx + n1;
+                                        else
+                                                break;
+                                }
+
+                                if ((n1 == MASK_BITS) && nodep->num_after)
+                                        high += nodep->num_after;
+
+                                /*
+                                 * How much room will it take to display
+                                 * this range.
+                                 */
+                                sz = display_range(NULL, low, high,
+                                        current_line_len != 0);
+
+                                /*
+                                 * If there is not enough room, display
+                                 * a newline plus the indent of the next
+                                 * line.
+                                 */
+                                if (current_line_len + sz > DUMP_LINE_MAX) {
+                                        fputs("\n", stream);
+                                        fprintf(stream, "%*s", indent, "");
+                                        current_line_len = 0;
+                                }
+
+                                /* Display the range */
+                                sz = display_range(stream, low, high,
+                                        current_line_len != 0);
+                                current_line_len += sz;
+                        }
+                }
+
+                /*
+                 * If num_after and most significant-bit of mask is not
+                 * set, then still need to display a range for the bits
+                 * described by num_after.
+                 */
+                if (!(nodep->mask & (1 << (MASK_BITS - 1))) && nodep->num_after) {
+                        low = nodep->idx + MASK_BITS;
+                        high = nodep->idx + MASK_BITS + nodep->num_after - 1;
+
+                        /*
+                         * How much room will it take to display
+                         * this range.
+                         */
+                        sz = display_range(NULL, low, high,
+                                current_line_len != 0);
+
+                        /*
+                         * If there is not enough room, display
+                         * a newline plus the indent of the next
+                         * line.
+                         */
+                        if (current_line_len + sz > DUMP_LINE_MAX) {
+                                fputs("\n", stream);
+                                fprintf(stream, "%*s", indent, "");
+                                current_line_len = 0;
+                        }
+
+                        /* Display the range */
+                        sz = display_range(stream, low, high,
+                                current_line_len != 0);
+                        current_line_len += sz;
+                }
+        }
+        fputs("\n", stream);
+}
+
+/* Validates the internal state of the sparsebit array given by
+ * s.  On error, diagnostic information is printed to stderr and
+ * abort is called.
+ */
+void sparsebit_validate_internal(struct sparsebit *s)
+{
+        bool error_detected = false;
+        struct node *nodep, *prev = NULL;
+        sparsebit_num_t total_bits_set = 0;
+        unsigned int n1;
+
+        /* For each node */
+        for (nodep = node_first(s); nodep;
+                prev = nodep, nodep = node_next(s, nodep)) {
+
+                /*
+                 * Increase total bits set by the number of bits set
+                 * in this node.
+                 */
+                for (n1 = 0; n1 < MASK_BITS; n1++)
+                        if (nodep->mask & (1 << n1))
+                                total_bits_set++;
+
+                total_bits_set += nodep->num_after;
+
+                /*
+                 * Arbitrary choice as to whether a mask of 0 is allowed
+                 * or not.  For diagnostic purposes it is beneficial to
+                 * have only one valid means to represent a set of bits.
+                 * To support this an arbitrary choice has been made
+                 * to not allow a mask of zero.
+                 */
+                if (nodep->mask == 0) {
+                        fprintf(stderr, "Node mask of zero, "
+                                "nodep: %p nodep->mask: 0x%x",
+                                nodep, nodep->mask);
+                        error_detected = true;
+                        break;
+                }
+
+                /*
+                 * Validate num_after is not greater than the max index
+                 * - the number of mask bits.  The num_after member
+                 * uses 0-based indexing and thus has no value that
+                 * represents all bits set.  This limitation is handled
+                 * by requiring a non-zero mask.  With a non-zero mask,
+                 * MASK_BITS worth of bits are described by the mask,
+                 * which makes the largest needed num_after equal to:
+                 *
+                 *    (~(sparsebit_num_t) 0) - MASK_BITS + 1
+                 */
+                if (nodep->num_after
+                        > (~(sparsebit_num_t) 0) - MASK_BITS + 1) {
+                        fprintf(stderr, "num_after too large, "
+                                "nodep: %p nodep->num_after: 0x%lx",
+                                nodep, nodep->num_after);
+                        error_detected = true;
+                        break;
+                }
+
+                /* Validate node index is divisible by the mask size */
+                if (nodep->idx % MASK_BITS) {
+                        fprintf(stderr, "Node index not divisible by "
+                                "mask size,\n"
+                                "  nodep: %p nodep->idx: 0x%lx "
+                                "MASK_BITS: %lu\n",
+                                nodep, nodep->idx, MASK_BITS);
+                        error_detected = true;
+                        break;
+                }
+
+                /*
+                 * Validate bits described by node don't wrap beyond the
+                 * highest supported index.
+                 */
+                if ((nodep->idx + MASK_BITS + nodep->num_after - 1) < nodep->idx) {
+                        fprintf(stderr, "Bits described by node wrap "
+                                "beyond highest supported index,\n"
+                                "  nodep: %p nodep->idx: 0x%lx\n"
+                                "  MASK_BITS: %lu nodep->num_after: 0x%lx",
+                                nodep, nodep->idx, MASK_BITS, nodep->num_after);
+                        error_detected = true;
+                        break;
+                }
+
+                /* Check parent pointers. */
+                if (nodep->left) {
+                        if (nodep->left->parent != nodep) {
+                                fprintf(stderr, "Left child parent pointer "
+                                        "doesn't point to this node,\n"
+                                        "  nodep: %p nodep->left: %p "
+                                        "nodep->left->parent: %p",
+                                        nodep, nodep->left,
+                                        nodep->left->parent);
+                                error_detected = true;
+                                break;
+                        }
+                }
+
+                if (nodep->right) {
+                        if (nodep->right->parent != nodep) {
+                                fprintf(stderr, "Right child parent pointer "
+                                        "doesn't point to this node,\n"
+                                        "  nodep: %p nodep->right: %p "
+                                        "nodep->right->parent: %p",
+                                        nodep, nodep->right,
+                                        nodep->right->parent);
+                                error_detected = true;
+                                break;
+                        }
+                }
+
+                if (!nodep->parent) {
+                        if (s->root != nodep) {
+                                fprintf(stderr, "Unexpected root node, "
+                                        "s->root: %p nodep: %p",
+                                        s->root, nodep);
+                                error_detected = true;
+                                break;
+                        }
+                }
+
+                if (prev) {
+                        /*
+                         * Is index of previous node before index of
+                         * current node?
+                         */
+                        if (prev->idx >= nodep->idx) {
+                                fprintf(stderr, "Previous node index "
+                                        ">= current node index,\n"
+                                        "  prev: %p prev->idx: 0x%lx\n"
+                                        "  nodep: %p nodep->idx: 0x%lx",
+                                        prev, prev->idx, nodep, nodep->idx);
+                                error_detected = true;
+                                break;
+                        }
+
+                        /*
+                         * Nodes occur in asscending order, based on each
+                         * nodes starting index.
+                         */
+                        if ((prev->idx + MASK_BITS + prev->num_after - 1)
+                                >= nodep->idx) {
+                                fprintf(stderr, "Previous node bit range "
+                                        "overlap with current node bit range,\n"
+                                        "  prev: %p prev->idx: 0x%lx "
+                                        "prev->num_after: 0x%lx\n"
+                                        "  nodep: %p nodep->idx: 0x%lx "
+                                        "nodep->num_after: 0x%lx\n"
+                                        "  MASK_BITS: %lu",
+                                        prev, prev->idx, prev->num_after,
+                                        nodep, nodep->idx, nodep->num_after,
+                                        MASK_BITS);
+                                error_detected = true;
+                                break;
+                        }
+
+                        /*
+                         * When the node has all mask bits set, it shouldn't
+                         * be adjacent to the last bit described by the
+                         * previous node.
+                         */
+                        if (nodep->mask == ~(mask_t) 0 &&
+                            prev->idx + MASK_BITS + prev->num_after == nodep->idx) {
+                                fprintf(stderr, "Current node has mask with "
+                                        "all bits set and is adjacent to the "
+                                        "previous node,\n"
+                                        "  prev: %p prev->idx: 0x%lx "
+                                        "prev->num_after: 0x%lx\n"
+                                        "  nodep: %p nodep->idx: 0x%lx "
+                                        "nodep->num_after: 0x%lx\n"
+                                        "  MASK_BITS: %lu",
+                                        prev, prev->idx, prev->num_after,
+                                        nodep, nodep->idx, nodep->num_after,
+                                        MASK_BITS);
+
+                                error_detected = true;
+                                break;
+                        }
+                }
+        }
+
+        if (!error_detected) {
+                /*
+                 * Is sum of bits set in each node equal to the count
+                 * of total bits set.
+                 */
+                if (s->num_set != total_bits_set) {
+                        fprintf(stderr, "Number of bits set missmatch,\n"
+                                "  s->num_set: 0x%lx total_bits_set: 0x%lx",
+                                s->num_set, total_bits_set);
+
+                        error_detected = true;
+                }
+        }
+
+        if (error_detected) {
+                fputs("  dump_internal:\n", stderr);
+                sparsebit_dump_internal(stderr, s, 4);
+                abort();
+        }
+}
+
+
+#ifdef FUZZ
+/* A simple but effective fuzzing driver.  Look for bugs with the help
+ * of some invariants and of a trivial representation of sparsebit.
+ * Just use 512 bytes of /dev/zero and /dev/urandom as inputs, and let
+ * afl-fuzz do the magic. :)
+ */
+
+#include <stdlib.h>
+#include <assert.h>
+
+struct range {
+        sparsebit_idx_t first, last;
+        bool set;
+};
+
+struct sparsebit *s;
+struct range ranges[1000];
+int num_ranges;
+
+static bool get_value(sparsebit_idx_t idx)
+{
+        int i;
+
+        for (i = num_ranges; --i >= 0; )
+                if (ranges[i].first <= idx && idx <= ranges[i].last)
+                        return ranges[i].set;
+
+        return false;
+}
+
+static void operate(int code, sparsebit_idx_t first, sparsebit_idx_t last)
+{
+        sparsebit_num_t num;
+        sparsebit_idx_t next;
+
+        if (first < last) {
+                num = last - first + 1;
+        } else {
+                num = first - last + 1;
+                first = last;
+                last = first + num - 1;
+        }
+
+        switch (code) {
+        case 0:
+                sparsebit_set(s, first);
+                assert(sparsebit_is_set(s, first));
+                assert(!sparsebit_is_clear(s, first));
+                assert(sparsebit_any_set(s));
+                assert(!sparsebit_all_clear(s));
+                if (get_value(first))
+                        return;
+                if (num_ranges == 1000)
+                        exit(0);
+                ranges[num_ranges++] = (struct range)
+                        { .first = first, .last = first, .set = true };
+                break;
+        case 1:
+                sparsebit_clear(s, first);
+                assert(!sparsebit_is_set(s, first));
+                assert(sparsebit_is_clear(s, first));
+                assert(sparsebit_any_clear(s));
+                assert(!sparsebit_all_set(s));
+                if (!get_value(first))
+                        return;
+                if (num_ranges == 1000)
+                        exit(0);
+                ranges[num_ranges++] = (struct range)
+                        { .first = first, .last = first, .set = false };
+                break;
+        case 2:
+                assert(sparsebit_is_set(s, first) == get_value(first));
+                assert(sparsebit_is_clear(s, first) == !get_value(first));
+                break;
+        case 3:
+                if (sparsebit_any_set(s))
+                        assert(get_value(sparsebit_first_set(s)));
+                if (sparsebit_any_clear(s))
+                        assert(!get_value(sparsebit_first_clear(s)));
+                sparsebit_set_all(s);
+                assert(!sparsebit_any_clear(s));
+                assert(sparsebit_all_set(s));
+                num_ranges = 0;
+                ranges[num_ranges++] = (struct range)
+                        { .first = 0, .last = ~(sparsebit_idx_t)0, .set = true };
+                break;
+        case 4:
+                if (sparsebit_any_set(s))
+                        assert(get_value(sparsebit_first_set(s)));
+                if (sparsebit_any_clear(s))
+                        assert(!get_value(sparsebit_first_clear(s)));
+                sparsebit_clear_all(s);
+                assert(!sparsebit_any_set(s));
+                assert(sparsebit_all_clear(s));
+                num_ranges = 0;
+                break;
+        case 5:
+                next = sparsebit_next_set(s, first);
+                assert(next == 0 || next > first);
+                assert(next == 0 || get_value(next));
+                break;
+        case 6:
+                next = sparsebit_next_clear(s, first);
+                assert(next == 0 || next > first);
+                assert(next == 0 || !get_value(next));
+                break;
+        case 7:
+                next = sparsebit_next_clear(s, first);
+                if (sparsebit_is_set_num(s, first, num)) {
+                        assert(next == 0 || next > last);
+                        if (first)
+                                next = sparsebit_next_set(s, first - 1);
+                        else if (sparsebit_any_set(s))
+                                next = sparsebit_first_set(s);
+                        else
+                                return;
+                        assert(next == first);
+                } else {
+                        assert(sparsebit_is_clear(s, first) || next <= last);
+                }
+                break;
+        case 8:
+                next = sparsebit_next_set(s, first);
+                if (sparsebit_is_clear_num(s, first, num)) {
+                        assert(next == 0 || next > last);
+                        if (first)
+                                next = sparsebit_next_clear(s, first - 1);
+                        else if (sparsebit_any_clear(s))
+                                next = sparsebit_first_clear(s);
+                        else
+                                return;
+                        assert(next == first);
+                } else {
+                        assert(sparsebit_is_set(s, first) || next <= last);
+                }
+                break;
+        case 9:
+                sparsebit_set_num(s, first, num);
+                assert(sparsebit_is_set_num(s, first, num));
+                assert(!sparsebit_is_clear_num(s, first, num));
+                assert(sparsebit_any_set(s));
+                assert(!sparsebit_all_clear(s));
+                if (num_ranges == 1000)
+                        exit(0);
+                ranges[num_ranges++] = (struct range)
+                        { .first = first, .last = last, .set = true };
+                break;
+        case 10:
+                sparsebit_clear_num(s, first, num);
+                assert(!sparsebit_is_set_num(s, first, num));
+                assert(sparsebit_is_clear_num(s, first, num));
+                assert(sparsebit_any_clear(s));
+                assert(!sparsebit_all_set(s));
+                if (num_ranges == 1000)
+                        exit(0);
+                ranges[num_ranges++] = (struct range)
+                        { .first = first, .last = last, .set = false };
+                break;
+        case 11:
+                sparsebit_validate_internal(s);
+                break;
+        default:
+                break;
+        }
+}
+
+unsigned char get8(void)
+{
+        int ch;
+
+        ch = getchar();
+        if (ch == EOF)
+                exit(0);
+        return ch;
+}
+
+uint64_t get64(void)
+{
+        uint64_t x;
+
+        x = get8();
+        x = (x << 8) | get8();
+        x = (x << 8) | get8();
+        x = (x << 8) | get8();
+        x = (x << 8) | get8();
+        x = (x << 8) | get8();
+        x = (x << 8) | get8();
+        return (x << 8) | get8();
+}
+
+int main(void)
+{
+        s = sparsebit_alloc();
+        for (;;) {
+                uint8_t op = get8() & 0xf;
+                uint64_t first = get64();
+                uint64_t last = get64();
+
+                operate(op, first, last);
+        }
+}
+#endif
diff --git a/tools/testing/selftests/kvm/lib/vmx.c b/tools/testing/selftests/kvm/lib/vmx.c
new file mode 100644
index 000000000000..0231bc0aae7b
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/vmx.c
@@ -0,0 +1,243 @@
+/*
+ * tools/testing/selftests/kvm/lib/x86.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#define _GNU_SOURCE /* for program_invocation_name */
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "x86.h"
+#include "vmx.h"
+
+/* Create a default VM for VMX tests.
+ *
+ * Input Args:
+ *   vcpuid - The id of the single VCPU to add to the VM.
+ *   guest_code - The vCPU's entry point
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to opaque structure that describes the created VM.
+ */
+struct kvm_vm *
+vm_create_default_vmx(uint32_t vcpuid, vmx_guest_code_t guest_code)
+{
+        struct kvm_cpuid2 *cpuid;
+        struct kvm_vm *vm;
+        vm_vaddr_t vmxon_vaddr;
+        vm_paddr_t vmxon_paddr;
+        vm_vaddr_t vmcs_vaddr;
+        vm_paddr_t vmcs_paddr;
+
+        vm = vm_create_default(vcpuid, (void *) guest_code);
+
+        /* Enable nesting in CPUID */
+        vcpu_set_cpuid(vm, vcpuid, kvm_get_supported_cpuid());
+
+        /* Setup of a region of guest memory for the vmxon region. */
+        vmxon_vaddr = vm_vaddr_alloc(vm, getpagesize(), 0, 0, 0);
+        vmxon_paddr = addr_gva2gpa(vm, vmxon_vaddr);
+
+        /* Setup of a region of guest memory for a vmcs. */
+        vmcs_vaddr = vm_vaddr_alloc(vm, getpagesize(), 0, 0, 0);
+        vmcs_paddr = addr_gva2gpa(vm, vmcs_vaddr);
+
+        vcpu_args_set(vm, vcpuid, 4, vmxon_vaddr, vmxon_paddr, vmcs_vaddr,
+                      vmcs_paddr);
+
+        return vm;
+}
+
+void prepare_for_vmx_operation(void)
+{
+        uint64_t feature_control;
+        uint64_t required;
+        unsigned long cr0;
+        unsigned long cr4;
+
+        /*
+         * Ensure bits in CR0 and CR4 are valid in VMX operation:
+         * - Bit X is 1 in _FIXED0: bit X is fixed to 1 in CRx.
+         * - Bit X is 0 in _FIXED1: bit X is fixed to 0 in CRx.
+         */
+        __asm__ __volatile__("mov %%cr0, %0" : "=r"(cr0) : : "memory");
+        cr0 &= rdmsr(MSR_IA32_VMX_CR0_FIXED1);
+        cr0 |= rdmsr(MSR_IA32_VMX_CR0_FIXED0);
+        __asm__ __volatile__("mov %0, %%cr0" : : "r"(cr0) : "memory");
+
+        __asm__ __volatile__("mov %%cr4, %0" : "=r"(cr4) : : "memory");
+        cr4 &= rdmsr(MSR_IA32_VMX_CR4_FIXED1);
+        cr4 |= rdmsr(MSR_IA32_VMX_CR4_FIXED0);
+        /* Enable VMX operation */
+        cr4 |= X86_CR4_VMXE;
+        __asm__ __volatile__("mov %0, %%cr4" : : "r"(cr4) : "memory");
+
+        /*
+         * Configure IA32_FEATURE_CONTROL MSR to allow VMXON:
+         *  Bit 0: Lock bit. If clear, VMXON causes a #GP.
+         *  Bit 2: Enables VMXON outside of SMX operation. If clear, VMXON
+         *    outside of SMX causes a #GP.
+         */
+        required = FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+        required |= FEATURE_CONTROL_LOCKED;
+        feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL);
+        if ((feature_control & required) != required)
+                wrmsr(MSR_IA32_FEATURE_CONTROL, feature_control | required);
+}
+
+/*
+ * Initialize the control fields to the most basic settings possible.
+ */
+static inline void init_vmcs_control_fields(void)
+{
+        vmwrite(VIRTUAL_PROCESSOR_ID, 0);
+        vmwrite(POSTED_INTR_NV, 0);
+
+        vmwrite(PIN_BASED_VM_EXEC_CONTROL, rdmsr(MSR_IA32_VMX_PINBASED_CTLS));
+        vmwrite(CPU_BASED_VM_EXEC_CONTROL, rdmsr(MSR_IA32_VMX_PROCBASED_CTLS));
+        vmwrite(EXCEPTION_BITMAP, 0);
+        vmwrite(PAGE_FAULT_ERROR_CODE_MASK, 0);
+        vmwrite(PAGE_FAULT_ERROR_CODE_MATCH, -1); /* Never match */
+        vmwrite(CR3_TARGET_COUNT, 0);
+        vmwrite(VM_EXIT_CONTROLS, rdmsr(MSR_IA32_VMX_EXIT_CTLS) |
+                VM_EXIT_HOST_ADDR_SPACE_SIZE);    /* 64-bit host */
+        vmwrite(VM_EXIT_MSR_STORE_COUNT, 0);
+        vmwrite(VM_EXIT_MSR_LOAD_COUNT, 0);
+        vmwrite(VM_ENTRY_CONTROLS, rdmsr(MSR_IA32_VMX_ENTRY_CTLS) |
+                VM_ENTRY_IA32E_MODE);             /* 64-bit guest */
+        vmwrite(VM_ENTRY_MSR_LOAD_COUNT, 0);
+        vmwrite(VM_ENTRY_INTR_INFO_FIELD, 0);
+        vmwrite(TPR_THRESHOLD, 0);
+        vmwrite(SECONDARY_VM_EXEC_CONTROL, 0);
+
+        vmwrite(CR0_GUEST_HOST_MASK, 0);
+        vmwrite(CR4_GUEST_HOST_MASK, 0);
+        vmwrite(CR0_READ_SHADOW, get_cr0());
+        vmwrite(CR4_READ_SHADOW, get_cr4());
+}
+
+/*
+ * Initialize the host state fields based on the current host state, with
+ * the exception of HOST_RSP and HOST_RIP, which should be set by vmlaunch
+ * or vmresume.
+ */
+static inline void init_vmcs_host_state(void)
+{
+        uint32_t exit_controls = vmreadz(VM_EXIT_CONTROLS);
+
+        vmwrite(HOST_ES_SELECTOR, get_es());
+        vmwrite(HOST_CS_SELECTOR, get_cs());
+        vmwrite(HOST_SS_SELECTOR, get_ss());
+        vmwrite(HOST_DS_SELECTOR, get_ds());
+        vmwrite(HOST_FS_SELECTOR, get_fs());
+        vmwrite(HOST_GS_SELECTOR, get_gs());
+        vmwrite(HOST_TR_SELECTOR, get_tr());
+
+        if (exit_controls & VM_EXIT_LOAD_IA32_PAT)
+                vmwrite(HOST_IA32_PAT, rdmsr(MSR_IA32_CR_PAT));
+        if (exit_controls & VM_EXIT_LOAD_IA32_EFER)
+                vmwrite(HOST_IA32_EFER, rdmsr(MSR_EFER));
+        if (exit_controls & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
+                vmwrite(HOST_IA32_PERF_GLOBAL_CTRL,
+                        rdmsr(MSR_CORE_PERF_GLOBAL_CTRL));
+
+        vmwrite(HOST_IA32_SYSENTER_CS, rdmsr(MSR_IA32_SYSENTER_CS));
+
+        vmwrite(HOST_CR0, get_cr0());
+        vmwrite(HOST_CR3, get_cr3());
+        vmwrite(HOST_CR4, get_cr4());
+        vmwrite(HOST_FS_BASE, rdmsr(MSR_FS_BASE));
+        vmwrite(HOST_GS_BASE, rdmsr(MSR_GS_BASE));
+        vmwrite(HOST_TR_BASE,
+                get_desc64_base((struct desc64 *)(get_gdt_base() + get_tr())));
+        vmwrite(HOST_GDTR_BASE, get_gdt_base());
+        vmwrite(HOST_IDTR_BASE, get_idt_base());
+        vmwrite(HOST_IA32_SYSENTER_ESP, rdmsr(MSR_IA32_SYSENTER_ESP));
+        vmwrite(HOST_IA32_SYSENTER_EIP, rdmsr(MSR_IA32_SYSENTER_EIP));
+}
+
+/*
+ * Initialize the guest state fields essentially as a clone of
+ * the host state fields. Some host state fields have fixed
+ * values, and we set the corresponding guest state fields accordingly.
+ */
+static inline void init_vmcs_guest_state(void *rip, void *rsp)
+{
+        vmwrite(GUEST_ES_SELECTOR, vmreadz(HOST_ES_SELECTOR));
+        vmwrite(GUEST_CS_SELECTOR, vmreadz(HOST_CS_SELECTOR));
+        vmwrite(GUEST_SS_SELECTOR, vmreadz(HOST_SS_SELECTOR));
+        vmwrite(GUEST_DS_SELECTOR, vmreadz(HOST_DS_SELECTOR));
+        vmwrite(GUEST_FS_SELECTOR, vmreadz(HOST_FS_SELECTOR));
+        vmwrite(GUEST_GS_SELECTOR, vmreadz(HOST_GS_SELECTOR));
+        vmwrite(GUEST_LDTR_SELECTOR, 0);
+        vmwrite(GUEST_TR_SELECTOR, vmreadz(HOST_TR_SELECTOR));
+        vmwrite(GUEST_INTR_STATUS, 0);
+        vmwrite(GUEST_PML_INDEX, 0);
+
+        vmwrite(VMCS_LINK_POINTER, -1ll);
+        vmwrite(GUEST_IA32_DEBUGCTL, 0);
+        vmwrite(GUEST_IA32_PAT, vmreadz(HOST_IA32_PAT));
+        vmwrite(GUEST_IA32_EFER, vmreadz(HOST_IA32_EFER));
+        vmwrite(GUEST_IA32_PERF_GLOBAL_CTRL,
+                vmreadz(HOST_IA32_PERF_GLOBAL_CTRL));
+
+        vmwrite(GUEST_ES_LIMIT, -1);
+        vmwrite(GUEST_CS_LIMIT, -1);
+        vmwrite(GUEST_SS_LIMIT, -1);
+        vmwrite(GUEST_DS_LIMIT, -1);
+        vmwrite(GUEST_FS_LIMIT, -1);
+        vmwrite(GUEST_GS_LIMIT, -1);
+        vmwrite(GUEST_LDTR_LIMIT, -1);
+        vmwrite(GUEST_TR_LIMIT, 0x67);
+        vmwrite(GUEST_GDTR_LIMIT, 0xffff);
+        vmwrite(GUEST_IDTR_LIMIT, 0xffff);
+        vmwrite(GUEST_ES_AR_BYTES,
+                vmreadz(GUEST_ES_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_CS_AR_BYTES, 0xa09b);
+        vmwrite(GUEST_SS_AR_BYTES, 0xc093);
+        vmwrite(GUEST_DS_AR_BYTES,
+                vmreadz(GUEST_DS_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_FS_AR_BYTES,
+                vmreadz(GUEST_FS_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_GS_AR_BYTES,
+                vmreadz(GUEST_GS_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_LDTR_AR_BYTES, 0x10000);
+        vmwrite(GUEST_TR_AR_BYTES, 0x8b);
+        vmwrite(GUEST_INTERRUPTIBILITY_INFO, 0);
+        vmwrite(GUEST_ACTIVITY_STATE, 0);
+        vmwrite(GUEST_SYSENTER_CS, vmreadz(HOST_IA32_SYSENTER_CS));
+        vmwrite(VMX_PREEMPTION_TIMER_VALUE, 0);
+
+        vmwrite(GUEST_CR0, vmreadz(HOST_CR0));
+        vmwrite(GUEST_CR3, vmreadz(HOST_CR3));
+        vmwrite(GUEST_CR4, vmreadz(HOST_CR4));
+        vmwrite(GUEST_ES_BASE, 0);
+        vmwrite(GUEST_CS_BASE, 0);
+        vmwrite(GUEST_SS_BASE, 0);
+        vmwrite(GUEST_DS_BASE, 0);
+        vmwrite(GUEST_FS_BASE, vmreadz(HOST_FS_BASE));
+        vmwrite(GUEST_GS_BASE, vmreadz(HOST_GS_BASE));
+        vmwrite(GUEST_LDTR_BASE, 0);
+        vmwrite(GUEST_TR_BASE, vmreadz(HOST_TR_BASE));
+        vmwrite(GUEST_GDTR_BASE, vmreadz(HOST_GDTR_BASE));
+        vmwrite(GUEST_IDTR_BASE, vmreadz(HOST_IDTR_BASE));
+        vmwrite(GUEST_DR7, 0x400);
+        vmwrite(GUEST_RSP, (uint64_t)rsp);
+        vmwrite(GUEST_RIP, (uint64_t)rip);
+        vmwrite(GUEST_RFLAGS, 2);
+        vmwrite(GUEST_PENDING_DBG_EXCEPTIONS, 0);
+        vmwrite(GUEST_SYSENTER_ESP, vmreadz(HOST_IA32_SYSENTER_ESP));
+        vmwrite(GUEST_SYSENTER_EIP, vmreadz(HOST_IA32_SYSENTER_EIP));
+}
+
+void prepare_vmcs(void *guest_rip, void *guest_rsp)
+{
+        init_vmcs_control_fields();
+        init_vmcs_host_state();
+        init_vmcs_guest_state(guest_rip, guest_rsp);
+}
diff --git a/tools/testing/selftests/kvm/lib/x86.c b/tools/testing/selftests/kvm/lib/x86.c
new file mode 100644
index 000000000000..2f17675f4275
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/x86.c
@@ -0,0 +1,700 @@
+/*
+ * tools/testing/selftests/kvm/lib/x86.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#define _GNU_SOURCE /* for program_invocation_name */
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "kvm_util_internal.h"
+#include "x86.h"
+
+/* Minimum physical address used for virtual translation tables. */
+#define KVM_GUEST_PAGE_TABLE_MIN_PADDR 0x180000
+
+/* Virtual translation table structure declarations */
+struct pageMapL4Entry {
+        uint64_t present:1;
+        uint64_t writable:1;
+        uint64_t user:1;
+        uint64_t write_through:1;
+        uint64_t cache_disable:1;
+        uint64_t accessed:1;
+        uint64_t ignored_06:1;
+        uint64_t page_size:1;
+        uint64_t ignored_11_08:4;
+        uint64_t address:40;
+        uint64_t ignored_62_52:11;
+        uint64_t execute_disable:1;
+};
+
+struct pageDirectoryPointerEntry {
+        uint64_t present:1;
+        uint64_t writable:1;
+        uint64_t user:1;
+        uint64_t write_through:1;
+        uint64_t cache_disable:1;
+        uint64_t accessed:1;
+        uint64_t ignored_06:1;
+        uint64_t page_size:1;
+        uint64_t ignored_11_08:4;
+        uint64_t address:40;
+        uint64_t ignored_62_52:11;
+        uint64_t execute_disable:1;
+};
+
+struct pageDirectoryEntry {
+        uint64_t present:1;
+        uint64_t writable:1;
+        uint64_t user:1;
+        uint64_t write_through:1;
+        uint64_t cache_disable:1;
+        uint64_t accessed:1;
+        uint64_t ignored_06:1;
+        uint64_t page_size:1;
+        uint64_t ignored_11_08:4;
+        uint64_t address:40;
+        uint64_t ignored_62_52:11;
+        uint64_t execute_disable:1;
+};
+
+struct pageTableEntry {
+        uint64_t present:1;
+        uint64_t writable:1;
+        uint64_t user:1;
+        uint64_t write_through:1;
+        uint64_t cache_disable:1;
+        uint64_t accessed:1;
+        uint64_t dirty:1;
+        uint64_t reserved_07:1;
+        uint64_t global:1;
+        uint64_t ignored_11_09:3;
+        uint64_t address:40;
+        uint64_t ignored_62_52:11;
+        uint64_t execute_disable:1;
+};
+
+/* Register Dump
+ *
+ * Input Args:
+ *   indent - Left margin indent amount
+ *   regs - register
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps the state of the registers given by regs, to the FILE stream
+ * given by steam.
+ */
+void regs_dump(FILE *stream, struct kvm_regs *regs,
+               uint8_t indent)
+{
+        fprintf(stream, "%*srax: 0x%.16llx rbx: 0x%.16llx "
+                "rcx: 0x%.16llx rdx: 0x%.16llx\n",
+                indent, "",
+                regs->rax, regs->rbx, regs->rcx, regs->rdx);
+        fprintf(stream, "%*srsi: 0x%.16llx rdi: 0x%.16llx "
+                "rsp: 0x%.16llx rbp: 0x%.16llx\n",
+                indent, "",
+                regs->rsi, regs->rdi, regs->rsp, regs->rbp);
+        fprintf(stream, "%*sr8:  0x%.16llx r9:  0x%.16llx "
+                "r10: 0x%.16llx r11: 0x%.16llx\n",
+                indent, "",
+                regs->r8, regs->r9, regs->r10, regs->r11);
+        fprintf(stream, "%*sr12: 0x%.16llx r13: 0x%.16llx "
+                "r14: 0x%.16llx r15: 0x%.16llx\n",
+                indent, "",
+                regs->r12, regs->r13, regs->r14, regs->r15);
+        fprintf(stream, "%*srip: 0x%.16llx rfl: 0x%.16llx\n",
+                indent, "",
+                regs->rip, regs->rflags);
+}
+
+/* Segment Dump
+ *
+ * Input Args:
+ *   indent - Left margin indent amount
+ *   segment - KVM segment
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps the state of the KVM segment given by segment, to the FILE stream
+ * given by steam.
+ */
+static void segment_dump(FILE *stream, struct kvm_segment *segment,
+                         uint8_t indent)
+{
+        fprintf(stream, "%*sbase: 0x%.16llx limit: 0x%.8x "
+                "selector: 0x%.4x type: 0x%.2x\n",
+                indent, "", segment->base, segment->limit,
+                segment->selector, segment->type);
+        fprintf(stream, "%*spresent: 0x%.2x dpl: 0x%.2x "
+                "db: 0x%.2x s: 0x%.2x l: 0x%.2x\n",
+                indent, "", segment->present, segment->dpl,
+                segment->db, segment->s, segment->l);
+        fprintf(stream, "%*sg: 0x%.2x avl: 0x%.2x "
+                "unusable: 0x%.2x padding: 0x%.2x\n",
+                indent, "", segment->g, segment->avl,
+                segment->unusable, segment->padding);
+}
+
+/* dtable Dump
+ *
+ * Input Args:
+ *   indent - Left margin indent amount
+ *   dtable - KVM dtable
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps the state of the KVM dtable given by dtable, to the FILE stream
+ * given by steam.
+ */
+static void dtable_dump(FILE *stream, struct kvm_dtable *dtable,
+                        uint8_t indent)
+{
+        fprintf(stream, "%*sbase: 0x%.16llx limit: 0x%.4x "
+                "padding: 0x%.4x 0x%.4x 0x%.4x\n",
+                indent, "", dtable->base, dtable->limit,
+                dtable->padding[0], dtable->padding[1], dtable->padding[2]);
+}
+
+/* System Register Dump
+ *
+ * Input Args:
+ *   indent - Left margin indent amount
+ *   sregs - System registers
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps the state of the system registers given by sregs, to the FILE stream
+ * given by steam.
+ */
+void sregs_dump(FILE *stream, struct kvm_sregs *sregs,
+                uint8_t indent)
+{
+        unsigned int i;
+
+        fprintf(stream, "%*scs:\n", indent, "");
+        segment_dump(stream, &sregs->cs, indent + 2);
+        fprintf(stream, "%*sds:\n", indent, "");
+        segment_dump(stream, &sregs->ds, indent + 2);
+        fprintf(stream, "%*ses:\n", indent, "");
+        segment_dump(stream, &sregs->es, indent + 2);
+        fprintf(stream, "%*sfs:\n", indent, "");
+        segment_dump(stream, &sregs->fs, indent + 2);
+        fprintf(stream, "%*sgs:\n", indent, "");
+        segment_dump(stream, &sregs->gs, indent + 2);
+        fprintf(stream, "%*sss:\n", indent, "");
+        segment_dump(stream, &sregs->ss, indent + 2);
+        fprintf(stream, "%*str:\n", indent, "");
+        segment_dump(stream, &sregs->tr, indent + 2);
+        fprintf(stream, "%*sldt:\n", indent, "");
+        segment_dump(stream, &sregs->ldt, indent + 2);
+
+        fprintf(stream, "%*sgdt:\n", indent, "");
+        dtable_dump(stream, &sregs->gdt, indent + 2);
+        fprintf(stream, "%*sidt:\n", indent, "");
+        dtable_dump(stream, &sregs->idt, indent + 2);
+
+        fprintf(stream, "%*scr0: 0x%.16llx cr2: 0x%.16llx "
+                "cr3: 0x%.16llx cr4: 0x%.16llx\n",
+                indent, "",
+                sregs->cr0, sregs->cr2, sregs->cr3, sregs->cr4);
+        fprintf(stream, "%*scr8: 0x%.16llx efer: 0x%.16llx "
+                "apic_base: 0x%.16llx\n",
+                indent, "",
+                sregs->cr8, sregs->efer, sregs->apic_base);
+
+        fprintf(stream, "%*sinterrupt_bitmap:\n", indent, "");
+        for (i = 0; i < (KVM_NR_INTERRUPTS + 63) / 64; i++) {
+                fprintf(stream, "%*s%.16llx\n", indent + 2, "",
+                        sregs->interrupt_bitmap[i]);
+        }
+}
+
+void virt_pgd_alloc(struct kvm_vm *vm, uint32_t pgd_memslot)
+{
+        int rc;
+
+        TEST_ASSERT(vm->mode == VM_MODE_FLAT48PG, "Attempt to use "
+                "unknown or unsupported guest mode, mode: 0x%x", vm->mode);
+
+        /* If needed, create page map l4 table. */
+        if (!vm->pgd_created) {
+                vm_paddr_t paddr = vm_phy_page_alloc(vm,
+                        KVM_GUEST_PAGE_TABLE_MIN_PADDR, pgd_memslot);
+                vm->pgd = paddr;
+
+                /* Set pointer to pgd tables in all the VCPUs that
+                 * have already been created.  Future VCPUs will have
+                 * the value set as each one is created.
+                 */
+                for (struct vcpu *vcpu = vm->vcpu_head; vcpu;
+                        vcpu = vcpu->next) {
+                        struct kvm_sregs sregs;
+
+                        /* Obtain the current system register settings */
+                        vcpu_sregs_get(vm, vcpu->id, &sregs);
+
+                        /* Set and store the pointer to the start of the
+                         * pgd tables.
+                         */
+                        sregs.cr3 = vm->pgd;
+                        vcpu_sregs_set(vm, vcpu->id, &sregs);
+                }
+
+                vm->pgd_created = true;
+        }
+}
+
+/* VM Virtual Page Map
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vaddr - VM Virtual Address
+ *   paddr - VM Physical Address
+ *   pgd_memslot - Memory region slot for new virtual translation tables
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Within the VM given by vm, creates a virtual translation for the page
+ * starting at vaddr to the page starting at paddr.
+ */
+void virt_pg_map(struct kvm_vm *vm, uint64_t vaddr, uint64_t paddr,
+        uint32_t pgd_memslot)
+{
+        uint16_t index[4];
+        struct pageMapL4Entry *pml4e;
+
+        TEST_ASSERT(vm->mode == VM_MODE_FLAT48PG, "Attempt to use "
+                "unknown or unsupported guest mode, mode: 0x%x", vm->mode);
+
+        TEST_ASSERT((vaddr % vm->page_size) == 0,
+                "Virtual address not on page boundary,\n"
+                "  vaddr: 0x%lx vm->page_size: 0x%x",
+                vaddr, vm->page_size);
+        TEST_ASSERT(sparsebit_is_set(vm->vpages_valid,
+                (vaddr >> vm->page_shift)),
+                "Invalid virtual address, vaddr: 0x%lx",
+                vaddr);
+        TEST_ASSERT((paddr % vm->page_size) == 0,
+                "Physical address not on page boundary,\n"
+                "  paddr: 0x%lx vm->page_size: 0x%x",
+                paddr, vm->page_size);
+        TEST_ASSERT((paddr >> vm->page_shift) <= vm->max_gfn,
+                "Physical address beyond beyond maximum supported,\n"
+                "  paddr: 0x%lx vm->max_gfn: 0x%lx vm->page_size: 0x%x",
+                paddr, vm->max_gfn, vm->page_size);
+
+        index[0] = (vaddr >> 12) & 0x1ffu;
+        index[1] = (vaddr >> 21) & 0x1ffu;
+        index[2] = (vaddr >> 30) & 0x1ffu;
+        index[3] = (vaddr >> 39) & 0x1ffu;
+
+        /* Allocate page directory pointer table if not present. */
+        pml4e = addr_gpa2hva(vm, vm->pgd);
+        if (!pml4e[index[3]].present) {
+                pml4e[index[3]].address = vm_phy_page_alloc(vm,
+                        KVM_GUEST_PAGE_TABLE_MIN_PADDR, pgd_memslot)
+                        >> vm->page_shift;
+                pml4e[index[3]].writable = true;
+                pml4e[index[3]].present = true;
+        }
+
+        /* Allocate page directory table if not present. */
+        struct pageDirectoryPointerEntry *pdpe;
+        pdpe = addr_gpa2hva(vm, pml4e[index[3]].address * vm->page_size);
+        if (!pdpe[index[2]].present) {
+                pdpe[index[2]].address = vm_phy_page_alloc(vm,
+                        KVM_GUEST_PAGE_TABLE_MIN_PADDR, pgd_memslot)
+                        >> vm->page_shift;
+                pdpe[index[2]].writable = true;
+                pdpe[index[2]].present = true;
+        }
+
+        /* Allocate page table if not present. */
+        struct pageDirectoryEntry *pde;
+        pde = addr_gpa2hva(vm, pdpe[index[2]].address * vm->page_size);
+        if (!pde[index[1]].present) {
+                pde[index[1]].address = vm_phy_page_alloc(vm,
+                        KVM_GUEST_PAGE_TABLE_MIN_PADDR, pgd_memslot)
+                        >> vm->page_shift;
+                pde[index[1]].writable = true;
+                pde[index[1]].present = true;
+        }
+
+        /* Fill in page table entry. */
+        struct pageTableEntry *pte;
+        pte = addr_gpa2hva(vm, pde[index[1]].address * vm->page_size);
+        pte[index[0]].address = paddr >> vm->page_shift;
+        pte[index[0]].writable = true;
+        pte[index[0]].present = 1;
+}
+
+/* Virtual Translation Tables Dump
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   indent - Left margin indent amount
+ *
+ * Output Args:
+ *   stream - Output FILE stream
+ *
+ * Return: None
+ *
+ * Dumps to the FILE stream given by stream, the contents of all the
+ * virtual translation tables for the VM given by vm.
+ */
+void virt_dump(FILE *stream, struct kvm_vm *vm, uint8_t indent)
+{
+        struct pageMapL4Entry *pml4e, *pml4e_start;
+        struct pageDirectoryPointerEntry *pdpe, *pdpe_start;
+        struct pageDirectoryEntry *pde, *pde_start;
+        struct pageTableEntry *pte, *pte_start;
+
+        if (!vm->pgd_created)
+                return;
+
+        fprintf(stream, "%*s                                          "
+                "                no\n", indent, "");
+        fprintf(stream, "%*s      index hvaddr         gpaddr         "
+                "addr         w exec dirty\n",
+                indent, "");
+        pml4e_start = (struct pageMapL4Entry *) addr_gpa2hva(vm,
+                vm->pgd);
+        for (uint16_t n1 = 0; n1 <= 0x1ffu; n1++) {
+                pml4e = &pml4e_start[n1];
+                if (!pml4e->present)
+                        continue;
+                fprintf(stream, "%*spml4e 0x%-3zx %p 0x%-12lx 0x%-10lx %u "
+                        " %u\n",
+                        indent, "",
+                        pml4e - pml4e_start, pml4e,
+                        addr_hva2gpa(vm, pml4e), (uint64_t) pml4e->address,
+                        pml4e->writable, pml4e->execute_disable);
+
+                pdpe_start = addr_gpa2hva(vm, pml4e->address
+                        * vm->page_size);
+                for (uint16_t n2 = 0; n2 <= 0x1ffu; n2++) {
+                        pdpe = &pdpe_start[n2];
+                        if (!pdpe->present)
+                                continue;
+                        fprintf(stream, "%*spdpe  0x%-3zx %p 0x%-12lx 0x%-10lx "
+                                "%u  %u\n",
+                                indent, "",
+                                pdpe - pdpe_start, pdpe,
+                                addr_hva2gpa(vm, pdpe),
+                                (uint64_t) pdpe->address, pdpe->writable,
+                                pdpe->execute_disable);
+
+                        pde_start = addr_gpa2hva(vm,
+                                pdpe->address * vm->page_size);
+                        for (uint16_t n3 = 0; n3 <= 0x1ffu; n3++) {
+                                pde = &pde_start[n3];
+                                if (!pde->present)
+                                        continue;
+                                fprintf(stream, "%*spde   0x%-3zx %p "
+                                        "0x%-12lx 0x%-10lx %u  %u\n",
+                                        indent, "", pde - pde_start, pde,
+                                        addr_hva2gpa(vm, pde),
+                                        (uint64_t) pde->address, pde->writable,
+                                        pde->execute_disable);
+
+                                pte_start = addr_gpa2hva(vm,
+                                        pde->address * vm->page_size);
+                                for (uint16_t n4 = 0; n4 <= 0x1ffu; n4++) {
+                                        pte = &pte_start[n4];
+                                        if (!pte->present)
+                                                continue;
+                                        fprintf(stream, "%*spte   0x%-3zx %p "
+                                                "0x%-12lx 0x%-10lx %u  %u "
+                                                "    %u    0x%-10lx\n",
+                                                indent, "",
+                                                pte - pte_start, pte,
+                                                addr_hva2gpa(vm, pte),
+                                                (uint64_t) pte->address,
+                                                pte->writable,
+                                                pte->execute_disable,
+                                                pte->dirty,
+                                                ((uint64_t) n1 << 27)
+                                                        | ((uint64_t) n2 << 18)
+                                                        | ((uint64_t) n3 << 9)
+                                                        | ((uint64_t) n4));
+                                }
+                        }
+                }
+        }
+}
+
+/* Set Unusable Segment
+ *
+ * Input Args: None
+ *
+ * Output Args:
+ *   segp - Pointer to segment register
+ *
+ * Return: None
+ *
+ * Sets the segment register pointed to by segp to an unusable state.
+ */
+static void kvm_seg_set_unusable(struct kvm_segment *segp)
+{
+        memset(segp, 0, sizeof(*segp));
+        segp->unusable = true;
+}
+
+/* Set Long Mode Flat Kernel Code Segment
+ *
+ * Input Args:
+ *   selector - selector value
+ *
+ * Output Args:
+ *   segp - Pointer to KVM segment
+ *
+ * Return: None
+ *
+ * Sets up the KVM segment pointed to by segp, to be a code segment
+ * with the selector value given by selector.
+ */
+static void kvm_seg_set_kernel_code_64bit(uint16_t selector,
+        struct kvm_segment *segp)
+{
+        memset(segp, 0, sizeof(*segp));
+        segp->selector = selector;
+        segp->limit = 0xFFFFFFFFu;
+        segp->s = 0x1; /* kTypeCodeData */
+        segp->type = 0x08 | 0x01 | 0x02; /* kFlagCode | kFlagCodeAccessed
+                                          * | kFlagCodeReadable
+                                          */
+        segp->g = true;
+        segp->l = true;
+        segp->present = 1;
+}
+
+/* Set Long Mode Flat Kernel Data Segment
+ *
+ * Input Args:
+ *   selector - selector value
+ *
+ * Output Args:
+ *   segp - Pointer to KVM segment
+ *
+ * Return: None
+ *
+ * Sets up the KVM segment pointed to by segp, to be a data segment
+ * with the selector value given by selector.
+ */
+static void kvm_seg_set_kernel_data_64bit(uint16_t selector,
+        struct kvm_segment *segp)
+{
+        memset(segp, 0, sizeof(*segp));
+        segp->selector = selector;
+        segp->limit = 0xFFFFFFFFu;
+        segp->s = 0x1; /* kTypeCodeData */
+        segp->type = 0x00 | 0x01 | 0x02; /* kFlagData | kFlagDataAccessed
+                                          * | kFlagDataWritable
+                                          */
+        segp->g = true;
+        segp->present = true;
+}
+
+/* Address Guest Virtual to Guest Physical
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   gpa - VM virtual address
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Equivalent VM physical address
+ *
+ * Translates the VM virtual address given by gva to a VM physical
+ * address and then locates the memory region containing the VM
+ * physical address, within the VM given by vm.  When found, the host
+ * virtual address providing the memory to the vm physical address is returned.
+ * A TEST_ASSERT failure occurs if no region containing translated
+ * VM virtual address exists.
+ */
+vm_paddr_t addr_gva2gpa(struct kvm_vm *vm, vm_vaddr_t gva)
+{
+        uint16_t index[4];
+        struct pageMapL4Entry *pml4e;
+        struct pageDirectoryPointerEntry *pdpe;
+        struct pageDirectoryEntry *pde;
+        struct pageTableEntry *pte;
+        void *hva;
+
+        TEST_ASSERT(vm->mode == VM_MODE_FLAT48PG, "Attempt to use "
+                "unknown or unsupported guest mode, mode: 0x%x", vm->mode);
+
+        index[0] = (gva >> 12) & 0x1ffu;
+        index[1] = (gva >> 21) & 0x1ffu;
+        index[2] = (gva >> 30) & 0x1ffu;
+        index[3] = (gva >> 39) & 0x1ffu;
+
+        if (!vm->pgd_created)
+                goto unmapped_gva;
+        pml4e = addr_gpa2hva(vm, vm->pgd);
+        if (!pml4e[index[3]].present)
+                goto unmapped_gva;
+
+        pdpe = addr_gpa2hva(vm, pml4e[index[3]].address * vm->page_size);
+        if (!pdpe[index[2]].present)
+                goto unmapped_gva;
+
+        pde = addr_gpa2hva(vm, pdpe[index[2]].address * vm->page_size);
+        if (!pde[index[1]].present)
+                goto unmapped_gva;
+
+        pte = addr_gpa2hva(vm, pde[index[1]].address * vm->page_size);
+        if (!pte[index[0]].present)
+                goto unmapped_gva;
+
+        return (pte[index[0]].address * vm->page_size) + (gva & 0xfffu);
+
+unmapped_gva:
+        TEST_ASSERT(false, "No mapping for vm virtual address, "
+                    "gva: 0x%lx", gva);
+}
+
+void vcpu_setup(struct kvm_vm *vm, int vcpuid)
+{
+        struct kvm_sregs sregs;
+
+        /* Set mode specific system register values. */
+        vcpu_sregs_get(vm, vcpuid, &sregs);
+
+        switch (vm->mode) {
+        case VM_MODE_FLAT48PG:
+                sregs.cr0 = X86_CR0_PE | X86_CR0_NE | X86_CR0_PG;
+                sregs.cr4 |= X86_CR4_PAE;
+                sregs.efer |= (EFER_LME | EFER_LMA | EFER_NX);
+
+                kvm_seg_set_unusable(&sregs.ldt);
+                kvm_seg_set_kernel_code_64bit(0x8, &sregs.cs);
+                kvm_seg_set_kernel_data_64bit(0x10, &sregs.ds);
+                kvm_seg_set_kernel_data_64bit(0x10, &sregs.es);
+                break;
+
+        default:
+                TEST_ASSERT(false, "Unknown guest mode, mode: 0x%x", vm->mode);
+        }
+        vcpu_sregs_set(vm, vcpuid, &sregs);
+
+        /* If virtual translation table have been setup, set system register
+         * to point to the tables.  It's okay if they haven't been setup yet,
+         * in that the code that sets up the virtual translation tables, will
+         * go back through any VCPUs that have already been created and set
+         * their values.
+         */
+        if (vm->pgd_created) {
+                struct kvm_sregs sregs;
+
+                vcpu_sregs_get(vm, vcpuid, &sregs);
+
+                sregs.cr3 = vm->pgd;
+                vcpu_sregs_set(vm, vcpuid, &sregs);
+        }
+}
+/* Adds a vCPU with reasonable defaults (i.e., a stack)
+ *
+ * Input Args:
+ *   vcpuid - The id of the VCPU to add to the VM.
+ *   guest_code - The vCPU's entry point
+ */
+void vm_vcpu_add_default(struct kvm_vm *vm, uint32_t vcpuid, void *guest_code)
+{
+        struct kvm_mp_state mp_state;
+        struct kvm_regs regs;
+        vm_vaddr_t stack_vaddr;
+        stack_vaddr = vm_vaddr_alloc(vm, DEFAULT_STACK_PGS * getpagesize(),
+                                     DEFAULT_GUEST_STACK_VADDR_MIN, 0, 0);
+
+        /* Create VCPU */
+        vm_vcpu_add(vm, vcpuid);
+
+        /* Setup guest general purpose registers */
+        vcpu_regs_get(vm, vcpuid, &regs);
+        regs.rflags = regs.rflags | 0x2;
+        regs.rsp = stack_vaddr + (DEFAULT_STACK_PGS * getpagesize());
+        regs.rip = (unsigned long) guest_code;
+        vcpu_regs_set(vm, vcpuid, &regs);
+
+        /* Setup the MP state */
+        mp_state.mp_state = 0;
+        vcpu_set_mp_state(vm, vcpuid, &mp_state);
+}
+
+/* VM VCPU CPUID Set
+ *
+ * Input Args:
+ *   vm - Virtual Machine
+ *   vcpuid - VCPU id
+ *   cpuid - The CPUID values to set.
+ *
+ * Output Args: None
+ *
+ * Return: void
+ *
+ * Set the VCPU's CPUID.
+ */
+void vcpu_set_cpuid(struct kvm_vm *vm,
+                uint32_t vcpuid, struct kvm_cpuid2 *cpuid)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int rc;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        rc = ioctl(vcpu->fd, KVM_SET_CPUID2, cpuid);
+        TEST_ASSERT(rc == 0, "KVM_SET_CPUID2 failed, rc: %i errno: %i",
+                    rc, errno);
+
+}
+/* Create a VM with reasonable defaults
+ *
+ * Input Args:
+ *   vcpuid - The id of the single VCPU to add to the VM.
+ *   guest_code - The vCPU's entry point
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to opaque structure that describes the created VM.
+ */
+struct kvm_vm *vm_create_default(uint32_t vcpuid, void *guest_code)
+{
+        struct kvm_vm *vm;
+
+        /* Create VM */
+        vm = vm_create(VM_MODE_FLAT48PG, DEFAULT_GUEST_PHY_PAGES, O_RDWR);
+
+        /* Setup guest code */
+        kvm_vm_elf_load(vm, program_invocation_name, 0, 0);
+
+        /* Setup IRQ Chip */
+        vm_create_irqchip(vm);
+
+        /* Add the first vCPU. */
+        vm_vcpu_add_default(vm, vcpuid, guest_code);
+
+        return vm;
+}
diff --git a/tools/testing/selftests/kvm/set_sregs_test.c b/tools/testing/selftests/kvm/set_sregs_test.c
new file mode 100644
index 000000000000..090fd3f19352
--- /dev/null
+++ b/tools/testing/selftests/kvm/set_sregs_test.c
@@ -0,0 +1,54 @@
+/*
+ * KVM_SET_SREGS tests
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ * This is a regression test for the bug fixed by the following commit:
+ * d3802286fa0f ("kvm: x86: Disallow illegal IA32_APIC_BASE MSR values")
+ *
+ * That bug allowed a user-mode program that called the KVM_SET_SREGS
+ * ioctl to put a VCPU's local APIC into an invalid state.
+ *
+ */
+#define _GNU_SOURCE /* for program_invocation_short_name */
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+
+#include "kvm_util.h"
+#include "x86.h"
+
+#define VCPU_ID                  5
+
+int main(int argc, char *argv[])
+{
+        struct kvm_sregs sregs;
+        struct kvm_vm *vm;
+        int rc;
+
+        /* Tell stdout not to buffer its content */
+        setbuf(stdout, NULL);
+
+        /* Create VM */
+        vm = vm_create_default(VCPU_ID, NULL);
+
+        vcpu_sregs_get(vm, VCPU_ID, &sregs);
+        sregs.apic_base = 1 << 10;
+        rc = _vcpu_sregs_set(vm, VCPU_ID, &sregs);
+        TEST_ASSERT(rc, "Set IA32_APIC_BASE to %llx (invalid)",
+                    sregs.apic_base);
+        sregs.apic_base = 1 << 11;
+        rc = _vcpu_sregs_set(vm, VCPU_ID, &sregs);
+        TEST_ASSERT(!rc, "Couldn't set IA32_APIC_BASE to %llx (valid)",
+                    sregs.apic_base);
+
+        kvm_vm_free(vm);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/kvm/sync_regs_test.c b/tools/testing/selftests/kvm/sync_regs_test.c
new file mode 100644
index 000000000000..eae1ece3c31b
--- /dev/null
+++ b/tools/testing/selftests/kvm/sync_regs_test.c
@@ -0,0 +1,254 @@
+/*
+ * Test for x86 KVM_CAP_SYNC_REGS
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ * Verifies expected behavior of x86 KVM_CAP_SYNC_REGS functionality,
+ * including requesting an invalid register set, updates to/from values
+ * in kvm_run.s.regs when kvm_valid_regs and kvm_dirty_regs are toggled.
+ */
+
+#define _GNU_SOURCE /* for program_invocation_short_name */
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "x86.h"
+
+#define VCPU_ID 5
+#define PORT_HOST_SYNC 0x1000
+
+static void __exit_to_l0(uint16_t port, uint64_t arg0, uint64_t arg1)
+{
+                __asm__ __volatile__("in %[port], %%al"
+                                     :
+                                     : [port]"d"(port), "D"(arg0), "S"(arg1)
+                                     : "rax");
+}
+
+#define exit_to_l0(_port, _arg0, _arg1) \
+        __exit_to_l0(_port, (uint64_t) (_arg0), (uint64_t) (_arg1))
+
+#define GUEST_ASSERT(_condition) do { \
+        if (!(_condition)) \
+                exit_to_l0(PORT_ABORT, "Failed guest assert: " #_condition, 0);\
+} while (0)
+
+void guest_code(void)
+{
+        for (;;) {
+                exit_to_l0(PORT_HOST_SYNC, "hello", 0);
+                asm volatile ("inc %r11");
+        }
+}
+
+static void compare_regs(struct kvm_regs *left, struct kvm_regs *right)
+{
+#define REG_COMPARE(reg) \
+        TEST_ASSERT(left->reg == right->reg, \
+                    "Register " #reg \
+                    " values did not match: 0x%llx, 0x%llx\n", \
+                    left->reg, right->reg)
+        REG_COMPARE(rax);
+        REG_COMPARE(rbx);
+        REG_COMPARE(rcx);
+        REG_COMPARE(rdx);
+        REG_COMPARE(rsi);
+        REG_COMPARE(rdi);
+        REG_COMPARE(rsp);
+        REG_COMPARE(rbp);
+        REG_COMPARE(r8);
+        REG_COMPARE(r9);
+        REG_COMPARE(r10);
+        REG_COMPARE(r11);
+        REG_COMPARE(r12);
+        REG_COMPARE(r13);
+        REG_COMPARE(r14);
+        REG_COMPARE(r15);
+        REG_COMPARE(rip);
+        REG_COMPARE(rflags);
+#undef REG_COMPARE
+}
+
+static void compare_sregs(struct kvm_sregs *left, struct kvm_sregs *right)
+{
+}
+
+static void compare_vcpu_events(struct kvm_vcpu_events *left,
+                                struct kvm_vcpu_events *right)
+{
+}
+
+#define TEST_SYNC_FIELDS   (KVM_SYNC_X86_REGS|KVM_SYNC_X86_SREGS|KVM_SYNC_X86_EVENTS)
+#define INVALID_SYNC_FIELD 0x80000000
+
+int main(int argc, char *argv[])
+{
+        struct kvm_vm *vm;
+        struct kvm_run *run;
+        struct kvm_regs regs;
+        struct kvm_sregs sregs;
+        struct kvm_vcpu_events events;
+        int rv, cap;
+
+        /* Tell stdout not to buffer its content */
+        setbuf(stdout, NULL);
+
+        cap = kvm_check_cap(KVM_CAP_SYNC_REGS);
+        if ((cap & TEST_SYNC_FIELDS) != TEST_SYNC_FIELDS) {
+                fprintf(stderr, "KVM_CAP_SYNC_REGS not supported, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+        if ((cap & INVALID_SYNC_FIELD) != 0) {
+                fprintf(stderr, "The \"invalid\" field is not invalid, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+
+        /* Create VM */
+        vm = vm_create_default(VCPU_ID, guest_code);
+
+        run = vcpu_state(vm, VCPU_ID);
+
+        /* Request reading invalid register set from VCPU. */
+        run->kvm_valid_regs = INVALID_SYNC_FIELD;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(rv < 0 && errno == EINVAL,
+                    "Invalid kvm_valid_regs did not cause expected KVM_RUN error: %d\n",
+                    rv);
+        vcpu_state(vm, VCPU_ID)->kvm_valid_regs = 0;
+
+        run->kvm_valid_regs = INVALID_SYNC_FIELD | TEST_SYNC_FIELDS;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(rv < 0 && errno == EINVAL,
+                    "Invalid kvm_valid_regs did not cause expected KVM_RUN error: %d\n",
+                    rv);
+        vcpu_state(vm, VCPU_ID)->kvm_valid_regs = 0;
+
+        /* Request setting invalid register set into VCPU. */
+        run->kvm_dirty_regs = INVALID_SYNC_FIELD;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(rv < 0 && errno == EINVAL,
+                    "Invalid kvm_dirty_regs did not cause expected KVM_RUN error: %d\n",
+                    rv);
+        vcpu_state(vm, VCPU_ID)->kvm_dirty_regs = 0;
+
+        run->kvm_dirty_regs = INVALID_SYNC_FIELD | TEST_SYNC_FIELDS;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(rv < 0 && errno == EINVAL,
+                    "Invalid kvm_dirty_regs did not cause expected KVM_RUN error: %d\n",
+                    rv);
+        vcpu_state(vm, VCPU_ID)->kvm_dirty_regs = 0;
+
+        /* Request and verify all valid register sets. */
+        /* TODO: BUILD TIME CHECK: TEST_ASSERT(KVM_SYNC_X86_NUM_FIELDS != 3); */
+        run->kvm_valid_regs = TEST_SYNC_FIELDS;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                    "Unexpected exit reason: %u (%s),\n",
+                    run->exit_reason,
+                    exit_reason_str(run->exit_reason));
+
+        vcpu_regs_get(vm, VCPU_ID, &regs);
+        compare_regs(&regs, &run->s.regs.regs);
+
+        vcpu_sregs_get(vm, VCPU_ID, &sregs);
+        compare_sregs(&sregs, &run->s.regs.sregs);
+
+        vcpu_events_get(vm, VCPU_ID, &events);
+        compare_vcpu_events(&events, &run->s.regs.events);
+
+        /* Set and verify various register values. */
+        run->s.regs.regs.r11 = 0xBAD1DEA;
+        run->s.regs.sregs.apic_base = 1 << 11;
+        /* TODO run->s.regs.events.XYZ = ABC; */
+
+        run->kvm_valid_regs = TEST_SYNC_FIELDS;
+        run->kvm_dirty_regs = KVM_SYNC_X86_REGS | KVM_SYNC_X86_SREGS;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                    "Unexpected exit reason: %u (%s),\n",
+                    run->exit_reason,
+                    exit_reason_str(run->exit_reason));
+        TEST_ASSERT(run->s.regs.regs.r11 == 0xBAD1DEA + 1,
+                    "r11 sync regs value incorrect 0x%llx.",
+                    run->s.regs.regs.r11);
+        TEST_ASSERT(run->s.regs.sregs.apic_base == 1 << 11,
+                    "apic_base sync regs value incorrect 0x%llx.",
+                    run->s.regs.sregs.apic_base);
+
+        vcpu_regs_get(vm, VCPU_ID, &regs);
+        compare_regs(&regs, &run->s.regs.regs);
+
+        vcpu_sregs_get(vm, VCPU_ID, &sregs);
+        compare_sregs(&sregs, &run->s.regs.sregs);
+
+        vcpu_events_get(vm, VCPU_ID, &events);
+        compare_vcpu_events(&events, &run->s.regs.events);
+
+        /* Clear kvm_dirty_regs bits, verify new s.regs values are
+         * overwritten with existing guest values.
+         */
+        run->kvm_valid_regs = TEST_SYNC_FIELDS;
+        run->kvm_dirty_regs = 0;
+        run->s.regs.regs.r11 = 0xDEADBEEF;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                    "Unexpected exit reason: %u (%s),\n",
+                    run->exit_reason,
+                    exit_reason_str(run->exit_reason));
+        TEST_ASSERT(run->s.regs.regs.r11 != 0xDEADBEEF,
+                    "r11 sync regs value incorrect 0x%llx.",
+                    run->s.regs.regs.r11);
+
+        /* Clear kvm_valid_regs bits and kvm_dirty_bits.
+         * Verify s.regs values are not overwritten with existing guest values
+         * and that guest values are not overwritten with kvm_sync_regs values.
+         */
+        run->kvm_valid_regs = 0;
+        run->kvm_dirty_regs = 0;
+        run->s.regs.regs.r11 = 0xAAAA;
+        regs.r11 = 0xBAC0;
+        vcpu_regs_set(vm, VCPU_ID, &regs);
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                    "Unexpected exit reason: %u (%s),\n",
+                    run->exit_reason,
+                    exit_reason_str(run->exit_reason));
+        TEST_ASSERT(run->s.regs.regs.r11 == 0xAAAA,
+                    "r11 sync regs value incorrect 0x%llx.",
+                    run->s.regs.regs.r11);
+        vcpu_regs_get(vm, VCPU_ID, &regs);
+        TEST_ASSERT(regs.r11 == 0xBAC0 + 1,
+                    "r11 guest value incorrect 0x%llx.",
+                    regs.r11);
+
+        /* Clear kvm_valid_regs bits. Verify s.regs values are not overwritten
+         * with existing guest values but that guest values are overwritten
+         * with kvm_sync_regs values.
+         */
+        run->kvm_valid_regs = 0;
+        run->kvm_dirty_regs = TEST_SYNC_FIELDS;
+        run->s.regs.regs.r11 = 0xBBBB;
+        rv = _vcpu_run(vm, VCPU_ID);
+        TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                    "Unexpected exit reason: %u (%s),\n",
+                    run->exit_reason,
+                    exit_reason_str(run->exit_reason));
+        TEST_ASSERT(run->s.regs.regs.r11 == 0xBBBB,
+                    "r11 sync regs value incorrect 0x%llx.",
+                    run->s.regs.regs.r11);
+        vcpu_regs_get(vm, VCPU_ID, &regs);
+        TEST_ASSERT(regs.r11 == 0xBBBB + 1,
+                    "r11 guest value incorrect 0x%llx.",
+                    regs.r11);
+
+        kvm_vm_free(vm);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
new file mode 100644
index 000000000000..aaa633263b2c
--- /dev/null
+++ b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
@@ -0,0 +1,231 @@
+/*
+ * gtests/tests/vmx_tsc_adjust_test.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ *
+ * IA32_TSC_ADJUST test
+ *
+ * According to the SDM, "if an execution of WRMSR to the
+ * IA32_TIME_STAMP_COUNTER MSR adds (or subtracts) value X from the TSC,
+ * the logical processor also adds (or subtracts) value X from the
+ * IA32_TSC_ADJUST MSR.
+ *
+ * Note that when L1 doesn't intercept writes to IA32_TSC, a
+ * WRMSR(IA32_TSC) from L2 sets L1's TSC value, not L2's perceived TSC
+ * value.
+ *
+ * This test verifies that this unusual case is handled correctly.
+ */
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "x86.h"
+#include "vmx.h"
+
+#include <string.h>
+#include <sys/ioctl.h>
+
+#ifndef MSR_IA32_TSC_ADJUST
+#define MSR_IA32_TSC_ADJUST 0x3b
+#endif
+
+#define PAGE_SIZE       4096
+#define VCPU_ID         5
+
+#define TSC_ADJUST_VALUE (1ll << 32)
+#define TSC_OFFSET_VALUE -(1ll << 48)
+
+enum {
+        PORT_ABORT = 0x1000,
+        PORT_REPORT,
+        PORT_DONE,
+};
+
+struct vmx_page {
+        vm_vaddr_t virt;
+        vm_paddr_t phys;
+};
+
+enum {
+        VMXON_PAGE = 0,
+        VMCS_PAGE,
+        MSR_BITMAP_PAGE,
+
+        NUM_VMX_PAGES,
+};
+
+struct kvm_single_msr {
+        struct kvm_msrs header;
+        struct kvm_msr_entry entry;
+} __attribute__((packed));
+
+/* The virtual machine object. */
+static struct kvm_vm *vm;
+
+/* Array of vmx_page descriptors that is shared with the guest. */
+struct vmx_page *vmx_pages;
+
+#define exit_to_l0(_port, _arg) do_exit_to_l0(_port, (unsigned long) (_arg))
+static void do_exit_to_l0(uint16_t port, unsigned long arg)
+{
+        __asm__ __volatile__("in %[port], %%al"
+                :
+                : [port]"d"(port), "D"(arg)
+                : "rax");
+}
+
+
+#define GUEST_ASSERT(_condition) do {                                        \
+        if (!(_condition))                                                   \
+                exit_to_l0(PORT_ABORT, "Failed guest assert: " #_condition); \
+} while (0)
+
+static void check_ia32_tsc_adjust(int64_t max)
+{
+        int64_t adjust;
+
+        adjust = rdmsr(MSR_IA32_TSC_ADJUST);
+        exit_to_l0(PORT_REPORT, adjust);
+        GUEST_ASSERT(adjust <= max);
+}
+
+static void l2_guest_code(void)
+{
+        uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE;
+
+        wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE);
+        check_ia32_tsc_adjust(-2 * TSC_ADJUST_VALUE);
+
+        /* Exit to L1 */
+        __asm__ __volatile__("vmcall");
+}
+
+static void l1_guest_code(struct vmx_page *vmx_pages)
+{
+#define L2_GUEST_STACK_SIZE 64
+        unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
+        uint32_t control;
+        uintptr_t save_cr3;
+
+        GUEST_ASSERT(rdtsc() < TSC_ADJUST_VALUE);
+        wrmsr(MSR_IA32_TSC, rdtsc() - TSC_ADJUST_VALUE);
+        check_ia32_tsc_adjust(-1 * TSC_ADJUST_VALUE);
+
+        prepare_for_vmx_operation();
+
+        /* Enter VMX root operation. */
+        *(uint32_t *)vmx_pages[VMXON_PAGE].virt = vmcs_revision();
+        GUEST_ASSERT(!vmxon(vmx_pages[VMXON_PAGE].phys));
+
+        /* Load a VMCS. */
+        *(uint32_t *)vmx_pages[VMCS_PAGE].virt = vmcs_revision();
+        GUEST_ASSERT(!vmclear(vmx_pages[VMCS_PAGE].phys));
+        GUEST_ASSERT(!vmptrld(vmx_pages[VMCS_PAGE].phys));
+
+        /* Prepare the VMCS for L2 execution. */
+        prepare_vmcs(l2_guest_code, &l2_guest_stack[L2_GUEST_STACK_SIZE]);
+        control = vmreadz(CPU_BASED_VM_EXEC_CONTROL);
+        control |= CPU_BASED_USE_MSR_BITMAPS | CPU_BASED_USE_TSC_OFFSETING;
+        vmwrite(CPU_BASED_VM_EXEC_CONTROL, control);
+        vmwrite(MSR_BITMAP, vmx_pages[MSR_BITMAP_PAGE].phys);
+        vmwrite(TSC_OFFSET, TSC_OFFSET_VALUE);
+
+        /* Jump into L2.  First, test failure to load guest CR3.  */
+        save_cr3 = vmreadz(GUEST_CR3);
+        vmwrite(GUEST_CR3, -1ull);
+        GUEST_ASSERT(!vmlaunch());
+        GUEST_ASSERT(vmreadz(VM_EXIT_REASON) ==
+                     (EXIT_REASON_FAILED_VMENTRY | EXIT_REASON_INVALID_STATE));
+        check_ia32_tsc_adjust(-1 * TSC_ADJUST_VALUE);
+        vmwrite(GUEST_CR3, save_cr3);
+
+        GUEST_ASSERT(!vmlaunch());
+        GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
+
+        check_ia32_tsc_adjust(-2 * TSC_ADJUST_VALUE);
+
+        exit_to_l0(PORT_DONE, 0);
+}
+
+static void allocate_vmx_page(struct vmx_page *page)
+{
+        vm_vaddr_t virt;
+
+        virt = vm_vaddr_alloc(vm, PAGE_SIZE, 0, 0, 0);
+        memset(addr_gva2hva(vm, virt), 0, PAGE_SIZE);
+
+        page->virt = virt;
+        page->phys = addr_gva2gpa(vm, virt);
+}
+
+static vm_vaddr_t allocate_vmx_pages(void)
+{
+        vm_vaddr_t vmx_pages_vaddr;
+        int i;
+
+        vmx_pages_vaddr = vm_vaddr_alloc(
+                vm, sizeof(struct vmx_page) * NUM_VMX_PAGES, 0, 0, 0);
+
+        vmx_pages = (void *) addr_gva2hva(vm, vmx_pages_vaddr);
+
+        for (i = 0; i < NUM_VMX_PAGES; i++)
+                allocate_vmx_page(&vmx_pages[i]);
+
+        return vmx_pages_vaddr;
+}
+
+void report(int64_t val)
+{
+        printf("IA32_TSC_ADJUST is %ld (%lld * TSC_ADJUST_VALUE + %lld).\n",
+               val, val / TSC_ADJUST_VALUE, val % TSC_ADJUST_VALUE);
+}
+
+int main(int argc, char *argv[])
+{
+        vm_vaddr_t vmx_pages_vaddr;
+        struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
+
+        if (!(entry->ecx & CPUID_VMX)) {
+                fprintf(stderr, "nested VMX not enabled, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+
+        vm = vm_create_default_vmx(VCPU_ID, (void *) l1_guest_code);
+
+        /* Allocate VMX pages and shared descriptors (vmx_pages). */
+        vmx_pages_vaddr = allocate_vmx_pages();
+        vcpu_args_set(vm, VCPU_ID, 1, vmx_pages_vaddr);
+
+        for (;;) {
+                volatile struct kvm_run *run = vcpu_state(vm, VCPU_ID);
+                struct kvm_regs regs;
+
+                vcpu_run(vm, VCPU_ID);
+                TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                            "Got exit_reason other than KVM_EXIT_IO: %u (%s),\n",
+                            run->exit_reason,
+                            exit_reason_str(run->exit_reason));
+
+                vcpu_regs_get(vm, VCPU_ID, &regs);
+
+                switch (run->io.port) {
+                case PORT_ABORT:
+                        TEST_ASSERT(false, "%s", (const char *) regs.rdi);
+                        /* NOT REACHED */
+                case PORT_REPORT:
+                        report(regs.rdi);
+                        break;
+                case PORT_DONE:
+                        goto done;
+                default:
+                        TEST_ASSERT(false, "Unknown port 0x%x.", run->io.port);
+                }
+        }
+
+        kvm_vm_free(vm);
+done:
+        return 0;
+}
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 7de482a0519d..c1b1a4dc6a96 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -20,9 +20,10 @@ all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
 
 .ONESHELL:
 define RUN_TESTS
-        @test_num=`echo 0`;
-        @echo "TAP version 13";
-        @for TEST in $(1); do                           \
+        @export KSFT_TAP_LEVEL=`echo 1`;                \
+        test_num=`echo 0`;                              \
+        echo "TAP version 13";                          \
+        for TEST in $(1); do                            \
                 BASENAME_TEST=`basename $$TEST`;        \
                 test_num=`echo $$test_num+1 | bc`;      \
                 echo "selftests: $$BASENAME_TEST";      \
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index d7c30d366935..3ff81a478dbe 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,7 +5,8 @@ CFLAGS =  -Wall -Wl,--no-as-needed -O2 -g
 CFLAGS += -I../../../../usr/include/
 
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
-TEST_PROGS += fib_tests.sh
+TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh
+TEST_PROGS_EXTENDED := in_netns.sh
 TEST_GEN_FILES =  socket
 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
 TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index 7177bea1fdfa..6a75a3ea44ad 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -2,3 +2,8 @@ CONFIG_USER_NS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_TEST_BPF=m
 CONFIG_NUMA=y
+CONFIG_NET_VRF=y
+CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_IPV6=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_VETH=y
diff --git a/tools/testing/selftests/net/fib-onlink-tests.sh b/tools/testing/selftests/net/fib-onlink-tests.sh
new file mode 100755
index 000000000000..3991ad1a368d
--- /dev/null
+++ b/tools/testing/selftests/net/fib-onlink-tests.sh
@@ -0,0 +1,467 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# IPv4 and IPv6 onlink tests
+
+PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
+
+# Network interfaces
+# - odd in current namespace; even in peer ns
+declare -A NETIFS
+# default VRF
+NETIFS[p1]=veth1
+NETIFS[p2]=veth2
+NETIFS[p3]=veth3
+NETIFS[p4]=veth4
+# VRF
+NETIFS[p5]=veth5
+NETIFS[p6]=veth6
+NETIFS[p7]=veth7
+NETIFS[p8]=veth8
+
+# /24 network
+declare -A V4ADDRS
+V4ADDRS[p1]=169.254.1.1
+V4ADDRS[p2]=169.254.1.2
+V4ADDRS[p3]=169.254.3.1
+V4ADDRS[p4]=169.254.3.2
+V4ADDRS[p5]=169.254.5.1
+V4ADDRS[p6]=169.254.5.2
+V4ADDRS[p7]=169.254.7.1
+V4ADDRS[p8]=169.254.7.2
+
+# /64 network
+declare -A V6ADDRS
+V6ADDRS[p1]=2001:db8:101::1
+V6ADDRS[p2]=2001:db8:101::2
+V6ADDRS[p3]=2001:db8:301::1
+V6ADDRS[p4]=2001:db8:301::2
+V6ADDRS[p5]=2001:db8:501::1
+V6ADDRS[p6]=2001:db8:501::2
+V6ADDRS[p7]=2001:db8:701::1
+V6ADDRS[p8]=2001:db8:701::2
+
+# Test networks:
+# [1] = default table
+# [2] = VRF
+#
+# /32 host routes
+declare -A TEST_NET4
+TEST_NET4[1]=169.254.101
+TEST_NET4[2]=169.254.102
+# /128 host routes
+declare -A TEST_NET6
+TEST_NET6[1]=2001:db8:101
+TEST_NET6[2]=2001:db8:102
+
+# connected gateway
+CONGW[1]=169.254.1.254
+CONGW[2]=169.254.3.254
+CONGW[3]=169.254.5.254
+
+# recursive gateway
+RECGW4[1]=169.254.11.254
+RECGW4[2]=169.254.12.254
+RECGW6[1]=2001:db8:11::64
+RECGW6[2]=2001:db8:12::64
+
+# for v4 mapped to v6
+declare -A TEST_NET4IN6IN6
+TEST_NET4IN6[1]=10.1.1.254
+TEST_NET4IN6[2]=10.2.1.254
+
+# mcast address
+MCAST6=ff02::1
+
+
+PEER_NS=bart
+PEER_CMD="ip netns exec ${PEER_NS}"
+VRF=lisa
+VRF_TABLE=1101
+PBR_TABLE=101
+
+################################################################################
+# utilities
+
+log_test()
+{
+        local rc=$1
+        local expected=$2
+        local msg="$3"
+
+        if [ ${rc} -eq ${expected} ]; then
+                nsuccess=$((nsuccess+1))
+                printf "\n    TEST: %-50s  [ OK ]\n" "${msg}"
+        else
+                nfail=$((nfail+1))
+                printf "\n    TEST: %-50s  [FAIL]\n" "${msg}"
+                if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+                        echo
+                        echo "hit enter to continue, 'q' to quit"
+                        read a
+                        [ "$a" = "q" ] && exit 1
+                fi
+        fi
+}
+
+log_section()
+{
+        echo
+        echo "######################################################################"
+        echo "TEST SECTION: $*"
+        echo "######################################################################"
+}
+
+log_subsection()
+{
+        echo
+        echo "#########################################"
+        echo "TEST SUBSECTION: $*"
+}
+
+run_cmd()
+{
+        echo
+        echo "COMMAND: $*"
+        eval $*
+}
+
+get_linklocal()
+{
+        local dev=$1
+        local pfx
+        local addr
+
+        addr=$(${pfx} ip -6 -br addr show dev ${dev} | \
+        awk '{
+                for (i = 3; i <= NF; ++i) {
+                        if ($i ~ /^fe80/)
+                                print $i
+                }
+        }'
+        )
+        addr=${addr/\/*}
+
+        [ -z "$addr" ] && return 1
+
+        echo $addr
+
+        return 0
+}
+
+################################################################################
+#
+
+setup()
+{
+        echo
+        echo "########################################"
+        echo "Configuring interfaces"
+
+        set -e
+
+        # create namespace
+        ip netns add ${PEER_NS}
+        ip -netns ${PEER_NS} li set lo up
+
+        # add vrf table
+        ip li add ${VRF} type vrf table ${VRF_TABLE}
+        ip li set ${VRF} up
+        ip ro add table ${VRF_TABLE} unreachable default
+        ip -6 ro add table ${VRF_TABLE} unreachable default
+
+        # create test interfaces
+        ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]}
+        ip li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]}
+        ip li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]}
+        ip li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]}
+
+        # enslave vrf interfaces
+        for n in 5 7; do
+                ip li set ${NETIFS[p${n}]} vrf ${VRF}
+        done
+
+        # add addresses
+        for n in 1 3 5 7; do
+                ip li set ${NETIFS[p${n}]} up
+                ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+                ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
+        done
+
+        # move peer interfaces to namespace and add addresses
+        for n in 2 4 6 8; do
+                ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up
+                ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+                ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
+        done
+
+        set +e
+
+        # let DAD complete - assume default of 1 probe
+        sleep 1
+}
+
+cleanup()
+{
+        # make sure we start from a clean slate
+        ip netns del ${PEER_NS} 2>/dev/null
+        for n in 1 3 5 7; do
+                ip link del ${NETIFS[p${n}]} 2>/dev/null
+        done
+        ip link del ${VRF} 2>/dev/null
+        ip ro flush table ${VRF_TABLE}
+        ip -6 ro flush table ${VRF_TABLE}
+}
+
+################################################################################
+# IPv4 tests
+#
+
+run_ip()
+{
+        local table="$1"
+        local prefix="$2"
+        local gw="$3"
+        local dev="$4"
+        local exp_rc="$5"
+        local desc="$6"
+
+        # dev arg may be empty
+        [ -n "${dev}" ] && dev="dev ${dev}"
+
+        run_cmd ip ro add table "${table}" "${prefix}"/32 via "${gw}" "${dev}" onlink
+        log_test $? ${exp_rc} "${desc}"
+}
+
+run_ip_mpath()
+{
+        local table="$1"
+        local prefix="$2"
+        local nh1="$3"
+        local nh2="$4"
+        local exp_rc="$5"
+        local desc="$6"
+
+        # dev arg may be empty
+        [ -n "${dev}" ] && dev="dev ${dev}"
+
+        run_cmd ip ro add table "${table}" "${prefix}"/32 \
+                nexthop via ${nh1} nexthop via ${nh2}
+        log_test $? ${exp_rc} "${desc}"
+}
+
+valid_onlink_ipv4()
+{
+        # - unicast connected, unicast recursive
+        #
+        log_subsection "default VRF - main table"
+
+        run_ip 254 ${TEST_NET4[1]}.1 ${CONGW[1]} ${NETIFS[p1]} 0 "unicast connected"
+        run_ip 254 ${TEST_NET4[1]}.2 ${RECGW4[1]} ${NETIFS[p1]} 0 "unicast recursive"
+
+        log_subsection "VRF ${VRF}"
+
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.1 ${CONGW[3]} ${NETIFS[p5]} 0 "unicast connected"
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.2 ${RECGW4[2]} ${NETIFS[p5]} 0 "unicast recursive"
+
+        log_subsection "VRF device, PBR table"
+
+        run_ip ${PBR_TABLE} ${TEST_NET4[2]}.3 ${CONGW[3]} ${NETIFS[p5]} 0 "unicast connected"
+        run_ip ${PBR_TABLE} ${TEST_NET4[2]}.4 ${RECGW4[2]} ${NETIFS[p5]} 0 "unicast recursive"
+
+        # multipath version
+        #
+        log_subsection "default VRF - main table - multipath"
+
+        run_ip_mpath 254 ${TEST_NET4[1]}.5 \
+                "${CONGW[1]} dev ${NETIFS[p1]} onlink" \
+                "${CONGW[2]} dev ${NETIFS[p3]} onlink" \
+                0 "unicast connected - multipath"
+
+        run_ip_mpath 254 ${TEST_NET4[1]}.6 \
+                "${RECGW4[1]} dev ${NETIFS[p1]} onlink" \
+                "${RECGW4[2]} dev ${NETIFS[p3]} onlink" \
+                0 "unicast recursive - multipath"
+
+        run_ip_mpath 254 ${TEST_NET4[1]}.7 \
+                "${CONGW[1]} dev ${NETIFS[p1]}"        \
+                "${CONGW[2]} dev ${NETIFS[p3]} onlink" \
+                0 "unicast connected - multipath onlink first only"
+
+        run_ip_mpath 254 ${TEST_NET4[1]}.8 \
+                "${CONGW[1]} dev ${NETIFS[p1]} onlink" \
+                "${CONGW[2]} dev ${NETIFS[p3]}"        \
+                0 "unicast connected - multipath onlink second only"
+}
+
+invalid_onlink_ipv4()
+{
+        run_ip 254 ${TEST_NET4[1]}.11 ${V4ADDRS[p1]} ${NETIFS[p1]} 2 \
+                "Invalid gw - local unicast address"
+
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.11 ${V4ADDRS[p5]} ${NETIFS[p5]} 2 \
+                "Invalid gw - local unicast address, VRF"
+
+        run_ip 254 ${TEST_NET4[1]}.101 ${V4ADDRS[p1]} "" 2 "No nexthop device given"
+
+        run_ip 254 ${TEST_NET4[1]}.102 ${V4ADDRS[p3]} ${NETIFS[p1]} 2 \
+                "Gateway resolves to wrong nexthop device"
+
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.103 ${V4ADDRS[p7]} ${NETIFS[p5]} 2 \
+                "Gateway resolves to wrong nexthop device - VRF"
+}
+
+################################################################################
+# IPv6 tests
+#
+
+run_ip6()
+{
+        local table="$1"
+        local prefix="$2"
+        local gw="$3"
+        local dev="$4"
+        local exp_rc="$5"
+        local desc="$6"
+
+        # dev arg may be empty
+        [ -n "${dev}" ] && dev="dev ${dev}"
+
+        run_cmd ip -6 ro add table "${table}" "${prefix}"/128 via "${gw}" "${dev}" onlink
+        log_test $? ${exp_rc} "${desc}"
+}
+
+run_ip6_mpath()
+{
+        local table="$1"
+        local prefix="$2"
+        local opts="$3"
+        local nh1="$4"
+        local nh2="$5"
+        local exp_rc="$6"
+        local desc="$7"
+
+        run_cmd ip -6 ro add table "${table}" "${prefix}"/128 "${opts}" \
+                nexthop via ${nh1} nexthop via ${nh2}
+        log_test $? ${exp_rc} "${desc}"
+}
+
+valid_onlink_ipv6()
+{
+        # - unicast connected, unicast recursive, v4-mapped
+        #
+        log_subsection "default VRF - main table"
+
+        run_ip6 254 ${TEST_NET6[1]}::1 ${V6ADDRS[p1]/::*}::64 ${NETIFS[p1]} 0 "unicast connected"
+        run_ip6 254 ${TEST_NET6[1]}::2 ${RECGW6[1]} ${NETIFS[p1]} 0 "unicast recursive"
+        run_ip6 254 ${TEST_NET6[1]}::3 ::ffff:${TEST_NET4IN6[1]} ${NETIFS[p1]} 0 "v4-mapped"
+
+        log_subsection "VRF ${VRF}"
+
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::1 ${V6ADDRS[p5]/::*}::64 ${NETIFS[p5]} 0 "unicast connected"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::2 ${RECGW6[2]} ${NETIFS[p5]} 0 "unicast recursive"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::3 ::ffff:${TEST_NET4IN6[2]} ${NETIFS[p5]} 0 "v4-mapped"
+
+        log_subsection "VRF device, PBR table"
+
+        run_ip6 ${PBR_TABLE} ${TEST_NET6[2]}::4 ${V6ADDRS[p5]/::*}::64 ${NETIFS[p5]} 0 "unicast connected"
+        run_ip6 ${PBR_TABLE} ${TEST_NET6[2]}::5 ${RECGW6[2]} ${NETIFS[p5]} 0 "unicast recursive"
+        run_ip6 ${PBR_TABLE} ${TEST_NET6[2]}::6 ::ffff:${TEST_NET4IN6[2]} ${NETIFS[p5]} 0 "v4-mapped"
+
+        # multipath version
+        #
+        log_subsection "default VRF - main table - multipath"
+
+        run_ip6_mpath 254 ${TEST_NET6[1]}::4 "onlink" \
+                "${V6ADDRS[p1]/::*}::64 dev ${NETIFS[p1]}" \
+                "${V6ADDRS[p3]/::*}::64 dev ${NETIFS[p3]}" \
+                0 "unicast connected - multipath onlink"
+
+        run_ip6_mpath 254 ${TEST_NET6[1]}::5 "onlink" \
+                "${RECGW6[1]} dev ${NETIFS[p1]}" \
+                "${RECGW6[2]} dev ${NETIFS[p3]}" \
+                0 "unicast recursive - multipath onlink"
+
+        run_ip6_mpath 254 ${TEST_NET6[1]}::6 "onlink" \
+                "::ffff:${TEST_NET4IN6[1]} dev ${NETIFS[p1]}" \
+                "::ffff:${TEST_NET4IN6[2]} dev ${NETIFS[p3]}" \
+                0 "v4-mapped - multipath onlink"
+
+        run_ip6_mpath 254 ${TEST_NET6[1]}::7 "" \
+                "${V6ADDRS[p1]/::*}::64 dev ${NETIFS[p1]} onlink" \
+                "${V6ADDRS[p3]/::*}::64 dev ${NETIFS[p3]} onlink" \
+                0 "unicast connected - multipath onlink both nexthops"
+
+        run_ip6_mpath 254 ${TEST_NET6[1]}::8 "" \
+                "${V6ADDRS[p1]/::*}::64 dev ${NETIFS[p1]} onlink" \
+                "${V6ADDRS[p3]/::*}::64 dev ${NETIFS[p3]}" \
+                0 "unicast connected - multipath onlink first only"
+
+        run_ip6_mpath 254 ${TEST_NET6[1]}::9 "" \
+                "${V6ADDRS[p1]/::*}::64 dev ${NETIFS[p1]}"        \
+                "${V6ADDRS[p3]/::*}::64 dev ${NETIFS[p3]} onlink" \
+                0 "unicast connected - multipath onlink second only"
+}
+
+invalid_onlink_ipv6()
+{
+        local lladdr
+
+        lladdr=$(get_linklocal ${NETIFS[p1]}) || return 1
+
+        run_ip6 254 ${TEST_NET6[1]}::11 ${V6ADDRS[p1]} ${NETIFS[p1]} 2 \
+                "Invalid gw - local unicast address"
+        run_ip6 254 ${TEST_NET6[1]}::12 ${lladdr} ${NETIFS[p1]} 2 \
+                "Invalid gw - local linklocal address"
+        run_ip6 254 ${TEST_NET6[1]}::12 ${MCAST6} ${NETIFS[p1]} 2 \
+                "Invalid gw - multicast address"
+
+        lladdr=$(get_linklocal ${NETIFS[p5]}) || return 1
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::11 ${V6ADDRS[p5]} ${NETIFS[p5]} 2 \
+                "Invalid gw - local unicast address, VRF"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::12 ${lladdr} ${NETIFS[p5]} 2 \
+                "Invalid gw - local linklocal address, VRF"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::12 ${MCAST6} ${NETIFS[p5]} 2 \
+                "Invalid gw - multicast address, VRF"
+
+        run_ip6 254 ${TEST_NET6[1]}::101 ${V6ADDRS[p1]} "" 2 \
+                "No nexthop device given"
+
+        # default VRF validation is done against LOCAL table
+        # run_ip6 254 ${TEST_NET6[1]}::102 ${V6ADDRS[p3]/::[0-9]/::64} ${NETIFS[p1]} 2 \
+        #       "Gateway resolves to wrong nexthop device"
+
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::103 ${V6ADDRS[p7]/::[0-9]/::64} ${NETIFS[p5]} 2 \
+                "Gateway resolves to wrong nexthop device - VRF"
+}
+
+run_onlink_tests()
+{
+        log_section "IPv4 onlink"
+        log_subsection "Valid onlink commands"
+        valid_onlink_ipv4
+        log_subsection "Invalid onlink commands"
+        invalid_onlink_ipv4
+
+        log_section "IPv6 onlink"
+        log_subsection "Valid onlink commands"
+        valid_onlink_ipv6
+        log_subsection "Invalid onlink commands"
+        invalid_onlink_ipv6
+}
+
+################################################################################
+# main
+
+nsuccess=0
+nfail=0
+
+cleanup
+setup
+run_onlink_tests
+cleanup
+
+if [ "$TESTS" != "none" ]; then
+        printf "\nTests passed: %3d\n" ${nsuccess}
+        printf "Tests failed: %3d\n"   ${nfail}
+fi
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index a9154eefb2e2..9164e60d4b66 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -6,154 +6,179 @@
 
 ret=0
 
-check_err()
-{
-        if [ $ret -eq 0 ]; then
-                ret=$1
-        fi
-}
+VERBOSE=${VERBOSE:=0}
+PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
+IP="ip -netns testns"
 
-check_fail()
+log_test()
 {
-        if [ $1 -eq 0 ]; then
+        local rc=$1
+        local expected=$2
+        local msg="$3"
+
+        if [ ${rc} -eq ${expected} ]; then
+                printf "    TEST: %-60s  [ OK ]\n" "${msg}"
+        else
                 ret=1
+                printf "    TEST: %-60s  [FAIL]\n" "${msg}"
+                if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+                echo
+                        echo "hit enter to continue, 'q' to quit"
+                        read a
+                        [ "$a" = "q" ] && exit 1
+                fi
         fi
 }
 
-netns_create()
+setup()
 {
-        local testns=$1
+        set -e
+        ip netns add testns
+        $IP link set dev lo up
+
+        $IP link add dummy0 type dummy
+        $IP link set dev dummy0 up
+        $IP address add 198.51.100.1/24 dev dummy0
+        $IP -6 address add 2001:db8:1::1/64 dev dummy0
+        set +e
 
-        ip netns add $testns
-        ip netns exec $testns ip link set dev lo up
 }
 
-fib_unreg_unicast_test()
+cleanup()
 {
-        ret=0
+        $IP link del dev dummy0 &> /dev/null
+        ip netns del testns
+}
 
-        netns_create "testns"
+get_linklocal()
+{
+        local dev=$1
+        local addr
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        addr=$($IP -6 -br addr show dev ${dev} | \
+        awk '{
+                for (i = 3; i <= NF; ++i) {
+                        if ($i ~ /^fe80/)
+                                print $i
+                }
+        }'
+        )
+        addr=${addr/\/*}
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        [ -z "$addr" ] && return 1
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        echo $addr
 
-        ip netns exec testns ip link del dev dummy0
-        check_err $?
+        return 0
+}
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_fail $?
+fib_unreg_unicast_test()
+{
+        echo
+        echo "Single path route test"
 
-        ip netns del testns
+        setup
 
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: unicast route test"
-                return 1
-        fi
-        echo "PASS: unicast route test"
+        echo "    Start point"
+        $IP route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
+
+        set -e
+        $IP link del dev dummy0
+        set +e
+
+        echo "    Nexthop device deleted"
+        $IP route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 2 "IPv4 fibmatch - no route"
+        $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 2 "IPv6 fibmatch - no route"
+
+        cleanup
 }
 
 fib_unreg_multipath_test()
 {
-        ret=0
-
-        netns_create "testns"
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        echo
+        echo "Multipath route test"
 
-        ip netns exec testns ip link add dummy1 type dummy
-        ip netns exec testns ip link set dev dummy1 up
+        setup
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        set -e
+        $IP link add dummy1 type dummy
+        $IP link set dev dummy1 up
+        $IP address add 192.0.2.1/24 dev dummy1
+        $IP -6 address add 2001:db8:2::1/64 dev dummy1
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy1
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy1
-
-        ip netns exec testns ip route add 203.0.113.0/24 \
+        $IP route add 203.0.113.0/24 \
                 nexthop via 198.51.100.2 dev dummy0 \
                 nexthop via 192.0.2.2 dev dummy1
-        ip netns exec testns ip -6 route add 2001:db8:3::/64 \
+        $IP -6 route add 2001:db8:3::/64 \
                 nexthop via 2001:db8:1::2 dev dummy0 \
                 nexthop via 2001:db8:2::2 dev dummy1
+        set +e
+
+        echo "    Start point"
+        $IP route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
-        check_err $?
+        set -e
+        $IP link del dev dummy0
+        set +e
 
-        ip netns exec testns ip link del dev dummy0
-        check_err $?
+        echo "    One nexthop device deleted"
+        $IP route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 2 "IPv4 - multipath route removed on delete"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null
         # In IPv6 we do not flush the entire multipath route.
-        check_err $?
+        log_test $? 0 "IPv6 - multipath down to single path"
 
-        ip netns exec testns ip link del dev dummy1
+        set -e
+        $IP link del dev dummy1
+        set +e
 
-        ip netns del testns
+        echo "    Second nexthop device deleted"
+        $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 2 "IPv6 - no route"
 
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: multipath route test"
-                return 1
-        fi
-        echo "PASS: multipath route test"
+        cleanup
 }
 
 fib_unreg_test()
 {
-        echo "Running netdev unregister tests"
-
         fib_unreg_unicast_test
         fib_unreg_multipath_test
 }
 
 fib_down_unicast_test()
 {
-        ret=0
-
-        netns_create "testns"
-
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        echo
+        echo "Single path, admin down"
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        setup
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        echo "    Start point"
+        $IP route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip link set dev dummy0 down
-        check_err $?
+        set -e
+        $IP link set dev dummy0 down
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_fail $?
+        echo "    Route deleted on down"
+        $IP route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 2 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 2 "IPv6 fibmatch"
 
-        ip netns exec testns ip link del dev dummy0
-
-        ip netns del testns
-
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: unicast route test"
-                return 1
-        fi
-        echo "PASS: unicast route test"
+        cleanup
 }
 
 fib_down_multipath_test_do()
@@ -161,251 +186,395 @@ fib_down_multipath_test_do()
         local down_dev=$1
         local up_dev=$2
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 \
+        $IP route get fibmatch 203.0.113.1 \
                 oif $down_dev &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 \
+        log_test $? 2 "IPv4 fibmatch on down device"
+        $IP -6 route get fibmatch 2001:db8:3::1 \
                 oif $down_dev &> /dev/null
-        check_fail $?
+        log_test $? 2 "IPv6 fibmatch on down device"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 \
+        $IP route get fibmatch 203.0.113.1 \
                 oif $up_dev &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 \
+        log_test $? 0 "IPv4 fibmatch on up device"
+        $IP -6 route get fibmatch 2001:db8:3::1 \
                 oif $up_dev &> /dev/null
-        check_err $?
+        log_test $? 0 "IPv6 fibmatch on up device"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 | \
+        $IP route get fibmatch 203.0.113.1 | \
                 grep $down_dev | grep -q "dead linkdown"
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 | \
+        log_test $? 0 "IPv4 flags on down device"
+        $IP -6 route get fibmatch 2001:db8:3::1 | \
                 grep $down_dev | grep -q "dead linkdown"
-        check_err $?
+        log_test $? 0 "IPv6 flags on down device"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 | \
+        $IP route get fibmatch 203.0.113.1 | \
                 grep $up_dev | grep -q "dead linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 | \
+        log_test $? 1 "IPv4 flags on up device"
+        $IP -6 route get fibmatch 2001:db8:3::1 | \
                 grep $up_dev | grep -q "dead linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 flags on up device"
 }
 
 fib_down_multipath_test()
 {
-        ret=0
-
-        netns_create "testns"
+        echo
+        echo "Admin down multipath"
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        setup
 
-        ip netns exec testns ip link add dummy1 type dummy
-        ip netns exec testns ip link set dev dummy1 up
+        set -e
+        $IP link add dummy1 type dummy
+        $IP link set dev dummy1 up
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        $IP address add 192.0.2.1/24 dev dummy1
+        $IP -6 address add 2001:db8:2::1/64 dev dummy1
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy1
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy1
-
-        ip netns exec testns ip route add 203.0.113.0/24 \
+        $IP route add 203.0.113.0/24 \
                 nexthop via 198.51.100.2 dev dummy0 \
                 nexthop via 192.0.2.2 dev dummy1
-        ip netns exec testns ip -6 route add 2001:db8:3::/64 \
+        $IP -6 route add 2001:db8:3::/64 \
                 nexthop via 2001:db8:1::2 dev dummy0 \
                 nexthop via 2001:db8:2::2 dev dummy1
+        set +e
+
+        echo "    Verify start point"
+        $IP route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
-        check_err $?
+        $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip link set dev dummy0 down
-        check_err $?
+        set -e
+        $IP link set dev dummy0 down
+        set +e
 
+        echo "    One device down, one up"
         fib_down_multipath_test_do "dummy0" "dummy1"
 
-        ip netns exec testns ip link set dev dummy0 up
-        check_err $?
-        ip netns exec testns ip link set dev dummy1 down
-        check_err $?
+        set -e
+        $IP link set dev dummy0 up
+        $IP link set dev dummy1 down
+        set +e
 
+        echo "    Other device down and up"
         fib_down_multipath_test_do "dummy1" "dummy0"
 
-        ip netns exec testns ip link set dev dummy0 down
-        check_err $?
-
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
-        check_fail $?
+        set -e
+        $IP link set dev dummy0 down
+        set +e
 
-        ip netns exec testns ip link del dev dummy1
-        ip netns exec testns ip link del dev dummy0
-
-        ip netns del testns
+        echo "    Both devices down"
+        $IP route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 2 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 2 "IPv6 fibmatch"
 
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: multipath route test"
-                return 1
-        fi
-        echo "PASS: multipath route test"
+        $IP link del dev dummy1
+        cleanup
 }
 
 fib_down_test()
 {
-        echo "Running netdev down tests"
-
         fib_down_unicast_test
         fib_down_multipath_test
 }
 
+# Local routes should not be affected when carrier changes.
 fib_carrier_local_test()
 {
-        ret=0
-
-        # Local routes should not be affected when carrier changes.
-        netns_create "testns"
-
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        echo
+        echo "Local carrier tests - single path"
 
-        ip netns exec testns ip link set dev dummy0 carrier on
+        setup
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        set -e
+        $IP link set dev dummy0 carrier on
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 &> /dev/null
-        check_err $?
+        echo "    Start point"
+        $IP route get fibmatch 198.51.100.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.1 | \
+        $IP route get fibmatch 198.51.100.1 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 | \
+        log_test $? 1 "IPv4 - no linkdown flag"
+        $IP -6 route get fibmatch 2001:db8:1::1 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 - no linkdown flag"
 
-        ip netns exec testns ip link set dev dummy0 carrier off
+        set -e
+        $IP link set dev dummy0 carrier off
+        sleep 1
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 &> /dev/null
-        check_err $?
+        echo "    Carrier off on nexthop"
+        $IP route get fibmatch 198.51.100.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.1 | \
+        $IP route get fibmatch 198.51.100.1 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 | \
+        log_test $? 1 "IPv4 - linkdown flag set"
+        $IP -6 route get fibmatch 2001:db8:1::1 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 - linkdown flag set"
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy0
+        set -e
+        $IP address add 192.0.2.1/24 dev dummy0
+        $IP -6 address add 2001:db8:2::1/64 dev dummy0
+        set +e
 
-        ip netns exec testns ip route get fibmatch 192.0.2.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::1 &> /dev/null
-        check_err $?
+        echo "    Route to local address with carrier down"
+        $IP route get fibmatch 192.0.2.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:2::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 192.0.2.1 | \
+        $IP route get fibmatch 192.0.2.1 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::1 | \
+        log_test $? 1 "IPv4 linkdown flag set"
+        $IP -6 route get fibmatch 2001:db8:2::1 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 linkdown flag set"
 
-        ip netns exec testns ip link del dev dummy0
-
-        ip netns del testns
-
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: local route carrier test"
-                return 1
-        fi
-        echo "PASS: local route carrier test"
+        cleanup
 }
 
 fib_carrier_unicast_test()
 {
         ret=0
 
-        netns_create "testns"
+        echo
+        echo "Single path route carrier test"
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        setup
 
-        ip netns exec testns ip link set dev dummy0 carrier on
+        set -e
+        $IP link set dev dummy0 carrier on
+        set +e
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        echo "    Start point"
+        $IP route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
-
-        ip netns exec testns ip route get fibmatch 198.51.100.2 | \
+        $IP route get fibmatch 198.51.100.2 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 | \
+        log_test $? 1 "IPv4 no linkdown flag"
+        $IP -6 route get fibmatch 2001:db8:1::2 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 no linkdown flag"
 
-        ip netns exec testns ip link set dev dummy0 carrier off
+        set -e
+        $IP link set dev dummy0 carrier off
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        echo "    Carrier down"
+        $IP route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 | \
+        $IP route get fibmatch 198.51.100.2 | \
                 grep -q "linkdown"
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 | \
+        log_test $? 0 "IPv4 linkdown flag set"
+        $IP -6 route get fibmatch 2001:db8:1::2 | \
                 grep -q "linkdown"
-        check_err $?
+        log_test $? 0 "IPv6 linkdown flag set"
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy0
+        set -e
+        $IP address add 192.0.2.1/24 dev dummy0
+        $IP -6 address add 2001:db8:2::1/64 dev dummy0
+        set +e
 
-        ip netns exec testns ip route get fibmatch 192.0.2.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::2 &> /dev/null
-        check_err $?
+        echo "    Second address added with carrier down"
+        $IP route get fibmatch 192.0.2.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        $IP -6 route get fibmatch 2001:db8:2::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 192.0.2.2 | \
+        $IP route get fibmatch 192.0.2.2 | \
                 grep -q "linkdown"
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::2 | \
+        log_test $? 0 "IPv4 linkdown flag set"
+        $IP -6 route get fibmatch 2001:db8:2::2 | \
                 grep -q "linkdown"
-        check_err $?
+        log_test $? 0 "IPv6 linkdown flag set"
 
-        ip netns exec testns ip link del dev dummy0
+        cleanup
+}
 
-        ip netns del testns
+fib_carrier_test()
+{
+        fib_carrier_local_test
+        fib_carrier_unicast_test
+}
 
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: unicast route carrier test"
-                return 1
+################################################################################
+# Tests on nexthop spec
+
+# run 'ip route add' with given spec
+add_rt()
+{
+        local desc="$1"
+        local erc=$2
+        local vrf=$3
+        local pfx=$4
+        local gw=$5
+        local dev=$6
+        local cmd out rc
+
+        [ "$vrf" = "-" ] && vrf="default"
+        [ -n "$gw" ] && gw="via $gw"
+        [ -n "$dev" ] && dev="dev $dev"
+
+        cmd="$IP route add vrf $vrf $pfx $gw $dev"
+        if [ "$VERBOSE" = "1" ]; then
+                printf "\n    COMMAND: $cmd\n"
+        fi
+
+        out=$(eval $cmd 2>&1)
+        rc=$?
+        if [ "$VERBOSE" = "1" -a -n "$out" ]; then
+                echo "    $out"
         fi
-        echo "PASS: unicast route carrier test"
+        log_test $rc $erc "$desc"
 }
 
-fib_carrier_test()
+fib4_nexthop()
 {
-        echo "Running netdev carrier change tests"
+        echo
+        echo "IPv4 nexthop tests"
 
-        fib_carrier_local_test
-        fib_carrier_unicast_test
+        echo "<<< write me >>>"
 }
 
+fib6_nexthop()
+{
+        local lldummy=$(get_linklocal dummy0)
+        local llv1=$(get_linklocal dummy0)
+
+        if [ -z "$lldummy" ]; then
+                echo "Failed to get linklocal address for dummy0"
+                return 1
+        fi
+        if [ -z "$llv1" ]; then
+                echo "Failed to get linklocal address for veth1"
+                return 1
+        fi
+
+        echo
+        echo "IPv6 nexthop tests"
+
+        add_rt "Directly connected nexthop, unicast address" 0 \
+                - 2001:db8:101::/64 2001:db8:1::2
+        add_rt "Directly connected nexthop, unicast address with device" 0 \
+                - 2001:db8:102::/64 2001:db8:1::2 "dummy0"
+        add_rt "Gateway is linklocal address" 0 \
+                - 2001:db8:103::1/64 $llv1 "veth0"
+
+        # fails because LL address requires a device
+        add_rt "Gateway is linklocal address, no device" 2 \
+                - 2001:db8:104::1/64 $llv1
+
+        # local address can not be a gateway
+        add_rt "Gateway can not be local unicast address" 2 \
+                - 2001:db8:105::/64 2001:db8:1::1
+        add_rt "Gateway can not be local unicast address, with device" 2 \
+                - 2001:db8:106::/64 2001:db8:1::1 "dummy0"
+        add_rt "Gateway can not be a local linklocal address" 2 \
+                - 2001:db8:107::1/64 $lldummy "dummy0"
+
+        # VRF tests
+        add_rt "Gateway can be local address in a VRF" 0 \
+                - 2001:db8:108::/64 2001:db8:51::2
+        add_rt "Gateway can be local address in a VRF, with device" 0 \
+                - 2001:db8:109::/64 2001:db8:51::2 "veth0"
+        add_rt "Gateway can be local linklocal address in a VRF" 0 \
+                - 2001:db8:110::1/64 $llv1 "veth0"
+
+        add_rt "Redirect to VRF lookup" 0 \
+                - 2001:db8:111::/64 "" "red"
+
+        add_rt "VRF route, gateway can be local address in default VRF" 0 \
+                red 2001:db8:112::/64 2001:db8:51::1
+
+        # local address in same VRF fails
+        add_rt "VRF route, gateway can not be a local address" 2 \
+                red 2001:db8:113::1/64 2001:db8:2::1
+        add_rt "VRF route, gateway can not be a local addr with device" 2 \
+                red 2001:db8:114::1/64 2001:db8:2::1 "dummy1"
+}
+
+# Default VRF:
+#   dummy0 - 198.51.100.1/24 2001:db8:1::1/64
+#   veth0  - 192.0.2.1/24    2001:db8:51::1/64
+#
+# VRF red:
+#   dummy1 - 192.168.2.1/24 2001:db8:2::1/64
+#   veth1  - 192.0.2.2/24   2001:db8:51::2/64
+#
+#  [ dummy0   veth0 ]--[ veth1   dummy1 ]
+
+fib_nexthop_test()
+{
+        setup
+
+        set -e
+
+        $IP -4 rule add pref 32765 table local
+        $IP -4 rule del pref 0
+        $IP -6 rule add pref 32765 table local
+        $IP -6 rule del pref 0
+
+        $IP link add red type vrf table 1
+        $IP link set red up
+        $IP -4 route add vrf red unreachable default metric 4278198272
+        $IP -6 route add vrf red unreachable default metric 4278198272
+
+        $IP link add veth0 type veth peer name veth1
+        $IP link set dev veth0 up
+        $IP address add 192.0.2.1/24 dev veth0
+        $IP -6 address add 2001:db8:51::1/64 dev veth0
+
+        $IP link set dev veth1 vrf red up
+        $IP address add 192.0.2.2/24 dev veth1
+        $IP -6 address add 2001:db8:51::2/64 dev veth1
+
+        $IP link add dummy1 type dummy
+        $IP link set dev dummy1 vrf red up
+        $IP address add 192.168.2.1/24 dev dummy1
+        $IP -6 address add 2001:db8:2::1/64 dev dummy1
+        set +e
+
+        sleep 1
+        fib4_nexthop
+        fib6_nexthop
+
+        (
+        $IP link del dev dummy1
+        $IP link del veth0
+        $IP link del red
+        ) 2>/dev/null
+        cleanup
+}
+
+################################################################################
+#
+
 fib_test()
 {
-        fib_unreg_test
-        fib_down_test
-        fib_carrier_test
+        if [ -n "$TEST" ]; then
+                eval $TEST
+        else
+                fib_unreg_test
+                fib_down_test
+                fib_carrier_test
+                fib_nexthop_test
+        fi
 }
 
 if [ "$(id -u)" -ne 0 ];then
@@ -424,6 +593,9 @@ if [ $? -ne 0 ]; then
         exit 0
 fi
 
+# start clean
+cleanup &> /dev/null
+
 fib_test
 
 exit $ret
diff --git a/tools/testing/selftests/net/forwarding/.gitignore b/tools/testing/selftests/net/forwarding/.gitignore
new file mode 100644
index 000000000000..a793eef5b876
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/.gitignore
@@ -0,0 +1 @@
+forwarding.config
diff --git a/tools/testing/selftests/net/forwarding/README b/tools/testing/selftests/net/forwarding/README
new file mode 100644
index 000000000000..4a0964c42860
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/README
@@ -0,0 +1,56 @@
+Motivation
+==========
+
+One of the nice things about network namespaces is that they allow one
+to easily create and test complex environments.
+
+Unfortunately, these namespaces can not be used with actual switching
+ASICs, as their ports can not be migrated to other network namespaces
+(NETIF_F_NETNS_LOCAL) and most of them probably do not support the
+L1-separation provided by namespaces.
+
+However, a similar kind of flexibility can be achieved by using VRFs and
+by looping the switch ports together. For example:
+
+                             br0
+                              +
+               vrf-h1         |           vrf-h2
+                 +        +---+----+        +
+                 |        |        |        |
+    192.0.2.1/24 +        +        +        + 192.0.2.2/24
+               swp1     swp2     swp3     swp4
+                 +        +        +        +
+                 |        |        |        |
+                 +--------+        +--------+
+
+The VRFs act as lightweight namespaces representing hosts connected to
+the switch.
+
+This approach for testing switch ASICs has several advantages over the
+traditional method that requires multiple physical machines, to name a
+few:
+
+1. Only the device under test (DUT) is being tested without noise from
+other system.
+
+2. Ability to easily provision complex topologies. Testing bridging
+between 4-ports LAGs or 8-way ECMP requires many physical links that are
+not always available. With the VRF-based approach one merely needs to
+loopback more ports.
+
+These tests are written with switch ASICs in mind, but they can be run
+on any Linux box using veth pairs to emulate physical loopbacks.
+
+Guidelines for Writing Tests
+============================
+
+o Where possible, reuse an existing topology for different tests instead
+  of recreating the same topology.
+o Where possible, IPv6 and IPv4 addresses shall conform to RFC 3849 and
+  RFC 5737, respectively.
+o Where possible, tests shall be written so that they can be reused by
+  multiple topologies and added to lib.sh.
+o Checks shall be added to lib.sh for any external dependencies.
+o Code shall be checked using ShellCheck [1] prior to submission.
+
+1. https://www.shellcheck.net/
diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
new file mode 100755
index 000000000000..75d922438bc9
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
@@ -0,0 +1,88 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=4
+CHECK_TC="yes"
+source lib.sh
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.2/24 2001:db8:1::2/64
+}
+
+h2_destroy()
+{
+        simple_if_fini $h2 192.0.2.2/24 2001:db8:1::2/64
+}
+
+switch_create()
+{
+        # 10 Seconds ageing time.
+        ip link add dev br0 type bridge vlan_filtering 1 ageing_time 1000 \
+                mcast_snooping 0
+
+        ip link set dev $swp1 master br0
+        ip link set dev $swp2 master br0
+
+        ip link set dev br0 up
+        ip link set dev $swp1 up
+        ip link set dev $swp2 up
+}
+
+switch_destroy()
+{
+        ip link set dev $swp2 down
+        ip link set dev $swp1 down
+
+        ip link del dev br0
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+
+        switch_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        switch_destroy
+
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+ping_test $h1 192.0.2.2
+ping6_test $h1 2001:db8:1::2
+learning_test "br0" $swp1 $h1 $h2
+flood_test $swp2 $h1 $h2
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
new file mode 100755
index 000000000000..1cddf06f691d
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
@@ -0,0 +1,86 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=4
+source lib.sh
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/24 2001:db8:1::1/64
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/24 2001:db8:1::1/64
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.2/24 2001:db8:1::2/64
+}
+
+h2_destroy()
+{
+        simple_if_fini $h2 192.0.2.2/24 2001:db8:1::2/64
+}
+
+switch_create()
+{
+        # 10 Seconds ageing time.
+        ip link add dev br0 type bridge ageing_time 1000 mcast_snooping 0
+
+        ip link set dev $swp1 master br0
+        ip link set dev $swp2 master br0
+
+        ip link set dev br0 up
+        ip link set dev $swp1 up
+        ip link set dev $swp2 up
+}
+
+switch_destroy()
+{
+        ip link set dev $swp2 down
+        ip link set dev $swp1 down
+
+        ip link del dev br0
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+
+        switch_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        switch_destroy
+
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+ping_test $h1 192.0.2.2
+ping6_test $h1 2001:db8:1::2
+learning_test "br0" $swp1 $h1 $h2
+flood_test $swp2 $h1 $h2
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/config b/tools/testing/selftests/net/forwarding/config
new file mode 100644
index 000000000000..5cd2aed97958
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/config
@@ -0,0 +1,12 @@
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_NET_VRF=m
+CONFIG_BPF_SYSCALL=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_VETH=m
diff --git a/tools/testing/selftests/net/forwarding/forwarding.config.sample b/tools/testing/selftests/net/forwarding/forwarding.config.sample
new file mode 100644
index 000000000000..e819d049d9ce
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/forwarding.config.sample
@@ -0,0 +1,35 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+##############################################################################
+# Topology description. p1 looped back to p2, p3 to p4 and so on.
+declare -A NETIFS
+
+NETIFS[p1]=veth0
+NETIFS[p2]=veth1
+NETIFS[p3]=veth2
+NETIFS[p4]=veth3
+NETIFS[p5]=veth4
+NETIFS[p6]=veth5
+NETIFS[p7]=veth6
+NETIFS[p8]=veth7
+
+##############################################################################
+# Defines
+
+# IPv4 ping utility name
+PING=ping
+# IPv6 ping utility name. Some distributions use 'ping' for IPv6.
+PING6=ping6
+# Packet generator. Some distributions use 'mz'.
+MZ=mausezahn
+# Time to wait after interfaces participating in the test are all UP
+WAIT_TIME=5
+# Whether to pause on failure or not.
+PAUSE_ON_FAIL=no
+# Whether to pause on cleanup or not.
+PAUSE_ON_CLEANUP=no
+# Type of network interface to create
+NETIF_TYPE=veth
+# Whether to create virtual interfaces (veth) or not
+NETIF_CREATE=yes
diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
new file mode 100644
index 000000000000..1ac6c62271f3
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -0,0 +1,577 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+##############################################################################
+# Defines
+
+# Can be overridden by the configuration file.
+PING=${PING:=ping}
+PING6=${PING6:=ping6}
+MZ=${MZ:=mausezahn}
+WAIT_TIME=${WAIT_TIME:=5}
+PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
+PAUSE_ON_CLEANUP=${PAUSE_ON_CLEANUP:=no}
+NETIF_TYPE=${NETIF_TYPE:=veth}
+NETIF_CREATE=${NETIF_CREATE:=yes}
+
+if [[ -f forwarding.config ]]; then
+        source forwarding.config
+fi
+
+##############################################################################
+# Sanity checks
+
+check_tc_version()
+{
+        tc -j &> /dev/null
+        if [[ $? -ne 0 ]]; then
+                echo "SKIP: iproute2 too old; tc is missing JSON support"
+                exit 1
+        fi
+
+        tc filter help 2>&1 | grep block &> /dev/null
+        if [[ $? -ne 0 ]]; then
+                echo "SKIP: iproute2 too old; tc is missing shared block support"
+                exit 1
+        fi
+}
+
+if [[ "$(id -u)" -ne 0 ]]; then
+        echo "SKIP: need root privileges"
+        exit 0
+fi
+
+if [[ "$CHECK_TC" = "yes" ]]; then
+        check_tc_version
+fi
+
+if [[ ! -x "$(command -v jq)" ]]; then
+        echo "SKIP: jq not installed"
+        exit 1
+fi
+
+if [[ ! -x "$(command -v $MZ)" ]]; then
+        echo "SKIP: $MZ not installed"
+        exit 1
+fi
+
+if [[ ! -v NUM_NETIFS ]]; then
+        echo "SKIP: importer does not define \"NUM_NETIFS\""
+        exit 1
+fi
+
+##############################################################################
+# Command line options handling
+
+count=0
+
+while [[ $# -gt 0 ]]; do
+        if [[ "$count" -eq "0" ]]; then
+                unset NETIFS
+                declare -A NETIFS
+        fi
+        count=$((count + 1))
+        NETIFS[p$count]="$1"
+        shift
+done
+
+##############################################################################
+# Network interfaces configuration
+
+create_netif_veth()
+{
+        local i
+
+        for i in $(eval echo {1..$NUM_NETIFS}); do
+                local j=$((i+1))
+
+                ip link show dev ${NETIFS[p$i]} &> /dev/null
+                if [[ $? -ne 0 ]]; then
+                        ip link add ${NETIFS[p$i]} type veth \
+                                peer name ${NETIFS[p$j]}
+                        if [[ $? -ne 0 ]]; then
+                                echo "Failed to create netif"
+                                exit 1
+                        fi
+                fi
+                i=$j
+        done
+}
+
+create_netif()
+{
+        case "$NETIF_TYPE" in
+        veth) create_netif_veth
+              ;;
+        *) echo "Can not create interfaces of type \'$NETIF_TYPE\'"
+           exit 1
+           ;;
+        esac
+}
+
+if [[ "$NETIF_CREATE" = "yes" ]]; then
+        create_netif
+fi
+
+for i in $(eval echo {1..$NUM_NETIFS}); do
+        ip link show dev ${NETIFS[p$i]} &> /dev/null
+        if [[ $? -ne 0 ]]; then
+                echo "SKIP: could not find all required interfaces"
+                exit 1
+        fi
+done
+
+##############################################################################
+# Helpers
+
+# Exit status to return at the end. Set in case one of the tests fails.
+EXIT_STATUS=0
+# Per-test return value. Clear at the beginning of each test.
+RET=0
+
+check_err()
+{
+        local err=$1
+        local msg=$2
+
+        if [[ $RET -eq 0 && $err -ne 0 ]]; then
+                RET=$err
+                retmsg=$msg
+        fi
+}
+
+check_fail()
+{
+        local err=$1
+        local msg=$2
+
+        if [[ $RET -eq 0 && $err -eq 0 ]]; then
+                RET=1
+                retmsg=$msg
+        fi
+}
+
+log_test()
+{
+        local test_name=$1
+        local opt_str=$2
+
+        if [[ $# -eq 2 ]]; then
+                opt_str="($opt_str)"
+        fi
+
+        if [[ $RET -ne 0 ]]; then
+                EXIT_STATUS=1
+                printf "TEST: %-60s  [FAIL]\n" "$test_name $opt_str"
+                if [[ ! -z "$retmsg" ]]; then
+                        printf "\t%s\n" "$retmsg"
+                fi
+                if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+                        echo "Hit enter to continue, 'q' to quit"
+                        read a
+                        [ "$a" = "q" ] && exit 1
+                fi
+                return 1
+        fi
+
+        printf "TEST: %-60s  [PASS]\n" "$test_name $opt_str"
+        return 0
+}
+
+log_info()
+{
+        local msg=$1
+
+        echo "INFO: $msg"
+}
+
+setup_wait()
+{
+        for i in $(eval echo {1..$NUM_NETIFS}); do
+                while true; do
+                        ip link show dev ${NETIFS[p$i]} up \
+                                | grep 'state UP' &> /dev/null
+                        if [[ $? -ne 0 ]]; then
+                                sleep 1
+                        else
+                                break
+                        fi
+                done
+        done
+
+        # Make sure links are ready.
+        sleep $WAIT_TIME
+}
+
+pre_cleanup()
+{
+        if [ "${PAUSE_ON_CLEANUP}" = "yes" ]; then
+                echo "Pausing before cleanup, hit any key to continue"
+                read
+        fi
+}
+
+vrf_prepare()
+{
+        ip -4 rule add pref 32765 table local
+        ip -4 rule del pref 0
+        ip -6 rule add pref 32765 table local
+        ip -6 rule del pref 0
+}
+
+vrf_cleanup()
+{
+        ip -6 rule add pref 0 table local
+        ip -6 rule del pref 32765
+        ip -4 rule add pref 0 table local
+        ip -4 rule del pref 32765
+}
+
+__last_tb_id=0
+declare -A __TB_IDS
+
+__vrf_td_id_assign()
+{
+        local vrf_name=$1
+
+        __last_tb_id=$((__last_tb_id + 1))
+        __TB_IDS[$vrf_name]=$__last_tb_id
+        return $__last_tb_id
+}
+
+__vrf_td_id_lookup()
+{
+        local vrf_name=$1
+
+        return ${__TB_IDS[$vrf_name]}
+}
+
+vrf_create()
+{
+        local vrf_name=$1
+        local tb_id
+
+        __vrf_td_id_assign $vrf_name
+        tb_id=$?
+
+        ip link add dev $vrf_name type vrf table $tb_id
+        ip -4 route add table $tb_id unreachable default metric 4278198272
+        ip -6 route add table $tb_id unreachable default metric 4278198272
+}
+
+vrf_destroy()
+{
+        local vrf_name=$1
+        local tb_id
+
+        __vrf_td_id_lookup $vrf_name
+        tb_id=$?
+
+        ip -6 route del table $tb_id unreachable default metric 4278198272
+        ip -4 route del table $tb_id unreachable default metric 4278198272
+        ip link del dev $vrf_name
+}
+
+__addr_add_del()
+{
+        local if_name=$1
+        local add_del=$2
+        local array
+
+        shift
+        shift
+        array=("${@}")
+
+        for addrstr in "${array[@]}"; do
+                ip address $add_del $addrstr dev $if_name
+        done
+}
+
+simple_if_init()
+{
+        local if_name=$1
+        local vrf_name
+        local array
+
+        shift
+        vrf_name=v$if_name
+        array=("${@}")
+
+        vrf_create $vrf_name
+        ip link set dev $if_name master $vrf_name
+        ip link set dev $vrf_name up
+        ip link set dev $if_name up
+
+        __addr_add_del $if_name add "${array[@]}"
+}
+
+simple_if_fini()
+{
+        local if_name=$1
+        local vrf_name
+        local array
+
+        shift
+        vrf_name=v$if_name
+        array=("${@}")
+
+        __addr_add_del $if_name del "${array[@]}"
+
+        ip link set dev $if_name down
+        vrf_destroy $vrf_name
+}
+
+master_name_get()
+{
+        local if_name=$1
+
+        ip -j link show dev $if_name | jq -r '.[]["master"]'
+}
+
+link_stats_tx_packets_get()
+{
+       local if_name=$1
+
+       ip -j -s link show dev $if_name | jq '.[]["stats64"]["tx"]["packets"]'
+}
+
+mac_get()
+{
+        local if_name=$1
+
+        ip -j link show dev $if_name | jq -r '.[]["address"]'
+}
+
+bridge_ageing_time_get()
+{
+        local bridge=$1
+        local ageing_time
+
+        # Need to divide by 100 to convert to seconds.
+        ageing_time=$(ip -j -d link show dev $bridge \
+                      | jq '.[]["linkinfo"]["info_data"]["ageing_time"]')
+        echo $((ageing_time / 100))
+}
+
+forwarding_enable()
+{
+       ipv4_fwd=$(sysctl -n net.ipv4.conf.all.forwarding)
+       ipv6_fwd=$(sysctl -n net.ipv6.conf.all.forwarding)
+
+       sysctl -q -w net.ipv4.conf.all.forwarding=1
+       sysctl -q -w net.ipv6.conf.all.forwarding=1
+}
+
+forwarding_restore()
+{
+       sysctl -q -w net.ipv6.conf.all.forwarding=$ipv6_fwd
+       sysctl -q -w net.ipv4.conf.all.forwarding=$ipv4_fwd
+}
+
+tc_offload_check()
+{
+        for i in $(eval echo {1..$NUM_NETIFS}); do
+                ethtool -k ${NETIFS[p$i]} \
+                        | grep "hw-tc-offload: on" &> /dev/null
+                if [[ $? -ne 0 ]]; then
+                        return 1
+                fi
+        done
+
+        return 0
+}
+
+##############################################################################
+# Tests
+
+ping_test()
+{
+        local if_name=$1
+        local dip=$2
+        local vrf_name
+
+        RET=0
+
+        vrf_name=$(master_name_get $if_name)
+        ip vrf exec $vrf_name $PING $dip -c 10 -i 0.1 -w 2 &> /dev/null
+        check_err $?
+        log_test "ping"
+}
+
+ping6_test()
+{
+        local if_name=$1
+        local dip=$2
+        local vrf_name
+
+        RET=0
+
+        vrf_name=$(master_name_get $if_name)
+        ip vrf exec $vrf_name $PING6 $dip -c 10 -i 0.1 -w 2 &> /dev/null
+        check_err $?
+        log_test "ping6"
+}
+
+learning_test()
+{
+        local bridge=$1
+        local br_port1=$2       # Connected to `host1_if`.
+        local host1_if=$3
+        local host2_if=$4
+        local mac=de:ad:be:ef:13:37
+        local ageing_time
+
+        RET=0
+
+        bridge -j fdb show br $bridge brport $br_port1 \
+                | jq -e ".[] | select(.mac == \"$mac\")" &> /dev/null
+        check_fail $? "Found FDB record when should not"
+
+        # Disable unknown unicast flooding on `br_port1` to make sure
+        # packets are only forwarded through the port after a matching
+        # FDB entry was installed.
+        bridge link set dev $br_port1 flood off
+
+        tc qdisc add dev $host1_if ingress
+        tc filter add dev $host1_if ingress protocol ip pref 1 handle 101 \
+                flower dst_mac $mac action drop
+
+        $MZ $host2_if -c 1 -p 64 -b $mac -t ip -q
+        sleep 1
+
+        tc -j -s filter show dev $host1_if ingress \
+                | jq -e ".[] | select(.options.handle == 101) \
+                | select(.options.actions[0].stats.packets == 1)" &> /dev/null
+        check_fail $? "Packet reached second host when should not"
+
+        $MZ $host1_if -c 1 -p 64 -a $mac -t ip -q
+        sleep 1
+
+        bridge -j fdb show br $bridge brport $br_port1 \
+                | jq -e ".[] | select(.mac == \"$mac\")" &> /dev/null
+        check_err $? "Did not find FDB record when should"
+
+        $MZ $host2_if -c 1 -p 64 -b $mac -t ip -q
+        sleep 1
+
+        tc -j -s filter show dev $host1_if ingress \
+                | jq -e ".[] | select(.options.handle == 101) \
+                | select(.options.actions[0].stats.packets == 1)" &> /dev/null
+        check_err $? "Packet did not reach second host when should"
+
+        # Wait for 10 seconds after the ageing time to make sure FDB
+        # record was aged-out.
+        ageing_time=$(bridge_ageing_time_get $bridge)
+        sleep $((ageing_time + 10))
+
+        bridge -j fdb show br $bridge brport $br_port1 \
+                | jq -e ".[] | select(.mac == \"$mac\")" &> /dev/null
+        check_fail $? "Found FDB record when should not"
+
+        bridge link set dev $br_port1 learning off
+
+        $MZ $host1_if -c 1 -p 64 -a $mac -t ip -q
+        sleep 1
+
+        bridge -j fdb show br $bridge brport $br_port1 \
+                | jq -e ".[] | select(.mac == \"$mac\")" &> /dev/null
+        check_fail $? "Found FDB record when should not"
+
+        bridge link set dev $br_port1 learning on
+
+        tc filter del dev $host1_if ingress protocol ip pref 1 handle 101 flower
+        tc qdisc del dev $host1_if ingress
+
+        bridge link set dev $br_port1 flood on
+
+        log_test "FDB learning"
+}
+
+flood_test_do()
+{
+        local should_flood=$1
+        local mac=$2
+        local ip=$3
+        local host1_if=$4
+        local host2_if=$5
+        local err=0
+
+        # Add an ACL on `host2_if` which will tell us whether the packet
+        # was flooded to it or not.
+        tc qdisc add dev $host2_if ingress
+        tc filter add dev $host2_if ingress protocol ip pref 1 handle 101 \
+                flower dst_mac $mac action drop
+
+        $MZ $host1_if -c 1 -p 64 -b $mac -B $ip -t ip -q
+        sleep 1
+
+        tc -j -s filter show dev $host2_if ingress \
+                | jq -e ".[] | select(.options.handle == 101) \
+                | select(.options.actions[0].stats.packets == 1)" &> /dev/null
+        if [[ $? -ne 0 && $should_flood == "true" || \
+              $? -eq 0 && $should_flood == "false" ]]; then
+                err=1
+        fi
+
+        tc filter del dev $host2_if ingress protocol ip pref 1 handle 101 flower
+        tc qdisc del dev $host2_if ingress
+
+        return $err
+}
+
+flood_unicast_test()
+{
+        local br_port=$1
+        local host1_if=$2
+        local host2_if=$3
+        local mac=de:ad:be:ef:13:37
+        local ip=192.0.2.100
+
+        RET=0
+
+        bridge link set dev $br_port flood off
+
+        flood_test_do false $mac $ip $host1_if $host2_if
+        check_err $? "Packet flooded when should not"
+
+        bridge link set dev $br_port flood on
+
+        flood_test_do true $mac $ip $host1_if $host2_if
+        check_err $? "Packet was not flooded when should"
+
+        log_test "Unknown unicast flood"
+}
+
+flood_multicast_test()
+{
+        local br_port=$1
+        local host1_if=$2
+        local host2_if=$3
+        local mac=01:00:5e:00:00:01
+        local ip=239.0.0.1
+
+        RET=0
+
+        bridge link set dev $br_port mcast_flood off
+
+        flood_test_do false $mac $ip $host1_if $host2_if
+        check_err $? "Packet flooded when should not"
+
+        bridge link set dev $br_port mcast_flood on
+
+        flood_test_do true $mac $ip $host1_if $host2_if
+        check_err $? "Packet was not flooded when should"
+
+        log_test "Unregistered multicast flood"
+}
+
+flood_test()
+{
+        # `br_port` is connected to `host2_if`
+        local br_port=$1
+        local host1_if=$2
+        local host2_if=$3
+
+        flood_unicast_test $br_port $host1_if $host2_if
+        flood_multicast_test $br_port $host1_if $host2_if
+}
diff --git a/tools/testing/selftests/net/forwarding/router.sh b/tools/testing/selftests/net/forwarding/router.sh
new file mode 100755
index 000000000000..cc6a14abfa87
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/router.sh
@@ -0,0 +1,125 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=4
+source lib.sh
+
+h1_create()
+{
+        vrf_create "vrf-h1"
+        ip link set dev $h1 master vrf-h1
+
+        ip link set dev vrf-h1 up
+        ip link set dev $h1 up
+
+        ip address add 192.0.2.2/24 dev $h1
+        ip address add 2001:db8:1::2/64 dev $h1
+
+        ip route add 198.51.100.0/24 vrf vrf-h1 nexthop via 192.0.2.1
+        ip route add 2001:db8:2::/64 vrf vrf-h1 nexthop via 2001:db8:1::1
+}
+
+h1_destroy()
+{
+        ip route del 2001:db8:2::/64 vrf vrf-h1
+        ip route del 198.51.100.0/24 vrf vrf-h1
+
+        ip address del 2001:db8:1::2/64 dev $h1
+        ip address del 192.0.2.2/24 dev $h1
+
+        ip link set dev $h1 down
+        vrf_destroy "vrf-h1"
+}
+
+h2_create()
+{
+        vrf_create "vrf-h2"
+        ip link set dev $h2 master vrf-h2
+
+        ip link set dev vrf-h2 up
+        ip link set dev $h2 up
+
+        ip address add 198.51.100.2/24 dev $h2
+        ip address add 2001:db8:2::2/64 dev $h2
+
+        ip route add 192.0.2.0/24 vrf vrf-h2 nexthop via 198.51.100.1
+        ip route add 2001:db8:1::/64 vrf vrf-h2 nexthop via 2001:db8:2::1
+}
+
+h2_destroy()
+{
+        ip route del 2001:db8:1::/64 vrf vrf-h2
+        ip route del 192.0.2.0/24 vrf vrf-h2
+
+        ip address del 2001:db8:2::2/64 dev $h2
+        ip address del 198.51.100.2/24 dev $h2
+
+        ip link set dev $h2 down
+        vrf_destroy "vrf-h2"
+}
+
+router_create()
+{
+        ip link set dev $rp1 up
+        ip link set dev $rp2 up
+
+        ip address add 192.0.2.1/24 dev $rp1
+        ip address add 2001:db8:1::1/64 dev $rp1
+
+        ip address add 198.51.100.1/24 dev $rp2
+        ip address add 2001:db8:2::1/64 dev $rp2
+}
+
+router_destroy()
+{
+        ip address del 2001:db8:2::1/64 dev $rp2
+        ip address del 198.51.100.1/24 dev $rp2
+
+        ip address del 2001:db8:1::1/64 dev $rp1
+        ip address del 192.0.2.1/24 dev $rp1
+
+        ip link set dev $rp2 down
+        ip link set dev $rp1 down
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        rp1=${NETIFS[p2]}
+
+        rp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+
+        router_create
+
+        forwarding_enable
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        forwarding_restore
+
+        router_destroy
+
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+ping_test $h1 198.51.100.2
+ping6_test $h1 2001:db8:2::2
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh
new file mode 100755
index 000000000000..3bc351008db6
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/router_multipath.sh
@@ -0,0 +1,376 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=8
+source lib.sh
+
+h1_create()
+{
+        vrf_create "vrf-h1"
+        ip link set dev $h1 master vrf-h1
+
+        ip link set dev vrf-h1 up
+        ip link set dev $h1 up
+
+        ip address add 192.0.2.2/24 dev $h1
+        ip address add 2001:db8:1::2/64 dev $h1
+
+        ip route add 198.51.100.0/24 vrf vrf-h1 nexthop via 192.0.2.1
+        ip route add 2001:db8:2::/64 vrf vrf-h1 nexthop via 2001:db8:1::1
+}
+
+h1_destroy()
+{
+        ip route del 2001:db8:2::/64 vrf vrf-h1
+        ip route del 198.51.100.0/24 vrf vrf-h1
+
+        ip address del 2001:db8:1::2/64 dev $h1
+        ip address del 192.0.2.2/24 dev $h1
+
+        ip link set dev $h1 down
+        vrf_destroy "vrf-h1"
+}
+
+h2_create()
+{
+        vrf_create "vrf-h2"
+        ip link set dev $h2 master vrf-h2
+
+        ip link set dev vrf-h2 up
+        ip link set dev $h2 up
+
+        ip address add 198.51.100.2/24 dev $h2
+        ip address add 2001:db8:2::2/64 dev $h2
+
+        ip route add 192.0.2.0/24 vrf vrf-h2 nexthop via 198.51.100.1
+        ip route add 2001:db8:1::/64 vrf vrf-h2 nexthop via 2001:db8:2::1
+}
+
+h2_destroy()
+{
+        ip route del 2001:db8:1::/64 vrf vrf-h2
+        ip route del 192.0.2.0/24 vrf vrf-h2
+
+        ip address del 2001:db8:2::2/64 dev $h2
+        ip address del 198.51.100.2/24 dev $h2
+
+        ip link set dev $h2 down
+        vrf_destroy "vrf-h2"
+}
+
+router1_create()
+{
+        vrf_create "vrf-r1"
+        ip link set dev $rp11 master vrf-r1
+        ip link set dev $rp12 master vrf-r1
+        ip link set dev $rp13 master vrf-r1
+
+        ip link set dev vrf-r1 up
+        ip link set dev $rp11 up
+        ip link set dev $rp12 up
+        ip link set dev $rp13 up
+
+        ip address add 192.0.2.1/24 dev $rp11
+        ip address add 2001:db8:1::1/64 dev $rp11
+
+        ip address add 169.254.2.12/24 dev $rp12
+        ip address add fe80:2::12/64 dev $rp12
+
+        ip address add 169.254.3.13/24 dev $rp13
+        ip address add fe80:3::13/64 dev $rp13
+
+        ip route add 198.51.100.0/24 vrf vrf-r1 \
+                nexthop via 169.254.2.22 dev $rp12 \
+                nexthop via 169.254.3.23 dev $rp13
+        ip route add 2001:db8:2::/64 vrf vrf-r1 \
+                nexthop via fe80:2::22 dev $rp12 \
+                nexthop via fe80:3::23 dev $rp13
+}
+
+router1_destroy()
+{
+        ip route del 2001:db8:2::/64 vrf vrf-r1
+        ip route del 198.51.100.0/24 vrf vrf-r1
+
+        ip address del fe80:3::13/64 dev $rp13
+        ip address del 169.254.3.13/24 dev $rp13
+
+        ip address del fe80:2::12/64 dev $rp12
+        ip address del 169.254.2.12/24 dev $rp12
+
+        ip address del 2001:db8:1::1/64 dev $rp11
+        ip address del 192.0.2.1/24 dev $rp11
+
+        ip link set dev $rp13 down
+        ip link set dev $rp12 down
+        ip link set dev $rp11 down
+
+        vrf_destroy "vrf-r1"
+}
+
+router2_create()
+{
+        vrf_create "vrf-r2"
+        ip link set dev $rp21 master vrf-r2
+        ip link set dev $rp22 master vrf-r2
+        ip link set dev $rp23 master vrf-r2
+
+        ip link set dev vrf-r2 up
+        ip link set dev $rp21 up
+        ip link set dev $rp22 up
+        ip link set dev $rp23 up
+
+        ip address add 198.51.100.1/24 dev $rp21
+        ip address add 2001:db8:2::1/64 dev $rp21
+
+        ip address add 169.254.2.22/24 dev $rp22
+        ip address add fe80:2::22/64 dev $rp22
+
+        ip address add 169.254.3.23/24 dev $rp23
+        ip address add fe80:3::23/64 dev $rp23
+
+        ip route add 192.0.2.0/24 vrf vrf-r2 \
+                nexthop via 169.254.2.12 dev $rp22 \
+                nexthop via 169.254.3.13 dev $rp23
+        ip route add 2001:db8:1::/64 vrf vrf-r2 \
+                nexthop via fe80:2::12 dev $rp22 \
+                nexthop via fe80:3::13 dev $rp23
+}
+
+router2_destroy()
+{
+        ip route del 2001:db8:1::/64 vrf vrf-r2
+        ip route del 192.0.2.0/24 vrf vrf-r2
+
+        ip address del fe80:3::23/64 dev $rp23
+        ip address del 169.254.3.23/24 dev $rp23
+
+        ip address del fe80:2::22/64 dev $rp22
+        ip address del 169.254.2.22/24 dev $rp22
+
+        ip address del 2001:db8:2::1/64 dev $rp21
+        ip address del 198.51.100.1/24 dev $rp21
+
+        ip link set dev $rp23 down
+        ip link set dev $rp22 down
+        ip link set dev $rp21 down
+
+        vrf_destroy "vrf-r2"
+}
+
+multipath_eval()
+{
+       local desc="$1"
+       local weight_rp12=$2
+       local weight_rp13=$3
+       local packets_rp12=$4
+       local packets_rp13=$5
+       local weights_ratio packets_ratio diff
+
+       RET=0
+
+       if [[ "$packets_rp12" -eq "0" || "$packets_rp13" -eq "0" ]]; then
+              check_err 1 "Packet difference is 0"
+              log_test "Multipath"
+              log_info "Expected ratio $weights_ratio"
+              return
+       fi
+
+       if [[ "$weight_rp12" -gt "$weight_rp13" ]]; then
+               weights_ratio=$(echo "scale=2; $weight_rp12 / $weight_rp13" \
+                       | bc -l)
+               packets_ratio=$(echo "scale=2; $packets_rp12 / $packets_rp13" \
+                       | bc -l)
+       else
+               weights_ratio=$(echo "scale=2; $weight_rp13 / $weight_rp12" | \
+                       bc -l)
+               packets_ratio=$(echo "scale=2; $packets_rp13 / $packets_rp12" | \
+                       bc -l)
+       fi
+
+       diff=$(echo $weights_ratio - $packets_ratio | bc -l)
+       diff=${diff#-}
+
+       test "$(echo "$diff / $weights_ratio > 0.1" | bc -l)" -eq 0
+       check_err $? "Too large discrepancy between expected and measured ratios"
+       log_test "$desc"
+       log_info "Expected ratio $weights_ratio Measured ratio $packets_ratio"
+}
+
+multipath4_test()
+{
+       local desc="$1"
+       local weight_rp12=$2
+       local weight_rp13=$3
+       local t0_rp12 t0_rp13 t1_rp12 t1_rp13
+       local packets_rp12 packets_rp13
+       local hash_policy
+
+       # Transmit multiple flows from h1 to h2 and make sure they are
+       # distributed between both multipath links (rp12 and rp13)
+       # according to the configured weights.
+       hash_policy=$(sysctl -n net.ipv4.fib_multipath_hash_policy)
+       sysctl -q -w net.ipv4.fib_multipath_hash_policy=1
+       ip route replace 198.51.100.0/24 vrf vrf-r1 \
+               nexthop via 169.254.2.22 dev $rp12 weight $weight_rp12 \
+               nexthop via 169.254.3.23 dev $rp13 weight $weight_rp13
+
+       t0_rp12=$(link_stats_tx_packets_get $rp12)
+       t0_rp13=$(link_stats_tx_packets_get $rp13)
+
+       ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
+               -d 1msec -t udp "sp=1024,dp=0-32768"
+
+       t1_rp12=$(link_stats_tx_packets_get $rp12)
+       t1_rp13=$(link_stats_tx_packets_get $rp13)
+
+       let "packets_rp12 = $t1_rp12 - $t0_rp12"
+       let "packets_rp13 = $t1_rp13 - $t0_rp13"
+       multipath_eval "$desc" $weight_rp12 $weight_rp13 $packets_rp12 $packets_rp13
+
+       # Restore settings.
+       ip route replace 198.51.100.0/24 vrf vrf-r1 \
+               nexthop via 169.254.2.22 dev $rp12 \
+               nexthop via 169.254.3.23 dev $rp13
+       sysctl -q -w net.ipv4.fib_multipath_hash_policy=$hash_policy
+}
+
+multipath6_l4_test()
+{
+       local desc="$1"
+       local weight_rp12=$2
+       local weight_rp13=$3
+       local t0_rp12 t0_rp13 t1_rp12 t1_rp13
+       local packets_rp12 packets_rp13
+       local hash_policy
+
+       # Transmit multiple flows from h1 to h2 and make sure they are
+       # distributed between both multipath links (rp12 and rp13)
+       # according to the configured weights.
+       hash_policy=$(sysctl -n net.ipv6.fib_multipath_hash_policy)
+       sysctl -q -w net.ipv6.fib_multipath_hash_policy=1
+
+       ip route replace 2001:db8:2::/64 vrf vrf-r1 \
+               nexthop via fe80:2::22 dev $rp12 weight $weight_rp12 \
+               nexthop via fe80:3::23 dev $rp13 weight $weight_rp13
+
+       t0_rp12=$(link_stats_tx_packets_get $rp12)
+       t0_rp13=$(link_stats_tx_packets_get $rp13)
+
+       $MZ $h1 -6 -q -p 64 -A 2001:db8:1::2 -B 2001:db8:2::2 \
+               -d 1msec -t udp "sp=1024,dp=0-32768"
+
+       t1_rp12=$(link_stats_tx_packets_get $rp12)
+       t1_rp13=$(link_stats_tx_packets_get $rp13)
+
+       let "packets_rp12 = $t1_rp12 - $t0_rp12"
+       let "packets_rp13 = $t1_rp13 - $t0_rp13"
+       multipath_eval "$desc" $weight_rp12 $weight_rp13 $packets_rp12 $packets_rp13
+
+       ip route replace 2001:db8:2::/64 vrf vrf-r1 \
+               nexthop via fe80:2::22 dev $rp12 \
+               nexthop via fe80:3::23 dev $rp13
+
+       sysctl -q -w net.ipv6.fib_multipath_hash_policy=$hash_policy
+}
+
+multipath6_test()
+{
+       local desc="$1"
+       local weight_rp12=$2
+       local weight_rp13=$3
+       local t0_rp12 t0_rp13 t1_rp12 t1_rp13
+       local packets_rp12 packets_rp13
+
+       ip route replace 2001:db8:2::/64 vrf vrf-r1 \
+               nexthop via fe80:2::22 dev $rp12 weight $weight_rp12 \
+               nexthop via fe80:3::23 dev $rp13 weight $weight_rp13
+
+       t0_rp12=$(link_stats_tx_packets_get $rp12)
+       t0_rp13=$(link_stats_tx_packets_get $rp13)
+
+       # Generate 16384 echo requests, each with a random flow label.
+       for _ in $(seq 1 16384); do
+               ip vrf exec vrf-h1 $PING6 2001:db8:2::2 -F 0 -c 1 -q &> /dev/null
+       done
+
+       t1_rp12=$(link_stats_tx_packets_get $rp12)
+       t1_rp13=$(link_stats_tx_packets_get $rp13)
+
+       let "packets_rp12 = $t1_rp12 - $t0_rp12"
+       let "packets_rp13 = $t1_rp13 - $t0_rp13"
+       multipath_eval "$desc" $weight_rp12 $weight_rp13 $packets_rp12 $packets_rp13
+
+       ip route replace 2001:db8:2::/64 vrf vrf-r1 \
+               nexthop via fe80:2::22 dev $rp12 \
+               nexthop via fe80:3::23 dev $rp13
+}
+
+multipath_test()
+{
+        log_info "Running IPv4 multipath tests"
+        multipath4_test "ECMP" 1 1
+        multipath4_test "Weighted MP 2:1" 2 1
+        multipath4_test "Weighted MP 11:45" 11 45
+
+        log_info "Running IPv6 multipath tests"
+        multipath6_test "ECMP" 1 1
+        multipath6_test "Weighted MP 2:1" 2 1
+        multipath6_test "Weighted MP 11:45" 11 45
+
+        log_info "Running IPv6 L4 hash multipath tests"
+        multipath6_l4_test "ECMP" 1 1
+        multipath6_l4_test "Weighted MP 2:1" 2 1
+        multipath6_l4_test "Weighted MP 11:45" 11 45
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        rp11=${NETIFS[p2]}
+
+        rp12=${NETIFS[p3]}
+        rp22=${NETIFS[p4]}
+
+        rp13=${NETIFS[p5]}
+        rp23=${NETIFS[p6]}
+
+        rp21=${NETIFS[p7]}
+        h2=${NETIFS[p8]}
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+
+        router1_create
+        router2_create
+
+        forwarding_enable
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        forwarding_restore
+
+        router2_destroy
+        router1_destroy
+
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+ping_test $h1 198.51.100.2
+ping6_test $h1 2001:db8:2::2
+multipath_test
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh
new file mode 100755
index 000000000000..3a6385ebd5d0
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/tc_actions.sh
@@ -0,0 +1,202 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=4
+source tc_common.sh
+source lib.sh
+
+tcflags="skip_hw"
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/24
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/24
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.2/24
+        tc qdisc add dev $h2 clsact
+}
+
+h2_destroy()
+{
+        tc qdisc del dev $h2 clsact
+        simple_if_fini $h2 192.0.2.2/24
+}
+
+switch_create()
+{
+        simple_if_init $swp1 192.0.2.2/24
+        tc qdisc add dev $swp1 clsact
+
+        simple_if_init $swp2 192.0.2.1/24
+}
+
+switch_destroy()
+{
+        simple_if_fini $swp2 192.0.2.1/24
+
+        tc qdisc del dev $swp1 clsact
+        simple_if_fini $swp1 192.0.2.2/24
+}
+
+mirred_egress_test()
+{
+        local action=$1
+
+        RET=0
+
+        tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags dst_ip 192.0.2.2 action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_fail $? "Matched without redirect rule inserted"
+
+        tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags dst_ip 192.0.2.2 action mirred egress $action \
+                dev $swp2
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_err $? "Did not match incoming $action packet"
+
+        tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
+        tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+
+        log_test "mirred egress $action ($tcflags)"
+}
+
+gact_drop_and_ok_test()
+{
+        RET=0
+
+        tc filter add dev $swp1 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags dst_ip 192.0.2.2 action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $swp1 ingress" 102 1
+        check_err $? "Packet was not dropped"
+
+        tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags dst_ip 192.0.2.2 action ok
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $swp1 ingress" 101 1
+        check_err $? "Did not see passed packet"
+
+        tc_check_packets "dev $swp1 ingress" 102 2
+        check_fail $? "Packet was dropped and it should not reach here"
+
+        tc filter del dev $swp1 ingress protocol ip pref 2 handle 102 flower
+        tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
+
+        log_test "gact drop and ok ($tcflags)"
+}
+
+gact_trap_test()
+{
+        RET=0
+
+        tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
+                skip_hw dst_ip 192.0.2.2 action drop
+        tc filter add dev $swp1 ingress protocol ip pref 3 handle 103 flower \
+                $tcflags dst_ip 192.0.2.2 action mirred egress redirect \
+                dev $swp2
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $swp1 ingress" 101 1
+        check_fail $? "Saw packet without trap rule inserted"
+
+        tc filter add dev $swp1 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags dst_ip 192.0.2.2 action trap
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $swp1 ingress" 102 1
+        check_err $? "Packet was not trapped"
+
+        tc_check_packets "dev $swp1 ingress" 101 1
+        check_err $? "Did not see trapped packet"
+
+        tc filter del dev $swp1 ingress protocol ip pref 3 handle 103 flower
+        tc filter del dev $swp1 ingress protocol ip pref 2 handle 102 flower
+        tc filter del dev $swp1 ingress protocol ip pref 1 handle 101 flower
+
+        log_test "trap ($tcflags)"
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        h1mac=$(mac_get $h1)
+        h2mac=$(mac_get $h2)
+
+        swp1origmac=$(mac_get $swp1)
+        swp2origmac=$(mac_get $swp2)
+        ip link set $swp1 address $h2mac
+        ip link set $swp2 address $h1mac
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+        switch_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        switch_destroy
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+
+        ip link set $swp2 address $swp2origmac
+        ip link set $swp1 address $swp1origmac
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+gact_drop_and_ok_test
+mirred_egress_test "redirect"
+mirred_egress_test "mirror"
+
+tc_offload_check
+if [[ $? -ne 0 ]]; then
+        log_info "Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        gact_drop_and_ok_test
+        mirred_egress_test "redirect"
+        mirred_egress_test "mirror"
+        gact_trap_test
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_chains.sh b/tools/testing/selftests/net/forwarding/tc_chains.sh
new file mode 100755
index 000000000000..2fd15226974b
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/tc_chains.sh
@@ -0,0 +1,122 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=2
+source tc_common.sh
+source lib.sh
+
+tcflags="skip_hw"
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/24
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/24
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.2/24
+        tc qdisc add dev $h2 clsact
+}
+
+h2_destroy()
+{
+        tc qdisc del dev $h2 clsact
+        simple_if_fini $h2 192.0.2.2/24
+}
+
+unreachable_chain_test()
+{
+        RET=0
+
+        tc filter add dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \
+                flower $tcflags dst_mac $h2mac action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 1101 1
+        check_fail $? "matched on filter in unreachable chain"
+
+        tc filter del dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \
+                flower
+
+        log_test "unreachable chain ($tcflags)"
+}
+
+gact_goto_chain_test()
+{
+        RET=0
+
+        tc filter add dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \
+                flower $tcflags dst_mac $h2mac action drop
+        tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags dst_mac $h2mac action drop
+        tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags dst_mac $h2mac action goto chain 1
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 102 1
+        check_fail $? "Matched on a wrong filter"
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_err $? "Did not match on correct filter with goto chain action"
+
+        tc_check_packets "dev $h2 ingress" 1101 1
+        check_err $? "Did not match on correct filter in chain 1"
+
+        tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+        tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
+        tc filter del dev $h2 ingress chain 1 protocol ip pref 1 handle 1101 \
+                flower
+
+        log_test "gact goto chain ($tcflags)"
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        h2=${NETIFS[p2]}
+        h1mac=$(mac_get $h1)
+        h2mac=$(mac_get $h2)
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+unreachable_chain_test
+gact_goto_chain_test
+
+tc_offload_check
+if [[ $? -ne 0 ]]; then
+        log_info "Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        unreachable_chain_test
+        gact_goto_chain_test
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_common.sh b/tools/testing/selftests/net/forwarding/tc_common.sh
new file mode 100644
index 000000000000..9d3b64a2a264
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/tc_common.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+CHECK_TC="yes"
+
+tc_check_packets()
+{
+        local id=$1
+        local handle=$2
+        local count=$3
+        local ret
+
+        output="$(tc -j -s filter show $id)"
+        # workaround the jq bug which causes jq to return 0 in case input is ""
+        ret=$?
+        if [[ $ret -ne 0 ]]; then
+                return $ret
+        fi
+        echo $output | \
+                jq -e ".[] \
+                | select(.options.handle == $handle) \
+                | select(.options.actions[0].stats.packets == $count)" \
+                &> /dev/null
+        return $?
+}
diff --git a/tools/testing/selftests/net/forwarding/tc_flower.sh b/tools/testing/selftests/net/forwarding/tc_flower.sh
new file mode 100755
index 000000000000..032b882adfc0
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/tc_flower.sh
@@ -0,0 +1,196 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=2
+source tc_common.sh
+source lib.sh
+
+tcflags="skip_hw"
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/24 198.51.100.1/24
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/24 198.51.100.1/24
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.2/24 198.51.100.2/24
+        tc qdisc add dev $h2 clsact
+}
+
+h2_destroy()
+{
+        tc qdisc del dev $h2 clsact
+        simple_if_fini $h2 192.0.2.2/24 198.51.100.2/24
+}
+
+match_dst_mac_test()
+{
+        local dummy_mac=de:ad:be:ef:aa:aa
+
+        RET=0
+
+        tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags dst_mac $dummy_mac action drop
+        tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags dst_mac $h2mac action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_fail $? "Matched on a wrong filter"
+
+        tc_check_packets "dev $h2 ingress" 102 1
+        check_err $? "Did not match on correct filter"
+
+        tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+        tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
+
+        log_test "dst_mac match ($tcflags)"
+}
+
+match_src_mac_test()
+{
+        local dummy_mac=de:ad:be:ef:aa:aa
+
+        RET=0
+
+        tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags src_mac $dummy_mac action drop
+        tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags src_mac $h1mac action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_fail $? "Matched on a wrong filter"
+
+        tc_check_packets "dev $h2 ingress" 102 1
+        check_err $? "Did not match on correct filter"
+
+        tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+        tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
+
+        log_test "src_mac match ($tcflags)"
+}
+
+match_dst_ip_test()
+{
+        RET=0
+
+        tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags dst_ip 198.51.100.2 action drop
+        tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags dst_ip 192.0.2.2 action drop
+        tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
+                $tcflags dst_ip 192.0.2.0/24 action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_fail $? "Matched on a wrong filter"
+
+        tc_check_packets "dev $h2 ingress" 102 1
+        check_err $? "Did not match on correct filter"
+
+        tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 103 1
+        check_err $? "Did not match on correct filter with mask"
+
+        tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+        tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
+
+        log_test "dst_ip match ($tcflags)"
+}
+
+match_src_ip_test()
+{
+        RET=0
+
+        tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+                $tcflags src_ip 198.51.100.1 action drop
+        tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
+                $tcflags src_ip 192.0.2.1 action drop
+        tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
+                $tcflags src_ip 192.0.2.0/24 action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 101 1
+        check_fail $? "Matched on a wrong filter"
+
+        tc_check_packets "dev $h2 ingress" 102 1
+        check_err $? "Did not match on correct filter"
+
+        tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "dev $h2 ingress" 103 1
+        check_err $? "Did not match on correct filter with mask"
+
+        tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+        tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
+
+        log_test "src_ip match ($tcflags)"
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        h2=${NETIFS[p2]}
+        h1mac=$(mac_get $h1)
+        h2mac=$(mac_get $h2)
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+match_dst_mac_test
+match_src_mac_test
+match_dst_ip_test
+match_src_ip_test
+
+tc_offload_check
+if [[ $? -ne 0 ]]; then
+        log_info "Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        match_dst_mac_test
+        match_src_mac_test
+        match_dst_ip_test
+        match_src_ip_test
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_shblocks.sh b/tools/testing/selftests/net/forwarding/tc_shblocks.sh
new file mode 100755
index 000000000000..077b98048ef4
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/tc_shblocks.sh
@@ -0,0 +1,122 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+NUM_NETIFS=4
+source tc_common.sh
+source lib.sh
+
+tcflags="skip_hw"
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/24
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/24
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.1/24
+}
+
+h2_destroy()
+{
+        simple_if_fini $h2 192.0.2.1/24
+}
+
+switch_create()
+{
+        simple_if_init $swp1 192.0.2.2/24
+        tc qdisc add dev $swp1 ingress_block 22 egress_block 23 clsact
+
+        simple_if_init $swp2 192.0.2.2/24
+        tc qdisc add dev $swp2 ingress_block 22 egress_block 23 clsact
+}
+
+switch_destroy()
+{
+        tc qdisc del dev $swp2 clsact
+        simple_if_fini $swp2 192.0.2.2/24
+
+        tc qdisc del dev $swp1 clsact
+        simple_if_fini $swp1 192.0.2.2/24
+}
+
+shared_block_test()
+{
+        RET=0
+
+        tc filter add block 22 protocol ip pref 1 handle 101 flower \
+                $tcflags dst_ip 192.0.2.2 action drop
+
+        $MZ $h1 -c 1 -p 64 -a $h1mac -b $swmac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "block 22" 101 1
+        check_err $? "Did not match first incoming packet on a block"
+
+        $MZ $h2 -c 1 -p 64 -a $h2mac -b $swmac -A 192.0.2.1 -B 192.0.2.2 \
+                -t ip -q
+
+        tc_check_packets "block 22" 101 2
+        check_err $? "Did not match second incoming packet on a block"
+
+        tc filter del block 22 protocol ip pref 1 handle 101 flower
+
+        log_test "shared block ($tcflags)"
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        h1mac=$(mac_get $h1)
+        h2mac=$(mac_get $h2)
+
+        swmac=$(mac_get $swp1)
+        swp2origmac=$(mac_get $swp2)
+        ip link set $swp2 address $swmac
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+        switch_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        switch_destroy
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+
+        ip link set $swp2 address $swp2origmac
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+shared_block_test
+
+tc_offload_check
+if [[ $? -ne 0 ]]; then
+        log_info "Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        shared_block_test
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/in_netns.sh b/tools/testing/selftests/net/in_netns.sh
new file mode 100755
index 000000000000..88795b510b32
--- /dev/null
+++ b/tools/testing/selftests/net/in_netns.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+#
+# Execute a subprocess in a network namespace
+
+set -e
+
+readonly NETNS="ns-$(mktemp -u XXXXXX)"
+
+setup() {
+        ip netns add "${NETNS}"
+        ip -netns "${NETNS}" link set lo up
+}
+
+cleanup() {
+        ip netns del "${NETNS}"
+}
+
+trap cleanup EXIT
+setup
+
+ip netns exec "${NETNS}" "$@"
+exit "$?"
diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
index e11fe84de0fd..406cc70c571d 100644
--- a/tools/testing/selftests/net/msg_zerocopy.c
+++ b/tools/testing/selftests/net/msg_zerocopy.c
@@ -14,6 +14,9 @@
  * - SOCK_DGRAM
  * - SOCK_RAW
  *
+ * PF_RDS
+ * - SOCK_SEQPACKET
+ *
  * Start this program on two connected hosts, one in send mode and
  * the other with option '-r' to put it in receiver mode.
  *
@@ -53,6 +56,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
+#include <linux/rds.h>
 
 #ifndef SO_EE_ORIGIN_ZEROCOPY
 #define SO_EE_ORIGIN_ZEROCOPY           5
@@ -164,17 +168,39 @@ static int do_accept(int fd)
         return fd;
 }
 
-static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy)
+static void add_zcopy_cookie(struct msghdr *msg, uint32_t cookie)
+{
+        struct cmsghdr *cm;
+
+        if (!msg->msg_control)
+                error(1, errno, "NULL cookie");
+        cm = (void *)msg->msg_control;
+        cm->cmsg_len = CMSG_LEN(sizeof(cookie));
+        cm->cmsg_level = SOL_RDS;
+        cm->cmsg_type = RDS_CMSG_ZCOPY_COOKIE;
+        memcpy(CMSG_DATA(cm), &cookie, sizeof(cookie));
+}
+
+static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy, int domain)
 {
         int ret, len, i, flags;
+        static uint32_t cookie;
+        char ckbuf[CMSG_SPACE(sizeof(cookie))];
 
         len = 0;
         for (i = 0; i < msg->msg_iovlen; i++)
                 len += msg->msg_iov[i].iov_len;
 
         flags = MSG_DONTWAIT;
-        if (do_zerocopy)
+        if (do_zerocopy) {
                 flags |= MSG_ZEROCOPY;
+                if (domain == PF_RDS) {
+                        memset(&msg->msg_control, 0, sizeof(msg->msg_control));
+                        msg->msg_controllen = CMSG_SPACE(sizeof(cookie));
+                        msg->msg_control = (struct cmsghdr *)ckbuf;
+                        add_zcopy_cookie(msg, ++cookie);
+                }
+        }
 
         ret = sendmsg(fd, msg, flags);
         if (ret == -1 && errno == EAGAIN)
@@ -190,6 +216,10 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy)
                 if (do_zerocopy && ret)
                         expected_completions++;
         }
+        if (do_zerocopy && domain == PF_RDS) {
+                msg->msg_control = NULL;
+                msg->msg_controllen = 0;
+        }
 
         return true;
 }
@@ -216,7 +246,9 @@ static void do_sendmsg_corked(int fd, struct msghdr *msg)
                 msg->msg_iov[0].iov_len = payload_len + extra_len;
                 extra_len = 0;
 
-                do_sendmsg(fd, msg, do_zerocopy);
+                do_sendmsg(fd, msg, do_zerocopy,
+                           (cfg_dst_addr.ss_family == AF_INET ?
+                            PF_INET : PF_INET6));
         }
 
         do_setsockopt(fd, IPPROTO_UDP, UDP_CORK, 0);
@@ -300,14 +332,65 @@ static int do_setup_tx(int domain, int type, int protocol)
         if (cfg_zerocopy)
                 do_setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, 1);
 
-        if (domain != PF_PACKET)
+        if (domain != PF_PACKET && domain != PF_RDS)
                 if (connect(fd, (void *) &cfg_dst_addr, cfg_alen))
                         error(1, errno, "connect");
 
+        if (domain == PF_RDS) {
+                if (bind(fd, (void *) &cfg_src_addr, cfg_alen))
+                        error(1, errno, "bind");
+        }
+
         return fd;
 }
 
-static bool do_recv_completion(int fd)
+static uint32_t do_process_zerocopy_cookies(struct rds_zcopy_cookies *ck)
+{
+        int i;
+
+        if (ck->num > RDS_MAX_ZCOOKIES)
+                error(1, 0, "Returned %d cookies, max expected %d\n",
+                      ck->num, RDS_MAX_ZCOOKIES);
+        for (i = 0; i < ck->num; i++)
+                if (cfg_verbose >= 2)
+                        fprintf(stderr, "%d\n", ck->cookies[i]);
+        return ck->num;
+}
+
+static bool do_recvmsg_completion(int fd)
+{
+        char cmsgbuf[CMSG_SPACE(sizeof(struct rds_zcopy_cookies))];
+        struct rds_zcopy_cookies *ck;
+        struct cmsghdr *cmsg;
+        struct msghdr msg;
+        bool ret = false;
+
+        memset(&msg, 0, sizeof(msg));
+        msg.msg_control = cmsgbuf;
+        msg.msg_controllen = sizeof(cmsgbuf);
+
+        if (recvmsg(fd, &msg, MSG_DONTWAIT))
+                return ret;
+
+        if (msg.msg_flags & MSG_CTRUNC)
+                error(1, errno, "recvmsg notification: truncated");
+
+        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+                if (cmsg->cmsg_level == SOL_RDS &&
+                    cmsg->cmsg_type == RDS_CMSG_ZCOPY_COMPLETION) {
+
+                        ck = (struct rds_zcopy_cookies *)CMSG_DATA(cmsg);
+                        completions += do_process_zerocopy_cookies(ck);
+                        ret = true;
+                        break;
+                }
+                error(0, 0, "ignoring cmsg at level %d type %d\n",
+                            cmsg->cmsg_level, cmsg->cmsg_type);
+        }
+        return ret;
+}
+
+static bool do_recv_completion(int fd, int domain)
 {
         struct sock_extended_err *serr;
         struct msghdr msg = {};
@@ -316,6 +399,9 @@ static bool do_recv_completion(int fd)
         int ret, zerocopy;
         char control[100];
 
+        if (domain == PF_RDS)
+                return do_recvmsg_completion(fd);
+
         msg.msg_control = control;
         msg.msg_controllen = sizeof(control);
 
@@ -337,6 +423,7 @@ static bool do_recv_completion(int fd)
                       cm->cmsg_level, cm->cmsg_type);
 
         serr = (void *) CMSG_DATA(cm);
+
         if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY)
                 error(1, 0, "serr: wrong origin: %u", serr->ee_origin);
         if (serr->ee_errno != 0)
@@ -371,20 +458,20 @@ static bool do_recv_completion(int fd)
 }
 
 /* Read all outstanding messages on the errqueue */
-static void do_recv_completions(int fd)
+static void do_recv_completions(int fd, int domain)
 {
-        while (do_recv_completion(fd)) {}
+        while (do_recv_completion(fd, domain)) {}
 }
 
 /* Wait for all remaining completions on the errqueue */
-static void do_recv_remaining_completions(int fd)
+static void do_recv_remaining_completions(int fd, int domain)
 {
         int64_t tstop = gettimeofday_ms() + cfg_waittime_ms;
 
         while (completions < expected_completions &&
                gettimeofday_ms() < tstop) {
-                if (do_poll(fd, POLLERR))
-                        do_recv_completions(fd);
+                if (do_poll(fd, domain == PF_RDS ? POLLIN : POLLERR))
+                        do_recv_completions(fd, domain);
         }
 
         if (completions < expected_completions)
@@ -444,6 +531,13 @@ static void do_tx(int domain, int type, int protocol)
                 msg.msg_iovlen++;
         }
 
+        if (domain == PF_RDS) {
+                msg.msg_name = &cfg_dst_addr;
+                msg.msg_namelen =  (cfg_dst_addr.ss_family == AF_INET ?
+                                    sizeof(struct sockaddr_in) :
+                                    sizeof(struct sockaddr_in6));
+        }
+
         iov[2].iov_base = payload;
         iov[2].iov_len = cfg_payload_len;
         msg.msg_iovlen++;
@@ -454,17 +548,17 @@ static void do_tx(int domain, int type, int protocol)
                 if (cfg_cork)
                         do_sendmsg_corked(fd, &msg);
                 else
-                        do_sendmsg(fd, &msg, cfg_zerocopy);
+                        do_sendmsg(fd, &msg, cfg_zerocopy, domain);
 
                 while (!do_poll(fd, POLLOUT)) {
                         if (cfg_zerocopy)
-                                do_recv_completions(fd);
+                                do_recv_completions(fd, domain);
                 }
 
         } while (gettimeofday_ms() < tstop);
 
         if (cfg_zerocopy)
-                do_recv_remaining_completions(fd);
+                do_recv_remaining_completions(fd, domain);
 
         if (close(fd))
                 error(1, errno, "close");
@@ -610,6 +704,7 @@ static void parse_opts(int argc, char **argv)
                                     40 /* max tcp options */;
         int c;
         char *daddr = NULL, *saddr = NULL;
+        char *cfg_test;
 
         cfg_payload_len = max_payload_len;
 
@@ -667,6 +762,14 @@ static void parse_opts(int argc, char **argv)
                         break;
                 }
         }
+
+        cfg_test = argv[argc - 1];
+        if (strcmp(cfg_test, "rds") == 0) {
+                if (!daddr)
+                        error(1, 0, "-D <server addr> required for PF_RDS\n");
+                if (!cfg_rx && !saddr)
+                        error(1, 0, "-S <client addr> required for PF_RDS\n");
+        }
         setup_sockaddr(cfg_family, daddr, &cfg_dst_addr);
         setup_sockaddr(cfg_family, saddr, &cfg_src_addr);
 
@@ -699,6 +802,8 @@ int main(int argc, char **argv)
                 do_test(cfg_family, SOCK_STREAM, 0);
         else if (!strcmp(cfg_test, "udp"))
                 do_test(cfg_family, SOCK_DGRAM, 0);
+        else if (!strcmp(cfg_test, "rds"))
+                do_test(PF_RDS, SOCK_SEQPACKET, 0);
         else
                 error(1, 0, "unknown cfg_test %s", cfg_test);
 
diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
new file mode 100755
index 000000000000..1e428781a625
--- /dev/null
+++ b/tools/testing/selftests/net/pmtu.sh
@@ -0,0 +1,471 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+#
+# Check that route PMTU values match expectations, and that initial device MTU
+# values are assigned correctly
+#
+# Tests currently implemented:
+#
+# - pmtu_vti4_exception
+#       Set up vti tunnel on top of veth, with xfrm states and policies, in two
+#       namespaces with matching endpoints. Check that route exception is not
+#       created if link layer MTU is not exceeded, then exceed it and check that
+#       exception is created with the expected PMTU. The approach described
+#       below for IPv6 doesn't apply here, because, on IPv4, administrative MTU
+#       changes alone won't affect PMTU
+#
+# - pmtu_vti6_exception
+#       Set up vti6 tunnel on top of veth, with xfrm states and policies, in two
+#       namespaces with matching endpoints. Check that route exception is
+#       created by exceeding link layer MTU with ping to other endpoint. Then
+#       decrease and increase MTU of tunnel, checking that route exception PMTU
+#       changes accordingly
+#
+# - pmtu_vti4_default_mtu
+#       Set up vti4 tunnel on top of veth, in two namespaces with matching
+#       endpoints. Check that MTU assigned to vti interface is the MTU of the
+#       lower layer (veth) minus additional lower layer headers (zero, for veth)
+#       minus IPv4 header length
+#
+# - pmtu_vti6_default_mtu
+#       Same as above, for IPv6
+#
+# - pmtu_vti4_link_add_mtu
+#       Set up vti4 interface passing MTU value at link creation, check MTU is
+#       configured, and that link is not created with invalid MTU values
+#
+# - pmtu_vti6_link_add_mtu
+#       Same as above, for IPv6
+#
+# - pmtu_vti6_link_change_mtu
+#       Set up two dummy interfaces with different MTUs, create a vti6 tunnel
+#       and check that configured MTU is used on link creation and changes, and
+#       that MTU is properly calculated instead when MTU is not configured from
+#       userspace
+
+tests="
+        pmtu_vti6_exception             vti6: PMTU exceptions
+        pmtu_vti4_exception             vti4: PMTU exceptions
+        pmtu_vti4_default_mtu           vti4: default MTU assignment
+        pmtu_vti6_default_mtu           vti6: default MTU assignment
+        pmtu_vti4_link_add_mtu          vti4: MTU setting on link creation
+        pmtu_vti6_link_add_mtu          vti6: MTU setting on link creation
+        pmtu_vti6_link_change_mtu       vti6: MTU changes on link changes"
+
+NS_A="ns-$(mktemp -u XXXXXX)"
+NS_B="ns-$(mktemp -u XXXXXX)"
+ns_a="ip netns exec ${NS_A}"
+ns_b="ip netns exec ${NS_B}"
+
+veth4_a_addr="192.168.1.1"
+veth4_b_addr="192.168.1.2"
+veth4_mask="24"
+veth6_a_addr="fd00:1::a"
+veth6_b_addr="fd00:1::b"
+veth6_mask="64"
+
+vti4_a_addr="192.168.2.1"
+vti4_b_addr="192.168.2.2"
+vti4_mask="24"
+vti6_a_addr="fd00:2::a"
+vti6_b_addr="fd00:2::b"
+vti6_mask="64"
+
+dummy6_0_addr="fc00:1000::0"
+dummy6_1_addr="fc00:1001::0"
+dummy6_mask="64"
+
+cleanup_done=1
+err_buf=
+
+err() {
+        err_buf="${err_buf}${1}
+"
+}
+
+err_flush() {
+        echo -n "${err_buf}"
+        err_buf=
+}
+
+setup_namespaces() {
+        ip netns add ${NS_A} || return 1
+        ip netns add ${NS_B}
+}
+
+setup_veth() {
+        ${ns_a} ip link add veth_a type veth peer name veth_b || return 1
+        ${ns_a} ip link set veth_b netns ${NS_B}
+
+        ${ns_a} ip addr add ${veth4_a_addr}/${veth4_mask} dev veth_a
+        ${ns_b} ip addr add ${veth4_b_addr}/${veth4_mask} dev veth_b
+
+        ${ns_a} ip addr add ${veth6_a_addr}/${veth6_mask} dev veth_a
+        ${ns_b} ip addr add ${veth6_b_addr}/${veth6_mask} dev veth_b
+
+        ${ns_a} ip link set veth_a up
+        ${ns_b} ip link set veth_b up
+}
+
+setup_vti() {
+        proto=${1}
+        veth_a_addr="${2}"
+        veth_b_addr="${3}"
+        vti_a_addr="${4}"
+        vti_b_addr="${5}"
+        vti_mask=${6}
+
+        [ ${proto} -eq 6 ] && vti_type="vti6" || vti_type="vti"
+
+        ${ns_a} ip link add vti${proto}_a type ${vti_type} local ${veth_a_addr} remote ${veth_b_addr} key 10 || return 1
+        ${ns_b} ip link add vti${proto}_b type ${vti_type} local ${veth_b_addr} remote ${veth_a_addr} key 10
+
+        ${ns_a} ip addr add ${vti_a_addr}/${vti_mask} dev vti${proto}_a
+        ${ns_b} ip addr add ${vti_b_addr}/${vti_mask} dev vti${proto}_b
+
+        ${ns_a} ip link set vti${proto}_a up
+        ${ns_b} ip link set vti${proto}_b up
+
+        sleep 1
+}
+
+setup_vti4() {
+        setup_vti 4 ${veth4_a_addr} ${veth4_b_addr} ${vti4_a_addr} ${vti4_b_addr} ${vti4_mask}
+}
+
+setup_vti6() {
+        setup_vti 6 ${veth6_a_addr} ${veth6_b_addr} ${vti6_a_addr} ${vti6_b_addr} ${vti6_mask}
+}
+
+setup_xfrm() {
+        proto=${1}
+        veth_a_addr="${2}"
+        veth_b_addr="${3}"
+
+        ${ns_a} ip -${proto} xfrm state add src ${veth_a_addr} dst ${veth_b_addr} spi 0x1000 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel || return 1
+        ${ns_a} ip -${proto} xfrm state add src ${veth_b_addr} dst ${veth_a_addr} spi 0x1001 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
+        ${ns_a} ip -${proto} xfrm policy add dir out mark 10 tmpl src ${veth_a_addr} dst ${veth_b_addr} proto esp mode tunnel
+        ${ns_a} ip -${proto} xfrm policy add dir in mark 10 tmpl src ${veth_b_addr} dst ${veth_a_addr} proto esp mode tunnel
+
+        ${ns_b} ip -${proto} xfrm state add src ${veth_a_addr} dst ${veth_b_addr} spi 0x1000 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
+        ${ns_b} ip -${proto} xfrm state add src ${veth_b_addr} dst ${veth_a_addr} spi 0x1001 proto esp aead "rfc4106(gcm(aes))" 0x0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f 128 mode tunnel
+        ${ns_b} ip -${proto} xfrm policy add dir out mark 10 tmpl src ${veth_b_addr} dst ${veth_a_addr} proto esp mode tunnel
+        ${ns_b} ip -${proto} xfrm policy add dir in mark 10 tmpl src ${veth_a_addr} dst ${veth_b_addr} proto esp mode tunnel
+}
+
+setup_xfrm4() {
+        setup_xfrm 4 ${veth4_a_addr} ${veth4_b_addr}
+}
+
+setup_xfrm6() {
+        setup_xfrm 6 ${veth6_a_addr} ${veth6_b_addr}
+}
+
+setup() {
+        [ "$(id -u)" -ne 0 ] && echo "  need to run as root" && return 1
+
+        cleanup_done=0
+        for arg do
+                eval setup_${arg} || { echo "  ${arg} not supported"; return 1; }
+        done
+}
+
+cleanup() {
+        [ ${cleanup_done} -eq 1 ] && return
+        ip netns del ${NS_A} 2 > /dev/null
+        ip netns del ${NS_B} 2 > /dev/null
+        cleanup_done=1
+}
+
+mtu() {
+        ns_cmd="${1}"
+        dev="${2}"
+        mtu="${3}"
+
+        ${ns_cmd} ip link set dev ${dev} mtu ${mtu}
+}
+
+mtu_parse() {
+        input="${1}"
+
+        next=0
+        for i in ${input}; do
+                [ ${next} -eq 1 ] && echo "${i}" && return
+                [ "${i}" = "mtu" ] && next=1
+        done
+}
+
+link_get() {
+        ns_cmd="${1}"
+        name="${2}"
+
+        ${ns_cmd} ip link show dev "${name}"
+}
+
+link_get_mtu() {
+        ns_cmd="${1}"
+        name="${2}"
+
+        mtu_parse "$(link_get "${ns_cmd}" ${name})"
+}
+
+route_get_dst_exception() {
+        ns_cmd="${1}"
+        dst="${2}"
+
+        ${ns_cmd} ip route get "${dst}"
+}
+
+route_get_dst_pmtu_from_exception() {
+        ns_cmd="${1}"
+        dst="${2}"
+
+        mtu_parse "$(route_get_dst_exception "${ns_cmd}" ${dst})"
+}
+
+test_pmtu_vti4_exception() {
+        setup namespaces veth vti4 xfrm4 || return 2
+
+        veth_mtu=1500
+        vti_mtu=$((veth_mtu - 20))
+
+        #                                SPI   SN   IV  ICV   pad length   next header
+        esp_payload_rfc4106=$((vti_mtu - 4   - 4  - 8 - 16  - 1          - 1))
+        ping_payload=$((esp_payload_rfc4106 - 28))
+
+        mtu "${ns_a}" veth_a ${veth_mtu}
+        mtu "${ns_b}" veth_b ${veth_mtu}
+        mtu "${ns_a}" vti4_a ${vti_mtu}
+        mtu "${ns_b}" vti4_b ${vti_mtu}
+
+        # Send DF packet without exceeding link layer MTU, check that no
+        # exception is created
+        ${ns_a} ping -q -M want -i 0.1 -w 2 -s ${ping_payload} ${vti4_b_addr} > /dev/null
+        pmtu="$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti4_b_addr})"
+        if [ "${pmtu}" != "" ]; then
+                err "  unexpected exception created with PMTU ${pmtu} for IP payload length ${esp_payload_rfc4106}"
+                return 1
+        fi
+
+        # Now exceed link layer MTU by one byte, check that exception is created
+        ${ns_a} ping -q -M want -i 0.1 -w 2 -s $((ping_payload + 1)) ${vti4_b_addr} > /dev/null
+        pmtu="$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti4_b_addr})"
+        if [ "${pmtu}" = "" ]; then
+                err "  exception not created for IP payload length $((esp_payload_rfc4106 + 1))"
+                return 1
+        fi
+
+        # ...with the right PMTU value
+        if [ ${pmtu} -ne ${esp_payload_rfc4106} ]; then
+                err "  wrong PMTU ${pmtu} in exception, expected: ${esp_payload_rfc4106}"
+                return 1
+        fi
+}
+
+test_pmtu_vti6_exception() {
+        setup namespaces veth vti6 xfrm6 || return 2
+        fail=0
+
+        # Create route exception by exceeding link layer MTU
+        mtu "${ns_a}" veth_a 4000
+        mtu "${ns_b}" veth_b 4000
+        mtu "${ns_a}" vti6_a 5000
+        mtu "${ns_b}" vti6_b 5000
+        ${ns_a} ping6 -q -i 0.1 -w 2 -s 60000 ${vti6_b_addr} > /dev/null
+
+        # Check that exception was created
+        if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" = "" ]; then
+                err "  tunnel exceeding link layer MTU didn't create route exception"
+                return 1
+        fi
+
+        # Decrease tunnel MTU, check for PMTU decrease in route exception
+        mtu "${ns_a}" vti6_a 3000
+
+        if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" -ne 3000 ]; then
+                err "  decreasing tunnel MTU didn't decrease route exception PMTU"
+                fail=1
+        fi
+
+        # Increase tunnel MTU, check for PMTU increase in route exception
+        mtu "${ns_a}" vti6_a 9000
+        if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" -ne 9000 ]; then
+                err "  increasing tunnel MTU didn't increase route exception PMTU"
+                fail=1
+        fi
+
+        return ${fail}
+}
+
+test_pmtu_vti4_default_mtu() {
+        setup namespaces veth vti4 || return 2
+
+        # Check that MTU of vti device is MTU of veth minus IPv4 header length
+        veth_mtu="$(link_get_mtu "${ns_a}" veth_a)"
+        vti4_mtu="$(link_get_mtu "${ns_a}" vti4_a)"
+        if [ $((veth_mtu - vti4_mtu)) -ne 20 ]; then
+                err "  vti MTU ${vti4_mtu} is not veth MTU ${veth_mtu} minus IPv4 header length"
+                return 1
+        fi
+}
+
+test_pmtu_vti6_default_mtu() {
+        setup namespaces veth vti6 || return 2
+
+        # Check that MTU of vti device is MTU of veth minus IPv6 header length
+        veth_mtu="$(link_get_mtu "${ns_a}" veth_a)"
+        vti6_mtu="$(link_get_mtu "${ns_a}" vti6_a)"
+        if [ $((veth_mtu - vti6_mtu)) -ne 40 ]; then
+                err "  vti MTU ${vti6_mtu} is not veth MTU ${veth_mtu} minus IPv6 header length"
+                return 1
+        fi
+}
+
+test_pmtu_vti4_link_add_mtu() {
+        setup namespaces || return 2
+
+        ${ns_a} ip link add vti4_a type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10
+        [ $? -ne 0 ] && err "  vti not supported" && return 2
+        ${ns_a} ip link del vti4_a
+
+        fail=0
+
+        min=68
+        max=$((65528 - 20))
+        # Check invalid values first
+        for v in $((min - 1)) $((max + 1)); do
+                ${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10 2>/dev/null
+                # This can fail, or MTU can be adjusted to a proper value
+                [ $? -ne 0 ] && continue
+                mtu="$(link_get_mtu "${ns_a}" vti4_a)"
+                if [ ${mtu} -lt ${min} -o ${mtu} -gt ${max} ]; then
+                        err "  vti tunnel created with invalid MTU ${mtu}"
+                        fail=1
+                fi
+                ${ns_a} ip link del vti4_a
+        done
+
+        # Now check valid values
+        for v in ${min} 1300 ${max}; do
+                ${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10
+                mtu="$(link_get_mtu "${ns_a}" vti4_a)"
+                ${ns_a} ip link del vti4_a
+                if [ "${mtu}" != "${v}" ]; then
+                        err "  vti MTU ${mtu} doesn't match configured value ${v}"
+                        fail=1
+                fi
+        done
+
+        return ${fail}
+}
+
+test_pmtu_vti6_link_add_mtu() {
+        setup namespaces || return 2
+
+        ${ns_a} ip link add vti6_a type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
+        [ $? -ne 0 ] && err "  vti6 not supported" && return 2
+        ${ns_a} ip link del vti6_a
+
+        fail=0
+
+        min=1280
+        max=$((65535 - 40))
+        # Check invalid values first
+        for v in $((min - 1)) $((max + 1)); do
+                ${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10 2>/dev/null
+                # This can fail, or MTU can be adjusted to a proper value
+                [ $? -ne 0 ] && continue
+                mtu="$(link_get_mtu "${ns_a}" vti6_a)"
+                if [ ${mtu} -lt ${min} -o ${mtu} -gt ${max} ]; then
+                        err "  vti6 tunnel created with invalid MTU ${v}"
+                        fail=1
+                fi
+                ${ns_a} ip link del vti6_a
+        done
+
+        # Now check valid values
+        for v in 1280 1300 $((65535 - 40)); do
+                ${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
+                mtu="$(link_get_mtu "${ns_a}" vti6_a)"
+                ${ns_a} ip link del vti6_a
+                if [ "${mtu}" != "${v}" ]; then
+                        err "  vti6 MTU ${mtu} doesn't match configured value ${v}"
+                        fail=1
+                fi
+        done
+
+        return ${fail}
+}
+
+test_pmtu_vti6_link_change_mtu() {
+        setup namespaces || return 2
+
+        ${ns_a} ip link add dummy0 mtu 1500 type dummy
+        [ $? -ne 0 ] && err "  dummy not supported" && return 2
+        ${ns_a} ip link add dummy1 mtu 3000 type dummy
+        ${ns_a} ip link set dummy0 up
+        ${ns_a} ip link set dummy1 up
+
+        ${ns_a} ip addr add ${dummy6_0_addr}/${dummy6_mask} dev dummy0
+        ${ns_a} ip addr add ${dummy6_1_addr}/${dummy6_mask} dev dummy1
+
+        fail=0
+
+        # Create vti6 interface bound to device, passing MTU, check it
+        ${ns_a} ip link add vti6_a mtu 1300 type vti6 remote ${dummy6_0_addr} local ${dummy6_0_addr}
+        mtu="$(link_get_mtu "${ns_a}" vti6_a)"
+        if [ ${mtu} -ne 1300 ]; then
+                err "  vti6 MTU ${mtu} doesn't match configured value 1300"
+                fail=1
+        fi
+
+        # Move to another device with different MTU, without passing MTU, check
+        # MTU is adjusted
+        ${ns_a} ip link set vti6_a type vti6 remote ${dummy6_1_addr} local ${dummy6_1_addr}
+        mtu="$(link_get_mtu "${ns_a}" vti6_a)"
+        if [ ${mtu} -ne $((3000 - 40)) ]; then
+                err "  vti MTU ${mtu} is not dummy MTU 3000 minus IPv6 header length"
+                fail=1
+        fi
+
+        # Move it back, passing MTU, check MTU is not overridden
+        ${ns_a} ip link set vti6_a mtu 1280 type vti6 remote ${dummy6_0_addr} local ${dummy6_0_addr}
+        mtu="$(link_get_mtu "${ns_a}" vti6_a)"
+        if [ ${mtu} -ne 1280 ]; then
+                err "  vti6 MTU ${mtu} doesn't match configured value 1280"
+                fail=1
+        fi
+
+        return ${fail}
+}
+
+trap cleanup EXIT
+
+exitcode=0
+desc=0
+IFS="   
+"
+for t in ${tests}; do
+        [ $desc -eq 0 ] && name="${t}" && desc=1 && continue || desc=0
+
+        (
+                unset IFS
+                eval test_${name}
+                ret=$?
+                cleanup
+
+                if [ $ret -eq 0 ]; then
+                        printf "TEST: %-60s  [ OK ]\n" "${t}"
+                elif [ $ret -eq 1 ]; then
+                        printf "TEST: %-60s  [FAIL]\n" "${t}"
+                        err_flush
+                        exit 1
+                elif [ $ret -eq 2 ]; then
+                        printf "TEST: %-60s  [SKIP]\n" "${t}"
+                        err_flush
+                fi
+        )
+        [ $? -ne 0 ] && exitcode=1
+done
+
+exit ${exitcode}
diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 989f917068d1..bd9b9632c72b 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -50,6 +50,7 @@
 #include <linux/filter.h>
 #include <linux/bpf.h>
 #include <linux/if_packet.h>
+#include <net/if.h>
 #include <net/ethernet.h>
 #include <netinet/ip.h>
 #include <netinet/udp.h>
@@ -73,14 +74,29 @@
  * @return -1 if mode is bad, a valid socket otherwise */
 static int sock_fanout_open(uint16_t typeflags, uint16_t group_id)
 {
+        struct sockaddr_ll addr = {0};
         int fd, val;
 
-        fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP));
+        fd = socket(PF_PACKET, SOCK_RAW, 0);
         if (fd < 0) {
                 perror("socket packet");
                 exit(1);
         }
 
+        pair_udp_setfilter(fd);
+
+        addr.sll_family = AF_PACKET;
+        addr.sll_protocol = htons(ETH_P_IP);
+        addr.sll_ifindex = if_nametoindex("lo");
+        if (addr.sll_ifindex == 0) {
+                perror("if_nametoindex");
+                exit(1);
+        }
+        if (bind(fd, (void *) &addr, sizeof(addr))) {
+                perror("bind packet");
+                exit(1);
+        }
+
         val = (((int) typeflags) << 16) | group_id;
         if (setsockopt(fd, SOL_PACKET, PACKET_FANOUT, &val, sizeof(val))) {
                 if (close(fd)) {
@@ -90,7 +106,6 @@ static int sock_fanout_open(uint16_t typeflags, uint16_t group_id)
                 return -1;
         }
 
-        pair_udp_setfilter(fd);
         return fd;
 }
 
@@ -128,6 +143,8 @@ static void sock_fanout_getopts(int fd, uint16_t *typeflags, uint16_t *group_id)
 
 static void sock_fanout_set_ebpf(int fd)
 {
+        static char log_buf[65536];
+
         const int len_off = __builtin_offsetof(struct __sk_buff, len);
         struct bpf_insn prog[] = {
                 { BPF_ALU64 | BPF_MOV | BPF_X,   6, 1, 0, 0 },
@@ -140,7 +157,6 @@ static void sock_fanout_set_ebpf(int fd)
                 { BPF_ALU   | BPF_MOV | BPF_K,   0, 0, 0, 0 },
                 { BPF_JMP   | BPF_EXIT,          0, 0, 0, 0 }
         };
-        char log_buf[512];
         union bpf_attr attr;
         int pfd;
 
@@ -228,7 +244,7 @@ static int sock_fanout_read(int fds[], char *rings[], const int expect[])
 
         if ((!(ret[0] == expect[0] && ret[1] == expect[1])) &&
             (!(ret[0] == expect[1] && ret[1] == expect[0]))) {
-                fprintf(stderr, "ERROR: incorrect queue lengths\n");
+                fprintf(stderr, "warning: incorrect queue lengths\n");
                 return 1;
         }
 
@@ -347,7 +363,8 @@ static int test_datapath(uint16_t typeflags, int port_off,
         uint8_t type = typeflags & 0xFF;
         int fds[2], fds_udp[2][2], ret;
 
-        fprintf(stderr, "test: datapath 0x%hx\n", typeflags);
+        fprintf(stderr, "\ntest: datapath 0x%hx ports %hu,%hu\n",
+                typeflags, PORT_BASE, PORT_BASE + port_off);
 
         fds[0] = sock_fanout_open(typeflags, 0);
         fds[1] = sock_fanout_open(typeflags, 0);
@@ -418,7 +435,7 @@ int main(int argc, char **argv)
         const int expect_cpu1[2][2]     = { { 0, 20 },  { 0, 20 } };
         const int expect_bpf[2][2]      = { { 15, 5 },  { 15, 20 } };
         const int expect_uniqueid[2][2] = { { 20, 20},  { 20, 20 } };
-        int port_off = 2, tries = 5, ret;
+        int port_off = 2, tries = 20, ret;
 
         test_control_single();
         test_control_group();
@@ -427,10 +444,14 @@ int main(int argc, char **argv)
         /* find a set of ports that do not collide onto the same socket */
         ret = test_datapath(PACKET_FANOUT_HASH, port_off,
                             expect_hash[0], expect_hash[1]);
-        while (ret && tries--) {
+        while (ret) {
                 fprintf(stderr, "info: trying alternate ports (%d)\n", tries);
                 ret = test_datapath(PACKET_FANOUT_HASH, ++port_off,
                                     expect_hash[0], expect_hash[1]);
+                if (!--tries) {
+                        fprintf(stderr, "too many collisions\n");
+                        return 1;
+                }
         }
 
         ret |= test_datapath(PACKET_FANOUT_HASH | PACKET_FANOUT_FLAG_ROLLOVER,
diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
index a622eeecc3a6..e6f485235435 100755
--- a/tools/testing/selftests/net/rtnetlink.sh
+++ b/tools/testing/selftests/net/rtnetlink.sh
@@ -517,6 +517,7 @@ kci_test_gretap()
         ip link help gretap 2>&1 | grep -q "^Usage:"
         if [ $? -ne 0 ];then
                 echo "SKIP: gretap: iproute2 too old"
+                ip netns del "$testns"
                 return 1
         fi
 
@@ -543,6 +544,7 @@ kci_test_gretap()
 
         if [ $ret -ne 0 ]; then
                 echo "FAIL: gretap"
+                ip netns del "$testns"
                 return 1
         fi
         echo "PASS: gretap"
@@ -565,6 +567,7 @@ kci_test_ip6gretap()
         ip link help ip6gretap 2>&1 | grep -q "^Usage:"
         if [ $? -ne 0 ];then
                 echo "SKIP: ip6gretap: iproute2 too old"
+                ip netns del "$testns"
                 return 1
         fi
 
@@ -591,6 +594,7 @@ kci_test_ip6gretap()
 
         if [ $ret -ne 0 ]; then
                 echo "FAIL: ip6gretap"
+                ip netns del "$testns"
                 return 1
         fi
         echo "PASS: ip6gretap"
@@ -655,6 +659,7 @@ kci_test_erspan()
 
         if [ $ret -ne 0 ]; then
                 echo "FAIL: erspan"
+                ip netns del "$testns"
                 return 1
         fi
         echo "PASS: erspan"
@@ -720,6 +725,7 @@ kci_test_ip6erspan()
 
         if [ $ret -ne 0 ]; then
                 echo "FAIL: ip6erspan"
+                ip netns del "$testns"
                 return 1
         fi
         echo "PASS: ip6erspan"
diff --git a/tools/testing/selftests/net/run_afpackettests b/tools/testing/selftests/net/run_afpackettests
index 21fe149e3de1..bea079edc278 100755
--- a/tools/testing/selftests/net/run_afpackettests
+++ b/tools/testing/selftests/net/run_afpackettests
@@ -9,7 +9,7 @@ fi
 echo "--------------------"
 echo "running psock_fanout test"
 echo "--------------------"
-./psock_fanout
+./in_netns.sh ./psock_fanout
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
 else
@@ -19,7 +19,7 @@ fi
 echo "--------------------"
 echo "running psock_tpacket test"
 echo "--------------------"
-./psock_tpacket
+./in_netns.sh ./psock_tpacket
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
 else
diff --git a/tools/testing/selftests/networking/timestamping/txtimestamp.c b/tools/testing/selftests/networking/timestamping/txtimestamp.c
index 5df07047ca86..81a98a240456 100644
--- a/tools/testing/selftests/networking/timestamping/txtimestamp.c
+++ b/tools/testing/selftests/networking/timestamping/txtimestamp.c
@@ -68,9 +68,11 @@ static int cfg_num_pkts = 4;
 static int do_ipv4 = 1;
 static int do_ipv6 = 1;
 static int cfg_payload_len = 10;
+static int cfg_poll_timeout = 100;
 static bool cfg_show_payload;
 static bool cfg_do_pktinfo;
 static bool cfg_loop_nodata;
+static bool cfg_no_delay;
 static uint16_t dest_port = 9000;
 
 static struct sockaddr_in daddr;
@@ -171,7 +173,7 @@ static void __poll(int fd)
 
         memset(&pollfd, 0, sizeof(pollfd));
         pollfd.fd = fd;
-        ret = poll(&pollfd, 1, 100);
+        ret = poll(&pollfd, 1, cfg_poll_timeout);
         if (ret != 1)
                 error(1, errno, "poll");
 }
@@ -371,7 +373,8 @@ static void do_test(int family, unsigned int opt)
                         error(1, errno, "send");
 
                 /* wait for all errors to be queued, else ACKs arrive OOO */
-                usleep(50 * 1000);
+                if (!cfg_no_delay)
+                        usleep(50 * 1000);
 
                 __poll(fd);
 
@@ -392,6 +395,9 @@ static void __attribute__((noreturn)) usage(const char *filepath)
                         "  -4:   only IPv4\n"
                         "  -6:   only IPv6\n"
                         "  -h:   show this message\n"
+                        "  -c N: number of packets for each test\n"
+                        "  -D:   no delay between packets\n"
+                        "  -F:   poll() waits forever for an event\n"
                         "  -I:   request PKTINFO\n"
                         "  -l N: send N bytes at a time\n"
                         "  -n:   set no-payload option\n"
@@ -409,7 +415,7 @@ static void parse_opt(int argc, char **argv)
         int proto_count = 0;
         char c;
 
-        while ((c = getopt(argc, argv, "46hIl:np:rRux")) != -1) {
+        while ((c = getopt(argc, argv, "46c:DFhIl:np:rRux")) != -1) {
                 switch (c) {
                 case '4':
                         do_ipv6 = 0;
@@ -417,6 +423,15 @@ static void parse_opt(int argc, char **argv)
                 case '6':
                         do_ipv4 = 0;
                         break;
+                case 'c':
+                        cfg_num_pkts = strtoul(optarg, NULL, 10);
+                        break;
+                case 'D':
+                        cfg_no_delay = true;
+                        break;
+                case 'F':
+                        cfg_poll_timeout = -1;
+                        break;
                 case 'I':
                         cfg_do_pktinfo = true;
                         break;
diff --git a/tools/testing/selftests/powerpc/benchmarks/.gitignore b/tools/testing/selftests/powerpc/benchmarks/.gitignore
index 04dc1e6ef2ce..9161679b1e1a 100644
--- a/tools/testing/selftests/powerpc/benchmarks/.gitignore
+++ b/tools/testing/selftests/powerpc/benchmarks/.gitignore
@@ -1,5 +1,7 @@
 gettimeofday
 context_switch
+fork
+exec_target
 mmap_bench
 futex_bench
 null_syscall
diff --git a/tools/testing/selftests/powerpc/benchmarks/Makefile b/tools/testing/selftests/powerpc/benchmarks/Makefile
index a35058e3766c..b4d7432a0ecd 100644
--- a/tools/testing/selftests/powerpc/benchmarks/Makefile
+++ b/tools/testing/selftests/powerpc/benchmarks/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
-TEST_GEN_PROGS := gettimeofday context_switch mmap_bench futex_bench null_syscall
+TEST_GEN_PROGS := gettimeofday context_switch fork mmap_bench futex_bench null_syscall
+TEST_GEN_FILES := exec_target
 
 CFLAGS += -O2
 
@@ -10,3 +11,7 @@ $(TEST_GEN_PROGS): ../harness.c
 $(OUTPUT)/context_switch: ../utils.c
 $(OUTPUT)/context_switch: CFLAGS += -maltivec -mvsx -mabi=altivec
 $(OUTPUT)/context_switch: LDLIBS += -lpthread
+
+$(OUTPUT)/fork: LDLIBS += -lpthread
+
+$(OUTPUT)/exec_target: CFLAGS += -static -nostartfiles
diff --git a/tools/testing/selftests/powerpc/benchmarks/exec_target.c b/tools/testing/selftests/powerpc/benchmarks/exec_target.c
new file mode 100644
index 000000000000..3c9c144192be
--- /dev/null
+++ b/tools/testing/selftests/powerpc/benchmarks/exec_target.c
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/*
+ * Part of fork context switch microbenchmark.
+ *
+ * Copyright 2018, Anton Blanchard, IBM Corp.
+ */
+
+void _exit(int);
+void _start(void)
+{
+        _exit(0);
+}
diff --git a/tools/testing/selftests/powerpc/benchmarks/fork.c b/tools/testing/selftests/powerpc/benchmarks/fork.c
new file mode 100644
index 000000000000..d312e638cb37
--- /dev/null
+++ b/tools/testing/selftests/powerpc/benchmarks/fork.c
@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/*
+ * Context switch microbenchmark.
+ *
+ * Copyright 2018, Anton Blanchard, IBM Corp.
+ */
+
+#define _GNU_SOURCE
+#include <assert.h>
+#include <errno.h>
+#include <getopt.h>
+#include <limits.h>
+#include <linux/futex.h>
+#include <pthread.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/shm.h>
+#include <sys/syscall.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static unsigned int timeout = 30;
+
+static void set_cpu(int cpu)
+{
+        cpu_set_t cpuset;
+
+        if (cpu == -1)
+                return;
+
+        CPU_ZERO(&cpuset);
+        CPU_SET(cpu, &cpuset);
+
+        if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) {
+                perror("sched_setaffinity");
+                exit(1);
+        }
+}
+
+static void start_process_on(void *(*fn)(void *), void *arg, int cpu)
+{
+        int pid;
+
+        pid = fork();
+        if (pid == -1) {
+                perror("fork");
+                exit(1);
+        }
+
+        if (pid)
+                return;
+
+        set_cpu(cpu);
+
+        fn(arg);
+
+        exit(0);
+}
+
+static int cpu;
+static int do_fork = 0;
+static int do_vfork = 0;
+static int do_exec = 0;
+static char *exec_file;
+static int exec_target = 0;
+static unsigned long iterations;
+static unsigned long iterations_prev;
+
+static void run_exec(void)
+{
+        char *const argv[] = { "./exec_target", NULL };
+
+        if (execve("./exec_target", argv, NULL) == -1) {
+                perror("execve");
+                exit(1);
+        }
+}
+
+static void bench_fork(void)
+{
+        while (1) {
+                pid_t pid = fork();
+                if (pid == -1) {
+                        perror("fork");
+                        exit(1);
+                }
+                if (pid == 0) {
+                        if (do_exec)
+                                run_exec();
+                        _exit(0);
+                }
+                pid = waitpid(pid, NULL, 0);
+                if (pid == -1) {
+                        perror("waitpid");
+                        exit(1);
+                }
+                iterations++;
+        }
+}
+
+static void bench_vfork(void)
+{
+        while (1) {
+                pid_t pid = vfork();
+                if (pid == -1) {
+                        perror("fork");
+                        exit(1);
+                }
+                if (pid == 0) {
+                        if (do_exec)
+                                run_exec();
+                        _exit(0);
+                }
+                pid = waitpid(pid, NULL, 0);
+                if (pid == -1) {
+                        perror("waitpid");
+                        exit(1);
+                }
+                iterations++;
+        }
+}
+
+static void *null_fn(void *arg)
+{
+        pthread_exit(NULL);
+}
+
+static void bench_thread(void)
+{
+        pthread_t tid;
+        cpu_set_t cpuset;
+        pthread_attr_t attr;
+        int rc;
+
+        rc = pthread_attr_init(&attr);
+        if (rc) {
+                errno = rc;
+                perror("pthread_attr_init");
+                exit(1);
+        }
+
+        if (cpu != -1) {
+                CPU_ZERO(&cpuset);
+                CPU_SET(cpu, &cpuset);
+
+                rc = pthread_attr_setaffinity_np(&attr, sizeof(cpu_set_t), &cpuset);
+                if (rc) {
+                        errno = rc;
+                        perror("pthread_attr_setaffinity_np");
+                        exit(1);
+                }
+        }
+
+        while (1) {
+                rc = pthread_create(&tid, &attr, null_fn, NULL);
+                if (rc) {
+                        errno = rc;
+                        perror("pthread_create");
+                        exit(1);
+                }
+                rc = pthread_join(tid, NULL);
+                if (rc) {
+                        errno = rc;
+                        perror("pthread_join");
+                        exit(1);
+                }
+                iterations++;
+        }
+}
+
+static void sigalrm_handler(int junk)
+{
+        unsigned long i = iterations;
+
+        printf("%ld\n", i - iterations_prev);
+        iterations_prev = i;
+
+        if (--timeout == 0)
+                kill(0, SIGUSR1);
+
+        alarm(1);
+}
+
+static void sigusr1_handler(int junk)
+{
+        exit(0);
+}
+
+static void *bench_proc(void *arg)
+{
+        signal(SIGALRM, sigalrm_handler);
+        alarm(1);
+
+        if (do_fork)
+                bench_fork();
+        else if (do_vfork)
+                bench_vfork();
+        else
+                bench_thread();
+
+        return NULL;
+}
+
+static struct option options[] = {
+        { "fork", no_argument, &do_fork, 1 },
+        { "vfork", no_argument, &do_vfork, 1 },
+        { "exec", no_argument, &do_exec, 1 },
+        { "timeout", required_argument, 0, 's' },
+        { "exec-target", no_argument, &exec_target, 1 },
+        { NULL },
+};
+
+static void usage(void)
+{
+        fprintf(stderr, "Usage: fork <options> CPU\n\n");
+        fprintf(stderr, "\t\t--fork\tUse fork() (default threads)\n");
+        fprintf(stderr, "\t\t--vfork\tUse vfork() (default threads)\n");
+        fprintf(stderr, "\t\t--exec\tAlso exec() (default no exec)\n");
+        fprintf(stderr, "\t\t--timeout=X\tDuration in seconds to run (default 30)\n");
+        fprintf(stderr, "\t\t--exec-target\tInternal option for exec workload\n");
+}
+
+int main(int argc, char *argv[])
+{
+        signed char c;
+
+        while (1) {
+                int option_index = 0;
+
+                c = getopt_long(argc, argv, "", options, &option_index);
+
+                if (c == -1)
+                        break;
+
+                switch (c) {
+                case 0:
+                        if (options[option_index].flag != 0)
+                                break;
+
+                        usage();
+                        exit(1);
+                        break;
+
+                case 's':
+                        timeout = atoi(optarg);
+                        break;
+
+                default:
+                        usage();
+                        exit(1);
+                }
+        }
+
+        if (do_fork && do_vfork) {
+                usage();
+                exit(1);
+        }
+        if (do_exec && !do_fork && !do_vfork) {
+                usage();
+                exit(1);
+        }
+
+        if (do_exec) {
+                char *dirname = strdup(argv[0]);
+                int i;
+                i = strlen(dirname) - 1;
+                while (i) {
+                        if (dirname[i] == '/') {
+                                dirname[i] = '\0';
+                                if (chdir(dirname) == -1) {
+                                        perror("chdir");
+                                        exit(1);
+                                }
+                                break;
+                        }
+                        i--;
+                }
+        }
+
+        if (exec_target) {
+                exit(0);
+        }
+
+        if (((argc - optind) != 1)) {
+                cpu = -1;
+        } else {
+                cpu = atoi(argv[optind++]);
+        }
+
+        if (do_exec)
+                exec_file = argv[0];
+
+        set_cpu(cpu);
+
+        printf("Using ");
+        if (do_fork)
+                printf("fork");
+        else if (do_vfork)
+                printf("vfork");
+        else
+                printf("clone");
+
+        if (do_exec)
+                printf(" + exec");
+
+        printf(" on cpu %d\n", cpu);
+
+        /* Create a new process group so we can signal everyone for exit */
+        setpgid(getpid(), getpid());
+
+        signal(SIGUSR1, sigusr1_handler);
+
+        start_process_on(bench_proc, NULL, cpu);
+
+        while (1)
+                sleep(3600);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/powerpc/copyloops/Makefile b/tools/testing/selftests/powerpc/copyloops/Makefile
index ac4a52e19e59..eedce3366f64 100644
--- a/tools/testing/selftests/powerpc/copyloops/Makefile
+++ b/tools/testing/selftests/powerpc/copyloops/Makefile
@@ -5,8 +5,8 @@ CFLAGS += -I$(CURDIR)
 CFLAGS += -D SELFTEST
 CFLAGS += -maltivec
 
-# Use our CFLAGS for the implicit .S rule
-ASFLAGS = $(CFLAGS)
+# Use our CFLAGS for the implicit .S rule & set the asm machine type
+ASFLAGS = $(CFLAGS) -Wa,-mpower4
 
 TEST_GEN_PROGS := copyuser_64 copyuser_power7 memcpy_64 memcpy_power7
 EXTRA_SOURCES := validate.c ../harness.c
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index 5c72ff978f27..c0e45d2dde25 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -4,7 +4,7 @@ SIGNAL_CONTEXT_CHK_TESTS := tm-signal-context-chk-gpr tm-signal-context-chk-fpu
 
 TEST_GEN_PROGS := tm-resched-dscr tm-syscall tm-signal-msr-resv tm-signal-stack \
         tm-vmxcopy tm-fork tm-tar tm-tmspr tm-vmx-unavail tm-unavailable tm-trap \
-        $(SIGNAL_CONTEXT_CHK_TESTS)
+        $(SIGNAL_CONTEXT_CHK_TESTS) tm-sigreturn
 
 include ../../lib.mk
 
diff --git a/tools/testing/selftests/powerpc/tm/tm-sigreturn.c b/tools/testing/selftests/powerpc/tm/tm-sigreturn.c
new file mode 100644
index 000000000000..85d63449243b
--- /dev/null
+++ b/tools/testing/selftests/powerpc/tm/tm-sigreturn.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright 2015, Laurent Dufour, IBM Corp.
+ *
+ * Test the kernel's signal returning code to check reclaim is done if the
+ * sigreturn() is called while in a transaction (suspended since active is
+ * already dropped trough the system call path).
+ *
+ * The kernel must discard the transaction when entering sigreturn, since
+ * restoring the potential TM SPRS from the signal frame is requiring to not be
+ * in a transaction.
+ */
+
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "tm.h"
+#include "utils.h"
+
+
+void handler(int sig)
+{
+        uint64_t ret;
+
+        asm __volatile__(
+                "li             3,1             ;"
+                "tbegin.                        ;"
+                "beq            1f              ;"
+                "li             3,0             ;"
+                "tsuspend.                      ;"
+                "1:                             ;"
+                "std%X[ret]     3, %[ret]       ;"
+                : [ret] "=m"(ret)
+                :
+                : "memory", "3", "cr0");
+
+        if (ret)
+                exit(1);
+
+        /*
+         * We return from the signal handle while in a suspended transaction
+         */
+}
+
+
+int tm_sigreturn(void)
+{
+        struct sigaction sa;
+        uint64_t ret = 0;
+
+        SKIP_IF(!have_htm());
+
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_handler = handler;
+        sigemptyset(&sa.sa_mask);
+
+        if (sigaction(SIGSEGV, &sa, NULL))
+                exit(1);
+
+        asm __volatile__(
+                "tbegin.                        ;"
+                "beq            1f              ;"
+                "li             3,0             ;"
+                "std            3,0(3)          ;" /* trigger SEGV */
+                "li             3,1             ;"
+                "std%X[ret]     3,%[ret]        ;"
+                "tend.                          ;"
+                "b              2f              ;"
+                "1:                             ;"
+                "li             3,2             ;"
+                "std%X[ret]     3,%[ret]        ;"
+                "2:                             ;"
+                : [ret] "=m"(ret)
+                :
+                : "memory", "3", "cr0");
+
+        if (ret != 2)
+                exit(1);
+
+        exit(0);
+}
+
+int main(void)
+{
+        return test_harness(tm_sigreturn, "tm_sigreturn");
+}
diff --git a/tools/testing/selftests/powerpc/tm/tm-unavailable.c b/tools/testing/selftests/powerpc/tm/tm-unavailable.c
index e6a0fad2bfd0..156c8e750259 100644
--- a/tools/testing/selftests/powerpc/tm/tm-unavailable.c
+++ b/tools/testing/selftests/powerpc/tm/tm-unavailable.c
@@ -80,7 +80,7 @@ bool is_failure(uint64_t condition_reg)
         return ((condition_reg >> 28) & 0xa) == 0xa;
 }
 
-void *ping(void *input)
+void *tm_una_ping(void *input)
 {
 
         /*
@@ -280,7 +280,7 @@ void *ping(void *input)
 }
 
 /* Thread to force context switch */
-void *pong(void *not_used)
+void *tm_una_pong(void *not_used)
 {
         /* Wait thread get its name "pong". */
         if (DEBUG)
@@ -311,11 +311,11 @@ void test_fp_vec(int fp, int vec, pthread_attr_t *attr)
         do {
                 int rc;
 
-                /* Bind 'ping' to CPU 0, as specified in 'attr'. */
-                rc = pthread_create(&t0, attr, ping, (void *) &flags);
+                /* Bind to CPU 0, as specified in 'attr'. */
+                rc = pthread_create(&t0, attr, tm_una_ping, (void *) &flags);
                 if (rc)
                         pr_err(rc, "pthread_create()");
-                rc = pthread_setname_np(t0, "ping");
+                rc = pthread_setname_np(t0, "tm_una_ping");
                 if (rc)
                         pr_warn(rc, "pthread_setname_np");
                 rc = pthread_join(t0, &ret_value);
@@ -333,13 +333,15 @@ void test_fp_vec(int fp, int vec, pthread_attr_t *attr)
         }
 }
 
-int main(int argc, char **argv)
+int tm_unavailable_test(void)
 {
         int rc, exception; /* FP = 0, VEC = 1, VSX = 2 */
         pthread_t t1;
         pthread_attr_t attr;
         cpu_set_t cpuset;
 
+        SKIP_IF(!have_htm());
+
         /* Set only CPU 0 in the mask. Both threads will be bound to CPU 0. */
         CPU_ZERO(&cpuset);
         CPU_SET(0, &cpuset);
@@ -354,12 +356,12 @@ int main(int argc, char **argv)
         if (rc)
                 pr_err(rc, "pthread_attr_setaffinity_np()");
 
-        rc = pthread_create(&t1, &attr /* Bind 'pong' to CPU 0 */, pong, NULL);
+        rc = pthread_create(&t1, &attr /* Bind to CPU 0 */, tm_una_pong, NULL);
         if (rc)
                 pr_err(rc, "pthread_create()");
 
         /* Name it for systemtap convenience */
-        rc = pthread_setname_np(t1, "pong");
+        rc = pthread_setname_np(t1, "tm_una_pong");
         if (rc)
                 pr_warn(rc, "pthread_create()");
 
@@ -394,3 +396,9 @@ int main(int argc, char **argv)
                 exit(0);
         }
 }
+
+int main(int argc, char **argv)
+{
+        test_harness_set_timeout(220);
+        return test_harness(tm_unavailable_test, "tm_unavailable_test");
+}
diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore
new file mode 100644
index 000000000000..6c16f77c722c
--- /dev/null
+++ b/tools/testing/selftests/proc/.gitignore
@@ -0,0 +1,8 @@
+/proc-loadavg-001
+/proc-self-map-files-001
+/proc-self-map-files-002
+/proc-self-syscall
+/proc-self-wchan
+/proc-uptime-001
+/proc-uptime-002
+/read
diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile
new file mode 100644
index 000000000000..dbb87e56264c
--- /dev/null
+++ b/tools/testing/selftests/proc/Makefile
@@ -0,0 +1,13 @@
+CFLAGS += -Wall -O2
+
+TEST_GEN_PROGS :=
+TEST_GEN_PROGS += proc-loadavg-001
+TEST_GEN_PROGS += proc-self-map-files-001
+TEST_GEN_PROGS += proc-self-map-files-002
+TEST_GEN_PROGS += proc-self-syscall
+TEST_GEN_PROGS += proc-self-wchan
+TEST_GEN_PROGS += proc-uptime-001
+TEST_GEN_PROGS += proc-uptime-002
+TEST_GEN_PROGS += read
+
+include ../lib.mk
diff --git a/tools/testing/selftests/proc/config b/tools/testing/selftests/proc/config
new file mode 100644
index 000000000000..68fbd2b35884
--- /dev/null
+++ b/tools/testing/selftests/proc/config
@@ -0,0 +1 @@
+CONFIG_PROC_FS=y
diff --git a/tools/testing/selftests/proc/proc-loadavg-001.c b/tools/testing/selftests/proc/proc-loadavg-001.c
new file mode 100644
index 000000000000..fcff7047000d
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-loadavg-001.c
@@ -0,0 +1,83 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/* Test that /proc/loadavg correctly reports last pid in pid namespace. */
+#define _GNU_SOURCE
+#include <errno.h>
+#include <sched.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+int main(void)
+{
+        pid_t pid;
+        int wstatus;
+
+        if (unshare(CLONE_NEWPID) == -1) {
+                if (errno == ENOSYS || errno == EPERM)
+                        return 2;
+                return 1;
+        }
+
+        pid = fork();
+        if (pid == -1)
+                return 1;
+        if (pid == 0) {
+                char buf[128], *p;
+                int fd;
+                ssize_t rv;
+
+                fd = open("/proc/loadavg" , O_RDONLY);
+                if (fd == -1)
+                        return 1;
+                rv = read(fd, buf, sizeof(buf));
+                if (rv < 3)
+                        return 1;
+                p = buf + rv;
+
+                /* pid 1 */
+                if (!(p[-3] == ' ' && p[-2] == '1' && p[-1] == '\n'))
+                        return 1;
+
+                pid = fork();
+                if (pid == -1)
+                        return 1;
+                if (pid == 0)
+                        return 0;
+                if (waitpid(pid, NULL, 0) == -1)
+                        return 1;
+
+                lseek(fd, 0, SEEK_SET);
+                rv = read(fd, buf, sizeof(buf));
+                if (rv < 3)
+                        return 1;
+                p = buf + rv;
+
+                /* pid 2 */
+                if (!(p[-3] == ' ' && p[-2] == '2' && p[-1] == '\n'))
+                        return 1;
+
+                return 0;
+        }
+
+        if (waitpid(pid, &wstatus, 0) == -1)
+                return 1;
+        if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0)
+                return 0;
+        return 1;
+}
diff --git a/tools/testing/selftests/proc/proc-self-map-files-001.c b/tools/testing/selftests/proc/proc-self-map-files-001.c
new file mode 100644
index 000000000000..4209c64283d6
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-self-map-files-001.c
@@ -0,0 +1,82 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/* Test readlink /proc/self/map_files/... */
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <stdlib.h>
+
+static void pass(const char *fmt, unsigned long a, unsigned long b)
+{
+        char name[64];
+        char buf[64];
+
+        snprintf(name, sizeof(name), fmt, a, b);
+        if (readlink(name, buf, sizeof(buf)) == -1)
+                exit(1);
+}
+
+static void fail(const char *fmt, unsigned long a, unsigned long b)
+{
+        char name[64];
+        char buf[64];
+
+        snprintf(name, sizeof(name), fmt, a, b);
+        if (readlink(name, buf, sizeof(buf)) == -1 && errno == ENOENT)
+                return;
+        exit(1);
+}
+
+int main(void)
+{
+        const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
+        void *p;
+        int fd;
+        unsigned long a, b;
+
+        fd = open("/dev/zero", O_RDONLY);
+        if (fd == -1)
+                return 1;
+
+        p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE, fd, 0);
+        if (p == MAP_FAILED)
+                return 1;
+
+        a = (unsigned long)p;
+        b = (unsigned long)p + PAGE_SIZE;
+
+        pass("/proc/self/map_files/%lx-%lx", a, b);
+        fail("/proc/self/map_files/ %lx-%lx", a, b);
+        fail("/proc/self/map_files/%lx -%lx", a, b);
+        fail("/proc/self/map_files/%lx- %lx", a, b);
+        fail("/proc/self/map_files/%lx-%lx ", a, b);
+        fail("/proc/self/map_files/0%lx-%lx", a, b);
+        fail("/proc/self/map_files/%lx-0%lx", a, b);
+        if (sizeof(long) == 4) {
+                fail("/proc/self/map_files/100000000%lx-%lx", a, b);
+                fail("/proc/self/map_files/%lx-100000000%lx", a, b);
+        } else if (sizeof(long) == 8) {
+                fail("/proc/self/map_files/10000000000000000%lx-%lx", a, b);
+                fail("/proc/self/map_files/%lx-10000000000000000%lx", a, b);
+        } else
+                return 1;
+
+        return 0;
+}
diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c
new file mode 100644
index 000000000000..6f1f4a6e1ecb
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-self-map-files-002.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/* Test readlink /proc/self/map_files/... with address 0. */
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <stdlib.h>
+
+static void pass(const char *fmt, unsigned long a, unsigned long b)
+{
+        char name[64];
+        char buf[64];
+
+        snprintf(name, sizeof(name), fmt, a, b);
+        if (readlink(name, buf, sizeof(buf)) == -1)
+                exit(1);
+}
+
+static void fail(const char *fmt, unsigned long a, unsigned long b)
+{
+        char name[64];
+        char buf[64];
+
+        snprintf(name, sizeof(name), fmt, a, b);
+        if (readlink(name, buf, sizeof(buf)) == -1 && errno == ENOENT)
+                return;
+        exit(1);
+}
+
+int main(void)
+{
+        const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
+        void *p;
+        int fd;
+        unsigned long a, b;
+
+        fd = open("/dev/zero", O_RDONLY);
+        if (fd == -1)
+                return 1;
+
+        p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
+        if (p == MAP_FAILED) {
+                if (errno == EPERM)
+                        return 2;
+                return 1;
+        }
+
+        a = (unsigned long)p;
+        b = (unsigned long)p + PAGE_SIZE;
+
+        pass("/proc/self/map_files/%lx-%lx", a, b);
+        fail("/proc/self/map_files/ %lx-%lx", a, b);
+        fail("/proc/self/map_files/%lx -%lx", a, b);
+        fail("/proc/self/map_files/%lx- %lx", a, b);
+        fail("/proc/self/map_files/%lx-%lx ", a, b);
+        fail("/proc/self/map_files/0%lx-%lx", a, b);
+        fail("/proc/self/map_files/%lx-0%lx", a, b);
+        if (sizeof(long) == 4) {
+                fail("/proc/self/map_files/100000000%lx-%lx", a, b);
+                fail("/proc/self/map_files/%lx-100000000%lx", a, b);
+        } else if (sizeof(long) == 8) {
+                fail("/proc/self/map_files/10000000000000000%lx-%lx", a, b);
+                fail("/proc/self/map_files/%lx-10000000000000000%lx", a, b);
+        } else
+                return 1;
+
+        return 0;
+}
diff --git a/tools/testing/selftests/proc/proc-self-syscall.c b/tools/testing/selftests/proc/proc-self-syscall.c
new file mode 100644
index 000000000000..5ab5f4810e43
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-self-syscall.c
@@ -0,0 +1,60 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#define _GNU_SOURCE
+#include <unistd.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdio.h>
+
+static inline ssize_t sys_read(int fd, void *buf, size_t len)
+{
+        return syscall(SYS_read, fd, buf, len);
+}
+
+int main(void)
+{
+        char buf1[64];
+        char buf2[64];
+        int fd;
+        ssize_t rv;
+
+        fd = open("/proc/self/syscall", O_RDONLY);
+        if (fd == -1) {
+                if (errno == ENOENT)
+                        return 2;
+                return 1;
+        }
+
+        /* Do direct system call as libc can wrap anything. */
+        snprintf(buf1, sizeof(buf1), "%ld 0x%lx 0x%lx 0x%lx",
+                 (long)SYS_read, (long)fd, (long)buf2, (long)sizeof(buf2));
+
+        memset(buf2, 0, sizeof(buf2));
+        rv = sys_read(fd, buf2, sizeof(buf2));
+        if (rv < 0)
+                return 1;
+        if (rv < strlen(buf1))
+                return 1;
+        if (strncmp(buf1, buf2, strlen(buf1)) != 0)
+                return 1;
+
+        return 0;
+}
diff --git a/tools/testing/selftests/proc/proc-self-wchan.c b/tools/testing/selftests/proc/proc-self-wchan.c
new file mode 100644
index 000000000000..a38b2fbaa7ad
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-self-wchan.c
@@ -0,0 +1,40 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <unistd.h>
+
+int main(void)
+{
+        char buf[64];
+        int fd;
+
+        fd = open("/proc/self/wchan", O_RDONLY);
+        if (fd == -1) {
+                if (errno == ENOENT)
+                        return 2;
+                return 1;
+        }
+
+        buf[0] = '\0';
+        if (read(fd, buf, sizeof(buf)) != 1)
+                return 1;
+        if (buf[0] != '0')
+                return 1;
+        return 0;
+}
diff --git a/tools/testing/selftests/proc/proc-uptime-001.c b/tools/testing/selftests/proc/proc-uptime-001.c
new file mode 100644
index 000000000000..781f7a50fc3f
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-uptime-001.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+// Test that values in /proc/uptime increment monotonically.
+#undef NDEBUG
+#include <assert.h>
+#include <stdint.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "proc-uptime.h"
+
+int main(void)
+{
+        uint64_t start, u0, u1, i0, i1;
+        int fd;
+
+        fd = open("/proc/uptime", O_RDONLY);
+        assert(fd >= 0);
+
+        proc_uptime(fd, &u0, &i0);
+        start = u0;
+        do {
+                proc_uptime(fd, &u1, &i1);
+                assert(u1 >= u0);
+                assert(i1 >= i0);
+                u0 = u1;
+                i0 = i1;
+        } while (u1 - start < 100);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c
new file mode 100644
index 000000000000..30e2b7849089
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-uptime-002.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+// Test that values in /proc/uptime increment monotonically
+// while shifting across CPUs.
+#define _GNU_SOURCE
+#undef NDEBUG
+#include <assert.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <stdint.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "proc-uptime.h"
+
+static inline int sys_sched_getaffinity(pid_t pid, unsigned int len, unsigned long *m)
+{
+        return syscall(SYS_sched_getaffinity, pid, len, m);
+}
+
+static inline int sys_sched_setaffinity(pid_t pid, unsigned int len, unsigned long *m)
+{
+        return syscall(SYS_sched_setaffinity, pid, len, m);
+}
+
+int main(void)
+{
+        unsigned int len;
+        unsigned long *m;
+        unsigned int cpu;
+        uint64_t u0, u1, i0, i1;
+        int fd;
+
+        /* find out "nr_cpu_ids" */
+        m = NULL;
+        len = 0;
+        do {
+                len += sizeof(unsigned long);
+                free(m);
+                m = malloc(len);
+        } while (sys_sched_getaffinity(0, len, m) == -EINVAL);
+
+        fd = open("/proc/uptime", O_RDONLY);
+        assert(fd >= 0);
+
+        proc_uptime(fd, &u0, &i0);
+        for (cpu = 0; cpu < len * 8; cpu++) {
+                memset(m, 0, len);
+                m[cpu / (8 * sizeof(unsigned long))] |= 1UL << (cpu % (8 * sizeof(unsigned long)));
+
+                /* CPU might not exist, ignore error */
+                sys_sched_setaffinity(0, len, m);
+
+                proc_uptime(fd, &u1, &i1);
+                assert(u1 >= u0);
+                assert(i1 >= i0);
+                u0 = u1;
+                i0 = i1;
+        }
+
+        return 0;
+}
diff --git a/tools/testing/selftests/proc/proc-uptime.h b/tools/testing/selftests/proc/proc-uptime.h
new file mode 100644
index 000000000000..0e464b50e9d9
--- /dev/null
+++ b/tools/testing/selftests/proc/proc-uptime.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#undef NDEBUG
+#include <assert.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static unsigned long long xstrtoull(const char *p, char **end)
+{
+        if (*p == '0') {
+                *end = (char *)p + 1;
+                return 0;
+        } else if ('1' <= *p && *p <= '9') {
+                unsigned long long val;
+
+                errno = 0;
+                val = strtoull(p, end, 10);
+                assert(errno == 0);
+                return val;
+        } else
+                assert(0);
+}
+
+static void proc_uptime(int fd, uint64_t *uptime, uint64_t *idle)
+{
+        uint64_t val1, val2;
+        char buf[64], *p;
+        ssize_t rv;
+
+        /* save "p < end" checks */
+        memset(buf, 0, sizeof(buf));
+        rv = pread(fd, buf, sizeof(buf), 0);
+        assert(0 <= rv && rv <= sizeof(buf));
+        buf[sizeof(buf) - 1] = '\0';
+
+        p = buf;
+
+        val1 = xstrtoull(p, &p);
+        assert(p[0] == '.');
+        assert('0' <= p[1] && p[1] <= '9');
+        assert('0' <= p[2] && p[2] <= '9');
+        assert(p[3] == ' ');
+
+        val2 = (p[1] - '0') * 10 + p[2] - '0';
+        *uptime = val1 * 100 + val2;
+
+        p += 4;
+
+        val1 = xstrtoull(p, &p);
+        assert(p[0] == '.');
+        assert('0' <= p[1] && p[1] <= '9');
+        assert('0' <= p[2] && p[2] <= '9');
+        assert(p[3] == '\n');
+
+        val2 = (p[1] - '0') * 10 + p[2] - '0';
+        *idle = val1 * 100 + val2;
+
+        assert(p + 4 == buf + rv);
+}
diff --git a/tools/testing/selftests/proc/read.c b/tools/testing/selftests/proc/read.c
new file mode 100644
index 000000000000..1e73c2232097
--- /dev/null
+++ b/tools/testing/selftests/proc/read.c
@@ -0,0 +1,147 @@
+/*
+ * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+// Test
+// 1) read of every file in /proc
+// 2) readlink of every symlink in /proc
+// 3) recursively (1) + (2) for every directory in /proc
+// 4) write to /proc/*/clear_refs and /proc/*/task/*/clear_refs
+// 5) write to /proc/sysrq-trigger
+#undef NDEBUG
+#include <assert.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <dirent.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+static inline bool streq(const char *s1, const char *s2)
+{
+        return strcmp(s1, s2) == 0;
+}
+
+static struct dirent *xreaddir(DIR *d)
+{
+        struct dirent *de;
+
+        errno = 0;
+        de = readdir(d);
+        if (!de && errno != 0) {
+                exit(1);
+        }
+        return de;
+}
+
+static void f_reg(DIR *d, const char *filename)
+{
+        char buf[4096];
+        int fd;
+        ssize_t rv;
+
+        /* read from /proc/kmsg can block */
+        fd = openat(dirfd(d), filename, O_RDONLY|O_NONBLOCK);
+        if (fd == -1)
+                return;
+        rv = read(fd, buf, sizeof(buf));
+        assert((0 <= rv && rv <= sizeof(buf)) || rv == -1);
+        close(fd);
+}
+
+static void f_reg_write(DIR *d, const char *filename, const char *buf, size_t len)
+{
+        int fd;
+        ssize_t rv;
+
+        fd = openat(dirfd(d), filename, O_WRONLY);
+        if (fd == -1)
+                return;
+        rv = write(fd, buf, len);
+        assert((0 <= rv && rv <= len) || rv == -1);
+        close(fd);
+}
+
+static void f_lnk(DIR *d, const char *filename)
+{
+        char buf[4096];
+        ssize_t rv;
+
+        rv = readlinkat(dirfd(d), filename, buf, sizeof(buf));
+        assert((0 <= rv && rv <= sizeof(buf)) || rv == -1);
+}
+
+static void f(DIR *d, unsigned int level)
+{
+        struct dirent *de;
+
+        de = xreaddir(d);
+        assert(de->d_type == DT_DIR);
+        assert(streq(de->d_name, "."));
+
+        de = xreaddir(d);
+        assert(de->d_type == DT_DIR);
+        assert(streq(de->d_name, ".."));
+
+        while ((de = xreaddir(d))) {
+                assert(!streq(de->d_name, "."));
+                assert(!streq(de->d_name, ".."));
+
+                switch (de->d_type) {
+                        DIR *dd;
+                        int fd;
+
+                case DT_REG:
+                        if (level == 0 && streq(de->d_name, "sysrq-trigger")) {
+                                f_reg_write(d, de->d_name, "h", 1);
+                        } else if (level == 1 && streq(de->d_name, "clear_refs")) {
+                                f_reg_write(d, de->d_name, "1", 1);
+                        } else if (level == 3 && streq(de->d_name, "clear_refs")) {
+                                f_reg_write(d, de->d_name, "1", 1);
+                        } else {
+                                f_reg(d, de->d_name);
+                        }
+                        break;
+                case DT_DIR:
+                        fd = openat(dirfd(d), de->d_name, O_DIRECTORY|O_RDONLY);
+                        if (fd == -1)
+                                continue;
+                        dd = fdopendir(fd);
+                        if (!dd)
+                                continue;
+                        f(dd, level + 1);
+                        closedir(dd);
+                        break;
+                case DT_LNK:
+                        f_lnk(d, de->d_name);
+                        break;
+                default:
+                        assert(0);
+                }
+        }
+}
+
+int main(void)
+{
+        DIR *d;
+
+        d = opendir("/proc");
+        if (!d)
+                return 2;
+        f(d, 0);
+        return 0;
+}
diff --git a/tools/testing/selftests/rcutorture/bin/functions.sh b/tools/testing/selftests/rcutorture/bin/functions.sh
index 07a13779eece..65f6655026f0 100644
--- a/tools/testing/selftests/rcutorture/bin/functions.sh
+++ b/tools/testing/selftests/rcutorture/bin/functions.sh
@@ -136,6 +136,9 @@ identify_boot_image () {
                 qemu-system-x86_64|qemu-system-i386)
                         echo arch/x86/boot/bzImage
                         ;;
+                qemu-system-aarch64)
+                        echo arch/arm64/boot/Image
+                        ;;
                 *)
                         echo vmlinux
                         ;;
@@ -158,6 +161,9 @@ identify_qemu () {
         elif echo $u | grep -q "Intel 80386"
         then
                 echo qemu-system-i386
+        elif echo $u | grep -q aarch64
+        then
+                echo qemu-system-aarch64
         elif uname -a | grep -q ppc64
         then
                 echo qemu-system-ppc64
@@ -176,16 +182,20 @@ identify_qemu () {
 # Output arguments for the qemu "-append" string based on CPU type
 # and the TORTURE_QEMU_INTERACTIVE environment variable.
 identify_qemu_append () {
+        local console=ttyS0
         case "$1" in
         qemu-system-x86_64|qemu-system-i386)
                 echo noapic selinux=0 initcall_debug debug
                 ;;
+        qemu-system-aarch64)
+                console=ttyAMA0
+                ;;
         esac
         if test -n "$TORTURE_QEMU_INTERACTIVE"
         then
                 echo root=/dev/sda
         else
-                echo console=ttyS0
+                echo console=$console
         fi
 }
 
@@ -197,6 +207,9 @@ identify_qemu_args () {
         case "$1" in
         qemu-system-x86_64|qemu-system-i386)
                 ;;
+        qemu-system-aarch64)
+                echo -machine virt,gic-version=host -cpu host
+                ;;
         qemu-system-ppc64)
                 echo -enable-kvm -M pseries -nodefaults
                 echo -device spapr-vscsi
@@ -254,7 +267,7 @@ specify_qemu_cpus () {
                 echo $2
         else
                 case "$1" in
-                qemu-system-x86_64|qemu-system-i386)
+                qemu-system-x86_64|qemu-system-i386|qemu-system-aarch64)
                         echo $2 -smp $3
                         ;;
                 qemu-system-ppc64)
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcuperf-ftrace.sh b/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcuperf-ftrace.sh
index 963f71289d22..8948f7926b21 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcuperf-ftrace.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcuperf-ftrace.sh
@@ -39,30 +39,31 @@ sed -e 's/us : / : /' |
 tr -d '\015' |
 awk '
 $8 == "start" {
-        if (starttask != "")
+        if (startseq != "")
                 nlost++;
         starttask = $1;
         starttime = $3;
         startseq = $7;
+        seqtask[startseq] = starttask;
 }
 
 $8 == "end" {
-        if (starttask == $1 && startseq == $7) {
+        if (startseq == $7) {
                 curgpdur = $3 - starttime;
                 gptimes[++n] = curgpdur;
                 gptaskcnt[starttask]++;
                 sum += curgpdur;
                 if (curgpdur > 1000)
                         print "Long GP " starttime "us to " $3 "us (" curgpdur "us)";
-                starttask = "";
+                startseq = "";
         } else {
                 # Lost a message or some such, reset.
-                starttask = "";
+                startseq = "";
                 nlost++;
         }
 }
 
-$8 == "done" {
+$8 == "done" && seqtask[$7] != $1 {
         piggybackcnt[$1]++;
 }
 
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
index 1b78a12740e5..5f8fbb0d7c17 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
@@ -177,8 +177,8 @@ then
         exit 0
 fi
 echo "NOTE: $QEMU either did not run or was interactive" > $resdir/console.log
-echo $QEMU $qemu_args -m 512 -kernel $KERNEL -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
-( $QEMU $qemu_args -m 512 -kernel $KERNEL -append "$qemu_append $boot_args"& echo $! > $resdir/qemu_pid; wait `cat  $resdir/qemu_pid`; echo $? > $resdir/qemu-retval ) &
+echo $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
+( $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append "$qemu_append $boot_args"& echo $! > $resdir/qemu_pid; wait `cat  $resdir/qemu_pid`; echo $? > $resdir/qemu-retval ) &
 commandcompleted=0
 sleep 10 # Give qemu's pid a chance to reach the file
 if test -s "$resdir/qemu_pid"
diff --git a/tools/testing/selftests/rcutorture/bin/kvm.sh b/tools/testing/selftests/rcutorture/bin/kvm.sh
index 7d1f607f0f76..56610dbbdf73 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm.sh
@@ -1,10 +1,8 @@
 #!/bin/bash
 #
-# Run a series of 14 tests under KVM.  These are not particularly
-# well-selected or well-tuned, but are the current set.
-#
-# Edit the definitions below to set the locations of the various directories,
-# as well as the test duration.
+# Run a series of tests under KVM.  By default, this series is specified
+# by the relevant CFLIST file, but can be overridden by the --configs
+# command-line argument.
 #
 # Usage: kvm.sh [ options ]
 #
@@ -44,6 +42,7 @@ TORTURE_BOOT_IMAGE=""
 TORTURE_INITRD="$KVM/initrd"; export TORTURE_INITRD
 TORTURE_KCONFIG_ARG=""
 TORTURE_KMAKE_ARG=""
+TORTURE_QEMU_MEM=512
 TORTURE_SHUTDOWN_GRACE=180
 TORTURE_SUITE=rcu
 resdir=""
@@ -70,6 +69,7 @@ usage () {
         echo "       --kconfig Kconfig-options"
         echo "       --kmake-arg kernel-make-arguments"
         echo "       --mac nn:nn:nn:nn:nn:nn"
+        echo "       --memory megabytes | nnnG"
         echo "       --no-initrd"
         echo "       --qemu-args qemu-arguments"
         echo "       --qemu-cmd qemu-system-..."
@@ -147,6 +147,11 @@ do
                 TORTURE_QEMU_MAC=$2
                 shift
                 ;;
+        --memory)
+                checkarg --memory "(memory size)" $# "$2" '^[0-9]\+[MG]\?$' error
+                TORTURE_QEMU_MEM=$2
+                shift
+                ;;
         --no-initrd)
                 TORTURE_INITRD=""; export TORTURE_INITRD
                 ;;
@@ -174,6 +179,12 @@ do
                 checkarg --torture "(suite name)" "$#" "$2" '^\(lock\|rcu\|rcuperf\)$' '^--'
                 TORTURE_SUITE=$2
                 shift
+                if test "$TORTURE_SUITE" = rcuperf
+                then
+                        # If you really want jitter for rcuperf, specify
+                        # it after specifying rcuperf.  (But why?)
+                        jitter=0
+                fi
                 ;;
         *)
                 echo Unknown argument $1
@@ -288,6 +299,7 @@ TORTURE_KMAKE_ARG="$TORTURE_KMAKE_ARG"; export TORTURE_KMAKE_ARG
 TORTURE_QEMU_CMD="$TORTURE_QEMU_CMD"; export TORTURE_QEMU_CMD
 TORTURE_QEMU_INTERACTIVE="$TORTURE_QEMU_INTERACTIVE"; export TORTURE_QEMU_INTERACTIVE
 TORTURE_QEMU_MAC="$TORTURE_QEMU_MAC"; export TORTURE_QEMU_MAC
+TORTURE_QEMU_MEM="$TORTURE_QEMU_MEM"; export TORTURE_QEMU_MEM
 TORTURE_SHUTDOWN_GRACE="$TORTURE_SHUTDOWN_GRACE"; export TORTURE_SHUTDOWN_GRACE
 TORTURE_SUITE="$TORTURE_SUITE"; export TORTURE_SUITE
 if ! test -e $resdir
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKS03 b/tools/testing/selftests/rcutorture/configs/rcu/TASKS03
index c70c51d5ded1..28568b72a31b 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TASKS03
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKS03
@@ -9,5 +9,4 @@ CONFIG_PREEMPT=y
 CONFIG_HZ_PERIODIC=n
 CONFIG_NO_HZ_IDLE=n
 CONFIG_NO_HZ_FULL=y
-CONFIG_NO_HZ_FULL_ALL=y
 #CHECK#CONFIG_RCU_EXPERT=n
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TASKS03.boot b/tools/testing/selftests/rcutorture/configs/rcu/TASKS03.boot
index cd2a188eeb6d..838297c58318 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TASKS03.boot
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TASKS03.boot
@@ -1 +1 @@
-rcutorture.torture_type=tasks
+rcutorture.torture_type=tasks nohz_full=1
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE04 b/tools/testing/selftests/rcutorture/configs/rcu/TREE04
index 27d22695d64c..24c9f6012e35 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE04
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE04
@@ -7,7 +7,6 @@ CONFIG_PREEMPT=n
 CONFIG_HZ_PERIODIC=n
 CONFIG_NO_HZ_IDLE=n
 CONFIG_NO_HZ_FULL=y
-CONFIG_NO_HZ_FULL_ALL=y
 CONFIG_RCU_FAST_NO_HZ=y
 CONFIG_RCU_TRACE=y
 CONFIG_HOTPLUG_CPU=n
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE04.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE04.boot
index e34c33430447..e6071bb96c7d 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE04.boot
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE04.boot
@@ -1 +1 @@
-rcutorture.torture_type=rcu_bh rcutree.rcu_fanout_leaf=4
+rcutorture.torture_type=rcu_bh rcutree.rcu_fanout_leaf=4 nohz_full=1-7
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE07 b/tools/testing/selftests/rcutorture/configs/rcu/TREE07
index 0f4759f4232e..d7afb271a586 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE07
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE07
@@ -7,7 +7,6 @@ CONFIG_PREEMPT=n
 CONFIG_HZ_PERIODIC=n
 CONFIG_NO_HZ_IDLE=n
 CONFIG_NO_HZ_FULL=y
-CONFIG_NO_HZ_FULL_ALL=n
 CONFIG_RCU_FAST_NO_HZ=n
 CONFIG_RCU_TRACE=y
 CONFIG_HOTPLUG_CPU=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcuperf/ver_functions.sh b/tools/testing/selftests/rcutorture/configs/rcuperf/ver_functions.sh
index b9603115d7c7..d36b8fd6f0fc 100644
--- a/tools/testing/selftests/rcutorture/configs/rcuperf/ver_functions.sh
+++ b/tools/testing/selftests/rcutorture/configs/rcuperf/ver_functions.sh
@@ -20,32 +20,10 @@
 #
 # Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
 
-# rcuperf_param_nreaders bootparam-string
-#
-# Adds nreaders rcuperf module parameter if not already specified.
-rcuperf_param_nreaders () {
-        if ! echo "$1" | grep -q "rcuperf.nreaders"
-        then
-                echo rcuperf.nreaders=-1
-        fi
-}
-
-# rcuperf_param_nwriters bootparam-string
-#
-# Adds nwriters rcuperf module parameter if not already specified.
-rcuperf_param_nwriters () {
-        if ! echo "$1" | grep -q "rcuperf.nwriters"
-        then
-                echo rcuperf.nwriters=-1
-        fi
-}
-
 # per_version_boot_params bootparam-string config-file seconds
 #
 # Adds per-version torture-module parameters to kernels supporting them.
 per_version_boot_params () {
-        echo $1 `rcuperf_param_nreaders "$1"` \
-                `rcuperf_param_nwriters "$1"` \
-                rcuperf.shutdown=1 \
+        echo $1 rcuperf.shutdown=1 \
                 rcuperf.verbose=1
 }
diff --git a/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt b/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt
index 66efb59a1bd1..449cf579d6f9 100644
--- a/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt
+++ b/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt
@@ -1,4 +1,4 @@
-This document describes one way to created the rcu-test-image file
+This document describes one way to create the rcu-test-image file
 that contains the filesystem used by the guest-OS kernel.  There are
 probably much better ways of doing this, and this filesystem could no
 doubt be smaller.  It is probably also possible to simply download
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 5df609950a66..168c66d74fc5 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -2860,6 +2860,7 @@ TEST(get_metadata)
         int pipefd[2];
         char buf;
         struct seccomp_metadata md;
+        long ret;
 
         ASSERT_EQ(0, pipe(pipefd));
 
@@ -2893,16 +2894,26 @@ TEST(get_metadata)
         ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid));
         ASSERT_EQ(pid, waitpid(pid, NULL, 0));
 
+        /* Past here must not use ASSERT or child process is never killed. */
+
         md.filter_off = 0;
-        ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md));
+        errno = 0;
+        ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
+        EXPECT_EQ(sizeof(md), ret) {
+                if (errno == EINVAL)
+                        XFAIL(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)");
+        }
+
         EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG);
         EXPECT_EQ(md.filter_off, 0);
 
         md.filter_off = 1;
-        ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md));
+        ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
+        EXPECT_EQ(sizeof(md), ret);
         EXPECT_EQ(md.flags, 0);
         EXPECT_EQ(md.filter_off, 1);
 
+skip:
         ASSERT_EQ(0, kill(pid, SIGKILL));
 }
 
diff --git a/tools/testing/selftests/tc-testing/README b/tools/testing/selftests/tc-testing/README
index 970ff294fec8..3a0336782d2d 100644
--- a/tools/testing/selftests/tc-testing/README
+++ b/tools/testing/selftests/tc-testing/README
@@ -14,11 +14,11 @@ REQUIREMENTS
 
 *  The kernel must have network namespace support
 
-*   The kernel must have veth support available, as a veth pair is created
+*  The kernel must have veth support available, as a veth pair is created
    prior to running the tests.
 
-*  All tc-related features must be built in or available as modules.
-   To check what is required in current setup run:
+*  All tc-related features being tested must be built in or available as
+   modules.  To check what is required in current setup run:
    ./tdc.py -c
 
    Note:
@@ -44,10 +44,13 @@ using the -p option when running tdc:
 RUNNING TDC
 -----------
 
-To use tdc, root privileges are required. tdc will not run otherwise.
+To use tdc, root privileges are required.  This is because the
+commands being tested must be run as root.  The code that enforces
+execution by root uid has been moved into a plugin (see PLUGIN
+ARCHITECTURE, below).
 
-All tests are executed inside a network namespace to prevent conflicts
-within the host.
+If nsPlugin is linked, all tests are executed inside a network
+namespace to prevent conflicts within the host.
 
 Running tdc without any arguments will run all tests. Refer to the section
 on command line arguments for more information, or run:
@@ -59,6 +62,33 @@ output captured from the failing test will be printed immediately following
 the failed test in the TAP output.
 
 
+OVERVIEW OF TDC EXECUTION
+-------------------------
+
+One run of tests is considered a "test suite" (this will be refined in the
+future).  A test suite has one or more test cases in it.
+
+A test case has four stages:
+
+  - setup
+  - execute
+  - verify
+  - teardown
+
+The setup and teardown stages can run zero or more commands.  The setup
+stage does some setup if the test needs it.  The teardown stage undoes
+the setup and returns the system to a "neutral" state so any other test
+can be run next.  These two stages require any commands run to return
+success, but do not otherwise verify the results.
+
+The execute and verify stages each run one command.  The execute stage
+tests the return code against one or more acceptable values.  The
+verify stage checks the return code for success, and also compares
+the stdout with a regular expression.
+
+Each of the commands in any stage will run in a shell instance.
+
+
 USER-DEFINED CONSTANTS
 ----------------------
 
@@ -70,23 +100,132 @@ executed as part of the test. More will be added as test cases require.
 Example:
         $TC qdisc add dev $DEV1 ingress
 
+The NAMES values are used to substitute into the commands in the test cases.
+
 
 COMMAND LINE ARGUMENTS
 ----------------------
 
 Run tdc.py -h to see the full list of available arguments.
 
--p PATH           Specify the tc executable located at PATH to be used on this
-                  test run
--c                Show the available test case categories in this test file
--c CATEGORY       Run only tests that belong to CATEGORY
--f FILE           Read test cases from the JSON file named FILE
--l [CATEGORY]     List all test cases in the JSON file. If CATEGORY is
-                  specified, list test cases matching that category.
--s ID             Show the test case matching ID
--e ID             Execute the test case identified by ID
--i                Generate unique ID numbers for test cases with no existing
-                  ID number
+usage: tdc.py [-h] [-p PATH] [-D DIR [DIR ...]] [-f FILE [FILE ...]]
+              [-c [CATG [CATG ...]]] [-e ID [ID ...]] [-l] [-s] [-i] [-v]
+              [-d DEVICE] [-n NS] [-V]
+
+Linux TC unit tests
+
+optional arguments:
+  -h, --help            show this help message and exit
+  -p PATH, --path PATH  The full path to the tc executable to use
+  -v, --verbose         Show the commands that are being run
+  -d DEVICE, --device DEVICE
+                        Execute the test case in flower category
+
+selection:
+  select which test cases: files plus directories; filtered by categories
+  plus testids
+
+  -D DIR [DIR ...], --directory DIR [DIR ...]
+                        Collect tests from the specified directory(ies)
+                        (default [tc-tests])
+  -f FILE [FILE ...], --file FILE [FILE ...]
+                        Run tests from the specified file(s)
+  -c [CATG [CATG ...]], --category [CATG [CATG ...]]
+                        Run tests only from the specified category/ies, or if
+                        no category/ies is/are specified, list known
+                        categories.
+  -e ID [ID ...], --execute ID [ID ...]
+                        Execute the specified test cases with specified IDs
+
+action:
+  select action to perform on selected test cases
+
+  -l, --list            List all test cases, or those only within the
+                        specified category
+  -s, --show            Display the selected test cases
+  -i, --id              Generate ID numbers for new test cases
+
+netns:
+  options for nsPlugin(run commands in net namespace)
+
+  -n NS, --namespace NS
+                        Run commands in namespace NS
+
+valgrind:
+  options for valgrindPlugin (run command under test under Valgrind)
+
+  -V, --valgrind        Run commands under valgrind
+
+
+PLUGIN ARCHITECTURE
+-------------------
+
+There is now a plugin architecture, and some of the functionality that
+was in the tdc.py script has been moved into the plugins.
+
+The plugins are in the directory plugin-lib.  The are executed from
+directory plugins.  Put symbolic links from plugins to plugin-lib,
+and name them according to the order you want them to run.
+
+Example:
+
+bjb@bee:~/work/tc-testing$ ls -l plugins
+total 4
+lrwxrwxrwx  1 bjb  bjb    27 Oct  4 16:12 10-rootPlugin.py -> ../plugin-lib/rootPlugin.py
+lrwxrwxrwx  1 bjb  bjb    25 Oct 12 17:55 20-nsPlugin.py -> ../plugin-lib/nsPlugin.py
+-rwxr-xr-x  1 bjb  bjb     0 Sep 29 15:56 __init__.py
+
+The plugins are a subclass of TdcPlugin, defined in TdcPlugin.py and
+must be called "SubPlugin" so tdc can find them.  They are
+distinguished from each other in the python program by their module
+name.
+
+This base class supplies "hooks" to run extra functions.  These hooks are as follows:
+
+pre- and post-suite
+pre- and post-case
+pre- and post-execute stage
+adjust-command (runs in all stages and receives the stage name)
+
+The pre-suite hook receives the number of tests and an array of test ids.
+This allows you to dump out the list of skipped tests in the event of a
+failure during setup or teardown stage.
+
+The pre-case hook receives the ordinal number and test id of the current test.
+
+The adjust-command hook receives the stage id (see list below) and the
+full command to be executed.  This allows for last-minute adjustment
+of the command.
+
+The stages are identified by the following strings:
+
+  - pre  (pre-suite)
+  - setup
+  - command
+  - verify
+  - teardown
+  - post (post-suite)
+
+
+To write a plugin, you need to inherit from TdcPlugin in
+TdcPlugin.py.  To use the plugin, you have to put the
+implementation file in plugin-lib, and add a symbolic link to it from
+plugins.  It will be detected at run time and invoked at the
+appropriate times.  There are a few examples in the plugin-lib
+directory:
+
+  - rootPlugin.py:
+      implements the enforcement of running as root
+  - nsPlugin.py:
+      sets up a network namespace and runs all commands in that namespace
+  - valgrindPlugin.py
+      runs each command in the execute stage under valgrind,
+      and checks for leaks.
+      This plugin will output an extra test for each test in the test file,
+      one is the existing output as to whether the test passed or failed,
+      and the other is a test whether the command leaked memory or not.
+      (This one is a preliminary version, it may not work quite right yet,
+      but the overall template is there and it should only need tweaks.)
 
 
 ACKNOWLEDGEMENTS
diff --git a/tools/testing/selftests/tc-testing/TODO.txt b/tools/testing/selftests/tc-testing/TODO.txt
index 6a266d811a78..c40698557e2f 100644
--- a/tools/testing/selftests/tc-testing/TODO.txt
+++ b/tools/testing/selftests/tc-testing/TODO.txt
@@ -5,6 +5,27 @@ tc Testing Suite To-Do list:
 
 - Add support for multiple versions of tc to run successively
 
-- Improve error messages when tdc aborts its run
+- Improve error messages when tdc aborts its run.  Partially done - still
+  need to better handle problems in pre- and post-suite.
 
-- Allow tdc to write its results to file
+- Use python logger module for debug/verbose output
+
+- Allow tdc to write its results to file.
+  Maybe use python logger module for this too.
+
+- A better implementation of the "hooks".  Currently, every plugin
+  will attempt to run a function at every hook point.  Could be
+  changed so that plugin __init__ methods will register functions to
+  be run in the various predefined times.  Then if a plugin does not
+  require action at a specific point, no penalty will be paid for
+  trying to run a function that will do nothing.
+
+- Proper exception handling - make an exception class and use it
+
+- a TestCase class, for easier testcase handling, searching, comparison
+
+- a TestSuite class
+  and a way to configure a test suite,
+  to automate running multiple "test suites" with different requirements
+
+- super simple test case example using ls, touch, etc
diff --git a/tools/testing/selftests/tc-testing/TdcPlugin.py b/tools/testing/selftests/tc-testing/TdcPlugin.py
new file mode 100644
index 000000000000..3ee9a6dacb52
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/TdcPlugin.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+
+class TdcPlugin:
+    def __init__(self):
+        super().__init__()
+        print(' -- {}.__init__'.format(self.sub_class))
+
+    def pre_suite(self, testcount, testidlist):
+        '''run commands before test_runner goes into a test loop'''
+        self.testcount = testcount
+        self.testidlist = testidlist
+        if self.args.verbose > 1:
+            print(' -- {}.pre_suite'.format(self.sub_class))
+
+    def post_suite(self, index):
+        '''run commands after test_runner completes the test loop
+        index is the last ordinal number of test that was attempted'''
+        if self.args.verbose > 1:
+            print(' -- {}.post_suite'.format(self.sub_class))
+
+    def pre_case(self, test_ordinal, testid):
+        '''run commands before test_runner does one test'''
+        if self.args.verbose > 1:
+            print(' -- {}.pre_case'.format(self.sub_class))
+        self.args.testid = testid
+        self.args.test_ordinal = test_ordinal
+
+    def post_case(self):
+        '''run commands after test_runner does one test'''
+        if self.args.verbose > 1:
+            print(' -- {}.post_case'.format(self.sub_class))
+
+    def pre_execute(self):
+        '''run command before test-runner does the execute step'''
+        if self.args.verbose > 1:
+            print(' -- {}.pre_execute'.format(self.sub_class))
+
+    def post_execute(self):
+        '''run command after test-runner does the execute step'''
+        if self.args.verbose > 1:
+            print(' -- {}.post_execute'.format(self.sub_class))
+
+    def adjust_command(self, stage, command):
+        '''adjust the command'''
+        if self.args.verbose > 1:
+            print(' -- {}.adjust_command {}'.format(self.sub_class, stage))
+
+        # if stage == 'pre':
+        #     pass
+        # elif stage == 'setup':
+        #     pass
+        # elif stage == 'execute':
+        #     pass
+        # elif stage == 'verify':
+        #     pass
+        # elif stage == 'teardown':
+        #     pass
+        # elif stage == 'post':
+        #     pass
+        # else:
+        #     pass
+
+        return command
+
+    def add_args(self, parser):
+        '''Get the plugin args from the command line'''
+        self.argparser = parser
+        return self.argparser
+
+    def check_args(self, args, remaining):
+        '''Check that the args are set correctly'''
+        self.args = args
+        if self.args.verbose > 1:
+            print(' -- {}.check_args'.format(self.sub_class))
diff --git a/tools/testing/selftests/tc-testing/creating-plugins/AddingPlugins.txt b/tools/testing/selftests/tc-testing/creating-plugins/AddingPlugins.txt
new file mode 100644
index 000000000000..c18f88d09360
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/creating-plugins/AddingPlugins.txt
@@ -0,0 +1,104 @@
+tdc - Adding plugins for tdc
+
+Author: Brenda J. Butler - bjb@mojatatu.com
+
+ADDING PLUGINS
+--------------
+
+A new plugin should be written in python as a class that inherits from TdcPlugin.
+There are some examples in plugin-lib.
+
+The plugin can be used to add functionality to the test framework,
+such as:
+
+- adding commands to be run before and/or after the test suite
+- adding commands to be run before and/or after the test cases
+- adding commands to be run before and/or after the execute phase of the test cases
+- ability to alter the command to be run in any phase:
+    pre        (the pre-suite stage)
+    prepare
+    execute
+    verify
+    teardown
+    post       (the post-suite stage)
+- ability to add to the command line args, and use them at run time
+
+
+The functions in the class should follow the following interfaces:
+
+    def __init__(self)
+    def pre_suite(self, testcount, testidlist)     # see "PRE_SUITE" below
+    def post_suite(self, ordinal)                  # see "SKIPPING" below
+    def pre_case(self, test_ordinal, testid)       # see "PRE_CASE" below
+    def post_case(self)
+    def pre_execute(self)
+    def post_execute(self)
+    def adjust_command(self, stage, command)       # see "ADJUST" below
+    def add_args(self, parser)                     # see "ADD_ARGS" below
+    def check_args(self, args, remaining)          # see "CHECK_ARGS" below
+
+
+PRE_SUITE
+
+This method takes a testcount (number of tests to be run) and
+testidlist (array of test ids for tests that will be run).  This is
+useful for various things, including when an exception occurs and the
+rest of the tests must be skipped.  The info is stored in the object,
+and the post_suite method can refer to it when dumping the "skipped"
+TAP output.  The tdc.py script will do that for the test suite as
+defined in the test case, but if the plugin is being used to run extra
+tests on each test (eg, check for memory leaks on associated
+co-processes) then that other tap output can be generated in the
+post-suite method using this info passed in to the pre_suite method.
+
+
+SKIPPING
+
+The post_suite method will receive the ordinal number of the last
+test to be attempted.  It can use this info when outputting
+the TAP output for the extra test cases.
+
+
+PRE_CASE
+
+The pre_case method will receive the ordinal number of the test
+and the test id.  Useful for outputing the extra test results.
+
+
+ADJUST
+
+The adjust_command method receives a string representing
+the execution stage and a string which is the actual command to be
+executed.  The plugin can adjust the command, based on the stage of
+execution.
+
+The stages are represented by the following strings:
+
+    'pre'
+    'setup'
+    'command'
+    'verify'
+    'teardown'
+    'post'
+
+The adjust_command method must return the adjusted command so tdc
+can use it.
+
+
+ADD_ARGS
+
+The add_args method receives the argparser object and can add
+arguments to it.  Care should be taken that the new arguments do not
+conflict with any from tdc.py or from other plugins that will be used
+concurrently.
+
+The add_args method should return the argparser object.
+
+
+CHECK_ARGS
+
+The check_args method is so that the plugin can do validation on
+the args, if needed.  If there is a problem, and Exception should
+be raised, with a string that explains the problem.
+
+eg:  raise Exception('plugin xxx, arg -y is wrong, fix it')
diff --git a/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt b/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt
index 00438331ba47..17b267dedbd9 100644
--- a/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt
+++ b/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt
@@ -12,14 +12,18 @@ template.json for the required JSON format for test cases.
 Include the 'id' field, but do not assign a value. Running tdc with the -i
 option will generate a unique ID for that test case.
 
-tdc will recursively search the 'tc' subdirectory for .json files.  Any
-test case files you create in these directories will automatically be included.
-If you wish to store your custom test cases elsewhere, be sure to run tdc
-with the -f argument and the path to your file.
+tdc will recursively search the 'tc-tests' subdirectory (or the
+directories named with the -D option) for .json files.  Any test case
+files you create in these directories will automatically be included.
+If you wish to store your custom test cases elsewhere, be sure to run
+tdc with the -f argument and the path to your file, or the -D argument
+and the path to your directory(ies).
 
-Be aware of required escape characters in the JSON data - particularly when
-defining the match pattern. Refer to the tctests.json file for examples when
-in doubt.
+Be aware of required escape characters in the JSON data - particularly
+when defining the match pattern. Refer to the supplied json test files
+for examples when in doubt.  The match pattern is written in json, and
+will be used by python.  So the match pattern will be a python regular
+expression, but should be written using json syntax.
 
 
 TEST CASE STRUCTURE
@@ -69,7 +73,8 @@ SETUP/TEARDOWN ERRORS
 If an error is detected during the setup/teardown process, execution of the
 tests will immediately stop with an error message and the namespace in which
 the tests are run will be destroyed. This is to prevent inaccurate results
-in the test cases.
+in the test cases.  tdc will output a series of TAP results for the skipped
+tests.
 
 Repeated failures of the setup/teardown may indicate a problem with the test
 case, or possibly even a bug in one of the commands that are not being tested.
@@ -79,3 +84,17 @@ so that it doesn't halt the script for an error that doesn't matter. Turn the
 individual command into a list, with the command being first, followed by all
 acceptable exit codes for the command.
 
+Example:
+
+A pair of setup commands.  The first can have exit code 0, 1 or 255, the
+second must have exit code 0.
+
+        "setup": [
+            [
+                "$TC actions flush action gact",
+                0,
+                1,
+                255
+            ],
+            "$TC actions add action reclassify index 65536"
+        ],
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/README-PLUGINS b/tools/testing/selftests/tc-testing/plugin-lib/README-PLUGINS
new file mode 100644
index 000000000000..aa8a2669702b
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/README-PLUGINS
@@ -0,0 +1,27 @@
+tdc.py will look for plugins in a directory plugins off the cwd.
+Make a set of numbered symbolic links from there to the actual plugins.
+Eg:
+
+tdc.py
+plugin-lib/
+plugins/
+    __init__.py
+    10-rootPlugin.py -> ../plugin-lib/rootPlugin.py
+    20-valgrindPlugin.py -> ../plugin-lib/valgrindPlugin.py
+    30-nsPlugin.py -> ../plugin-lib/nsPlugin.py
+
+
+tdc.py will find them and use them.
+
+
+rootPlugin
+    Check if the uid is root.  If not, bail out.
+
+valgrindPlugin
+    Run the command under test with valgrind, and produce an extra set of TAP results for the memory tests.
+    This plugin will write files to the cwd, called vgnd-xxx.log.  These will contain
+    the valgrind output for test xxx.  Any file matching the glob 'vgnd-*.log' will be
+    deleted at the end of the run.
+
+nsPlugin
+    Run all the commands in a network namespace.
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/nsPlugin.py b/tools/testing/selftests/tc-testing/plugin-lib/nsPlugin.py
new file mode 100644
index 000000000000..a194b1af2b30
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/nsPlugin.py
@@ -0,0 +1,141 @@
+import os
+import signal
+from string import Template
+import subprocess
+import time
+from TdcPlugin import TdcPlugin
+
+from tdc_config import *
+
+class SubPlugin(TdcPlugin):
+    def __init__(self):
+        self.sub_class = 'ns/SubPlugin'
+        super().__init__()
+
+    def pre_suite(self, testcount, testidlist):
+        '''run commands before test_runner goes into a test loop'''
+        super().pre_suite(testcount, testidlist)
+
+        if self.args.namespace:
+            self._ns_create()
+
+    def post_suite(self, index):
+        '''run commands after test_runner goes into a test loop'''
+        super().post_suite(index)
+        if self.args.verbose:
+            print('{}.post_suite'.format(self.sub_class))
+
+        if self.args.namespace:
+            self._ns_destroy()
+
+    def add_args(self, parser):
+        super().add_args(parser)
+        self.argparser_group = self.argparser.add_argument_group(
+            'netns',
+            'options for nsPlugin(run commands in net namespace)')
+        self.argparser_group.add_argument(
+            '-n', '--namespace', action='store_true',
+            help='Run commands in namespace')
+        return self.argparser
+
+    def adjust_command(self, stage, command):
+        super().adjust_command(stage, command)
+        cmdform = 'list'
+        cmdlist = list()
+
+        if not self.args.namespace:
+            return command
+
+        if self.args.verbose:
+            print('{}.adjust_command'.format(self.sub_class))
+
+        if not isinstance(command, list):
+            cmdform = 'str'
+            cmdlist = command.split()
+        else:
+            cmdlist = command
+        if stage == 'setup' or stage == 'execute' or stage == 'verify' or stage == 'teardown':
+            if self.args.verbose:
+                print('adjust_command:  stage is {}; inserting netns stuff in command [{}] list [{}]'.format(stage, command, cmdlist))
+            cmdlist.insert(0, self.args.NAMES['NS'])
+            cmdlist.insert(0, 'exec')
+            cmdlist.insert(0, 'netns')
+            cmdlist.insert(0, 'ip')
+        else:
+            pass
+
+        if cmdform == 'str':
+            command = ' '.join(cmdlist)
+        else:
+            command = cmdlist
+
+        if self.args.verbose:
+            print('adjust_command:  return command [{}]'.format(command))
+        return command
+
+    def _ns_create(self):
+        '''
+        Create the network namespace in which the tests will be run and set up
+        the required network devices for it.
+        '''
+        if self.args.namespace:
+            cmd = 'ip netns add {}'.format(self.args.NAMES['NS'])
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip link add $DEV0 type veth peer name $DEV1'
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip link set $DEV1 netns {}'.format(self.args.NAMES['NS'])
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip link set $DEV0 up'
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip -n {} link set $DEV1 up'.format(self.args.NAMES['NS'])
+            self._exec_cmd('pre', cmd)
+            if self.args.device:
+                cmd = 'ip link set $DEV2 netns {}'.format(self.args.NAMES['NS'])
+                self._exec_cmd('pre', cmd)
+                cmd = 'ip -n {} link set $DEV2 up'.format(self.args.NAMES['NS'])
+                self._exec_cmd('pre', cmd)
+
+    def _ns_destroy(self):
+        '''
+        Destroy the network namespace for testing (and any associated network
+        devices as well)
+        '''
+        if self.args.namespace:
+            cmd = 'ip netns delete {}'.format(self.args.NAMES['NS'])
+            self._exec_cmd('post', cmd)
+
+    def _exec_cmd(self, stage, command):
+        '''
+        Perform any required modifications on an executable command, then run
+        it in a subprocess and return the results.
+        '''
+        if '$' in command:
+            command = self._replace_keywords(command)
+
+        self.adjust_command(stage, command)
+        if self.args.verbose:
+            print('_exec_cmd:  command "{}"'.format(command))
+        proc = subprocess.Popen(command,
+            shell=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            env=ENVIR)
+        (rawout, serr) = proc.communicate()
+
+        if proc.returncode != 0 and len(serr) > 0:
+            foutput = serr.decode("utf-8")
+        else:
+            foutput = rawout.decode("utf-8")
+
+        proc.stdout.close()
+        proc.stderr.close()
+        return proc, foutput
+
+    def _replace_keywords(self, cmd):
+        """
+        For a given executable command, substitute any known
+        variables contained within NAMES with the correct values
+        """
+        tcmd = Template(cmd)
+        subcmd = tcmd.safe_substitute(self.args.NAMES)
+        return subcmd
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/rootPlugin.py b/tools/testing/selftests/tc-testing/plugin-lib/rootPlugin.py
new file mode 100644
index 000000000000..e36775bd4d12
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/rootPlugin.py
@@ -0,0 +1,19 @@
+import os
+import sys
+from TdcPlugin import TdcPlugin
+
+from tdc_config import *
+
+
+class SubPlugin(TdcPlugin):
+    def __init__(self):
+        self.sub_class = 'root/SubPlugin'
+        super().__init__()
+
+    def pre_suite(self, testcount, testidlist):
+        # run commands before test_runner goes into a test loop
+        super().pre_suite(testcount, testidlist)
+
+        if os.geteuid():
+            print('This script must be run with root privileges', file=sys.stderr)
+            exit(1)
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/valgrindPlugin.py b/tools/testing/selftests/tc-testing/plugin-lib/valgrindPlugin.py
new file mode 100644
index 000000000000..477a7bd7d7fb
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/valgrindPlugin.py
@@ -0,0 +1,142 @@
+'''
+run the command under test, under valgrind and collect memory leak info
+as a separate test.
+'''
+
+
+import os
+import re
+import signal
+from string import Template
+import subprocess
+import time
+from TdcPlugin import TdcPlugin
+
+from tdc_config import *
+
+def vp_extract_num_from_string(num_as_string_maybe_with_commas):
+    return int(num_as_string_maybe_with_commas.replace(',',''))
+
+class SubPlugin(TdcPlugin):
+    def __init__(self):
+        self.sub_class = 'valgrind/SubPlugin'
+        self.tap = ''
+        super().__init__()
+
+    def pre_suite(self, testcount, testidlist):
+        '''run commands before test_runner goes into a test loop'''
+        super().pre_suite(testcount, testidlist)
+        if self.args.verbose > 1:
+            print('{}.pre_suite'.format(self.sub_class))
+        if self.args.valgrind:
+            self._add_to_tap('1..{}\n'.format(self.testcount))
+
+    def post_suite(self, index):
+        '''run commands after test_runner goes into a test loop'''
+        super().post_suite(index)
+        self._add_to_tap('\n|---\n')
+        if self.args.verbose > 1:
+            print('{}.post_suite'.format(self.sub_class))
+        print('{}'.format(self.tap))
+        if self.args.verbose < 4:
+            subprocess.check_output('rm -f vgnd-*.log', shell=True)
+
+    def add_args(self, parser):
+        super().add_args(parser)
+        self.argparser_group = self.argparser.add_argument_group(
+            'valgrind',
+            'options for valgrindPlugin (run command under test under Valgrind)')
+
+        self.argparser_group.add_argument(
+            '-V', '--valgrind', action='store_true',
+            help='Run commands under valgrind')
+
+        return self.argparser
+
+    def adjust_command(self, stage, command):
+        super().adjust_command(stage, command)
+        cmdform = 'list'
+        cmdlist = list()
+
+        if not self.args.valgrind:
+            return command
+
+        if self.args.verbose > 1:
+            print('{}.adjust_command'.format(self.sub_class))
+
+        if not isinstance(command, list):
+            cmdform = 'str'
+            cmdlist = command.split()
+        else:
+            cmdlist = command
+
+        if stage == 'execute':
+            if self.args.verbose > 1:
+                print('adjust_command:  stage is {}; inserting valgrind stuff in command [{}] list [{}]'.
+                      format(stage, command, cmdlist))
+            cmdlist.insert(0, '--track-origins=yes')
+            cmdlist.insert(0, '--show-leak-kinds=definite,indirect')
+            cmdlist.insert(0, '--leak-check=full')
+            cmdlist.insert(0, '--log-file=vgnd-{}.log'.format(self.args.testid))
+            cmdlist.insert(0, '-v')  # ask for summary of non-leak errors
+            cmdlist.insert(0, ENVIR['VALGRIND_BIN'])
+        else:
+            pass
+
+        if cmdform == 'str':
+            command = ' '.join(cmdlist)
+        else:
+            command = cmdlist
+
+        if self.args.verbose > 1:
+            print('adjust_command:  return command [{}]'.format(command))
+        return command
+
+    def post_execute(self):
+        if not self.args.valgrind:
+            return
+
+        self.definitely_lost_re = re.compile(
+            r'definitely lost:\s+([,0-9]+)\s+bytes in\s+([,0-9]+)\sblocks', re.MULTILINE | re.DOTALL)
+        self.indirectly_lost_re = re.compile(
+            r'indirectly lost:\s+([,0-9]+)\s+bytes in\s+([,0-9]+)\s+blocks', re.MULTILINE | re.DOTALL)
+        self.possibly_lost_re = re.compile(
+            r'possibly lost:\s+([,0-9]+)bytes in\s+([,0-9]+)\s+blocks', re.MULTILINE | re.DOTALL)
+        self.non_leak_error_re = re.compile(
+            r'ERROR SUMMARY:\s+([,0-9]+) errors from\s+([,0-9]+)\s+contexts', re.MULTILINE | re.DOTALL)
+
+        def_num = 0
+        ind_num = 0
+        pos_num = 0
+        nle_num = 0
+
+        # what about concurrent test runs?  Maybe force them to be in different directories?
+        with open('vgnd-{}.log'.format(self.args.testid)) as vfd:
+            content = vfd.read()
+            def_mo = self.definitely_lost_re.search(content)
+            ind_mo = self.indirectly_lost_re.search(content)
+            pos_mo = self.possibly_lost_re.search(content)
+            nle_mo = self.non_leak_error_re.search(content)
+
+            if def_mo:
+                def_num = int(def_mo.group(2))
+            if ind_mo:
+                ind_num = int(ind_mo.group(2))
+            if pos_mo:
+                pos_num = int(pos_mo.group(2))
+            if nle_mo:
+                nle_num = int(nle_mo.group(1))
+
+        mem_results = ''
+        if (def_num > 0) or (ind_num > 0) or (pos_num > 0) or (nle_num > 0):
+            mem_results += 'not '
+
+        mem_results += 'ok {} - {}-mem # {}\n'.format(
+            self.args.test_ordinal, self.args.testid, 'memory leak check')
+        self._add_to_tap(mem_results)
+        if mem_results.startswith('not '):
+            print('{}'.format(content))
+            self._add_to_tap(content)
+
+    def _add_to_tap(self, more_tap_output):
+        self.tap += more_tap_output
diff --git a/tools/testing/selftests/tc-testing/plugins/__init__.py b/tools/testing/selftests/tc-testing/plugins/__init__.py
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugins/__init__.py
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json b/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
new file mode 100644
index 000000000000..6f289a49e5ec
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
@@ -0,0 +1,294 @@
+[
+    {
+        "id": "d959",
+        "name": "Add cBPF action with valid bytecode",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC action flush action bpf",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' index 100",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action get action bpf index 100",
+        "matchPattern": "action order [0-9]*: bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' default-action pipe.*index 100 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC action flush action bpf"
+        ]
+    },
+    {
+        "id": "f84a",
+        "name": "Add cBPF action with invalid bytecode",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action add action bpf bytecode '4,40 0 0 12,31 0 1 2048,6 0 0 262144,6 0 0 0' index 100",
+        "expExitCode": "255",
+        "verifyCmd": "$TC action get action bpf index 100",
+        "matchPattern": "action order [0-9]*: bpf bytecode '4,40 0 0 12,31 0 1 2048,6 0 0 262144,6 0 0 0' default-action pipe.*index 100 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action bpf"
+        ]
+    },
+    {
+        "id": "e939",
+        "name": "Add eBPF action with valid object-file",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            "printf '#include <linux/bpf.h>\nchar l[] __attribute__((section(\"license\"),used))=\"GPL\"; __attribute__((section(\"action\"),used)) int m(struct __sk_buff *s) { return 2; }' | clang -O2 -x c -c - -target bpf -o _b.o",
+            [
+                "$TC action flush action bpf",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action add action bpf object-file _b.o index 667",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action get action bpf index 667",
+        "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9]* tag 3b185187f1855c4c( jited)? default-action pipe.*index 667 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC action flush action bpf",
+            "rm -f _b.o"
+        ]
+    },
+    {
+        "id": "282d",
+        "name": "Add eBPF action with invalid object-file",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            "printf '#include <linux/bpf.h>\nchar l[] __attribute__((section(\"license\"),used))=\"GPL\"; __attribute__((section(\"action\"),used)) int m(struct __sk_buff *s) { s->data = 0x0; return 2; }' | clang -O2 -x c -c - -target bpf -o _c.o",
+            [
+                "$TC action flush action bpf",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action add action bpf object-file _c.o index 667",
+        "expExitCode": "255",
+        "verifyCmd": "$TC action get action bpf index 667",
+        "matchPattern": "action order [0-9]*: bpf _c.o:\\[action\\] id [0-9].*index 667 ref",
+        "matchCount": "0",
+        "teardown": [
+            [
+                "$TC action flush action bpf",
+                0,
+                1,
+                255
+            ],
+            "rm -f _c.o"
+        ]
+    },
+    {
+        "id": "d819",
+        "name": "Replace cBPF bytecode and action control",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ],
+            [
+                "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' index 555",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action replace action bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' drop index 555",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action get action bpf index 555",
+        "matchPattern": "action order [0-9]*: bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' default-action drop.*index 555 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC action flush action bpf"
+        ]
+    },
+    {
+        "id": "6ae3",
+        "name": "Delete cBPF action ",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ],
+            [
+                "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' index 444",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action delete action bpf index 444",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action get action bpf index 444",
+        "matchPattern": "action order [0-9]*: bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' default-action pipe.*index 444 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC action flush action bpf"
+        ]
+    },
+    {
+        "id": "3e0d",
+        "name": "List cBPF actions",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC action flush action bpf",
+                0,
+                1,
+                255
+            ],
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' ok index 101",
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' drop index 102",
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 33024,6 0 0 262144,6 0 0 0' continue index 103"
+        ],
+        "cmdUnderTest": "$TC action list action bpf",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action list action bpf",
+        "matchPattern": "action order [0-9]*: bpf bytecode",
+        "matchCount": "3",
+        "teardown": [
+            "$TC actions flush action bpf"
+        ]
+    },
+    {
+        "id": "55ce",
+        "name": "Flush BPF actions",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ],
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' ok index 101",
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' drop index 102",
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 33024,6 0 0 262144,6 0 0 0' continue index 103"
+        ],
+        "cmdUnderTest": "$TC action flush action bpf",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action list action bpf",
+        "matchPattern": "action order [0-9]*: bpf bytecode",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action bpf"
+        ]
+    },
+    {
+        "id": "ccc3",
+        "name": "Add cBPF action with duplicate index",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ],
+            "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' index 4294967295"
+        ],
+        "cmdUnderTest": "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' index 4294967295",
+        "expExitCode": "255",
+        "verifyCmd": "$TC action get action bpf index 4294967295",
+        "matchPattern": "action order [0-9]*: bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' default-action pipe.*index 4294967295",
+        "matchCount": "1",
+        "teardown": [
+            "$TC action flush action bpf"
+        ]
+    },
+    {
+        "id": "89c7",
+        "name": "Add cBPF action with invalid index",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' index 4294967296 cookie 12345",
+        "expExitCode": "255",
+        "verifyCmd": "$TC action ls action bpf",
+        "matchPattern": "action order [0-9]*: bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' default-action pipe.*cookie 12345",
+        "matchCount": "0",
+        "teardown": [
+            "$TC action flush action bpf"
+        ]
+    },
+    {
+        "id": "7ab9",
+        "name": "Add cBPF action with cookie",
+        "category": [
+            "actions",
+            "bpf"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action bpf",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC action add action bpf bytecode '4,40 0 0 12,21 0 1 2054,6 0 0 262144,6 0 0 0' cookie d0d0d0d0d0d0d0d0",
+        "expExitCode": "0",
+        "verifyCmd": "$TC action list action bpf",
+        "matchPattern": "action order [0-9]*: bpf.*cookie d0d0d0d0d0d0d0",
+        "matchCount": "1",
+        "teardown": [
+            "$TC action flush action bpf"
+        ]
+    }
+]
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json b/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json
new file mode 100644
index 000000000000..70952bd98ff9
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json
@@ -0,0 +1,291 @@
+[
+    {
+        "id": "2002",
+        "name": "Add valid connmark action with defaults",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action connmark",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 pipe",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "56a5",
+        "name": "Add valid connmark action with control pass",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark pass index 1",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action connmark index 1",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 pass.*index 1 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "7c66",
+        "name": "Add valid connmark action with control drop",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark drop index 100",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action connmark index 100",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 drop.*index 100 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "a913",
+        "name": "Add valid connmark action with control pipe",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark pipe index 455",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action connmark index 455",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 pipe.*index 455 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "bdd8",
+        "name": "Add valid connmark action with control reclassify",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark reclassify index 7",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action connmark",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 reclassify.*index 7 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "b8be",
+        "name": "Add valid connmark action with control continue",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark continue index 17",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action connmark",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 continue.*index 17 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "d8a6",
+        "name": "Add valid connmark action with control jump",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark jump 10 index 17",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action connmark",
+        "matchPattern": "action order [0-9]+:  connmark zone 0 jump 10.*index 17 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "aae8",
+        "name": "Add valid connmark action with zone argument",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark zone 100 pipe index 1",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action connmark index 1",
+        "matchPattern": "action order [0-9]+:  connmark zone 100 pipe.*index 1 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "2f0b",
+        "name": "Add valid connmark action with invalid zone argument",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark zone 65536 reclassify index 21",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions get action connmark index 1",
+        "matchPattern": "action order [0-9]+:  connmark zone 65536 reclassify.*index 21 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "9305",
+        "name": "Add connmark action with unsupported argument",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark zone 655 unsupp_arg pass index 2",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions get action connmark index 2",
+        "matchPattern": "action order [0-9]+:  connmark zone 655 unsupp_arg pass.*index 2 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "71ca",
+        "name": "Add valid connmark action and replace it",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ],
+            "$TC actions add action connmark zone 777 pass index 555"
+        ],
+        "cmdUnderTest": "$TC actions replace action connmark zone 555 reclassify index 555",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action connmark index 555",
+        "matchPattern": "action order [0-9]+:  connmark zone 555 reclassify.*index 555 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    },
+    {
+        "id": "5f8f",
+        "name": "Add valid connmark action with cookie",
+        "category": [
+            "actions",
+            "connmark"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action connmark",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action connmark zone 555 pipe index 5 cookie aabbccddeeff112233445566778800a1",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action connmark index 5",
+        "matchPattern": "action order [0-9]+:  connmark zone 555 pipe.*index 5 ref.*cookie aabbccddeeff112233445566778800a1",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action connmark"
+        ]
+    }
+]
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json b/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json
new file mode 100644
index 000000000000..93cf8fea8ae7
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json
@@ -0,0 +1,410 @@
+[
+    {
+        "id": "6d84",
+        "name": "Add csum iph action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum iph index 800",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 800",
+        "matchPattern": "action order [0-9]*: csum \\(iph\\) action pass.*index 800 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "1862",
+        "name": "Add csum ip4h action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum ip4h index 7",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 7",
+        "matchPattern": "action order [0-9]*: csum \\(iph\\) action pass.*index 7 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "15c6",
+        "name": "Add csum ipv4h action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum ipv4h index 1122",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 1122",
+        "matchPattern": "action order [0-9]*: csum \\(iph\\) action pass.*index 1122 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "bf47",
+        "name": "Add csum icmp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum icmp index 1",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 1",
+        "matchPattern": "action order [0-9]*: csum \\(icmp\\) action pass.*index 1 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "cc1d",
+        "name": "Add csum igmp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum igmp index 999",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 999",
+        "matchPattern": "action order [0-9]*: csum \\(igmp\\) action pass.*index 999 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "bccc",
+        "name": "Add csum foobar action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum foobar index 1",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action csum",
+        "matchPattern": "action order [0-9]*: csum \\(foobar\\) action pass.*index 1 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "3bb4",
+        "name": "Add csum tcp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum tcp index 9999",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 9999",
+        "matchPattern": "action order [0-9]*: csum \\(tcp\\) action pass.*index 9999 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "759c",
+        "name": "Add csum udp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum udp index 334455",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 334455",
+        "matchPattern": "action order [0-9]*: csum \\(udp\\) action pass.*index 334455 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "bdb6",
+        "name": "Add csum udp xor iph action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum udp xor iph index 3",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action csum",
+        "matchPattern": "action order [0-9]*: csum \\(udp xor iph\\) action pass.*index 3 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "c220",
+        "name": "Add csum udplite action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum udplite continue index 3",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 3",
+        "matchPattern": "action order [0-9]*: csum \\(udplite\\) action continue.*index 3 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "8993",
+        "name": "Add csum sctp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum sctp index 777",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 777",
+        "matchPattern": "action order [0-9]*: csum \\(sctp\\) action pass.*index 777 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "b138",
+        "name": "Add csum ip & icmp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum ip and icmp pipe index 123",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 123",
+        "matchPattern": "action order [0-9]*: csum \\(iph, icmp\\) action pipe.*index 123 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "eeda",
+        "name": "Add csum ip & sctp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum ipv4h sctp continue index 2",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 2",
+        "matchPattern": "action order [0-9]*: csum \\(iph, sctp\\) action continue.*index 2 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "0017",
+        "name": "Add csum udp or tcp action",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum udp or tcp continue index 27",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 27",
+        "matchPattern": "action order [0-9]*: csum \\(tcp, udp\\) action continue.*index 27 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "ce92",
+        "name": "Add csum udp action with cookie",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum udp pipe index 7 cookie 12345678",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 7",
+        "matchPattern": "action order [0-9]*: csum \\(udp\\) action pipe.*index 7.*cookie 12345678",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "912f",
+        "name": "Add csum icmp action with large cookie",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action csum icmp pipe index 17 cookie aabbccddeeff1122",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action csum index 17",
+        "matchPattern": "action order [0-9]*: csum \\(icmp\\) action pipe.*index 17.*cookie aabbccddeeff1122",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "879b",
+        "name": "Add batch of 32 csum tcp actions",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "for i in `seq 1 32`; do cmd=\"action csum tcp continue index $i \"; args=\"$args$cmd\"; done && $TC actions add $args",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action csum",
+        "matchPattern": "^[ \t]+index [0-9]* ref",
+        "matchCount": "32",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    }
+]
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/gact.json b/tools/testing/selftests/tc-testing/tc-tests/actions/gact.json
index e2187b6e0b7a..68c91023cdb9 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/gact.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/gact.json
@@ -465,5 +465,76 @@
         "teardown": [
             "$TC actions flush action gact"
         ]
+    },
+    {
+        "id": "1021",
+        "name": "Add batch of 32 gact pass actions",
+        "category": [
+            "actions",
+            "gact"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action gact",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action pass index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action gact",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "32",
+        "teardown": [
+            "$TC actions flush action gact"
+        ]
+    },
+    {
+        "id": "da7a",
+        "name": "Add batch of 32 gact continue actions with cookie",
+        "category": [
+            "actions",
+            "gact"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action gact",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action continue index \\$i cookie aabbccddeeff112233445566778800a1 \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action gact",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "32",
+        "teardown": [
+            "$TC actions flush action gact"
+        ]
+    },
+    {
+        "id": "8aa3",
+        "name": "Delete batch of 32 gact continue actions",
+        "category": [
+            "actions",
+            "gact"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action gact",
+                0,
+                1,
+                255
+            ],
+            "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action continue index \\$i \\\"; args=\\\"\\$args\\$cmd\\\"; done && $TC actions add \\$args\""
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action gact index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions del \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action gact",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "0",
+        "teardown": []
     }
 ]
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
index 0fcccf18399b..443c9b3c8664 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
@@ -171,6 +171,198 @@
         ]
     },
     {
+        "id": "8917",
+        "name": "Add mirred mirror action with control pass",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo pass index 1",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 1",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) pass.*index 1 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "1054",
+        "name": "Add mirred mirror action with control pipe",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo pipe index 15",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 15",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) pipe.*index 15 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "9887",
+        "name": "Add mirred mirror action with control continue",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo continue index 15",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 15",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) continue.*index 15 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "e4aa",
+        "name": "Add mirred mirror action with control reclassify",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo reclassify index 150",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 150",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) reclassify.*index 150 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "ece9",
+        "name": "Add mirred mirror action with control drop",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo drop index 99",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 99",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) drop.*index 99 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "0031",
+        "name": "Add mirred mirror action with control jump",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo jump 10 index 99",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 99",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) jump 10.*index 99 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "407c",
+        "name": "Add mirred mirror action with cookie",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo reclassify cookie aa11bb22cc33dd44ee55",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions ls action mirred",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) reclassify.*cookie aa11bb22cc33dd44ee55",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
+        "id": "8b69",
+        "name": "Add mirred mirror action with maximum index",
+        "category": [
+            "actions",
+            "mirred"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action mirred",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action mirred ingress mirror dev lo pipe index 4294967295",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 4294967295",
+        "matchPattern": "action order [0-9]*: mirred \\(Ingress Mirror to device lo\\) pipe.*index 4294967295",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
         "id": "a70e",
         "name": "Delete mirred mirror action",
         "category": [
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/police.json b/tools/testing/selftests/tc-testing/tc-tests/actions/police.json
index 0e602a3f9393..38d85a1d7492 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/police.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/police.json
@@ -265,6 +265,150 @@
         ]
     },
     {
+        "id": "ddd6",
+        "name": "Add police action with invalid rate value",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 3tb burst 250k conform-exceed pass/pipe index 5",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action police",
+        "matchPattern": "action order [0-9]*:  police 0x5 rate 3Tb burst 250Kb mtu 2Kb action pass/pipe",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
+        "id": "f61c",
+        "name": "Add police action with invalid burst value",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 3kbit burst 250P conform-exceed pass/pipe index 5",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action police",
+        "matchPattern": "action order [0-9]*:  police 0x5 rate 3Kbit burst 250Pb mtu 2Kb action pass/pipe",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
+        "id": "c26f",
+        "name": "Add police action with invalid peakrate value",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 90kbit burst 10k mtu 2kb peakrate 100T index 1",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action police",
+        "matchPattern": "action order [0-9]*:  police 0x1 rate 90Kbit burst 10Kb mtu 2Kb peakrate 100Tbit",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
+        "id": "db04",
+        "name": "Add police action with invalid mtu value",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 10kbit burst 10k mtu 2Pbit index 1",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action police",
+        "matchPattern": "action order [0-9]*:  police 0x1 rate 10Kbit burst 1Kb mtu 2Pb",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
+        "id": "f3c9",
+        "name": "Add police action with cookie",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 10mbit burst 10k index 1 cookie a1b1c1d1e1f12233bb",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action police index 1",
+        "matchPattern": "action order [0-9]*:  police 0x1 rate 10Mbit burst 10Kb mtu 2Kb.*cookie a1b1c1d1e1f12233bb",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
+        "id": "d190",
+        "name": "Add police action with maximum index",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 10mbit burst 10k index 4294967295",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action mirred index 4294967295",
+        "matchPattern": "action order [0-9]*:  police 0xffffffff rate 10Mbit burst 10Kb mtu 2Kb",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action mirred"
+        ]
+    },
+    {
         "id": "336e",
         "name": "Delete police action",
         "category": [
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json b/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json
index 99635ea4722e..37ecc2716fee 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json
@@ -216,6 +216,174 @@
         ]
     },
     {
+        "id": "464a",
+        "name": "Add skbedit action with control pipe",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit ptype host pipe index 11",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 11",
+        "matchPattern": "action order [0-9]*:  skbedit ptype host pipe.*index 11 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "212f",
+        "name": "Add skbedit action with control reclassify",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit mark 56789 reclassify index 90",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 90",
+        "matchPattern": "action order [0-9]*:  skbedit mark 56789 reclassify.*index 90 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "0651",
+        "name": "Add skbedit action with control pass",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit queue_mapping 3 pass index 271",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 271",
+        "matchPattern": "action order [0-9]*:  skbedit queue_mapping 3 pass.*index 271 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "cc53",
+        "name": "Add skbedit action with control drop",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit queue_mapping 3 drop index 271",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 271",
+        "matchPattern": "action order [0-9]*:  skbedit queue_mapping 3 drop.*index 271 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "ec16",
+        "name": "Add skbedit action with control jump",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit priority 8 jump 9 index 2",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 2",
+        "matchPattern": "action order [0-9]*:  skbedit priority :8 jump 9.*index 2 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "db54",
+        "name": "Add skbedit action with control continue",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit priority 16 continue index 32",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 32",
+        "matchPattern": "action order [0-9]*:  skbedit priority :16 continue.*index 32 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "1055",
+        "name": "Add skbedit action with cookie",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbedit priority 16 continue index 32 cookie deadbeef",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbedit index 32",
+        "matchPattern": "action order [0-9]*:  skbedit priority :16 continue.*index 32 ref.*cookie deadbeef",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
         "id": "5172",
         "name": "List skbedit actions",
         "category": [
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json b/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json
index 90bba48c3f07..fe3326e939c1 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json
@@ -264,6 +264,30 @@
         ]
     },
     {
+        "id": "6046",
+        "name": "Add skbmod action with control reclassify and cookie",
+        "category": [
+            "actions",
+            "skbmod"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbmod",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action skbmod set smac 00:01:02:03:04:01 reclassify index 1 cookie ddeeffaabb11cc22",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action skbmod index 1",
+        "matchPattern": "action order [0-9]*: skbmod reclassify set smac 00:01:02:03:04:01.*index 1 ref.*cookie ddeeffaabb11cc22",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action skbmod"
+        ]
+    },
+    {
         "id": "58cb",
         "name": "List skbmod actions",
         "category": [
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/vlan.json b/tools/testing/selftests/tc-testing/tc-tests/actions/vlan.json
new file mode 100644
index 000000000000..4510ddfa6e54
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/vlan.json
@@ -0,0 +1,410 @@
+[
+    {
+        "id": "6f5a",
+        "name": "Add vlan pop action",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan pop index 8",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*pop.*index 8 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "ee6f",
+        "name": "Add vlan pop action with large index",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan pop index 4294967295",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*pop.*index 4294967295 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "b6b9",
+        "name": "Add vlan pop action with jump opcode",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan pop jump 10 index 8",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*jump 10.*index 8 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "87c3",
+        "name": "Add vlan pop action with trap opcode",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan pop trap index 8",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*pop trap.*index 8 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "2b91",
+        "name": "Add vlan invalid action",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan bad_mode",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*bad_mode",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "57fc",
+        "name": "Add vlan action with invalid protocol type",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push protocol ABCD",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*push",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "3989",
+        "name": "Add vlan push action with default protocol and priority",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push id 123 index 18",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action vlan index 18",
+        "matchPattern": "action order [0-9]+: vlan.*push id 123 protocol 802.1Q priority 0 pipe.*index 18 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "79dc",
+        "name": "Add vlan push action with protocol 802.1Q and priority 3",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push id 77 protocol 802.1Q priority 3 continue index 734",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action vlan index 734",
+        "matchPattern": "action order [0-9]+: vlan.*push id 77 protocol 802.1Q priority 3 continue.*index 734 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "4d73",
+        "name": "Add vlan push action with protocol 802.1AD",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push id 1024 protocol 802.1AD pass index 10000",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action vlan index 10000",
+        "matchPattern": "action order [0-9]+: vlan.*push id 1024 protocol 802.1ad priority 0 pass.*index 10000 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "1f7b",
+        "name": "Add vlan push action with invalid vlan ID",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push id 5678 index 1",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*push id 5678.*index 1 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "5d02",
+        "name": "Add vlan push action with invalid IEEE 802.1p priority",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push id 5 priority 10 index 1",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*push id 5.*index 1 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "6812",
+        "name": "Add vlan modify action for protocol 802.1Q",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan modify protocol 802.1Q id 5 index 100",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action vlan index 100",
+        "matchPattern": "action order [0-9]+: vlan.*modify id 100 protocol 802.1Q priority 0 pipe.*index 100 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "5a31",
+        "name": "Add vlan modify action for protocol 802.1AD",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan modify protocol 802.1ad id 500 reclassify index 12",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action vlan index 12",
+        "matchPattern": "action order [0-9]+: vlan.*modify id 500 protocol 802.1ad priority 0 reclassify.*index 12 ref",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    },
+    {
+        "id": "83a4",
+        "name": "Delete vlan pop action",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ],
+            "$TC actions add action vlan pop index 44"
+        ],
+        "cmdUnderTest": "$TC actions del action vlan index 44",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*pop.*index 44 ref",
+        "matchCount": "0",
+        "teardown": []
+    },
+    {
+        "id": "ed1e",
+        "name": "Delete vlan push action for protocol 802.1Q",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ],
+            "$TC actions add action vlan push id 4094 protocol 802.1Q index 999"
+        ],
+        "cmdUnderTest": "$TC actions del action vlan index 999",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*push id 4094 protocol 802.1Q priority 0 pipe.*index 999 ref",
+        "matchCount": "0",
+        "teardown": []
+    },
+    {
+        "id": "a2a3",
+        "name": "Flush vlan actions",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ],
+            "$TC actions add action vlan push id 4 protocol 802.1ad index 10",
+            "$TC actions add action vlan push id 4 protocol 802.1ad index 11",
+            "$TC actions add action vlan push id 4 protocol 802.1ad index 12",
+            "$TC actions add action vlan push id 4 protocol 802.1ad index 13"
+        ],
+        "cmdUnderTest": "$TC actions flush action vlan",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*push id 4 protocol 802.1ad",
+        "matchCount": "0",
+        "teardown": []
+    },
+    {
+        "id": "1d78",
+        "name": "Add vlan action with cookie",
+        "category": [
+            "actions",
+            "vlan"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action vlan",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action vlan push id 4 cookie a0a0a0a0a0a0a0",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action vlan",
+        "matchPattern": "action order [0-9]+: vlan.*push id 4.*cookie a0a0a0a0a0a0a0",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action vlan"
+        ]
+    }
+]
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index fc373fdf2bdc..87a04a8a5945 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -11,16 +11,96 @@ import re
 import os
 import sys
 import argparse
+import importlib
 import json
 import subprocess
+import time
+import traceback
 from collections import OrderedDict
 from string import Template
 
 from tdc_config import *
 from tdc_helper import *
 
-
-USE_NS = True
+import TdcPlugin
+
+
+class PluginMgrTestFail(Exception):
+    def __init__(self, stage, output, message):
+        self.stage = stage
+        self.output = output
+        self.message = message
+
+class PluginMgr:
+    def __init__(self, argparser):
+        super().__init__()
+        self.plugins = {}
+        self.plugin_instances = []
+        self.args = []
+        self.argparser = argparser
+
+        # TODO, put plugins in order
+        plugindir = os.getenv('TDC_PLUGIN_DIR', './plugins')
+        for dirpath, dirnames, filenames in os.walk(plugindir):
+            for fn in filenames:
+                if (fn.endswith('.py') and
+                    not fn == '__init__.py' and
+                    not fn.startswith('#') and
+                    not fn.startswith('.#')):
+                    mn = fn[0:-3]
+                    foo = importlib.import_module('plugins.' + mn)
+                    self.plugins[mn] = foo
+                    self.plugin_instances.append(foo.SubPlugin())
+
+    def call_pre_suite(self, testcount, testidlist):
+        for pgn_inst in self.plugin_instances:
+            pgn_inst.pre_suite(testcount, testidlist)
+
+    def call_post_suite(self, index):
+        for pgn_inst in reversed(self.plugin_instances):
+            pgn_inst.post_suite(index)
+
+    def call_pre_case(self, test_ordinal, testid):
+        for pgn_inst in self.plugin_instances:
+            try:
+                pgn_inst.pre_case(test_ordinal, testid)
+            except Exception as ee:
+                print('exception {} in call to pre_case for {} plugin'.
+                      format(ee, pgn_inst.__class__))
+                print('test_ordinal is {}'.format(test_ordinal))
+                print('testid is {}'.format(testid))
+                raise
+
+    def call_post_case(self):
+        for pgn_inst in reversed(self.plugin_instances):
+            pgn_inst.post_case()
+
+    def call_pre_execute(self):
+        for pgn_inst in self.plugin_instances:
+            pgn_inst.pre_execute()
+
+    def call_post_execute(self):
+        for pgn_inst in reversed(self.plugin_instances):
+            pgn_inst.post_execute()
+
+    def call_add_args(self, parser):
+        for pgn_inst in self.plugin_instances:
+            parser = pgn_inst.add_args(parser)
+        return parser
+
+    def call_check_args(self, args, remaining):
+        for pgn_inst in self.plugin_instances:
+            pgn_inst.check_args(args, remaining)
+
+    def call_adjust_command(self, stage, command):
+        for pgn_inst in self.plugin_instances:
+            command = pgn_inst.adjust_command(stage, command)
+        return command
+
+    @staticmethod
+    def _make_argparser(args):
+        self.argparser = argparse.ArgumentParser(
+            description='Linux TC unit tests')
 
 
 def replace_keywords(cmd):
@@ -33,21 +113,24 @@ def replace_keywords(cmd):
     return subcmd
 
 
-def exec_cmd(command, nsonly=True):
+def exec_cmd(args, pm, stage, command):
     """
     Perform any required modifications on an executable command, then run
     it in a subprocess and return the results.
     """
-    if (USE_NS and nsonly):
-        command = 'ip netns exec $NS ' + command
-
+    if len(command.strip()) == 0:
+        return None, None
     if '$' in command:
         command = replace_keywords(command)
 
+    command = pm.call_adjust_command(stage, command)
+    if args.verbose > 0:
+        print('command "{}"'.format(command))
     proc = subprocess.Popen(command,
         shell=True,
         stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE)
+        stderr=subprocess.PIPE,
+        env=ENVIR)
     (rawout, serr) = proc.communicate()
 
     if proc.returncode != 0 and len(serr) > 0:
@@ -60,36 +143,99 @@ def exec_cmd(command, nsonly=True):
     return proc, foutput
 
 
-def prepare_env(cmdlist):
+def prepare_env(args, pm, stage, prefix, cmdlist, output = None):
     """
-    Execute the setup/teardown commands for a test case. Optionally
-    terminate test execution if the command fails.
+    Execute the setup/teardown commands for a test case.
+    Optionally terminate test execution if the command fails.
     """
+    if args.verbose > 0:
+        print('{}'.format(prefix))
     for cmdinfo in cmdlist:
-        if (type(cmdinfo) == list):
+        if isinstance(cmdinfo, list):
             exit_codes = cmdinfo[1:]
             cmd = cmdinfo[0]
         else:
             exit_codes = [0]
             cmd = cmdinfo
 
-        if (len(cmd) == 0):
+        if not cmd:
             continue
 
-        (proc, foutput) = exec_cmd(cmd)
+        (proc, foutput) = exec_cmd(args, pm, stage, cmd)
+
+        if proc and (proc.returncode not in exit_codes):
+            print('', file=sys.stderr)
+            print("{} *** Could not execute: \"{}\"".format(prefix, cmd),
+                  file=sys.stderr)
+            print("\n{} *** Error message: \"{}\"".format(prefix, foutput),
+                  file=sys.stderr)
+            print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr)
+            print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr)
+            print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr)
+            raise PluginMgrTestFail(
+                stage, output,
+                '"{}" did not complete successfully'.format(prefix))
+
+def run_one_test(pm, args, index, tidx):
+    global NAMES
+    result = True
+    tresult = ""
+    tap = ""
+    if args.verbose > 0:
+        print("\t====================\n=====> ", end="")
+    print("Test " + tidx["id"] + ": " + tidx["name"])
+
+    # populate NAMES with TESTID for this test
+    NAMES['TESTID'] = tidx['id']
+
+    pm.call_pre_case(index, tidx['id'])
+    prepare_env(args, pm, 'setup', "-----> prepare stage", tidx["setup"])
+
+    if (args.verbose > 0):
+        print('-----> execute stage')
+    pm.call_pre_execute()
+    (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"])
+    exit_code = p.returncode
+    pm.call_post_execute()
+
+    if (exit_code != int(tidx["expExitCode"])):
+        result = False
+        print("exit:", exit_code, int(tidx["expExitCode"]))
+        print(procout)
+    else:
+        if args.verbose > 0:
+            print('-----> verify stage')
+        match_pattern = re.compile(
+            str(tidx["matchPattern"]), re.DOTALL | re.MULTILINE)
+        (p, procout) = exec_cmd(args, pm, 'verify', tidx["verifyCmd"])
+        if procout:
+            match_index = re.findall(match_pattern, procout)
+            if len(match_index) != int(tidx["matchCount"]):
+                result = False
+        elif int(tidx["matchCount"]) != 0:
+            result = False
+
+    if not result:
+        tresult += 'not '
+    tresult += 'ok {} - {} # {}\n'.format(str(index), tidx['id'], tidx['name'])
+    tap += tresult
 
-        if proc.returncode not in exit_codes:
-            print
-            print("Could not execute:")
-            print(cmd)
-            print("\nError message:")
-            print(foutput)
-            print("\nAborting test run.")
-            ns_destroy()
-            exit(1)
+    if result == False:
+        if procout:
+            tap += procout
+        else:
+            tap += 'No output!\n'
+
+    prepare_env(args, pm, 'teardown', '-----> teardown stage', tidx['teardown'], procout)
+    pm.call_post_case()
 
+    index += 1
+
+    # remove TESTID from NAMES
+    del(NAMES['TESTID'])
+    return tap
 
-def test_runner(filtered_tests, args):
+def test_runner(pm, args, filtered_tests):
     """
     Driver function for the unit tests.
 
@@ -101,75 +247,92 @@ def test_runner(filtered_tests, args):
     testlist = filtered_tests
     tcount = len(testlist)
     index = 1
-    tap = str(index) + ".." + str(tcount) + "\n"
-
+    tap = ''
+    badtest = None
+    stage = None
+    emergency_exit = False
+    emergency_exit_message = ''
+
+    if args.notap:
+        if args.verbose:
+            tap = 'notap requested:  omitting test plan\n'
+    else:
+        tap = str(index) + ".." + str(tcount) + "\n"
+    try:
+        pm.call_pre_suite(tcount, [tidx['id'] for tidx in testlist])
+    except Exception as ee:
+        ex_type, ex, ex_tb = sys.exc_info()
+        print('Exception {} {} (caught in pre_suite).'.
+              format(ex_type, ex))
+        # when the extra print statements are uncommented,
+        # the traceback does not appear between them
+        # (it appears way earlier in the tdc.py output)
+        # so don't bother ...
+        # print('--------------------(')
+        # print('traceback')
+        traceback.print_tb(ex_tb)
+        # print('--------------------)')
+        emergency_exit_message = 'EMERGENCY EXIT, call_pre_suite failed with exception {} {}\n'.format(ex_type, ex)
+        emergency_exit = True
+        stage = 'pre-SUITE'
+
+    if emergency_exit:
+        pm.call_post_suite(index)
+        return emergency_exit_message
+    if args.verbose > 1:
+        print('give test rig 2 seconds to stabilize')
+    time.sleep(2)
     for tidx in testlist:
-        result = True
-        tresult = ""
         if "flower" in tidx["category"] and args.device == None:
+            if args.verbose > 1:
+                print('Not executing test {} {} because DEV2 not defined'.
+                      format(tidx['id'], tidx['name']))
             continue
-        print("Test " + tidx["id"] + ": " + tidx["name"])
-        prepare_env(tidx["setup"])
-        (p, procout) = exec_cmd(tidx["cmdUnderTest"])
-        exit_code = p.returncode
-
-        if (exit_code != int(tidx["expExitCode"])):
-            result = False
-            print("exit:", exit_code, int(tidx["expExitCode"]))
-            print(procout)
-        else:
-            match_pattern = re.compile(str(tidx["matchPattern"]), re.DOTALL)
-            (p, procout) = exec_cmd(tidx["verifyCmd"])
-            match_index = re.findall(match_pattern, procout)
-            if len(match_index) != int(tidx["matchCount"]):
-                result = False
-
-        if result == True:
-            tresult += "ok "
-        else:
-            tresult += "not ok "
-        tap += tresult + str(index) + " " + tidx["id"] + " " + tidx["name"] + "\n"
-
-        if result == False:
-            tap += procout
-
-        prepare_env(tidx["teardown"])
+        try:
+            badtest = tidx  # in case it goes bad
+            tap += run_one_test(pm, args, index, tidx)
+        except PluginMgrTestFail as pmtf:
+            ex_type, ex, ex_tb = sys.exc_info()
+            stage = pmtf.stage
+            message = pmtf.message
+            output = pmtf.output
+            print(message)
+            print('Exception {} {} (caught in test_runner, running test {} {} {} stage {})'.
+                  format(ex_type, ex, index, tidx['id'], tidx['name'], stage))
+            print('---------------')
+            print('traceback')
+            traceback.print_tb(ex_tb)
+            print('---------------')
+            if stage == 'teardown':
+                print('accumulated output for this test:')
+                if pmtf.output:
+                    print(pmtf.output)
+            print('---------------')
+            break
         index += 1
 
-    return tap
-
+    # if we failed in setup or teardown,
+    # fill in the remaining tests with ok-skipped
+    count = index
+    if not args.notap:
+        tap += 'about to flush the tap output if tests need to be skipped\n'
+        if tcount + 1 != index:
+            for tidx in testlist[index - 1:]:
+                msg = 'skipped - previous {} failed'.format(stage)
+                tap += 'ok {} - {} # {} {} {}\n'.format(
+                    count, tidx['id'], msg, index, badtest.get('id', '--Unknown--'))
+                count += 1
 
-def ns_create():
-    """
-    Create the network namespace in which the tests will be run and set up
-    the required network devices for it.
-    """
-    if (USE_NS):
-        cmd = 'ip netns add $NS'
-        exec_cmd(cmd, False)
-        cmd = 'ip link add $DEV0 type veth peer name $DEV1'
-        exec_cmd(cmd, False)
-        cmd = 'ip link set $DEV1 netns $NS'
-        exec_cmd(cmd, False)
-        cmd = 'ip link set $DEV0 up'
-        exec_cmd(cmd, False)
-        cmd = 'ip -n $NS link set $DEV1 up'
-        exec_cmd(cmd, False)
-        cmd = 'ip link set $DEV2 netns $NS'
-        exec_cmd(cmd, False)
-        cmd = 'ip -n $NS link set $DEV2 up'
-        exec_cmd(cmd, False)
+        tap += 'done flushing skipped test tap output\n'
 
+    if args.pause:
+        print('Want to pause\nPress enter to continue ...')
+        if input(sys.stdin):
+            print('got something on stdin')
 
-def ns_destroy():
-    """
-    Destroy the network namespace for testing (and any associated network
-    devices as well)
-    """
-    if (USE_NS):
-        cmd = 'ip netns delete $NS'
-        exec_cmd(cmd, False)
+    pm.call_post_suite(index)
 
+    return tap
 
 def has_blank_ids(idlist):
     """
@@ -209,41 +372,70 @@ def set_args(parser):
     """
     Set the command line arguments for tdc.
     """
-    parser.add_argument('-p', '--path', type=str,
-                        help='The full path to the tc executable to use')
-    parser.add_argument('-c', '--category', type=str, nargs='?', const='+c',
-                        help='Run tests only from the specified category, or if no category is specified, list known categories.')
-    parser.add_argument('-f', '--file', type=str,
-                        help='Run tests from the specified file')
-    parser.add_argument('-l', '--list', type=str, nargs='?', const="++", metavar='CATEGORY',
-                        help='List all test cases, or those only within the specified category')
-    parser.add_argument('-s', '--show', type=str, nargs=1, metavar='ID', dest='showID',
-                        help='Display the test case with specified id')
-    parser.add_argument('-e', '--execute', type=str, nargs=1, metavar='ID',
-                        help='Execute the single test case with specified ID')
-    parser.add_argument('-i', '--id', action='store_true', dest='gen_id',
-                        help='Generate ID numbers for new test cases')
+    parser.add_argument(
+        '-p', '--path', type=str,
+        help='The full path to the tc executable to use')
+    sg = parser.add_argument_group(
+        'selection', 'select which test cases: ' +
+        'files plus directories; filtered by categories plus testids')
+    ag = parser.add_argument_group(
+        'action', 'select action to perform on selected test cases')
+
+    sg.add_argument(
+        '-D', '--directory', nargs='+', metavar='DIR',
+        help='Collect tests from the specified directory(ies) ' +
+        '(default [tc-tests])')
+    sg.add_argument(
+        '-f', '--file', nargs='+', metavar='FILE',
+        help='Run tests from the specified file(s)')
+    sg.add_argument(
+        '-c', '--category', nargs='*', metavar='CATG', default=['+c'],
+        help='Run tests only from the specified category/ies, ' +
+        'or if no category/ies is/are specified, list known categories.')
+    sg.add_argument(
+        '-e', '--execute', nargs='+', metavar='ID',
+        help='Execute the specified test cases with specified IDs')
+    ag.add_argument(
+        '-l', '--list', action='store_true',
+        help='List all test cases, or those only within the specified category')
+    ag.add_argument(
+        '-s', '--show', action='store_true', dest='showID',
+        help='Display the selected test cases')
+    ag.add_argument(
+        '-i', '--id', action='store_true', dest='gen_id',
+        help='Generate ID numbers for new test cases')
+    parser.add_argument(
+        '-v', '--verbose', action='count', default=0,
+        help='Show the commands that are being run')
+    parser.add_argument(
+        '-N', '--notap', action='store_true',
+        help='Suppress tap results for command under test')
     parser.add_argument('-d', '--device',
                         help='Execute the test case in flower category')
+    parser.add_argument(
+        '-P', '--pause', action='store_true',
+        help='Pause execution just before post-suite stage')
     return parser
 
 
-def check_default_settings(args):
+def check_default_settings(args, remaining, pm):
     """
-    Process any arguments overriding the default settings, and ensure the
-    settings are correct.
+    Process any arguments overriding the default settings,
+    and ensure the settings are correct.
     """
     # Allow for overriding specific settings
     global NAMES
 
     if args.path != None:
-         NAMES['TC'] = args.path
+        NAMES['TC'] = args.path
     if args.device != None:
-         NAMES['DEV2'] = args.device
+        NAMES['DEV2'] = args.device
     if not os.path.isfile(NAMES['TC']):
         print("The specified tc path " + NAMES['TC'] + " does not exist.")
         exit(1)
 
+    pm.call_check_args(args, remaining)
+
 
 def get_id_list(alltests):
     """
@@ -277,7 +469,7 @@ def generate_case_ids(alltests):
     for c in alltests:
         if (c["id"] == ""):
             while True:
-                newid = str('%04x' % random.randrange(16**4))
+                newid = str('{:04x}'.format(random.randrange(16**4)))
                 if (does_id_exist(alltests, newid)):
                     continue
                 else:
@@ -298,42 +490,110 @@ def generate_case_ids(alltests):
                     testlist.append(t)
         outfile = open(f, "w")
         json.dump(testlist, outfile, indent=4)
+        outfile.write("\n")
         outfile.close()
 
+def filter_tests_by_id(args, testlist):
+    '''
+    Remove tests from testlist that are not in the named id list.
+    If id list is empty, return empty list.
+    '''
+    newlist = list()
+    if testlist and args.execute:
+        target_ids = args.execute
+
+        if isinstance(target_ids, list) and (len(target_ids) > 0):
+            newlist = list(filter(lambda x: x['id'] in target_ids, testlist))
+    return newlist
+
+def filter_tests_by_category(args, testlist):
+    '''
+    Remove tests from testlist that are not in a named category.
+    '''
+    answer = list()
+    if args.category and testlist:
+        test_ids = list()
+        for catg in set(args.category):
+            if catg == '+c':
+                continue
+            print('considering category {}'.format(catg))
+            for tc in testlist:
+                if catg in tc['category'] and tc['id'] not in test_ids:
+                    answer.append(tc)
+                    test_ids.append(tc['id'])
+
+    return answer
 
 def get_test_cases(args):
     """
     If a test case file is specified, retrieve tests from that file.
     Otherwise, glob for all json files in subdirectories and load from
     each one.
+    Also, if requested, filter by category, and add tests matching
+    certain ids.
     """
     import fnmatch
-    if args.file != None:
-        if not os.path.isfile(args.file):
-            print("The specified test case file " + args.file + " does not exist.")
-            exit(1)
-        flist = [args.file]
-    else:
-        flist = []
-        for root, dirnames, filenames in os.walk('tc-tests'):
+
+    flist = []
+    testdirs = ['tc-tests']
+
+    if args.file:
+        # at least one file was specified - remove the default directory
+        testdirs = []
+
+        for ff in args.file:
+            if not os.path.isfile(ff):
+                print("IGNORING file " + ff + "\n\tBECAUSE does not exist.")
+            else:
+                flist.append(os.path.abspath(ff))
+
+    if args.directory:
+        testdirs = args.directory
+
+    for testdir in testdirs:
+        for root, dirnames, filenames in os.walk(testdir):
             for filename in fnmatch.filter(filenames, '*.json'):
-                flist.append(os.path.join(root, filename))
-    alltests = list()
+                candidate = os.path.abspath(os.path.join(root, filename))
+                if candidate not in testdirs:
+                    flist.append(candidate)
+
+    alltestcases = list()
     for casefile in flist:
-        alltests = alltests + (load_from_file(casefile))
-    return alltests
+        alltestcases = alltestcases + (load_from_file(casefile))
+
+    allcatlist = get_test_categories(alltestcases)
+    allidlist = get_id_list(alltestcases)
 
+    testcases_by_cats = get_categorized_testlist(alltestcases, allcatlist)
+    idtestcases = filter_tests_by_id(args, alltestcases)
+    cattestcases = filter_tests_by_category(args, alltestcases)
 
-def set_operation_mode(args):
+    cat_ids = [x['id'] for x in cattestcases]
+    if args.execute:
+        if args.category:
+            alltestcases = cattestcases + [x for x in idtestcases if x['id'] not in cat_ids]
+        else:
+            alltestcases = idtestcases
+    else:
+        if cat_ids:
+            alltestcases = cattestcases
+        else:
+            # just accept the existing value of alltestcases,
+            # which has been filtered by file/directory
+            pass
+
+    return allcatlist, allidlist, testcases_by_cats, alltestcases
+
+
+def set_operation_mode(pm, args):
     """
     Load the test case data and process remaining arguments to determine
     what the script should do for this run, and call the appropriate
     function.
     """
-    alltests = get_test_cases(args)
+    ucat, idlist, testcases, alltests = get_test_cases(args)
 
     if args.gen_id:
-        idlist = get_id_list(alltests)
         if (has_blank_ids(idlist)):
             alltests = generate_case_ids(alltests)
         else:
@@ -347,70 +607,29 @@ def set_operation_mode(args):
         print("Please correct them before continuing.")
         exit(1)
 
-    ucat = get_test_categories(alltests)
-
     if args.showID:
-        show_test_case_by_id(alltests, args.showID[0])
+        for atest in alltests:
+            print_test_case(atest)
         exit(0)
 
-    if args.execute:
-        target_id = args.execute[0]
-    else:
-        target_id = ""
-
-    if args.category:
-        if (args.category == '+c'):
-            print("Available categories:")
-            print_sll(ucat)
-            exit(0)
-        else:
-            target_category = args.category
-    else:
-        target_category = ""
-
-
-    testcases = get_categorized_testlist(alltests, ucat)
+    if isinstance(args.category, list) and (len(args.category) == 0):
+        print("Available categories:")
+        print_sll(ucat)
+        exit(0)
 
     if args.list:
-        if (args.list == "++"):
+        if args.list:
             list_test_cases(alltests)
             exit(0)
-        elif(len(args.list) > 0):
-            if (args.list not in ucat):
-                print("Unknown category " + args.list)
-                print("Available categories:")
-                print_sll(ucat)
-                exit(1)
-            list_test_cases(testcases[args.list])
-            exit(0)
-
-    if (os.geteuid() != 0):
-        print("This script must be run with root privileges.\n")
-        exit(1)
-
-    ns_create()
-
-    if (len(target_category) == 0):
-        if (len(target_id) > 0):
-            alltests = list(filter(lambda x: target_id in x['id'], alltests))
-            if (len(alltests) == 0):
-                print("Cannot find a test case with ID matching " + target_id)
-                exit(1)
-        catresults = test_runner(alltests, args)
-        print("All test results: " + "\n\n" + catresults)
-    elif (len(target_category) > 0):
-        if (target_category == "flower") and args.device == None:
-            print("Please specify a NIC device (-d) to run category flower")
-            exit(1)
-        if (target_category not in ucat):
-            print("Specified category is not present in this file.")
-            exit(1)
-        else:
-            catresults = test_runner(testcases[target_category], args)
-            print("Category " + target_category + "\n\n" + catresults)
-
-    ns_destroy()
 
+    if len(alltests):
+        catresults = test_runner(pm, args, alltests)
+    else:
+        catresults = 'No tests found\n'
+    if args.notap:
+        print('Tap output suppression requested\n')
+    else:
+        print('All test results: \n\n{}'.format(catresults))
 
 def main():
     """
@@ -419,10 +638,15 @@ def main():
     """
     parser = args_parse()
     parser = set_args(parser)
+    pm = PluginMgr(parser)
+    parser = pm.call_add_args(parser)
     (args, remaining) = parser.parse_known_args()
-    check_default_settings(args)
+    args.NAMES = NAMES
+    check_default_settings(args, remaining, pm)
+    if args.verbose > 2:
+        print('args is {}'.format(args))
 
-    set_operation_mode(args)
+    set_operation_mode(pm, args)
 
     exit(0)
 
diff --git a/tools/testing/selftests/tc-testing/tdc_batch.py b/tools/testing/selftests/tc-testing/tdc_batch.py
index 707c6bfef689..52fa539dc662 100755
--- a/tools/testing/selftests/tc-testing/tdc_batch.py
+++ b/tools/testing/selftests/tc-testing/tdc_batch.py
@@ -49,13 +49,13 @@ index = 0
 for i in range(0x100):
     for j in range(0x100):
         for k in range(0x100):
-            mac = ("%02x:%02x:%02x" % (i, j, k))
+            mac = ("{:02x}:{:02x}:{:02x}".format(i, j, k))
             src_mac = "e4:11:00:" + mac
             dst_mac = "e4:12:00:" + mac
-            cmd = ("filter add dev %s %s protocol ip parent ffff: flower %s "
-                   "src_mac %s dst_mac %s action drop %s" %
+            cmd = ("filter add dev {} {} protocol ip parent ffff: flower {} "
+                   "src_mac {} dst_mac {} action drop {}".format
                    (device, prio, skip, src_mac, dst_mac, share_action))
-            file.write("%s\n" % cmd)
+            file.write("{}\n".format(cmd))
             index += 1
             if index >= number:
                 file.close()
diff --git a/tools/testing/selftests/tc-testing/tdc_helper.py b/tools/testing/selftests/tc-testing/tdc_helper.py
index db381120a566..9f35c96c88a0 100644
--- a/tools/testing/selftests/tc-testing/tdc_helper.py
+++ b/tools/testing/selftests/tc-testing/tdc_helper.py
@@ -57,20 +57,11 @@ def print_sll(items):
 
 def print_test_case(tcase):
     """ Pretty-printing of a given test case. """
+    print('\n==============\nTest {}\t{}\n'.format(tcase['id'], tcase['name']))
     for k in tcase.keys():
         if (isinstance(tcase[k], list)):
             print(k + ":")
             print_list(tcase[k])
         else:
-            print(k + ": " + tcase[k])
-
-
-def show_test_case_by_id(testlist, caseID):
-    """ Find the specified test case to pretty-print. """
-    if not any(d.get('id', None) == caseID for d in testlist):
-        print("That ID does not exist.")
-        exit(1)
-    else:
-        print_test_case(next((d for d in testlist if d['id'] == caseID)))
-
-
+            if not ((k == 'id') or (k == 'name')):
+                print(k + ": " + str(tcase[k]))
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index d744991c0f4f..39f66bc29b82 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -11,7 +11,7 @@ CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
 
 TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
                         check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
-                        protection_keys test_vdso test_vsyscall
+                        protection_keys test_vdso test_vsyscall mov_ss_trap
 TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
                         test_FCMOV test_FCOMI test_FISTTP \
                         vdso_restorer
diff --git a/tools/testing/selftests/x86/mov_ss_trap.c b/tools/testing/selftests/x86/mov_ss_trap.c
new file mode 100644
index 000000000000..3c3a022654f3
--- /dev/null
+++ b/tools/testing/selftests/x86/mov_ss_trap.c
@@ -0,0 +1,285 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * mov_ss_trap.c: Exercise the bizarre side effects of a watchpoint on MOV SS
+ *
+ * This does MOV SS from a watchpointed address followed by various
+ * types of kernel entries.  A MOV SS that hits a watchpoint will queue
+ * up a #DB trap but will not actually deliver that trap.  The trap
+ * will be delivered after the next instruction instead.  The CPU's logic
+ * seems to be:
+ *
+ *  - Any fault: drop the pending #DB trap.
+ *  - INT $N, INT3, INTO, SYSCALL, SYSENTER: enter the kernel and then
+ *    deliver #DB.
+ *  - ICEBP: enter the kernel but do not deliver the watchpoint trap
+ *  - breakpoint: only one #DB is delivered (phew!)
+ *
+ * There are plenty of ways for a kernel to handle this incorrectly.  This
+ * test tries to exercise all the cases.
+ *
+ * This should mostly cover CVE-2018-1087 and CVE-2018-8897.
+ */
+#define _GNU_SOURCE
+
+#include <stdlib.h>
+#include <sys/ptrace.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/user.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <err.h>
+#include <string.h>
+#include <setjmp.h>
+#include <sys/prctl.h>
+
+#define X86_EFLAGS_RF (1UL << 16)
+
+#if __x86_64__
+# define REG_IP REG_RIP
+#else
+# define REG_IP REG_EIP
+#endif
+
+unsigned short ss;
+extern unsigned char breakpoint_insn[];
+sigjmp_buf jmpbuf;
+static unsigned char altstack_data[SIGSTKSZ];
+
+static void enable_watchpoint(void)
+{
+        pid_t parent = getpid();
+        int status;
+
+        pid_t child = fork();
+        if (child < 0)
+                err(1, "fork");
+
+        if (child) {
+                if (waitpid(child, &status, 0) != child)
+                        err(1, "waitpid for child");
+        } else {
+                unsigned long dr0, dr1, dr7;
+
+                dr0 = (unsigned long)&ss;
+                dr1 = (unsigned long)breakpoint_insn;
+                dr7 = ((1UL << 1) |     /* G0 */
+                       (3UL << 16) |    /* RW0 = read or write */
+                       (1UL << 18) |    /* LEN0 = 2 bytes */
+                       (1UL << 3));     /* G1, RW1 = insn */
+
+                if (ptrace(PTRACE_ATTACH, parent, NULL, NULL) != 0)
+                        err(1, "PTRACE_ATTACH");
+
+                if (waitpid(parent, &status, 0) != parent)
+                        err(1, "waitpid for child");
+
+                if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[0]), dr0) != 0)
+                        err(1, "PTRACE_POKEUSER DR0");
+
+                if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[1]), dr1) != 0)
+                        err(1, "PTRACE_POKEUSER DR1");
+
+                if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[7]), dr7) != 0)
+                        err(1, "PTRACE_POKEUSER DR7");
+
+                printf("\tDR0 = %lx, DR1 = %lx, DR7 = %lx\n", dr0, dr1, dr7);
+
+                if (ptrace(PTRACE_DETACH, parent, NULL, NULL) != 0)
+                        err(1, "PTRACE_DETACH");
+
+                exit(0);
+        }
+}
+
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                       int flags)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_sigaction = handler;
+        sa.sa_flags = SA_SIGINFO | flags;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+}
+
+static char const * const signames[] = {
+        [SIGSEGV] = "SIGSEGV",
+        [SIGBUS] = "SIBGUS",
+        [SIGTRAP] = "SIGTRAP",
+        [SIGILL] = "SIGILL",
+};
+
+static void sigtrap(int sig, siginfo_t *si, void *ctx_void)
+{
+        ucontext_t *ctx = ctx_void;
+
+        printf("\tGot SIGTRAP with RIP=%lx, EFLAGS.RF=%d\n",
+               (unsigned long)ctx->uc_mcontext.gregs[REG_IP],
+               !!(ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_RF));
+}
+
+static void handle_and_return(int sig, siginfo_t *si, void *ctx_void)
+{
+        ucontext_t *ctx = ctx_void;
+
+        printf("\tGot %s with RIP=%lx\n", signames[sig],
+               (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
+}
+
+static void handle_and_longjmp(int sig, siginfo_t *si, void *ctx_void)
+{
+        ucontext_t *ctx = ctx_void;
+
+        printf("\tGot %s with RIP=%lx\n", signames[sig],
+               (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
+
+        siglongjmp(jmpbuf, 1);
+}
+
+int main()
+{
+        unsigned long nr;
+
+        asm volatile ("mov %%ss, %[ss]" : [ss] "=m" (ss));
+        printf("\tSS = 0x%hx, &SS = 0x%p\n", ss, &ss);
+
+        if (prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, 0, 0, 0) == 0)
+                printf("\tPR_SET_PTRACER_ANY succeeded\n");
+
+        printf("\tSet up a watchpoint\n");
+        sethandler(SIGTRAP, sigtrap, 0);
+        enable_watchpoint();
+
+        printf("[RUN]\tRead from watched memory (should get SIGTRAP)\n");
+        asm volatile ("mov %[ss], %[tmp]" : [tmp] "=r" (nr) : [ss] "m" (ss));
+
+        printf("[RUN]\tMOV SS; INT3\n");
+        asm volatile ("mov %[ss], %%ss; int3" :: [ss] "m" (ss));
+
+        printf("[RUN]\tMOV SS; INT 3\n");
+        asm volatile ("mov %[ss], %%ss; .byte 0xcd, 0x3" :: [ss] "m" (ss));
+
+        printf("[RUN]\tMOV SS; CS CS INT3\n");
+        asm volatile ("mov %[ss], %%ss; .byte 0x2e, 0x2e; int3" :: [ss] "m" (ss));
+
+        printf("[RUN]\tMOV SS; CSx14 INT3\n");
+        asm volatile ("mov %[ss], %%ss; .fill 14,1,0x2e; int3" :: [ss] "m" (ss));
+
+        printf("[RUN]\tMOV SS; INT 4\n");
+        sethandler(SIGSEGV, handle_and_return, SA_RESETHAND);
+        asm volatile ("mov %[ss], %%ss; int $4" :: [ss] "m" (ss));
+
+#ifdef __i386__
+        printf("[RUN]\tMOV SS; INTO\n");
+        sethandler(SIGSEGV, handle_and_return, SA_RESETHAND);
+        nr = -1;
+        asm volatile ("add $1, %[tmp]; mov %[ss], %%ss; into"
+                      : [tmp] "+r" (nr) : [ss] "m" (ss));
+#endif
+
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; ICEBP\n");
+
+                /* Some emulators (e.g. QEMU TCG) don't emulate ICEBP. */
+                sethandler(SIGILL, handle_and_longjmp, SA_RESETHAND);
+
+                asm volatile ("mov %[ss], %%ss; .byte 0xf1" :: [ss] "m" (ss));
+        }
+
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; CLI\n");
+                sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND);
+                asm volatile ("mov %[ss], %%ss; cli" :: [ss] "m" (ss));
+        }
+
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; #PF\n");
+                sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND);
+                asm volatile ("mov %[ss], %%ss; mov (-1), %[tmp]"
+                              : [tmp] "=r" (nr) : [ss] "m" (ss));
+        }
+
+        /*
+         * INT $1: if #DB has DPL=3 and there isn't special handling,
+         * then the kernel will die.
+         */
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; INT 1\n");
+                sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND);
+                asm volatile ("mov %[ss], %%ss; int $1" :: [ss] "m" (ss));
+        }
+
+#ifdef __x86_64__
+        /*
+         * In principle, we should test 32-bit SYSCALL as well, but
+         * the calling convention is so unpredictable that it's
+         * not obviously worth the effort.
+         */
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; SYSCALL\n");
+                sethandler(SIGILL, handle_and_longjmp, SA_RESETHAND);
+                nr = SYS_getpid;
+                /*
+                 * Toggle the high bit of RSP to make it noncanonical to
+                 * strengthen this test on non-SMAP systems.
+                 */
+                asm volatile ("btc $63, %%rsp\n\t"
+                              "mov %[ss], %%ss; syscall\n\t"
+                              "btc $63, %%rsp"
+                              : "+a" (nr) : [ss] "m" (ss)
+                              : "rcx"
+#ifdef __x86_64__
+                                , "r11"
+#endif
+                        );
+        }
+#endif
+
+        printf("[RUN]\tMOV SS; breakpointed NOP\n");
+        asm volatile ("mov %[ss], %%ss; breakpoint_insn: nop" :: [ss] "m" (ss));
+
+        /*
+         * Invoking SYSENTER directly breaks all the rules.  Just handle
+         * the SIGSEGV.
+         */
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; SYSENTER\n");
+                stack_t stack = {
+                        .ss_sp = altstack_data,
+                        .ss_size = SIGSTKSZ,
+                };
+                if (sigaltstack(&stack, NULL) != 0)
+                        err(1, "sigaltstack");
+                sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND | SA_ONSTACK);
+                nr = SYS_getpid;
+                asm volatile ("mov %[ss], %%ss; SYSENTER" : "+a" (nr)
+                              : [ss] "m" (ss) : "flags", "rcx"
+#ifdef __x86_64__
+                                , "r11"
+#endif
+                        );
+
+                /* We're unreachable here.  SYSENTER forgets RIP. */
+        }
+
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                printf("[RUN]\tMOV SS; INT $0x80\n");
+                sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND);
+                nr = 20;        /* compat getpid */
+                asm volatile ("mov %[ss], %%ss; int $0x80"
+                              : "+a" (nr) : [ss] "m" (ss)
+                              : "flags"
+#ifdef __x86_64__
+                                , "r8", "r9", "r10", "r11"
+#endif
+                        );
+        }
+
+        printf("[OK]\tI aten't dead\n");
+        return 0;
+}
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index 9c0325e1ea68..50f7e9272481 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -368,6 +368,11 @@ static int expected_bnd_index = -1;
 uint64_t shadow_plb[NR_MPX_BOUNDS_REGISTERS][2]; /* shadow MPX bound registers */
 unsigned long shadow_map[NR_MPX_BOUNDS_REGISTERS];
 
+/* Failed address bound checks: */
+#ifndef SEGV_BNDERR
+# define SEGV_BNDERR    3
+#endif
+
 /*
  * The kernel is supposed to provide some information about the bounds
  * exception in the siginfo.  It should match what we have in the bounds
@@ -419,8 +424,6 @@ void handler(int signum, siginfo_t *si, void *vucontext)
                 br_count++;
                 dprintf1("#BR 0x%jx (total seen: %d)\n", status, br_count);
 
-#define SEGV_BNDERR     3  /* failed address bound checks */
-
                 dprintf2("Saw a #BR! status 0x%jx at %016lx br_reason: %jx\n",
                                 status, ip, br_reason);
                 dprintf2("si_signo: %d\n", si->si_signo);
diff --git a/tools/testing/selftests/x86/pkey-helpers.h b/tools/testing/selftests/x86/pkey-helpers.h
index b3cb7670e026..254e5436bdd9 100644
--- a/tools/testing/selftests/x86/pkey-helpers.h
+++ b/tools/testing/selftests/x86/pkey-helpers.h
@@ -26,30 +26,26 @@ static inline void sigsafe_printf(const char *format, ...)
 {
         va_list ap;
 
-        va_start(ap, format);
         if (!dprint_in_signal) {
+                va_start(ap, format);
                 vprintf(format, ap);
+                va_end(ap);
         } else {
                 int ret;
-                int len = vsnprintf(dprint_in_signal_buffer,
-                                    DPRINT_IN_SIGNAL_BUF_SIZE,
-                                    format, ap);
                 /*
-                 * len is amount that would have been printed,
-                 * but actual write is truncated at BUF_SIZE.
+                 * No printf() functions are signal-safe.
+                 * They deadlock easily. Write the format
+                 * string to get some output, even if
+                 * incomplete.
                  */
-                if (len > DPRINT_IN_SIGNAL_BUF_SIZE)
-                        len = DPRINT_IN_SIGNAL_BUF_SIZE;
-                ret = write(1, dprint_in_signal_buffer, len);
+                ret = write(1, format, strlen(format));
                 if (ret < 0)
-                        abort();
+                        exit(1);
         }
-        va_end(ap);
 }
 #define dprintf_level(level, args...) do {      \
         if (level <= DEBUG_LEVEL)               \
                 sigsafe_printf(args);           \
-        fflush(NULL);                           \
 } while (0)
 #define dprintf0(args...) dprintf_level(0, args)
 #define dprintf1(args...) dprintf_level(1, args)
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index f15aa5a76fe3..460b4bdf4c1e 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -72,10 +72,9 @@ extern void abort_hooks(void);
                                 test_nr, iteration_nr); \
                 dprintf0("errno at assert: %d", errno); \
                 abort_hooks();                  \
-                assert(condition);              \
+                exit(__LINE__);                 \
         }                                       \
 } while (0)
-#define raw_assert(cond) assert(cond)
 
 void cat_into_file(char *str, char *file)
 {
@@ -87,12 +86,17 @@ void cat_into_file(char *str, char *file)
          * these need to be raw because they are called under
          * pkey_assert()
          */
-        raw_assert(fd >= 0);
+        if (fd < 0) {
+                fprintf(stderr, "error opening '%s'\n", str);
+                perror("error: ");
+                exit(__LINE__);
+        }
+
         ret = write(fd, str, strlen(str));
         if (ret != strlen(str)) {
                 perror("write to file failed");
                 fprintf(stderr, "filename: '%s' str: '%s'\n", file, str);
-                raw_assert(0);
+                exit(__LINE__);
         }
         close(fd);
 }
@@ -191,26 +195,30 @@ void lots_o_noops_around_write(int *write_to_me)
 #ifdef __i386__
 
 #ifndef SYS_mprotect_key
-# define SYS_mprotect_key 380
+# define SYS_mprotect_key       380
 #endif
+
 #ifndef SYS_pkey_alloc
-# define SYS_pkey_alloc  381
-# define SYS_pkey_free   382
+# define SYS_pkey_alloc         381
+# define SYS_pkey_free          382
 #endif
-#define REG_IP_IDX REG_EIP
-#define si_pkey_offset 0x14
+
+#define REG_IP_IDX              REG_EIP
+#define si_pkey_offset          0x14
 
 #else
 
 #ifndef SYS_mprotect_key
-# define SYS_mprotect_key 329
+# define SYS_mprotect_key       329
 #endif
+
 #ifndef SYS_pkey_alloc
-# define SYS_pkey_alloc  330
-# define SYS_pkey_free   331
+# define SYS_pkey_alloc         330
+# define SYS_pkey_free          331
 #endif
-#define REG_IP_IDX REG_RIP
-#define si_pkey_offset 0x20
+
+#define REG_IP_IDX              REG_RIP
+#define si_pkey_offset          0x20
 
 #endif
 
@@ -225,8 +233,14 @@ void dump_mem(void *dumpme, int len_bytes)
         }
 }
 
-#define SEGV_BNDERR     3  /* failed address bound checks */
-#define SEGV_PKUERR     4
+/* Failed address bound checks: */
+#ifndef SEGV_BNDERR
+# define SEGV_BNDERR            3
+#endif
+
+#ifndef SEGV_PKUERR
+# define SEGV_PKUERR            4
+#endif
 
 static char *si_code_str(int si_code)
 {
@@ -289,13 +303,6 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext)
                 dump_mem(pkru_ptr - 128, 256);
         pkey_assert(*pkru_ptr);
 
-        si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset);
-        dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr);
-        dump_mem(si_pkey_ptr - 8, 24);
-        siginfo_pkey = *si_pkey_ptr;
-        pkey_assert(siginfo_pkey < NR_PKEYS);
-        last_si_pkey = siginfo_pkey;
-
         if ((si->si_code == SEGV_MAPERR) ||
             (si->si_code == SEGV_ACCERR) ||
             (si->si_code == SEGV_BNDERR)) {
@@ -303,6 +310,13 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext)
                 exit(4);
         }
 
+        si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset);
+        dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr);
+        dump_mem((u8 *)si_pkey_ptr - 8, 24);
+        siginfo_pkey = *si_pkey_ptr;
+        pkey_assert(siginfo_pkey < NR_PKEYS);
+        last_si_pkey = siginfo_pkey;
+
         dprintf1("signal pkru from xsave: %08x\n", *pkru_ptr);
         /* need __rdpkru() version so we do not do shadow_pkru checking */
         dprintf1("signal pkru from  pkru: %08x\n", __rdpkru());
@@ -311,22 +325,6 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext)
         dprintf1("WARNING: set PRKU=0 to allow faulting instruction to continue\n");
         pkru_faults++;
         dprintf1("<<<<==================================================\n");
-        return;
-        if (trapno == 14) {
-                fprintf(stderr,
-                        "ERROR: In signal handler, page fault, trapno = %d, ip = %016lx\n",
-                        trapno, ip);
-                fprintf(stderr, "si_addr %p\n", si->si_addr);
-                fprintf(stderr, "REG_ERR: %lx\n",
-                                (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);
-                exit(1);
-        } else {
-                fprintf(stderr, "unexpected trap %d! at 0x%lx\n", trapno, ip);
-                fprintf(stderr, "si_addr %p\n", si->si_addr);
-                fprintf(stderr, "REG_ERR: %lx\n",
-                                (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);
-                exit(2);
-        }
         dprint_in_signal = 0;
 }
 
@@ -393,10 +391,15 @@ pid_t fork_lazy_child(void)
         return forkret;
 }
 
-#define PKEY_DISABLE_ACCESS    0x1
-#define PKEY_DISABLE_WRITE     0x2
+#ifndef PKEY_DISABLE_ACCESS
+# define PKEY_DISABLE_ACCESS    0x1
+#endif
+
+#ifndef PKEY_DISABLE_WRITE
+# define PKEY_DISABLE_WRITE     0x2
+#endif
 
-u32 pkey_get(int pkey, unsigned long flags)
+static u32 hw_pkey_get(int pkey, unsigned long flags)
 {
         u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE);
         u32 pkru = __rdpkru();
@@ -418,7 +421,7 @@ u32 pkey_get(int pkey, unsigned long flags)
         return masked_pkru;
 }
 
-int pkey_set(int pkey, unsigned long rights, unsigned long flags)
+static int hw_pkey_set(int pkey, unsigned long rights, unsigned long flags)
 {
         u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE);
         u32 old_pkru = __rdpkru();
@@ -452,15 +455,15 @@ void pkey_disable_set(int pkey, int flags)
                 pkey, flags);
         pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE));
 
-        pkey_rights = pkey_get(pkey, syscall_flags);
+        pkey_rights = hw_pkey_get(pkey, syscall_flags);
 
-        dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
+        dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__,
                         pkey, pkey, pkey_rights);
         pkey_assert(pkey_rights >= 0);
 
         pkey_rights |= flags;
 
-        ret = pkey_set(pkey, pkey_rights, syscall_flags);
+        ret = hw_pkey_set(pkey, pkey_rights, syscall_flags);
         assert(!ret);
         /*pkru and flags have the same format */
         shadow_pkru |= flags << (pkey * 2);
@@ -468,8 +471,8 @@ void pkey_disable_set(int pkey, int flags)
 
         pkey_assert(ret >= 0);
 
-        pkey_rights = pkey_get(pkey, syscall_flags);
-        dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
+        pkey_rights = hw_pkey_get(pkey, syscall_flags);
+        dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__,
                         pkey, pkey, pkey_rights);
 
         dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru());
@@ -483,24 +486,24 @@ void pkey_disable_clear(int pkey, int flags)
 {
         unsigned long syscall_flags = 0;
         int ret;
-        int pkey_rights = pkey_get(pkey, syscall_flags);
+        int pkey_rights = hw_pkey_get(pkey, syscall_flags);
         u32 orig_pkru = rdpkru();
 
         pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE));
 
-        dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
+        dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__,
                         pkey, pkey, pkey_rights);
         pkey_assert(pkey_rights >= 0);
 
         pkey_rights |= flags;
 
-        ret = pkey_set(pkey, pkey_rights, 0);
+        ret = hw_pkey_set(pkey, pkey_rights, 0);
         /* pkru and flags have the same format */
         shadow_pkru &= ~(flags << (pkey * 2));
         pkey_assert(ret >= 0);
 
-        pkey_rights = pkey_get(pkey, syscall_flags);
-        dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
+        pkey_rights = hw_pkey_get(pkey, syscall_flags);
+        dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__,
                         pkey, pkey, pkey_rights);
 
         dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru());
@@ -674,10 +677,12 @@ int mprotect_pkey(void *ptr, size_t size, unsigned long orig_prot,
 struct pkey_malloc_record {
         void *ptr;
         long size;
+        int prot;
 };
 struct pkey_malloc_record *pkey_malloc_records;
+struct pkey_malloc_record *pkey_last_malloc_record;
 long nr_pkey_malloc_records;
-void record_pkey_malloc(void *ptr, long size)
+void record_pkey_malloc(void *ptr, long size, int prot)
 {
         long i;
         struct pkey_malloc_record *rec = NULL;
@@ -709,6 +714,8 @@ void record_pkey_malloc(void *ptr, long size)
                 (int)(rec - pkey_malloc_records), rec, ptr, size);
         rec->ptr = ptr;
         rec->size = size;
+        rec->prot = prot;
+        pkey_last_malloc_record = rec;
         nr_pkey_malloc_records++;
 }
 
@@ -753,7 +760,7 @@ void *malloc_pkey_with_mprotect(long size, int prot, u16 pkey)
         pkey_assert(ptr != (void *)-1);
         ret = mprotect_pkey((void *)ptr, PAGE_SIZE, prot, pkey);
         pkey_assert(!ret);
-        record_pkey_malloc(ptr, size);
+        record_pkey_malloc(ptr, size, prot);
         rdpkru();
 
         dprintf1("%s() for pkey %d @ %p\n", __func__, pkey, ptr);
@@ -774,7 +781,7 @@ void *malloc_pkey_anon_huge(long size, int prot, u16 pkey)
         size = ALIGN_UP(size, HPAGE_SIZE * 2);
         ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
         pkey_assert(ptr != (void *)-1);
-        record_pkey_malloc(ptr, size);
+        record_pkey_malloc(ptr, size, prot);
         mprotect_pkey(ptr, size, prot, pkey);
 
         dprintf1("unaligned ptr: %p\n", ptr);
@@ -847,7 +854,7 @@ void *malloc_pkey_hugetlb(long size, int prot, u16 pkey)
         pkey_assert(ptr != (void *)-1);
         mprotect_pkey(ptr, size, prot, pkey);
 
-        record_pkey_malloc(ptr, size);
+        record_pkey_malloc(ptr, size, prot);
 
         dprintf1("mmap()'d hugetlbfs for pkey %d @ %p\n", pkey, ptr);
         return ptr;
@@ -869,7 +876,7 @@ void *malloc_pkey_mmap_dax(long size, int prot, u16 pkey)
 
         mprotect_pkey(ptr, size, prot, pkey);
 
-        record_pkey_malloc(ptr, size);
+        record_pkey_malloc(ptr, size, prot);
 
         dprintf1("mmap()'d for pkey %d @ %p\n", pkey, ptr);
         close(fd);
@@ -918,13 +925,21 @@ void *malloc_pkey(long size, int prot, u16 pkey)
 }
 
 int last_pkru_faults;
+#define UNKNOWN_PKEY -2
 void expected_pk_fault(int pkey)
 {
         dprintf2("%s(): last_pkru_faults: %d pkru_faults: %d\n",
                         __func__, last_pkru_faults, pkru_faults);
         dprintf2("%s(%d): last_si_pkey: %d\n", __func__, pkey, last_si_pkey);
         pkey_assert(last_pkru_faults + 1 == pkru_faults);
-        pkey_assert(last_si_pkey == pkey);
+
+       /*
+        * For exec-only memory, we do not know the pkey in
+        * advance, so skip this check.
+        */
+        if (pkey != UNKNOWN_PKEY)
+                pkey_assert(last_si_pkey == pkey);
+
         /*
          * The signal handler shold have cleared out PKRU to let the
          * test program continue.  We now have to restore it.
@@ -939,10 +954,11 @@ void expected_pk_fault(int pkey)
         last_si_pkey = -1;
 }
 
-void do_not_expect_pk_fault(void)
-{
-        pkey_assert(last_pkru_faults == pkru_faults);
-}
+#define do_not_expect_pk_fault(msg)     do {                    \
+        if (last_pkru_faults != pkru_faults)                    \
+                dprintf0("unexpected PK fault: %s\n", msg);     \
+        pkey_assert(last_pkru_faults == pkru_faults);           \
+} while (0)
 
 int test_fds[10] = { -1 };
 int nr_test_fds;
@@ -1151,12 +1167,15 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
         pkey_assert(i < NR_PKEYS*2);
 
         /*
-         * There are 16 pkeys supported in hardware.  One is taken
-         * up for the default (0) and another can be taken up by
-         * an execute-only mapping.  Ensure that we can allocate
-         * at least 14 (16-2).
+         * There are 16 pkeys supported in hardware.  Three are
+         * allocated by the time we get here:
+         *   1. The default key (0)
+         *   2. One possibly consumed by an execute-only mapping.
+         *   3. One allocated by the test code and passed in via
+         *      'pkey' to this function.
+         * Ensure that we can allocate at least another 13 (16-3).
          */
-        pkey_assert(i >= NR_PKEYS-2);
+        pkey_assert(i >= NR_PKEYS-3);
 
         for (i = 0; i < nr_allocated_pkeys; i++) {
                 err = sys_pkey_free(allocated_pkeys[i]);
@@ -1165,6 +1184,35 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
         }
 }
 
+/*
+ * pkey 0 is special.  It is allocated by default, so you do not
+ * have to call pkey_alloc() to use it first.  Make sure that it
+ * is usable.
+ */
+void test_mprotect_with_pkey_0(int *ptr, u16 pkey)
+{
+        long size;
+        int prot;
+
+        assert(pkey_last_malloc_record);
+        size = pkey_last_malloc_record->size;
+        /*
+         * This is a bit of a hack.  But mprotect() requires
+         * huge-page-aligned sizes when operating on hugetlbfs.
+         * So, make sure that we use something that's a multiple
+         * of a huge page when we can.
+         */
+        if (size >= HPAGE_SIZE)
+                size = HPAGE_SIZE;
+        prot = pkey_last_malloc_record->prot;
+
+        /* Use pkey 0 */
+        mprotect_pkey(ptr, size, prot, 0);
+
+        /* Make sure that we can set it back to the original pkey. */
+        mprotect_pkey(ptr, size, prot, pkey);
+}
+
 void test_ptrace_of_child(int *ptr, u16 pkey)
 {
         __attribute__((__unused__)) int peek_result;
@@ -1228,7 +1276,7 @@ void test_ptrace_of_child(int *ptr, u16 pkey)
         pkey_assert(ret != -1);
         /* Now access from the current task, and expect NO exception: */
         peek_result = read_ptr(plain_ptr);
-        do_not_expect_pk_fault();
+        do_not_expect_pk_fault("read plain pointer after ptrace");
 
         ret = ptrace(PTRACE_DETACH, child_pid, ignored, 0);
         pkey_assert(ret != -1);
@@ -1241,12 +1289,9 @@ void test_ptrace_of_child(int *ptr, u16 pkey)
         free(plain_ptr_unaligned);
 }
 
-void test_executing_on_unreadable_memory(int *ptr, u16 pkey)
+void *get_pointer_to_instructions(void)
 {
         void *p1;
-        int scratch;
-        int ptr_contents;
-        int ret;
 
         p1 = ALIGN_PTR_UP(&lots_o_noops_around_write, PAGE_SIZE);
         dprintf3("&lots_o_noops: %p\n", &lots_o_noops_around_write);
@@ -1256,7 +1301,23 @@ void test_executing_on_unreadable_memory(int *ptr, u16 pkey)
         /* Point 'p1' at the *second* page of the function: */
         p1 += PAGE_SIZE;
 
+        /*
+         * Try to ensure we fault this in on next touch to ensure
+         * we get an instruction fault as opposed to a data one
+         */
         madvise(p1, PAGE_SIZE, MADV_DONTNEED);
+
+        return p1;
+}
+
+void test_executing_on_unreadable_memory(int *ptr, u16 pkey)
+{
+        void *p1;
+        int scratch;
+        int ptr_contents;
+        int ret;
+
+        p1 = get_pointer_to_instructions();
         lots_o_noops_around_write(&scratch);
         ptr_contents = read_ptr(p1);
         dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents);
@@ -1272,12 +1333,55 @@ void test_executing_on_unreadable_memory(int *ptr, u16 pkey)
          */
         madvise(p1, PAGE_SIZE, MADV_DONTNEED);
         lots_o_noops_around_write(&scratch);
-        do_not_expect_pk_fault();
+        do_not_expect_pk_fault("executing on PROT_EXEC memory");
         ptr_contents = read_ptr(p1);
         dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents);
         expected_pk_fault(pkey);
 }
 
+void test_implicit_mprotect_exec_only_memory(int *ptr, u16 pkey)
+{
+        void *p1;
+        int scratch;
+        int ptr_contents;
+        int ret;
+
+        dprintf1("%s() start\n", __func__);
+
+        p1 = get_pointer_to_instructions();
+        lots_o_noops_around_write(&scratch);
+        ptr_contents = read_ptr(p1);
+        dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents);
+
+        /* Use a *normal* mprotect(), not mprotect_pkey(): */
+        ret = mprotect(p1, PAGE_SIZE, PROT_EXEC);
+        pkey_assert(!ret);
+
+        dprintf2("pkru: %x\n", rdpkru());
+
+        /* Make sure this is an *instruction* fault */
+        madvise(p1, PAGE_SIZE, MADV_DONTNEED);
+        lots_o_noops_around_write(&scratch);
+        do_not_expect_pk_fault("executing on PROT_EXEC memory");
+        ptr_contents = read_ptr(p1);
+        dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents);
+        expected_pk_fault(UNKNOWN_PKEY);
+
+        /*
+         * Put the memory back to non-PROT_EXEC.  Should clear the
+         * exec-only pkey off the VMA and allow it to be readable
+         * again.  Go to PROT_NONE first to check for a kernel bug
+         * that did not clear the pkey when doing PROT_NONE.
+         */
+        ret = mprotect(p1, PAGE_SIZE, PROT_NONE);
+        pkey_assert(!ret);
+
+        ret = mprotect(p1, PAGE_SIZE, PROT_READ|PROT_EXEC);
+        pkey_assert(!ret);
+        ptr_contents = read_ptr(p1);
+        do_not_expect_pk_fault("plain read on recently PROT_EXEC area");
+}
+
 void test_mprotect_pkey_on_unsupported_cpu(int *ptr, u16 pkey)
 {
         int size = PAGE_SIZE;
@@ -1302,6 +1406,8 @@ void (*pkey_tests[])(int *ptr, u16 pkey) = {
         test_kernel_gup_of_access_disabled_region,
         test_kernel_gup_write_to_write_disabled_region,
         test_executing_on_unreadable_memory,
+        test_implicit_mprotect_exec_only_memory,
+        test_mprotect_with_pkey_0,
         test_ptrace_of_child,
         test_pkey_syscalls_on_non_allocated_pkey,
         test_pkey_syscalls_bad_args,
diff --git a/tools/testing/selftests/x86/test_syscall_vdso.c b/tools/testing/selftests/x86/test_syscall_vdso.c
index 40370354d4c1..c9c3281077bc 100644
--- a/tools/testing/selftests/x86/test_syscall_vdso.c
+++ b/tools/testing/selftests/x86/test_syscall_vdso.c
@@ -100,12 +100,19 @@ asm (
         "       shl     $32, %r8\n"
         "       orq     $0x7f7f7f7f, %r8\n"
         "       movq    %r8, %r9\n"
-        "       movq    %r8, %r10\n"
-        "       movq    %r8, %r11\n"
-        "       movq    %r8, %r12\n"
-        "       movq    %r8, %r13\n"
-        "       movq    %r8, %r14\n"
-        "       movq    %r8, %r15\n"
+        "       incq    %r9\n"
+        "       movq    %r9, %r10\n"
+        "       incq    %r10\n"
+        "       movq    %r10, %r11\n"
+        "       incq    %r11\n"
+        "       movq    %r11, %r12\n"
+        "       incq    %r12\n"
+        "       movq    %r12, %r13\n"
+        "       incq    %r13\n"
+        "       movq    %r13, %r14\n"
+        "       incq    %r14\n"
+        "       movq    %r14, %r15\n"
+        "       incq    %r15\n"
         "       ret\n"
         "       .code32\n"
         "       .popsection\n"
@@ -128,12 +135,13 @@ int check_regs64(void)
         int err = 0;
         int num = 8;
         uint64_t *r64 = &regs64.r8;
+        uint64_t expected = 0x7f7f7f7f7f7f7f7fULL;
 
         if (!kernel_is_64bit)
                 return 0;
 
         do {
-                if (*r64 == 0x7f7f7f7f7f7f7f7fULL)
+                if (*r64 == expected++)
                         continue; /* register did not change */
                 if (syscall_addr != (long)&int80) {
                         /*
@@ -147,18 +155,17 @@ int check_regs64(void)
                                 continue;
                         }
                 } else {
-                        /* INT80 syscall entrypoint can be used by
+                        /*
+                         * INT80 syscall entrypoint can be used by
                          * 64-bit programs too, unlike SYSCALL/SYSENTER.
                          * Therefore it must preserve R12+
                          * (they are callee-saved registers in 64-bit C ABI).
                          *
-                         * This was probably historically not intended,
-                         * but R8..11 are clobbered (cleared to 0).
-                         * IOW: they are the only registers which aren't
-                         * preserved across INT80 syscall.
+                         * Starting in Linux 4.17 (and any kernel that
+                         * backports the change), R8..11 are preserved.
+                         * Historically (and probably unintentionally), they
+                         * were clobbered or zeroed.
                          */
-                        if (*r64 == 0 && num <= 11)
-                                continue;
                 }
                 printf("[FAIL]\tR%d has changed:%016llx\n", num, *r64);
                 err++;
diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c
index 1c12536f2081..18f523557983 100644
--- a/tools/thermal/tmon/sysfs.c
+++ b/tools/thermal/tmon/sysfs.c
@@ -486,6 +486,7 @@ int zone_instance_to_index(int zone_inst)
 int update_thermal_data()
 {
         int i;
+        int next_thermal_record = cur_thermal_record + 1;
         char tz_name[256];
         static unsigned long samples;
 
@@ -495,9 +496,9 @@ int update_thermal_data()
         }
 
         /* circular buffer for keeping historic data */
-        if (cur_thermal_record >= NR_THERMAL_RECORDS)
-                cur_thermal_record = 0;
-        gettimeofday(&trec[cur_thermal_record].tv, NULL);
+        if (next_thermal_record >= NR_THERMAL_RECORDS)
+                next_thermal_record = 0;
+        gettimeofday(&trec[next_thermal_record].tv, NULL);
         if (tmon_log) {
                 fprintf(tmon_log, "%lu ", ++samples);
                 fprintf(tmon_log, "%3.1f ", p_param.t_target);
@@ -507,11 +508,12 @@ int update_thermal_data()
                 snprintf(tz_name, 256, "%s/%s%d", THERMAL_SYSFS, TZONE,
                         ptdata.tzi[i].instance);
                 sysfs_get_ulong(tz_name, "temp",
-                                &trec[cur_thermal_record].temp[i]);
+                                &trec[next_thermal_record].temp[i]);
                 if (tmon_log)
                         fprintf(tmon_log, "%lu ",
-                                trec[cur_thermal_record].temp[i]/1000);
+                                trec[next_thermal_record].temp[i] / 1000);
         }
+        cur_thermal_record = next_thermal_record;
         for (i = 0; i < ptdata.nr_cooling_dev; i++) {
                 char cdev_name[256];
                 unsigned long val;
diff --git a/tools/thermal/tmon/tmon.c b/tools/thermal/tmon/tmon.c
index 9aa19652e8e8..b43138f8b862 100644
--- a/tools/thermal/tmon/tmon.c
+++ b/tools/thermal/tmon/tmon.c
@@ -336,7 +336,6 @@ int main(int argc, char **argv)
                         show_data_w();
                         show_cooling_device();
                 }
-                cur_thermal_record++;
                 time_elapsed += ticktime;
                 controller_handler(trec[0].temp[target_tz_index] / 1000,
                                 &yk);
diff --git a/tools/usb/usbip/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c
index 001bb8e8f668..bb424638d75b 100644
--- a/tools/usb/usbip/libsrc/usbip_common.c
+++ b/tools/usb/usbip/libsrc/usbip_common.c
@@ -66,6 +66,29 @@ const char *usbip_speed_string(int num)
         return "Unknown Speed";
 }
 
+struct op_common_status_string {
+        int num;
+        char *desc;
+};
+
+static struct op_common_status_string op_common_status_strings[] = {
+        { ST_OK,        "Request Completed Successfully" },
+        { ST_NA,        "Request Failed" },
+        { ST_DEV_BUSY,  "Device busy (exported)" },
+        { ST_DEV_ERR,   "Device in error state" },
+        { ST_NODEV,     "Device not found" },
+        { ST_ERROR,     "Unexpected response" },
+        { 0, NULL}
+};
+
+const char *usbip_op_common_status_string(int status)
+{
+        for (int i = 0; op_common_status_strings[i].desc != NULL; i++)
+                if (op_common_status_strings[i].num == status)
+                        return op_common_status_strings[i].desc;
+
+        return "Unknown Op Common Status";
+}
 
 #define DBG_UDEV_INTEGER(name)\
         dbg("%-20s = %x", to_string(name), (int) udev->name)
diff --git a/tools/usb/usbip/libsrc/usbip_common.h b/tools/usb/usbip/libsrc/usbip_common.h
index e45ec9d2fdbc..73a367a7fa10 100644
--- a/tools/usb/usbip/libsrc/usbip_common.h
+++ b/tools/usb/usbip/libsrc/usbip_common.h
@@ -43,6 +43,16 @@
 #define SYSFS_PATH_MAX          256
 #define SYSFS_BUS_ID_SIZE       32
 
+/* Defines for op_code status in server/client op_common PDUs */
+#define ST_OK   0x00
+#define ST_NA   0x01
+        /* Device requested for import is not available */
+#define ST_DEV_BUSY     0x02
+        /* Device requested for import is in error state */
+#define ST_DEV_ERR      0x03
+#define ST_NODEV        0x04
+#define ST_ERROR        0x05
+
 extern int usbip_use_syslog;
 extern int usbip_use_stderr;
 extern int usbip_use_debug ;
@@ -130,6 +140,7 @@ int read_usb_interface(struct usbip_usb_device *udev, int i,
 
 const char *usbip_speed_string(int num);
 const char *usbip_status_string(int32_t status);
+const char *usbip_op_common_status_string(int status);
 
 int usbip_names_init(char *);
 void usbip_names_free(void);
diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
index 6ff7b601f854..dc93fadbee96 100644
--- a/tools/usb/usbip/libsrc/usbip_host_common.c
+++ b/tools/usb/usbip/libsrc/usbip_host_common.c
@@ -234,14 +234,17 @@ int usbip_export_device(struct usbip_exported_device *edev, int sockfd)
                 switch (edev->status) {
                 case SDEV_ST_ERROR:
                         dbg("status SDEV_ST_ERROR");
+                        ret = ST_DEV_ERR;
                         break;
                 case SDEV_ST_USED:
                         dbg("status SDEV_ST_USED");
+                        ret = ST_DEV_BUSY;
                         break;
                 default:
                         dbg("status unknown: 0x%x", edev->status);
+                        ret = -1;
                 }
-                return -1;
+                return ret;
         }
 
         /* only the first interface is true */
diff --git a/tools/usb/usbip/src/usbip_attach.c b/tools/usb/usbip/src/usbip_attach.c
index 7f07b2d50f59..ba88728483ff 100644
--- a/tools/usb/usbip/src/usbip_attach.c
+++ b/tools/usb/usbip/src/usbip_attach.c
@@ -135,6 +135,7 @@ static int query_import_device(int sockfd, char *busid)
         struct op_import_request request;
         struct op_import_reply   reply;
         uint16_t code = OP_REP_IMPORT;
+        int status;
 
         memset(&request, 0, sizeof(request));
         memset(&reply, 0, sizeof(reply));
@@ -157,9 +158,10 @@ static int query_import_device(int sockfd, char *busid)
         }
 
         /* receive a reply */
-        rc = usbip_net_recv_op_common(sockfd, &code);
+        rc = usbip_net_recv_op_common(sockfd, &code, &status);
         if (rc < 0) {
-                err("recv op_common");
+                err("Attach Request for %s failed - %s\n",
+                    busid, usbip_op_common_status_string(status));
                 return -1;
         }
 
@@ -194,10 +196,8 @@ static int attach_device(char *host, char *busid)
         }
 
         rhport = query_import_device(sockfd, busid);
-        if (rhport < 0) {
-                err("query");
+        if (rhport < 0)
                 return -1;
-        }
 
         close(sockfd);
 
diff --git a/tools/usb/usbip/src/usbip_list.c b/tools/usb/usbip/src/usbip_list.c
index d65a9f444174..8d4ccf4b9480 100644
--- a/tools/usb/usbip/src/usbip_list.c
+++ b/tools/usb/usbip/src/usbip_list.c
@@ -62,6 +62,7 @@ static int get_exported_devices(char *host, int sockfd)
         struct usbip_usb_interface uintf;
         unsigned int i;
         int rc, j;
+        int status;
 
         rc = usbip_net_send_op_common(sockfd, OP_REQ_DEVLIST, 0);
         if (rc < 0) {
@@ -69,9 +70,10 @@ static int get_exported_devices(char *host, int sockfd)
                 return -1;
         }
 
-        rc = usbip_net_recv_op_common(sockfd, &code);
+        rc = usbip_net_recv_op_common(sockfd, &code, &status);
         if (rc < 0) {
-                dbg("usbip_net_recv_op_common failed");
+                err("Exported Device List Request failed - %s\n",
+                    usbip_op_common_status_string(status));
                 return -1;
         }
 
diff --git a/tools/usb/usbip/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
index b4c37e76a6e0..8ffcd47d9638 100644
--- a/tools/usb/usbip/src/usbip_network.c
+++ b/tools/usb/usbip/src/usbip_network.c
@@ -163,7 +163,7 @@ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
         return 0;
 }
 
-int usbip_net_recv_op_common(int sockfd, uint16_t *code)
+int usbip_net_recv_op_common(int sockfd, uint16_t *code, int *status)
 {
         struct op_common op_common;
         int rc;
@@ -179,8 +179,8 @@ int usbip_net_recv_op_common(int sockfd, uint16_t *code)
         PACK_OP_COMMON(0, &op_common);
 
         if (op_common.version != USBIP_VERSION) {
-                dbg("version mismatch: %d %d", op_common.version,
-                    USBIP_VERSION);
+                err("USBIP Kernel and tool version mismatch: %d %d:",
+                    op_common.version, USBIP_VERSION);
                 goto err;
         }
 
@@ -191,10 +191,14 @@ int usbip_net_recv_op_common(int sockfd, uint16_t *code)
                 if (op_common.code != *code) {
                         dbg("unexpected pdu %#0x for %#0x", op_common.code,
                             *code);
+                        /* return error status */
+                        *status = ST_ERROR;
                         goto err;
                 }
         }
 
+        *status = op_common.status;
+
         if (op_common.status != ST_OK) {
                 dbg("request failed at peer: %d", op_common.status);
                 goto err;
diff --git a/tools/usb/usbip/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
index 7032687621d3..555215eae43e 100644
--- a/tools/usb/usbip/src/usbip_network.h
+++ b/tools/usb/usbip/src/usbip_network.h
@@ -27,9 +27,7 @@ struct op_common {
 #define OP_REPLY        (0x00 << 8)
         uint16_t code;
 
-        /* add more error code */
-#define ST_OK   0x00
-#define ST_NA   0x01
+        /* status codes defined in usbip_common.h */
         uint32_t status; /* op_code status (for reply) */
 
 } __attribute__((packed));
@@ -176,7 +174,7 @@ void usbip_net_pack_usb_interface(int pack, struct usbip_usb_interface *uinf);
 ssize_t usbip_net_recv(int sockfd, void *buff, size_t bufflen);
 ssize_t usbip_net_send(int sockfd, void *buff, size_t bufflen);
 int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status);
-int usbip_net_recv_op_common(int sockfd, uint16_t *code);
+int usbip_net_recv_op_common(int sockfd, uint16_t *code, int *status);
 int usbip_net_set_reuseaddr(int sockfd);
 int usbip_net_set_nodelay(int sockfd);
 int usbip_net_set_keepalive(int sockfd);
diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c
index c6dad2a13c80..32864c52942d 100644
--- a/tools/usb/usbip/src/usbipd.c
+++ b/tools/usb/usbip/src/usbipd.c
@@ -107,7 +107,7 @@ static int recv_request_import(int sockfd)
         struct usbip_usb_device pdu_udev;
         struct list_head *i;
         int found = 0;
-        int error = 0;
+        int status = ST_OK;
         int rc;
 
         memset(&req, 0, sizeof(req));
@@ -133,22 +133,21 @@ static int recv_request_import(int sockfd)
                 usbip_net_set_nodelay(sockfd);
 
                 /* export device needs a TCP/IP socket descriptor */
-                rc = usbip_export_device(edev, sockfd);
-                if (rc < 0)
-                        error = 1;
+                status = usbip_export_device(edev, sockfd);
+                if (status < 0)
+                        status = ST_NA;
         } else {
                 info("requested device not found: %s", req.busid);
-                error = 1;
+                status = ST_NODEV;
         }
 
-        rc = usbip_net_send_op_common(sockfd, OP_REP_IMPORT,
-                                      (!error ? ST_OK : ST_NA));
+        rc = usbip_net_send_op_common(sockfd, OP_REP_IMPORT, status);
         if (rc < 0) {
                 dbg("usbip_net_send_op_common failed: %#0x", OP_REP_IMPORT);
                 return -1;
         }
 
-        if (error) {
+        if (status) {
                 dbg("import request busid %s: failed", req.busid);
                 return -1;
         }
@@ -176,10 +175,21 @@ static int send_reply_devlist(int connfd)
         struct list_head *j;
         int rc, i;
 
+        /*
+         * Exclude devices that are already exported to a client from
+         * the exportable device list to avoid:
+         *      - import requests for devices that are exported only to
+         *        fail the request.
+         *      - revealing devices that are imported by a client to
+         *        another client.
+         */
+
         reply.ndev = 0;
         /* number of exported devices */
         list_for_each(j, &driver->edev_list) {
-                reply.ndev += 1;
+                edev = list_entry(j, struct usbip_exported_device, node);
+                if (edev->status != SDEV_ST_USED)
+                        reply.ndev += 1;
         }
         info("exportable devices: %d", reply.ndev);
 
@@ -198,6 +208,9 @@ static int send_reply_devlist(int connfd)
 
         list_for_each(j, &driver->edev_list) {
                 edev = list_entry(j, struct usbip_exported_device, node);
+                if (edev->status == SDEV_ST_USED)
+                        continue;
+
                 dump_usb_device(&edev->udev);
                 memcpy(&pdu_udev, &edev->udev, sizeof(pdu_udev));
                 usbip_net_pack_usb_device(1, &pdu_udev);
@@ -251,8 +264,9 @@ static int recv_pdu(int connfd)
 {
         uint16_t code = OP_UNSPEC;
         int ret;
+        int status;
 
-        ret = usbip_net_recv_op_common(connfd, &code);
+        ret = usbip_net_recv_op_common(connfd, &code, &status);
         if (ret < 0) {
                 dbg("could not receive opcode: %#0x", code);
                 return -1;
diff --git a/tools/virtio/ringtest/ptr_ring.c b/tools/virtio/ringtest/ptr_ring.c
index 477899c12c51..2d566fbd236b 100644
--- a/tools/virtio/ringtest/ptr_ring.c
+++ b/tools/virtio/ringtest/ptr_ring.c
@@ -17,6 +17,8 @@
 #define likely(x)    (__builtin_expect(!!(x), 1))
 #define ALIGN(x, a) (((x) + (a) - 1) / (a) * (a))
 #define SIZE_MAX        (~(size_t)0)
+#define KMALLOC_MAX_SIZE SIZE_MAX
+#define BUG_ON(x) assert(x)
 
 typedef pthread_spinlock_t  spinlock_t;
 
@@ -57,6 +59,9 @@ static void kfree(void *p)
                 free(p);
 }
 
+#define kvmalloc_array kmalloc_array
+#define kvfree kfree
+
 static void spin_lock_init(spinlock_t *lock)
 {
         int r = pthread_spin_init(lock, 0);