151 files changed, 6595 insertions, 1136 deletions
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 508e3fe934d2..1022e7b675c2 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -298,7 +298,7 @@ config HUGETLB_PAGE_SIZE_VARIABLE
 config MATH_EMULATION
        bool "Math emulation"
-        depends on 4xx || 8xx || E200 || PPC_MPC832x || E500
+        depends on 4xx || 8xx || PPC_MPC832x || BOOKE
        ---help---
          Some PowerPC chips designed for embedded applications do not have
          a floating-point unit and therefore do not implement the
@@ -307,6 +307,10 @@ config MATH_EMULATION
          unit, which will allow programs that use floating-point
          instructions to run.
+          This is also useful to emulate missing (optional) instructions
+          such as fsqrt on cores that do have an FPU but do not implement
+          them (such as Freescale BookE).
 config PPC_TRANSACTIONAL_MEM
       bool "Transactional Memory support for POWERPC"
       depends on PPC_BOOK3S_64
@@ -315,17 +319,6 @@ config PPC_TRANSACTIONAL_MEM
       ---help---
         Support user-mode Transactional Memory on POWERPC.
-config 8XX_MINIMAL_FPEMU
-        bool "Minimal math emulation for 8xx"
-        depends on 8xx && !MATH_EMULATION
-        help
-          Older arch/ppc kernels still emulated a few floating point
-          instructions such as load and store, even when full math
-          emulation is disabled.  Say "Y" here if you want to preserve
-          this behavior.
-          It is recommended that you build a soft-float userspace instead.
 config IOMMU_HELPER
        def_bool PPC64
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 863d877e0b5f..d86875f3e17e 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -147,6 +147,13 @@ choice
          enable debugging for the wrong type of machine your kernel
          _will not boot_.
+config PPC_EARLY_DEBUG_BOOTX
+        bool "BootX or OpenFirmware"
+        depends on BOOTX_TEXT
+        help
+          Select this to enable early debugging for a machine using BootX
+          or OpenFirmware.
 config PPC_EARLY_DEBUG_LPAR
        bool "LPAR HV Console"
        depends on PPC_PSERIES
diff --git a/arch/powerpc/boot/dts/currituck.dts b/arch/powerpc/boot/dts/currituck.dts
index b801dd06e573..d2c8a872308e 100644
--- a/arch/powerpc/boot/dts/currituck.dts
+++ b/arch/powerpc/boot/dts/currituck.dts
@@ -103,6 +103,11 @@
                                interrupts = <34 2>;
                        };
+                        FPGA0: fpga@50000000 {
+                                compatible = "ibm,currituck-fpga";
+                                reg = <0x50000000 0x4>;
+                        };
                        IIC0: i2c@00000000 {
                                compatible = "ibm,iic-currituck", "ibm,iic";
                                reg = <0x0 0x00000014>;
diff --git a/arch/powerpc/boot/dts/fsl/interlaken-lac-portals.dtsi b/arch/powerpc/boot/dts/fsl/interlaken-lac-portals.dtsi
new file mode 100644
index 000000000000..9cffccf4e07e
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/interlaken-lac-portals.dtsi
@@ -0,0 +1,156 @@
+/* T4240 Interlaken LAC Portal device tree stub with 24 portals.
+ *
+ * Copyright 2012 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#address-cells = <0x1>;
+#size-cells = <0x1>;
+compatible = "fsl,interlaken-lac-portals";
+lportal0: lac-portal@0 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x0 0x1000>;
+};
+lportal1: lac-portal@1000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x1000 0x1000>;
+};
+lportal2: lac-portal@2000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x2000 0x1000>;
+};
+lportal3: lac-portal@3000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x3000 0x1000>;
+};
+lportal4: lac-portal@4000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x4000 0x1000>;
+};
+lportal5: lac-portal@5000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x5000 0x1000>;
+};
+lportal6: lac-portal@6000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x6000 0x1000>;
+};
+lportal7: lac-portal@7000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x7000 0x1000>;
+};
+lportal8: lac-portal@8000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x8000 0x1000>;
+};
+lportal9: lac-portal@9000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x9000 0x1000>;
+};
+lportal10: lac-portal@A000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0xA000 0x1000>;
+};
+lportal11: lac-portal@B000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0xB000 0x1000>;
+};
+lportal12: lac-portal@C000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0xC000 0x1000>;
+};
+lportal13: lac-portal@D000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0xD000 0x1000>;
+};
+lportal14: lac-portal@E000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0xE000 0x1000>;
+};
+lportal15: lac-portal@F000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0xF000 0x1000>;
+};
+lportal16: lac-portal@10000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x10000 0x1000>;
+};
+lportal17: lac-portal@11000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x11000 0x1000>;
+};
+lportal18: lac-portal@1200 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x12000 0x1000>;
+};
+lportal19: lac-portal@13000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x13000 0x1000>;
+};
+lportal20: lac-portal@14000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x14000 0x1000>;
+};
+lportal21: lac-portal@15000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x15000 0x1000>;
+};
+lportal22: lac-portal@16000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x16000 0x1000>;
+};
+lportal23: lac-portal@17000 {
+        compatible = "fsl,interlaken-lac-portal-v1.0";
+        reg = <0x17000 0x1000>;
+};
diff --git a/arch/powerpc/boot/dts/fsl/interlaken-lac.dtsi b/arch/powerpc/boot/dts/fsl/interlaken-lac.dtsi
new file mode 100644
index 000000000000..e8208720ac0e
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/interlaken-lac.dtsi
@@ -0,0 +1,45 @@
+/*
+ * T4 Interlaken Look-aside Controller (LAC) device tree stub
+ *
+ * Copyright 2012 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+lac: lac@229000 {
+        compatible = "fsl,interlaken-lac";
+        reg = <0x229000 0x1000>;
+        interrupts = <16 2 1 18>;
+};
+lac-hv@228000 {
+        compatible = "fsl,interlaken-lac-hv";
+        reg = <0x228000 0x1000>;
+        fsl,non-hv-node = <&lac>;
+};
diff --git a/arch/powerpc/configs/c2k_defconfig b/arch/powerpc/configs/c2k_defconfig
index 2a84fd7f631c..671a8f960afa 100644
--- a/arch/powerpc/configs/c2k_defconfig
+++ b/arch/powerpc/configs/c2k_defconfig
@@ -423,6 +423,8 @@ CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_BOOTX_TEXT=y
+CONFIG_PPC_EARLY_DEBUG=y
+CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_KEYS=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
 CONFIG_SECURITY=y
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index 07b7f2af2dca..1ea22fc24ea8 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -284,6 +284,8 @@ CONFIG_DEBUG_MUTEXES=y
 CONFIG_LATENCYTOP=y
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_BOOTX_TEXT=y
+CONFIG_PPC_EARLY_DEBUG=y
+CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_ECB=m
diff --git a/arch/powerpc/configs/maple_defconfig b/arch/powerpc/configs/maple_defconfig
index 02ac96b679b8..2a5afac29861 100644
--- a/arch/powerpc/configs/maple_defconfig
+++ b/arch/powerpc/configs/maple_defconfig
@@ -138,6 +138,8 @@ CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_BOOTX_TEXT=y
+CONFIG_PPC_EARLY_DEBUG=y
+CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
diff --git a/arch/powerpc/configs/mpc512x_defconfig b/arch/powerpc/configs/mpc512x_defconfig
index 0d0d981442fd..ee853a1b1b2c 100644
--- a/arch/powerpc/configs/mpc512x_defconfig
+++ b/arch/powerpc/configs/mpc512x_defconfig
@@ -1,7 +1,6 @@
-CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
-CONFIG_SPARSE_IRQ=y
+CONFIG_NO_HZ=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_COMPAT_BRK is not set
@@ -9,6 +8,7 @@ CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
 # CONFIG_IOSCHED_CFQ is not set
 # CONFIG_PPC_CHRP is not set
 CONFIG_PPC_MPC512x=y
@@ -16,9 +16,7 @@ CONFIG_MPC5121_ADS=y
 CONFIG_MPC512x_GENERIC=y
 CONFIG_PDM360NG=y
 # CONFIG_PPC_PMAC is not set
-CONFIG_NO_HZ=y
 CONFIG_HZ_1000=y
-# CONFIG_MIGRATION is not set
 # CONFIG_SECCOMP is not set
 # CONFIG_PCI is not set
 CONFIG_NET=y
@@ -33,8 +31,6 @@ CONFIG_IP_PNP=y
 # CONFIG_INET_DIAG is not set
 # CONFIG_IPV6 is not set
 CONFIG_CAN=y
-CONFIG_CAN_RAW=y
-CONFIG_CAN_BCM=y
 CONFIG_CAN_VCAN=y
 CONFIG_CAN_MSCAN=y
 CONFIG_CAN_DEBUG_DEVICES=y
@@ -46,7 +42,6 @@ CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_CFI_AMDSTD=y
@@ -60,7 +55,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=1
 CONFIG_BLK_DEV_RAM_SIZE=8192
 CONFIG_BLK_DEV_XIP=y
-CONFIG_MISC_DEVICES=y
 CONFIG_EEPROM_AT24=y
 CONFIG_EEPROM_AT25=y
 CONFIG_SCSI=y
@@ -68,6 +62,7 @@ CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_SG=y
 CONFIG_NETDEVICES=y
+CONFIG_FS_ENET=y
 CONFIG_MARVELL_PHY=y
 CONFIG_DAVICOM_PHY=y
 CONFIG_QSEMI_PHY=y
@@ -83,10 +78,6 @@ CONFIG_STE10XP=y
 CONFIG_LSI_ET1011C_PHY=y
 CONFIG_FIXED_PHY=y
 CONFIG_MDIO_BITBANG=y
-CONFIG_NET_ETHERNET=y
-CONFIG_FS_ENET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_WLAN is not set
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_EVDEV=y
@@ -106,14 +97,18 @@ CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_MPC8XXX=y
 # CONFIG_HWMON is not set
 CONFIG_MEDIA_SUPPORT=y
-CONFIG_VIDEO_DEV=y
 CONFIG_VIDEO_ADV_DEBUG=y
-# CONFIG_VIDEO_HELPER_CHIPS_AUTO is not set
-CONFIG_VIDEO_SAA711X=y
 CONFIG_FB=y
 CONFIG_FB_FSL_DIU=y
 # CONFIG_VGA_CONSOLE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_USB=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_FSL=y
+# CONFIG_USB_EHCI_HCD_PPC_OF is not set
+CONFIG_USB_STORAGE=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_FSL_USB2=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_M41T80=y
 CONFIG_RTC_DRV_MPC5121=y
@@ -129,9 +124,7 @@ CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_UBIFS_FS=y
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_ROOT_NFS=y
-CONFIG_PARTITION_ADVANCED=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/powerpc/configs/mpc85xx_smp_defconfig b/arch/powerpc/configs/mpc85xx_smp_defconfig
index 165e6b32baef..152fa05b15e4 100644
--- a/arch/powerpc/configs/mpc85xx_smp_defconfig
+++ b/arch/powerpc/configs/mpc85xx_smp_defconfig
@@ -131,6 +131,7 @@ CONFIG_DUMMY=y
 CONFIG_FS_ENET=y
 CONFIG_UCC_GETH=y
 CONFIG_GIANFAR=y
+CONFIG_E1000E=y
 CONFIG_MARVELL_PHY=y
 CONFIG_DAVICOM_PHY=y
 CONFIG_CICADA_PHY=y
diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
index 29767a8dfea5..a73626b09051 100644
--- a/arch/powerpc/configs/pmac32_defconfig
+++ b/arch/powerpc/configs/pmac32_defconfig
@@ -350,6 +350,8 @@ CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_BOOTX_TEXT=y
+CONFIG_PPC_EARLY_DEBUG=y
+CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_MD4=m
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index aef3f71de5ad..c86fcb92358e 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -398,6 +398,8 @@ CONFIG_FTR_FIXUP_SELFTEST=y
 CONFIG_MSI_BITMAP_SELFTEST=y
 CONFIG_XMON=y
 CONFIG_BOOTX_TEXT=y
+CONFIG_PPC_EARLY_DEBUG=y
+CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_PCBC=m
diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig
index be1cb6ea3a36..20ebfaf7234b 100644
--- a/arch/powerpc/configs/ppc6xx_defconfig
+++ b/arch/powerpc/configs/ppc6xx_defconfig
@@ -1264,6 +1264,8 @@ CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_XMON=y
 CONFIG_BOOTX_TEXT=y
+CONFIG_PPC_EARLY_DEBUG=y
+CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_KEYS=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
 CONFIG_SECURITY=y
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index c4dfbaf8b192..bea8587c3af5 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -296,6 +296,7 @@ CONFIG_SQUASHFS=m
 CONFIG_SQUASHFS_XATTR=y
 CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
+CONFIG_PSTORE=y
 CONFIG_NFS_FS=y
 CONFIG_NFS_V3_ACL=y
 CONFIG_NFS_V4=y
diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h
index a80e32b46c11..09a8743143f3 100644
--- a/arch/powerpc/include/asm/eeh.h
+++ b/arch/powerpc/include/asm/eeh.h
@@ -24,6 +24,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/string.h>
+#include <linux/time.h>
 struct pci_dev;
 struct pci_bus;
@@ -52,6 +53,7 @@ struct device_node;
 #define EEH_PE_ISOLATED         (1 << 0)        /* Isolated PE          */
 #define EEH_PE_RECOVERING       (1 << 1)        /* Recovering PE        */
+#define EEH_PE_PHB_DEAD         (1 << 2)        /* Dead PHB             */
 struct eeh_pe {
        int type;                       /* PE type: PHB/Bus/Device      */
@@ -59,8 +61,10 @@ struct eeh_pe {
        int config_addr;                /* Traditional PCI address      */
        int addr;                       /* PE configuration address     */
        struct pci_controller *phb;     /* Associated PHB               */
+        struct pci_bus *bus;            /* Top PCI bus for bus PE       */
        int check_count;                /* Times of ignored error       */
        int freeze_count;               /* Times of froze up            */
+        struct timeval tstamp;          /* Time on first-time freeze    */
        int false_positives;            /* Times of reported #ff's      */
        struct eeh_pe *parent;          /* Parent PE                    */
        struct list_head child_list;    /* Link PE to the child list    */
@@ -95,12 +99,12 @@ struct eeh_dev {
 static inline struct device_node *eeh_dev_to_of_node(struct eeh_dev *edev)
 {
-        return edev->dn;
+        return edev ? edev->dn : NULL;
 }
 static inline struct pci_dev *eeh_dev_to_pci_dev(struct eeh_dev *edev)
 {
-        return edev->pdev;
+        return edev ? edev->pdev : NULL;
 }
 /*
@@ -130,8 +134,9 @@ static inline struct pci_dev *eeh_dev_to_pci_dev(struct eeh_dev *edev)
 struct eeh_ops {
        char *name;
        int (*init)(void);
+        int (*post_init)(void);
        void* (*of_probe)(struct device_node *dn, void *flag);
-        void* (*dev_probe)(struct pci_dev *dev, void *flag);
+        int (*dev_probe)(struct pci_dev *dev, void *flag);
        int (*set_option)(struct eeh_pe *pe, int option);
        int (*get_pe_addr)(struct eeh_pe *pe);
        int (*get_state)(struct eeh_pe *pe, int *state);
@@ -141,11 +146,12 @@ struct eeh_ops {
        int (*configure_bridge)(struct eeh_pe *pe);
        int (*read_config)(struct device_node *dn, int where, int size, u32 *val);
        int (*write_config)(struct device_node *dn, int where, int size, u32 val);
+        int (*next_error)(struct eeh_pe **pe);
 };
 extern struct eeh_ops *eeh_ops;
 extern int eeh_subsystem_enabled;
-extern struct mutex eeh_mutex;
+extern raw_spinlock_t confirm_error_lock;
 extern int eeh_probe_mode;
 #define EEH_PROBE_MODE_DEV      (1<<0)  /* From PCI device      */
@@ -166,14 +172,14 @@ static inline int eeh_probe_mode_dev(void)
        return (eeh_probe_mode == EEH_PROBE_MODE_DEV);
 }
-static inline void eeh_lock(void)
+static inline void eeh_serialize_lock(unsigned long *flags)
 {
-        mutex_lock(&eeh_mutex);
+        raw_spin_lock_irqsave(&confirm_error_lock, *flags);
 }
-static inline void eeh_unlock(void)
+static inline void eeh_serialize_unlock(unsigned long flags)
 {
-        mutex_unlock(&eeh_mutex);
+        raw_spin_unlock_irqrestore(&confirm_error_lock, flags);
 }
 /*
@@ -184,8 +190,11 @@ static inline void eeh_unlock(void)
 typedef void *(*eeh_traverse_func)(void *data, void *flag);
 int eeh_phb_pe_create(struct pci_controller *phb);
+struct eeh_pe *eeh_phb_pe_get(struct pci_controller *phb);
+struct eeh_pe *eeh_pe_get(struct eeh_dev *edev);
 int eeh_add_to_parent_pe(struct eeh_dev *edev);
 int eeh_rmv_from_parent_pe(struct eeh_dev *edev, int purge_pe);
+void eeh_pe_update_time_stamp(struct eeh_pe *pe);
 void *eeh_pe_dev_traverse(struct eeh_pe *root,
                eeh_traverse_func fn, void *flag);
 void eeh_pe_restore_bars(struct eeh_pe *pe);
@@ -193,12 +202,13 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe);
 void *eeh_dev_init(struct device_node *dn, void *data);
 void eeh_dev_phb_init_dynamic(struct pci_controller *phb);
+int eeh_init(void);
 int __init eeh_ops_register(struct eeh_ops *ops);
 int __exit eeh_ops_unregister(const char *name);
 unsigned long eeh_check_failure(const volatile void __iomem *token,
                                unsigned long val);
 int eeh_dev_check_failure(struct eeh_dev *edev);
-void __init eeh_addr_cache_build(void);
+void eeh_addr_cache_build(void);
 void eeh_add_device_tree_early(struct device_node *);
 void eeh_add_device_tree_late(struct pci_bus *);
 void eeh_add_sysfs_files(struct pci_bus *);
@@ -221,6 +231,11 @@ void eeh_remove_bus_device(struct pci_dev *, int);
 #else /* !CONFIG_EEH */
+static inline int eeh_init(void)
+{
+        return 0;
+}
 static inline void *eeh_dev_init(struct device_node *dn, void *data)
 {
        return NULL;
@@ -245,9 +260,6 @@ static inline void eeh_add_sysfs_files(struct pci_bus *bus) { }
 static inline void eeh_remove_bus_device(struct pci_dev *dev, int purge_pe) { }
-static inline void eeh_lock(void) { }
-static inline void eeh_unlock(void) { }
 #define EEH_POSSIBLE_ERROR(val, type) (0)
 #define EEH_IO_ERROR_VALUE(size) (-1UL)
 #endif /* CONFIG_EEH */
diff --git a/arch/powerpc/include/asm/eeh_event.h b/arch/powerpc/include/asm/eeh_event.h
index de67d830151b..89d5670b2eeb 100644
--- a/arch/powerpc/include/asm/eeh_event.h
+++ b/arch/powerpc/include/asm/eeh_event.h
@@ -31,7 +31,9 @@ struct eeh_event {
        struct eeh_pe           *pe;    /* EEH PE               */
 };
+int eeh_event_init(void);
 int eeh_send_failure_event(struct eeh_pe *pe);
+void eeh_remove_event(struct eeh_pe *pe);
 void eeh_handle_event(struct eeh_pe *pe);
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 46793b58a761..07ca627e52c0 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -358,12 +358,12 @@ label##_relon_pSeries:					\
        /* No guest interrupts come through here */     \
        SET_SCRATCH0(r13);              /* save r13 */  \
        EXCEPTION_RELON_PROLOG_PSERIES(PACA_EXGEN, label##_common, \
-                                       EXC_STD, KVMTEST_PR, vec)
+                                       EXC_STD, NOTEST, vec)
 #define STD_RELON_EXCEPTION_PSERIES_OOL(vec, label)             \
        .globl label##_relon_pSeries;                           \
 label##_relon_pSeries:                                          \
-        EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST_PR, vec);        \
+        EXCEPTION_PROLOG_1(PACA_EXGEN, NOTEST, vec);            \
        EXCEPTION_RELON_PROLOG_PSERIES_1(label##_common, EXC_STD)
 #define STD_RELON_EXCEPTION_HV(loc, vec, label)         \
@@ -374,12 +374,12 @@ label##_relon_hv:					\
        /* No guest interrupts come through here */     \
        SET_SCRATCH0(r13);      /* save r13 */          \
        EXCEPTION_RELON_PROLOG_PSERIES(PACA_EXGEN, label##_common, \
-                                       EXC_HV, KVMTEST, vec)
+                                       EXC_HV, NOTEST, vec)
 #define STD_RELON_EXCEPTION_HV_OOL(vec, label)                  \
        .globl label##_relon_hv;                                \
 label##_relon_hv:                                               \
-        EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST, vec);           \
+        EXCEPTION_PROLOG_1(PACA_EXGEN, NOTEST, vec);            \
        EXCEPTION_RELON_PROLOG_PSERIES_1(label##_common, EXC_HV)
 /* This associate vector numbers with bits in paca->irq_happened */
diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
index f2498c8e595d..d750336b171d 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -191,8 +191,14 @@ static inline void flush_hugetlb_page(struct vm_area_struct *vma,
                                      unsigned long vmaddr)
 {
 }
-#endif /* CONFIG_HUGETLB_PAGE */
+#define hugepd_shift(x) 0
+static inline pte_t *hugepte_offset(hugepd_t *hpdp, unsigned long addr,
+                                    unsigned pdshift)
+{
+        return 0;
+}
+#endif /* CONFIG_HUGETLB_PAGE */
 /*
 * FSL Book3E platforms require special gpage handling - the gpages
diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
index cbfe678e3dbe..c34656a8925e 100644
--- a/arch/powerpc/include/asm/iommu.h
+++ b/arch/powerpc/include/asm/iommu.h
@@ -76,6 +76,9 @@ struct iommu_table {
        struct iommu_pool large_pool;
        struct iommu_pool pools[IOMMU_NR_POOLS];
        unsigned long *it_map;       /* A simple allocation bitmap for now */
+#ifdef CONFIG_IOMMU_API
+        struct iommu_group *it_group;
+#endif
 };
 struct scatterlist;
@@ -98,6 +101,8 @@ extern void iommu_free_table(struct iommu_table *tbl, const char *node_name);
 */
 extern struct iommu_table *iommu_init_table(struct iommu_table * tbl,
                                            int nid);
+extern void iommu_register_group(struct iommu_table *tbl,
+                                 int pci_domain_number, unsigned long pe_num);
 extern int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                        struct scatterlist *sglist, int nelems,
@@ -125,13 +130,6 @@ extern void iommu_init_early_pSeries(void);
 extern void iommu_init_early_dart(void);
 extern void iommu_init_early_pasemi(void);
-#ifdef CONFIG_PCI
-extern void pci_iommu_init(void);
-extern void pci_direct_iommu_init(void);
-#else
-static inline void pci_iommu_init(void) { }
-#endif
 extern void alloc_dart_table(void);
 #if defined(CONFIG_PPC64) && defined(CONFIG_PM)
 static inline void iommu_save(void)
@@ -147,5 +145,26 @@ static inline void iommu_restore(void)
 }
 #endif
+/* The API to support IOMMU operations for VFIO */
+extern int iommu_tce_clear_param_check(struct iommu_table *tbl,
+                unsigned long ioba, unsigned long tce_value,
+                unsigned long npages);
+extern int iommu_tce_put_param_check(struct iommu_table *tbl,
+                unsigned long ioba, unsigned long tce);
+extern int iommu_tce_build(struct iommu_table *tbl, unsigned long entry,
+                unsigned long hwaddr, enum dma_data_direction direction);
+extern unsigned long iommu_clear_tce(struct iommu_table *tbl,
+                unsigned long entry);
+extern int iommu_clear_tces_and_put_pages(struct iommu_table *tbl,
+                unsigned long entry, unsigned long pages);
+extern int iommu_put_tce_user_mode(struct iommu_table *tbl,
+                unsigned long entry, unsigned long tce);
+extern void iommu_flush_tce(struct iommu_table *tbl);
+extern int iommu_take_ownership(struct iommu_table *tbl);
+extern void iommu_release_ownership(struct iommu_table *tbl);
+extern enum dma_data_direction iommu_tce_direction(unsigned long tce);
 #endif /* __KERNEL__ */
 #endif /* _ASM_IOMMU_H */
diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
index 9c1ff330c805..a1ecb14e4442 100644
--- a/arch/powerpc/include/asm/kvm_book3s_64.h
+++ b/arch/powerpc/include/asm/kvm_book3s_64.h
@@ -159,36 +159,46 @@ static inline int hpte_cache_flags_ok(unsigned long ptel, unsigned long io_type)
 }
 /*
- * Lock and read a linux PTE.  If it's present and writable, atomically
+ * If it's present and writable, atomically set dirty and referenced bits and
- * set dirty and referenced bits and return the PTE, otherwise return 0.
+ * return the PTE, otherwise return 0. If we find a transparent hugepage
+ * and if it is marked splitting we return 0;
 */
-static inline pte_t kvmppc_read_update_linux_pte(pte_t *p, int writing)
+static inline pte_t kvmppc_read_update_linux_pte(pte_t *ptep, int writing,
+                                                 unsigned int hugepage)
 {
-        pte_t pte, tmp;
+        pte_t old_pte, new_pte = __pte(0);
-        /* wait until _PAGE_BUSY is clear then set it atomically */
+        while (1) {
-        __asm__ __volatile__ (
+                old_pte = pte_val(*ptep);
-                "1:     ldarx   %0,0,%3\n"
+                /*
-                "       andi.   %1,%0,%4\n"
+                 * wait until _PAGE_BUSY is clear then set it atomically
-                "       bne-    1b\n"
+                 */
-                "       ori     %1,%0,%4\n"
+                if (unlikely(old_pte & _PAGE_BUSY)) {
-                "       stdcx.  %1,0,%3\n"
+                        cpu_relax();
-                "       bne-    1b"
+                        continue;
-                : "=&r" (pte), "=&r" (tmp), "=m" (*p)
+                }
-                : "r" (p), "i" (_PAGE_BUSY)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-                : "cc");
+                /* If hugepage and is trans splitting return None */
+                if (unlikely(hugepage &&
-        if (pte_present(pte)) {
+                             pmd_trans_splitting(pte_pmd(old_pte))))
-                pte = pte_mkyoung(pte);
+                        return __pte(0);
-                if (writing && pte_write(pte))
+#endif
-                        pte = pte_mkdirty(pte);
+                /* If pte is not present return None */
-        }
+                if (unlikely(!(old_pte & _PAGE_PRESENT)))
+                        return __pte(0);
-        *p = pte;       /* clears _PAGE_BUSY */
+                new_pte = pte_mkyoung(old_pte);
+                if (writing && pte_write(old_pte))
+                        new_pte = pte_mkdirty(new_pte);
-        return pte;
+                if (old_pte == __cmpxchg_u64((unsigned long *)ptep, old_pte,
+                                             new_pte))
+                        break;
+        }
+        return new_pte;
 }
 /* Return HPTE cache control bits corresponding to Linux pte bits */
 static inline unsigned long hpte_cache_bits(unsigned long pte_val)
 {
diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h
index b1e7f2af1016..9b12f88d4adb 100644
--- a/arch/powerpc/include/asm/lppaca.h
+++ b/arch/powerpc/include/asm/lppaca.h
@@ -66,7 +66,8 @@ struct lppaca {
        u8      reserved6[48];
        u8      cede_latency_hint;
-        u8      reserved7[7];
+        u8      ebb_regs_in_use;
+        u8      reserved7[6];
        u8      dtl_enable_mask;        /* Dispatch Trace Log mask */
        u8      donate_dedicated_cpu;   /* Donate dedicated CPU cycles */
        u8      fpregs_in_use;
diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
index 92386fc4e82a..8b480901165a 100644
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -36,13 +36,13 @@ struct machdep_calls {
 #ifdef CONFIG_PPC64
        void            (*hpte_invalidate)(unsigned long slot,
                                           unsigned long vpn,
-                                           int psize, int ssize,
+                                           int bpsize, int apsize,
-                                           int local);
+                                           int ssize, int local);
        long            (*hpte_updatepp)(unsigned long slot, 
                                         unsigned long newpp, 
                                         unsigned long vpn,
-                                         int psize, int ssize,
+                                         int bpsize, int apsize,
-                                         int local);
+                                         int ssize, int local);
        void            (*hpte_updateboltedpp)(unsigned long newpp, 
                                               unsigned long ea,
                                               int psize, int ssize);
@@ -57,6 +57,9 @@ struct machdep_calls {
        void            (*hpte_removebolted)(unsigned long ea,
                                             int psize, int ssize);
        void            (*flush_hash_range)(unsigned long number, int local);
+        void            (*hugepage_invalidate)(struct mm_struct *mm,
+                                               unsigned char *hpte_slot_array,
+                                               unsigned long addr, int psize);
        /* special for kexec, to be called in real mode, linear mapping is
         * destroyed as well */
diff --git a/arch/powerpc/include/asm/mmu-hash64.h b/arch/powerpc/include/asm/mmu-hash64.h
index 2accc9611248..c4cf01197273 100644
--- a/arch/powerpc/include/asm/mmu-hash64.h
+++ b/arch/powerpc/include/asm/mmu-hash64.h
@@ -340,6 +340,20 @@ extern int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
 int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                     pte_t *ptep, unsigned long trap, int local, int ssize,
                     unsigned int shift, unsigned int mmu_psize);
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+extern int __hash_page_thp(unsigned long ea, unsigned long access,
+                           unsigned long vsid, pmd_t *pmdp, unsigned long trap,
+                           int local, int ssize, unsigned int psize);
+#else
+static inline int __hash_page_thp(unsigned long ea, unsigned long access,
+                                  unsigned long vsid, pmd_t *pmdp,
+                                  unsigned long trap, int local,
+                                  int ssize, unsigned int psize)
+{
+        BUG();
+        return -1;
+}
+#endif
 extern void hash_failure_debug(unsigned long ea, unsigned long access,
                               unsigned long vsid, unsigned long trap,
                               int ssize, int psize, int lpsize,
diff --git a/arch/powerpc/include/asm/mpc5121.h b/arch/powerpc/include/asm/mpc5121.h
index 885c040d6194..8ae133eaf9fa 100644
--- a/arch/powerpc/include/asm/mpc5121.h
+++ b/arch/powerpc/include/asm/mpc5121.h
@@ -68,6 +68,5 @@ struct mpc512x_lpc {
 };
 int mpc512x_cs_config(unsigned int cs, u32 val);
-int __init mpc5121_clk_init(void);
 #endif /* __ASM_POWERPC_MPC5121_H__ */
diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h
index c0f9ef90f0b8..4a1ac9fbf186 100644
--- a/arch/powerpc/include/asm/mpic.h
+++ b/arch/powerpc/include/asm/mpic.h
@@ -339,6 +339,8 @@ struct mpic
 #endif
 };
+extern struct bus_type mpic_subsys;
 /*
 * MPIC flags (passed to mpic_alloc)
 *
@@ -393,6 +395,9 @@ struct mpic
 #define MPIC_REGSET_STANDARD            MPIC_REGSET(0)  /* Original MPIC */
 #define MPIC_REGSET_TSI108              MPIC_REGSET(1)  /* Tsi108/109 PIC */
+/* Get the version of primary MPIC */
+extern u32 fsl_mpic_primary_get_version(void);
 /* Allocate the controller structure and setup the linux irq descs
 * for the range if interrupts passed in. No HW initialization is
 * actually performed.
diff --git a/arch/powerpc/include/asm/mpic_timer.h b/arch/powerpc/include/asm/mpic_timer.h
new file mode 100644
index 000000000000..0e23cd4ac8aa
--- /dev/null
+++ b/arch/powerpc/include/asm/mpic_timer.h
@@ -0,0 +1,46 @@
+/*
+ * arch/powerpc/include/asm/mpic_timer.h
+ *
+ * Header file for Mpic Global Timer
+ *
+ * Copyright 2013 Freescale Semiconductor, Inc.
+ *
+ * Author: Wang Dongsheng <Dongsheng.Wang@freescale.com>
+ *         Li Yang <leoli@freescale.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+#ifndef __MPIC_TIMER__
+#define __MPIC_TIMER__
+#include <linux/interrupt.h>
+#include <linux/time.h>
+struct mpic_timer {
+        void                    *dev;
+        struct cascade_priv     *cascade_handle;
+        unsigned int            num;
+        unsigned int            irq;
+};
+#ifdef CONFIG_MPIC_TIMER
+struct mpic_timer *mpic_request_timer(irq_handler_t fn,  void *dev,
+                const struct timeval *time);
+void mpic_start_timer(struct mpic_timer *handle);
+void mpic_stop_timer(struct mpic_timer *handle);
+void mpic_get_remain_time(struct mpic_timer *handle, struct timeval *time);
+void mpic_free_timer(struct mpic_timer *handle);
+#else
+struct mpic_timer *mpic_request_timer(irq_handler_t fn,  void *dev,
+                const struct timeval *time) { return NULL; }
+void mpic_start_timer(struct mpic_timer *handle) { }
+void mpic_stop_timer(struct mpic_timer *handle) { }
+void mpic_get_remain_time(struct mpic_timer *handle, struct timeval *time) { }
+void mpic_free_timer(struct mpic_timer *handle) { }
+#endif
+#endif
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index cbb9305ab15a..029fe85722aa 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -117,7 +117,13 @@ extern int opal_enter_rtas(struct rtas_args *args,
 #define OPAL_SET_SLOT_LED_STATUS                55
 #define OPAL_GET_EPOW_STATUS                    56
 #define OPAL_SET_SYSTEM_ATTENTION_LED           57
+#define OPAL_RESERVED1                          58
+#define OPAL_RESERVED2                          59
+#define OPAL_PCI_NEXT_ERROR                     60
+#define OPAL_PCI_EEH_FREEZE_STATUS2             61
+#define OPAL_PCI_POLL                           62
 #define OPAL_PCI_MSI_EOI                        63
+#define OPAL_PCI_GET_PHB_DIAG_DATA2             64
 #ifndef __ASSEMBLY__
@@ -125,6 +131,7 @@ extern int opal_enter_rtas(struct rtas_args *args,
 enum OpalVendorApiTokens {
        OPAL_START_VENDOR_API_RANGE = 1000, OPAL_END_VENDOR_API_RANGE = 1999
 };
 enum OpalFreezeState {
        OPAL_EEH_STOPPED_NOT_FROZEN = 0,
        OPAL_EEH_STOPPED_MMIO_FREEZE = 1,
@@ -134,55 +141,69 @@ enum OpalFreezeState {
        OPAL_EEH_STOPPED_TEMP_UNAVAIL = 5,
        OPAL_EEH_STOPPED_PERM_UNAVAIL = 6
 };
 enum OpalEehFreezeActionToken {
        OPAL_EEH_ACTION_CLEAR_FREEZE_MMIO = 1,
        OPAL_EEH_ACTION_CLEAR_FREEZE_DMA = 2,
        OPAL_EEH_ACTION_CLEAR_FREEZE_ALL = 3
 };
 enum OpalPciStatusToken {
-        OPAL_EEH_PHB_NO_ERROR = 0,
+        OPAL_EEH_NO_ERROR       = 0,
-        OPAL_EEH_PHB_FATAL = 1,
+        OPAL_EEH_IOC_ERROR      = 1,
-        OPAL_EEH_PHB_RECOVERABLE = 2,
+        OPAL_EEH_PHB_ERROR      = 2,
-        OPAL_EEH_PHB_BUS_ERROR = 3,
+        OPAL_EEH_PE_ERROR       = 3,
-        OPAL_EEH_PCI_NO_DEVSEL = 4,
+        OPAL_EEH_PE_MMIO_ERROR  = 4,
-        OPAL_EEH_PCI_TA = 5,
+        OPAL_EEH_PE_DMA_ERROR   = 5
-        OPAL_EEH_PCIEX_UR = 6,
-        OPAL_EEH_PCIEX_CA = 7,
-        OPAL_EEH_PCI_MMIO_ERROR = 8,
-        OPAL_EEH_PCI_DMA_ERROR = 9
 };
+enum OpalPciErrorSeverity {
+        OPAL_EEH_SEV_NO_ERROR   = 0,
+        OPAL_EEH_SEV_IOC_DEAD   = 1,
+        OPAL_EEH_SEV_PHB_DEAD   = 2,
+        OPAL_EEH_SEV_PHB_FENCED = 3,
+        OPAL_EEH_SEV_PE_ER      = 4,
+        OPAL_EEH_SEV_INF        = 5
+};
 enum OpalShpcAction {
        OPAL_SHPC_GET_LINK_STATE = 0,
        OPAL_SHPC_GET_SLOT_STATE = 1
 };
 enum OpalShpcLinkState {
        OPAL_SHPC_LINK_DOWN = 0,
        OPAL_SHPC_LINK_UP = 1
 };
 enum OpalMmioWindowType {
        OPAL_M32_WINDOW_TYPE = 1,
        OPAL_M64_WINDOW_TYPE = 2,
        OPAL_IO_WINDOW_TYPE = 3
 };
 enum OpalShpcSlotState {
        OPAL_SHPC_DEV_NOT_PRESENT = 0,
        OPAL_SHPC_DEV_PRESENT = 1
 };
 enum OpalExceptionHandler {
        OPAL_MACHINE_CHECK_HANDLER = 1,
        OPAL_HYPERVISOR_MAINTENANCE_HANDLER = 2,
        OPAL_SOFTPATCH_HANDLER = 3
 };
 enum OpalPendingState {
-        OPAL_EVENT_OPAL_INTERNAL = 0x1,
+        OPAL_EVENT_OPAL_INTERNAL        = 0x1,
-        OPAL_EVENT_NVRAM = 0x2,
+        OPAL_EVENT_NVRAM                = 0x2,
-        OPAL_EVENT_RTC = 0x4,
+        OPAL_EVENT_RTC                  = 0x4,
-        OPAL_EVENT_CONSOLE_OUTPUT = 0x8,
+        OPAL_EVENT_CONSOLE_OUTPUT       = 0x8,
-        OPAL_EVENT_CONSOLE_INPUT = 0x10,
+        OPAL_EVENT_CONSOLE_INPUT        = 0x10,
-        OPAL_EVENT_ERROR_LOG_AVAIL = 0x20,
+        OPAL_EVENT_ERROR_LOG_AVAIL      = 0x20,
-        OPAL_EVENT_ERROR_LOG = 0x40,
+        OPAL_EVENT_ERROR_LOG            = 0x40,
-        OPAL_EVENT_EPOW = 0x80,
+        OPAL_EVENT_EPOW                 = 0x80,
-        OPAL_EVENT_LED_STATUS = 0x100
+        OPAL_EVENT_LED_STATUS           = 0x100,
+        OPAL_EVENT_PCI_ERROR            = 0x200
 };
 /* Machine check related definitions */
@@ -364,15 +385,80 @@ struct opal_machine_check_event {
        } u;
 };
+enum {
+        OPAL_P7IOC_DIAG_TYPE_NONE       = 0,
+        OPAL_P7IOC_DIAG_TYPE_RGC        = 1,
+        OPAL_P7IOC_DIAG_TYPE_BI         = 2,
+        OPAL_P7IOC_DIAG_TYPE_CI         = 3,
+        OPAL_P7IOC_DIAG_TYPE_MISC       = 4,
+        OPAL_P7IOC_DIAG_TYPE_I2C        = 5,
+        OPAL_P7IOC_DIAG_TYPE_LAST       = 6
+};
+struct OpalIoP7IOCErrorData {
+        uint16_t type;
+        /* GEM */
+        uint64_t gemXfir;
+        uint64_t gemRfir;
+        uint64_t gemRirqfir;
+        uint64_t gemMask;
+        uint64_t gemRwof;
+        /* LEM */
+        uint64_t lemFir;
+        uint64_t lemErrMask;
+        uint64_t lemAction0;
+        uint64_t lemAction1;
+        uint64_t lemWof;
+        union {
+                struct OpalIoP7IOCRgcErrorData {
+                        uint64_t rgcStatus;             /* 3E1C10 */
+                        uint64_t rgcLdcp;               /* 3E1C18 */
+                }rgc;
+                struct OpalIoP7IOCBiErrorData {
+                        uint64_t biLdcp0;               /* 3C0100, 3C0118 */
+                        uint64_t biLdcp1;               /* 3C0108, 3C0120 */
+                        uint64_t biLdcp2;               /* 3C0110, 3C0128 */
+                        uint64_t biFenceStatus;         /* 3C0130, 3C0130 */
+                        uint8_t  biDownbound;           /* BI Downbound or Upbound */
+                }bi;
+                struct OpalIoP7IOCCiErrorData {
+                        uint64_t ciPortStatus;          /* 3Dn008 */
+                        uint64_t ciPortLdcp;            /* 3Dn010 */
+                        uint8_t  ciPort;                /* Index of CI port: 0/1 */
+                }ci;
+        };
+};
 /**
 * This structure defines the overlay which will be used to store PHB error
 * data upon request.
 */
 enum {
+        OPAL_PHB_ERROR_DATA_VERSION_1 = 1,
+};
+enum {
+        OPAL_PHB_ERROR_DATA_TYPE_P7IOC = 1,
+};
+enum {
        OPAL_P7IOC_NUM_PEST_REGS = 128,
 };
+struct OpalIoPhbErrorCommon {
+        uint32_t version;
+        uint32_t ioType;
+        uint32_t len;
+};
 struct OpalIoP7IOCPhbErrorData {
+        struct OpalIoPhbErrorCommon common;
        uint32_t brdgCtl;
        // P7IOC utl regs
@@ -530,14 +616,21 @@ int64_t opal_pci_map_pe_dma_window_real(uint64_t phb_id, uint16_t pe_number,
                                        uint64_t pci_mem_size);
 int64_t opal_pci_reset(uint64_t phb_id, uint8_t reset_scope, uint8_t assert_state);
-int64_t opal_pci_get_hub_diag_data(uint64_t hub_id, void *diag_buffer, uint64_t diag_buffer_len);
+int64_t opal_pci_get_hub_diag_data(uint64_t hub_id, void *diag_buffer,
-int64_t opal_pci_get_phb_diag_data(uint64_t phb_id, void *diag_buffer, uint64_t diag_buffer_len);
+                                   uint64_t diag_buffer_len);
+int64_t opal_pci_get_phb_diag_data(uint64_t phb_id, void *diag_buffer,
+                                   uint64_t diag_buffer_len);
+int64_t opal_pci_get_phb_diag_data2(uint64_t phb_id, void *diag_buffer,
+                                    uint64_t diag_buffer_len);
 int64_t opal_pci_fence_phb(uint64_t phb_id);
 int64_t opal_pci_reinit(uint64_t phb_id, uint8_t reinit_scope);
 int64_t opal_pci_mask_pe_error(uint64_t phb_id, uint16_t pe_number, uint8_t error_type, uint8_t mask_action);
 int64_t opal_set_slot_led_status(uint64_t phb_id, uint64_t slot_id, uint8_t led_type, uint8_t led_action);
 int64_t opal_get_epow_status(uint64_t *status);
 int64_t opal_set_system_attention_led(uint8_t led_action);
+int64_t opal_pci_next_error(uint64_t phb_id, uint64_t *first_frozen_pe,
+                            uint16_t *pci_error_type, uint16_t *severity);
+int64_t opal_pci_poll(uint64_t phb_id);
 /* Internal functions */
 extern int early_init_dt_scan_opal(unsigned long node, const char *uname, int depth, void *data);
@@ -551,6 +644,11 @@ extern void hvc_opal_init_early(void);
 extern int early_init_dt_scan_opal(unsigned long node, const char *uname,
                                   int depth, void *data);
+extern int opal_notifier_register(struct notifier_block *nb);
+extern void opal_notifier_enable(void);
+extern void opal_notifier_disable(void);
+extern void opal_notifier_update_evt(uint64_t evt_mask, uint64_t evt_val);
 extern int opal_get_chars(uint32_t vtermno, char *buf, int count);
 extern int opal_put_chars(uint32_t vtermno, const char *buf, int total_len);
diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
index f265049dd7d6..2dd7bfc459be 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -60,6 +60,7 @@ struct power_pmu {
 #define PPMU_HAS_SSLOT          0x00000020 /* Has sampled slot in MMCRA */
 #define PPMU_HAS_SIER           0x00000040 /* Has SIER */
 #define PPMU_BHRB               0x00000080 /* has BHRB feature enabled */
+#define PPMU_EBB                0x00000100 /* supports event based branch */
 /*
 * Values for flags to get_alternatives()
@@ -68,6 +69,11 @@ struct power_pmu {
 #define PPMU_LIMITED_PMC_REQD   2       /* have to put this on a limited PMC */
 #define PPMU_ONLY_COUNT_RUN     4       /* only counting in run state */
+/*
+ * We use the event config bit 63 as a flag to request EBB.
+ */
+#define EVENT_CONFIG_EBB_SHIFT  63
 extern int register_power_pmu(struct power_pmu *);
 struct pt_regs;
diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
index b66ae722a8e9..f65e27b09bd3 100644
--- a/arch/powerpc/include/asm/pgalloc-64.h
+++ b/arch/powerpc/include/asm/pgalloc-64.h
@@ -221,17 +221,17 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PMD_INDEX_SIZE),
+        return kmem_cache_alloc(PGT_CACHE(PMD_CACHE_INDEX),
                                GFP_KERNEL|__GFP_REPEAT);
 }
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
-        kmem_cache_free(PGT_CACHE(PMD_INDEX_SIZE), pmd);
+        kmem_cache_free(PGT_CACHE(PMD_CACHE_INDEX), pmd);
 }
 #define __pmd_free_tlb(tlb, pmd, addr)                \
-        pgtable_free_tlb(tlb, pmd, PMD_INDEX_SIZE)
+        pgtable_free_tlb(tlb, pmd, PMD_CACHE_INDEX)
 #ifndef CONFIG_PPC_64K_PAGES
 #define __pud_free_tlb(tlb, pud, addr)                \
        pgtable_free_tlb(tlb, pud, PUD_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/pgtable-ppc64-64k.h b/arch/powerpc/include/asm/pgtable-ppc64-64k.h
index 45142d640720..a56b82fb0609 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64-64k.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64-64k.h
@@ -33,7 +33,8 @@
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
 /* Bits to mask out from a PMD to get to the PTE page */
-#define PMD_MASKED_BITS         0x1ff
+/* PMDs point to PTE table fragments which are 4K aligned.  */
+#define PMD_MASKED_BITS         0xfff
 /* Bits to mask out from a PGD/PUD to get to the PMD page */
 #define PUD_MASKED_BITS         0x1ff
diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
index e3d55f6f24fe..46db09414a10 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -10,6 +10,7 @@
 #else
 #include <asm/pgtable-ppc64-4k.h>
 #endif
+#include <asm/barrier.h>
 #define FIRST_USER_ADDRESS      0
@@ -20,7 +21,11 @@
                            PUD_INDEX_SIZE + PGD_INDEX_SIZE + PAGE_SHIFT)
 #define PGTABLE_RANGE (ASM_CONST(1) << PGTABLE_EADDR_SIZE)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#define PMD_CACHE_INDEX (PMD_INDEX_SIZE + 1)
+#else
+#define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#endif
 /*
 * Define the address range of the kernel non-linear virtual area
 */
@@ -150,7 +155,7 @@
 #define pmd_present(pmd)        (pmd_val(pmd) != 0)
 #define pmd_clear(pmdp)         (pmd_val(*(pmdp)) = 0)
 #define pmd_page_vaddr(pmd)     (pmd_val(pmd) & ~PMD_MASKED_BITS)
-#define pmd_page(pmd)           virt_to_page(pmd_page_vaddr(pmd))
+extern struct page *pmd_page(pmd_t pmd);
 #define pud_set(pudp, pudval)   (pud_val(*(pudp)) = (pudval))
 #define pud_none(pud)           (!pud_val(pud))
@@ -339,43 +344,217 @@ static inline void __ptep_set_access_flags(pte_t *ptep, pte_t entry)
 void pgtable_cache_add(unsigned shift, void (*ctor)(void *));
 void pgtable_cache_init(void);
+#endif /* __ASSEMBLY__ */
+/*
+ * THP pages can't be special. So use the _PAGE_SPECIAL
+ */
+#define _PAGE_SPLITTING _PAGE_SPECIAL
+/*
+ * We need to differentiate between explicit huge page and THP huge
+ * page, since THP huge page also need to track real subpage details
+ */
+#define _PAGE_THP_HUGE  _PAGE_4K_PFN
 /*
- * find_linux_pte returns the address of a linux pte for a given
+ * set of bits not changed in pmd_modify.
- * effective address and directory.  If not found, it returns zero.
 */
-static inline pte_t *find_linux_pte(pgd_t *pgdir, unsigned long ea)
+#define _HPAGE_CHG_MASK (PTE_RPN_MASK | _PAGE_HPTEFLAGS |               \
+                         _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_SPLITTING | \
+                         _PAGE_THP_HUGE)
+#ifndef __ASSEMBLY__
+/*
+ * The linux hugepage PMD now include the pmd entries followed by the address
+ * to the stashed pgtable_t. The stashed pgtable_t contains the hpte bits.
+ * [ 1 bit secondary | 3 bit hidx | 1 bit valid | 000]. We use one byte per
+ * each HPTE entry. With 16MB hugepage and 64K HPTE we need 256 entries and
+ * with 4K HPTE we need 4096 entries. Both will fit in a 4K pgtable_t.
+ *
+ * The last three bits are intentionally left to zero. This memory location
+ * are also used as normal page PTE pointers. So if we have any pointers
+ * left around while we collapse a hugepage, we need to make sure
+ * _PAGE_PRESENT and _PAGE_FILE bits of that are zero when we look at them
+ */
+static inline unsigned int hpte_valid(unsigned char *hpte_slot_array, int index)
 {
-        pgd_t *pg;
+        return (hpte_slot_array[index] >> 3) & 0x1;
-        pud_t *pu;
-        pmd_t *pm;
-        pte_t *pt = NULL;
-        pg = pgdir + pgd_index(ea);
-        if (!pgd_none(*pg)) {
-                pu = pud_offset(pg, ea);
-                if (!pud_none(*pu)) {
-                        pm = pmd_offset(pu, ea);
-                        if (pmd_present(*pm))
-                                pt = pte_offset_kernel(pm, ea);
-                }
-        }
-        return pt;
 }
-#ifdef CONFIG_HUGETLB_PAGE
+static inline unsigned int hpte_hash_index(unsigned char *hpte_slot_array,
-pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea,
+                                           int index)
-                                 unsigned *shift);
-#else
-static inline pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea,
-                                               unsigned *shift)
 {
-        if (shift)
+        return hpte_slot_array[index] >> 4;
-                *shift = 0;
-        return find_linux_pte(pgdir, ea);
 }
-#endif /* !CONFIG_HUGETLB_PAGE */
-#endif /* __ASSEMBLY__ */
+static inline void mark_hpte_slot_valid(unsigned char *hpte_slot_array,
+                                        unsigned int index, unsigned int hidx)
+{
+        hpte_slot_array[index] = hidx << 4 | 0x1 << 3;
+}
+static inline char *get_hpte_slot_array(pmd_t *pmdp)
+{
+        /*
+         * The hpte hindex is stored in the pgtable whose address is in the
+         * second half of the PMD
+         *
+         * Order this load with the test for pmd_trans_huge in the caller
+         */
+        smp_rmb();
+        return *(char **)(pmdp + PTRS_PER_PMD);
+}
+extern void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
+                                   pmd_t *pmdp);
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+extern pmd_t pfn_pmd(unsigned long pfn, pgprot_t pgprot);
+extern pmd_t mk_pmd(struct page *page, pgprot_t pgprot);
+extern pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot);
+extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
+                       pmd_t *pmdp, pmd_t pmd);
+extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
+                                 pmd_t *pmd);
+static inline int pmd_trans_huge(pmd_t pmd)
+{
+        /*
+         * leaf pte for huge page, bottom two bits != 00
+         */
+        return (pmd_val(pmd) & 0x3) && (pmd_val(pmd) & _PAGE_THP_HUGE);
+}
+static inline int pmd_large(pmd_t pmd)
+{
+        /*
+         * leaf pte for huge page, bottom two bits != 00
+         */
+        if (pmd_trans_huge(pmd))
+                return pmd_val(pmd) & _PAGE_PRESENT;
+        return 0;
+}
+static inline int pmd_trans_splitting(pmd_t pmd)
+{
+        if (pmd_trans_huge(pmd))
+                return pmd_val(pmd) & _PAGE_SPLITTING;
+        return 0;
+}
+extern int has_transparent_hugepage(void);
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+static inline pte_t pmd_pte(pmd_t pmd)
+{
+        return __pte(pmd_val(pmd));
+}
+static inline pmd_t pte_pmd(pte_t pte)
+{
+        return __pmd(pte_val(pte));
+}
+static inline pte_t *pmdp_ptep(pmd_t *pmd)
+{
+        return (pte_t *)pmd;
+}
+#define pmd_pfn(pmd)            pte_pfn(pmd_pte(pmd))
+#define pmd_young(pmd)          pte_young(pmd_pte(pmd))
+#define pmd_mkold(pmd)          pte_pmd(pte_mkold(pmd_pte(pmd)))
+#define pmd_wrprotect(pmd)      pte_pmd(pte_wrprotect(pmd_pte(pmd)))
+#define pmd_mkdirty(pmd)        pte_pmd(pte_mkdirty(pmd_pte(pmd)))
+#define pmd_mkyoung(pmd)        pte_pmd(pte_mkyoung(pmd_pte(pmd)))
+#define pmd_mkwrite(pmd)        pte_pmd(pte_mkwrite(pmd_pte(pmd)))
+#define __HAVE_ARCH_PMD_WRITE
+#define pmd_write(pmd)          pte_write(pmd_pte(pmd))
+static inline pmd_t pmd_mkhuge(pmd_t pmd)
+{
+        /* Do nothing, mk_pmd() does this part.  */
+        return pmd;
+}
+static inline pmd_t pmd_mknotpresent(pmd_t pmd)
+{
+        pmd_val(pmd) &= ~_PAGE_PRESENT;
+        return pmd;
+}
+static inline pmd_t pmd_mksplitting(pmd_t pmd)
+{
+        pmd_val(pmd) |= _PAGE_SPLITTING;
+        return pmd;
+}
+#define __HAVE_ARCH_PMD_SAME
+static inline int pmd_same(pmd_t pmd_a, pmd_t pmd_b)
+{
+        return (((pmd_val(pmd_a) ^ pmd_val(pmd_b)) & ~_PAGE_HPTEFLAGS) == 0);
+}
+#define __HAVE_ARCH_PMDP_SET_ACCESS_FLAGS
+extern int pmdp_set_access_flags(struct vm_area_struct *vma,
+                                 unsigned long address, pmd_t *pmdp,
+                                 pmd_t entry, int dirty);
+extern unsigned long pmd_hugepage_update(struct mm_struct *mm,
+                                         unsigned long addr,
+                                         pmd_t *pmdp, unsigned long clr);
+static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
+                                              unsigned long addr, pmd_t *pmdp)
+{
+        unsigned long old;
+        if ((pmd_val(*pmdp) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
+                return 0;
+        old = pmd_hugepage_update(mm, addr, pmdp, _PAGE_ACCESSED);
+        return ((old & _PAGE_ACCESSED) != 0);
+}
+#define __HAVE_ARCH_PMDP_TEST_AND_CLEAR_YOUNG
+extern int pmdp_test_and_clear_young(struct vm_area_struct *vma,
+                                     unsigned long address, pmd_t *pmdp);
+#define __HAVE_ARCH_PMDP_CLEAR_YOUNG_FLUSH
+extern int pmdp_clear_flush_young(struct vm_area_struct *vma,
+                                  unsigned long address, pmd_t *pmdp);
+#define __HAVE_ARCH_PMDP_GET_AND_CLEAR
+extern pmd_t pmdp_get_and_clear(struct mm_struct *mm,
+                                unsigned long addr, pmd_t *pmdp);
+#define __HAVE_ARCH_PMDP_CLEAR_FLUSH
+extern pmd_t pmdp_clear_flush(struct vm_area_struct *vma, unsigned long address,
+                              pmd_t *pmdp);
+#define __HAVE_ARCH_PMDP_SET_WRPROTECT
+static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr,
+                                      pmd_t *pmdp)
+{
+        if ((pmd_val(*pmdp) & _PAGE_RW) == 0)
+                return;
+        pmd_hugepage_update(mm, addr, pmdp, _PAGE_RW);
+}
+#define __HAVE_ARCH_PMDP_SPLITTING_FLUSH
+extern void pmdp_splitting_flush(struct vm_area_struct *vma,
+                                 unsigned long address, pmd_t *pmdp);
+#define __HAVE_ARCH_PGTABLE_DEPOSIT
+extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
+                                       pgtable_t pgtable);
+#define __HAVE_ARCH_PGTABLE_WITHDRAW
+extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp);
+#define __HAVE_ARCH_PMDP_INVALIDATE
+extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
+                            pmd_t *pmdp);
+#endif /* __ASSEMBLY__ */
 #endif /* _ASM_POWERPC_PGTABLE_PPC64_H_ */
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index b6293d26bd39..7d6eacf249cf 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -217,6 +217,12 @@ extern int gup_hugepd(hugepd_t *hugepd, unsigned pdshift, unsigned long addr,
 extern int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
                       unsigned long end, int write, struct page **pages, int *nr);
+#ifndef CONFIG_TRANSPARENT_HUGEPAGE
+#define pmd_large(pmd)          0
+#define has_transparent_hugepage() 0
+#endif
+pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea,
+                                 unsigned *shift);
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/probes.h b/arch/powerpc/include/asm/probes.h
index 5f1e15b68704..3421637cfd7b 100644
--- a/arch/powerpc/include/asm/probes.h
+++ b/arch/powerpc/include/asm/probes.h
@@ -38,5 +38,30 @@ typedef u32 ppc_opcode_t;
 #define is_trap(instr)          (IS_TW(instr) || IS_TWI(instr))
 #endif /* CONFIG_PPC64 */
+#ifdef CONFIG_PPC_ADV_DEBUG_REGS
+#define MSR_SINGLESTEP  (MSR_DE)
+#else
+#define MSR_SINGLESTEP  (MSR_SE)
+#endif
+/* Enable single stepping for the current task */
+static inline void enable_single_step(struct pt_regs *regs)
+{
+        regs->msr |= MSR_SINGLESTEP;
+#ifdef CONFIG_PPC_ADV_DEBUG_REGS
+        /*
+         * We turn off Critical Input Exception(CE) to ensure that the single
+         * step will be for the instruction we have the probe on; if we don't,
+         * it is possible we'd get the single step reported for CE.
+         */
+        regs->msr &= ~MSR_CE;
+        mtspr(SPRN_DBCR0, mfspr(SPRN_DBCR0) | DBCR0_IC | DBCR0_IDM);
+#ifdef CONFIG_PPC_47x
+        isync();
+#endif
+#endif
+}
 #endif /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_PROBES_H */
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index 14a658363698..47a35b08b963 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -168,10 +168,10 @@ struct thread_struct {
         * The following help to manage the use of Debug Control Registers
         * om the BookE platforms.
         */
-        unsigned long   dbcr0;
+        uint32_t        dbcr0;
-        unsigned long   dbcr1;
+        uint32_t        dbcr1;
 #ifdef CONFIG_BOOKE
-        unsigned long   dbcr2;
+        uint32_t        dbcr2;
 #endif
        /*
         * The stored value of the DBSR register will be the value at the
@@ -179,7 +179,7 @@ struct thread_struct {
         * user (will never be written to) and has value while helping to
         * describe the reason for the last debug trap.  Torez
         */
-        unsigned long   dbsr;
+        uint32_t        dbsr;
        /*
         * The following will contain addresses used by debug applications
         * to help trace and trap on particular address locations.
@@ -200,7 +200,7 @@ struct thread_struct {
 #endif
 #endif
        /* FP and VSX 0-31 register set */
-        double          fpr[32][TS_FPRWIDTH];
+        double          fpr[32][TS_FPRWIDTH] __attribute__((aligned(16)));
        struct {
                unsigned int pad;
@@ -287,9 +287,9 @@ struct thread_struct {
        unsigned long   siar;
        unsigned long   sdar;
        unsigned long   sier;
-        unsigned long   mmcr0;
        unsigned long   mmcr2;
-        unsigned long   mmcra;
+        unsigned        mmcr0;
+        unsigned        used_ebb;
 #endif
 };
@@ -404,9 +404,7 @@ static inline void prefetchw(const void *x)
 #define spin_lock_prefetch(x)   prefetchw(x)
-#ifdef CONFIG_PPC64
 #define HAVE_ARCH_PICK_MMAP_LAYOUT
-#endif
 #ifdef CONFIG_PPC64
 static inline unsigned long get_clean_sp(unsigned long sp, int is_32)
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 4a9e408644fe..5d7d9c2a5473 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -621,11 +621,15 @@
 #define   MMCR0_PMXE    0x04000000UL /* performance monitor exception enable */
 #define   MMCR0_FCECE   0x02000000UL /* freeze ctrs on enabled cond or event */
 #define   MMCR0_TBEE    0x00400000UL /* time base exception enable */
+#define   MMCR0_EBE     0x00100000UL /* Event based branch enable */
+#define   MMCR0_PMCC    0x000c0000UL /* PMC control */
+#define   MMCR0_PMCC_U6 0x00080000UL /* PMC1-6 are R/W by user (PR) */
 #define   MMCR0_PMC1CE  0x00008000UL /* PMC1 count enable*/
 #define   MMCR0_PMCjCE  0x00004000UL /* PMCj count enable*/
 #define   MMCR0_TRIGGER 0x00002000UL /* TRIGGER enable */
 #define   MMCR0_PMAO    0x00000080UL /* performance monitor alert has occurred, set to 0 after handling exception */
 #define   MMCR0_SHRFC   0x00000040UL /* SHRre freeze conditions between threads */
+#define   MMCR0_FC56    0x00000010UL /* freeze counters 5 and 6 */
 #define   MMCR0_FCTI    0x00000008UL /* freeze counters in tags inactive mode */
 #define   MMCR0_FCTA    0x00000004UL /* freeze counters in tags active mode */
 #define   MMCR0_FCWAIT  0x00000002UL /* freeze counter in WAIT state */
@@ -673,6 +677,11 @@
 #define   SIER_SIAR_VALID       0x0400000       /* SIAR contents valid */
 #define   SIER_SDAR_VALID       0x0200000       /* SDAR contents valid */
+/* When EBB is enabled, some of MMCR0/MMCR2/SIER are user accessible */
+#define MMCR0_USER_MASK (MMCR0_FC | MMCR0_PMXE | MMCR0_PMAO)
+#define MMCR2_USER_MASK 0x4020100804020000UL /* (FC1P|FC2P|FC3P|FC4P|FC5P|FC6P) */
+#define SIER_USER_MASK  0x7fffffUL
 #define SPRN_PA6T_MMCR0 795
 #define   PA6T_MMCR0_EN0        0x0000000000000001UL
 #define   PA6T_MMCR0_EN1        0x0000000000000002UL
diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
index 34fd70488d83..c7a8bfc9f6f5 100644
--- a/arch/powerpc/include/asm/rtas.h
+++ b/arch/powerpc/include/asm/rtas.h
@@ -350,8 +350,8 @@ static inline u32 rtas_config_addr(int busno, int devfn, int reg)
                        (devfn << 8) | (reg & 0xff);
 }
-extern void __cpuinit rtas_give_timebase(void);
+extern void rtas_give_timebase(void);
-extern void __cpuinit rtas_take_timebase(void);
+extern void rtas_take_timebase(void);
 #ifdef CONFIG_PPC_RTAS
 static inline int page_is_rtas_user_buf(unsigned long pfn)
diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h
index 200d763a0a67..49a13e0ef234 100644
--- a/arch/powerpc/include/asm/switch_to.h
+++ b/arch/powerpc/include/asm/switch_to.h
@@ -67,4 +67,18 @@ static inline void flush_spe_to_thread(struct task_struct *t)
 }
 #endif
+static inline void clear_task_ebb(struct task_struct *t)
+{
+#ifdef CONFIG_PPC_BOOK3S_64
+    /* EBB perf events are not inherited, so clear all EBB state. */
+    t->thread.bescr = 0;
+    t->thread.mmcr2 = 0;
+    t->thread.mmcr0 = 0;
+    t->thread.siar = 0;
+    t->thread.sdar = 0;
+    t->thread.sier = 0;
+    t->thread.used_ebb = 0;
+#endif
+}
 #endif /* _ASM_POWERPC_SWITCH_TO_H */
diff --git a/arch/powerpc/include/asm/tlbflush.h b/arch/powerpc/include/asm/tlbflush.h
index 61a59271665b..2def01ed0cb2 100644
--- a/arch/powerpc/include/asm/tlbflush.h
+++ b/arch/powerpc/include/asm/tlbflush.h
@@ -165,7 +165,8 @@ static inline void flush_tlb_kernel_range(unsigned long start,
 /* Private function for use by PCI IO mapping code */
 extern void __flush_hash_table_range(struct mm_struct *mm, unsigned long start,
                                     unsigned long end);
+extern void flush_tlb_pmd_range(struct mm_struct *mm, pmd_t *pmd,
+                                unsigned long addr);
 #else
 #error Unsupported MMU type
 #endif
diff --git a/arch/powerpc/include/asm/vdso.h b/arch/powerpc/include/asm/vdso.h
index 50f261bc3e95..0d9cecddf8a4 100644
--- a/arch/powerpc/include/asm/vdso.h
+++ b/arch/powerpc/include/asm/vdso.h
@@ -22,7 +22,7 @@ extern unsigned long vdso64_rt_sigtramp;
 extern unsigned long vdso32_sigtramp;
 extern unsigned long vdso32_rt_sigtramp;
-int __cpuinit vdso_getcpu_init(void);
+int vdso_getcpu_init(void);
 #else /* __ASSEMBLY__ */
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index f960a7944553..a8619bfe879e 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -58,6 +58,8 @@ obj-$(CONFIG_RTAS_PROC)		+= rtas-proc.o
 obj-$(CONFIG_LPARCFG)           += lparcfg.o
 obj-$(CONFIG_IBMVIO)            += vio.o
 obj-$(CONFIG_IBMEBUS)           += ibmebus.o
+obj-$(CONFIG_EEH)              += eeh.o eeh_pe.o eeh_dev.o eeh_cache.o \
+                                  eeh_driver.o eeh_event.o eeh_sysfs.o
 obj-$(CONFIG_GENERIC_TBSYNC)    += smp-tbsync.o
 obj-$(CONFIG_CRASH_DUMP)        += crash_dump.o
 obj-$(CONFIG_FA_DUMP)           += fadump.o
@@ -100,7 +102,7 @@ obj-$(CONFIG_PPC_UDBG_16550)	+= legacy_serial.o udbg_16550.o
 obj-$(CONFIG_STACKTRACE)        += stacktrace.o
 obj-$(CONFIG_SWIOTLB)           += dma-swiotlb.o
-pci64-$(CONFIG_PPC64)           += pci_dn.o isa-bridge.o
+pci64-$(CONFIG_PPC64)           += pci_dn.o pci-hotplug.o isa-bridge.o
 obj-$(CONFIG_PCI)               += pci_$(CONFIG_WORD_SIZE).o $(pci64-y) \
                                   pci-common.o pci_of_scan.o
 obj-$(CONFIG_PCI_MSI)           += msi.o
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 6f16ffafa6f0..c7e8afc2ead0 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -105,9 +105,6 @@ int main(void)
        DEFINE(KSP_VSID, offsetof(struct thread_struct, ksp_vsid));
 #else /* CONFIG_PPC64 */
        DEFINE(PGDIR, offsetof(struct thread_struct, pgdir));
-#if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
-        DEFINE(THREAD_DBCR0, offsetof(struct thread_struct, dbcr0));
-#endif
 #ifdef CONFIG_SPE
        DEFINE(THREAD_EVR0, offsetof(struct thread_struct, evr[0]));
        DEFINE(THREAD_ACC, offsetof(struct thread_struct, acc));
@@ -115,6 +112,9 @@ int main(void)
        DEFINE(THREAD_USED_SPE, offsetof(struct thread_struct, used_spe));
 #endif /* CONFIG_SPE */
 #endif /* CONFIG_PPC64 */
+#if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
+        DEFINE(THREAD_DBCR0, offsetof(struct thread_struct, dbcr0));
+#endif
 #ifdef CONFIG_KVM_BOOK3S_32_HANDLER
        DEFINE(THREAD_KVM_SVCPU, offsetof(struct thread_struct, kvm_shadow_vcpu));
 #endif
@@ -132,7 +132,6 @@ int main(void)
        DEFINE(THREAD_SIER, offsetof(struct thread_struct, sier));
        DEFINE(THREAD_MMCR0, offsetof(struct thread_struct, mmcr0));
        DEFINE(THREAD_MMCR2, offsetof(struct thread_struct, mmcr2));
-        DEFINE(THREAD_MMCRA, offsetof(struct thread_struct, mmcra));
 #endif
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
        DEFINE(PACATMSCRATCH, offsetof(struct paca_struct, tm_scratch));
diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
index 92c6b008dd2b..9262cf2bec4b 100644
--- a/arch/powerpc/kernel/cacheinfo.c
+++ b/arch/powerpc/kernel/cacheinfo.c
@@ -131,7 +131,8 @@ static const char *cache_type_string(const struct cache *cache)
        return cache_type_info[cache->type].name;
 }
-static void __cpuinit cache_init(struct cache *cache, int type, int level, struct device_node *ofnode)
+static void cache_init(struct cache *cache, int type, int level,
+                       struct device_node *ofnode)
 {
        cache->type = type;
        cache->level = level;
@@ -140,7 +141,7 @@ static void __cpuinit cache_init(struct cache *cache, int type, int level, struc
        list_add(&cache->list, &cache_list);
 }
-static struct cache *__cpuinit new_cache(int type, int level, struct device_node *ofnode)
+static struct cache *new_cache(int type, int level, struct device_node *ofnode)
 {
        struct cache *cache;
@@ -324,7 +325,8 @@ static bool cache_node_is_unified(const struct device_node *np)
        return of_get_property(np, "cache-unified", NULL);
 }
-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
+static struct cache *cache_do_one_devnode_unified(struct device_node *node,
+                                                  int level)
 {
        struct cache *cache;
@@ -335,7 +337,8 @@ static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *
        return cache;
 }
-static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
+static struct cache *cache_do_one_devnode_split(struct device_node *node,
+                                                int level)
 {
        struct cache *dcache, *icache;
@@ -357,7 +360,7 @@ err:
        return NULL;
 }
-static struct cache *__cpuinit cache_do_one_devnode(struct device_node *node, int level)
+static struct cache *cache_do_one_devnode(struct device_node *node, int level)
 {
        struct cache *cache;
@@ -369,7 +372,8 @@ static struct cache *__cpuinit cache_do_one_devnode(struct device_node *node, in
        return cache;
 }
-static struct cache *__cpuinit cache_lookup_or_instantiate(struct device_node *node, int level)
+static struct cache *cache_lookup_or_instantiate(struct device_node *node,
+                                                 int level)
 {
        struct cache *cache;
@@ -385,7 +389,7 @@ static struct cache *__cpuinit cache_lookup_or_instantiate(struct device_node *n
        return cache;
 }
-static void __cpuinit link_cache_lists(struct cache *smaller, struct cache *bigger)
+static void link_cache_lists(struct cache *smaller, struct cache *bigger)
 {
        while (smaller->next_local) {
                if (smaller->next_local == bigger)
@@ -396,13 +400,13 @@ static void __cpuinit link_cache_lists(struct cache *smaller, struct cache *bigg
        smaller->next_local = bigger;
 }
-static void __cpuinit do_subsidiary_caches_debugcheck(struct cache *cache)
+static void do_subsidiary_caches_debugcheck(struct cache *cache)
 {
        WARN_ON_ONCE(cache->level != 1);
        WARN_ON_ONCE(strcmp(cache->ofnode->type, "cpu"));
 }
-static void __cpuinit do_subsidiary_caches(struct cache *cache)
+static void do_subsidiary_caches(struct cache *cache)
 {
        struct device_node *subcache_node;
        int level = cache->level;
@@ -423,7 +427,7 @@ static void __cpuinit do_subsidiary_caches(struct cache *cache)
        }
 }
-static struct cache *__cpuinit cache_chain_instantiate(unsigned int cpu_id)
+static struct cache *cache_chain_instantiate(unsigned int cpu_id)
 {
        struct device_node *cpu_node;
        struct cache *cpu_cache = NULL;
@@ -448,7 +452,7 @@ out:
        return cpu_cache;
 }
-static struct cache_dir *__cpuinit cacheinfo_create_cache_dir(unsigned int cpu_id)
+static struct cache_dir *cacheinfo_create_cache_dir(unsigned int cpu_id)
 {
        struct cache_dir *cache_dir;
        struct device *dev;
@@ -653,7 +657,7 @@ static struct kobj_type cache_index_type = {
        .default_attrs = cache_index_default_attrs,
 };
-static void __cpuinit cacheinfo_create_index_opt_attrs(struct cache_index_dir *dir)
+static void cacheinfo_create_index_opt_attrs(struct cache_index_dir *dir)
 {
        const char *cache_name;
        const char *cache_type;
@@ -696,7 +700,8 @@ static void __cpuinit cacheinfo_create_index_opt_attrs(struct cache_index_dir *d
        kfree(buf);
 }
-static void __cpuinit cacheinfo_create_index_dir(struct cache *cache, int index, struct cache_dir *cache_dir)
+static void cacheinfo_create_index_dir(struct cache *cache, int index,
+                                       struct cache_dir *cache_dir)
 {
        struct cache_index_dir *index_dir;
        int rc;
@@ -722,7 +727,8 @@ err:
        kfree(index_dir);
 }
-static void __cpuinit cacheinfo_sysfs_populate(unsigned int cpu_id, struct cache *cache_list)
+static void cacheinfo_sysfs_populate(unsigned int cpu_id,
+                                     struct cache *cache_list)
 {
        struct cache_dir *cache_dir;
        struct cache *cache;
@@ -740,7 +746,7 @@ static void __cpuinit cacheinfo_sysfs_populate(unsigned int cpu_id, struct cache
        }
 }
-void __cpuinit cacheinfo_cpu_online(unsigned int cpu_id)
+void cacheinfo_cpu_online(unsigned int cpu_id)
 {
        struct cache *cache;
diff --git a/arch/powerpc/platforms/pseries/eeh.c b/arch/powerpc/kernel/eeh.c
index 6b73d6c44f51..39954fe941b8 100644
--- a/arch/powerpc/platforms/pseries/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -103,11 +103,8 @@ EXPORT_SYMBOL(eeh_subsystem_enabled);
 */
 int eeh_probe_mode;
-/* Global EEH mutex */
-DEFINE_MUTEX(eeh_mutex);
 /* Lock to avoid races due to multiple reports of an error */
-static DEFINE_RAW_SPINLOCK(confirm_error_lock);
+DEFINE_RAW_SPINLOCK(confirm_error_lock);
 /* Buffer for reporting pci register dumps. Its here in BSS, and
 * not dynamically alloced, so that it ends up in RMO where RTAS
@@ -235,16 +232,30 @@ void eeh_slot_error_detail(struct eeh_pe *pe, int severity)
 {
        size_t loglen = 0;
        struct eeh_dev *edev;
+        bool valid_cfg_log = true;
-        eeh_pci_enable(pe, EEH_OPT_THAW_MMIO);
+        /*
-        eeh_ops->configure_bridge(pe);
+         * When the PHB is fenced or dead, it's pointless to collect
-        eeh_pe_restore_bars(pe);
+         * the data from PCI config space because it should return
+         * 0xFF's. For ER, we still retrieve the data from the PCI
-        pci_regs_buf[0] = 0;
+         * config space.
-        eeh_pe_for_each_dev(pe, edev) {
+         */
-                loglen += eeh_gather_pci_data(edev, pci_regs_buf,
+        if (eeh_probe_mode_dev() &&
-                                EEH_PCI_REGS_LOG_LEN);
+            (pe->type & EEH_PE_PHB) &&
-        }
+            (pe->state & (EEH_PE_ISOLATED | EEH_PE_PHB_DEAD)))
+                valid_cfg_log = false;
+        if (valid_cfg_log) {
+                eeh_pci_enable(pe, EEH_OPT_THAW_MMIO);
+                eeh_ops->configure_bridge(pe);
+                eeh_pe_restore_bars(pe);
+                pci_regs_buf[0] = 0;
+                eeh_pe_for_each_dev(pe, edev) {
+                        loglen += eeh_gather_pci_data(edev, pci_regs_buf + loglen,
+                                                      EEH_PCI_REGS_LOG_LEN - loglen);
+                }
+        }
        eeh_ops->get_log(pe, severity, pci_regs_buf, loglen);
 }
@@ -260,15 +271,74 @@ static inline unsigned long eeh_token_to_phys(unsigned long token)
 {
        pte_t *ptep;
        unsigned long pa;
+        int hugepage_shift;
-        ptep = find_linux_pte(init_mm.pgd, token);
+        /*
+         * We won't find hugepages here, iomem
+         */
+        ptep = find_linux_pte_or_hugepte(init_mm.pgd, token, &hugepage_shift);
        if (!ptep)
                return token;
+        WARN_ON(hugepage_shift);
        pa = pte_pfn(*ptep) << PAGE_SHIFT;
        return pa | (token & (PAGE_SIZE-1));
 }
+/*
+ * On PowerNV platform, we might already have fenced PHB there.
+ * For that case, it's meaningless to recover frozen PE. Intead,
+ * We have to handle fenced PHB firstly.
+ */
+static int eeh_phb_check_failure(struct eeh_pe *pe)
+{
+        struct eeh_pe *phb_pe;
+        unsigned long flags;
+        int ret;
+        if (!eeh_probe_mode_dev())
+                return -EPERM;
+        /* Find the PHB PE */
+        phb_pe = eeh_phb_pe_get(pe->phb);
+        if (!phb_pe) {
+                pr_warning("%s Can't find PE for PHB#%d\n",
+                           __func__, pe->phb->global_number);
+                return -EEXIST;
+        }
+        /* If the PHB has been in problematic state */
+        eeh_serialize_lock(&flags);
+        if (phb_pe->state & (EEH_PE_ISOLATED | EEH_PE_PHB_DEAD)) {
+                ret = 0;
+                goto out;
+        }
+        /* Check PHB state */
+        ret = eeh_ops->get_state(phb_pe, NULL);
+        if ((ret < 0) ||
+            (ret == EEH_STATE_NOT_SUPPORT) ||
+            (ret & (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE)) ==
+            (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE)) {
+                ret = 0;
+                goto out;
+        }
+        /* Isolate the PHB and send event */
+        eeh_pe_state_mark(phb_pe, EEH_PE_ISOLATED);
+        eeh_serialize_unlock(flags);
+        eeh_send_failure_event(phb_pe);
+        pr_err("EEH: PHB#%x failure detected\n",
+                phb_pe->phb->global_number);
+        dump_stack();
+        return 1;
+out:
+        eeh_serialize_unlock(flags);
+        return ret;
+}
 /**
 * eeh_dev_check_failure - Check if all 1's data is due to EEH slot freeze
 * @edev: eeh device
@@ -319,13 +389,21 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
                return 0;
        }
+        /*
+         * On PowerNV platform, we might already have fenced PHB
+         * there and we need take care of that firstly.
+         */
+        ret = eeh_phb_check_failure(pe);
+        if (ret > 0)
+                return ret;
        /* If we already have a pending isolation event for this
         * slot, we know it's bad already, we don't need to check.
         * Do this checking under a lock; as multiple PCI devices
         * in one slot might report errors simultaneously, and we
         * only want one error recovery routine running.
         */
-        raw_spin_lock_irqsave(&confirm_error_lock, flags);
+        eeh_serialize_lock(&flags);
        rc = 1;
        if (pe->state & EEH_PE_ISOLATED) {
                pe->check_count++;
@@ -368,13 +446,13 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
        }
        eeh_stats.slot_resets++;
- 
        /* Avoid repeated reports of this failure, including problems
         * with other functions on this device, and functions under
         * bridges.
         */
        eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
-        raw_spin_unlock_irqrestore(&confirm_error_lock, flags);
+        eeh_serialize_unlock(flags);
        eeh_send_failure_event(pe);
@@ -382,11 +460,14 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
         * a stack trace will help the device-driver authors figure
         * out what happened.  So print that out.
         */
-        WARN(1, "EEH: failure detected\n");
+        pr_err("EEH: Frozen PE#%x detected on PHB#%x\n",
+                pe->addr, pe->phb->global_number);
+        dump_stack();
        return 1;
 dn_unlock:
-        raw_spin_unlock_irqrestore(&confirm_error_lock, flags);
+        eeh_serialize_unlock(flags);
        return rc;
 }
@@ -525,7 +606,7 @@ static void eeh_reset_pe_once(struct eeh_pe *pe)
         * or a fundamental reset (3).
         * A fundamental reset required by any device under
         * Partitionable Endpoint trumps hot-reset.
-         */
+         */
        eeh_pe_dev_traverse(pe, eeh_set_dev_freset, &freset);
        if (freset)
@@ -538,8 +619,8 @@ static void eeh_reset_pe_once(struct eeh_pe *pe)
         */
 #define PCI_BUS_RST_HOLD_TIME_MSEC 250
        msleep(PCI_BUS_RST_HOLD_TIME_MSEC);
-        
-        /* We might get hit with another EEH freeze as soon as the 
+        /* We might get hit with another EEH freeze as soon as the
         * pci slot reset line is dropped. Make sure we don't miss
         * these, and clear the flag now.
         */
@@ -565,6 +646,7 @@ static void eeh_reset_pe_once(struct eeh_pe *pe)
 */
 int eeh_reset_pe(struct eeh_pe *pe)
 {
+        int flags = (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE);
        int i, rc;
        /* Take three shots at resetting the bus */
@@ -572,7 +654,7 @@ int eeh_reset_pe(struct eeh_pe *pe)
                eeh_reset_pe_once(pe);
                rc = eeh_ops->wait_state(pe, PCI_BUS_RESET_WAIT_MSEC);
-                if (rc == (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE))
+                if ((rc & flags) == flags)
                        return 0;
                if (rc < 0) {
@@ -604,7 +686,7 @@ void eeh_save_bars(struct eeh_dev *edev)
        if (!edev)
                return;
        dn = eeh_dev_to_of_node(edev);
-        
        for (i = 0; i < 16; i++)
                eeh_ops->read_config(dn, i * 4, 4, &edev->config_space[i]);
 }
@@ -674,11 +756,21 @@ int __exit eeh_ops_unregister(const char *name)
 * Even if force-off is set, the EEH hardware is still enabled, so that
 * newer systems can boot.
 */
-static int __init eeh_init(void)
+int eeh_init(void)
 {
        struct pci_controller *hose, *tmp;
        struct device_node *phb;
-        int ret;
+        static int cnt = 0;
+        int ret = 0;
+        /*
+         * We have to delay the initialization on PowerNV after
+         * the PCI hierarchy tree has been built because the PEs
+         * are figured out based on PCI devices instead of device
+         * tree nodes
+         */
+        if (machine_is(powernv) && cnt++ <= 0)
+                return ret;
        /* call platform initialization function */
        if (!eeh_ops) {
@@ -691,7 +783,10 @@ static int __init eeh_init(void)
                return ret;
        }
-        raw_spin_lock_init(&confirm_error_lock);
+        /* Initialize EEH event */
+        ret = eeh_event_init();
+        if (ret)
+                return ret;
        /* Enable EEH for all adapters */
        if (eeh_probe_mode_devtree()) {
@@ -700,6 +795,25 @@ static int __init eeh_init(void)
                        phb = hose->dn;
                        traverse_pci_devices(phb, eeh_ops->of_probe, NULL);
                }
+        } else if (eeh_probe_mode_dev()) {
+                list_for_each_entry_safe(hose, tmp,
+                        &hose_list, list_node)
+                        pci_walk_bus(hose->bus, eeh_ops->dev_probe, NULL);
+        } else {
+                pr_warning("%s: Invalid probe mode %d\n",
+                           __func__, eeh_probe_mode);
+                return -EINVAL;
+        }
+        /*
+         * Call platform post-initialization. Actually, It's good chance
+         * to inform platform that EEH is ready to supply service if the
+         * I/O cache stuff has been built up.
+         */
+        if (eeh_ops->post_init) {
+                ret = eeh_ops->post_init();
+                if (ret)
+                        return ret;
        }
        if (eeh_subsystem_enabled)
@@ -728,6 +842,14 @@ static void eeh_add_device_early(struct device_node *dn)
 {
        struct pci_controller *phb;
+        /*
+         * If we're doing EEH probe based on PCI device, we
+         * would delay the probe until late stage because
+         * the PCI device isn't available this moment.
+         */
+        if (!eeh_probe_mode_devtree())
+                return;
        if (!of_node_to_eeh_dev(dn))
                return;
        phb = of_node_to_eeh_dev(dn)->phb;
@@ -736,7 +858,6 @@ static void eeh_add_device_early(struct device_node *dn)
        if (NULL == phb || 0 == phb->buid)
                return;
-        /* FIXME: hotplug support on POWERNV */
        eeh_ops->of_probe(dn, NULL);
 }
@@ -787,6 +908,13 @@ static void eeh_add_device_late(struct pci_dev *dev)
        edev->pdev = dev;
        dev->dev.archdata.edev = edev;
+        /*
+         * We have to do the EEH probe here because the PCI device
+         * hasn't been created yet in the early stage.
+         */
+        if (eeh_probe_mode_dev())
+                eeh_ops->dev_probe(dev, NULL);
        eeh_addr_cache_insert_dev(dev);
 }
@@ -803,12 +931,12 @@ void eeh_add_device_tree_late(struct pci_bus *bus)
        struct pci_dev *dev;
        list_for_each_entry(dev, &bus->devices, bus_list) {
-                eeh_add_device_late(dev);
+                eeh_add_device_late(dev);
-                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
-                        struct pci_bus *subbus = dev->subordinate;
+                        struct pci_bus *subbus = dev->subordinate;
-                        if (subbus)
+                        if (subbus)
-                                eeh_add_device_tree_late(subbus);
+                                eeh_add_device_tree_late(subbus);
-                }
+                }
        }
 }
 EXPORT_SYMBOL_GPL(eeh_add_device_tree_late);
diff --git a/arch/powerpc/platforms/pseries/eeh_cache.c b/arch/powerpc/kernel/eeh_cache.c
index 5ce3ba7ad137..f9ac1232a746 100644
--- a/arch/powerpc/platforms/pseries/eeh_cache.c
+++ b/arch/powerpc/kernel/eeh_cache.c
@@ -194,7 +194,7 @@ static void __eeh_addr_cache_insert_dev(struct pci_dev *dev)
        }
        /* Skip any devices for which EEH is not enabled. */
-        if (!edev->pe) {
+        if (!eeh_probe_mode_dev() && !edev->pe) {
 #ifdef DEBUG
                pr_info("PCI: skip building address cache for=%s - %s\n",
                        pci_name(dev), dn->full_name);
@@ -285,7 +285,7 @@ void eeh_addr_cache_rmv_dev(struct pci_dev *dev)
 * Must be run late in boot process, after the pci controllers
 * have been scanned for devices (after all device resources are known).
 */
-void __init eeh_addr_cache_build(void)
+void eeh_addr_cache_build(void)
 {
        struct device_node *dn;
        struct eeh_dev *edev;
@@ -316,4 +316,3 @@ void __init eeh_addr_cache_build(void)
        eeh_addr_cache_print(&pci_io_addr_cache_root);
 #endif
 }
diff --git a/arch/powerpc/platforms/pseries/eeh_dev.c b/arch/powerpc/kernel/eeh_dev.c
index 1efa28f5fc54..1efa28f5fc54 100644
--- a/arch/powerpc/platforms/pseries/eeh_dev.c
+++ b/arch/powerpc/kernel/eeh_dev.c
diff --git a/arch/powerpc/platforms/pseries/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index a3fefb61097c..2b1ce17cae50 100644
--- a/arch/powerpc/platforms/pseries/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -154,9 +154,9 @@ static void eeh_enable_irq(struct pci_dev *dev)
 * eeh_report_error - Report pci error to each device driver
 * @data: eeh device
 * @userdata: return value
- * 
+ *
- * Report an EEH error to each device driver, collect up and 
+ * Report an EEH error to each device driver, collect up and
- * merge the device driver responses. Cumulative response 
+ * merge the device driver responses. Cumulative response
 * passed back in "userdata".
 */
 static void *eeh_report_error(void *data, void *userdata)
@@ -349,10 +349,12 @@ static void *eeh_report_failure(void *data, void *userdata)
 */
 static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
 {
+        struct timeval tstamp;
        int cnt, rc;
        /* pcibios will clear the counter; save the value */
        cnt = pe->freeze_count;
+        tstamp = pe->tstamp;
        /*
         * We don't remove the corresponding PE instances because
@@ -376,15 +378,17 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
        eeh_pe_restore_bars(pe);
        /* Give the system 5 seconds to finish running the user-space
-         * hotplug shutdown scripts, e.g. ifdown for ethernet.  Yes, 
+         * hotplug shutdown scripts, e.g. ifdown for ethernet.  Yes,
-         * this is a hack, but if we don't do this, and try to bring 
+         * this is a hack, but if we don't do this, and try to bring
-         * the device up before the scripts have taken it down, 
+         * the device up before the scripts have taken it down,
         * potentially weird things happen.
         */
        if (bus) {
                ssleep(5);
                pcibios_add_pci_devices(bus);
        }
+        pe->tstamp = tstamp;
        pe->freeze_count = cnt;
        return 0;
@@ -395,24 +399,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
 */
 #define MAX_WAIT_FOR_RECOVERY 150
-/**
+static void eeh_handle_normal_event(struct eeh_pe *pe)
- * eeh_handle_event - Reset a PCI device after hard lockup.
- * @pe: EEH PE
- *
- * While PHB detects address or data parity errors on particular PCI
- * slot, the associated PE will be frozen. Besides, DMA's occurring
- * to wild addresses (which usually happen due to bugs in device
- * drivers or in PCI adapter firmware) can cause EEH error. #SERR,
- * #PERR or other misc PCI-related errors also can trigger EEH errors.
- *
- * Recovery process consists of unplugging the device driver (which
- * generated hotplug events to userspace), then issuing a PCI #RST to
- * the device, then reconfiguring the PCI config space for all bridges
- * & devices under this slot, and then finally restarting the device
- * drivers (which cause a second set of hotplug events to go out to
- * userspace).
- */
-void eeh_handle_event(struct eeh_pe *pe)
 {
        struct pci_bus *frozen_bus;
        int rc = 0;
@@ -425,6 +412,7 @@ void eeh_handle_event(struct eeh_pe *pe)
                return;
        }
+        eeh_pe_update_time_stamp(pe);
        pe->freeze_count++;
        if (pe->freeze_count > EEH_MAX_ALLOWED_FREEZES)
                goto excess_failures;
@@ -437,6 +425,7 @@ void eeh_handle_event(struct eeh_pe *pe)
         * status ... if any child can't handle the reset, then the entire
         * slot is dlpar removed and added.
         */
+        pr_info("EEH: Notify device drivers to shutdown\n");
        eeh_pe_dev_traverse(pe, eeh_report_error, &result);
        /* Get the current PCI slot state. This can take a long time,
@@ -444,7 +433,7 @@ void eeh_handle_event(struct eeh_pe *pe)
         */
        rc = eeh_ops->wait_state(pe, MAX_WAIT_FOR_RECOVERY*1000);
        if (rc < 0 || rc == EEH_STATE_NOT_SUPPORT) {
-                printk(KERN_WARNING "EEH: Permanent failure\n");
+                pr_warning("EEH: Permanent failure\n");
                goto hard_fail;
        }
@@ -452,6 +441,7 @@ void eeh_handle_event(struct eeh_pe *pe)
         * don't post the error log until after all dev drivers
         * have been informed.
         */
+        pr_info("EEH: Collect temporary log\n");
        eeh_slot_error_detail(pe, EEH_LOG_TEMP);
        /* If all device drivers were EEH-unaware, then shut
@@ -459,15 +449,18 @@ void eeh_handle_event(struct eeh_pe *pe)
         * go down willingly, without panicing the system.
         */
        if (result == PCI_ERS_RESULT_NONE) {
+                pr_info("EEH: Reset with hotplug activity\n");
                rc = eeh_reset_device(pe, frozen_bus);
                if (rc) {
-                        printk(KERN_WARNING "EEH: Unable to reset, rc=%d\n", rc);
+                        pr_warning("%s: Unable to reset, err=%d\n",
+                                   __func__, rc);
                        goto hard_fail;
                }
        }
        /* If all devices reported they can proceed, then re-enable MMIO */
        if (result == PCI_ERS_RESULT_CAN_RECOVER) {
+                pr_info("EEH: Enable I/O for affected devices\n");
                rc = eeh_pci_enable(pe, EEH_OPT_THAW_MMIO);
                if (rc < 0)
@@ -475,6 +468,7 @@ void eeh_handle_event(struct eeh_pe *pe)
                if (rc) {
                        result = PCI_ERS_RESULT_NEED_RESET;
                } else {
+                        pr_info("EEH: Notify device drivers to resume I/O\n");
                        result = PCI_ERS_RESULT_NONE;
                        eeh_pe_dev_traverse(pe, eeh_report_mmio_enabled, &result);
                }
@@ -482,6 +476,7 @@ void eeh_handle_event(struct eeh_pe *pe)
        /* If all devices reported they can proceed, then re-enable DMA */
        if (result == PCI_ERS_RESULT_CAN_RECOVER) {
+                pr_info("EEH: Enabled DMA for affected devices\n");
                rc = eeh_pci_enable(pe, EEH_OPT_THAW_DMA);
                if (rc < 0)
@@ -494,17 +489,22 @@ void eeh_handle_event(struct eeh_pe *pe)
        /* If any device has a hard failure, then shut off everything. */
        if (result == PCI_ERS_RESULT_DISCONNECT) {
-                printk(KERN_WARNING "EEH: Device driver gave up\n");
+                pr_warning("EEH: Device driver gave up\n");
                goto hard_fail;
        }
        /* If any device called out for a reset, then reset the slot */
        if (result == PCI_ERS_RESULT_NEED_RESET) {
+                pr_info("EEH: Reset without hotplug activity\n");
                rc = eeh_reset_device(pe, NULL);
                if (rc) {
-                        printk(KERN_WARNING "EEH: Cannot reset, rc=%d\n", rc);
+                        pr_warning("%s: Cannot reset, err=%d\n",
+                                   __func__, rc);
                        goto hard_fail;
                }
+                pr_info("EEH: Notify device drivers "
+                        "the completion of reset\n");
                result = PCI_ERS_RESULT_NONE;
                eeh_pe_dev_traverse(pe, eeh_report_reset, &result);
        }
@@ -512,15 +512,16 @@ void eeh_handle_event(struct eeh_pe *pe)
        /* All devices should claim they have recovered by now. */
        if ((result != PCI_ERS_RESULT_RECOVERED) &&
            (result != PCI_ERS_RESULT_NONE)) {
-                printk(KERN_WARNING "EEH: Not recovered\n");
+                pr_warning("EEH: Not recovered\n");
                goto hard_fail;
        }
        /* Tell all device drivers that they can resume operations */
+        pr_info("EEH: Notify device driver to resume\n");
        eeh_pe_dev_traverse(pe, eeh_report_resume, NULL);
        return;
-        
 excess_failures:
        /*
         * About 90% of all real-life EEH failures in the field
@@ -550,3 +551,111 @@ perm_error:
                pcibios_remove_pci_devices(frozen_bus);
 }
+static void eeh_handle_special_event(void)
+{
+        struct eeh_pe *pe, *phb_pe;
+        struct pci_bus *bus;
+        struct pci_controller *hose, *tmp;
+        unsigned long flags;
+        int rc = 0;
+        /*
+         * The return value from next_error() has been classified as follows.
+         * It might be good to enumerate them. However, next_error() is only
+         * supported by PowerNV platform for now. So it would be fine to use
+         * integer directly:
+         *
+         * 4 - Dead IOC           3 - Dead PHB
+         * 2 - Fenced PHB         1 - Frozen PE
+         * 0 - No error found
+         *
+         */
+        rc = eeh_ops->next_error(&pe);
+        if (rc <= 0)
+                return;
+        switch (rc) {
+        case 4:
+                /* Mark all PHBs in dead state */
+                eeh_serialize_lock(&flags);
+                list_for_each_entry_safe(hose, tmp,
+                                &hose_list, list_node) {
+                        phb_pe = eeh_phb_pe_get(hose);
+                        if (!phb_pe) continue;
+                        eeh_pe_state_mark(phb_pe,
+                                EEH_PE_ISOLATED | EEH_PE_PHB_DEAD);
+                }
+                eeh_serialize_unlock(flags);
+                /* Purge all events */
+                eeh_remove_event(NULL);
+                break;
+        case 3:
+        case 2:
+        case 1:
+                /* Mark the PE in fenced state */
+                eeh_serialize_lock(&flags);
+                if (rc == 3)
+                        eeh_pe_state_mark(pe,
+                                EEH_PE_ISOLATED | EEH_PE_PHB_DEAD);
+                else
+                        eeh_pe_state_mark(pe,
+                                EEH_PE_ISOLATED | EEH_PE_RECOVERING);
+                eeh_serialize_unlock(flags);
+                /* Purge all events of the PHB */
+                eeh_remove_event(pe);
+                break;
+        default:
+                pr_err("%s: Invalid value %d from next_error()\n",
+                       __func__, rc);
+                return;
+        }
+        /*
+         * For fenced PHB and frozen PE, it's handled as normal
+         * event. We have to remove the affected PHBs for dead
+         * PHB and IOC
+         */
+        if (rc == 2 || rc == 1)
+                eeh_handle_normal_event(pe);
+        else {
+                list_for_each_entry_safe(hose, tmp,
+                        &hose_list, list_node) {
+                        phb_pe = eeh_phb_pe_get(hose);
+                        if (!phb_pe || !(phb_pe->state & EEH_PE_PHB_DEAD))
+                                continue;
+                        bus = eeh_pe_bus_get(phb_pe);
+                        /* Notify all devices that they're about to go down. */
+                        eeh_pe_dev_traverse(pe, eeh_report_failure, NULL);
+                        pcibios_remove_pci_devices(bus);
+                }
+        }
+}
+/**
+ * eeh_handle_event - Reset a PCI device after hard lockup.
+ * @pe: EEH PE
+ *
+ * While PHB detects address or data parity errors on particular PCI
+ * slot, the associated PE will be frozen. Besides, DMA's occurring
+ * to wild addresses (which usually happen due to bugs in device
+ * drivers or in PCI adapter firmware) can cause EEH error. #SERR,
+ * #PERR or other misc PCI-related errors also can trigger EEH errors.
+ *
+ * Recovery process consists of unplugging the device driver (which
+ * generated hotplug events to userspace), then issuing a PCI #RST to
+ * the device, then reconfiguring the PCI config space for all bridges
+ * & devices under this slot, and then finally restarting the device
+ * drivers (which cause a second set of hotplug events to go out to
+ * userspace).
+ */
+void eeh_handle_event(struct eeh_pe *pe)
+{
+        if (pe)
+                eeh_handle_normal_event(pe);
+        else
+                eeh_handle_special_event();
+}
diff --git a/arch/powerpc/platforms/pseries/eeh_event.c b/arch/powerpc/kernel/eeh_event.c
index 185bedd926df..d27c5afc90ae 100644
--- a/arch/powerpc/platforms/pseries/eeh_event.c
+++ b/arch/powerpc/kernel/eeh_event.c
@@ -18,11 +18,10 @@
 #include <linux/delay.h>
 #include <linux/list.h>
-#include <linux/mutex.h>
 #include <linux/sched.h>
+#include <linux/semaphore.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
-#include <linux/workqueue.h>
 #include <linux/kthread.h>
 #include <asm/eeh_event.h>
 #include <asm/ppc-pci.h>
@@ -35,14 +34,9 @@
 *  work-queue, where a worker thread can drive recovery.
 */
-/* EEH event workqueue setup. */
 static DEFINE_SPINLOCK(eeh_eventlist_lock);
+static struct semaphore eeh_eventlist_sem;
 LIST_HEAD(eeh_eventlist);
-static void eeh_thread_launcher(struct work_struct *);
-DECLARE_WORK(eeh_event_wq, eeh_thread_launcher);
-/* Serialize reset sequences for a given pci device */
-DEFINE_MUTEX(eeh_event_mutex);
 /**
 * eeh_event_handler - Dispatch EEH events.
@@ -60,55 +54,63 @@ static int eeh_event_handler(void * dummy)
        struct eeh_event *event;
        struct eeh_pe *pe;
-        spin_lock_irqsave(&eeh_eventlist_lock, flags);
+        while (!kthread_should_stop()) {
-        event = NULL;
+                if (down_interruptible(&eeh_eventlist_sem))
+                        break;
-        /* Unqueue the event, get ready to process. */
-        if (!list_empty(&eeh_eventlist)) {
+                /* Fetch EEH event from the queue */
-                event = list_entry(eeh_eventlist.next, struct eeh_event, list);
+                spin_lock_irqsave(&eeh_eventlist_lock, flags);
-                list_del(&event->list);
+                event = NULL;
-        }
+                if (!list_empty(&eeh_eventlist)) {
-        spin_unlock_irqrestore(&eeh_eventlist_lock, flags);
+                        event = list_entry(eeh_eventlist.next,
+                                           struct eeh_event, list);
-        if (event == NULL)
+                        list_del(&event->list);
-                return 0;
+                }
+                spin_unlock_irqrestore(&eeh_eventlist_lock, flags);
-        /* Serialize processing of EEH events */
+                if (!event)
-        mutex_lock(&eeh_event_mutex);
+                        continue;
-        pe = event->pe;
-        eeh_pe_state_mark(pe, EEH_PE_RECOVERING);
+                /* We might have event without binding PE */
-        pr_info("EEH: Detected PCI bus error on PHB#%d-PE#%x\n",
+                pe = event->pe;
-                pe->phb->global_number, pe->addr);
+                if (pe) {
+                        eeh_pe_state_mark(pe, EEH_PE_RECOVERING);
-        set_current_state(TASK_INTERRUPTIBLE);  /* Don't add to load average */
+                        pr_info("EEH: Detected PCI bus error on PHB#%d-PE#%x\n",
-        eeh_handle_event(pe);
+                                 pe->phb->global_number, pe->addr);
-        eeh_pe_state_clear(pe, EEH_PE_RECOVERING);
+                        eeh_handle_event(pe);
+                        eeh_pe_state_clear(pe, EEH_PE_RECOVERING);
-        kfree(event);
+                } else {
-        mutex_unlock(&eeh_event_mutex);
+                        eeh_handle_event(NULL);
+                }
-        /* If there are no new errors after an hour, clear the counter. */
-        if (pe && pe->freeze_count > 0) {
+                kfree(event);
-                msleep_interruptible(3600*1000);
-                if (pe->freeze_count > 0)
-                        pe->freeze_count--;
        }
        return 0;
 }
 /**
- * eeh_thread_launcher - Start kernel thread to handle EEH events
+ * eeh_event_init - Start kernel thread to handle EEH events
- * @dummy - unused
 *
 * This routine is called to start the kernel thread for processing
 * EEH event.
 */
-static void eeh_thread_launcher(struct work_struct *dummy)
+int eeh_event_init(void)
 {
-        if (IS_ERR(kthread_run(eeh_event_handler, NULL, "eehd")))
+        struct task_struct *t;
-                printk(KERN_ERR "Failed to start EEH daemon\n");
+        int ret = 0;
+        /* Initialize semaphore */
+        sema_init(&eeh_eventlist_sem, 0);
+        t = kthread_run(eeh_event_handler, NULL, "eehd");
+        if (IS_ERR(t)) {
+                ret = PTR_ERR(t);
+                pr_err("%s: Failed to start EEH daemon (%d)\n",
+                        __func__, ret);
+                return ret;
+        }
+        return 0;
 }
 /**
@@ -136,7 +138,45 @@ int eeh_send_failure_event(struct eeh_pe *pe)
        list_add(&event->list, &eeh_eventlist);
        spin_unlock_irqrestore(&eeh_eventlist_lock, flags);
-        schedule_work(&eeh_event_wq);
+        /* For EEH deamon to knick in */
+        up(&eeh_eventlist_sem);
        return 0;
 }
+/**
+ * eeh_remove_event - Remove EEH event from the queue
+ * @pe: Event binding to the PE
+ *
+ * On PowerNV platform, we might have subsequent coming events
+ * is part of the former one. For that case, those subsequent
+ * coming events are totally duplicated and unnecessary, thus
+ * they should be removed.
+ */
+void eeh_remove_event(struct eeh_pe *pe)
+{
+        unsigned long flags;
+        struct eeh_event *event, *tmp;
+        spin_lock_irqsave(&eeh_eventlist_lock, flags);
+        list_for_each_entry_safe(event, tmp, &eeh_eventlist, list) {
+                /*
+                 * If we don't have valid PE passed in, that means
+                 * we already have event corresponding to dead IOC
+                 * and all events should be purged.
+                 */
+                if (!pe) {
+                        list_del(&event->list);
+                        kfree(event);
+                } else if (pe->type & EEH_PE_PHB) {
+                        if (event->pe && event->pe->phb == pe->phb) {
+                                list_del(&event->list);
+                                kfree(event);
+                        }
+                } else if (event->pe == pe) {
+                        list_del(&event->list);
+                        kfree(event);
+                }
+        }
+        spin_unlock_irqrestore(&eeh_eventlist_lock, flags);
+}
diff --git a/arch/powerpc/platforms/pseries/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
index 9d4a9e8562b2..016588a6f5ed 100644
--- a/arch/powerpc/platforms/pseries/eeh_pe.c
+++ b/arch/powerpc/kernel/eeh_pe.c
@@ -22,6 +22,7 @@
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
+#include <linux/delay.h>
 #include <linux/export.h>
 #include <linux/gfp.h>
 #include <linux/init.h>
@@ -78,9 +79,7 @@ int eeh_phb_pe_create(struct pci_controller *phb)
        }
        /* Put it into the list */
-        eeh_lock();
        list_add_tail(&pe->child, &eeh_phb_pe);
-        eeh_unlock();
        pr_debug("EEH: Add PE for PHB#%d\n", phb->global_number);
@@ -95,7 +94,7 @@ int eeh_phb_pe_create(struct pci_controller *phb)
 * hierarchy tree is composed of PHB PEs. The function is used
 * to retrieve the corresponding PHB PE according to the given PHB.
 */
-static struct eeh_pe *eeh_phb_pe_get(struct pci_controller *phb)
+struct eeh_pe *eeh_phb_pe_get(struct pci_controller *phb)
 {
        struct eeh_pe *pe;
@@ -185,21 +184,15 @@ void *eeh_pe_dev_traverse(struct eeh_pe *root,
                return NULL;
        }
-        eeh_lock();
        /* Traverse root PE */
        for (pe = root; pe; pe = eeh_pe_next(pe, root)) {
                eeh_pe_for_each_dev(pe, edev) {
                        ret = fn(edev, flag);
-                        if (ret) {
+                        if (ret)
-                                eeh_unlock();
                                return ret;
-                        }
                }
        }
-        eeh_unlock();
        return NULL;
 }
@@ -228,7 +221,7 @@ static void *__eeh_pe_get(void *data, void *flag)
                return pe;
        /* Try BDF address */
-        if (edev->pe_config_addr &&
+        if (edev->config_addr &&
           (edev->config_addr == pe->config_addr))
                return pe;
@@ -246,7 +239,7 @@ static void *__eeh_pe_get(void *data, void *flag)
 * which is composed of PCI bus/device/function number, or unified
 * PE address.
 */
-static struct eeh_pe *eeh_pe_get(struct eeh_dev *edev)
+struct eeh_pe *eeh_pe_get(struct eeh_dev *edev)
 {
        struct eeh_pe *root = eeh_phb_pe_get(edev->phb);
        struct eeh_pe *pe;
@@ -305,8 +298,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
 {
        struct eeh_pe *pe, *parent;
-        eeh_lock();
        /*
         * Search the PE has been existing or not according
         * to the PE address. If that has been existing, the
@@ -316,7 +307,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
        pe = eeh_pe_get(edev);
        if (pe && !(pe->type & EEH_PE_INVALID)) {
                if (!edev->pe_config_addr) {
-                        eeh_unlock();
                        pr_err("%s: PE with addr 0x%x already exists\n",
                                __func__, edev->config_addr);
                        return -EEXIST;
@@ -328,7 +318,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
                /* Put the edev to PE */
                list_add_tail(&edev->list, &pe->edevs);
-                eeh_unlock();
                pr_debug("EEH: Add %s to Bus PE#%x\n",
                        edev->dn->full_name, pe->addr);
@@ -347,7 +336,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
                        parent->type &= ~EEH_PE_INVALID;
                        parent = parent->parent;
                }
-                eeh_unlock();
                pr_debug("EEH: Add %s to Device PE#%x, Parent PE#%x\n",
                        edev->dn->full_name, pe->addr, pe->parent->addr);
@@ -357,7 +345,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
        /* Create a new EEH PE */
        pe = eeh_pe_alloc(edev->phb, EEH_PE_DEVICE);
        if (!pe) {
-                eeh_unlock();
                pr_err("%s: out of memory!\n", __func__);
                return -ENOMEM;
        }
@@ -365,6 +352,17 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
        pe->config_addr = edev->config_addr;
        /*
+         * While doing PE reset, we probably hot-reset the
+         * upstream bridge. However, the PCI devices including
+         * the associated EEH devices might be removed when EEH
+         * core is doing recovery. So that won't safe to retrieve
+         * the bridge through downstream EEH device. We have to
+         * trace the parent PCI bus, then the upstream bridge.
+         */
+        if (eeh_probe_mode_dev())
+                pe->bus = eeh_dev_to_pci_dev(edev)->bus;
+        /*
         * Put the new EEH PE into hierarchy tree. If the parent
         * can't be found, the newly created PE will be attached
         * to PHB directly. Otherwise, we have to associate the
@@ -374,7 +372,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
        if (!parent) {
                parent = eeh_phb_pe_get(edev->phb);
                if (!parent) {
-                        eeh_unlock();
                        pr_err("%s: No PHB PE is found (PHB Domain=%d)\n",
                                __func__, edev->phb->global_number);
                        edev->pe = NULL;
@@ -391,7 +388,6 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
        list_add_tail(&pe->child, &parent->child_list);
        list_add_tail(&edev->list, &pe->edevs);
        edev->pe = pe;
-        eeh_unlock();
        pr_debug("EEH: Add %s to Device PE#%x, Parent PE#%x\n",
                edev->dn->full_name, pe->addr, pe->parent->addr);
@@ -419,8 +415,6 @@ int eeh_rmv_from_parent_pe(struct eeh_dev *edev, int purge_pe)
                return -EEXIST;
        }
-        eeh_lock();
        /* Remove the EEH device */
        pe = edev->pe;
        edev->pe = NULL;
@@ -465,12 +459,37 @@ int eeh_rmv_from_parent_pe(struct eeh_dev *edev, int purge_pe)
                pe = parent;
        }
-        eeh_unlock();
        return 0;
 }
 /**
+ * eeh_pe_update_time_stamp - Update PE's frozen time stamp
+ * @pe: EEH PE
+ *
+ * We have time stamp for each PE to trace its time of getting
+ * frozen in last hour. The function should be called to update
+ * the time stamp on first error of the specific PE. On the other
+ * handle, we needn't account for errors happened in last hour.
+ */
+void eeh_pe_update_time_stamp(struct eeh_pe *pe)
+{
+        struct timeval tstamp;
+        if (!pe) return;
+        if (pe->freeze_count <= 0) {
+                pe->freeze_count = 0;
+                do_gettimeofday(&pe->tstamp);
+        } else {
+                do_gettimeofday(&tstamp);
+                if (tstamp.tv_sec - pe->tstamp.tv_sec > 3600) {
+                        pe->tstamp = tstamp;
+                        pe->freeze_count = 0;
+                }
+        }
+}
+/**
 * __eeh_pe_state_mark - Mark the state for the PE
 * @data: EEH PE
 * @flag: state
@@ -512,9 +531,7 @@ static void *__eeh_pe_state_mark(void *data, void *flag)
 */
 void eeh_pe_state_mark(struct eeh_pe *pe, int state)
 {
-        eeh_lock();
        eeh_pe_traverse(pe, __eeh_pe_state_mark, &state);
-        eeh_unlock();
 }
 /**
@@ -548,35 +565,135 @@ static void *__eeh_pe_state_clear(void *data, void *flag)
 */
 void eeh_pe_state_clear(struct eeh_pe *pe, int state)
 {
-        eeh_lock();
        eeh_pe_traverse(pe, __eeh_pe_state_clear, &state);
-        eeh_unlock();
 }
-/**
+/*
- * eeh_restore_one_device_bars - Restore the Base Address Registers for one device
+ * Some PCI bridges (e.g. PLX bridges) have primary/secondary
- * @data: EEH device
+ * buses assigned explicitly by firmware, and we probably have
- * @flag: Unused
+ * lost that after reset. So we have to delay the check until
+ * the PCI-CFG registers have been restored for the parent
+ * bridge.
 *
- * Loads the PCI configuration space base address registers,
+ * Don't use normal PCI-CFG accessors, which probably has been
- * the expansion ROM base address, the latency timer, and etc.
+ * blocked on normal path during the stage. So we need utilize
- * from the saved values in the device node.
+ * eeh operations, which is always permitted.
 */
-static void *eeh_restore_one_device_bars(void *data, void *flag)
+static void eeh_bridge_check_link(struct pci_dev *pdev,
+                                  struct device_node *dn)
+{
+        int cap;
+        uint32_t val;
+        int timeout = 0;
+        /*
+         * We only check root port and downstream ports of
+         * PCIe switches
+         */
+        if (!pci_is_pcie(pdev) ||
+            (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT &&
+             pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM))
+                return;
+        pr_debug("%s: Check PCIe link for %s ...\n",
+                 __func__, pci_name(pdev));
+        /* Check slot status */
+        cap = pdev->pcie_cap;
+        eeh_ops->read_config(dn, cap + PCI_EXP_SLTSTA, 2, &val);
+        if (!(val & PCI_EXP_SLTSTA_PDS)) {
+                pr_debug("  No card in the slot (0x%04x) !\n", val);
+                return;
+        }
+        /* Check power status if we have the capability */
+        eeh_ops->read_config(dn, cap + PCI_EXP_SLTCAP, 2, &val);
+        if (val & PCI_EXP_SLTCAP_PCP) {
+                eeh_ops->read_config(dn, cap + PCI_EXP_SLTCTL, 2, &val);
+                if (val & PCI_EXP_SLTCTL_PCC) {
+                        pr_debug("  In power-off state, power it on ...\n");
+                        val &= ~(PCI_EXP_SLTCTL_PCC | PCI_EXP_SLTCTL_PIC);
+                        val |= (0x0100 & PCI_EXP_SLTCTL_PIC);
+                        eeh_ops->write_config(dn, cap + PCI_EXP_SLTCTL, 2, val);
+                        msleep(2 * 1000);
+                }
+        }
+        /* Enable link */
+        eeh_ops->read_config(dn, cap + PCI_EXP_LNKCTL, 2, &val);
+        val &= ~PCI_EXP_LNKCTL_LD;
+        eeh_ops->write_config(dn, cap + PCI_EXP_LNKCTL, 2, val);
+        /* Check link */
+        eeh_ops->read_config(dn, cap + PCI_EXP_LNKCAP, 4, &val);
+        if (!(val & PCI_EXP_LNKCAP_DLLLARC)) {
+                pr_debug("  No link reporting capability (0x%08x) \n", val);
+                msleep(1000);
+                return;
+        }
+        /* Wait the link is up until timeout (5s) */
+        timeout = 0;
+        while (timeout < 5000) {
+                msleep(20);
+                timeout += 20;
+                eeh_ops->read_config(dn, cap + PCI_EXP_LNKSTA, 2, &val);
+                if (val & PCI_EXP_LNKSTA_DLLLA)
+                        break;
+        }
+        if (val & PCI_EXP_LNKSTA_DLLLA)
+                pr_debug("  Link up (%s)\n",
+                         (val & PCI_EXP_LNKSTA_CLS_2_5GB) ? "2.5GB" : "5GB");
+        else
+                pr_debug("  Link not ready (0x%04x)\n", val);
+}
+#define BYTE_SWAP(OFF)  (8*((OFF)/4)+3-(OFF))
+#define SAVED_BYTE(OFF) (((u8 *)(edev->config_space))[BYTE_SWAP(OFF)])
+static void eeh_restore_bridge_bars(struct pci_dev *pdev,
+                                    struct eeh_dev *edev,
+                                    struct device_node *dn)
+{
+        int i;
+        /*
+         * Device BARs: 0x10 - 0x18
+         * Bus numbers and windows: 0x18 - 0x30
+         */
+        for (i = 4; i < 13; i++)
+                eeh_ops->write_config(dn, i*4, 4, edev->config_space[i]);
+        /* Rom: 0x38 */
+        eeh_ops->write_config(dn, 14*4, 4, edev->config_space[14]);
+        /* Cache line & Latency timer: 0xC 0xD */
+        eeh_ops->write_config(dn, PCI_CACHE_LINE_SIZE, 1,
+                SAVED_BYTE(PCI_CACHE_LINE_SIZE));
+        eeh_ops->write_config(dn, PCI_LATENCY_TIMER, 1,
+                SAVED_BYTE(PCI_LATENCY_TIMER));
+        /* Max latency, min grant, interrupt ping and line: 0x3C */
+        eeh_ops->write_config(dn, 15*4, 4, edev->config_space[15]);
+        /* PCI Command: 0x4 */
+        eeh_ops->write_config(dn, PCI_COMMAND, 4, edev->config_space[1]);
+        /* Check the PCIe link is ready */
+        eeh_bridge_check_link(pdev, dn);
+}
+static void eeh_restore_device_bars(struct eeh_dev *edev,
+                                    struct device_node *dn)
 {
        int i;
        u32 cmd;
-        struct eeh_dev *edev = (struct eeh_dev *)data;
-        struct device_node *dn = eeh_dev_to_of_node(edev);
        for (i = 4; i < 10; i++)
                eeh_ops->write_config(dn, i*4, 4, edev->config_space[i]);
        /* 12 == Expansion ROM Address */
        eeh_ops->write_config(dn, 12*4, 4, edev->config_space[12]);
-#define BYTE_SWAP(OFF) (8*((OFF)/4)+3-(OFF))
-#define SAVED_BYTE(OFF) (((u8 *)(edev->config_space))[BYTE_SWAP(OFF)])
        eeh_ops->write_config(dn, PCI_CACHE_LINE_SIZE, 1,
                SAVED_BYTE(PCI_CACHE_LINE_SIZE));
        eeh_ops->write_config(dn, PCI_LATENCY_TIMER, 1,
@@ -599,6 +716,34 @@ static void *eeh_restore_one_device_bars(void *data, void *flag)
        else
                cmd &= ~PCI_COMMAND_SERR;
        eeh_ops->write_config(dn, PCI_COMMAND, 4, cmd);
+}
+/**
+ * eeh_restore_one_device_bars - Restore the Base Address Registers for one device
+ * @data: EEH device
+ * @flag: Unused
+ *
+ * Loads the PCI configuration space base address registers,
+ * the expansion ROM base address, the latency timer, and etc.
+ * from the saved values in the device node.
+ */
+static void *eeh_restore_one_device_bars(void *data, void *flag)
+{
+        struct pci_dev *pdev = NULL;
+        struct eeh_dev *edev = (struct eeh_dev *)data;
+        struct device_node *dn = eeh_dev_to_of_node(edev);
+        /* Trace the PCI bridge */
+        if (eeh_probe_mode_dev()) {
+                pdev = eeh_dev_to_pci_dev(edev);
+                if (pdev->hdr_type != PCI_HEADER_TYPE_BRIDGE)
+                        pdev = NULL;
+        }
+        if (pdev)
+                eeh_restore_bridge_bars(pdev, edev, dn);
+        else
+                eeh_restore_device_bars(edev, dn);
        return NULL;
 }
@@ -635,19 +780,21 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe)
        struct eeh_dev *edev;
        struct pci_dev *pdev;
-        eeh_lock();
        if (pe->type & EEH_PE_PHB) {
                bus = pe->phb->bus;
        } else if (pe->type & EEH_PE_BUS ||
                   pe->type & EEH_PE_DEVICE) {
+                if (pe->bus) {
+                        bus = pe->bus;
+                        goto out;
+                }
                edev = list_first_entry(&pe->edevs, struct eeh_dev, list);
                pdev = eeh_dev_to_pci_dev(edev);
                if (pdev)
                        bus = pdev->bus;
        }
-        eeh_unlock();
+out:
        return bus;
 }
diff --git a/arch/powerpc/platforms/pseries/eeh_sysfs.c b/arch/powerpc/kernel/eeh_sysfs.c
index d37708360f2e..e7ae3484918c 100644
--- a/arch/powerpc/platforms/pseries/eeh_sysfs.c
+++ b/arch/powerpc/kernel/eeh_sysfs.c
@@ -72,4 +72,3 @@ void eeh_sysfs_remove_device(struct pci_dev *pdev)
        device_remove_file(&pdev->dev, &dev_attr_eeh_config_addr);
        device_remove_file(&pdev->dev, &dev_attr_eeh_pe_config_addr);
 }
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 8741c854e03d..ab15b8d057ad 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -629,21 +629,43 @@ _GLOBAL(ret_from_except_lite)
        CURRENT_THREAD_INFO(r9, r1)
        ld      r3,_MSR(r1)
+#ifdef CONFIG_PPC_BOOK3E
+        ld      r10,PACACURRENT(r13)
+#endif /* CONFIG_PPC_BOOK3E */
        ld      r4,TI_FLAGS(r9)
        andi.   r3,r3,MSR_PR
        beq     resume_kernel
+#ifdef CONFIG_PPC_BOOK3E
+        lwz     r3,(THREAD+THREAD_DBCR0)(r10)
+#endif /* CONFIG_PPC_BOOK3E */
        /* Check current_thread_info()->flags */
        andi.   r0,r4,_TIF_USER_WORK_MASK
+#ifdef CONFIG_PPC_BOOK3E
+        bne     1f
+        /*
+         * Check to see if the dbcr0 register is set up to debug.
+         * Use the internal debug mode bit to do this.
+         */
+        andis.  r0,r3,DBCR0_IDM@h
        beq     restore
+        mfmsr   r0
-        andi.   r0,r4,_TIF_NEED_RESCHED
+        rlwinm  r0,r0,0,~MSR_DE /* Clear MSR.DE */
-        beq     1f
+        mtmsr   r0
+        mtspr   SPRN_DBCR0,r3
+        li      r10, -1
+        mtspr   SPRN_DBSR,r10
+        b       restore
+#else
+        beq     restore
+#endif
+1:      andi.   r0,r4,_TIF_NEED_RESCHED
+        beq     2f
        bl      .restore_interrupts
        SCHEDULE_USER
        b       .ret_from_except_lite
-1:      bl      .save_nvgprs
+2:      bl      .save_nvgprs
        bl      .restore_interrupts
        addi    r3,r1,STACK_FRAME_OVERHEAD
        bl      .do_notify_resume
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 40e4a17c8ba0..4e00d223b2e3 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -341,10 +341,17 @@ vsx_unavailable_pSeries_1:
        EXCEPTION_PROLOG_0(PACA_EXGEN)
        b       vsx_unavailable_pSeries
+facility_unavailable_trampoline:
        . = 0xf60
        SET_SCRATCH0(r13)
        EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       tm_unavailable_pSeries
+        b       facility_unavailable_pSeries
+hv_facility_unavailable_trampoline:
+        . = 0xf80
+        SET_SCRATCH0(r13)
+        EXCEPTION_PROLOG_0(PACA_EXGEN)
+        b       facility_unavailable_hv
 #ifdef CONFIG_CBE_RAS
        STD_EXCEPTION_HV(0x1200, 0x1202, cbe_system_error)
@@ -522,8 +529,10 @@ denorm_done:
        KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xf20)
        STD_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
        KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xf40)
-        STD_EXCEPTION_PSERIES_OOL(0xf60, tm_unavailable)
+        STD_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
        KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xf60)
+        STD_EXCEPTION_HV_OOL(0xf82, facility_unavailable)
+        KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xf82)
 /*
 * An interrupt came in while soft-disabled. We set paca->irq_happened, then:
@@ -793,14 +802,10 @@ system_call_relon_pSeries:
        STD_RELON_EXCEPTION_PSERIES(0x4d00, 0xd00, single_step)
        . = 0x4e00
-        SET_SCRATCH0(r13)
+        b       .       /* Can't happen, see v2.07 Book III-S section 6.5 */
-        EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       h_data_storage_relon_hv
        . = 0x4e20
-        SET_SCRATCH0(r13)
+        b       .       /* Can't happen, see v2.07 Book III-S section 6.5 */
-        EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       h_instr_storage_relon_hv
        . = 0x4e40
        SET_SCRATCH0(r13)
@@ -808,9 +813,7 @@ system_call_relon_pSeries:
        b       emulation_assist_relon_hv
        . = 0x4e60
-        SET_SCRATCH0(r13)
+        b       .       /* Can't happen, see v2.07 Book III-S section 6.5 */
-        EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       hmi_exception_relon_hv
        . = 0x4e80
        SET_SCRATCH0(r13)
@@ -835,11 +838,17 @@ vsx_unavailable_relon_pSeries_1:
        EXCEPTION_PROLOG_0(PACA_EXGEN)
        b       vsx_unavailable_relon_pSeries
-tm_unavailable_relon_pSeries_1:
+facility_unavailable_relon_trampoline:
        . = 0x4f60
        SET_SCRATCH0(r13)
        EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       tm_unavailable_relon_pSeries
+        b       facility_unavailable_relon_pSeries
+hv_facility_unavailable_relon_trampoline:
+        . = 0x4f80
+        SET_SCRATCH0(r13)
+        EXCEPTION_PROLOG_0(PACA_EXGEN)
+        b       facility_unavailable_relon_hv
        STD_RELON_EXCEPTION_PSERIES(0x5300, 0x1300, instruction_breakpoint)
 #ifdef CONFIG_PPC_DENORMALISATION
@@ -1165,36 +1174,21 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX)
        bl      .vsx_unavailable_exception
        b       .ret_from_except
-        .align  7
+        STD_EXCEPTION_COMMON(0xf60, facility_unavailable, .facility_unavailable_exception)
-        .globl tm_unavailable_common
-tm_unavailable_common:
-        EXCEPTION_PROLOG_COMMON(0xf60, PACA_EXGEN)
-        bl      .save_nvgprs
-        DISABLE_INTS
-        addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .tm_unavailable_exception
-        b       .ret_from_except
        .align  7
        .globl  __end_handlers
 __end_handlers:
        /* Equivalents to the above handlers for relocation-on interrupt vectors */
-        STD_RELON_EXCEPTION_HV_OOL(0xe00, h_data_storage)
-        KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe00)
-        STD_RELON_EXCEPTION_HV_OOL(0xe20, h_instr_storage)
-        KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe20)
        STD_RELON_EXCEPTION_HV_OOL(0xe40, emulation_assist)
-        KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe40)
-        STD_RELON_EXCEPTION_HV_OOL(0xe60, hmi_exception)
-        KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe60)
        MASKABLE_RELON_EXCEPTION_HV_OOL(0xe80, h_doorbell)
-        KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe80)
        STD_RELON_EXCEPTION_PSERIES_OOL(0xf00, performance_monitor)
        STD_RELON_EXCEPTION_PSERIES_OOL(0xf20, altivec_unavailable)
        STD_RELON_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
-        STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, tm_unavailable)
+        STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
+        STD_RELON_EXCEPTION_HV_OOL(0xf80, facility_unavailable)
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
 /*
diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
index a949bdfc9623..f0b47d1a6b0e 100644
--- a/arch/powerpc/kernel/hw_breakpoint.c
+++ b/arch/powerpc/kernel/hw_breakpoint.c
@@ -176,7 +176,7 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
                length_max = 512 ; /* 64 doublewords */
                /* DAWR region can't cross 512 boundary */
                if ((bp->attr.bp_addr >> 10) != 
-                    ((bp->attr.bp_addr + bp->attr.bp_len) >> 10))
+                    ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10))
                        return -EINVAL;
        }
        if (info->len >
@@ -250,6 +250,7 @@ int __kprobes hw_breakpoint_handler(struct die_args *args)
         * we still need to single-step the instruction, but we don't
         * generate an event.
         */
+        info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ;
        if (!((bp->attr.bp_addr <= dar) &&
              (dar - bp->attr.bp_addr < bp->attr.bp_len)))
                info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
index 939ea7ef0dc8..d7216c9abda1 100644
--- a/arch/powerpc/kernel/idle.c
+++ b/arch/powerpc/kernel/idle.c
@@ -85,7 +85,7 @@ int powersave_nap;
 /*
 * Register the sysctl to set/clear powersave_nap.
 */
-static ctl_table powersave_nap_ctl_table[]={
+static struct ctl_table powersave_nap_ctl_table[] = {
        {
                .procname       = "powersave-nap",
                .data           = &powersave_nap,
@@ -95,7 +95,7 @@ static ctl_table powersave_nap_ctl_table[]={
        },
        {}
 };
-static ctl_table powersave_nap_sysctl_root[] = {
+static struct ctl_table powersave_nap_sysctl_root[] = {
        {
                .procname       = "kernel",
                .mode           = 0555,
diff --git a/arch/powerpc/kernel/io-workarounds.c b/arch/powerpc/kernel/io-workarounds.c
index 50e90b7e7139..fa0b54b2a362 100644
--- a/arch/powerpc/kernel/io-workarounds.c
+++ b/arch/powerpc/kernel/io-workarounds.c
@@ -55,6 +55,7 @@ static struct iowa_bus *iowa_pci_find(unsigned long vaddr, unsigned long paddr)
 struct iowa_bus *iowa_mem_find_bus(const PCI_IO_ADDR addr)
 {
+        unsigned hugepage_shift;
        struct iowa_bus *bus;
        int token;
@@ -70,11 +71,17 @@ struct iowa_bus *iowa_mem_find_bus(const PCI_IO_ADDR addr)
                if (vaddr < PHB_IO_BASE || vaddr >= PHB_IO_END)
                        return NULL;
-                ptep = find_linux_pte(init_mm.pgd, vaddr);
+                ptep = find_linux_pte_or_hugepte(init_mm.pgd, vaddr,
+                                                 &hugepage_shift);
                if (ptep == NULL)
                        paddr = 0;
-                else
+                else {
+                        /*
+                         * we don't have hugepages backing iomem
+                         */
+                        WARN_ON(hugepage_shift);
                        paddr = pte_pfn(*ptep) << PAGE_SHIFT;
+                }
                bus = iowa_pci_find(vaddr, paddr);
                if (bus == NULL)
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index c0d0dbddfba1..b20ff173a671 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -36,6 +36,8 @@
 #include <linux/hash.h>
 #include <linux/fault-inject.h>
 #include <linux/pci.h>
+#include <linux/iommu.h>
+#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/prom.h>
 #include <asm/iommu.h>
@@ -44,6 +46,7 @@
 #include <asm/kdump.h>
 #include <asm/fadump.h>
 #include <asm/vio.h>
+#include <asm/tce.h>
 #define DBG(...)
@@ -724,6 +727,13 @@ void iommu_free_table(struct iommu_table *tbl, const char *node_name)
        if (tbl->it_offset == 0)
                clear_bit(0, tbl->it_map);
+#ifdef CONFIG_IOMMU_API
+        if (tbl->it_group) {
+                iommu_group_put(tbl->it_group);
+                BUG_ON(tbl->it_group);
+        }
+#endif
        /* verify that table contains no entries */
        if (!bitmap_empty(tbl->it_map, tbl->it_size))
                pr_warn("%s: Unexpected TCEs for %s\n", __func__, node_name);
@@ -860,3 +870,316 @@ void iommu_free_coherent(struct iommu_table *tbl, size_t size,
                free_pages((unsigned long)vaddr, get_order(size));
        }
 }
+#ifdef CONFIG_IOMMU_API
+/*
+ * SPAPR TCE API
+ */
+static void group_release(void *iommu_data)
+{
+        struct iommu_table *tbl = iommu_data;
+        tbl->it_group = NULL;
+}
+void iommu_register_group(struct iommu_table *tbl,
+                int pci_domain_number, unsigned long pe_num)
+{
+        struct iommu_group *grp;
+        char *name;
+        grp = iommu_group_alloc();
+        if (IS_ERR(grp)) {
+                pr_warn("powerpc iommu api: cannot create new group, err=%ld\n",
+                                PTR_ERR(grp));
+                return;
+        }
+        tbl->it_group = grp;
+        iommu_group_set_iommudata(grp, tbl, group_release);
+        name = kasprintf(GFP_KERNEL, "domain%d-pe%lx",
+                        pci_domain_number, pe_num);
+        if (!name)
+                return;
+        iommu_group_set_name(grp, name);
+        kfree(name);
+}
+enum dma_data_direction iommu_tce_direction(unsigned long tce)
+{
+        if ((tce & TCE_PCI_READ) && (tce & TCE_PCI_WRITE))
+                return DMA_BIDIRECTIONAL;
+        else if (tce & TCE_PCI_READ)
+                return DMA_TO_DEVICE;
+        else if (tce & TCE_PCI_WRITE)
+                return DMA_FROM_DEVICE;
+        else
+                return DMA_NONE;
+}
+EXPORT_SYMBOL_GPL(iommu_tce_direction);
+void iommu_flush_tce(struct iommu_table *tbl)
+{
+        /* Flush/invalidate TLB caches if necessary */
+        if (ppc_md.tce_flush)
+                ppc_md.tce_flush(tbl);
+        /* Make sure updates are seen by hardware */
+        mb();
+}
+EXPORT_SYMBOL_GPL(iommu_flush_tce);
+int iommu_tce_clear_param_check(struct iommu_table *tbl,
+                unsigned long ioba, unsigned long tce_value,
+                unsigned long npages)
+{
+        /* ppc_md.tce_free() does not support any value but 0 */
+        if (tce_value)
+                return -EINVAL;
+        if (ioba & ~IOMMU_PAGE_MASK)
+                return -EINVAL;
+        ioba >>= IOMMU_PAGE_SHIFT;
+        if (ioba < tbl->it_offset)
+                return -EINVAL;
+        if ((ioba + npages) > (tbl->it_offset + tbl->it_size))
+                return -EINVAL;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iommu_tce_clear_param_check);
+int iommu_tce_put_param_check(struct iommu_table *tbl,
+                unsigned long ioba, unsigned long tce)
+{
+        if (!(tce & (TCE_PCI_WRITE | TCE_PCI_READ)))
+                return -EINVAL;
+        if (tce & ~(IOMMU_PAGE_MASK | TCE_PCI_WRITE | TCE_PCI_READ))
+                return -EINVAL;
+        if (ioba & ~IOMMU_PAGE_MASK)
+                return -EINVAL;
+        ioba >>= IOMMU_PAGE_SHIFT;
+        if (ioba < tbl->it_offset)
+                return -EINVAL;
+        if ((ioba + 1) > (tbl->it_offset + tbl->it_size))
+                return -EINVAL;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iommu_tce_put_param_check);
+unsigned long iommu_clear_tce(struct iommu_table *tbl, unsigned long entry)
+{
+        unsigned long oldtce;
+        struct iommu_pool *pool = get_pool(tbl, entry);
+        spin_lock(&(pool->lock));
+        oldtce = ppc_md.tce_get(tbl, entry);
+        if (oldtce & (TCE_PCI_WRITE | TCE_PCI_READ))
+                ppc_md.tce_free(tbl, entry, 1);
+        else
+                oldtce = 0;
+        spin_unlock(&(pool->lock));
+        return oldtce;
+}
+EXPORT_SYMBOL_GPL(iommu_clear_tce);
+int iommu_clear_tces_and_put_pages(struct iommu_table *tbl,
+                unsigned long entry, unsigned long pages)
+{
+        unsigned long oldtce;
+        struct page *page;
+        for ( ; pages; --pages, ++entry) {
+                oldtce = iommu_clear_tce(tbl, entry);
+                if (!oldtce)
+                        continue;
+                page = pfn_to_page(oldtce >> PAGE_SHIFT);
+                WARN_ON(!page);
+                if (page) {
+                        if (oldtce & TCE_PCI_WRITE)
+                                SetPageDirty(page);
+                        put_page(page);
+                }
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iommu_clear_tces_and_put_pages);
+/*
+ * hwaddr is a kernel virtual address here (0xc... bazillion),
+ * tce_build converts it to a physical address.
+ */
+int iommu_tce_build(struct iommu_table *tbl, unsigned long entry,
+                unsigned long hwaddr, enum dma_data_direction direction)
+{
+        int ret = -EBUSY;
+        unsigned long oldtce;
+        struct iommu_pool *pool = get_pool(tbl, entry);
+        spin_lock(&(pool->lock));
+        oldtce = ppc_md.tce_get(tbl, entry);
+        /* Add new entry if it is not busy */
+        if (!(oldtce & (TCE_PCI_WRITE | TCE_PCI_READ)))
+                ret = ppc_md.tce_build(tbl, entry, 1, hwaddr, direction, NULL);
+        spin_unlock(&(pool->lock));
+        /* if (unlikely(ret))
+                pr_err("iommu_tce: %s failed on hwaddr=%lx ioba=%lx kva=%lx ret=%d\n",
+                                __func__, hwaddr, entry << IOMMU_PAGE_SHIFT,
+                                hwaddr, ret); */
+        return ret;
+}
+EXPORT_SYMBOL_GPL(iommu_tce_build);
+int iommu_put_tce_user_mode(struct iommu_table *tbl, unsigned long entry,
+                unsigned long tce)
+{
+        int ret;
+        struct page *page = NULL;
+        unsigned long hwaddr, offset = tce & IOMMU_PAGE_MASK & ~PAGE_MASK;
+        enum dma_data_direction direction = iommu_tce_direction(tce);
+        ret = get_user_pages_fast(tce & PAGE_MASK, 1,
+                        direction != DMA_TO_DEVICE, &page);
+        if (unlikely(ret != 1)) {
+                /* pr_err("iommu_tce: get_user_pages_fast failed tce=%lx ioba=%lx ret=%d\n",
+                                tce, entry << IOMMU_PAGE_SHIFT, ret); */
+                return -EFAULT;
+        }
+        hwaddr = (unsigned long) page_address(page) + offset;
+        ret = iommu_tce_build(tbl, entry, hwaddr, direction);
+        if (ret)
+                put_page(page);
+        if (ret < 0)
+                pr_err("iommu_tce: %s failed ioba=%lx, tce=%lx, ret=%d\n",
+                                __func__, entry << IOMMU_PAGE_SHIFT, tce, ret);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(iommu_put_tce_user_mode);
+int iommu_take_ownership(struct iommu_table *tbl)
+{
+        unsigned long sz = (tbl->it_size + 7) >> 3;
+        if (tbl->it_offset == 0)
+                clear_bit(0, tbl->it_map);
+        if (!bitmap_empty(tbl->it_map, tbl->it_size)) {
+                pr_err("iommu_tce: it_map is not empty");
+                return -EBUSY;
+        }
+        memset(tbl->it_map, 0xff, sz);
+        iommu_clear_tces_and_put_pages(tbl, tbl->it_offset, tbl->it_size);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iommu_take_ownership);
+void iommu_release_ownership(struct iommu_table *tbl)
+{
+        unsigned long sz = (tbl->it_size + 7) >> 3;
+        iommu_clear_tces_and_put_pages(tbl, tbl->it_offset, tbl->it_size);
+        memset(tbl->it_map, 0, sz);
+        /* Restore bit#0 set by iommu_init_table() */
+        if (tbl->it_offset == 0)
+                set_bit(0, tbl->it_map);
+}
+EXPORT_SYMBOL_GPL(iommu_release_ownership);
+static int iommu_add_device(struct device *dev)
+{
+        struct iommu_table *tbl;
+        int ret = 0;
+        if (WARN_ON(dev->iommu_group)) {
+                pr_warn("iommu_tce: device %s is already in iommu group %d, skipping\n",
+                                dev_name(dev),
+                                iommu_group_id(dev->iommu_group));
+                return -EBUSY;
+        }
+        tbl = get_iommu_table_base(dev);
+        if (!tbl || !tbl->it_group) {
+                pr_debug("iommu_tce: skipping device %s with no tbl\n",
+                                dev_name(dev));
+                return 0;
+        }
+        pr_debug("iommu_tce: adding %s to iommu group %d\n",
+                        dev_name(dev), iommu_group_id(tbl->it_group));
+        ret = iommu_group_add_device(tbl->it_group, dev);
+        if (ret < 0)
+                pr_err("iommu_tce: %s has not been added, ret=%d\n",
+                                dev_name(dev), ret);
+        return ret;
+}
+static void iommu_del_device(struct device *dev)
+{
+        iommu_group_remove_device(dev);
+}
+static int iommu_bus_notifier(struct notifier_block *nb,
+                              unsigned long action, void *data)
+{
+        struct device *dev = data;
+        switch (action) {
+        case BUS_NOTIFY_ADD_DEVICE:
+                return iommu_add_device(dev);
+        case BUS_NOTIFY_DEL_DEVICE:
+                iommu_del_device(dev);
+                return 0;
+        default:
+                return 0;
+        }
+}
+static struct notifier_block tce_iommu_bus_nb = {
+        .notifier_call = iommu_bus_notifier,
+};
+static int __init tce_iommu_init(void)
+{
+        struct pci_dev *pdev = NULL;
+        BUILD_BUG_ON(PAGE_SIZE < IOMMU_PAGE_SIZE);
+        for_each_pci_dev(pdev)
+                iommu_add_device(&pdev->dev);
+        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
+        return 0;
+}
+subsys_initcall_sync(tce_iommu_init);
+#else
+void iommu_register_group(struct iommu_table *tbl,
+                int pci_domain_number, unsigned long pe_num)
+{
+}
+#endif /* CONFIG_IOMMU_API */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index ea185e0b3cae..2e51cde616d2 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -116,8 +116,6 @@ static inline notrace int decrementer_check_overflow(void)
        u64 now = get_tb_or_rtc();
        u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
 
-        if (now >= *next_tb)
-                set_dec(1);
        return now >= *next_tb;
 }
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 11f5b03a0b06..2156ea90eb54 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -36,12 +36,6 @@
 #include <asm/sstep.h>
 #include <asm/uaccess.h>
-#ifdef CONFIG_PPC_ADV_DEBUG_REGS
-#define MSR_SINGLESTEP  (MSR_DE)
-#else
-#define MSR_SINGLESTEP  (MSR_SE)
-#endif
 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
@@ -104,19 +98,7 @@ void __kprobes arch_remove_kprobe(struct kprobe *p)
 static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
 {
-        /* We turn off async exceptions to ensure that the single step will
+        enable_single_step(regs);
-         * be for the instruction we have the kprobe on, if we dont its
-         * possible we'd get the single step reported for an exception handler
-         * like Decrementer or External Interrupt */
-        regs->msr &= ~MSR_EE;
-        regs->msr |= MSR_SINGLESTEP;
-#ifdef CONFIG_PPC_ADV_DEBUG_REGS
-        regs->msr &= ~MSR_CE;
-        mtspr(SPRN_DBCR0, mfspr(SPRN_DBCR0) | DBCR0_IC | DBCR0_IDM);
-#ifdef CONFIG_PPC_47x
-        isync();
-#endif
-#endif
        /*
         * On powerpc we should single step on the original
diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index 48fbc2b97e95..8213ee1eb05a 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -84,22 +84,30 @@ static ssize_t dev_nvram_read(struct file *file, char __user *buf,
        char *tmp = NULL;
        ssize_t size;
-        ret = -ENODEV;
+        if (!ppc_md.nvram_size) {
-        if (!ppc_md.nvram_size)
+                ret = -ENODEV;
                goto out;
+        }
-        ret = 0;
        size = ppc_md.nvram_size();
-        if (*ppos >= size || size < 0)
+        if (size < 0) {
+                ret = size;
+                goto out;
+        }
+        if (*ppos >= size) {
+                ret = 0;
                goto out;
+        }
        count = min_t(size_t, count, size - *ppos);
        count = min(count, PAGE_SIZE);
-        ret = -ENOMEM;
        tmp = kmalloc(count, GFP_KERNEL);
-        if (!tmp)
+        if (!tmp) {
+                ret = -ENOMEM;
                goto out;
+        }
        ret = ppc_md.nvram_read(tmp, count, ppos);
        if (ret <= 0)
diff --git a/arch/powerpc/kernel/pci-hotplug.c b/arch/powerpc/kernel/pci-hotplug.c
new file mode 100644
index 000000000000..3f608800c06b
--- /dev/null
+++ b/arch/powerpc/kernel/pci-hotplug.c
@@ -0,0 +1,111 @@
+/*
+ * Derived from "arch/powerpc/platforms/pseries/pci_dlpar.c"
+ *
+ * Copyright (C) 2003 Linda Xie <lxie@us.ibm.com>
+ * Copyright (C) 2005 International Business Machines
+ *
+ * Updates, 2005, John Rose <johnrose@austin.ibm.com>
+ * Updates, 2005, Linas Vepstas <linas@austin.ibm.com>
+ * Updates, 2013, Gavin Shan <shangw@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/pci.h>
+#include <linux/export.h>
+#include <asm/pci-bridge.h>
+#include <asm/ppc-pci.h>
+#include <asm/firmware.h>
+#include <asm/eeh.h>
+/**
+ * __pcibios_remove_pci_devices - remove all devices under this bus
+ * @bus: the indicated PCI bus
+ * @purge_pe: destroy the PE on removal of PCI devices
+ *
+ * Remove all of the PCI devices under this bus both from the
+ * linux pci device tree, and from the powerpc EEH address cache.
+ * By default, the corresponding PE will be destroied during the
+ * normal PCI hotplug path. For PCI hotplug during EEH recovery,
+ * the corresponding PE won't be destroied and deallocated.
+ */
+void __pcibios_remove_pci_devices(struct pci_bus *bus, int purge_pe)
+{
+        struct pci_dev *dev, *tmp;
+        struct pci_bus *child_bus;
+        /* First go down child busses */
+        list_for_each_entry(child_bus, &bus->children, node)
+                __pcibios_remove_pci_devices(child_bus, purge_pe);
+        pr_debug("PCI: Removing devices on bus %04x:%02x\n",
+                 pci_domain_nr(bus),  bus->number);
+        list_for_each_entry_safe(dev, tmp, &bus->devices, bus_list) {
+                pr_debug("     * Removing %s...\n", pci_name(dev));
+                eeh_remove_bus_device(dev, purge_pe);
+                pci_stop_and_remove_bus_device(dev);
+        }
+}
+/**
+ * pcibios_remove_pci_devices - remove all devices under this bus
+ * @bus: the indicated PCI bus
+ *
+ * Remove all of the PCI devices under this bus both from the
+ * linux pci device tree, and from the powerpc EEH address cache.
+ */
+void pcibios_remove_pci_devices(struct pci_bus *bus)
+{
+        __pcibios_remove_pci_devices(bus, 1);
+}
+EXPORT_SYMBOL_GPL(pcibios_remove_pci_devices);
+/**
+ * pcibios_add_pci_devices - adds new pci devices to bus
+ * @bus: the indicated PCI bus
+ *
+ * This routine will find and fixup new pci devices under
+ * the indicated bus. This routine presumes that there
+ * might already be some devices under this bridge, so
+ * it carefully tries to add only new devices.  (And that
+ * is how this routine differs from other, similar pcibios
+ * routines.)
+ */
+void pcibios_add_pci_devices(struct pci_bus * bus)
+{
+        int slotno, num, mode, pass, max;
+        struct pci_dev *dev;
+        struct device_node *dn = pci_bus_to_OF_node(bus);
+        eeh_add_device_tree_early(dn);
+        mode = PCI_PROBE_NORMAL;
+        if (ppc_md.pci_probe_mode)
+                mode = ppc_md.pci_probe_mode(bus);
+        if (mode == PCI_PROBE_DEVTREE) {
+                /* use ofdt-based probe */
+                of_rescan_bus(dn, bus);
+        } else if (mode == PCI_PROBE_NORMAL) {
+                /* use legacy probe */
+                slotno = PCI_SLOT(PCI_DN(dn->child)->devfn);
+                num = pci_scan_slot(bus, PCI_DEVFN(slotno, 0));
+                if (!num)
+                        return;
+                pcibios_setup_bus_devices(bus);
+                max = bus->busn_res.start;
+                for (pass = 0; pass < 2; pass++) {
+                        list_for_each_entry(dev, &bus->devices, bus_list) {
+                                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE ||
+                                    dev->hdr_type == PCI_HEADER_TYPE_CARDBUS)
+                                        max = pci_scan_bridge(bus, dev,
+                                                              max, pass);
+                        }
+                }
+        }
+        pcibios_finish_adding_to_bus(bus);
+}
+EXPORT_SYMBOL_GPL(pcibios_add_pci_devices);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 076d1242507a..c517dbe705fd 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -916,7 +916,11 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
        flush_altivec_to_thread(src);
        flush_vsx_to_thread(src);
        flush_spe_to_thread(src);
        *dst = *src;
+        clear_task_ebb(dst);
        return 0;
 }
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 8b6f7a99cce2..eb23ac92abb9 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -559,6 +559,35 @@ void __init early_init_dt_setup_initrd_arch(unsigned long start,
 }
 #endif
+static void __init early_reserve_mem_dt(void)
+{
+        unsigned long i, len, dt_root;
+        const __be32 *prop;
+        dt_root = of_get_flat_dt_root();
+        prop = of_get_flat_dt_prop(dt_root, "reserved-ranges", &len);
+        if (!prop)
+                return;
+        DBG("Found new-style reserved-ranges\n");
+        /* Each reserved range is an (address,size) pair, 2 cells each,
+         * totalling 4 cells per range. */
+        for (i = 0; i < len / (sizeof(*prop) * 4); i++) {
+                u64 base, size;
+                base = of_read_number(prop + (i * 4) + 0, 2);
+                size = of_read_number(prop + (i * 4) + 2, 2);
+                if (size) {
+                        DBG("reserving: %llx -> %llx\n", base, size);
+                        memblock_reserve(base, size);
+                }
+        }
+}
 static void __init early_reserve_mem(void)
 {
        u64 base, size;
@@ -574,12 +603,16 @@ static void __init early_reserve_mem(void)
        self_size = initial_boot_params->totalsize;
        memblock_reserve(self_base, self_size);
+        /* Look for the new "reserved-regions" property in the DT */
+        early_reserve_mem_dt();
 #ifdef CONFIG_BLK_DEV_INITRD
-        /* then reserve the initrd, if any */
+        /* Then reserve the initrd, if any */
-        if (initrd_start && (initrd_end > initrd_start))
+        if (initrd_start && (initrd_end > initrd_start)) {
                memblock_reserve(_ALIGN_DOWN(__pa(initrd_start), PAGE_SIZE),
                        _ALIGN_UP(initrd_end, PAGE_SIZE) -
                        _ALIGN_DOWN(initrd_start, PAGE_SIZE));
+        }
 #endif /* CONFIG_BLK_DEV_INITRD */
 #ifdef CONFIG_PPC32
@@ -591,6 +624,8 @@ static void __init early_reserve_mem(void)
                u32 base_32, size_32;
                u32 *reserve_map_32 = (u32 *)reserve_map;
+                DBG("Found old 32-bit reserve map\n");
                while (1) {
                        base_32 = *(reserve_map_32++);
                        size_32 = *(reserve_map_32++);
@@ -605,6 +640,9 @@ static void __init early_reserve_mem(void)
                return;
        }
 #endif
+        DBG("Processing reserve map\n");
+        /* Handle the reserve map in the fdt blob if it exists */
        while (1) {
                base = *(reserve_map++);
                size = *(reserve_map++);
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 98c2fc198712..64f7bd5b1b0f 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1449,7 +1449,9 @@ static long ppc_set_hwdebug(struct task_struct *child,
         */
        if (bp_info->addr_mode == PPC_BREAKPOINT_MODE_RANGE_INCLUSIVE) {
                len = bp_info->addr2 - bp_info->addr;
-        } else if (bp_info->addr_mode != PPC_BREAKPOINT_MODE_EXACT) {
+        } else if (bp_info->addr_mode == PPC_BREAKPOINT_MODE_EXACT)
+                len = 1;
+        else {
                ptrace_put_breakpoints(child);
                return -EINVAL;
        }
diff --git a/arch/powerpc/kernel/reloc_32.S b/arch/powerpc/kernel/reloc_32.S
index ef46ba6e094f..f366fedb0872 100644
--- a/arch/powerpc/kernel/reloc_32.S
+++ b/arch/powerpc/kernel/reloc_32.S
@@ -166,7 +166,7 @@ ha16:
        /* R_PPC_ADDR16_LO */
 lo16:
        cmpwi   r4, R_PPC_ADDR16_LO
-        bne     nxtrela
+        bne     unknown_type
        lwz     r4, 0(r9)       /* r_offset */
        lwz     r0, 8(r9)       /* r_addend */
        add     r0, r0, r3
@@ -191,6 +191,7 @@ nxtrela:
        dcbst   r4,r7
        sync                    /* Ensure the data is flushed before icbi */
        icbi    r4,r7
+unknown_type:
        cmpwi   r8, 0           /* relasz = 0 ? */
        ble     done
        add     r9, r9, r6      /* move to next entry in the .rela table */
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 52add6f3e201..80b5ef403f68 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1172,7 +1172,7 @@ int __init early_init_dt_scan_rtas(unsigned long node,
 static arch_spinlock_t timebase_lock;
 static u64 timebase = 0;
-void __cpuinit rtas_give_timebase(void)
+void rtas_give_timebase(void)
 {
        unsigned long flags;
@@ -1189,7 +1189,7 @@ void __cpuinit rtas_give_timebase(void)
        local_irq_restore(flags);
 }
-void __cpuinit rtas_take_timebase(void)
+void rtas_take_timebase(void)
 {
        while (!timebase)
                barrier();
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index e379d3fd1694..389fb8077cc9 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -76,7 +76,7 @@
 #endif
 int boot_cpuid = 0;
-int __initdata spinning_secondaries;
+int spinning_secondaries;
 u64 ppc64_pft_size;
 /* Pick defaults since we might want to patch instructions
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 201385c3a1ae..0f83122e6676 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -407,7 +407,8 @@ inline unsigned long copy_transact_fpr_from_user(struct task_struct *task,
 * altivec/spe instructions at some point.
 */
 static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
-                int sigret, int ctx_has_vsx_region)
+                          struct mcontext __user *tm_frame, int sigret,
+                          int ctx_has_vsx_region)
 {
        unsigned long msr = regs->msr;
@@ -475,6 +476,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
        if (__put_user(msr, &frame->mc_gregs[PT_MSR]))
                return 1;
+        /* We need to write 0 the MSR top 32 bits in the tm frame so that we
+         * can check it on the restore to see if TM is active
+         */
+        if (tm_frame && __put_user(0, &tm_frame->mc_gregs[PT_MSR]))
+                return 1;
        if (sigret) {
                /* Set up the sigreturn trampoline: li r0,sigret; sc */
                if (__put_user(0x38000000UL + sigret, &frame->tramp[0])
@@ -747,7 +754,7 @@ static long restore_tm_user_regs(struct pt_regs *regs,
                                 struct mcontext __user *tm_sr)
 {
        long err;
-        unsigned long msr;
+        unsigned long msr, msr_hi;
 #ifdef CONFIG_VSX
        int i;
 #endif
@@ -852,8 +859,11 @@ static long restore_tm_user_regs(struct pt_regs *regs,
        tm_enable();
        /* This loads the checkpointed FP/VEC state, if used */
        tm_recheckpoint(&current->thread, msr);
-        /* The task has moved into TM state S, so ensure MSR reflects this */
+        /* Get the top half of the MSR */
-        regs->msr = (regs->msr & ~MSR_TS_MASK) | MSR_TS_S;
+        if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
+                return 1;
+        /* Pull in MSR TM from user context */
+        regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK);
        /* This loads the speculative FP/VEC state, if used */
        if (msr & MSR_FP) {
@@ -952,6 +962,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
 {
        struct rt_sigframe __user *rt_sf;
        struct mcontext __user *frame;
+        struct mcontext __user *tm_frame = NULL;
        void __user *addr;
        unsigned long newsp = 0;
        int sigret;
@@ -985,23 +996,24 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
        }
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        tm_frame = &rt_sf->uc_transact.uc_mcontext;
        if (MSR_TM_ACTIVE(regs->msr)) {
-                if (save_tm_user_regs(regs, &rt_sf->uc.uc_mcontext,
+                if (save_tm_user_regs(regs, frame, tm_frame, sigret))
-                                      &rt_sf->uc_transact.uc_mcontext, sigret))
                        goto badframe;
        }
        else
 #endif
-                if (save_user_regs(regs, frame, sigret, 1))
+        {
+                if (save_user_regs(regs, frame, tm_frame, sigret, 1))
                        goto badframe;
+        }
        regs->link = tramp;
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
        if (MSR_TM_ACTIVE(regs->msr)) {
                if (__put_user((unsigned long)&rt_sf->uc_transact,
                               &rt_sf->uc.uc_link)
-                    || __put_user(to_user_ptr(&rt_sf->uc_transact.uc_mcontext),
+                    || __put_user((unsigned long)tm_frame, &rt_sf->uc_transact.uc_regs))
-                                  &rt_sf->uc_transact.uc_regs))
                        goto badframe;
        }
        else
@@ -1170,7 +1182,7 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
                mctx = (struct mcontext __user *)
                        ((unsigned long) &old_ctx->uc_mcontext & ~0xfUL);
                if (!access_ok(VERIFY_WRITE, old_ctx, ctx_size)
-                    || save_user_regs(regs, mctx, 0, ctx_has_vsx_region)
+                    || save_user_regs(regs, mctx, NULL, 0, ctx_has_vsx_region)
                    || put_sigset_t(&old_ctx->uc_sigmask, &current->blocked)
                    || __put_user(to_user_ptr(mctx), &old_ctx->uc_regs))
                        return -EFAULT;
@@ -1233,7 +1245,7 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
                if (__get_user(msr_hi, &mcp->mc_gregs[PT_MSR]))
                        goto bad;
-                if (MSR_TM_SUSPENDED(msr_hi<<32)) {
+                if (MSR_TM_ACTIVE(msr_hi<<32)) {
                        /* We only recheckpoint on return if we're
                         * transaction.
                         */
@@ -1392,6 +1404,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
 {
        struct sigcontext __user *sc;
        struct sigframe __user *frame;
+        struct mcontext __user *tm_mctx = NULL;
        unsigned long newsp = 0;
        int sigret;
        unsigned long tramp;
@@ -1425,6 +1438,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
        }
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        tm_mctx = &frame->mctx_transact;
        if (MSR_TM_ACTIVE(regs->msr)) {
                if (save_tm_user_regs(regs, &frame->mctx, &frame->mctx_transact,
                                      sigret))
@@ -1432,8 +1446,10 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
        }
        else
 #endif
-                if (save_user_regs(regs, &frame->mctx, sigret, 1))
+        {
+                if (save_user_regs(regs, &frame->mctx, tm_mctx, sigret, 1))
                        goto badframe;
+        }
        regs->link = tramp;
@@ -1481,16 +1497,22 @@ badframe:
 long sys_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
                       struct pt_regs *regs)
 {
+        struct sigframe __user *sf;
        struct sigcontext __user *sc;
        struct sigcontext sigctx;
        struct mcontext __user *sr;
        void __user *addr;
        sigset_t set;
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        struct mcontext __user *mcp, *tm_mcp;
+        unsigned long msr_hi;
+#endif
        /* Always make any pending restarted system calls return -EINTR */
        current_thread_info()->restart_block.fn = do_no_restart_syscall;
-        sc = (struct sigcontext __user *)(regs->gpr[1] + __SIGNAL_FRAMESIZE);
+        sf = (struct sigframe __user *)(regs->gpr[1] + __SIGNAL_FRAMESIZE);
+        sc = &sf->sctx;
        addr = sc;
        if (copy_from_user(&sigctx, sc, sizeof(sigctx)))
                goto badframe;
@@ -1507,11 +1529,25 @@ long sys_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
 #endif
        set_current_blocked(&set);
-        sr = (struct mcontext __user *)from_user_ptr(sigctx.regs);
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-        addr = sr;
+        mcp = (struct mcontext __user *)&sf->mctx;
-        if (!access_ok(VERIFY_READ, sr, sizeof(*sr))
+        tm_mcp = (struct mcontext __user *)&sf->mctx_transact;
-            || restore_user_regs(regs, sr, 1))
+        if (__get_user(msr_hi, &tm_mcp->mc_gregs[PT_MSR]))
                goto badframe;
+        if (MSR_TM_ACTIVE(msr_hi<<32)) {
+                if (!cpu_has_feature(CPU_FTR_TM))
+                        goto badframe;
+                if (restore_tm_user_regs(regs, mcp, tm_mcp))
+                        goto badframe;
+        } else
+#endif
+        {
+                sr = (struct mcontext __user *)from_user_ptr(sigctx.regs);
+                addr = sr;
+                if (!access_ok(VERIFY_READ, sr, sizeof(*sr))
+                    || restore_user_regs(regs, sr, 1))
+                        goto badframe;
+        }
        set_thread_flag(TIF_RESTOREALL);
        return 0;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 345947367ec0..887e99d85bc2 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -410,6 +410,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
        /* get MSR separately, transfer the LE bit if doing signal return */
        err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
+        /* pull in MSR TM from user context */
+        regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+        /* pull in MSR LE from user context */
        regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
        /* The following non-GPR non-FPR non-VR state is also checkpointed: */
@@ -505,8 +509,6 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
        tm_enable();
        /* This loads the checkpointed FP/VEC state, if used */
        tm_recheckpoint(&current->thread, msr);
-        /* The task has moved into TM state S, so ensure MSR reflects this: */
-        regs->msr = (regs->msr & ~MSR_TS_MASK) | __MASK(33);
        /* This loads the speculative FP/VEC state, if used */
        if (msr & MSR_FP) {
@@ -654,7 +656,7 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
        if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
                goto badframe;
-        if (MSR_TM_SUSPENDED(msr)) {
+        if (MSR_TM_ACTIVE(msr)) {
                /* We recheckpoint on return. */
                struct ucontext __user *uc_transact;
                if (__get_user(uc_transact, &uc->uc_link))
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index ee7ac5e6e28a..38b0ba65a735 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -480,7 +480,7 @@ static void cpu_idle_thread_init(unsigned int cpu, struct task_struct *idle)
        secondary_ti = current_set[cpu] = ti;
 }
-int __cpuinit __cpu_up(unsigned int cpu, struct task_struct *tidle)
+int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
        int rc, c;
@@ -610,7 +610,7 @@ static struct device_node *cpu_to_l2cache(int cpu)
 }
 /* Activate a secondary processor. */
-__cpuinit void start_secondary(void *unused)
+void start_secondary(void *unused)
 {
        unsigned int cpu = smp_processor_id();
        struct device_node *l2_cache;
@@ -637,12 +637,10 @@ __cpuinit void start_secondary(void *unused)
        vdso_getcpu_init();
 #endif
-        notify_cpu_starting(cpu);
-        set_cpu_online(cpu, true);
        /* Update sibling maps */
        base = cpu_first_thread_sibling(cpu);
        for (i = 0; i < threads_per_core; i++) {
-                if (cpu_is_offline(base + i))
+                if (cpu_is_offline(base + i) && (cpu != base + i))
                        continue;
                cpumask_set_cpu(cpu, cpu_sibling_mask(base + i));
                cpumask_set_cpu(base + i, cpu_sibling_mask(cpu));
@@ -667,6 +665,10 @@ __cpuinit void start_secondary(void *unused)
        }
        of_node_put(l2_cache);
+        smp_wmb();
+        notify_cpu_starting(cpu);
+        set_cpu_online(cpu, true);
        local_irq_enable();
        cpu_startup_entry(CPUHP_ONLINE);
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index e68a84568b8b..27a90b99ef67 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -341,7 +341,7 @@ static struct device_attribute pa6t_attrs[] = {
 #endif /* HAS_PPC_PMC_PA6T */
 #endif /* HAS_PPC_PMC_CLASSIC */
-static void __cpuinit register_cpu_online(unsigned int cpu)
+static void register_cpu_online(unsigned int cpu)
 {
        struct cpu *c = &per_cpu(cpu_devices, cpu);
        struct device *s = &c->dev;
@@ -502,7 +502,7 @@ ssize_t arch_cpu_release(const char *buf, size_t count)
 #endif /* CONFIG_HOTPLUG_CPU */
-static int __cpuinit sysfs_cpu_notify(struct notifier_block *self,
+static int sysfs_cpu_notify(struct notifier_block *self,
                                      unsigned long action, void *hcpu)
 {
        unsigned int cpu = (unsigned int)(long)hcpu;
@@ -522,7 +522,7 @@ static int __cpuinit sysfs_cpu_notify(struct notifier_block *self,
        return NOTIFY_OK;
 }
-static struct notifier_block __cpuinitdata sysfs_cpu_nb = {
+static struct notifier_block sysfs_cpu_nb = {
        .notifier_call  = sysfs_cpu_notify,
 };
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 5fc29ad7e26f..65ab9e909377 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -631,7 +631,6 @@ static int __init get_freq(char *name, int cells, unsigned long *val)
        return found;
 }
-/* should become __cpuinit when secondary_cpu_time_init also is */
 void start_cpu_decrementer(void)
 {
 #if defined(CONFIG_BOOKE) || defined(CONFIG_40x)
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 2da67e7a16d5..51be8fb24803 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -112,9 +112,18 @@ _GLOBAL(tm_reclaim)
        std     r3, STACK_PARAM(0)(r1)
        SAVE_NVGPRS(r1)
+        /* We need to setup MSR for VSX register save instructions.  Here we
+         * also clear the MSR RI since when we do the treclaim, we won't have a
+         * valid kernel pointer for a while.  We clear RI here as it avoids
+         * adding another mtmsr closer to the treclaim.  This makes the region
+         * maked as non-recoverable wider than it needs to be but it saves on
+         * inserting another mtmsrd later.
+         */
        mfmsr   r14
        mr      r15, r14
        ori     r15, r15, MSR_FP
+        li      r16, MSR_RI
+        andc    r15, r15, r16
        oris    r15, r15, MSR_VEC@h
 #ifdef CONFIG_VSX
        BEGIN_FTR_SECTION
@@ -349,9 +358,10 @@ restore_gprs:
        mtcr    r5
        mtxer   r6
-        /* MSR and flags:  We don't change CRs, and we don't need to alter
+        /* Clear the MSR RI since we are about to change R1.  EE is already off
-         * MSR.
         */
+        li      r4, 0
+        mtmsrd  r4, 1
        REST_4GPRS(0, r7)                       /* GPR0-3 */
        REST_GPR(4, r7)                         /* GPR4-6 */
@@ -377,6 +387,10 @@ restore_gprs:
        GET_PACA(r13)
        GET_SCRATCH0(r1)
+        /* R1 is restored, so we are recoverable again.  EE is still off */
+        li      r4, MSR_RI
+        mtmsrd  r4, 1
        REST_NVGPRS(r1)
        addi    r1, r1, TM_FRAME_SIZE
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index c0e5caf8ccc7..bf33c22e38a4 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -866,6 +866,10 @@ static int emulate_string_inst(struct pt_regs *regs, u32 instword)
                u8 val;
                u32 shift = 8 * (3 - (pos & 0x3));
+                /* if process is 32-bit, clear upper 32 bits of EA */
+                if ((regs->msr & MSR_64BIT) == 0)
+                        EA &= 0xFFFFFFFF;
                switch ((instword & PPC_INST_STRING_MASK)) {
                        case PPC_INST_LSWX:
                        case PPC_INST_LSWI:
@@ -1125,7 +1129,17 @@ void __kprobes program_check_exception(struct pt_regs *regs)
         * ESR_DST (!?) or 0.  In the process of chasing this with the
         * hardware people - not sure if it can happen on any illegal
         * instruction or only on FP instructions, whether there is a
-         * pattern to occurrences etc. -dgibson 31/Mar/2003 */
+         * pattern to occurrences etc. -dgibson 31/Mar/2003
+         */
+        /*
+         * If we support a HW FPU, we need to ensure the FP state
+         * if flushed into the thread_struct before attempting
+         * emulation
+         */
+#ifdef CONFIG_PPC_FPU
+        flush_fp_to_thread(current);
+#endif
        switch (do_mathemu(regs)) {
        case 0:
                emulate_single_step(regs);
@@ -1282,25 +1296,50 @@ void vsx_unavailable_exception(struct pt_regs *regs)
        die("Unrecoverable VSX Unavailable Exception", regs, SIGABRT);
 }
-void tm_unavailable_exception(struct pt_regs *regs)
+void facility_unavailable_exception(struct pt_regs *regs)
 {
+        static char *facility_strings[] = {
+                "FPU",
+                "VMX/VSX",
+                "DSCR",
+                "PMU SPRs",
+                "BHRB",
+                "TM",
+                "AT",
+                "EBB",
+                "TAR",
+        };
+        char *facility, *prefix;
+        u64 value;
+        if (regs->trap == 0xf60) {
+                value = mfspr(SPRN_FSCR);
+                prefix = "";
+        } else {
+                value = mfspr(SPRN_HFSCR);
+                prefix = "Hypervisor ";
+        }
+        value = value >> 56;
        /* We restore the interrupt state now */
        if (!arch_irq_disabled_regs(regs))
                local_irq_enable();
-        /* Currently we never expect a TMU exception.  Catch
+        if (value < ARRAY_SIZE(facility_strings))
-         * this and kill the process!
+                facility = facility_strings[value];
-         */
+        else
-        printk(KERN_EMERG "Unexpected TM unavailable exception at %lx "
+                facility = "unknown";
-               "(msr %lx)\n",
-               regs->nip, regs->msr);
+        pr_err("%sFacility '%s' unavailable, exception at 0x%lx, MSR=%lx\n",
+                prefix, facility, regs->nip, regs->msr);
        if (user_mode(regs)) {
                _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
                return;
        }
-        die("Unexpected TM unavailable exception", regs, SIGABRT);
+        die("Unexpected facility unavailable exception", regs, SIGABRT);
 }
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
@@ -1396,8 +1435,7 @@ void performance_monitor_exception(struct pt_regs *regs)
 void SoftwareEmulation(struct pt_regs *regs)
 {
        extern int do_mathemu(struct pt_regs *);
-        extern int Soft_emulate_8xx(struct pt_regs *);
+#if defined(CONFIG_MATH_EMULATION)
-#if defined(CONFIG_MATH_EMULATION) || defined(CONFIG_8XX_MINIMAL_FPEMU)
        int errcode;
 #endif
@@ -1430,23 +1468,6 @@ void SoftwareEmulation(struct pt_regs *regs)
                _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
                return;
        }
-#elif defined(CONFIG_8XX_MINIMAL_FPEMU)
-        errcode = Soft_emulate_8xx(regs);
-        if (errcode >= 0)
-                PPC_WARN_EMULATED(8xx, regs);
-        switch (errcode) {
-        case 0:
-                emulate_single_step(regs);
-                return;
-        case 1:
-                _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
-                return;
-        case -EFAULT:
-                _exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
-                return;
-        }
 #else
        _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
 #endif
@@ -1796,8 +1817,6 @@ struct ppc_emulated ppc_emulated = {
        WARN_EMULATED_SETUP(unaligned),
 #ifdef CONFIG_MATH_EMULATION
        WARN_EMULATED_SETUP(math),
-#elif defined(CONFIG_8XX_MINIMAL_FPEMU)
-        WARN_EMULATED_SETUP(8xx),
 #endif
 #ifdef CONFIG_VSX
        WARN_EMULATED_SETUP(vsx),
diff --git a/arch/powerpc/kernel/udbg.c b/arch/powerpc/kernel/udbg.c
index 9d3fdcd66290..a15837519dca 100644
--- a/arch/powerpc/kernel/udbg.c
+++ b/arch/powerpc/kernel/udbg.c
@@ -50,7 +50,7 @@ void __init udbg_early_init(void)
        udbg_init_debug_beat();
 #elif defined(CONFIG_PPC_EARLY_DEBUG_PAS_REALMODE)
        udbg_init_pas_realmode();
-#elif defined(CONFIG_BOOTX_TEXT)
+#elif defined(CONFIG_PPC_EARLY_DEBUG_BOOTX)
        udbg_init_btext();
 #elif defined(CONFIG_PPC_EARLY_DEBUG_44x)
        /* PPC44x debug */
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index d4f463ac65b1..1d9c92621b36 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -711,7 +711,7 @@ static void __init vdso_setup_syscall_map(void)
 }
 #ifdef CONFIG_PPC64
-int __cpuinit vdso_getcpu_init(void)
+int vdso_getcpu_init(void)
 {
        unsigned long cpu, node, val;
diff --git a/arch/powerpc/kvm/book3s_64_mmu_host.c b/arch/powerpc/kvm/book3s_64_mmu_host.c
index b350d9494b26..e5240524bf6c 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_host.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_host.c
@@ -34,7 +34,7 @@
 void kvmppc_mmu_invalidate_pte(struct kvm_vcpu *vcpu, struct hpte_cache *pte)
 {
        ppc_md.hpte_invalidate(pte->slot, pte->host_vpn,
-                               MMU_PAGE_4K, MMU_SEGSIZE_256M,
+                               MMU_PAGE_4K, MMU_PAGE_4K, MMU_SEGSIZE_256M,
                               false);
 }
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 5880dfb31074..710d31317d81 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -675,6 +675,7 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                }
                /* if the guest wants write access, see if that is OK */
                if (!writing && hpte_is_writable(r)) {
+                        unsigned int hugepage_shift;
                        pte_t *ptep, pte;
                        /*
@@ -683,9 +684,10 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         */
                        rcu_read_lock_sched();
                        ptep = find_linux_pte_or_hugepte(current->mm->pgd,
-                                                         hva, NULL);
+                                                         hva, &hugepage_shift);
-                        if (ptep && pte_present(*ptep)) {
+                        if (ptep) {
-                                pte = kvmppc_read_update_linux_pte(ptep, 1);
+                                pte = kvmppc_read_update_linux_pte(ptep, 1,
+                                                           hugepage_shift);
                                if (pte_write(pte))
                                        write_ok = 1;
                        }
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 6dcbb49105a4..fc25689a9f35 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -27,7 +27,7 @@ static void *real_vmalloc_addr(void *x)
        unsigned long addr = (unsigned long) x;
        pte_t *p;
-        p = find_linux_pte(swapper_pg_dir, addr);
+        p = find_linux_pte_or_hugepte(swapper_pg_dir, addr, NULL);
        if (!p || !pte_present(*p))
                return NULL;
        /* assume we don't have huge pages in vmalloc space... */
@@ -139,20 +139,18 @@ static pte_t lookup_linux_pte(pgd_t *pgdir, unsigned long hva,
 {
        pte_t *ptep;
        unsigned long ps = *pte_sizep;
-        unsigned int shift;
+        unsigned int hugepage_shift;
-        ptep = find_linux_pte_or_hugepte(pgdir, hva, &shift);
+        ptep = find_linux_pte_or_hugepte(pgdir, hva, &hugepage_shift);
        if (!ptep)
                return __pte(0);
-        if (shift)
+        if (hugepage_shift)
-                *pte_sizep = 1ul << shift;
+                *pte_sizep = 1ul << hugepage_shift;
        else
                *pte_sizep = PAGE_SIZE;
        if (ps > *pte_sizep)
                return __pte(0);
-        if (!pte_present(*ptep))
+        return kvmppc_read_update_linux_pte(ptep, writing, hugepage_shift);
-                return __pte(0);
-        return kvmppc_read_update_linux_pte(ptep, writing);
 }
 static inline void unlock_hpte(unsigned long *hpte, unsigned long hpte_v)
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index e15c521846ca..99c7fc16dc0d 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -580,7 +580,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                if (instr & 1)
                        regs->link = regs->nip;
                if (branch_taken(instr, regs))
-                        regs->nip = imm;
+                        regs->nip = truncate_if_32bit(regs->msr, imm);
                return 1;
 #ifdef CONFIG_PPC64
        case 17:        /* sc */
diff --git a/arch/powerpc/math-emu/Makefile b/arch/powerpc/math-emu/Makefile
index 7d1dba0d57f9..8d035d2d42a6 100644
--- a/arch/powerpc/math-emu/Makefile
+++ b/arch/powerpc/math-emu/Makefile
@@ -4,7 +4,8 @@ obj-$(CONFIG_MATH_EMULATION)	+= fabs.o fadd.o fadds.o fcmpo.o fcmpu.o \
                                        fmadd.o fmadds.o fmsub.o fmsubs.o \
                                        fmul.o fmuls.o fnabs.o fneg.o \
                                        fnmadd.o fnmadds.o fnmsub.o fnmsubs.o \
-                                        fres.o frsp.o frsqrte.o fsel.o lfs.o \
+                                        fres.o fre.o frsp.o fsel.o lfs.o \
+                                        frsqrte.o frsqrtes.o \
                                        fsqrt.o fsqrts.o fsub.o fsubs.o \
                                        mcrfs.o mffs.o mtfsb0.o mtfsb1.o \
                                        mtfsf.o mtfsfi.o stfiwx.o stfs.o \
diff --git a/arch/powerpc/math-emu/fre.c b/arch/powerpc/math-emu/fre.c
new file mode 100644
index 000000000000..49ccf2cc6a5a
--- /dev/null
+++ b/arch/powerpc/math-emu/fre.c
@@ -0,0 +1,11 @@
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <asm/uaccess.h>
+int fre(void *frD, void *frB)
+{
+#ifdef DEBUG
+        printk("%s: %p %p\n", __func__, frD, frB);
+#endif
+        return -ENOSYS;
+}
diff --git a/arch/powerpc/math-emu/frsqrtes.c b/arch/powerpc/math-emu/frsqrtes.c
new file mode 100644
index 000000000000..7e838e380314
--- /dev/null
+++ b/arch/powerpc/math-emu/frsqrtes.c
@@ -0,0 +1,11 @@
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <asm/uaccess.h>
+int frsqrtes(void *frD, void *frB)
+{
+#ifdef DEBUG
+        printk("%s: %p %p\n", __func__, frD, frB);
+#endif
+        return 0;
+}
diff --git a/arch/powerpc/math-emu/math.c b/arch/powerpc/math-emu/math.c
index 164d55935bd8..0328e66e0799 100644
--- a/arch/powerpc/math-emu/math.c
+++ b/arch/powerpc/math-emu/math.c
@@ -58,8 +58,10 @@ FLOATFUNC(fnabs);
 FLOATFUNC(fneg);
 /* Optional */
+FLOATFUNC(fre);
 FLOATFUNC(fres);
 FLOATFUNC(frsqrte);
+FLOATFUNC(frsqrtes);
 FLOATFUNC(fsel);
 FLOATFUNC(fsqrt);
 FLOATFUNC(fsqrts);
@@ -97,6 +99,7 @@ FLOATFUNC(fsqrts);
 #define FSQRTS          0x016           /*   22 */
 #define FRES            0x018           /*   24 */
 #define FMULS           0x019           /*   25 */
+#define FRSQRTES        0x01a           /*   26 */
 #define FMSUBS          0x01c           /*   28 */
 #define FMADDS          0x01d           /*   29 */
 #define FNMSUBS         0x01e           /*   30 */
@@ -109,6 +112,7 @@ FLOATFUNC(fsqrts);
 #define FADD            0x015           /*   21 */
 #define FSQRT           0x016           /*   22 */
 #define FSEL            0x017           /*   23 */
+#define FRE             0x018           /*   24 */
 #define FMUL            0x019           /*   25 */
 #define FRSQRTE         0x01a           /*   26 */
 #define FMSUB           0x01c           /*   28 */
@@ -299,9 +303,10 @@ do_mathemu(struct pt_regs *regs)
                case FDIVS:     func = fdivs;   type = AB;      break;
                case FSUBS:     func = fsubs;   type = AB;      break;
                case FADDS:     func = fadds;   type = AB;      break;
-                case FSQRTS:    func = fsqrts;  type = AB;      break;
+                case FSQRTS:    func = fsqrts;  type = XB;      break;
-                case FRES:      func = fres;    type = AB;      break;
+                case FRES:      func = fres;    type = XB;      break;
                case FMULS:     func = fmuls;   type = AC;      break;
+                case FRSQRTES:  func = frsqrtes;type = XB;      break;
                case FMSUBS:    func = fmsubs;  type = ABC;     break;
                case FMADDS:    func = fmadds;  type = ABC;     break;
                case FNMSUBS:   func = fnmsubs; type = ABC;     break;
@@ -317,10 +322,11 @@ do_mathemu(struct pt_regs *regs)
                        case FDIV:      func = fdiv;    type = AB;      break;
                        case FSUB:      func = fsub;    type = AB;      break;
                        case FADD:      func = fadd;    type = AB;      break;
-                        case FSQRT:     func = fsqrt;   type = AB;      break;
+                        case FSQRT:     func = fsqrt;   type = XB;      break;
+                        case FRE:       func = fre;     type = XB;      break;
                        case FSEL:      func = fsel;    type = ABC;     break;
                        case FMUL:      func = fmul;    type = AC;      break;
-                        case FRSQRTE:   func = frsqrte; type = AB;      break;
+                        case FRSQRTE:   func = frsqrte; type = XB;      break;
                        case FMSUB:     func = fmsub;   type = ABC;     break;
                        case FMADD:     func = fmadd;   type = ABC;     break;
                        case FNMSUB:    func = fnmsub;  type = ABC;     break;
diff --git a/arch/powerpc/mm/44x_mmu.c b/arch/powerpc/mm/44x_mmu.c
index 2c9441ee6bb8..82b1ff759e26 100644
--- a/arch/powerpc/mm/44x_mmu.c
+++ b/arch/powerpc/mm/44x_mmu.c
@@ -41,7 +41,7 @@ int icache_44x_need_flush;
 unsigned long tlb_47x_boltmap[1024/8];
-static void __cpuinit ppc44x_update_tlb_hwater(void)
+static void ppc44x_update_tlb_hwater(void)
 {
        extern unsigned int tlb_44x_patch_hwater_D[];
        extern unsigned int tlb_44x_patch_hwater_I[];
@@ -134,7 +134,7 @@ static void __init ppc47x_update_boltmap(void)
 /*
 * "Pins" a 256MB TLB entry in AS0 for kernel lowmem for 47x type MMU
 */
-static void __cpuinit ppc47x_pin_tlb(unsigned int virt, unsigned int phys)
+static void ppc47x_pin_tlb(unsigned int virt, unsigned int phys)
 {
        unsigned int rA;
        int bolted;
@@ -229,7 +229,7 @@ void setup_initial_memory_limit(phys_addr_t first_memblock_base,
 }
 #ifdef CONFIG_SMP
-void __cpuinit mmu_init_secondary(int cpu)
+void mmu_init_secondary(int cpu)
 {
        unsigned long addr;
        unsigned long memstart = memstart_addr & ~(PPC_PIN_SIZE - 1);
diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
index cf16b5733eaa..51230ee6a407 100644
--- a/arch/powerpc/mm/Makefile
+++ b/arch/powerpc/mm/Makefile
@@ -6,17 +6,16 @@ subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
 ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC)
-obj-y                           := fault.o mem.o pgtable.o gup.o \
+obj-y                           := fault.o mem.o pgtable.o gup.o mmap.o \
                                   init_$(CONFIG_WORD_SIZE).o \
                                   pgtable_$(CONFIG_WORD_SIZE).o
 obj-$(CONFIG_PPC_MMU_NOHASH)    += mmu_context_nohash.o tlb_nohash.o \
                                   tlb_nohash_low.o
 obj-$(CONFIG_PPC_BOOK3E)        += tlb_low_$(CONFIG_WORD_SIZE)e.o
-obj-$(CONFIG_PPC64)             += mmap_64.o
 hash64-$(CONFIG_PPC_NATIVE)     := hash_native_64.o
 obj-$(CONFIG_PPC_STD_MMU_64)    += hash_utils_64.o \
                                   slb_low.o slb.o stab.o \
-                                   mmap_64.o $(hash64-y)
+                                   $(hash64-y)
 obj-$(CONFIG_PPC_STD_MMU_32)    += ppc_mmu_32.o
 obj-$(CONFIG_PPC_STD_MMU)       += hash_low_$(CONFIG_WORD_SIZE).o \
                                   tlb_hash$(CONFIG_WORD_SIZE).o \
@@ -28,11 +27,12 @@ obj-$(CONFIG_44x)		+= 44x_mmu.o
 obj-$(CONFIG_PPC_FSL_BOOK3E)    += fsl_booke_mmu.o
 obj-$(CONFIG_NEED_MULTIPLE_NODES) += numa.o
 obj-$(CONFIG_PPC_MM_SLICES)     += slice.o
-ifeq ($(CONFIG_HUGETLB_PAGE),y)
 obj-y                           += hugetlbpage.o
+ifeq ($(CONFIG_HUGETLB_PAGE),y)
 obj-$(CONFIG_PPC_STD_MMU_64)    += hugetlbpage-hash64.o
 obj-$(CONFIG_PPC_BOOK3E_MMU)    += hugetlbpage-book3e.o
 endif
+obj-$(CONFIG_TRANSPARENT_HUGEPAGE) += hugepage-hash64.o
 obj-$(CONFIG_PPC_SUBPAGE_PROT)  += subpage-prot.o
 obj-$(CONFIG_NOT_COHERENT_CACHE) += dma-noncoherent.o
 obj-$(CONFIG_HIGHMEM)           += highmem.o
diff --git a/arch/powerpc/mm/gup.c b/arch/powerpc/mm/gup.c
index 4b921affa495..49822d90ea96 100644
--- a/arch/powerpc/mm/gup.c
+++ b/arch/powerpc/mm/gup.c
@@ -34,7 +34,7 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
        ptep = pte_offset_kernel(&pmd, addr);
        do {
-                pte_t pte = *ptep;
+                pte_t pte = ACCESS_ONCE(*ptep);
                struct page *page;
                if ((pte_val(pte) & mask) != result)
@@ -63,12 +63,18 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
        pmdp = pmd_offset(&pud, addr);
        do {
-                pmd_t pmd = *pmdp;
+                pmd_t pmd = ACCESS_ONCE(*pmdp);
                next = pmd_addr_end(addr, end);
-                if (pmd_none(pmd))
+                /*
+                 * If we find a splitting transparent hugepage we
+                 * return zero. That will result in taking the slow
+                 * path which will call wait_split_huge_page()
+                 * if the pmd is still in splitting state
+                 */
+                if (pmd_none(pmd) || pmd_trans_splitting(pmd))
                        return 0;
-                if (pmd_huge(pmd)) {
+                if (pmd_huge(pmd) || pmd_large(pmd)) {
                        if (!gup_hugepte((pte_t *)pmdp, PMD_SIZE, addr, next,
                                         write, pages, nr))
                                return 0;
@@ -91,7 +97,7 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
        pudp = pud_offset(&pgd, addr);
        do {
-                pud_t pud = *pudp;
+                pud_t pud = ACCESS_ONCE(*pudp);
                next = pud_addr_end(addr, end);
                if (pud_none(pud))
@@ -154,7 +160,7 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
        pgdp = pgd_offset(mm, addr);
        do {
-                pgd_t pgd = *pgdp;
+                pgd_t pgd = ACCESS_ONCE(*pgdp);
                pr_devel("  %016lx: normal pgd %p\n", addr,
                         (void *)pgd_val(pgd));
diff --git a/arch/powerpc/mm/hash_low_64.S b/arch/powerpc/mm/hash_low_64.S
index 0e980acae67c..d3cbda62857b 100644
--- a/arch/powerpc/mm/hash_low_64.S
+++ b/arch/powerpc/mm/hash_low_64.S
@@ -289,9 +289,10 @@ htab_modify_pte:
        /* Call ppc_md.hpte_updatepp */
        mr      r5,r29                  /* vpn */
-        li      r6,MMU_PAGE_4K          /* page size */
+        li      r6,MMU_PAGE_4K          /* base page size */
-        ld      r7,STK_PARAM(R9)(r1)    /* segment size */
+        li      r7,MMU_PAGE_4K          /* actual page size */
-        ld      r8,STK_PARAM(R8)(r1)    /* get "local" param */
+        ld      r8,STK_PARAM(R9)(r1)    /* segment size */
+        ld      r9,STK_PARAM(R8)(r1)    /* get "local" param */
 _GLOBAL(htab_call_hpte_updatepp)
        bl      .                       /* Patched by htab_finish_init() */
@@ -649,9 +650,10 @@ htab_modify_pte:
        /* Call ppc_md.hpte_updatepp */
        mr      r5,r29                  /* vpn */
-        li      r6,MMU_PAGE_4K          /* page size */
+        li      r6,MMU_PAGE_4K          /* base page size */
-        ld      r7,STK_PARAM(R9)(r1)    /* segment size */
+        li      r7,MMU_PAGE_4K          /* actual page size */
-        ld      r8,STK_PARAM(R8)(r1)    /* get "local" param */
+        ld      r8,STK_PARAM(R9)(r1)    /* segment size */
+        ld      r9,STK_PARAM(R8)(r1)    /* get "local" param */
 _GLOBAL(htab_call_hpte_updatepp)
        bl      .                       /* patched by htab_finish_init() */
@@ -937,9 +939,10 @@ ht64_modify_pte:
        /* Call ppc_md.hpte_updatepp */
        mr      r5,r29                  /* vpn */
-        li      r6,MMU_PAGE_64K
+        li      r6,MMU_PAGE_64K         /* base page size */
-        ld      r7,STK_PARAM(R9)(r1)    /* segment size */
+        li      r7,MMU_PAGE_64K         /* actual page size */
-        ld      r8,STK_PARAM(R8)(r1)    /* get "local" param */
+        ld      r8,STK_PARAM(R9)(r1)    /* segment size */
+        ld      r9,STK_PARAM(R8)(r1)    /* get "local" param */
 _GLOBAL(ht64_call_hpte_updatepp)
        bl      .                       /* patched by htab_finish_init() */
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index 4c122c3f1623..3f0c30ae4791 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -273,61 +273,15 @@ static long native_hpte_remove(unsigned long hpte_group)
        return i;
 }
-static inline int __hpte_actual_psize(unsigned int lp, int psize)
-{
-        int i, shift;
-        unsigned int mask;
-        /* start from 1 ignoring MMU_PAGE_4K */
-        for (i = 1; i < MMU_PAGE_COUNT; i++) {
-                /* invalid penc */
-                if (mmu_psize_defs[psize].penc[i] == -1)
-                        continue;
-                /*
-                 * encoding bits per actual page size
-                 *        PTE LP     actual page size
-                 *    rrrr rrrz         >=8KB
-                 *    rrrr rrzz         >=16KB
-                 *    rrrr rzzz         >=32KB
-                 *    rrrr zzzz         >=64KB
-                 * .......
-                 */
-                shift = mmu_psize_defs[i].shift - LP_SHIFT;
-                if (shift > LP_BITS)
-                        shift = LP_BITS;
-                mask = (1 << shift) - 1;
-                if ((lp & mask) == mmu_psize_defs[psize].penc[i])
-                        return i;
-        }
-        return -1;
-}
-static inline int hpte_actual_psize(struct hash_pte *hptep, int psize)
-{
-        /* Look at the 8 bit LP value */
-        unsigned int lp = (hptep->r >> LP_SHIFT) & ((1 << LP_BITS) - 1);
-        if (!(hptep->v & HPTE_V_VALID))
-                return -1;
-        /* First check if it is large page */
-        if (!(hptep->v & HPTE_V_LARGE))
-                return MMU_PAGE_4K;
-        return __hpte_actual_psize(lp, psize);
-}
 static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
-                                 unsigned long vpn, int psize, int ssize,
+                                 unsigned long vpn, int bpsize,
-                                 int local)
+                                 int apsize, int ssize, int local)
 {
        struct hash_pte *hptep = htab_address + slot;
        unsigned long hpte_v, want_v;
        int ret = 0;
-        int actual_psize;
-        want_v = hpte_encode_avpn(vpn, psize, ssize);
+        want_v = hpte_encode_avpn(vpn, bpsize, ssize);
        DBG_LOW("    update(vpn=%016lx, avpnv=%016lx, group=%lx, newpp=%lx)",
                vpn, want_v & HPTE_V_AVPN, slot, newpp);
@@ -335,7 +289,6 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
        native_lock_hpte(hptep);
        hpte_v = hptep->v;
-        actual_psize = hpte_actual_psize(hptep, psize);
        /*
         * We need to invalidate the TLB always because hpte_remove doesn't do
         * a tlb invalidate. If a hash bucket gets full, we "evict" a more/less
@@ -343,12 +296,7 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
         * (hpte_remove) because we assume the old translation is still
         * technically "valid".
         */
-        if (actual_psize < 0) {
+        if (!HPTE_V_COMPARE(hpte_v, want_v) || !(hpte_v & HPTE_V_VALID)) {
-                actual_psize = psize;
-                ret = -1;
-                goto err_out;
-        }
-        if (!HPTE_V_COMPARE(hpte_v, want_v)) {
                DBG_LOW(" -> miss\n");
                ret = -1;
        } else {
@@ -357,11 +305,10 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
                hptep->r = (hptep->r & ~(HPTE_R_PP | HPTE_R_N)) |
                        (newpp & (HPTE_R_PP | HPTE_R_N | HPTE_R_C));
        }
-err_out:
        native_unlock_hpte(hptep);
        /* Ensure it is out of the tlb too. */
-        tlbie(vpn, psize, actual_psize, ssize, local);
+        tlbie(vpn, bpsize, apsize, ssize, local);
        return ret;
 }
@@ -402,7 +349,6 @@ static long native_hpte_find(unsigned long vpn, int psize, int ssize)
 static void native_hpte_updateboltedpp(unsigned long newpp, unsigned long ea,
                                       int psize, int ssize)
 {
-        int actual_psize;
        unsigned long vpn;
        unsigned long vsid;
        long slot;
@@ -415,36 +361,33 @@ static void native_hpte_updateboltedpp(unsigned long newpp, unsigned long ea,
        if (slot == -1)
                panic("could not find page to bolt\n");
        hptep = htab_address + slot;
-        actual_psize = hpte_actual_psize(hptep, psize);
-        if (actual_psize < 0)
-                actual_psize = psize;
        /* Update the HPTE */
        hptep->r = (hptep->r & ~(HPTE_R_PP | HPTE_R_N)) |
                (newpp & (HPTE_R_PP | HPTE_R_N));
+        /*
-        /* Ensure it is out of the tlb too. */
+         * Ensure it is out of the tlb too. Bolted entries base and
-        tlbie(vpn, psize, actual_psize, ssize, 0);
+         * actual page size will be same.
+         */
+        tlbie(vpn, psize, psize, ssize, 0);
 }
 static void native_hpte_invalidate(unsigned long slot, unsigned long vpn,
-                                   int psize, int ssize, int local)
+                                   int bpsize, int apsize, int ssize, int local)
 {
        struct hash_pte *hptep = htab_address + slot;
        unsigned long hpte_v;
        unsigned long want_v;
        unsigned long flags;
-        int actual_psize;
        local_irq_save(flags);
        DBG_LOW("    invalidate(vpn=%016lx, hash: %lx)\n", vpn, slot);
-        want_v = hpte_encode_avpn(vpn, psize, ssize);
+        want_v = hpte_encode_avpn(vpn, bpsize, ssize);
        native_lock_hpte(hptep);
        hpte_v = hptep->v;
-        actual_psize = hpte_actual_psize(hptep, psize);
        /*
         * We need to invalidate the TLB always because hpte_remove doesn't do
         * a tlb invalidate. If a hash bucket gets full, we "evict" a more/less
@@ -452,23 +395,120 @@ static void native_hpte_invalidate(unsigned long slot, unsigned long vpn,
         * (hpte_remove) because we assume the old translation is still
         * technically "valid".
         */
-        if (actual_psize < 0) {
+        if (!HPTE_V_COMPARE(hpte_v, want_v) || !(hpte_v & HPTE_V_VALID))
-                actual_psize = psize;
-                native_unlock_hpte(hptep);
-                goto err_out;
-        }
-        if (!HPTE_V_COMPARE(hpte_v, want_v))
                native_unlock_hpte(hptep);
        else
                /* Invalidate the hpte. NOTE: this also unlocks it */
                hptep->v = 0;
-err_out:
        /* Invalidate the TLB */
-        tlbie(vpn, psize, actual_psize, ssize, local);
+        tlbie(vpn, bpsize, apsize, ssize, local);
+        local_irq_restore(flags);
+}
+static void native_hugepage_invalidate(struct mm_struct *mm,
+                                       unsigned char *hpte_slot_array,
+                                       unsigned long addr, int psize)
+{
+        int ssize = 0, i;
+        int lock_tlbie;
+        struct hash_pte *hptep;
+        int actual_psize = MMU_PAGE_16M;
+        unsigned int max_hpte_count, valid;
+        unsigned long flags, s_addr = addr;
+        unsigned long hpte_v, want_v, shift;
+        unsigned long hidx, vpn = 0, vsid, hash, slot;
+        shift = mmu_psize_defs[psize].shift;
+        max_hpte_count = 1U << (PMD_SHIFT - shift);
+        local_irq_save(flags);
+        for (i = 0; i < max_hpte_count; i++) {
+                valid = hpte_valid(hpte_slot_array, i);
+                if (!valid)
+                        continue;
+                hidx =  hpte_hash_index(hpte_slot_array, i);
+                /* get the vpn */
+                addr = s_addr + (i * (1ul << shift));
+                if (!is_kernel_addr(addr)) {
+                        ssize = user_segment_size(addr);
+                        vsid = get_vsid(mm->context.id, addr, ssize);
+                        WARN_ON(vsid == 0);
+                } else {
+                        vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
+                        ssize = mmu_kernel_ssize;
+                }
+                vpn = hpt_vpn(addr, vsid, ssize);
+                hash = hpt_hash(vpn, shift, ssize);
+                if (hidx & _PTEIDX_SECONDARY)
+                        hash = ~hash;
+                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+                slot += hidx & _PTEIDX_GROUP_IX;
+                hptep = htab_address + slot;
+                want_v = hpte_encode_avpn(vpn, psize, ssize);
+                native_lock_hpte(hptep);
+                hpte_v = hptep->v;
+                /* Even if we miss, we need to invalidate the TLB */
+                if (!HPTE_V_COMPARE(hpte_v, want_v) || !(hpte_v & HPTE_V_VALID))
+                        native_unlock_hpte(hptep);
+                else
+                        /* Invalidate the hpte. NOTE: this also unlocks it */
+                        hptep->v = 0;
+        }
+        /*
+         * Since this is a hugepage, we just need a single tlbie.
+         * use the last vpn.
+         */
+        lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
+        if (lock_tlbie)
+                raw_spin_lock(&native_tlbie_lock);
+        asm volatile("ptesync":::"memory");
+        __tlbie(vpn, psize, actual_psize, ssize);
+        asm volatile("eieio; tlbsync; ptesync":::"memory");
+        if (lock_tlbie)
+                raw_spin_unlock(&native_tlbie_lock);
        local_irq_restore(flags);
 }
+static inline int __hpte_actual_psize(unsigned int lp, int psize)
+{
+        int i, shift;
+        unsigned int mask;
+        /* start from 1 ignoring MMU_PAGE_4K */
+        for (i = 1; i < MMU_PAGE_COUNT; i++) {
+                /* invalid penc */
+                if (mmu_psize_defs[psize].penc[i] == -1)
+                        continue;
+                /*
+                 * encoding bits per actual page size
+                 *        PTE LP     actual page size
+                 *    rrrr rrrz         >=8KB
+                 *    rrrr rrzz         >=16KB
+                 *    rrrr rzzz         >=32KB
+                 *    rrrr zzzz         >=64KB
+                 * .......
+                 */
+                shift = mmu_psize_defs[i].shift - LP_SHIFT;
+                if (shift > LP_BITS)
+                        shift = LP_BITS;
+                mask = (1 << shift) - 1;
+                if ((lp & mask) == mmu_psize_defs[psize].penc[i])
+                        return i;
+        }
+        return -1;
+}
 static void hpte_decode(struct hash_pte *hpte, unsigned long slot,
                        int *psize, int *apsize, int *ssize, unsigned long *vpn)
 {
@@ -672,4 +712,5 @@ void __init hpte_init_native(void)
        ppc_md.hpte_remove      = native_hpte_remove;
        ppc_md.hpte_clear_all   = native_hpte_clear;
        ppc_md.flush_hash_range = native_flush_hash_range;
+        ppc_md.hugepage_invalidate   = native_hugepage_invalidate;
 }
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index e303a6d74e3a..6ecc38bd5b24 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -807,7 +807,7 @@ void __init early_init_mmu(void)
 }
 #ifdef CONFIG_SMP
-void __cpuinit early_init_mmu_secondary(void)
+void early_init_mmu_secondary(void)
 {
        /* Initialize hash table for that CPU */
        if (!firmware_has_feature(FW_FEATURE_LPAR))
@@ -1050,13 +1050,26 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                goto bail;
        }
-#ifdef CONFIG_HUGETLB_PAGE
        if (hugeshift) {
-                rc = __hash_page_huge(ea, access, vsid, ptep, trap, local,
+                if (pmd_trans_huge(*(pmd_t *)ptep))
-                                        ssize, hugeshift, psize);
+                        rc = __hash_page_thp(ea, access, vsid, (pmd_t *)ptep,
+                                             trap, local, ssize, psize);
+#ifdef CONFIG_HUGETLB_PAGE
+                else
+                        rc = __hash_page_huge(ea, access, vsid, ptep, trap,
+                                              local, ssize, hugeshift, psize);
+#else
+                else {
+                        /*
+                         * if we have hugeshift, and is not transhuge with
+                         * hugetlb disabled, something is really wrong.
+                         */
+                        rc = 1;
+                        WARN_ON(1);
+                }
+#endif
                goto bail;
        }
-#endif /* CONFIG_HUGETLB_PAGE */
 #ifndef CONFIG_PPC_64K_PAGES
        DBG_LOW(" i-pte: %016lx\n", pte_val(*ptep));
@@ -1145,6 +1158,7 @@ EXPORT_SYMBOL_GPL(hash_page);
 void hash_preload(struct mm_struct *mm, unsigned long ea,
                  unsigned long access, unsigned long trap)
 {
+        int hugepage_shift;
        unsigned long vsid;
        pgd_t *pgdir;
        pte_t *ptep;
@@ -1166,10 +1180,27 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
        pgdir = mm->pgd;
        if (pgdir == NULL)
                return;
-        ptep = find_linux_pte(pgdir, ea);
-        if (!ptep)
+        /* Get VSID */
+        ssize = user_segment_size(ea);
+        vsid = get_vsid(mm->context.id, ea, ssize);
+        if (!vsid)
                return;
+        /*
+         * Hash doesn't like irqs. Walking linux page table with irq disabled
+         * saves us from holding multiple locks.
+         */
+        local_irq_save(flags);
+        /*
+         * THP pages use update_mmu_cache_pmd. We don't do
+         * hash preload there. Hence can ignore THP here
+         */
+        ptep = find_linux_pte_or_hugepte(pgdir, ea, &hugepage_shift);
+        if (!ptep)
+                goto out_exit;
+        WARN_ON(hugepage_shift);
 #ifdef CONFIG_PPC_64K_PAGES
        /* If either _PAGE_4K_PFN or _PAGE_NO_CACHE is set (and we are on
         * a 64K kernel), then we don't preload, hash_page() will take
@@ -1178,18 +1209,9 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
         * page size demotion here
         */
        if (pte_val(*ptep) & (_PAGE_4K_PFN | _PAGE_NO_CACHE))
-                return;
+                goto out_exit;
 #endif /* CONFIG_PPC_64K_PAGES */
-        /* Get VSID */
-        ssize = user_segment_size(ea);
-        vsid = get_vsid(mm->context.id, ea, ssize);
-        if (!vsid)
-                return;
-        /* Hash doesn't like irqs */
-        local_irq_save(flags);
        /* Is that local to this CPU ? */
        if (cpumask_equal(mm_cpumask(mm), cpumask_of(smp_processor_id())))
                local = 1;
@@ -1211,7 +1233,7 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
                                   mm->context.user_psize,
                                   mm->context.user_psize,
                                   pte_val(*ptep));
+out_exit:
        local_irq_restore(flags);
 }
@@ -1232,7 +1254,11 @@ void flush_hash_page(unsigned long vpn, real_pte_t pte, int psize, int ssize,
                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
                slot += hidx & _PTEIDX_GROUP_IX;
                DBG_LOW(" sub %ld: hash=%lx, hidx=%lx\n", index, slot, hidx);
-                ppc_md.hpte_invalidate(slot, vpn, psize, ssize, local);
+                /*
+                 * We use same base page size and actual psize, because we don't
+                 * use these functions for hugepage
+                 */
+                ppc_md.hpte_invalidate(slot, vpn, psize, psize, ssize, local);
        } pte_iterate_hashed_end();
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
@@ -1365,7 +1391,8 @@ static void kernel_unmap_linear_page(unsigned long vaddr, unsigned long lmi)
                hash = ~hash;
        slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
        slot += hidx & _PTEIDX_GROUP_IX;
-        ppc_md.hpte_invalidate(slot, vpn, mmu_linear_psize, mmu_kernel_ssize, 0);
+        ppc_md.hpte_invalidate(slot, vpn, mmu_linear_psize, mmu_linear_psize,
+                               mmu_kernel_ssize, 0);
 }
 void kernel_map_pages(struct page *page, int numpages, int enable)
diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
new file mode 100644
index 000000000000..34de9e0cdc34
--- /dev/null
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -0,0 +1,175 @@
+/*
+ * Copyright IBM Corporation, 2013
+ * Author Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it would be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ */
+/*
+ * PPC64 THP Support for hash based MMUs
+ */
+#include <linux/mm.h>
+#include <asm/machdep.h>
+int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
+                    pmd_t *pmdp, unsigned long trap, int local, int ssize,
+                    unsigned int psize)
+{
+        unsigned int index, valid;
+        unsigned char *hpte_slot_array;
+        unsigned long rflags, pa, hidx;
+        unsigned long old_pmd, new_pmd;
+        int ret, lpsize = MMU_PAGE_16M;
+        unsigned long vpn, hash, shift, slot;
+        /*
+         * atomically mark the linux large page PMD busy and dirty
+         */
+        do {
+                old_pmd = pmd_val(*pmdp);
+                /* If PMD busy, retry the access */
+                if (unlikely(old_pmd & _PAGE_BUSY))
+                        return 0;
+                /* If PMD is trans splitting retry the access */
+                if (unlikely(old_pmd & _PAGE_SPLITTING))
+                        return 0;
+                /* If PMD permissions don't match, take page fault */
+                if (unlikely(access & ~old_pmd))
+                        return 1;
+                /*
+                 * Try to lock the PTE, add ACCESSED and DIRTY if it was
+                 * a write access
+                 */
+                new_pmd = old_pmd | _PAGE_BUSY | _PAGE_ACCESSED;
+                if (access & _PAGE_RW)
+                        new_pmd |= _PAGE_DIRTY;
+        } while (old_pmd != __cmpxchg_u64((unsigned long *)pmdp,
+                                          old_pmd, new_pmd));
+        /*
+         * PP bits. _PAGE_USER is already PP bit 0x2, so we only
+         * need to add in 0x1 if it's a read-only user page
+         */
+        rflags = new_pmd & _PAGE_USER;
+        if ((new_pmd & _PAGE_USER) && !((new_pmd & _PAGE_RW) &&
+                                           (new_pmd & _PAGE_DIRTY)))
+                rflags |= 0x1;
+        /*
+         * _PAGE_EXEC -> HW_NO_EXEC since it's inverted
+         */
+        rflags |= ((new_pmd & _PAGE_EXEC) ? 0 : HPTE_R_N);
+#if 0
+        if (!cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) {
+                /*
+                 * No CPU has hugepages but lacks no execute, so we
+                 * don't need to worry about that case
+                 */
+                rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
+        }
+#endif
+        /*
+         * Find the slot index details for this ea, using base page size.
+         */
+        shift = mmu_psize_defs[psize].shift;
+        index = (ea & ~HPAGE_PMD_MASK) >> shift;
+        BUG_ON(index >= 4096);
+        vpn = hpt_vpn(ea, vsid, ssize);
+        hash = hpt_hash(vpn, shift, ssize);
+        hpte_slot_array = get_hpte_slot_array(pmdp);
+        valid = hpte_valid(hpte_slot_array, index);
+        if (valid) {
+                /* update the hpte bits */
+                hidx =  hpte_hash_index(hpte_slot_array, index);
+                if (hidx & _PTEIDX_SECONDARY)
+                        hash = ~hash;
+                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+                slot += hidx & _PTEIDX_GROUP_IX;
+                ret = ppc_md.hpte_updatepp(slot, rflags, vpn,
+                                           psize, lpsize, ssize, local);
+                /*
+                 * We failed to update, try to insert a new entry.
+                 */
+                if (ret == -1) {
+                        /*
+                         * large pte is marked busy, so we can be sure
+                         * nobody is looking at hpte_slot_array. hence we can
+                         * safely update this here.
+                         */
+                        valid = 0;
+                        new_pmd &= ~_PAGE_HPTEFLAGS;
+                        hpte_slot_array[index] = 0;
+                } else
+                        /* clear the busy bits and set the hash pte bits */
+                        new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE;
+        }
+        if (!valid) {
+                unsigned long hpte_group;
+                /* insert new entry */
+                pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT;
+repeat:
+                hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL;
+                /* clear the busy bits and set the hash pte bits */
+                new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE;
+                /* Add in WIMG bits */
+                rflags |= (new_pmd & (_PAGE_WRITETHRU | _PAGE_NO_CACHE |
+                                      _PAGE_COHERENT | _PAGE_GUARDED));
+                /* Insert into the hash table, primary slot */
+                slot = ppc_md.hpte_insert(hpte_group, vpn, pa, rflags, 0,
+                                          psize, lpsize, ssize);
+                /*
+                 * Primary is full, try the secondary
+                 */
+                if (unlikely(slot == -1)) {
+                        hpte_group = ((~hash & htab_hash_mask) *
+                                      HPTES_PER_GROUP) & ~0x7UL;
+                        slot = ppc_md.hpte_insert(hpte_group, vpn, pa,
+                                                  rflags, HPTE_V_SECONDARY,
+                                                  psize, lpsize, ssize);
+                        if (slot == -1) {
+                                if (mftb() & 0x1)
+                                        hpte_group = ((hash & htab_hash_mask) *
+                                                      HPTES_PER_GROUP) & ~0x7UL;
+                                ppc_md.hpte_remove(hpte_group);
+                                goto repeat;
+                        }
+                }
+                /*
+                 * Hypervisor failure. Restore old pmd and return -1
+                 * similar to __hash_page_*
+                 */
+                if (unlikely(slot == -2)) {
+                        *pmdp = __pmd(old_pmd);
+                        hash_failure_debug(ea, access, vsid, trap, ssize,
+                                           psize, lpsize, old_pmd);
+                        return -1;
+                }
+                /*
+                 * large pte is marked busy, so we can be sure
+                 * nobody is looking at hpte_slot_array. hence we can
+                 * safely update this here.
+                 */
+                mark_hpte_slot_valid(hpte_slot_array, index, slot);
+        }
+        /*
+         * No need to use ldarx/stdcx here
+         */
+        *pmdp = __pmd(new_pmd & ~_PAGE_BUSY);
+        return 0;
+}
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index 0f1d94a1fb82..0b7fb6761015 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -81,7 +81,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                slot += (old_pte & _PAGE_F_GIX) >> 12;
                if (ppc_md.hpte_updatepp(slot, rflags, vpn, mmu_psize,
-                                         ssize, local) == -1)
+                                         mmu_psize, ssize, local) == -1)
                        old_pte &= ~_PAGE_HPTEFLAGS;
        }
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 4210549ac95e..834ca8eb38f2 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -21,6 +21,9 @@
 #include <asm/pgalloc.h>
 #include <asm/tlb.h>
 #include <asm/setup.h>
+#include <asm/hugetlb.h>
+#ifdef CONFIG_HUGETLB_PAGE
 #define PAGE_SHIFT_64K  16
 #define PAGE_SHIFT_16M  24
@@ -100,68 +103,9 @@ int pgd_huge(pgd_t pgd)
 }
 #endif
-/*
- * We have 4 cases for pgds and pmds:
- * (1) invalid (all zeroes)
- * (2) pointer to next table, as normal; bottom 6 bits == 0
- * (3) leaf pte for huge page, bottom two bits != 00
- * (4) hugepd pointer, bottom two bits == 00, next 4 bits indicate size of table
- */
-pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea, unsigned *shift)
-{
-        pgd_t *pg;
-        pud_t *pu;
-        pmd_t *pm;
-        pte_t *ret_pte;
-        hugepd_t *hpdp = NULL;
-        unsigned pdshift = PGDIR_SHIFT;
-        if (shift)
-                *shift = 0;
-        pg = pgdir + pgd_index(ea);
-        if (pgd_huge(*pg)) {
-                ret_pte = (pte_t *) pg;
-                goto out;
-        } else if (is_hugepd(pg))
-                hpdp = (hugepd_t *)pg;
-        else if (!pgd_none(*pg)) {
-                pdshift = PUD_SHIFT;
-                pu = pud_offset(pg, ea);
-                if (pud_huge(*pu)) {
-                        ret_pte = (pte_t *) pu;
-                        goto out;
-                } else if (is_hugepd(pu))
-                        hpdp = (hugepd_t *)pu;
-                else if (!pud_none(*pu)) {
-                        pdshift = PMD_SHIFT;
-                        pm = pmd_offset(pu, ea);
-                        if (pmd_huge(*pm)) {
-                                ret_pte = (pte_t *) pm;
-                                goto out;
-                        } else if (is_hugepd(pm))
-                                hpdp = (hugepd_t *)pm;
-                        else if (!pmd_none(*pm))
-                                return pte_offset_kernel(pm, ea);
-                }
-        }
-        if (!hpdp)
-                return NULL;
-        ret_pte = hugepte_offset(hpdp, ea, pdshift);
-        pdshift = hugepd_shift(*hpdp);
-out:
-        if (shift)
-                *shift = pdshift;
-        return ret_pte;
-}
-EXPORT_SYMBOL_GPL(find_linux_pte_or_hugepte);
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
+        /* Only called for hugetlbfs pages, hence can ignore THP */
        return find_linux_pte_or_hugepte(mm->pgd, addr, NULL);
 }
@@ -736,11 +680,14 @@ follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
        struct page *page;
        unsigned shift;
        unsigned long mask;
+        /*
+         * Transparent hugepages are handled by generic code. We can skip them
+         * here.
+         */
        ptep = find_linux_pte_or_hugepte(mm->pgd, address, &shift);
        /* Verify it is a huge page else bail. */
-        if (!ptep || !shift)
+        if (!ptep || !shift || pmd_trans_huge(*(pmd_t *)ptep))
                return ERR_PTR(-EINVAL);
        mask = (1UL << shift) - 1;
@@ -759,69 +706,6 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
        return NULL;
 }
-int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
-                unsigned long end, int write, struct page **pages, int *nr)
-{
-        unsigned long mask;
-        unsigned long pte_end;
-        struct page *head, *page, *tail;
-        pte_t pte;
-        int refs;
-        pte_end = (addr + sz) & ~(sz-1);
-        if (pte_end < end)
-                end = pte_end;
-        pte = *ptep;
-        mask = _PAGE_PRESENT | _PAGE_USER;
-        if (write)
-                mask |= _PAGE_RW;
-        if ((pte_val(pte) & mask) != mask)
-                return 0;
-        /* hugepages are never "special" */
-        VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
-        refs = 0;
-        head = pte_page(pte);
-        page = head + ((addr & (sz-1)) >> PAGE_SHIFT);
-        tail = page;
-        do {
-                VM_BUG_ON(compound_head(page) != head);
-                pages[*nr] = page;
-                (*nr)++;
-                page++;
-                refs++;
-        } while (addr += PAGE_SIZE, addr != end);
-        if (!page_cache_add_speculative(head, refs)) {
-                *nr -= refs;
-                return 0;
-        }
-        if (unlikely(pte_val(pte) != pte_val(*ptep))) {
-                /* Could be optimized better */
-                *nr -= refs;
-                while (refs--)
-                        put_page(head);
-                return 0;
-        }
-        /*
-         * Any tail page need their mapcount reference taken before we
-         * return.
-         */
-        while (refs--) {
-                if (PageTail(tail))
-                        get_huge_page_tail(tail);
-                tail++;
-        }
-        return 1;
-}
 static unsigned long hugepte_addr_end(unsigned long addr, unsigned long end,
                                      unsigned long sz)
 {
@@ -1038,3 +922,168 @@ void flush_dcache_icache_hugepage(struct page *page)
                }
        }
 }
+#endif /* CONFIG_HUGETLB_PAGE */
+/*
+ * We have 4 cases for pgds and pmds:
+ * (1) invalid (all zeroes)
+ * (2) pointer to next table, as normal; bottom 6 bits == 0
+ * (3) leaf pte for huge page, bottom two bits != 00
+ * (4) hugepd pointer, bottom two bits == 00, next 4 bits indicate size of table
+ *
+ * So long as we atomically load page table pointers we are safe against teardown,
+ * we can follow the address down to the the page and take a ref on it.
+ */
+pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea, unsigned *shift)
+{
+        pgd_t pgd, *pgdp;
+        pud_t pud, *pudp;
+        pmd_t pmd, *pmdp;
+        pte_t *ret_pte;
+        hugepd_t *hpdp = NULL;
+        unsigned pdshift = PGDIR_SHIFT;
+        if (shift)
+                *shift = 0;
+        pgdp = pgdir + pgd_index(ea);
+        pgd  = ACCESS_ONCE(*pgdp);
+        /*
+         * Always operate on the local stack value. This make sure the
+         * value don't get updated by a parallel THP split/collapse,
+         * page fault or a page unmap. The return pte_t * is still not
+         * stable. So should be checked there for above conditions.
+         */
+        if (pgd_none(pgd))
+                return NULL;
+        else if (pgd_huge(pgd)) {
+                ret_pte = (pte_t *) pgdp;
+                goto out;
+        } else if (is_hugepd(&pgd))
+                hpdp = (hugepd_t *)&pgd;
+        else {
+                /*
+                 * Even if we end up with an unmap, the pgtable will not
+                 * be freed, because we do an rcu free and here we are
+                 * irq disabled
+                 */
+                pdshift = PUD_SHIFT;
+                pudp = pud_offset(&pgd, ea);
+                pud  = ACCESS_ONCE(*pudp);
+                if (pud_none(pud))
+                        return NULL;
+                else if (pud_huge(pud)) {
+                        ret_pte = (pte_t *) pudp;
+                        goto out;
+                } else if (is_hugepd(&pud))
+                        hpdp = (hugepd_t *)&pud;
+                else {
+                        pdshift = PMD_SHIFT;
+                        pmdp = pmd_offset(&pud, ea);
+                        pmd  = ACCESS_ONCE(*pmdp);
+                        /*
+                         * A hugepage collapse is captured by pmd_none, because
+                         * it mark the pmd none and do a hpte invalidate.
+                         *
+                         * A hugepage split is captured by pmd_trans_splitting
+                         * because we mark the pmd trans splitting and do a
+                         * hpte invalidate
+                         *
+                         */
+                        if (pmd_none(pmd) || pmd_trans_splitting(pmd))
+                                return NULL;
+                        if (pmd_huge(pmd) || pmd_large(pmd)) {
+                                ret_pte = (pte_t *) pmdp;
+                                goto out;
+                        } else if (is_hugepd(&pmd))
+                                hpdp = (hugepd_t *)&pmd;
+                        else
+                                return pte_offset_kernel(&pmd, ea);
+                }
+        }
+        if (!hpdp)
+                return NULL;
+        ret_pte = hugepte_offset(hpdp, ea, pdshift);
+        pdshift = hugepd_shift(*hpdp);
+out:
+        if (shift)
+                *shift = pdshift;
+        return ret_pte;
+}
+EXPORT_SYMBOL_GPL(find_linux_pte_or_hugepte);
+int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        unsigned long mask;
+        unsigned long pte_end;
+        struct page *head, *page, *tail;
+        pte_t pte;
+        int refs;
+        pte_end = (addr + sz) & ~(sz-1);
+        if (pte_end < end)
+                end = pte_end;
+        pte = ACCESS_ONCE(*ptep);
+        mask = _PAGE_PRESENT | _PAGE_USER;
+        if (write)
+                mask |= _PAGE_RW;
+        if ((pte_val(pte) & mask) != mask)
+                return 0;
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        /*
+         * check for splitting here
+         */
+        if (pmd_trans_splitting(pte_pmd(pte)))
+                return 0;
+#endif
+        /* hugepages are never "special" */
+        VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+        refs = 0;
+        head = pte_page(pte);
+        page = head + ((addr & (sz-1)) >> PAGE_SHIFT);
+        tail = page;
+        do {
+                VM_BUG_ON(compound_head(page) != head);
+                pages[*nr] = page;
+                (*nr)++;
+                page++;
+                refs++;
+        } while (addr += PAGE_SIZE, addr != end);
+        if (!page_cache_add_speculative(head, refs)) {
+                *nr -= refs;
+                return 0;
+        }
+        if (unlikely(pte_val(pte) != pte_val(*ptep))) {
+                /* Could be optimized better */
+                *nr -= refs;
+                while (refs--)
+                        put_page(head);
+                return 0;
+        }
+        /*
+         * Any tail page need their mapcount reference taken before we
+         * return.
+         */
+        while (refs--) {
+                if (PageTail(tail))
+                        get_huge_page_tail(tail);
+                tail++;
+        }
+        return 1;
+}
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index a90b9c458990..d0cd9e4c6837 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -88,7 +88,11 @@ static void pgd_ctor(void *addr)
 static void pmd_ctor(void *addr)
 {
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        memset(addr, 0, PMD_TABLE_SIZE * 2);
+#else
        memset(addr, 0, PMD_TABLE_SIZE);
+#endif
 }
 struct kmem_cache *pgtable_cache[MAX_PGTABLE_INDEX_SIZE];
@@ -137,10 +141,9 @@ void pgtable_cache_add(unsigned shift, void (*ctor)(void *))
 void pgtable_cache_init(void)
 {
        pgtable_cache_add(PGD_INDEX_SIZE, pgd_ctor);
-        pgtable_cache_add(PMD_INDEX_SIZE, pmd_ctor);
+        pgtable_cache_add(PMD_CACHE_INDEX, pmd_ctor);
-        if (!PGT_CACHE(PGD_INDEX_SIZE) || !PGT_CACHE(PMD_INDEX_SIZE))
+        if (!PGT_CACHE(PGD_INDEX_SIZE) || !PGT_CACHE(PMD_CACHE_INDEX))
                panic("Couldn't allocate pgtable caches");
        /* In all current configs, when the PUD index exists it's the
         * same size as either the pgd or pmd index.  Verify that the
         * initialization above has also created a PUD cache.  This
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 1cb1ea133a2c..7f4bea162026 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -461,6 +461,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address,
                      pte_t *ptep)
 {
 #ifdef CONFIG_PPC_STD_MMU
+        /*
+         * We don't need to worry about _PAGE_PRESENT here because we are
+         * called with either mm->page_table_lock held or ptl lock held
+         */
        unsigned long access = 0, trap;
        /* We only want HPTEs for linux PTEs that have _PAGE_ACCESSED set */
diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap.c
index 67a42ed0d2fc..67a42ed0d2fc 100644
--- a/arch/powerpc/mm/mmap_64.c
+++ b/arch/powerpc/mm/mmap.c
diff --git a/arch/powerpc/mm/mmu_context_nohash.c b/arch/powerpc/mm/mmu_context_nohash.c
index e779642c25e5..af3d78e19302 100644
--- a/arch/powerpc/mm/mmu_context_nohash.c
+++ b/arch/powerpc/mm/mmu_context_nohash.c
@@ -112,8 +112,10 @@ static unsigned int steal_context_smp(unsigned int id)
                 */
                for_each_cpu(cpu, mm_cpumask(mm)) {
                        for (i = cpu_first_thread_sibling(cpu);
-                             i <= cpu_last_thread_sibling(cpu); i++)
+                             i <= cpu_last_thread_sibling(cpu); i++) {
-                                __set_bit(id, stale_map[i]);
+                                if (stale_map[i])
+                                        __set_bit(id, stale_map[i]);
+                        }
                        cpu = i - 1;
                }
                return id;
@@ -272,7 +274,8 @@ void switch_mmu_context(struct mm_struct *prev, struct mm_struct *next)
                /* XXX This clear should ultimately be part of local_flush_tlb_mm */
                for (i = cpu_first_thread_sibling(cpu);
                     i <= cpu_last_thread_sibling(cpu); i++) {
-                        __clear_bit(id, stale_map[i]);
+                        if (stale_map[i])
+                                __clear_bit(id, stale_map[i]);
                }
        }
@@ -329,8 +332,8 @@ void destroy_context(struct mm_struct *mm)
 #ifdef CONFIG_SMP
-static int __cpuinit mmu_context_cpu_notify(struct notifier_block *self,
+static int mmu_context_cpu_notify(struct notifier_block *self,
-                                            unsigned long action, void *hcpu)
+                                  unsigned long action, void *hcpu)
 {
        unsigned int cpu = (unsigned int)(long)hcpu;
@@ -363,7 +366,7 @@ static int __cpuinit mmu_context_cpu_notify(struct notifier_block *self,
        return NOTIFY_OK;
 }
-static struct notifier_block __cpuinitdata mmu_context_cpu_nb = {
+static struct notifier_block mmu_context_cpu_nb = {
        .notifier_call  = mmu_context_cpu_notify,
 };
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 88c0425dc0a8..08397217e8ac 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -516,7 +516,7 @@ static int of_drconf_to_nid_single(struct of_drconf_cell *drmem,
 * Figure out to which domain a cpu belongs and stick it there.
 * Return the id of the domain used.
 */
-static int __cpuinit numa_setup_cpu(unsigned long lcpu)
+static int numa_setup_cpu(unsigned long lcpu)
 {
        int nid = 0;
        struct device_node *cpu = of_get_cpu_node(lcpu, NULL);
@@ -538,8 +538,7 @@ out:
        return nid;
 }
-static int __cpuinit cpu_numa_callback(struct notifier_block *nfb,
+static int cpu_numa_callback(struct notifier_block *nfb, unsigned long action,
-                             unsigned long action,
                             void *hcpu)
 {
        unsigned long lcpu = (unsigned long)hcpu;
@@ -919,7 +918,7 @@ static void __init *careful_zallocation(int nid, unsigned long size,
        return ret;
 }
-static struct notifier_block __cpuinitdata ppc64_numa_nb = {
+static struct notifier_block ppc64_numa_nb = {
        .notifier_call = cpu_numa_callback,
        .priority = 1 /* Must run before sched domains notifier. */
 };
@@ -1433,11 +1432,9 @@ static int update_cpu_topology(void *data)
                if (cpu != update->cpu)
                        continue;
-                unregister_cpu_under_node(update->cpu, update->old_nid);
                unmap_cpu_from_node(update->cpu);
                map_cpu_to_node(update->cpu, update->new_nid);
                vdso_getcpu_init();
-                register_cpu_under_node(update->cpu, update->new_nid);
        }
        return 0;
@@ -1485,6 +1482,9 @@ int arch_update_cpu_topology(void)
        stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
        for (ud = &updates[0]; ud; ud = ud->next) {
+                unregister_cpu_under_node(ud->cpu, ud->old_nid);
+                register_cpu_under_node(ud->cpu, ud->new_nid);
                dev = get_cpu_device(ud->cpu);
                if (dev)
                        kobject_uevent(&dev->kobj, KOBJ_CHANGE);
diff --git a/arch/powerpc/mm/pgtable.c b/arch/powerpc/mm/pgtable.c
index 214130a4edc6..edda589795c3 100644
--- a/arch/powerpc/mm/pgtable.c
+++ b/arch/powerpc/mm/pgtable.c
@@ -235,6 +235,14 @@ void assert_pte_locked(struct mm_struct *mm, unsigned long addr)
        pud = pud_offset(pgd, addr);
        BUG_ON(pud_none(*pud));
        pmd = pmd_offset(pud, addr);
+        /*
+         * khugepaged to collapse normal pages to hugepage, first set
+         * pmd to none to force page fault/gup to take mmap_sem. After
+         * pmd is set to none, we do a pte_clear which does this assertion
+         * so if we find pmd none, return.
+         */
+        if (pmd_none(*pmd))
+                return;
        BUG_ON(!pmd_present(*pmd));
        assert_spin_locked(pte_lockptr(mm, pmd));
 }
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index a854096e1023..536eec72c0f7 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -338,6 +338,19 @@ EXPORT_SYMBOL(iounmap);
 EXPORT_SYMBOL(__iounmap);
 EXPORT_SYMBOL(__iounmap_at);
+/*
+ * For hugepage we have pfn in the pmd, we use PTE_RPN_SHIFT bits for flags
+ * For PTE page, we have a PTE_FRAG_SIZE (4K) aligned virtual address.
+ */
+struct page *pmd_page(pmd_t pmd)
+{
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        if (pmd_trans_huge(pmd))
+                return pfn_to_page(pmd_pfn(pmd));
+#endif
+        return virt_to_page(pmd_page_vaddr(pmd));
+}
 #ifdef CONFIG_PPC_64K_PAGES
 static pte_t *get_from_cache(struct mm_struct *mm)
 {
@@ -455,3 +468,404 @@ void pgtable_free_tlb(struct mmu_gather *tlb, void *table, int shift)
 }
 #endif
 #endif /* CONFIG_PPC_64K_PAGES */
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+/*
+ * This is called when relaxing access to a hugepage. It's also called in the page
+ * fault path when we don't hit any of the major fault cases, ie, a minor
+ * update of _PAGE_ACCESSED, _PAGE_DIRTY, etc... The generic code will have
+ * handled those two for us, we additionally deal with missing execute
+ * permission here on some processors
+ */
+int pmdp_set_access_flags(struct vm_area_struct *vma, unsigned long address,
+                          pmd_t *pmdp, pmd_t entry, int dirty)
+{
+        int changed;
+#ifdef CONFIG_DEBUG_VM
+        WARN_ON(!pmd_trans_huge(*pmdp));
+        assert_spin_locked(&vma->vm_mm->page_table_lock);
+#endif
+        changed = !pmd_same(*(pmdp), entry);
+        if (changed) {
+                __ptep_set_access_flags(pmdp_ptep(pmdp), pmd_pte(entry));
+                /*
+                 * Since we are not supporting SW TLB systems, we don't
+                 * have any thing similar to flush_tlb_page_nohash()
+                 */
+        }
+        return changed;
+}
+unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr,
+                                  pmd_t *pmdp, unsigned long clr)
+{
+        unsigned long old, tmp;
+#ifdef CONFIG_DEBUG_VM
+        WARN_ON(!pmd_trans_huge(*pmdp));
+        assert_spin_locked(&mm->page_table_lock);
+#endif
+#ifdef PTE_ATOMIC_UPDATES
+        __asm__ __volatile__(
+        "1:     ldarx   %0,0,%3\n\
+                andi.   %1,%0,%6\n\
+                bne-    1b \n\
+                andc    %1,%0,%4 \n\
+                stdcx.  %1,0,%3 \n\
+                bne-    1b"
+        : "=&r" (old), "=&r" (tmp), "=m" (*pmdp)
+        : "r" (pmdp), "r" (clr), "m" (*pmdp), "i" (_PAGE_BUSY)
+        : "cc" );
+#else
+        old = pmd_val(*pmdp);
+        *pmdp = __pmd(old & ~clr);
+#endif
+        if (old & _PAGE_HASHPTE)
+                hpte_do_hugepage_flush(mm, addr, pmdp);
+        return old;
+}
+pmd_t pmdp_clear_flush(struct vm_area_struct *vma, unsigned long address,
+                       pmd_t *pmdp)
+{
+        pmd_t pmd;
+        VM_BUG_ON(address & ~HPAGE_PMD_MASK);
+        if (pmd_trans_huge(*pmdp)) {
+                pmd = pmdp_get_and_clear(vma->vm_mm, address, pmdp);
+        } else {
+                /*
+                 * khugepaged calls this for normal pmd
+                 */
+                pmd = *pmdp;
+                pmd_clear(pmdp);
+                /*
+                 * Wait for all pending hash_page to finish. This is needed
+                 * in case of subpage collapse. When we collapse normal pages
+                 * to hugepage, we first clear the pmd, then invalidate all
+                 * the PTE entries. The assumption here is that any low level
+                 * page fault will see a none pmd and take the slow path that
+                 * will wait on mmap_sem. But we could very well be in a
+                 * hash_page with local ptep pointer value. Such a hash page
+                 * can result in adding new HPTE entries for normal subpages.
+                 * That means we could be modifying the page content as we
+                 * copy them to a huge page. So wait for parallel hash_page
+                 * to finish before invalidating HPTE entries. We can do this
+                 * by sending an IPI to all the cpus and executing a dummy
+                 * function there.
+                 */
+                kick_all_cpus_sync();
+                /*
+                 * Now invalidate the hpte entries in the range
+                 * covered by pmd. This make sure we take a
+                 * fault and will find the pmd as none, which will
+                 * result in a major fault which takes mmap_sem and
+                 * hence wait for collapse to complete. Without this
+                 * the __collapse_huge_page_copy can result in copying
+                 * the old content.
+                 */
+                flush_tlb_pmd_range(vma->vm_mm, &pmd, address);
+        }
+        return pmd;
+}
+int pmdp_test_and_clear_young(struct vm_area_struct *vma,
+                              unsigned long address, pmd_t *pmdp)
+{
+        return __pmdp_test_and_clear_young(vma->vm_mm, address, pmdp);
+}
+/*
+ * We currently remove entries from the hashtable regardless of whether
+ * the entry was young or dirty. The generic routines only flush if the
+ * entry was young or dirty which is not good enough.
+ *
+ * We should be more intelligent about this but for the moment we override
+ * these functions and force a tlb flush unconditionally
+ */
+int pmdp_clear_flush_young(struct vm_area_struct *vma,
+                                  unsigned long address, pmd_t *pmdp)
+{
+        return __pmdp_test_and_clear_young(vma->vm_mm, address, pmdp);
+}
+/*
+ * We mark the pmd splitting and invalidate all the hpte
+ * entries for this hugepage.
+ */
+void pmdp_splitting_flush(struct vm_area_struct *vma,
+                          unsigned long address, pmd_t *pmdp)
+{
+        unsigned long old, tmp;
+        VM_BUG_ON(address & ~HPAGE_PMD_MASK);
+#ifdef CONFIG_DEBUG_VM
+        WARN_ON(!pmd_trans_huge(*pmdp));
+        assert_spin_locked(&vma->vm_mm->page_table_lock);
+#endif
+#ifdef PTE_ATOMIC_UPDATES
+        __asm__ __volatile__(
+        "1:     ldarx   %0,0,%3\n\
+                andi.   %1,%0,%6\n\
+                bne-    1b \n\
+                ori     %1,%0,%4 \n\
+                stdcx.  %1,0,%3 \n\
+                bne-    1b"
+        : "=&r" (old), "=&r" (tmp), "=m" (*pmdp)
+        : "r" (pmdp), "i" (_PAGE_SPLITTING), "m" (*pmdp), "i" (_PAGE_BUSY)
+        : "cc" );
+#else
+        old = pmd_val(*pmdp);
+        *pmdp = __pmd(old | _PAGE_SPLITTING);
+#endif
+        /*
+         * If we didn't had the splitting flag set, go and flush the
+         * HPTE entries.
+         */
+        if (!(old & _PAGE_SPLITTING)) {
+                /* We need to flush the hpte */
+                if (old & _PAGE_HASHPTE)
+                        hpte_do_hugepage_flush(vma->vm_mm, address, pmdp);
+        }
+}
+/*
+ * We want to put the pgtable in pmd and use pgtable for tracking
+ * the base page size hptes
+ */
+void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
+                                pgtable_t pgtable)
+{
+        pgtable_t *pgtable_slot;
+        assert_spin_locked(&mm->page_table_lock);
+        /*
+         * we store the pgtable in the second half of PMD
+         */
+        pgtable_slot = (pgtable_t *)pmdp + PTRS_PER_PMD;
+        *pgtable_slot = pgtable;
+        /*
+         * expose the deposited pgtable to other cpus.
+         * before we set the hugepage PTE at pmd level
+         * hash fault code looks at the deposted pgtable
+         * to store hash index values.
+         */
+        smp_wmb();
+}
+pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
+{
+        pgtable_t pgtable;
+        pgtable_t *pgtable_slot;
+        assert_spin_locked(&mm->page_table_lock);
+        pgtable_slot = (pgtable_t *)pmdp + PTRS_PER_PMD;
+        pgtable = *pgtable_slot;
+        /*
+         * Once we withdraw, mark the entry NULL.
+         */
+        *pgtable_slot = NULL;
+        /*
+         * We store HPTE information in the deposited PTE fragment.
+         * zero out the content on withdraw.
+         */
+        memset(pgtable, 0, PTE_FRAG_SIZE);
+        return pgtable;
+}
+/*
+ * set a new huge pmd. We should not be called for updating
+ * an existing pmd entry. That should go via pmd_hugepage_update.
+ */
+void set_pmd_at(struct mm_struct *mm, unsigned long addr,
+                pmd_t *pmdp, pmd_t pmd)
+{
+#ifdef CONFIG_DEBUG_VM
+        WARN_ON(!pmd_none(*pmdp));
+        assert_spin_locked(&mm->page_table_lock);
+        WARN_ON(!pmd_trans_huge(pmd));
+#endif
+        return set_pte_at(mm, addr, pmdp_ptep(pmdp), pmd_pte(pmd));
+}
+void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
+                     pmd_t *pmdp)
+{
+        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT);
+}
+/*
+ * A linux hugepage PMD was changed and the corresponding hash table entries
+ * neesd to be flushed.
+ */
+void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
+                            pmd_t *pmdp)
+{
+        int ssize, i;
+        unsigned long s_addr;
+        int max_hpte_count;
+        unsigned int psize, valid;
+        unsigned char *hpte_slot_array;
+        unsigned long hidx, vpn, vsid, hash, shift, slot;
+        /*
+         * Flush all the hptes mapping this hugepage
+         */
+        s_addr = addr & HPAGE_PMD_MASK;
+        hpte_slot_array = get_hpte_slot_array(pmdp);
+        /*
+         * IF we try to do a HUGE PTE update after a withdraw is done.
+         * we will find the below NULL. This happens when we do
+         * split_huge_page_pmd
+         */
+        if (!hpte_slot_array)
+                return;
+        /* get the base page size */
+        psize = get_slice_psize(mm, s_addr);
+        if (ppc_md.hugepage_invalidate)
+                return ppc_md.hugepage_invalidate(mm, hpte_slot_array,
+                                                  s_addr, psize);
+        /*
+         * No bluk hpte removal support, invalidate each entry
+         */
+        shift = mmu_psize_defs[psize].shift;
+        max_hpte_count = HPAGE_PMD_SIZE >> shift;
+        for (i = 0; i < max_hpte_count; i++) {
+                /*
+                 * 8 bits per each hpte entries
+                 * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit]
+                 */
+                valid = hpte_valid(hpte_slot_array, i);
+                if (!valid)
+                        continue;
+                hidx =  hpte_hash_index(hpte_slot_array, i);
+                /* get the vpn */
+                addr = s_addr + (i * (1ul << shift));
+                if (!is_kernel_addr(addr)) {
+                        ssize = user_segment_size(addr);
+                        vsid = get_vsid(mm->context.id, addr, ssize);
+                        WARN_ON(vsid == 0);
+                } else {
+                        vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
+                        ssize = mmu_kernel_ssize;
+                }
+                vpn = hpt_vpn(addr, vsid, ssize);
+                hash = hpt_hash(vpn, shift, ssize);
+                if (hidx & _PTEIDX_SECONDARY)
+                        hash = ~hash;
+                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+                slot += hidx & _PTEIDX_GROUP_IX;
+                ppc_md.hpte_invalidate(slot, vpn, psize,
+                                       MMU_PAGE_16M, ssize, 0);
+        }
+}
+static pmd_t pmd_set_protbits(pmd_t pmd, pgprot_t pgprot)
+{
+        pmd_val(pmd) |= pgprot_val(pgprot);
+        return pmd;
+}
+pmd_t pfn_pmd(unsigned long pfn, pgprot_t pgprot)
+{
+        pmd_t pmd;
+        /*
+         * For a valid pte, we would have _PAGE_PRESENT or _PAGE_FILE always
+         * set. We use this to check THP page at pmd level.
+         * leaf pte for huge page, bottom two bits != 00
+         */
+        pmd_val(pmd) = pfn << PTE_RPN_SHIFT;
+        pmd_val(pmd) |= _PAGE_THP_HUGE;
+        pmd = pmd_set_protbits(pmd, pgprot);
+        return pmd;
+}
+pmd_t mk_pmd(struct page *page, pgprot_t pgprot)
+{
+        return pfn_pmd(page_to_pfn(page), pgprot);
+}
+pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
+{
+        pmd_val(pmd) &= _HPAGE_CHG_MASK;
+        pmd = pmd_set_protbits(pmd, newprot);
+        return pmd;
+}
+/*
+ * This is called at the end of handling a user page fault, when the
+ * fault has been handled by updating a HUGE PMD entry in the linux page tables.
+ * We use it to preload an HPTE into the hash table corresponding to
+ * the updated linux HUGE PMD entry.
+ */
+void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
+                          pmd_t *pmd)
+{
+        return;
+}
+pmd_t pmdp_get_and_clear(struct mm_struct *mm,
+                         unsigned long addr, pmd_t *pmdp)
+{
+        pmd_t old_pmd;
+        pgtable_t pgtable;
+        unsigned long old;
+        pgtable_t *pgtable_slot;
+        old = pmd_hugepage_update(mm, addr, pmdp, ~0UL);
+        old_pmd = __pmd(old);
+        /*
+         * We have pmd == none and we are holding page_table_lock.
+         * So we can safely go and clear the pgtable hash
+         * index info.
+         */
+        pgtable_slot = (pgtable_t *)pmdp + PTRS_PER_PMD;
+        pgtable = *pgtable_slot;
+        /*
+         * Let's zero out old valid and hash index details
+         * hash fault look at them.
+         */
+        memset(pgtable, 0, PTE_FRAG_SIZE);
+        return old_pmd;
+}
+int has_transparent_hugepage(void)
+{
+        if (!mmu_has_feature(MMU_FTR_16M_PAGE))
+                return 0;
+        /*
+         * We support THP only if PMD_SIZE is 16MB.
+         */
+        if (mmu_psize_defs[MMU_PAGE_16M].shift != PMD_SHIFT)
+                return 0;
+        /*
+         * We need to make sure that we support 16MB hugepage in a segement
+         * with base page size 64K or 4K. We only enable THP with a PAGE_SIZE
+         * of 64K.
+         */
+        /*
+         * If we have 64K HPTE, we will be using that by default
+         */
+        if (mmu_psize_defs[MMU_PAGE_64K].shift &&
+            (mmu_psize_defs[MMU_PAGE_64K].penc[MMU_PAGE_16M] == -1))
+                return 0;
+        /*
+         * Ok we only have 4K HPTE
+         */
+        if (mmu_psize_defs[MMU_PAGE_4K].penc[MMU_PAGE_16M] == -1)
+                return 0;
+        return 1;
+}
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
diff --git a/arch/powerpc/mm/subpage-prot.c b/arch/powerpc/mm/subpage-prot.c
index 7c415ddde948..aa74acb0fdfc 100644
--- a/arch/powerpc/mm/subpage-prot.c
+++ b/arch/powerpc/mm/subpage-prot.c
@@ -130,6 +130,53 @@ static void subpage_prot_clear(unsigned long addr, unsigned long len)
        up_write(&mm->mmap_sem);
 }
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static int subpage_walk_pmd_entry(pmd_t *pmd, unsigned long addr,
+                                  unsigned long end, struct mm_walk *walk)
+{
+        struct vm_area_struct *vma = walk->private;
+        split_huge_page_pmd(vma, addr, pmd);
+        return 0;
+}
+static void subpage_mark_vma_nohuge(struct mm_struct *mm, unsigned long addr,
+                                    unsigned long len)
+{
+        struct vm_area_struct *vma;
+        struct mm_walk subpage_proto_walk = {
+                .mm = mm,
+                .pmd_entry = subpage_walk_pmd_entry,
+        };
+        /*
+         * We don't try too hard, we just mark all the vma in that range
+         * VM_NOHUGEPAGE and split them.
+         */
+        vma = find_vma(mm, addr);
+        /*
+         * If the range is in unmapped range, just return
+         */
+        if (vma && ((addr + len) <= vma->vm_start))
+                return;
+        while (vma) {
+                if (vma->vm_start >= (addr + len))
+                        break;
+                vma->vm_flags |= VM_NOHUGEPAGE;
+                subpage_proto_walk.private = vma;
+                walk_page_range(vma->vm_start, vma->vm_end,
+                                &subpage_proto_walk);
+                vma = vma->vm_next;
+        }
+}
+#else
+static void subpage_mark_vma_nohuge(struct mm_struct *mm, unsigned long addr,
+                                    unsigned long len)
+{
+        return;
+}
+#endif
 /*
 * Copy in a subpage protection map for an address range.
 * The map has 2 bits per 4k subpage, so 32 bits per 64k page.
@@ -168,6 +215,7 @@ long sys_subpage_prot(unsigned long addr, unsigned long len, u32 __user *map)
                return -EFAULT;
        down_write(&mm->mmap_sem);
+        subpage_mark_vma_nohuge(mm, addr, len);
        for (limit = addr + len; addr < limit; addr = next) {
                next = pmd_addr_end(addr, limit);
                err = -ENOMEM;
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 7df1c5edda87..36e44b4260eb 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -189,6 +189,7 @@ void tlb_flush(struct mmu_gather *tlb)
 void __flush_hash_table_range(struct mm_struct *mm, unsigned long start,
                              unsigned long end)
 {
+        int hugepage_shift;
        unsigned long flags;
        start = _ALIGN_DOWN(start, PAGE_SIZE);
@@ -206,7 +207,8 @@ void __flush_hash_table_range(struct mm_struct *mm, unsigned long start,
        local_irq_save(flags);
        arch_enter_lazy_mmu_mode();
        for (; start < end; start += PAGE_SIZE) {
-                pte_t *ptep = find_linux_pte(mm->pgd, start);
+                pte_t *ptep = find_linux_pte_or_hugepte(mm->pgd, start,
+                                                        &hugepage_shift);
                unsigned long pte;
                if (ptep == NULL)
@@ -214,7 +216,37 @@ void __flush_hash_table_range(struct mm_struct *mm, unsigned long start,
                pte = pte_val(*ptep);
                if (!(pte & _PAGE_HASHPTE))
                        continue;
-                hpte_need_flush(mm, start, ptep, pte, 0);
+                if (unlikely(hugepage_shift && pmd_trans_huge(*(pmd_t *)pte)))
+                        hpte_do_hugepage_flush(mm, start, (pmd_t *)pte);
+                else
+                        hpte_need_flush(mm, start, ptep, pte, 0);
+        }
+        arch_leave_lazy_mmu_mode();
+        local_irq_restore(flags);
+}
+void flush_tlb_pmd_range(struct mm_struct *mm, pmd_t *pmd, unsigned long addr)
+{
+        pte_t *pte;
+        pte_t *start_pte;
+        unsigned long flags;
+        addr = _ALIGN_DOWN(addr, PMD_SIZE);
+        /* Note: Normally, we should only ever use a batch within a
+         * PTE locked section. This violates the rule, but will work
+         * since we don't actually modify the PTEs, we just flush the
+         * hash while leaving the PTEs intact (including their reference
+         * to being hashed). This is not the most performance oriented
+         * way to do things but is fine for our needs here.
+         */
+        local_irq_save(flags);
+        arch_enter_lazy_mmu_mode();
+        start_pte = pte_offset_map(pmd, addr);
+        for (pte = start_pte; pte < start_pte + PTRS_PER_PTE; pte++) {
+                unsigned long pteval = pte_val(*pte);
+                if (pteval & _PAGE_HASHPTE)
+                        hpte_need_flush(mm, addr, pte, pteval, 0);
+                addr += PAGE_SIZE;
        }
        arch_leave_lazy_mmu_mode();
        local_irq_restore(flags);
diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
index 6888cad5103d..41cd68dee681 100644
--- a/arch/powerpc/mm/tlb_nohash.c
+++ b/arch/powerpc/mm/tlb_nohash.c
@@ -648,7 +648,7 @@ void __init early_init_mmu(void)
        __early_init_mmu(1);
 }
-void __cpuinit early_init_mmu_secondary(void)
+void early_init_mmu_secondary(void)
 {
        __early_init_mmu(0);
 }
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 29c6482890c8..a3985aee77fe 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -75,6 +75,11 @@ static unsigned int freeze_events_kernel = MMCR0_FCS;
 #define MMCR0_FCHV              0
 #define MMCR0_PMCjCE            MMCR0_PMCnCE
+#define MMCR0_FC56              0
+#define MMCR0_PMAO              0
+#define MMCR0_EBE               0
+#define MMCR0_PMCC              0
+#define MMCR0_PMCC_U6           0
 #define SPRN_MMCRA              SPRN_MMCR2
 #define MMCRA_SAMPLE_ENABLE     0
@@ -102,6 +107,15 @@ static inline int siar_valid(struct pt_regs *regs)
        return 1;
 }
+static bool is_ebb_event(struct perf_event *event) { return false; }
+static int ebb_event_check(struct perf_event *event) { return 0; }
+static void ebb_event_add(struct perf_event *event) { }
+static void ebb_switch_out(unsigned long mmcr0) { }
+static unsigned long ebb_switch_in(bool ebb, unsigned long mmcr0)
+{
+        return mmcr0;
+}
 static inline void power_pmu_bhrb_enable(struct perf_event *event) {}
 static inline void power_pmu_bhrb_disable(struct perf_event *event) {}
 void power_pmu_flush_branch_stack(void) {}
@@ -462,6 +476,89 @@ void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw)
        return;
 }
+static bool is_ebb_event(struct perf_event *event)
+{
+        /*
+         * This could be a per-PMU callback, but we'd rather avoid the cost. We
+         * check that the PMU supports EBB, meaning those that don't can still
+         * use bit 63 of the event code for something else if they wish.
+         */
+        return (ppmu->flags & PPMU_EBB) &&
+               ((event->attr.config >> EVENT_CONFIG_EBB_SHIFT) & 1);
+}
+static int ebb_event_check(struct perf_event *event)
+{
+        struct perf_event *leader = event->group_leader;
+        /* Event and group leader must agree on EBB */
+        if (is_ebb_event(leader) != is_ebb_event(event))
+                return -EINVAL;
+        if (is_ebb_event(event)) {
+                if (!(event->attach_state & PERF_ATTACH_TASK))
+                        return -EINVAL;
+                if (!leader->attr.pinned || !leader->attr.exclusive)
+                        return -EINVAL;
+                if (event->attr.inherit || event->attr.sample_period ||
+                    event->attr.enable_on_exec || event->attr.freq)
+                        return -EINVAL;
+        }
+        return 0;
+}
+static void ebb_event_add(struct perf_event *event)
+{
+        if (!is_ebb_event(event) || current->thread.used_ebb)
+                return;
+        /*
+         * IFF this is the first time we've added an EBB event, set
+         * PMXE in the user MMCR0 so we can detect when it's cleared by
+         * userspace. We need this so that we can context switch while
+         * userspace is in the EBB handler (where PMXE is 0).
+         */
+        current->thread.used_ebb = 1;
+        current->thread.mmcr0 |= MMCR0_PMXE;
+}
+static void ebb_switch_out(unsigned long mmcr0)
+{
+        if (!(mmcr0 & MMCR0_EBE))
+                return;
+        current->thread.siar  = mfspr(SPRN_SIAR);
+        current->thread.sier  = mfspr(SPRN_SIER);
+        current->thread.sdar  = mfspr(SPRN_SDAR);
+        current->thread.mmcr0 = mmcr0 & MMCR0_USER_MASK;
+        current->thread.mmcr2 = mfspr(SPRN_MMCR2) & MMCR2_USER_MASK;
+}
+static unsigned long ebb_switch_in(bool ebb, unsigned long mmcr0)
+{
+        if (!ebb)
+                goto out;
+        /* Enable EBB and read/write to all 6 PMCs for userspace */
+        mmcr0 |= MMCR0_EBE | MMCR0_PMCC_U6;
+        /* Add any bits from the user reg, FC or PMAO */
+        mmcr0 |= current->thread.mmcr0;
+        /* Be careful not to set PMXE if userspace had it cleared */
+        if (!(current->thread.mmcr0 & MMCR0_PMXE))
+                mmcr0 &= ~MMCR0_PMXE;
+        mtspr(SPRN_SIAR, current->thread.siar);
+        mtspr(SPRN_SIER, current->thread.sier);
+        mtspr(SPRN_SDAR, current->thread.sdar);
+        mtspr(SPRN_MMCR2, current->thread.mmcr2);
+out:
+        return mmcr0;
+}
 #endif /* CONFIG_PPC64 */
 static void perf_event_interrupt(struct pt_regs *regs);
@@ -732,6 +829,13 @@ static void power_pmu_read(struct perf_event *event)
        if (!event->hw.idx)
                return;
+        if (is_ebb_event(event)) {
+                val = read_pmc(event->hw.idx);
+                local64_set(&event->hw.prev_count, val);
+                return;
+        }
        /*
         * Performance monitor interrupts come even when interrupts
         * are soft-disabled, as long as interrupts are hard-enabled.
@@ -852,7 +956,7 @@ static void write_mmcr0(struct cpu_hw_events *cpuhw, unsigned long mmcr0)
 static void power_pmu_disable(struct pmu *pmu)
 {
        struct cpu_hw_events *cpuhw;
-        unsigned long flags;
+        unsigned long flags, mmcr0, val;
        if (!ppmu)
                return;
@@ -860,9 +964,6 @@ static void power_pmu_disable(struct pmu *pmu)
        cpuhw = &__get_cpu_var(cpu_hw_events);
        if (!cpuhw->disabled) {
-                cpuhw->disabled = 1;
-                cpuhw->n_added = 0;
                /*
                 * Check if we ever enabled the PMU on this cpu.
                 */
@@ -872,6 +973,21 @@ static void power_pmu_disable(struct pmu *pmu)
                }
                /*
+                 * Set the 'freeze counters' bit, clear EBE/PMCC/PMAO/FC56.
+                 */
+                val  = mmcr0 = mfspr(SPRN_MMCR0);
+                val |= MMCR0_FC;
+                val &= ~(MMCR0_EBE | MMCR0_PMCC | MMCR0_PMAO | MMCR0_FC56);
+                /*
+                 * The barrier is to make sure the mtspr has been
+                 * executed and the PMU has frozen the events etc.
+                 * before we return.
+                 */
+                write_mmcr0(cpuhw, val);
+                mb();
+                /*
                 * Disable instruction sampling if it was enabled
                 */
                if (cpuhw->mmcr[2] & MMCRA_SAMPLE_ENABLE) {
@@ -880,15 +996,12 @@ static void power_pmu_disable(struct pmu *pmu)
                        mb();
                }
-                /*
+                cpuhw->disabled = 1;
-                 * Set the 'freeze counters' bit.
+                cpuhw->n_added = 0;
-                 * The barrier is to make sure the mtspr has been
-                 * executed and the PMU has frozen the events
+                ebb_switch_out(mmcr0);
-                 * before we return.
-                 */
-                write_mmcr0(cpuhw, mfspr(SPRN_MMCR0) | MMCR0_FC);
-                mb();
        }
        local_irq_restore(flags);
 }
@@ -903,23 +1016,36 @@ static void power_pmu_enable(struct pmu *pmu)
        struct cpu_hw_events *cpuhw;
        unsigned long flags;
        long i;
-        unsigned long val;
+        unsigned long val, mmcr0;
        s64 left;
        unsigned int hwc_index[MAX_HWEVENTS];
        int n_lim;
        int idx;
+        bool ebb;
        if (!ppmu)
                return;
        local_irq_save(flags);
        cpuhw = &__get_cpu_var(cpu_hw_events);
-        if (!cpuhw->disabled) {
+        if (!cpuhw->disabled)
-                local_irq_restore(flags);
+                goto out;
-                return;
+        if (cpuhw->n_events == 0) {
+                ppc_set_pmu_inuse(0);
+                goto out;
        }
        cpuhw->disabled = 0;
        /*
+         * EBB requires an exclusive group and all events must have the EBB
+         * flag set, or not set, so we can just check a single event. Also we
+         * know we have at least one event.
+         */
+        ebb = is_ebb_event(cpuhw->event[0]);
+        /*
         * If we didn't change anything, or only removed events,
         * no need to recalculate MMCR* settings and reset the PMCs.
         * Just reenable the PMU with the current MMCR* settings
@@ -928,8 +1054,6 @@ static void power_pmu_enable(struct pmu *pmu)
        if (!cpuhw->n_added) {
                mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
                mtspr(SPRN_MMCR1, cpuhw->mmcr[1]);
-                if (cpuhw->n_events == 0)
-                        ppc_set_pmu_inuse(0);
                goto out_enable;
        }
@@ -996,25 +1120,34 @@ static void power_pmu_enable(struct pmu *pmu)
                        ++n_lim;
                        continue;
                }
-                val = 0;
-                if (event->hw.sample_period) {
+                if (ebb)
-                        left = local64_read(&event->hw.period_left);
+                        val = local64_read(&event->hw.prev_count);
-                        if (left < 0x80000000L)
+                else {
-                                val = 0x80000000L - left;
+                        val = 0;
+                        if (event->hw.sample_period) {
+                                left = local64_read(&event->hw.period_left);
+                                if (left < 0x80000000L)
+                                        val = 0x80000000L - left;
+                        }
+                        local64_set(&event->hw.prev_count, val);
                }
-                local64_set(&event->hw.prev_count, val);
                event->hw.idx = idx;
                if (event->hw.state & PERF_HES_STOPPED)
                        val = 0;
                write_pmc(idx, val);
                perf_event_update_userpage(event);
        }
        cpuhw->n_limited = n_lim;
        cpuhw->mmcr[0] |= MMCR0_PMXE | MMCR0_FCECE;
 out_enable:
+        mmcr0 = ebb_switch_in(ebb, cpuhw->mmcr[0]);
        mb();
-        write_mmcr0(cpuhw, cpuhw->mmcr[0]);
+        write_mmcr0(cpuhw, mmcr0);
        /*
         * Enable instruction sampling if necessary
@@ -1112,6 +1245,8 @@ static int power_pmu_add(struct perf_event *event, int ef_flags)
        event->hw.config = cpuhw->events[n0];
 nocheck:
+        ebb_event_add(event);
        ++cpuhw->n_events;
        ++cpuhw->n_added;
@@ -1472,6 +1607,11 @@ static int power_pmu_event_init(struct perf_event *event)
                }
        }
+        /* Extra checks for EBB */
+        err = ebb_event_check(event);
+        if (err)
+                return err;
        /*
         * If this is in a group, check if it can go on with all the
         * other hardware events in the group.  We assume the event
@@ -1511,6 +1651,13 @@ static int power_pmu_event_init(struct perf_event *event)
        local64_set(&event->hw.period_left, event->hw.last_period);
        /*
+         * For EBB events we just context switch the PMC value, we don't do any
+         * of the sample_period logic. We use hw.prev_count for this.
+         */
+        if (is_ebb_event(event))
+                local64_set(&event->hw.prev_count, 0);
+        /*
         * See if we need to reserve the PMU.
         * If no events are currently in use, then we have to take a
         * mutex to ensure that we don't race with another task doing
@@ -1786,7 +1933,7 @@ static void power_pmu_setup(int cpu)
        cpuhw->mmcr[0] = MMCR0_FC;
 }
-static int __cpuinit
+static int
 power_pmu_notifier(struct notifier_block *self, unsigned long action, void *hcpu)
 {
        unsigned int cpu = (long)hcpu;
@@ -1803,7 +1950,7 @@ power_pmu_notifier(struct notifier_block *self, unsigned long action, void *hcpu
        return NOTIFY_OK;
 }
-int __cpuinit register_power_pmu(struct power_pmu *pmu)
+int register_power_pmu(struct power_pmu *pmu)
 {
        if (ppmu)
                return -EBUSY;          /* something's already registered */
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index f7d1c4fff303..96a64d6a8bdf 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -31,9 +31,9 @@
 *
 *        60        56        52        48        44        40        36        32
 * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
- *                                     [      thresh_cmp     ]   [  thresh_ctl   ]
+ *   |                                 [      thresh_cmp     ]   [  thresh_ctl   ]
- *                                                                       |
+ *   |                                                                   |
- *                                       thresh start/stop OR FAB match -*
+ *   *- EBB (Linux)                      thresh start/stop OR FAB match -*
 *
 *        28        24        20        16        12         8         4         0
 * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
@@ -85,6 +85,7 @@
 *
 */
+#define EVENT_EBB_MASK          1ull
 #define EVENT_THR_CMP_SHIFT     40      /* Threshold CMP value */
 #define EVENT_THR_CMP_MASK      0x3ff
 #define EVENT_THR_CTL_SHIFT     32      /* Threshold control value (start/stop) */
@@ -109,6 +110,17 @@
 #define EVENT_IS_MARKED         (EVENT_MARKED_MASK << EVENT_MARKED_SHIFT)
 #define EVENT_PSEL_MASK         0xff    /* PMCxSEL value */
+#define EVENT_VALID_MASK        \
+        ((EVENT_THRESH_MASK    << EVENT_THRESH_SHIFT)           |       \
+         (EVENT_SAMPLE_MASK    << EVENT_SAMPLE_SHIFT)           |       \
+         (EVENT_CACHE_SEL_MASK << EVENT_CACHE_SEL_SHIFT)        |       \
+         (EVENT_PMC_MASK       << EVENT_PMC_SHIFT)              |       \
+         (EVENT_UNIT_MASK      << EVENT_UNIT_SHIFT)             |       \
+         (EVENT_COMBINE_MASK   << EVENT_COMBINE_SHIFT)          |       \
+         (EVENT_MARKED_MASK    << EVENT_MARKED_SHIFT)           |       \
+         (EVENT_EBB_MASK       << EVENT_CONFIG_EBB_SHIFT)       |       \
+          EVENT_PSEL_MASK)
 /* MMCRA IFM bits - POWER8 */
 #define POWER8_MMCRA_IFM1               0x0000000040000000UL
 #define POWER8_MMCRA_IFM2               0x0000000080000000UL
@@ -130,10 +142,10 @@
 *
 *        28        24        20        16        12         8         4         0
 * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
- *                       [ ]   [  sample ]   [     ]   [6] [5]   [4] [3]   [2] [1]
+ *                   |   [ ]   [  sample ]   [     ]   [6] [5]   [4] [3]   [2] [1]
- *                        |                     |
+ *              EBB -*    |                     |
- *      L1 I/D qualifier -*                     |      Count of events for each PMC.
+ *                        |                     |      Count of events for each PMC.
- *                                              |        p1, p2, p3, p4, p5, p6.
+ *      L1 I/D qualifier -*                     |        p1, p2, p3, p4, p5, p6.
 *                     nc - number of counters -*
 *
 * The PMC fields P1..P6, and NC, are adder fields. As we accumulate constraints
@@ -149,6 +161,9 @@
 #define CNST_THRESH_VAL(v)      (((v) & EVENT_THRESH_MASK) << 32)
 #define CNST_THRESH_MASK        CNST_THRESH_VAL(EVENT_THRESH_MASK)
+#define CNST_EBB_VAL(v)         (((v) & EVENT_EBB_MASK) << 24)
+#define CNST_EBB_MASK           CNST_EBB_VAL(EVENT_EBB_MASK)
 #define CNST_L1_QUAL_VAL(v)     (((v) & 3) << 22)
 #define CNST_L1_QUAL_MASK       CNST_L1_QUAL_VAL(3)
@@ -207,14 +222,21 @@ static inline bool event_is_fab_match(u64 event)
 static int power8_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
 {
-        unsigned int unit, pmc, cache;
+        unsigned int unit, pmc, cache, ebb;
        unsigned long mask, value;
        mask = value = 0;
-        pmc   = (event >> EVENT_PMC_SHIFT)       & EVENT_PMC_MASK;
+        if (event & ~EVENT_VALID_MASK)
-        unit  = (event >> EVENT_UNIT_SHIFT)      & EVENT_UNIT_MASK;
+                return -1;
-        cache = (event >> EVENT_CACHE_SEL_SHIFT) & EVENT_CACHE_SEL_MASK;
+        pmc   = (event >> EVENT_PMC_SHIFT)        & EVENT_PMC_MASK;
+        unit  = (event >> EVENT_UNIT_SHIFT)       & EVENT_UNIT_MASK;
+        cache = (event >> EVENT_CACHE_SEL_SHIFT)  & EVENT_CACHE_SEL_MASK;
+        ebb   = (event >> EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
+        /* Clear the EBB bit in the event, so event checks work below */
+        event &= ~(EVENT_EBB_MASK << EVENT_CONFIG_EBB_SHIFT);
        if (pmc) {
                if (pmc > 6)
@@ -284,6 +306,18 @@ static int power8_get_constraint(u64 event, unsigned long *maskp, unsigned long
                value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT);
        }
+        if (!pmc && ebb)
+                /* EBB events must specify the PMC */
+                return -1;
+        /*
+         * All events must agree on EBB, either all request it or none.
+         * EBB events are pinned & exclusive, so this should never actually
+         * hit, but we leave it as a fallback in case.
+         */
+        mask  |= CNST_EBB_VAL(ebb);
+        value |= CNST_EBB_MASK;
        *maskp = mask;
        *valp = value;
@@ -378,6 +412,10 @@ static int power8_compute_mmcr(u64 event[], int n_ev,
        if (pmc_inuse & 0x7c)
                mmcr[0] |= MMCR0_PMCjCE;
+        /* If we're not using PMC 5 or 6, freeze them */
+        if (!(pmc_inuse & 0x60))
+                mmcr[0] |= MMCR0_FC56;
        mmcr[1] = mmcr1;
        mmcr[2] = mmcra;
@@ -574,7 +612,7 @@ static struct power_pmu power8_pmu = {
        .get_constraint         = power8_get_constraint,
        .get_alternatives       = power8_get_alternatives,
        .disable_pmc            = power8_disable_pmc,
-        .flags                  = PPMU_HAS_SSLOT | PPMU_HAS_SIER | PPMU_BHRB,
+        .flags                  = PPMU_HAS_SSLOT | PPMU_HAS_SIER | PPMU_BHRB | PPMU_EBB,
        .n_generic              = ARRAY_SIZE(power8_generic_events),
        .generic_events         = power8_generic_events,
        .attr_groups            = power8_pmu_attr_groups,
diff --git a/arch/powerpc/platforms/44x/currituck.c b/arch/powerpc/platforms/44x/currituck.c
index ecd3890c40d7..7f1b71a01c6a 100644
--- a/arch/powerpc/platforms/44x/currituck.c
+++ b/arch/powerpc/platforms/44x/currituck.c
@@ -91,12 +91,12 @@ static void __init ppc47x_init_irq(void)
 }
 #ifdef CONFIG_SMP
-static void __cpuinit smp_ppc47x_setup_cpu(int cpu)
+static void smp_ppc47x_setup_cpu(int cpu)
 {
        mpic_setup_this_cpu();
 }
-static int __cpuinit smp_ppc47x_kick_cpu(int cpu)
+static int smp_ppc47x_kick_cpu(int cpu)
 {
        struct device_node *cpunode = of_get_cpu_node(cpu, NULL);
        const u64 *spin_table_addr_prop;
@@ -176,13 +176,48 @@ static int __init ppc47x_probe(void)
        return 1;
 }
+static int board_rev = -1;
+static int __init ppc47x_get_board_rev(void)
+{
+        u8 fpga_reg0;
+        void *fpga;
+        struct device_node *np;
+        np = of_find_compatible_node(NULL, NULL, "ibm,currituck-fpga");
+        if (!np)
+                goto fail;
+        fpga = of_iomap(np, 0);
+        of_node_put(np);
+        if (!fpga)
+                goto fail;
+        fpga_reg0 = ioread8(fpga);
+        board_rev = fpga_reg0 & 0x03;
+        pr_info("%s: Found board revision %d\n", __func__, board_rev);
+        iounmap(fpga);
+        return 0;
+fail:
+        pr_info("%s: Unable to find board revision\n", __func__);
+        return 0;
+}
+machine_arch_initcall(ppc47x, ppc47x_get_board_rev);
 /* Use USB controller should have been hardware swizzled but it wasn't :( */
 static void ppc47x_pci_irq_fixup(struct pci_dev *dev)
 {
        if (dev->vendor == 0x1033 && (dev->device == 0x0035 ||
                                      dev->device == 0x00e0)) {
-                dev->irq = irq_create_mapping(NULL, 47);
+                if (board_rev == 0) {
-                pr_info("%s: Mapping irq 47 %d\n", __func__, dev->irq);
+                        dev->irq = irq_create_mapping(NULL, 47);
+                        pr_info("%s: Mapping irq %d\n", __func__, dev->irq);
+                } else if (board_rev == 2) {
+                        dev->irq = irq_create_mapping(NULL, 49);
+                        pr_info("%s: Mapping irq %d\n", __func__, dev->irq);
+                } else {
+                        pr_alert("%s: Unknown board revision\n", __func__);
+                }
        }
 }
diff --git a/arch/powerpc/platforms/44x/iss4xx.c b/arch/powerpc/platforms/44x/iss4xx.c
index a28a8629727e..4241bc825800 100644
--- a/arch/powerpc/platforms/44x/iss4xx.c
+++ b/arch/powerpc/platforms/44x/iss4xx.c
@@ -81,12 +81,12 @@ static void __init iss4xx_init_irq(void)
 }
 #ifdef CONFIG_SMP
-static void __cpuinit smp_iss4xx_setup_cpu(int cpu)
+static void smp_iss4xx_setup_cpu(int cpu)
 {
        mpic_setup_this_cpu();
 }
-static int __cpuinit smp_iss4xx_kick_cpu(int cpu)
+static int smp_iss4xx_kick_cpu(int cpu)
 {
        struct device_node *cpunode = of_get_cpu_node(cpu, NULL);
        const u64 *spin_table_addr_prop;
diff --git a/arch/powerpc/platforms/512x/mpc5121_ads.c b/arch/powerpc/platforms/512x/mpc5121_ads.c
index 0a134e0469ef..3e90ece10ae9 100644
--- a/arch/powerpc/platforms/512x/mpc5121_ads.c
+++ b/arch/powerpc/platforms/512x/mpc5121_ads.c
@@ -43,9 +43,7 @@ static void __init mpc5121_ads_setup_arch(void)
                mpc83xx_add_bridge(np);
 #endif
-#if defined(CONFIG_FB_FSL_DIU) || defined(CONFIG_FB_FSL_DIU_MODULE)
+        mpc512x_setup_arch();
-        mpc512x_setup_diu();
-#endif
 }
 static void __init mpc5121_ads_init_IRQ(void)
@@ -69,7 +67,7 @@ define_machine(mpc5121_ads) {
        .probe                  = mpc5121_ads_probe,
        .setup_arch             = mpc5121_ads_setup_arch,
        .init                   = mpc512x_init,
-        .init_early             = mpc512x_init_diu,
+        .init_early             = mpc512x_init_early,
        .init_IRQ               = mpc5121_ads_init_IRQ,
        .get_irq                = ipic_get_irq,
        .calibrate_decr         = generic_calibrate_decr,
diff --git a/arch/powerpc/platforms/512x/mpc512x.h b/arch/powerpc/platforms/512x/mpc512x.h
index 0a8e60023944..cc97f022d028 100644
--- a/arch/powerpc/platforms/512x/mpc512x.h
+++ b/arch/powerpc/platforms/512x/mpc512x.h
@@ -12,18 +12,12 @@
 #ifndef __MPC512X_H__
 #define __MPC512X_H__
 extern void __init mpc512x_init_IRQ(void);
+extern void __init mpc512x_init_early(void);
 extern void __init mpc512x_init(void);
+extern void __init mpc512x_setup_arch(void);
 extern int __init mpc5121_clk_init(void);
-void __init mpc512x_declare_of_platform_devices(void);
 extern const char *mpc512x_select_psc_compat(void);
+extern const char *mpc512x_select_reset_compat(void);
 extern void mpc512x_restart(char *cmd);
-#if defined(CONFIG_FB_FSL_DIU) || defined(CONFIG_FB_FSL_DIU_MODULE)
-void mpc512x_init_diu(void);
-void mpc512x_setup_diu(void);
-#else
-#define mpc512x_init_diu NULL
-#define mpc512x_setup_diu NULL
-#endif
 #endif                          /* __MPC512X_H__ */
diff --git a/arch/powerpc/platforms/512x/mpc512x_generic.c b/arch/powerpc/platforms/512x/mpc512x_generic.c
index 5fb919b30924..ce71408781a0 100644
--- a/arch/powerpc/platforms/512x/mpc512x_generic.c
+++ b/arch/powerpc/platforms/512x/mpc512x_generic.c
@@ -45,8 +45,8 @@ define_machine(mpc512x_generic) {
        .name                   = "MPC512x generic",
        .probe                  = mpc512x_generic_probe,
        .init                   = mpc512x_init,
-        .init_early             = mpc512x_init_diu,
+        .init_early             = mpc512x_init_early,
-        .setup_arch             = mpc512x_setup_diu,
+        .setup_arch             = mpc512x_setup_arch,
        .init_IRQ               = mpc512x_init_IRQ,
        .get_irq                = ipic_get_irq,
        .calibrate_decr         = generic_calibrate_decr,
diff --git a/arch/powerpc/platforms/512x/mpc512x_shared.c b/arch/powerpc/platforms/512x/mpc512x_shared.c
index 6eb94ab99d39..a82a41b4fd91 100644
--- a/arch/powerpc/platforms/512x/mpc512x_shared.c
+++ b/arch/powerpc/platforms/512x/mpc512x_shared.c
@@ -35,8 +35,10 @@ static struct mpc512x_reset_module __iomem *reset_module_base;
 static void __init mpc512x_restart_init(void)
 {
        struct device_node *np;
+        const char *reset_compat;
-        np = of_find_compatible_node(NULL, NULL, "fsl,mpc5121-reset");
+        reset_compat = mpc512x_select_reset_compat();
+        np = of_find_compatible_node(NULL, NULL, reset_compat);
        if (!np)
                return;
@@ -58,7 +60,7 @@ void mpc512x_restart(char *cmd)
                ;
 }
-#if defined(CONFIG_FB_FSL_DIU) || defined(CONFIG_FB_FSL_DIU_MODULE)
+#if IS_ENABLED(CONFIG_FB_FSL_DIU)
 struct fsl_diu_shared_fb {
        u8              gamma[0x300];   /* 32-bit aligned! */
@@ -355,6 +357,17 @@ const char *mpc512x_select_psc_compat(void)
        return NULL;
 }
+const char *mpc512x_select_reset_compat(void)
+{
+        if (of_machine_is_compatible("fsl,mpc5121"))
+                return "fsl,mpc5121-reset";
+        if (of_machine_is_compatible("fsl,mpc5125"))
+                return "fsl,mpc5125-reset";
+        return NULL;
+}
 static unsigned int __init get_fifo_size(struct device_node *np,
                                         char *prop_name)
 {
@@ -436,14 +449,26 @@ void __init mpc512x_psc_fifo_init(void)
        }
 }
+void __init mpc512x_init_early(void)
+{
+        mpc512x_restart_init();
+        if (IS_ENABLED(CONFIG_FB_FSL_DIU))
+                mpc512x_init_diu();
+}
 void __init mpc512x_init(void)
 {
        mpc5121_clk_init();
        mpc512x_declare_of_platform_devices();
-        mpc512x_restart_init();
        mpc512x_psc_fifo_init();
 }
+void __init mpc512x_setup_arch(void)
+{
+        if (IS_ENABLED(CONFIG_FB_FSL_DIU))
+                mpc512x_setup_diu();
+}
 /**
 * mpc512x_cs_config - Setup chip select configuration
 * @cs: chip select number
diff --git a/arch/powerpc/platforms/512x/pdm360ng.c b/arch/powerpc/platforms/512x/pdm360ng.c
index 0575e858291c..24b314d7bd5f 100644
--- a/arch/powerpc/platforms/512x/pdm360ng.c
+++ b/arch/powerpc/platforms/512x/pdm360ng.c
@@ -119,9 +119,9 @@ static int __init pdm360ng_probe(void)
 define_machine(pdm360ng) {
        .name                   = "PDM360NG",
        .probe                  = pdm360ng_probe,
-        .setup_arch             = mpc512x_setup_diu,
+        .setup_arch             = mpc512x_setup_arch,
        .init                   = pdm360ng_init,
-        .init_early             = mpc512x_init_diu,
+        .init_early             = mpc512x_init_early,
        .init_IRQ               = mpc512x_init_IRQ,
        .get_irq                = ipic_get_irq,
        .calibrate_decr         = generic_calibrate_decr,
diff --git a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
index 624cb51d19c9..7bc315822935 100644
--- a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
+++ b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
@@ -231,17 +231,7 @@ static struct i2c_driver mcu_driver = {
        .id_table = mcu_ids,
 };
-static int __init mcu_init(void)
+module_i2c_driver(mcu_driver);
-{
-        return i2c_add_driver(&mcu_driver);
-}
-module_init(mcu_init);
-static void __exit mcu_exit(void)
-{
-        i2c_del_driver(&mcu_driver);
-}
-module_exit(mcu_exit);
 MODULE_DESCRIPTION("Power Management and GPIO expander driver for "
                   "MPC8349E-mITX-compatible MCU");
diff --git a/arch/powerpc/platforms/85xx/p5020_ds.c b/arch/powerpc/platforms/85xx/p5020_ds.c
index 753a42c29d4d..39cfa4044e6c 100644
--- a/arch/powerpc/platforms/85xx/p5020_ds.c
+++ b/arch/powerpc/platforms/85xx/p5020_ds.c
@@ -75,12 +75,7 @@ define_machine(p5020_ds) {
 #ifdef CONFIG_PCI
        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
 #endif
-/* coreint doesn't play nice with lazy EE, use legacy mpic for now */
-#ifdef CONFIG_PPC64
-        .get_irq                = mpic_get_irq,
-#else
        .get_irq                = mpic_get_coreint_irq,
-#endif
        .restart                = fsl_rstcr_restart,
        .calibrate_decr         = generic_calibrate_decr,
        .progress               = udbg_progress,
diff --git a/arch/powerpc/platforms/85xx/p5040_ds.c b/arch/powerpc/platforms/85xx/p5040_ds.c
index 11381851828e..f70e74cddf97 100644
--- a/arch/powerpc/platforms/85xx/p5040_ds.c
+++ b/arch/powerpc/platforms/85xx/p5040_ds.c
@@ -66,12 +66,7 @@ define_machine(p5040_ds) {
 #ifdef CONFIG_PCI
        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
 #endif
-/* coreint doesn't play nice with lazy EE, use legacy mpic for now */
-#ifdef CONFIG_PPC64
-        .get_irq                = mpic_get_irq,
-#else
        .get_irq                = mpic_get_coreint_irq,
-#endif
        .restart                = fsl_rstcr_restart,
        .calibrate_decr         = generic_calibrate_decr,
        .progress               = udbg_progress,
diff --git a/arch/powerpc/platforms/85xx/smp.c b/arch/powerpc/platforms/85xx/smp.c
index 6a1759939c6b..5ced4f5bb2b2 100644
--- a/arch/powerpc/platforms/85xx/smp.c
+++ b/arch/powerpc/platforms/85xx/smp.c
@@ -99,7 +99,7 @@ static void mpc85xx_take_timebase(void)
 }
 #ifdef CONFIG_HOTPLUG_CPU
-static void __cpuinit smp_85xx_mach_cpu_die(void)
+static void smp_85xx_mach_cpu_die(void)
 {
        unsigned int cpu = smp_processor_id();
        u32 tmp;
@@ -141,7 +141,7 @@ static inline u32 read_spin_table_addr_l(void *spin_table)
        return in_be32(&((struct epapr_spin_table *)spin_table)->addr_l);
 }
-static int __cpuinit smp_85xx_kick_cpu(int nr)
+static int smp_85xx_kick_cpu(int nr)
 {
        unsigned long flags;
        const u64 *cpu_rel_addr;
@@ -362,7 +362,7 @@ static void mpc85xx_smp_machine_kexec(struct kimage *image)
 }
 #endif /* CONFIG_KEXEC */
-static void __cpuinit smp_85xx_setup_cpu(int cpu_nr)
+static void smp_85xx_setup_cpu(int cpu_nr)
 {
        if (smp_85xx_ops.probe == smp_mpic_probe)
                mpic_setup_this_cpu();
diff --git a/arch/powerpc/platforms/85xx/t4240_qds.c b/arch/powerpc/platforms/85xx/t4240_qds.c
index 5998e9f33304..91ead6b1b8af 100644
--- a/arch/powerpc/platforms/85xx/t4240_qds.c
+++ b/arch/powerpc/platforms/85xx/t4240_qds.c
@@ -75,12 +75,7 @@ define_machine(t4240_qds) {
 #ifdef CONFIG_PCI
        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
 #endif
-/* coreint doesn't play nice with lazy EE, use legacy mpic for now */
-#ifdef CONFIG_PPC64
-        .get_irq                = mpic_get_irq,
-#else
        .get_irq                = mpic_get_coreint_irq,
-#endif
        .restart                = fsl_rstcr_restart,
        .calibrate_decr         = generic_calibrate_decr,
        .progress               = udbg_progress,
diff --git a/arch/powerpc/platforms/8xx/m8xx_setup.c b/arch/powerpc/platforms/8xx/m8xx_setup.c
index 1e121088826f..587a2828b06c 100644
--- a/arch/powerpc/platforms/8xx/m8xx_setup.c
+++ b/arch/powerpc/platforms/8xx/m8xx_setup.c
@@ -43,6 +43,7 @@ static irqreturn_t timebase_interrupt(int irq, void *dev)
 static struct irqaction tbint_irqaction = {
        .handler = timebase_interrupt,
+        .flags = IRQF_NO_THREAD,
        .name = "tbint",
 };
@@ -218,19 +219,12 @@ void mpc8xx_restart(char *cmd)
 static void cpm_cascade(unsigned int irq, struct irq_desc *desc)
 {
-        struct irq_chip *chip;
+        struct irq_chip *chip = irq_desc_get_chip(desc);
-        int cascade_irq;
+        int cascade_irq = cpm_get_irq();
-        if ((cascade_irq = cpm_get_irq()) >= 0) {
-                struct irq_desc *cdesc = irq_to_desc(cascade_irq);
+        if (cascade_irq >= 0)
                generic_handle_irq(cascade_irq);
-                chip = irq_desc_get_chip(cdesc);
-                chip->irq_eoi(&cdesc->irq_data);
-        }
-        chip = irq_desc_get_chip(desc);
        chip->irq_eoi(&desc->irq_data);
 }
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index e17cdfc5ba40..d703775bda30 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -86,6 +86,27 @@ config MPIC
        bool
        default n
+config MPIC_TIMER
+        bool "MPIC Global Timer"
+        depends on MPIC && FSL_SOC
+        default n
+        help
+          The MPIC global timer is a hardware timer inside the
+          Freescale PIC complying with OpenPIC standard. When the
+          specified interval times out, the hardware timer generates
+          an interrupt. The driver currently is only tested on fsl
+          chip, but it can potentially support other global timers
+          complying with the OpenPIC standard.
+config FSL_MPIC_TIMER_WAKEUP
+        tristate "Freescale MPIC global timer wakeup driver"
+        depends on FSL_SOC &&  MPIC_TIMER && PM
+        default n
+        help
+          The driver provides a way to wake up the system by MPIC
+          timer.
+          e.g. "echo 5 > /sys/devices/system/mpic/timer_wakeup"
 config PPC_EPAPR_HV_PIC
        bool
        default n
@@ -164,6 +185,11 @@ config IBMEBUS
        help
          Bus device driver for GX bus based adapters.
+config EEH
+        bool
+        depends on (PPC_POWERNV || PPC_PSERIES) && PCI
+        default y
 config PPC_MPC106
        bool
        default n
diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index 7819c40a6bc3..47d9a03dd415 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -71,6 +71,7 @@ config PPC_BOOK3S_64
        select PPC_FPU
        select PPC_HAVE_PMU_SUPPORT
        select SYS_SUPPORTS_HUGETLBFS
+        select HAVE_ARCH_TRANSPARENT_HUGEPAGE if PPC_64K_PAGES
 config PPC_BOOK3E_64
        bool "Embedded processors"
diff --git a/arch/powerpc/platforms/cell/beat_htab.c b/arch/powerpc/platforms/cell/beat_htab.c
index 246e1d8b3af3..c34ee4e60873 100644
--- a/arch/powerpc/platforms/cell/beat_htab.c
+++ b/arch/powerpc/platforms/cell/beat_htab.c
@@ -185,7 +185,8 @@ static void beat_lpar_hptab_clear(void)
 static long beat_lpar_hpte_updatepp(unsigned long slot,
                                    unsigned long newpp,
                                    unsigned long vpn,
-                                    int psize, int ssize, int local)
+                                    int psize, int apsize,
+                                    int ssize, int local)
 {
        unsigned long lpar_rc;
        u64 dummy0, dummy1;
@@ -274,7 +275,8 @@ static void beat_lpar_hpte_updateboltedpp(unsigned long newpp,
 }
 static void beat_lpar_hpte_invalidate(unsigned long slot, unsigned long vpn,
-                                         int psize, int ssize, int local)
+                                      int psize, int apsize,
+                                      int ssize, int local)
 {
        unsigned long want_v;
        unsigned long lpar_rc;
@@ -364,9 +366,10 @@ static long beat_lpar_hpte_insert_v3(unsigned long hpte_group,
 * already zero.  For now I am paranoid.
 */
 static long beat_lpar_hpte_updatepp_v3(unsigned long slot,
-                                    unsigned long newpp,
+                                       unsigned long newpp,
-                                    unsigned long vpn,
+                                       unsigned long vpn,
-                                    int psize, int ssize, int local)
+                                       int psize, int apsize,
+                                       int ssize, int local)
 {
        unsigned long lpar_rc;
        unsigned long want_v;
@@ -394,7 +397,8 @@ static long beat_lpar_hpte_updatepp_v3(unsigned long slot,
 }
 static void beat_lpar_hpte_invalidate_v3(unsigned long slot, unsigned long vpn,
-                                         int psize, int ssize, int local)
+                                         int psize, int apsize,
+                                         int ssize, int local)
 {
        unsigned long want_v;
        unsigned long lpar_rc;
diff --git a/arch/powerpc/platforms/cell/smp.c b/arch/powerpc/platforms/cell/smp.c
index d35dbbc8ec79..f75f6fcac729 100644
--- a/arch/powerpc/platforms/cell/smp.c
+++ b/arch/powerpc/platforms/cell/smp.c
@@ -142,7 +142,7 @@ static int smp_cell_cpu_bootable(unsigned int nr)
         * during boot if the user requests it.  Odd-numbered
         * cpus are assumed to be secondary threads.
         */
-        if (system_state < SYSTEM_RUNNING &&
+        if (system_state == SYSTEM_BOOTING &&
            cpu_has_feature(CPU_FTR_SMT) &&
            !smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
                return 0;
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index bdb738a69e41..49c9f9501c21 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -885,7 +885,7 @@ static int smp_core99_cpu_notify(struct notifier_block *self,
        return NOTIFY_OK;
 }
-static struct notifier_block __cpuinitdata smp_core99_cpu_nb = {
+static struct notifier_block smp_core99_cpu_nb = {
        .notifier_call  = smp_core99_cpu_notify,
 };
 #endif /* CONFIG_HOTPLUG_CPU */
diff --git a/arch/powerpc/platforms/powernv/Makefile b/arch/powerpc/platforms/powernv/Makefile
index bcc3cb48a44e..7fe595152478 100644
--- a/arch/powerpc/platforms/powernv/Makefile
+++ b/arch/powerpc/platforms/powernv/Makefile
@@ -3,3 +3,4 @@ obj-y			+= opal-rtc.o opal-nvram.o
 obj-$(CONFIG_SMP)       += smp.o
 obj-$(CONFIG_PCI)       += pci.o pci-p5ioc2.o pci-ioda.o
+obj-$(CONFIG_EEH)       += eeh-ioda.o eeh-powernv.o
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
new file mode 100644
index 000000000000..0cd1c4a71755
--- /dev/null
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -0,0 +1,916 @@
+/*
+ * The file intends to implement the functions needed by EEH, which is
+ * built on IODA compliant chip. Actually, lots of functions related
+ * to EEH would be built based on the OPAL APIs.
+ *
+ * Copyright Benjamin Herrenschmidt & Gavin Shan, IBM Corporation 2013.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/bootmem.h>
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/kernel.h>
+#include <linux/msi.h>
+#include <linux/notifier.h>
+#include <linux/pci.h>
+#include <linux/string.h>
+#include <asm/eeh.h>
+#include <asm/eeh_event.h>
+#include <asm/io.h>
+#include <asm/iommu.h>
+#include <asm/msi_bitmap.h>
+#include <asm/opal.h>
+#include <asm/pci-bridge.h>
+#include <asm/ppc-pci.h>
+#include <asm/tce.h>
+#include "powernv.h"
+#include "pci.h"
+/* Debugging option */
+#ifdef IODA_EEH_DBG_ON
+#define IODA_EEH_DBG(args...)   pr_info(args)
+#else
+#define IODA_EEH_DBG(args...)
+#endif
+static char *hub_diag = NULL;
+static int ioda_eeh_nb_init = 0;
+static int ioda_eeh_event(struct notifier_block *nb,
+                          unsigned long events, void *change)
+{
+        uint64_t changed_evts = (uint64_t)change;
+        /* We simply send special EEH event */
+        if ((changed_evts & OPAL_EVENT_PCI_ERROR) &&
+            (events & OPAL_EVENT_PCI_ERROR))
+                eeh_send_failure_event(NULL);
+        return 0;
+}
+static struct notifier_block ioda_eeh_nb = {
+        .notifier_call  = ioda_eeh_event,
+        .next           = NULL,
+        .priority       = 0
+};
+#ifdef CONFIG_DEBUG_FS
+static int ioda_eeh_dbgfs_set(void *data, u64 val)
+{
+        struct pci_controller *hose = data;
+        struct pnv_phb *phb = hose->private_data;
+        out_be64(phb->regs + 0xD10, val);
+        return 0;
+}
+static int ioda_eeh_dbgfs_get(void *data, u64 *val)
+{
+        struct pci_controller *hose = data;
+        struct pnv_phb *phb = hose->private_data;
+        *val = in_be64(phb->regs + 0xD10);
+        return 0;
+}
+DEFINE_SIMPLE_ATTRIBUTE(ioda_eeh_dbgfs_ops, ioda_eeh_dbgfs_get,
+                        ioda_eeh_dbgfs_set, "0x%llx\n");
+#endif /* CONFIG_DEBUG_FS */
+/**
+ * ioda_eeh_post_init - Chip dependent post initialization
+ * @hose: PCI controller
+ *
+ * The function will be called after eeh PEs and devices
+ * have been built. That means the EEH is ready to supply
+ * service with I/O cache.
+ */
+static int ioda_eeh_post_init(struct pci_controller *hose)
+{
+        struct pnv_phb *phb = hose->private_data;
+        int ret;
+        /* Register OPAL event notifier */
+        if (!ioda_eeh_nb_init) {
+                ret = opal_notifier_register(&ioda_eeh_nb);
+                if (ret) {
+                        pr_err("%s: Can't register OPAL event notifier (%d)\n",
+                               __func__, ret);
+                        return ret;
+                }
+                ioda_eeh_nb_init = 1;
+        }
+        /* FIXME: Enable it for PHB3 later */
+        if (phb->type == PNV_PHB_IODA1) {
+                if (!hub_diag) {
+                        hub_diag = (char *)__get_free_page(GFP_KERNEL |
+                                                           __GFP_ZERO);
+                        if (!hub_diag) {
+                                pr_err("%s: Out of memory !\n",
+                                       __func__);
+                                return -ENOMEM;
+                        }
+                }
+#ifdef CONFIG_DEBUG_FS
+                if (phb->dbgfs)
+                        debugfs_create_file("err_injct", 0600,
+                                            phb->dbgfs, hose,
+                                            &ioda_eeh_dbgfs_ops);
+#endif
+                phb->eeh_state |= PNV_EEH_STATE_ENABLED;
+        }
+        return 0;
+}
+/**
+ * ioda_eeh_set_option - Set EEH operation or I/O setting
+ * @pe: EEH PE
+ * @option: options
+ *
+ * Enable or disable EEH option for the indicated PE. The
+ * function also can be used to enable I/O or DMA for the
+ * PE.
+ */
+static int ioda_eeh_set_option(struct eeh_pe *pe, int option)
+{
+        s64 ret;
+        u32 pe_no;
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        /* Check on PE number */
+        if (pe->addr < 0 || pe->addr >= phb->ioda.total_pe) {
+                pr_err("%s: PE address %x out of range [0, %x] "
+                       "on PHB#%x\n",
+                        __func__, pe->addr, phb->ioda.total_pe,
+                        hose->global_number);
+                return -EINVAL;
+        }
+        pe_no = pe->addr;
+        switch (option) {
+        case EEH_OPT_DISABLE:
+                ret = -EEXIST;
+                break;
+        case EEH_OPT_ENABLE:
+                ret = 0;
+                break;
+        case EEH_OPT_THAW_MMIO:
+                ret = opal_pci_eeh_freeze_clear(phb->opal_id, pe_no,
+                                OPAL_EEH_ACTION_CLEAR_FREEZE_MMIO);
+                if (ret) {
+                        pr_warning("%s: Failed to enable MMIO for "
+                                   "PHB#%x-PE#%x, err=%lld\n",
+                                __func__, hose->global_number, pe_no, ret);
+                        return -EIO;
+                }
+                break;
+        case EEH_OPT_THAW_DMA:
+                ret = opal_pci_eeh_freeze_clear(phb->opal_id, pe_no,
+                                OPAL_EEH_ACTION_CLEAR_FREEZE_DMA);
+                if (ret) {
+                        pr_warning("%s: Failed to enable DMA for "
+                                   "PHB#%x-PE#%x, err=%lld\n",
+                                __func__, hose->global_number, pe_no, ret);
+                        return -EIO;
+                }
+                break;
+        default:
+                pr_warning("%s: Invalid option %d\n", __func__, option);
+                return -EINVAL;
+        }
+        return ret;
+}
+/**
+ * ioda_eeh_get_state - Retrieve the state of PE
+ * @pe: EEH PE
+ *
+ * The PE's state should be retrieved from the PEEV, PEST
+ * IODA tables. Since the OPAL has exported the function
+ * to do it, it'd better to use that.
+ */
+static int ioda_eeh_get_state(struct eeh_pe *pe)
+{
+        s64 ret = 0;
+        u8 fstate;
+        u16 pcierr;
+        u32 pe_no;
+        int result;
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        /*
+         * Sanity check on PE address. The PHB PE address should
+         * be zero.
+         */
+        if (pe->addr < 0 || pe->addr >= phb->ioda.total_pe) {
+                pr_err("%s: PE address %x out of range [0, %x] "
+                       "on PHB#%x\n",
+                       __func__, pe->addr, phb->ioda.total_pe,
+                       hose->global_number);
+                return EEH_STATE_NOT_SUPPORT;
+        }
+        /* Retrieve PE status through OPAL */
+        pe_no = pe->addr;
+        ret = opal_pci_eeh_freeze_status(phb->opal_id, pe_no,
+                        &fstate, &pcierr, NULL);
+        if (ret) {
+                pr_err("%s: Failed to get EEH status on "
+                       "PHB#%x-PE#%x\n, err=%lld\n",
+                       __func__, hose->global_number, pe_no, ret);
+                return EEH_STATE_NOT_SUPPORT;
+        }
+        /* Check PHB status */
+        if (pe->type & EEH_PE_PHB) {
+                result = 0;
+                result &= ~EEH_STATE_RESET_ACTIVE;
+                if (pcierr != OPAL_EEH_PHB_ERROR) {
+                        result |= EEH_STATE_MMIO_ACTIVE;
+                        result |= EEH_STATE_DMA_ACTIVE;
+                        result |= EEH_STATE_MMIO_ENABLED;
+                        result |= EEH_STATE_DMA_ENABLED;
+                }
+                return result;
+        }
+        /* Parse result out */
+        result = 0;
+        switch (fstate) {
+        case OPAL_EEH_STOPPED_NOT_FROZEN:
+                result &= ~EEH_STATE_RESET_ACTIVE;
+                result |= EEH_STATE_MMIO_ACTIVE;
+                result |= EEH_STATE_DMA_ACTIVE;
+                result |= EEH_STATE_MMIO_ENABLED;
+                result |= EEH_STATE_DMA_ENABLED;
+                break;
+        case OPAL_EEH_STOPPED_MMIO_FREEZE:
+                result &= ~EEH_STATE_RESET_ACTIVE;
+                result |= EEH_STATE_DMA_ACTIVE;
+                result |= EEH_STATE_DMA_ENABLED;
+                break;
+        case OPAL_EEH_STOPPED_DMA_FREEZE:
+                result &= ~EEH_STATE_RESET_ACTIVE;
+                result |= EEH_STATE_MMIO_ACTIVE;
+                result |= EEH_STATE_MMIO_ENABLED;
+                break;
+        case OPAL_EEH_STOPPED_MMIO_DMA_FREEZE:
+                result &= ~EEH_STATE_RESET_ACTIVE;
+                break;
+        case OPAL_EEH_STOPPED_RESET:
+                result |= EEH_STATE_RESET_ACTIVE;
+                break;
+        case OPAL_EEH_STOPPED_TEMP_UNAVAIL:
+                result |= EEH_STATE_UNAVAILABLE;
+                break;
+        case OPAL_EEH_STOPPED_PERM_UNAVAIL:
+                result |= EEH_STATE_NOT_SUPPORT;
+                break;
+        default:
+                pr_warning("%s: Unexpected EEH status 0x%x "
+                           "on PHB#%x-PE#%x\n",
+                           __func__, fstate, hose->global_number, pe_no);
+        }
+        return result;
+}
+static int ioda_eeh_pe_clear(struct eeh_pe *pe)
+{
+        struct pci_controller *hose;
+        struct pnv_phb *phb;
+        u32 pe_no;
+        u8 fstate;
+        u16 pcierr;
+        s64 ret;
+        pe_no = pe->addr;
+        hose = pe->phb;
+        phb = pe->phb->private_data;
+        /* Clear the EEH error on the PE */
+        ret = opal_pci_eeh_freeze_clear(phb->opal_id,
+                        pe_no, OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+        if (ret) {
+                pr_err("%s: Failed to clear EEH error for "
+                       "PHB#%x-PE#%x, err=%lld\n",
+                       __func__, hose->global_number, pe_no, ret);
+                return -EIO;
+        }
+        /*
+         * Read the PE state back and verify that the frozen
+         * state has been removed.
+         */
+        ret = opal_pci_eeh_freeze_status(phb->opal_id, pe_no,
+                        &fstate, &pcierr, NULL);
+        if (ret) {
+                pr_err("%s: Failed to get EEH status on "
+                       "PHB#%x-PE#%x\n, err=%lld\n",
+                       __func__, hose->global_number, pe_no, ret);
+                return -EIO;
+        }
+        if (fstate != OPAL_EEH_STOPPED_NOT_FROZEN) {
+                pr_err("%s: Frozen state not cleared on "
+                       "PHB#%x-PE#%x, sts=%x\n",
+                       __func__, hose->global_number, pe_no, fstate);
+                return -EIO;
+        }
+        return 0;
+}
+static s64 ioda_eeh_phb_poll(struct pnv_phb *phb)
+{
+        s64 rc = OPAL_HARDWARE;
+        while (1) {
+                rc = opal_pci_poll(phb->opal_id);
+                if (rc <= 0)
+                        break;
+                msleep(rc);
+        }
+        return rc;
+}
+static int ioda_eeh_phb_reset(struct pci_controller *hose, int option)
+{
+        struct pnv_phb *phb = hose->private_data;
+        s64 rc = OPAL_HARDWARE;
+        pr_debug("%s: Reset PHB#%x, option=%d\n",
+                 __func__, hose->global_number, option);
+        /* Issue PHB complete reset request */
+        if (option == EEH_RESET_FUNDAMENTAL ||
+            option == EEH_RESET_HOT)
+                rc = opal_pci_reset(phb->opal_id,
+                                OPAL_PHB_COMPLETE,
+                                OPAL_ASSERT_RESET);
+        else if (option == EEH_RESET_DEACTIVATE)
+                rc = opal_pci_reset(phb->opal_id,
+                                OPAL_PHB_COMPLETE,
+                                OPAL_DEASSERT_RESET);
+        if (rc < 0)
+                goto out;
+        /*
+         * Poll state of the PHB until the request is done
+         * successfully.
+         */
+        rc = ioda_eeh_phb_poll(phb);
+out:
+        if (rc != OPAL_SUCCESS)
+                return -EIO;
+        return 0;
+}
+static int ioda_eeh_root_reset(struct pci_controller *hose, int option)
+{
+        struct pnv_phb *phb = hose->private_data;
+        s64 rc = OPAL_SUCCESS;
+        pr_debug("%s: Reset PHB#%x, option=%d\n",
+                 __func__, hose->global_number, option);
+        /*
+         * During the reset deassert time, we needn't care
+         * the reset scope because the firmware does nothing
+         * for fundamental or hot reset during deassert phase.
+         */
+        if (option == EEH_RESET_FUNDAMENTAL)
+                rc = opal_pci_reset(phb->opal_id,
+                                OPAL_PCI_FUNDAMENTAL_RESET,
+                                OPAL_ASSERT_RESET);
+        else if (option == EEH_RESET_HOT)
+                rc = opal_pci_reset(phb->opal_id,
+                                OPAL_PCI_HOT_RESET,
+                                OPAL_ASSERT_RESET);
+        else if (option == EEH_RESET_DEACTIVATE)
+                rc = opal_pci_reset(phb->opal_id,
+                                OPAL_PCI_HOT_RESET,
+                                OPAL_DEASSERT_RESET);
+        if (rc < 0)
+                goto out;
+        /* Poll state of the PHB until the request is done */
+        rc = ioda_eeh_phb_poll(phb);
+out:
+        if (rc != OPAL_SUCCESS)
+                return -EIO;
+        return 0;
+}
+static int ioda_eeh_bridge_reset(struct pci_controller *hose,
+                struct pci_dev *dev, int option)
+{
+        u16 ctrl;
+        pr_debug("%s: Reset device %04x:%02x:%02x.%01x with option %d\n",
+                 __func__, hose->global_number, dev->bus->number,
+                 PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn), option);
+        switch (option) {
+        case EEH_RESET_FUNDAMENTAL:
+        case EEH_RESET_HOT:
+                pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &ctrl);
+                ctrl |= PCI_BRIDGE_CTL_BUS_RESET;
+                pci_write_config_word(dev, PCI_BRIDGE_CONTROL, ctrl);
+                break;
+        case EEH_RESET_DEACTIVATE:
+                pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &ctrl);
+                ctrl &= ~PCI_BRIDGE_CTL_BUS_RESET;
+                pci_write_config_word(dev, PCI_BRIDGE_CONTROL, ctrl);
+                break;
+        }
+        return 0;
+}
+/**
+ * ioda_eeh_reset - Reset the indicated PE
+ * @pe: EEH PE
+ * @option: reset option
+ *
+ * Do reset on the indicated PE. For PCI bus sensitive PE,
+ * we need to reset the parent p2p bridge. The PHB has to
+ * be reinitialized if the p2p bridge is root bridge. For
+ * PCI device sensitive PE, we will try to reset the device
+ * through FLR. For now, we don't have OPAL APIs to do HARD
+ * reset yet, so all reset would be SOFT (HOT) reset.
+ */
+static int ioda_eeh_reset(struct eeh_pe *pe, int option)
+{
+        struct pci_controller *hose = pe->phb;
+        struct eeh_dev *edev;
+        struct pci_dev *dev;
+        int ret;
+        /*
+         * Anyway, we have to clear the problematic state for the
+         * corresponding PE. However, we needn't do it if the PE
+         * is PHB associated. That means the PHB is having fatal
+         * errors and it needs reset. Further more, the AIB interface
+         * isn't reliable any more.
+         */
+        if (!(pe->type & EEH_PE_PHB) &&
+            (option == EEH_RESET_HOT ||
+            option == EEH_RESET_FUNDAMENTAL)) {
+                ret = ioda_eeh_pe_clear(pe);
+                if (ret)
+                        return -EIO;
+        }
+        /*
+         * The rules applied to reset, either fundamental or hot reset:
+         *
+         * We always reset the direct upstream bridge of the PE. If the
+         * direct upstream bridge isn't root bridge, we always take hot
+         * reset no matter what option (fundamental or hot) is. Otherwise,
+         * we should do the reset according to the required option.
+         */
+        if (pe->type & EEH_PE_PHB) {
+                ret = ioda_eeh_phb_reset(hose, option);
+        } else {
+                if (pe->type & EEH_PE_DEVICE) {
+                        /*
+                         * If it's device PE, we didn't refer to the parent
+                         * PCI bus yet. So we have to figure it out indirectly.
+                         */
+                        edev = list_first_entry(&pe->edevs,
+                                        struct eeh_dev, list);
+                        dev = eeh_dev_to_pci_dev(edev);
+                        dev = dev->bus->self;
+                } else {
+                        /*
+                         * If it's bus PE, the parent PCI bus is already there
+                         * and just pick it up.
+                         */
+                        dev = pe->bus->self;
+                }
+                /*
+                 * Do reset based on the fact that the direct upstream bridge
+                 * is root bridge (port) or not.
+                 */
+                if (dev->bus->number == 0)
+                        ret = ioda_eeh_root_reset(hose, option);
+                else
+                        ret = ioda_eeh_bridge_reset(hose, dev, option);
+        }
+        return ret;
+}
+/**
+ * ioda_eeh_get_log - Retrieve error log
+ * @pe: EEH PE
+ * @severity: Severity level of the log
+ * @drv_log: buffer to store the log
+ * @len: space of the log buffer
+ *
+ * The function is used to retrieve error log from P7IOC.
+ */
+static int ioda_eeh_get_log(struct eeh_pe *pe, int severity,
+                            char *drv_log, unsigned long len)
+{
+        s64 ret;
+        unsigned long flags;
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        spin_lock_irqsave(&phb->lock, flags);
+        ret = opal_pci_get_phb_diag_data2(phb->opal_id,
+                        phb->diag.blob, PNV_PCI_DIAG_BUF_SIZE);
+        if (ret) {
+                spin_unlock_irqrestore(&phb->lock, flags);
+                pr_warning("%s: Failed to get log for PHB#%x-PE#%x\n",
+                           __func__, hose->global_number, pe->addr);
+                return -EIO;
+        }
+        /*
+         * FIXME: We probably need log the error in somewhere.
+         * Lets make it up in future.
+         */
+        /* pr_info("%s", phb->diag.blob); */
+        spin_unlock_irqrestore(&phb->lock, flags);
+        return 0;
+}
+/**
+ * ioda_eeh_configure_bridge - Configure the PCI bridges for the indicated PE
+ * @pe: EEH PE
+ *
+ * For particular PE, it might have included PCI bridges. In order
+ * to make the PE work properly, those PCI bridges should be configured
+ * correctly. However, we need do nothing on P7IOC since the reset
+ * function will do everything that should be covered by the function.
+ */
+static int ioda_eeh_configure_bridge(struct eeh_pe *pe)
+{
+        return 0;
+}
+static void ioda_eeh_hub_diag_common(struct OpalIoP7IOCErrorData *data)
+{
+        /* GEM */
+        pr_info("  GEM XFIR:        %016llx\n", data->gemXfir);
+        pr_info("  GEM RFIR:        %016llx\n", data->gemRfir);
+        pr_info("  GEM RIRQFIR:     %016llx\n", data->gemRirqfir);
+        pr_info("  GEM Mask:        %016llx\n", data->gemMask);
+        pr_info("  GEM RWOF:        %016llx\n", data->gemRwof);
+        /* LEM */
+        pr_info("  LEM FIR:         %016llx\n", data->lemFir);
+        pr_info("  LEM Error Mask:  %016llx\n", data->lemErrMask);
+        pr_info("  LEM Action 0:    %016llx\n", data->lemAction0);
+        pr_info("  LEM Action 1:    %016llx\n", data->lemAction1);
+        pr_info("  LEM WOF:         %016llx\n", data->lemWof);
+}
+static void ioda_eeh_hub_diag(struct pci_controller *hose)
+{
+        struct pnv_phb *phb = hose->private_data;
+        struct OpalIoP7IOCErrorData *data;
+        long rc;
+        data = (struct OpalIoP7IOCErrorData *)ioda_eeh_hub_diag;
+        rc = opal_pci_get_hub_diag_data(phb->hub_id, data, PAGE_SIZE);
+        if (rc != OPAL_SUCCESS) {
+                pr_warning("%s: Failed to get HUB#%llx diag-data (%ld)\n",
+                           __func__, phb->hub_id, rc);
+                return;
+        }
+        switch (data->type) {
+        case OPAL_P7IOC_DIAG_TYPE_RGC:
+                pr_info("P7IOC diag-data for RGC\n\n");
+                ioda_eeh_hub_diag_common(data);
+                pr_info("  RGC Status:      %016llx\n", data->rgc.rgcStatus);
+                pr_info("  RGC LDCP:        %016llx\n", data->rgc.rgcLdcp);
+                break;
+        case OPAL_P7IOC_DIAG_TYPE_BI:
+                pr_info("P7IOC diag-data for BI %s\n\n",
+                        data->bi.biDownbound ? "Downbound" : "Upbound");
+                ioda_eeh_hub_diag_common(data);
+                pr_info("  BI LDCP 0:       %016llx\n", data->bi.biLdcp0);
+                pr_info("  BI LDCP 1:       %016llx\n", data->bi.biLdcp1);
+                pr_info("  BI LDCP 2:       %016llx\n", data->bi.biLdcp2);
+                pr_info("  BI Fence Status: %016llx\n", data->bi.biFenceStatus);
+                break;
+        case OPAL_P7IOC_DIAG_TYPE_CI:
+                pr_info("P7IOC diag-data for CI Port %d\\nn",
+                        data->ci.ciPort);
+                ioda_eeh_hub_diag_common(data);
+                pr_info("  CI Port Status:  %016llx\n", data->ci.ciPortStatus);
+                pr_info("  CI Port LDCP:    %016llx\n", data->ci.ciPortLdcp);
+                break;
+        case OPAL_P7IOC_DIAG_TYPE_MISC:
+                pr_info("P7IOC diag-data for MISC\n\n");
+                ioda_eeh_hub_diag_common(data);
+                break;
+        case OPAL_P7IOC_DIAG_TYPE_I2C:
+                pr_info("P7IOC diag-data for I2C\n\n");
+                ioda_eeh_hub_diag_common(data);
+                break;
+        default:
+                pr_warning("%s: Invalid type of HUB#%llx diag-data (%d)\n",
+                           __func__, phb->hub_id, data->type);
+        }
+}
+static void ioda_eeh_p7ioc_phb_diag(struct pci_controller *hose,
+                                    struct OpalIoPhbErrorCommon *common)
+{
+        struct OpalIoP7IOCPhbErrorData *data;
+        int i;
+        data = (struct OpalIoP7IOCPhbErrorData *)common;
+        pr_info("P7IOC PHB#%x Diag-data (Version: %d)\n\n",
+                hose->global_number, common->version);
+        pr_info("  brdgCtl:              %08x\n", data->brdgCtl);
+        pr_info("  portStatusReg:        %08x\n", data->portStatusReg);
+        pr_info("  rootCmplxStatus:      %08x\n", data->rootCmplxStatus);
+        pr_info("  busAgentStatus:       %08x\n", data->busAgentStatus);
+        pr_info("  deviceStatus:         %08x\n", data->deviceStatus);
+        pr_info("  slotStatus:           %08x\n", data->slotStatus);
+        pr_info("  linkStatus:           %08x\n", data->linkStatus);
+        pr_info("  devCmdStatus:         %08x\n", data->devCmdStatus);
+        pr_info("  devSecStatus:         %08x\n", data->devSecStatus);
+        pr_info("  rootErrorStatus:      %08x\n", data->rootErrorStatus);
+        pr_info("  uncorrErrorStatus:    %08x\n", data->uncorrErrorStatus);
+        pr_info("  corrErrorStatus:      %08x\n", data->corrErrorStatus);
+        pr_info("  tlpHdr1:              %08x\n", data->tlpHdr1);
+        pr_info("  tlpHdr2:              %08x\n", data->tlpHdr2);
+        pr_info("  tlpHdr3:              %08x\n", data->tlpHdr3);
+        pr_info("  tlpHdr4:              %08x\n", data->tlpHdr4);
+        pr_info("  sourceId:             %08x\n", data->sourceId);
+        pr_info("  errorClass:           %016llx\n", data->errorClass);
+        pr_info("  correlator:           %016llx\n", data->correlator);
+        pr_info("  p7iocPlssr:           %016llx\n", data->p7iocPlssr);
+        pr_info("  p7iocCsr:             %016llx\n", data->p7iocCsr);
+        pr_info("  lemFir:               %016llx\n", data->lemFir);
+        pr_info("  lemErrorMask:         %016llx\n", data->lemErrorMask);
+        pr_info("  lemWOF:               %016llx\n", data->lemWOF);
+        pr_info("  phbErrorStatus:       %016llx\n", data->phbErrorStatus);
+        pr_info("  phbFirstErrorStatus:  %016llx\n", data->phbFirstErrorStatus);
+        pr_info("  phbErrorLog0:         %016llx\n", data->phbErrorLog0);
+        pr_info("  phbErrorLog1:         %016llx\n", data->phbErrorLog1);
+        pr_info("  mmioErrorStatus:      %016llx\n", data->mmioErrorStatus);
+        pr_info("  mmioFirstErrorStatus: %016llx\n", data->mmioFirstErrorStatus);
+        pr_info("  mmioErrorLog0:        %016llx\n", data->mmioErrorLog0);
+        pr_info("  mmioErrorLog1:        %016llx\n", data->mmioErrorLog1);
+        pr_info("  dma0ErrorStatus:      %016llx\n", data->dma0ErrorStatus);
+        pr_info("  dma0FirstErrorStatus: %016llx\n", data->dma0FirstErrorStatus);
+        pr_info("  dma0ErrorLog0:        %016llx\n", data->dma0ErrorLog0);
+        pr_info("  dma0ErrorLog1:        %016llx\n", data->dma0ErrorLog1);
+        pr_info("  dma1ErrorStatus:      %016llx\n", data->dma1ErrorStatus);
+        pr_info("  dma1FirstErrorStatus: %016llx\n", data->dma1FirstErrorStatus);
+        pr_info("  dma1ErrorLog0:        %016llx\n", data->dma1ErrorLog0);
+        pr_info("  dma1ErrorLog1:        %016llx\n", data->dma1ErrorLog1);
+        for (i = 0; i < OPAL_P7IOC_NUM_PEST_REGS; i++) {
+                if ((data->pestA[i] >> 63) == 0 &&
+                    (data->pestB[i] >> 63) == 0)
+                        continue;
+                pr_info("  PE[%3d] PESTA:        %016llx\n", i, data->pestA[i]);
+                pr_info("          PESTB:        %016llx\n", data->pestB[i]);
+        }
+}
+static void ioda_eeh_phb_diag(struct pci_controller *hose)
+{
+        struct pnv_phb *phb = hose->private_data;
+        struct OpalIoPhbErrorCommon *common;
+        long rc;
+        common = (struct OpalIoPhbErrorCommon *)phb->diag.blob;
+        rc = opal_pci_get_phb_diag_data2(phb->opal_id, common, PAGE_SIZE);
+        if (rc != OPAL_SUCCESS) {
+                pr_warning("%s: Failed to get diag-data for PHB#%x (%ld)\n",
+                            __func__, hose->global_number, rc);
+                return;
+        }
+        switch (common->ioType) {
+        case OPAL_PHB_ERROR_DATA_TYPE_P7IOC:
+                ioda_eeh_p7ioc_phb_diag(hose, common);
+                break;
+        default:
+                pr_warning("%s: Unrecognized I/O chip %d\n",
+                           __func__, common->ioType);
+        }
+}
+static int ioda_eeh_get_phb_pe(struct pci_controller *hose,
+                               struct eeh_pe **pe)
+{
+        struct eeh_pe *phb_pe;
+        phb_pe = eeh_phb_pe_get(hose);
+        if (!phb_pe) {
+                pr_warning("%s Can't find PE for PHB#%d\n",
+                           __func__, hose->global_number);
+                return -EEXIST;
+        }
+        *pe = phb_pe;
+        return 0;
+}
+static int ioda_eeh_get_pe(struct pci_controller *hose,
+                           u16 pe_no, struct eeh_pe **pe)
+{
+        struct eeh_pe *phb_pe, *dev_pe;
+        struct eeh_dev dev;
+        /* Find the PHB PE */
+        if (ioda_eeh_get_phb_pe(hose, &phb_pe))
+                return -EEXIST;
+        /* Find the PE according to PE# */
+        memset(&dev, 0, sizeof(struct eeh_dev));
+        dev.phb = hose;
+        dev.pe_config_addr = pe_no;
+        dev_pe = eeh_pe_get(&dev);
+        if (!dev_pe) {
+                pr_warning("%s: Can't find PE for PHB#%x - PE#%x\n",
+                           __func__, hose->global_number, pe_no);
+                return -EEXIST;
+        }
+        *pe = dev_pe;
+        return 0;
+}
+/**
+ * ioda_eeh_next_error - Retrieve next error for EEH core to handle
+ * @pe: The affected PE
+ *
+ * The function is expected to be called by EEH core while it gets
+ * special EEH event (without binding PE). The function calls to
+ * OPAL APIs for next error to handle. The informational error is
+ * handled internally by platform. However, the dead IOC, dead PHB,
+ * fenced PHB and frozen PE should be handled by EEH core eventually.
+ */
+static int ioda_eeh_next_error(struct eeh_pe **pe)
+{
+        struct pci_controller *hose, *tmp;
+        struct pnv_phb *phb;
+        u64 frozen_pe_no;
+        u16 err_type, severity;
+        long rc;
+        int ret = 1;
+        /*
+         * While running here, it's safe to purge the event queue.
+         * And we should keep the cached OPAL notifier event sychronized
+         * between the kernel and firmware.
+         */
+        eeh_remove_event(NULL);
+        opal_notifier_update_evt(OPAL_EVENT_PCI_ERROR, 0x0ul);
+        list_for_each_entry_safe(hose, tmp, &hose_list, list_node) {
+                /*
+                 * If the subordinate PCI buses of the PHB has been
+                 * removed, we needn't take care of it any more.
+                 */
+                phb = hose->private_data;
+                if (phb->eeh_state & PNV_EEH_STATE_REMOVED)
+                        continue;
+                rc = opal_pci_next_error(phb->opal_id,
+                                &frozen_pe_no, &err_type, &severity);
+                /* If OPAL API returns error, we needn't proceed */
+                if (rc != OPAL_SUCCESS) {
+                        IODA_EEH_DBG("%s: Invalid return value on "
+                                     "PHB#%x (0x%lx) from opal_pci_next_error",
+                                     __func__, hose->global_number, rc);
+                        continue;
+                }
+                /* If the PHB doesn't have error, stop processing */
+                if (err_type == OPAL_EEH_NO_ERROR ||
+                    severity == OPAL_EEH_SEV_NO_ERROR) {
+                        IODA_EEH_DBG("%s: No error found on PHB#%x\n",
+                                     __func__, hose->global_number);
+                        continue;
+                }
+                /*
+                 * Processing the error. We're expecting the error with
+                 * highest priority reported upon multiple errors on the
+                 * specific PHB.
+                 */
+                IODA_EEH_DBG("%s: Error (%d, %d, %d) on PHB#%x\n",
+                        err_type, severity, pe_no, hose->global_number);
+                switch (err_type) {
+                case OPAL_EEH_IOC_ERROR:
+                        if (severity == OPAL_EEH_SEV_IOC_DEAD) {
+                                list_for_each_entry_safe(hose, tmp,
+                                                &hose_list, list_node) {
+                                        phb = hose->private_data;
+                                        phb->eeh_state |= PNV_EEH_STATE_REMOVED;
+                                }
+                                pr_err("EEH: dead IOC detected\n");
+                                ret = 4;
+                                goto out;
+                        } else if (severity == OPAL_EEH_SEV_INF) {
+                                pr_info("EEH: IOC informative error "
+                                        "detected\n");
+                                ioda_eeh_hub_diag(hose);
+                        }
+                        break;
+                case OPAL_EEH_PHB_ERROR:
+                        if (severity == OPAL_EEH_SEV_PHB_DEAD) {
+                                if (ioda_eeh_get_phb_pe(hose, pe))
+                                        break;
+                                pr_err("EEH: dead PHB#%x detected\n",
+                                        hose->global_number);
+                                phb->eeh_state |= PNV_EEH_STATE_REMOVED;
+                                ret = 3;
+                                goto out;
+                        } else if (severity == OPAL_EEH_SEV_PHB_FENCED) {
+                                if (ioda_eeh_get_phb_pe(hose, pe))
+                                        break;
+                                pr_err("EEH: fenced PHB#%x detected\n",
+                                        hose->global_number);
+                                ret = 2;
+                                goto out;
+                        } else if (severity == OPAL_EEH_SEV_INF) {
+                                pr_info("EEH: PHB#%x informative error "
+                                        "detected\n",
+                                        hose->global_number);
+                                ioda_eeh_phb_diag(hose);
+                        }
+                        break;
+                case OPAL_EEH_PE_ERROR:
+                        if (ioda_eeh_get_pe(hose, frozen_pe_no, pe))
+                                break;
+                        pr_err("EEH: Frozen PE#%x on PHB#%x detected\n",
+                                (*pe)->addr, (*pe)->phb->global_number);
+                        ret = 1;
+                        goto out;
+                }
+        }
+        ret = 0;
+out:
+        return ret;
+}
+struct pnv_eeh_ops ioda_eeh_ops = {
+        .post_init              = ioda_eeh_post_init,
+        .set_option             = ioda_eeh_set_option,
+        .get_state              = ioda_eeh_get_state,
+        .reset                  = ioda_eeh_reset,
+        .get_log                = ioda_eeh_get_log,
+        .configure_bridge       = ioda_eeh_configure_bridge,
+        .next_error             = ioda_eeh_next_error
+};
diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
new file mode 100644
index 000000000000..969cce73055a
--- /dev/null
+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
@@ -0,0 +1,379 @@
+/*
+ * The file intends to implement the platform dependent EEH operations on
+ * powernv platform. Actually, the powernv was created in order to fully
+ * hypervisor support.
+ *
+ * Copyright Benjamin Herrenschmidt & Gavin Shan, IBM Corporation 2013.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/atomic.h>
+#include <linux/delay.h>
+#include <linux/export.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/msi.h>
+#include <linux/of.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/rbtree.h>
+#include <linux/sched.h>
+#include <linux/seq_file.h>
+#include <linux/spinlock.h>
+#include <asm/eeh.h>
+#include <asm/eeh_event.h>
+#include <asm/firmware.h>
+#include <asm/io.h>
+#include <asm/iommu.h>
+#include <asm/machdep.h>
+#include <asm/msi_bitmap.h>
+#include <asm/opal.h>
+#include <asm/ppc-pci.h>
+#include "powernv.h"
+#include "pci.h"
+/**
+ * powernv_eeh_init - EEH platform dependent initialization
+ *
+ * EEH platform dependent initialization on powernv
+ */
+static int powernv_eeh_init(void)
+{
+        /* We require OPALv3 */
+        if (!firmware_has_feature(FW_FEATURE_OPALv3)) {
+                pr_warning("%s: OPALv3 is required !\n", __func__);
+                return -EINVAL;
+        }
+        /* Set EEH probe mode */
+        eeh_probe_mode_set(EEH_PROBE_MODE_DEV);
+        return 0;
+}
+/**
+ * powernv_eeh_post_init - EEH platform dependent post initialization
+ *
+ * EEH platform dependent post initialization on powernv. When
+ * the function is called, the EEH PEs and devices should have
+ * been built. If the I/O cache staff has been built, EEH is
+ * ready to supply service.
+ */
+static int powernv_eeh_post_init(void)
+{
+        struct pci_controller *hose;
+        struct pnv_phb *phb;
+        int ret = 0;
+        list_for_each_entry(hose, &hose_list, list_node) {
+                phb = hose->private_data;
+                if (phb->eeh_ops && phb->eeh_ops->post_init) {
+                        ret = phb->eeh_ops->post_init(hose);
+                        if (ret)
+                                break;
+                }
+        }
+        return ret;
+}
+/**
+ * powernv_eeh_dev_probe - Do probe on PCI device
+ * @dev: PCI device
+ * @flag: unused
+ *
+ * When EEH module is installed during system boot, all PCI devices
+ * are checked one by one to see if it supports EEH. The function
+ * is introduced for the purpose. By default, EEH has been enabled
+ * on all PCI devices. That's to say, we only need do necessary
+ * initialization on the corresponding eeh device and create PE
+ * accordingly.
+ *
+ * It's notable that's unsafe to retrieve the EEH device through
+ * the corresponding PCI device. During the PCI device hotplug, which
+ * was possiblly triggered by EEH core, the binding between EEH device
+ * and the PCI device isn't built yet.
+ */
+static int powernv_eeh_dev_probe(struct pci_dev *dev, void *flag)
+{
+        struct pci_controller *hose = pci_bus_to_host(dev->bus);
+        struct pnv_phb *phb = hose->private_data;
+        struct device_node *dn = pci_device_to_OF_node(dev);
+        struct eeh_dev *edev = of_node_to_eeh_dev(dn);
+        /*
+         * When probing the root bridge, which doesn't have any
+         * subordinate PCI devices. We don't have OF node for
+         * the root bridge. So it's not reasonable to continue
+         * the probing.
+         */
+        if (!dn || !edev)
+                return 0;
+        /* Skip for PCI-ISA bridge */
+        if ((dev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+                return 0;
+        /* Initialize eeh device */
+        edev->class_code        = dev->class;
+        edev->mode              = 0;
+        edev->config_addr       = ((dev->bus->number << 8) | dev->devfn);
+        edev->pe_config_addr    = phb->bdfn_to_pe(phb, dev->bus, dev->devfn & 0xff);
+        /* Create PE */
+        eeh_add_to_parent_pe(edev);
+        /*
+         * Enable EEH explicitly so that we will do EEH check
+         * while accessing I/O stuff
+         *
+         * FIXME: Enable that for PHB3 later
+         */
+        if (phb->type == PNV_PHB_IODA1)
+                eeh_subsystem_enabled = 1;
+        /* Save memory bars */
+        eeh_save_bars(edev);
+        return 0;
+}
+/**
+ * powernv_eeh_set_option - Initialize EEH or MMIO/DMA reenable
+ * @pe: EEH PE
+ * @option: operation to be issued
+ *
+ * The function is used to control the EEH functionality globally.
+ * Currently, following options are support according to PAPR:
+ * Enable EEH, Disable EEH, Enable MMIO and Enable DMA
+ */
+static int powernv_eeh_set_option(struct eeh_pe *pe, int option)
+{
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        int ret = -EEXIST;
+        /*
+         * What we need do is pass it down for hardware
+         * implementation to handle it.
+         */
+        if (phb->eeh_ops && phb->eeh_ops->set_option)
+                ret = phb->eeh_ops->set_option(pe, option);
+        return ret;
+}
+/**
+ * powernv_eeh_get_pe_addr - Retrieve PE address
+ * @pe: EEH PE
+ *
+ * Retrieve the PE address according to the given tranditional
+ * PCI BDF (Bus/Device/Function) address.
+ */
+static int powernv_eeh_get_pe_addr(struct eeh_pe *pe)
+{
+        return pe->addr;
+}
+/**
+ * powernv_eeh_get_state - Retrieve PE state
+ * @pe: EEH PE
+ * @delay: delay while PE state is temporarily unavailable
+ *
+ * Retrieve the state of the specified PE. For IODA-compitable
+ * platform, it should be retrieved from IODA table. Therefore,
+ * we prefer passing down to hardware implementation to handle
+ * it.
+ */
+static int powernv_eeh_get_state(struct eeh_pe *pe, int *delay)
+{
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        int ret = EEH_STATE_NOT_SUPPORT;
+        if (phb->eeh_ops && phb->eeh_ops->get_state) {
+                ret = phb->eeh_ops->get_state(pe);
+                /*
+                 * If the PE state is temporarily unavailable,
+                 * to inform the EEH core delay for default
+                 * period (1 second)
+                 */
+                if (delay) {
+                        *delay = 0;
+                        if (ret & EEH_STATE_UNAVAILABLE)
+                                *delay = 1000;
+                }
+        }
+        return ret;
+}
+/**
+ * powernv_eeh_reset - Reset the specified PE
+ * @pe: EEH PE
+ * @option: reset option
+ *
+ * Reset the specified PE
+ */
+static int powernv_eeh_reset(struct eeh_pe *pe, int option)
+{
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        int ret = -EEXIST;
+        if (phb->eeh_ops && phb->eeh_ops->reset)
+                ret = phb->eeh_ops->reset(pe, option);
+        return ret;
+}
+/**
+ * powernv_eeh_wait_state - Wait for PE state
+ * @pe: EEH PE
+ * @max_wait: maximal period in microsecond
+ *
+ * Wait for the state of associated PE. It might take some time
+ * to retrieve the PE's state.
+ */
+static int powernv_eeh_wait_state(struct eeh_pe *pe, int max_wait)
+{
+        int ret;
+        int mwait;
+        while (1) {
+                ret = powernv_eeh_get_state(pe, &mwait);
+                /*
+                 * If the PE's state is temporarily unavailable,
+                 * we have to wait for the specified time. Otherwise,
+                 * the PE's state will be returned immediately.
+                 */
+                if (ret != EEH_STATE_UNAVAILABLE)
+                        return ret;
+                max_wait -= mwait;
+                if (max_wait <= 0) {
+                        pr_warning("%s: Timeout getting PE#%x's state (%d)\n",
+                                   __func__, pe->addr, max_wait);
+                        return EEH_STATE_NOT_SUPPORT;
+                }
+                msleep(mwait);
+        }
+        return EEH_STATE_NOT_SUPPORT;
+}
+/**
+ * powernv_eeh_get_log - Retrieve error log
+ * @pe: EEH PE
+ * @severity: temporary or permanent error log
+ * @drv_log: driver log to be combined with retrieved error log
+ * @len: length of driver log
+ *
+ * Retrieve the temporary or permanent error from the PE.
+ */
+static int powernv_eeh_get_log(struct eeh_pe *pe, int severity,
+                        char *drv_log, unsigned long len)
+{
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        int ret = -EEXIST;
+        if (phb->eeh_ops && phb->eeh_ops->get_log)
+                ret = phb->eeh_ops->get_log(pe, severity, drv_log, len);
+        return ret;
+}
+/**
+ * powernv_eeh_configure_bridge - Configure PCI bridges in the indicated PE
+ * @pe: EEH PE
+ *
+ * The function will be called to reconfigure the bridges included
+ * in the specified PE so that the mulfunctional PE would be recovered
+ * again.
+ */
+static int powernv_eeh_configure_bridge(struct eeh_pe *pe)
+{
+        struct pci_controller *hose = pe->phb;
+        struct pnv_phb *phb = hose->private_data;
+        int ret = 0;
+        if (phb->eeh_ops && phb->eeh_ops->configure_bridge)
+                ret = phb->eeh_ops->configure_bridge(pe);
+        return ret;
+}
+/**
+ * powernv_eeh_next_error - Retrieve next EEH error to handle
+ * @pe: Affected PE
+ *
+ * Using OPAL API, to retrieve next EEH error for EEH core to handle
+ */
+static int powernv_eeh_next_error(struct eeh_pe **pe)
+{
+        struct pci_controller *hose;
+        struct pnv_phb *phb = NULL;
+        list_for_each_entry(hose, &hose_list, list_node) {
+                phb = hose->private_data;
+                break;
+        }
+        if (phb && phb->eeh_ops->next_error)
+                return phb->eeh_ops->next_error(pe);
+        return -EEXIST;
+}
+static struct eeh_ops powernv_eeh_ops = {
+        .name                   = "powernv",
+        .init                   = powernv_eeh_init,
+        .post_init              = powernv_eeh_post_init,
+        .of_probe               = NULL,
+        .dev_probe              = powernv_eeh_dev_probe,
+        .set_option             = powernv_eeh_set_option,
+        .get_pe_addr            = powernv_eeh_get_pe_addr,
+        .get_state              = powernv_eeh_get_state,
+        .reset                  = powernv_eeh_reset,
+        .wait_state             = powernv_eeh_wait_state,
+        .get_log                = powernv_eeh_get_log,
+        .configure_bridge       = powernv_eeh_configure_bridge,
+        .read_config            = pnv_pci_cfg_read,
+        .write_config           = pnv_pci_cfg_write,
+        .next_error             = powernv_eeh_next_error
+};
+/**
+ * eeh_powernv_init - Register platform dependent EEH operations
+ *
+ * EEH initialization on powernv platform. This function should be
+ * called before any EEH related functions.
+ */
+static int __init eeh_powernv_init(void)
+{
+        int ret = -EINVAL;
+        if (!machine_is(powernv))
+                return ret;
+        ret = eeh_ops_register(&powernv_eeh_ops);
+        if (!ret)
+                pr_info("EEH: PowerNV platform initialized\n");
+        else
+                pr_info("EEH: Failed to initialize PowerNV platform (%d)\n", ret);
+        return ret;
+}
+early_initcall(eeh_powernv_init);
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index 6fabe92eafb6..e88863ffb135 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -107,4 +107,7 @@ OPAL_CALL(opal_pci_mask_pe_error,		OPAL_PCI_MASK_PE_ERROR);
 OPAL_CALL(opal_set_slot_led_status,             OPAL_SET_SLOT_LED_STATUS);
 OPAL_CALL(opal_get_epow_status,                 OPAL_GET_EPOW_STATUS);
 OPAL_CALL(opal_set_system_attention_led,        OPAL_SET_SYSTEM_ATTENTION_LED);
+OPAL_CALL(opal_pci_next_error,                  OPAL_PCI_NEXT_ERROR);
+OPAL_CALL(opal_pci_poll,                        OPAL_PCI_POLL);
 OPAL_CALL(opal_pci_msi_eoi,                     OPAL_PCI_MSI_EOI);
+OPAL_CALL(opal_pci_get_phb_diag_data2,          OPAL_PCI_GET_PHB_DIAG_DATA2);
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 628c564ceadb..106301fd2fa5 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -15,6 +15,7 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/interrupt.h>
+#include <linux/notifier.h>
 #include <linux/slab.h>
 #include <asm/opal.h>
 #include <asm/firmware.h>
@@ -31,6 +32,10 @@ static DEFINE_SPINLOCK(opal_write_lock);
 extern u64 opal_mc_secondary_handler[];
 static unsigned int *opal_irqs;
 static unsigned int opal_irq_count;
+static ATOMIC_NOTIFIER_HEAD(opal_notifier_head);
+static DEFINE_SPINLOCK(opal_notifier_lock);
+static uint64_t last_notified_mask = 0x0ul;
+static atomic_t opal_notifier_hold = ATOMIC_INIT(0);
 int __init early_init_dt_scan_opal(unsigned long node,
                                   const char *uname, int depth, void *data)
@@ -95,6 +100,68 @@ static int __init opal_register_exception_handlers(void)
 early_initcall(opal_register_exception_handlers);
+int opal_notifier_register(struct notifier_block *nb)
+{
+        if (!nb) {
+                pr_warning("%s: Invalid argument (%p)\n",
+                           __func__, nb);
+                return -EINVAL;
+        }
+        atomic_notifier_chain_register(&opal_notifier_head, nb);
+        return 0;
+}
+static void opal_do_notifier(uint64_t events)
+{
+        unsigned long flags;
+        uint64_t changed_mask;
+        if (atomic_read(&opal_notifier_hold))
+                return;
+        spin_lock_irqsave(&opal_notifier_lock, flags);
+        changed_mask = last_notified_mask ^ events;
+        last_notified_mask = events;
+        spin_unlock_irqrestore(&opal_notifier_lock, flags);
+        /*
+         * We feed with the event bits and changed bits for
+         * enough information to the callback.
+         */
+        atomic_notifier_call_chain(&opal_notifier_head,
+                                   events, (void *)changed_mask);
+}
+void opal_notifier_update_evt(uint64_t evt_mask,
+                              uint64_t evt_val)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&opal_notifier_lock, flags);
+        last_notified_mask &= ~evt_mask;
+        last_notified_mask |= evt_val;
+        spin_unlock_irqrestore(&opal_notifier_lock, flags);
+}
+void opal_notifier_enable(void)
+{
+        int64_t rc;
+        uint64_t evt = 0;
+        atomic_set(&opal_notifier_hold, 0);
+        /* Process pending events */
+        rc = opal_poll_events(&evt);
+        if (rc == OPAL_SUCCESS && evt)
+                opal_do_notifier(evt);
+}
+void opal_notifier_disable(void)
+{
+        atomic_set(&opal_notifier_hold, 1);
+}
 int opal_get_chars(uint32_t vtermno, char *buf, int count)
 {
        s64 len, rc;
@@ -297,7 +364,7 @@ static irqreturn_t opal_interrupt(int irq, void *data)
        opal_handle_interrupt(virq_to_hw(irq), &events);
-        /* XXX TODO: Do something with the events */
+        opal_do_notifier(events);
        return IRQ_HANDLED;
 }
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 9c9d15e4cdf2..49b57b9f835d 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/pci.h>
+#include <linux/debugfs.h>
 #include <linux/delay.h>
 #include <linux/string.h>
 #include <linux/init.h>
@@ -32,6 +33,7 @@
 #include <asm/iommu.h>
 #include <asm/tce.h>
 #include <asm/xics.h>
+#include <asm/debug.h>
 #include "powernv.h"
 #include "pci.h"
@@ -441,6 +443,17 @@ static void pnv_pci_ioda_dma_dev_setup(struct pnv_phb *phb, struct pci_dev *pdev
        set_iommu_table_base(&pdev->dev, &pe->tce32_table);
 }
+static void pnv_ioda_setup_bus_dma(struct pnv_ioda_pe *pe, struct pci_bus *bus)
+{
+        struct pci_dev *dev;
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                set_iommu_table_base(&dev->dev, &pe->tce32_table);
+                if (dev->subordinate)
+                        pnv_ioda_setup_bus_dma(pe, dev->subordinate);
+        }
+}
 static void pnv_pci_ioda1_tce_invalidate(struct iommu_table *tbl,
                                         u64 *startp, u64 *endp)
 {
@@ -595,6 +608,12 @@ static void pnv_pci_ioda_setup_dma_pe(struct pnv_phb *phb,
                               TCE_PCI_SWINV_PAIR;
        }
        iommu_init_table(tbl, phb->hose->node);
+        iommu_register_group(tbl, pci_domain_nr(pe->pbus), pe->pe_number);
+        if (pe->pdev)
+                set_iommu_table_base(&pe->pdev->dev, tbl);
+        else
+                pnv_ioda_setup_bus_dma(pe, pe->pbus);
        return;
 fail:
@@ -667,6 +686,11 @@ static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
        }
        iommu_init_table(tbl, phb->hose->node);
+        if (pe->pdev)
+                set_iommu_table_base(&pe->pdev->dev, tbl);
+        else
+                pnv_ioda_setup_bus_dma(pe, pe->pbus);
        return;
 fail:
        if (pe->tce32_seg >= 0)
@@ -968,11 +992,38 @@ static void pnv_pci_ioda_setup_DMA(void)
        }
 }
+static void pnv_pci_ioda_create_dbgfs(void)
+{
+#ifdef CONFIG_DEBUG_FS
+        struct pci_controller *hose, *tmp;
+        struct pnv_phb *phb;
+        char name[16];
+        list_for_each_entry_safe(hose, tmp, &hose_list, list_node) {
+                phb = hose->private_data;
+                sprintf(name, "PCI%04x", hose->global_number);
+                phb->dbgfs = debugfs_create_dir(name, powerpc_debugfs_root);
+                if (!phb->dbgfs)
+                        pr_warning("%s: Error on creating debugfs on PHB#%x\n",
+                                __func__, hose->global_number);
+        }
+#endif /* CONFIG_DEBUG_FS */
+}
 static void pnv_pci_ioda_fixup(void)
 {
        pnv_pci_ioda_setup_PEs();
        pnv_pci_ioda_setup_seg();
        pnv_pci_ioda_setup_DMA();
+        pnv_pci_ioda_create_dbgfs();
+#ifdef CONFIG_EEH
+        eeh_probe_mode_set(EEH_PROBE_MODE_DEV);
+        eeh_addr_cache_build();
+        eeh_init();
+#endif
 }
 /*
@@ -1049,7 +1100,8 @@ static void pnv_pci_ioda_shutdown(struct pnv_phb *phb)
                       OPAL_ASSERT_RESET);
 }
-void __init pnv_pci_init_ioda_phb(struct device_node *np, int ioda_type)
+void __init pnv_pci_init_ioda_phb(struct device_node *np,
+                                  u64 hub_id, int ioda_type)
 {
        struct pci_controller *hose;
        static int primary = 1;
@@ -1087,6 +1139,7 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np, int ioda_type)
        hose->first_busno = 0;
        hose->last_busno = 0xff;
        hose->private_data = phb;
+        phb->hub_id = hub_id;
        phb->opal_id = phb_id;
        phb->type = ioda_type;
@@ -1172,6 +1225,9 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np, int ioda_type)
                phb->ioda.io_size, phb->ioda.io_segsize);
        phb->hose->ops = &pnv_pci_ops;
+#ifdef CONFIG_EEH
+        phb->eeh_ops = &ioda_eeh_ops;
+#endif
        /* Setup RID -> PE mapping function */
        phb->bdfn_to_pe = pnv_ioda_bdfn_to_pe;
@@ -1212,7 +1268,7 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np, int ioda_type)
 void pnv_pci_init_ioda2_phb(struct device_node *np)
 {
-        pnv_pci_init_ioda_phb(np, PNV_PHB_IODA2);
+        pnv_pci_init_ioda_phb(np, 0, PNV_PHB_IODA2);
 }
 void __init pnv_pci_init_ioda_hub(struct device_node *np)
@@ -1235,6 +1291,6 @@ void __init pnv_pci_init_ioda_hub(struct device_node *np)
        for_each_child_of_node(np, phbn) {
                /* Look for IODA1 PHBs */
                if (of_device_is_compatible(phbn, "ibm,ioda-phb"))
-                        pnv_pci_init_ioda_phb(phbn, PNV_PHB_IODA1);
+                        pnv_pci_init_ioda_phb(phbn, hub_id, PNV_PHB_IODA1);
        }
 }
diff --git a/arch/powerpc/platforms/powernv/pci-p5ioc2.c b/arch/powerpc/platforms/powernv/pci-p5ioc2.c
index 92b37a0186c9..b68db6325c1b 100644
--- a/arch/powerpc/platforms/powernv/pci-p5ioc2.c
+++ b/arch/powerpc/platforms/powernv/pci-p5ioc2.c
@@ -86,13 +86,16 @@ static void pnv_pci_init_p5ioc2_msis(struct pnv_phb *phb) { }
 static void pnv_pci_p5ioc2_dma_dev_setup(struct pnv_phb *phb,
                                         struct pci_dev *pdev)
 {
-        if (phb->p5ioc2.iommu_table.it_map == NULL)
+        if (phb->p5ioc2.iommu_table.it_map == NULL) {
                iommu_init_table(&phb->p5ioc2.iommu_table, phb->hose->node);
+                iommu_register_group(&phb->p5ioc2.iommu_table,
+                                pci_domain_nr(phb->hose->bus), phb->opal_id);
+        }
        set_iommu_table_base(&pdev->dev, &phb->p5ioc2.iommu_table);
 }
-static void __init pnv_pci_init_p5ioc2_phb(struct device_node *np,
+static void __init pnv_pci_init_p5ioc2_phb(struct device_node *np, u64 hub_id,
                                           void *tce_mem, u64 tce_size)
 {
        struct pnv_phb *phb;
@@ -133,6 +136,7 @@ static void __init pnv_pci_init_p5ioc2_phb(struct device_node *np,
        phb->hose->first_busno = 0;
        phb->hose->last_busno = 0xff;
        phb->hose->private_data = phb;
+        phb->hub_id = hub_id;
        phb->opal_id = phb_id;
        phb->type = PNV_PHB_P5IOC2;
        phb->model = PNV_PHB_MODEL_P5IOC2;
@@ -226,7 +230,8 @@ void __init pnv_pci_init_p5ioc2_hub(struct device_node *np)
        for_each_child_of_node(np, phbn) {
                if (of_device_is_compatible(phbn, "ibm,p5ioc2-pcix") ||
                    of_device_is_compatible(phbn, "ibm,p5ioc2-pciex")) {
-                        pnv_pci_init_p5ioc2_phb(phbn, tce_mem, tce_per_phb);
+                        pnv_pci_init_p5ioc2_phb(phbn, hub_id,
+                                        tce_mem, tce_per_phb);
                        tce_mem += tce_per_phb;
                }
        }
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 277343cc6a3d..a28d3b5e6393 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -20,6 +20,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/msi.h>
+#include <linux/iommu.h>
 #include <asm/sections.h>
 #include <asm/io.h>
@@ -32,6 +33,8 @@
 #include <asm/iommu.h>
 #include <asm/tce.h>
 #include <asm/firmware.h>
+#include <asm/eeh_event.h>
+#include <asm/eeh.h>
 #include "powernv.h"
 #include "pci.h"
@@ -202,7 +205,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
        spin_lock_irqsave(&phb->lock, flags);
-        rc = opal_pci_get_phb_diag_data(phb->opal_id, phb->diag.blob, PNV_PCI_DIAG_BUF_SIZE);
+        rc = opal_pci_get_phb_diag_data2(phb->opal_id, phb->diag.blob,
+                                         PNV_PCI_DIAG_BUF_SIZE);
        has_diag = (rc == OPAL_SUCCESS);
        rc = opal_pci_eeh_freeze_clear(phb->opal_id, pe_no,
@@ -227,43 +231,50 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
        spin_unlock_irqrestore(&phb->lock, flags);
 }
-static void pnv_pci_config_check_eeh(struct pnv_phb *phb, struct pci_bus *bus,
+static void pnv_pci_config_check_eeh(struct pnv_phb *phb,
-                                     u32 bdfn)
+                                     struct device_node *dn)
 {
        s64     rc;
        u8      fstate;
        u16     pcierr;
        u32     pe_no;
-        /* Get PE# if we support IODA */
+        /*
-        pe_no = phb->bdfn_to_pe ? phb->bdfn_to_pe(phb, bus, bdfn & 0xff) : 0;
+         * Get the PE#. During the PCI probe stage, we might not
+         * setup that yet. So all ER errors should be mapped to
+         * PE#0
+         */
+        pe_no = PCI_DN(dn)->pe_number;
+        if (pe_no == IODA_INVALID_PE)
+                pe_no = 0;
        /* Read freeze status */
        rc = opal_pci_eeh_freeze_status(phb->opal_id, pe_no, &fstate, &pcierr,
                                        NULL);
        if (rc) {
-                pr_warning("PCI %d: Failed to read EEH status for PE#%d,"
+                pr_warning("%s: Can't read EEH status (PE#%d) for "
-                           " err %lld\n", phb->hose->global_number, pe_no, rc);
+                           "%s, err %lld\n",
+                           __func__, pe_no, dn->full_name, rc);
                return;
        }
-        cfg_dbg(" -> EEH check, bdfn=%04x PE%d fstate=%x\n",
+        cfg_dbg(" -> EEH check, bdfn=%04x PE#%d fstate=%x\n",
-                bdfn, pe_no, fstate);
+                (PCI_DN(dn)->busno << 8) | (PCI_DN(dn)->devfn),
+                pe_no, fstate);
        if (fstate != 0)
                pnv_pci_handle_eeh_config(phb, pe_no);
 }
-static int pnv_pci_read_config(struct pci_bus *bus,
+int pnv_pci_cfg_read(struct device_node *dn,
-                               unsigned int devfn,
+                     int where, int size, u32 *val)
-                               int where, int size, u32 *val)
 {
-        struct pci_controller *hose = pci_bus_to_host(bus);
+        struct pci_dn *pdn = PCI_DN(dn);
-        struct pnv_phb *phb = hose->private_data;
+        struct pnv_phb *phb = pdn->phb->private_data;
-        u32 bdfn = (((uint64_t)bus->number) << 8) | devfn;
+        u32 bdfn = (pdn->busno << 8) | pdn->devfn;
+#ifdef CONFIG_EEH
+        struct eeh_pe *phb_pe = NULL;
+#endif
        s64 rc;
-        if (hose == NULL)
-                return PCIBIOS_DEVICE_NOT_FOUND;
        switch (size) {
        case 1: {
                u8 v8;
@@ -287,28 +298,43 @@ static int pnv_pci_read_config(struct pci_bus *bus,
        default:
                return PCIBIOS_FUNC_NOT_SUPPORTED;
        }
-        cfg_dbg("pnv_pci_read_config bus: %x devfn: %x +%x/%x -> %08x\n",
+        cfg_dbg("%s: bus: %x devfn: %x +%x/%x -> %08x\n",
-                bus->number, devfn, where, size, *val);
+                __func__, pdn->busno, pdn->devfn, where, size, *val);
-        /* Check if the PHB got frozen due to an error (no response) */
+        /*
-        pnv_pci_config_check_eeh(phb, bus, bdfn);
+         * Check if the specified PE has been put into frozen
+         * state. On the other hand, we needn't do that while
+         * the PHB has been put into frozen state because of
+         * PHB-fatal errors.
+         */
+#ifdef CONFIG_EEH
+        phb_pe = eeh_phb_pe_get(pdn->phb);
+        if (phb_pe && (phb_pe->state & EEH_PE_ISOLATED))
+                return PCIBIOS_SUCCESSFUL;
+        if (phb->eeh_state & PNV_EEH_STATE_ENABLED) {
+                if (*val == EEH_IO_ERROR_VALUE(size) &&
+                    eeh_dev_check_failure(of_node_to_eeh_dev(dn)))
+                        return PCIBIOS_DEVICE_NOT_FOUND;
+        } else {
+                pnv_pci_config_check_eeh(phb, dn);
+        }
+#else
+        pnv_pci_config_check_eeh(phb, dn);
+#endif
        return PCIBIOS_SUCCESSFUL;
 }
-static int pnv_pci_write_config(struct pci_bus *bus,
+int pnv_pci_cfg_write(struct device_node *dn,
-                                unsigned int devfn,
+                      int where, int size, u32 val)
-                                int where, int size, u32 val)
 {
-        struct pci_controller *hose = pci_bus_to_host(bus);
+        struct pci_dn *pdn = PCI_DN(dn);
-        struct pnv_phb *phb = hose->private_data;
+        struct pnv_phb *phb = pdn->phb->private_data;
-        u32 bdfn = (((uint64_t)bus->number) << 8) | devfn;
+        u32 bdfn = (pdn->busno << 8) | pdn->devfn;
-        if (hose == NULL)
-                return PCIBIOS_DEVICE_NOT_FOUND;
-        cfg_dbg("pnv_pci_write_config bus: %x devfn: %x +%x/%x -> %08x\n",
+        cfg_dbg("%s: bus: %x devfn: %x +%x/%x -> %08x\n",
-                bus->number, devfn, where, size, val);
+                pdn->busno, pdn->devfn, where, size, val);
        switch (size) {
        case 1:
                opal_pci_config_write_byte(phb->opal_id, bdfn, where, val);
@@ -322,14 +348,54 @@ static int pnv_pci_write_config(struct pci_bus *bus,
        default:
                return PCIBIOS_FUNC_NOT_SUPPORTED;
        }
        /* Check if the PHB got frozen due to an error (no response) */
-        pnv_pci_config_check_eeh(phb, bus, bdfn);
+#ifdef CONFIG_EEH
+        if (!(phb->eeh_state & PNV_EEH_STATE_ENABLED))
+                pnv_pci_config_check_eeh(phb, dn);
+#else
+        pnv_pci_config_check_eeh(phb, dn);
+#endif
        return PCIBIOS_SUCCESSFUL;
 }
+static int pnv_pci_read_config(struct pci_bus *bus,
+                               unsigned int devfn,
+                               int where, int size, u32 *val)
+{
+        struct device_node *dn, *busdn = pci_bus_to_OF_node(bus);
+        struct pci_dn *pdn;
+        for (dn = busdn->child; dn; dn = dn->sibling) {
+                pdn = PCI_DN(dn);
+                if (pdn && pdn->devfn == devfn)
+                        return pnv_pci_cfg_read(dn, where, size, val);
+        }
+        *val = 0xFFFFFFFF;
+        return PCIBIOS_DEVICE_NOT_FOUND;
+}
+static int pnv_pci_write_config(struct pci_bus *bus,
+                                unsigned int devfn,
+                                int where, int size, u32 val)
+{
+        struct device_node *dn, *busdn = pci_bus_to_OF_node(bus);
+        struct pci_dn *pdn;
+        for (dn = busdn->child; dn; dn = dn->sibling) {
+                pdn = PCI_DN(dn);
+                if (pdn && pdn->devfn == devfn)
+                        return pnv_pci_cfg_write(dn, where, size, val);
+        }
+        return PCIBIOS_DEVICE_NOT_FOUND;
+}
 struct pci_ops pnv_pci_ops = {
-        .read = pnv_pci_read_config,
+        .read  = pnv_pci_read_config,
        .write = pnv_pci_write_config,
 };
@@ -412,6 +478,7 @@ static struct iommu_table *pnv_pci_setup_bml_iommu(struct pci_controller *hose)
        pnv_pci_setup_iommu_table(tbl, __va(be64_to_cpup(basep)),
                                  be32_to_cpup(sizep), 0);
        iommu_init_table(tbl, hose->node);
+        iommu_register_group(tbl, pci_domain_nr(hose->bus), 0);
        /* Deal with SW invalidated TCEs when needed (BML way) */
        swinvp = of_get_property(hose->dn, "linux,tce-sw-invalidate-info",
diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
index 25d76c4df50b..d633c64e05a1 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -66,15 +66,43 @@ struct pnv_ioda_pe {
        struct list_head        list;
 };
+/* IOC dependent EEH operations */
+#ifdef CONFIG_EEH
+struct pnv_eeh_ops {
+        int (*post_init)(struct pci_controller *hose);
+        int (*set_option)(struct eeh_pe *pe, int option);
+        int (*get_state)(struct eeh_pe *pe);
+        int (*reset)(struct eeh_pe *pe, int option);
+        int (*get_log)(struct eeh_pe *pe, int severity,
+                       char *drv_log, unsigned long len);
+        int (*configure_bridge)(struct eeh_pe *pe);
+        int (*next_error)(struct eeh_pe **pe);
+};
+#define PNV_EEH_STATE_ENABLED   (1 << 0)        /* EEH enabled  */
+#define PNV_EEH_STATE_REMOVED   (1 << 1)        /* PHB removed  */
+#endif /* CONFIG_EEH */
 struct pnv_phb {
        struct pci_controller   *hose;
        enum pnv_phb_type       type;
        enum pnv_phb_model      model;
+        u64                     hub_id;
        u64                     opal_id;
        void __iomem            *regs;
        int                     initialized;
        spinlock_t              lock;
+#ifdef CONFIG_EEH
+        struct pnv_eeh_ops      *eeh_ops;
+        int                     eeh_state;
+#endif
+#ifdef CONFIG_DEBUG_FS
+        struct dentry           *dbgfs;
+#endif
 #ifdef CONFIG_PCI_MSI
        unsigned int            msi_base;
        unsigned int            msi32_support;
@@ -150,7 +178,14 @@ struct pnv_phb {
 };
 extern struct pci_ops pnv_pci_ops;
+#ifdef CONFIG_EEH
+extern struct pnv_eeh_ops ioda_eeh_ops;
+#endif
+int pnv_pci_cfg_read(struct device_node *dn,
+                     int where, int size, u32 *val);
+int pnv_pci_cfg_write(struct device_node *dn,
+                      int where, int size, u32 val);
 extern void pnv_pci_setup_iommu_table(struct iommu_table *tbl,
                                      void *tce_mem, u64 tce_size,
                                      u64 dma_offset);
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index d4459bfc92f7..84438af96c05 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -93,6 +93,8 @@ static void  __noreturn pnv_restart(char *cmd)
 {
        long rc = OPAL_BUSY;
+        opal_notifier_disable();
        while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                rc = opal_cec_reboot();
                if (rc == OPAL_BUSY_EVENT)
@@ -108,6 +110,8 @@ static void __noreturn pnv_power_off(void)
 {
        long rc = OPAL_BUSY;
+        opal_notifier_disable();
        while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                rc = opal_cec_power_down(0);
                if (rc == OPAL_BUSY_EVENT)
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 88c9459c3e07..89e3857af4e0 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -40,7 +40,7 @@
 #define DBG(fmt...)
 #endif
-static void __cpuinit pnv_smp_setup_cpu(int cpu)
+static void pnv_smp_setup_cpu(int cpu)
 {
        if (cpu != boot_cpuid)
                xics_setup_cpu();
@@ -51,7 +51,7 @@ static int pnv_smp_cpu_bootable(unsigned int nr)
        /* Special case - we inhibit secondary thread startup
         * during boot if the user requests it.
         */
-        if (system_state < SYSTEM_RUNNING && cpu_has_feature(CPU_FTR_SMT)) {
+        if (system_state == SYSTEM_BOOTING && cpu_has_feature(CPU_FTR_SMT)) {
                if (!smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
                        return 0;
                if (smt_enabled_at_boot
diff --git a/arch/powerpc/platforms/ps3/htab.c b/arch/powerpc/platforms/ps3/htab.c
index 177a2f70700c..3e270e3412ae 100644
--- a/arch/powerpc/platforms/ps3/htab.c
+++ b/arch/powerpc/platforms/ps3/htab.c
@@ -109,7 +109,8 @@ static long ps3_hpte_remove(unsigned long hpte_group)
 }
 static long ps3_hpte_updatepp(unsigned long slot, unsigned long newpp,
-        unsigned long vpn, int psize, int ssize, int local)
+                              unsigned long vpn, int psize, int apsize,
+                              int ssize, int local)
 {
        int result;
        u64 hpte_v, want_v, hpte_rs;
@@ -162,7 +163,7 @@ static void ps3_hpte_updateboltedpp(unsigned long newpp, unsigned long ea,
 }
 static void ps3_hpte_invalidate(unsigned long slot, unsigned long vpn,
-        int psize, int ssize, int local)
+                                int psize, int apsize, int ssize, int local)
 {
        unsigned long flags;
        int result;
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 4459eff7a75a..1bd3399146ed 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -33,11 +33,6 @@ config PPC_SPLPAR
          processors, that is, which share physical processors between
          two or more partitions.
-config EEH
-        bool
-        depends on PPC_PSERIES && PCI
-        default y
 config PSERIES_MSI
       bool
       depends on PCI_MSI && EEH
diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
index 53866e537a92..8ae010381316 100644
--- a/arch/powerpc/platforms/pseries/Makefile
+++ b/arch/powerpc/platforms/pseries/Makefile
@@ -6,9 +6,7 @@ obj-y			:= lpar.o hvCall.o nvram.o reconfig.o \
                           firmware.o power.o dlpar.o mobility.o
 obj-$(CONFIG_SMP)       += smp.o
 obj-$(CONFIG_SCANLOG)   += scanlog.o
-obj-$(CONFIG_EEH)       += eeh.o eeh_pe.o eeh_dev.o eeh_cache.o \
+obj-$(CONFIG_EEH)       += eeh_pseries.o
-                           eeh_driver.o eeh_event.o eeh_sysfs.o \
-                           eeh_pseries.o
 obj-$(CONFIG_KEXEC)     += kexec.o
 obj-$(CONFIG_PCI)       += pci.o pci_dlpar.o
 obj-$(CONFIG_PSERIES_MSI)       += msi.o
diff --git a/arch/powerpc/platforms/pseries/io_event_irq.c b/arch/powerpc/platforms/pseries/io_event_irq.c
index ef9d9d84c7d5..5ea88d1541f7 100644
--- a/arch/powerpc/platforms/pseries/io_event_irq.c
+++ b/arch/powerpc/platforms/pseries/io_event_irq.c
@@ -115,7 +115,7 @@ static struct pseries_io_event * ioei_find_event(struct rtas_error_log *elog)
 *   by scope or event type alone. For example, Torrent ISR route change
 *   event is reported with scope 0x00 (Not Applicatable) rather than
 *   0x3B (Torrent-hub). It is better to let the clients to identify
- *   who owns the the event.
+ *   who owns the event.
 */
 static irqreturn_t ioei_interrupt(int irq, void *dev_id)
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 86ae364900d6..23fc1dcf4434 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -614,6 +614,7 @@ static void pci_dma_bus_setup_pSeries(struct pci_bus *bus)
        iommu_table_setparms(pci->phb, dn, tbl);
        pci->iommu_table = iommu_init_table(tbl, pci->phb->node);
+        iommu_register_group(tbl, pci_domain_nr(bus), 0);
        /* Divide the rest (1.75GB) among the children */
        pci->phb->dma_window_size = 0x80000000ul;
@@ -658,6 +659,7 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus)
                                   ppci->phb->node);
                iommu_table_setparms_lpar(ppci->phb, pdn, tbl, dma_window);
                ppci->iommu_table = iommu_init_table(tbl, ppci->phb->node);
+                iommu_register_group(tbl, pci_domain_nr(bus), 0);
                pr_debug("  created table: %p\n", ppci->iommu_table);
        }
 }
@@ -684,6 +686,7 @@ static void pci_dma_dev_setup_pSeries(struct pci_dev *dev)
                                   phb->node);
                iommu_table_setparms(phb, dn, tbl);
                PCI_DN(dn)->iommu_table = iommu_init_table(tbl, phb->node);
+                iommu_register_group(tbl, pci_domain_nr(phb->bus), 0);
                set_iommu_table_base(&dev->dev, PCI_DN(dn)->iommu_table);
                return;
        }
@@ -1184,6 +1187,7 @@ static void pci_dma_dev_setup_pSeriesLP(struct pci_dev *dev)
                                   pci->phb->node);
                iommu_table_setparms_lpar(pci->phb, pdn, tbl, dma_window);
                pci->iommu_table = iommu_init_table(tbl, pci->phb->node);
+                iommu_register_group(tbl, pci_domain_nr(pci->phb->bus), 0);
                pr_debug("  created table: %p\n", pci->iommu_table);
        } else {
                pr_debug("  found DMA window, table: %p\n", pci->iommu_table);
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 6d62072a7d5a..02d6e21619bb 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -45,6 +45,13 @@
 #include "plpar_wrappers.h"
 #include "pseries.h"
+/* Flag bits for H_BULK_REMOVE */
+#define HBR_REQUEST     0x4000000000000000UL
+#define HBR_RESPONSE    0x8000000000000000UL
+#define HBR_END         0xc000000000000000UL
+#define HBR_AVPN        0x0200000000000000UL
+#define HBR_ANDCOND     0x0100000000000000UL
 /* in hvCall.S */
 EXPORT_SYMBOL(plpar_hcall);
@@ -64,6 +71,9 @@ void vpa_init(int cpu)
        if (cpu_has_feature(CPU_FTR_ALTIVEC))
                lppaca_of(cpu).vmxregs_in_use = 1;
+        if (cpu_has_feature(CPU_FTR_ARCH_207S))
+                lppaca_of(cpu).ebb_regs_in_use = 1;
        addr = __pa(&lppaca_of(cpu));
        ret = register_vpa(hwcpu, addr);
@@ -240,7 +250,8 @@ static void pSeries_lpar_hptab_clear(void)
 static long pSeries_lpar_hpte_updatepp(unsigned long slot,
                                       unsigned long newpp,
                                       unsigned long vpn,
-                                       int psize, int ssize, int local)
+                                       int psize, int apsize,
+                                       int ssize, int local)
 {
        unsigned long lpar_rc;
        unsigned long flags = (newpp & 7) | H_AVPN;
@@ -328,7 +339,8 @@ static void pSeries_lpar_hpte_updateboltedpp(unsigned long newpp,
 }
 static void pSeries_lpar_hpte_invalidate(unsigned long slot, unsigned long vpn,
-                                         int psize, int ssize, int local)
+                                         int psize, int apsize,
+                                         int ssize, int local)
 {
        unsigned long want_v;
        unsigned long lpar_rc;
@@ -345,6 +357,113 @@ static void pSeries_lpar_hpte_invalidate(unsigned long slot, unsigned long vpn,
        BUG_ON(lpar_rc != H_SUCCESS);
 }
+/*
+ * Limit iterations holding pSeries_lpar_tlbie_lock to 3. We also need
+ * to make sure that we avoid bouncing the hypervisor tlbie lock.
+ */
+#define PPC64_HUGE_HPTE_BATCH 12
+static void __pSeries_lpar_hugepage_invalidate(unsigned long *slot,
+                                             unsigned long *vpn, int count,
+                                             int psize, int ssize)
+{
+        unsigned long param[8];
+        int i = 0, pix = 0, rc;
+        unsigned long flags = 0;
+        int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
+        if (lock_tlbie)
+                spin_lock_irqsave(&pSeries_lpar_tlbie_lock, flags);
+        for (i = 0; i < count; i++) {
+                if (!firmware_has_feature(FW_FEATURE_BULK_REMOVE)) {
+                        pSeries_lpar_hpte_invalidate(slot[i], vpn[i], psize, 0,
+                                                     ssize, 0);
+                } else {
+                        param[pix] = HBR_REQUEST | HBR_AVPN | slot[i];
+                        param[pix+1] = hpte_encode_avpn(vpn[i], psize, ssize);
+                        pix += 2;
+                        if (pix == 8) {
+                                rc = plpar_hcall9(H_BULK_REMOVE, param,
+                                                  param[0], param[1], param[2],
+                                                  param[3], param[4], param[5],
+                                                  param[6], param[7]);
+                                BUG_ON(rc != H_SUCCESS);
+                                pix = 0;
+                        }
+                }
+        }
+        if (pix) {
+                param[pix] = HBR_END;
+                rc = plpar_hcall9(H_BULK_REMOVE, param, param[0], param[1],
+                                  param[2], param[3], param[4], param[5],
+                                  param[6], param[7]);
+                BUG_ON(rc != H_SUCCESS);
+        }
+        if (lock_tlbie)
+                spin_unlock_irqrestore(&pSeries_lpar_tlbie_lock, flags);
+}
+static void pSeries_lpar_hugepage_invalidate(struct mm_struct *mm,
+                                       unsigned char *hpte_slot_array,
+                                       unsigned long addr, int psize)
+{
+        int ssize = 0, i, index = 0;
+        unsigned long s_addr = addr;
+        unsigned int max_hpte_count, valid;
+        unsigned long vpn_array[PPC64_HUGE_HPTE_BATCH];
+        unsigned long slot_array[PPC64_HUGE_HPTE_BATCH];
+        unsigned long shift, hidx, vpn = 0, vsid, hash, slot;
+        shift = mmu_psize_defs[psize].shift;
+        max_hpte_count = 1U << (PMD_SHIFT - shift);
+        for (i = 0; i < max_hpte_count; i++) {
+                valid = hpte_valid(hpte_slot_array, i);
+                if (!valid)
+                        continue;
+                hidx =  hpte_hash_index(hpte_slot_array, i);
+                /* get the vpn */
+                addr = s_addr + (i * (1ul << shift));
+                if (!is_kernel_addr(addr)) {
+                        ssize = user_segment_size(addr);
+                        vsid = get_vsid(mm->context.id, addr, ssize);
+                        WARN_ON(vsid == 0);
+                } else {
+                        vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
+                        ssize = mmu_kernel_ssize;
+                }
+                vpn = hpt_vpn(addr, vsid, ssize);
+                hash = hpt_hash(vpn, shift, ssize);
+                if (hidx & _PTEIDX_SECONDARY)
+                        hash = ~hash;
+                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+                slot += hidx & _PTEIDX_GROUP_IX;
+                slot_array[index] = slot;
+                vpn_array[index] = vpn;
+                if (index == PPC64_HUGE_HPTE_BATCH - 1) {
+                        /*
+                         * Now do a bluk invalidate
+                         */
+                        __pSeries_lpar_hugepage_invalidate(slot_array,
+                                                           vpn_array,
+                                                           PPC64_HUGE_HPTE_BATCH,
+                                                           psize, ssize);
+                        index = 0;
+                } else
+                        index++;
+        }
+        if (index)
+                __pSeries_lpar_hugepage_invalidate(slot_array, vpn_array,
+                                                   index, psize, ssize);
+}
 static void pSeries_lpar_hpte_removebolted(unsigned long ea,
                                           int psize, int ssize)
 {
@@ -356,17 +475,12 @@ static void pSeries_lpar_hpte_removebolted(unsigned long ea,
        slot = pSeries_lpar_hpte_find(vpn, psize, ssize);
        BUG_ON(slot == -1);
+        /*
-        pSeries_lpar_hpte_invalidate(slot, vpn, psize, ssize, 0);
+         * lpar doesn't use the passed actual page size
+         */
+        pSeries_lpar_hpte_invalidate(slot, vpn, psize, 0, ssize, 0);
 }
-/* Flag bits for H_BULK_REMOVE */
-#define HBR_REQUEST     0x4000000000000000UL
-#define HBR_RESPONSE    0x8000000000000000UL
-#define HBR_END         0xc000000000000000UL
-#define HBR_AVPN        0x0200000000000000UL
-#define HBR_ANDCOND     0x0100000000000000UL
 /*
 * Take a spinlock around flushes to avoid bouncing the hypervisor tlbie
 * lock.
@@ -400,8 +514,11 @@ static void pSeries_lpar_flush_hash_range(unsigned long number, int local)
                        slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
                        slot += hidx & _PTEIDX_GROUP_IX;
                        if (!firmware_has_feature(FW_FEATURE_BULK_REMOVE)) {
+                                /*
+                                 * lpar doesn't use the passed actual page size
+                                 */
                                pSeries_lpar_hpte_invalidate(slot, vpn, psize,
-                                                             ssize, local);
+                                                             0, ssize, local);
                        } else {
                                param[pix] = HBR_REQUEST | HBR_AVPN | slot;
                                param[pix+1] = hpte_encode_avpn(vpn, psize,
@@ -452,6 +569,7 @@ void __init hpte_init_lpar(void)
        ppc_md.hpte_removebolted = pSeries_lpar_hpte_removebolted;
        ppc_md.flush_hash_range = pSeries_lpar_flush_hash_range;
        ppc_md.hpte_clear_all   = pSeries_lpar_hptab_clear;
+        ppc_md.hugepage_invalidate = pSeries_lpar_hugepage_invalidate;
 }
 #ifdef CONFIG_PPC_SMLPAR
diff --git a/arch/powerpc/platforms/pseries/nvram.c b/arch/powerpc/platforms/pseries/nvram.c
index 8733a86ad52e..9f8671a44551 100644
--- a/arch/powerpc/platforms/pseries/nvram.c
+++ b/arch/powerpc/platforms/pseries/nvram.c
@@ -18,6 +18,7 @@
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/kmsg_dump.h>
+#include <linux/pstore.h>
 #include <linux/ctype.h>
 #include <linux/zlib.h>
 #include <asm/uaccess.h>
@@ -29,6 +30,13 @@
 /* Max bytes to read/write in one go */
 #define NVRW_CNT 0x20
+/*
+ * Set oops header version to distingush between old and new format header.
+ * lnx,oops-log partition max size is 4000, header version > 4000 will
+ * help in identifying new header.
+ */
+#define OOPS_HDR_VERSION 5000
 static unsigned int nvram_size;
 static int nvram_fetch, nvram_store;
 static char nvram_buf[NVRW_CNT];        /* assume this is in the first 4GB */
@@ -45,20 +53,23 @@ struct nvram_os_partition {
        int min_size;   /* minimum acceptable size (0 means req_size) */
        long size;      /* size of data portion (excluding err_log_info) */
        long index;     /* offset of data portion of partition */
+        bool os_partition; /* partition initialized by OS, not FW */
 };
 static struct nvram_os_partition rtas_log_partition = {
        .name = "ibm,rtas-log",
        .req_size = 2079,
        .min_size = 1055,
-        .index = -1
+        .index = -1,
+        .os_partition = true
 };
 static struct nvram_os_partition oops_log_partition = {
        .name = "lnx,oops-log",
        .req_size = 4000,
        .min_size = 2000,
-        .index = -1
+        .index = -1,
+        .os_partition = true
 };
 static const char *pseries_nvram_os_partitions[] = {
@@ -67,6 +78,12 @@ static const char *pseries_nvram_os_partitions[] = {
        NULL
 };
+struct oops_log_info {
+        u16 version;
+        u16 report_length;
+        u64 timestamp;
+} __attribute__((packed));
 static void oops_to_nvram(struct kmsg_dumper *dumper,
                          enum kmsg_dump_reason reason);
@@ -83,28 +100,28 @@ static unsigned long last_unread_rtas_event;	/* timestamp */
 * big_oops_buf[] holds the uncompressed text we're capturing.
 *
- * oops_buf[] holds the compressed text, preceded by a prefix.
+ * oops_buf[] holds the compressed text, preceded by a oops header.
- * The prefix is just a u16 holding the length of the compressed* text.
+ * oops header has u16 holding the version of oops header (to differentiate
- * (*Or uncompressed, if compression fails.)  oops_buf[] gets written
+ * between old and new format header) followed by u16 holding the length of
- * to NVRAM.
+ * the compressed* text (*Or uncompressed, if compression fails.) and u64
+ * holding the timestamp. oops_buf[] gets written to NVRAM.
 *
- * oops_len points to the prefix.  oops_data points to the compressed text.
+ * oops_log_info points to the header. oops_data points to the compressed text.
 *
 * +- oops_buf
- * |            +- oops_data
+ * |                                   +- oops_data
- * v            v
+ * v                                   v
- * +------------+-----------------------------------------------+
+ * +-----------+-----------+-----------+------------------------+
- * | length     | text                                          |
+ * | version   | length    | timestamp | text                   |
- * | (2 bytes)  | (oops_data_sz bytes)                          |
+ * | (2 bytes) | (2 bytes) | (8 bytes) | (oops_data_sz bytes)   |
- * +------------+-----------------------------------------------+
+ * +-----------+-----------+-----------+------------------------+
 * ^
- * +- oops_len
+ * +- oops_log_info
 *
 * We preallocate these buffers during init to avoid kmalloc during oops/panic.
 */
 static size_t big_oops_buf_sz;
 static char *big_oops_buf, *oops_buf;
-static u16 *oops_len;
 static char *oops_data;
 static size_t oops_data_sz;
@@ -114,6 +131,30 @@ static size_t oops_data_sz;
 #define MEM_LEVEL 4
 static struct z_stream_s stream;
+#ifdef CONFIG_PSTORE
+static struct nvram_os_partition of_config_partition = {
+        .name = "of-config",
+        .index = -1,
+        .os_partition = false
+};
+static struct nvram_os_partition common_partition = {
+        .name = "common",
+        .index = -1,
+        .os_partition = false
+};
+static enum pstore_type_id nvram_type_ids[] = {
+        PSTORE_TYPE_DMESG,
+        PSTORE_TYPE_PPC_RTAS,
+        PSTORE_TYPE_PPC_OF,
+        PSTORE_TYPE_PPC_COMMON,
+        -1
+};
+static int read_type;
+static unsigned long last_rtas_event;
+#endif
 static ssize_t pSeries_nvram_read(char *buf, size_t count, loff_t *index)
 {
        unsigned int i;
@@ -275,48 +316,72 @@ int nvram_write_error_log(char * buff, int length,
 {
        int rc = nvram_write_os_partition(&rtas_log_partition, buff, length,
                                                err_type, error_log_cnt);
-        if (!rc)
+        if (!rc) {
                last_unread_rtas_event = get_seconds();
+#ifdef CONFIG_PSTORE
+                last_rtas_event = get_seconds();
+#endif
+        }
        return rc;
 }
-/* nvram_read_error_log
+/* nvram_read_partition
 *
- * Reads nvram for error log for at most 'length'
+ * Reads nvram partition for at most 'length'
 */
-int nvram_read_error_log(char * buff, int length,
+int nvram_read_partition(struct nvram_os_partition *part, char *buff,
-                         unsigned int * err_type, unsigned int * error_log_cnt)
+                        int length, unsigned int *err_type,
+                        unsigned int *error_log_cnt)
 {
        int rc;
        loff_t tmp_index;
        struct err_log_info info;
        
-        if (rtas_log_partition.index == -1)
+        if (part->index == -1)
                return -1;
-        if (length > rtas_log_partition.size)
+        if (length > part->size)
-                length = rtas_log_partition.size;
+                length = part->size;
-        tmp_index = rtas_log_partition.index;
+        tmp_index = part->index;
-        rc = ppc_md.nvram_read((char *)&info, sizeof(struct err_log_info), &tmp_index);
+        if (part->os_partition) {
-        if (rc <= 0) {
+                rc = ppc_md.nvram_read((char *)&info,
-                printk(KERN_ERR "nvram_read_error_log: Failed nvram_read (%d)\n", rc);
+                                        sizeof(struct err_log_info),
-                return rc;
+                                        &tmp_index);
+                if (rc <= 0) {
+                        pr_err("%s: Failed nvram_read (%d)\n", __FUNCTION__,
+                                                                        rc);
+                        return rc;
+                }
        }
        rc = ppc_md.nvram_read(buff, length, &tmp_index);
        if (rc <= 0) {
-                printk(KERN_ERR "nvram_read_error_log: Failed nvram_read (%d)\n", rc);
+                pr_err("%s: Failed nvram_read (%d)\n", __FUNCTION__, rc);
                return rc;
        }
-        *error_log_cnt = info.seq_num;
+        if (part->os_partition) {
-        *err_type = info.error_type;
+                *error_log_cnt = info.seq_num;
+                *err_type = info.error_type;
+        }
        return 0;
 }
+/* nvram_read_error_log
+ *
+ * Reads nvram for error log for at most 'length'
+ */
+int nvram_read_error_log(char *buff, int length,
+                        unsigned int *err_type, unsigned int *error_log_cnt)
+{
+        return nvram_read_partition(&rtas_log_partition, buff, length,
+                                                err_type, error_log_cnt);
+}
 /* This doesn't actually zero anything, but it sets the event_logged
 * word to tell that this event is safely in syslog.
 */
@@ -405,6 +470,349 @@ static int __init pseries_nvram_init_os_partition(struct nvram_os_partition
        return 0;
 }
+/*
+ * Are we using the ibm,rtas-log for oops/panic reports?  And if so,
+ * would logging this oops/panic overwrite an RTAS event that rtas_errd
+ * hasn't had a chance to read and process?  Return 1 if so, else 0.
+ *
+ * We assume that if rtas_errd hasn't read the RTAS event in
+ * NVRAM_RTAS_READ_TIMEOUT seconds, it's probably not going to.
+ */
+static int clobbering_unread_rtas_event(void)
+{
+        return (oops_log_partition.index == rtas_log_partition.index
+                && last_unread_rtas_event
+                && get_seconds() - last_unread_rtas_event <=
+                                                NVRAM_RTAS_READ_TIMEOUT);
+}
+/* Derived from logfs_compress() */
+static int nvram_compress(const void *in, void *out, size_t inlen,
+                                                        size_t outlen)
+{
+        int err, ret;
+        ret = -EIO;
+        err = zlib_deflateInit2(&stream, COMPR_LEVEL, Z_DEFLATED, WINDOW_BITS,
+                                                MEM_LEVEL, Z_DEFAULT_STRATEGY);
+        if (err != Z_OK)
+                goto error;
+        stream.next_in = in;
+        stream.avail_in = inlen;
+        stream.total_in = 0;
+        stream.next_out = out;
+        stream.avail_out = outlen;
+        stream.total_out = 0;
+        err = zlib_deflate(&stream, Z_FINISH);
+        if (err != Z_STREAM_END)
+                goto error;
+        err = zlib_deflateEnd(&stream);
+        if (err != Z_OK)
+                goto error;
+        if (stream.total_out >= stream.total_in)
+                goto error;
+        ret = stream.total_out;
+error:
+        return ret;
+}
+/* Compress the text from big_oops_buf into oops_buf. */
+static int zip_oops(size_t text_len)
+{
+        struct oops_log_info *oops_hdr = (struct oops_log_info *)oops_buf;
+        int zipped_len = nvram_compress(big_oops_buf, oops_data, text_len,
+                                                                oops_data_sz);
+        if (zipped_len < 0) {
+                pr_err("nvram: compression failed; returned %d\n", zipped_len);
+                pr_err("nvram: logging uncompressed oops/panic report\n");
+                return -1;
+        }
+        oops_hdr->version = OOPS_HDR_VERSION;
+        oops_hdr->report_length = (u16) zipped_len;
+        oops_hdr->timestamp = get_seconds();
+        return 0;
+}
+#ifdef CONFIG_PSTORE
+/* Derived from logfs_uncompress */
+int nvram_decompress(void *in, void *out, size_t inlen, size_t outlen)
+{
+        int err, ret;
+        ret = -EIO;
+        err = zlib_inflateInit(&stream);
+        if (err != Z_OK)
+                goto error;
+        stream.next_in = in;
+        stream.avail_in = inlen;
+        stream.total_in = 0;
+        stream.next_out = out;
+        stream.avail_out = outlen;
+        stream.total_out = 0;
+        err = zlib_inflate(&stream, Z_FINISH);
+        if (err != Z_STREAM_END)
+                goto error;
+        err = zlib_inflateEnd(&stream);
+        if (err != Z_OK)
+                goto error;
+        ret = stream.total_out;
+error:
+        return ret;
+}
+static int unzip_oops(char *oops_buf, char *big_buf)
+{
+        struct oops_log_info *oops_hdr = (struct oops_log_info *)oops_buf;
+        u64 timestamp = oops_hdr->timestamp;
+        char *big_oops_data = NULL;
+        char *oops_data_buf = NULL;
+        size_t big_oops_data_sz;
+        int unzipped_len;
+        big_oops_data = big_buf + sizeof(struct oops_log_info);
+        big_oops_data_sz = big_oops_buf_sz - sizeof(struct oops_log_info);
+        oops_data_buf = oops_buf + sizeof(struct oops_log_info);
+        unzipped_len = nvram_decompress(oops_data_buf, big_oops_data,
+                                        oops_hdr->report_length,
+                                        big_oops_data_sz);
+        if (unzipped_len < 0) {
+                pr_err("nvram: decompression failed; returned %d\n",
+                                                                unzipped_len);
+                return -1;
+        }
+        oops_hdr = (struct oops_log_info *)big_buf;
+        oops_hdr->version = OOPS_HDR_VERSION;
+        oops_hdr->report_length = (u16) unzipped_len;
+        oops_hdr->timestamp = timestamp;
+        return 0;
+}
+static int nvram_pstore_open(struct pstore_info *psi)
+{
+        /* Reset the iterator to start reading partitions again */
+        read_type = -1;
+        return 0;
+}
+/**
+ * nvram_pstore_write - pstore write callback for nvram
+ * @type:               Type of message logged
+ * @reason:             reason behind dump (oops/panic)
+ * @id:                 identifier to indicate the write performed
+ * @part:               pstore writes data to registered buffer in parts,
+ *                      part number will indicate the same.
+ * @count:              Indicates oops count
+ * @hsize:              Size of header added by pstore
+ * @size:               number of bytes written to the registered buffer
+ * @psi:                registered pstore_info structure
+ *
+ * Called by pstore_dump() when an oops or panic report is logged in the
+ * printk buffer.
+ * Returns 0 on successful write.
+ */
+static int nvram_pstore_write(enum pstore_type_id type,
+                                enum kmsg_dump_reason reason,
+                                u64 *id, unsigned int part, int count,
+                                size_t hsize, size_t size,
+                                struct pstore_info *psi)
+{
+        int rc;
+        unsigned int err_type = ERR_TYPE_KERNEL_PANIC;
+        struct oops_log_info *oops_hdr = (struct oops_log_info *) oops_buf;
+        /* part 1 has the recent messages from printk buffer */
+        if (part > 1 || type != PSTORE_TYPE_DMESG ||
+                                clobbering_unread_rtas_event())
+                return -1;
+        oops_hdr->version = OOPS_HDR_VERSION;
+        oops_hdr->report_length = (u16) size;
+        oops_hdr->timestamp = get_seconds();
+        if (big_oops_buf) {
+                rc = zip_oops(size);
+                /*
+                 * If compression fails copy recent log messages from
+                 * big_oops_buf to oops_data.
+                 */
+                if (rc != 0) {
+                        size_t diff = size - oops_data_sz + hsize;
+                        if (size > oops_data_sz) {
+                                memcpy(oops_data, big_oops_buf, hsize);
+                                memcpy(oops_data + hsize, big_oops_buf + diff,
+                                        oops_data_sz - hsize);
+                                oops_hdr->report_length = (u16) oops_data_sz;
+                        } else
+                                memcpy(oops_data, big_oops_buf, size);
+                } else
+                        err_type = ERR_TYPE_KERNEL_PANIC_GZ;
+        }
+        rc = nvram_write_os_partition(&oops_log_partition, oops_buf,
+                (int) (sizeof(*oops_hdr) + oops_hdr->report_length), err_type,
+                count);
+        if (rc != 0)
+                return rc;
+        *id = part;
+        return 0;
+}
+/*
+ * Reads the oops/panic report, rtas, of-config and common partition.
+ * Returns the length of the data we read from each partition.
+ * Returns 0 if we've been called before.
+ */
+static ssize_t nvram_pstore_read(u64 *id, enum pstore_type_id *type,
+                                int *count, struct timespec *time, char **buf,
+                                struct pstore_info *psi)
+{
+        struct oops_log_info *oops_hdr;
+        unsigned int err_type, id_no, size = 0;
+        struct nvram_os_partition *part = NULL;
+        char *buff = NULL, *big_buff = NULL;
+        int rc, sig = 0;
+        loff_t p;
+read_partition:
+        read_type++;
+        switch (nvram_type_ids[read_type]) {
+        case PSTORE_TYPE_DMESG:
+                part = &oops_log_partition;
+                *type = PSTORE_TYPE_DMESG;
+                break;
+        case PSTORE_TYPE_PPC_RTAS:
+                part = &rtas_log_partition;
+                *type = PSTORE_TYPE_PPC_RTAS;
+                time->tv_sec = last_rtas_event;
+                time->tv_nsec = 0;
+                break;
+        case PSTORE_TYPE_PPC_OF:
+                sig = NVRAM_SIG_OF;
+                part = &of_config_partition;
+                *type = PSTORE_TYPE_PPC_OF;
+                *id = PSTORE_TYPE_PPC_OF;
+                time->tv_sec = 0;
+                time->tv_nsec = 0;
+                break;
+        case PSTORE_TYPE_PPC_COMMON:
+                sig = NVRAM_SIG_SYS;
+                part = &common_partition;
+                *type = PSTORE_TYPE_PPC_COMMON;
+                *id = PSTORE_TYPE_PPC_COMMON;
+                time->tv_sec = 0;
+                time->tv_nsec = 0;
+                break;
+        default:
+                return 0;
+        }
+        if (!part->os_partition) {
+                p = nvram_find_partition(part->name, sig, &size);
+                if (p <= 0) {
+                        pr_err("nvram: Failed to find partition %s, "
+                                "err %d\n", part->name, (int)p);
+                        return 0;
+                }
+                part->index = p;
+                part->size = size;
+        }
+        buff = kmalloc(part->size, GFP_KERNEL);
+        if (!buff)
+                return -ENOMEM;
+        if (nvram_read_partition(part, buff, part->size, &err_type, &id_no)) {
+                kfree(buff);
+                return 0;
+        }
+        *count = 0;
+        if (part->os_partition)
+                *id = id_no;
+        if (nvram_type_ids[read_type] == PSTORE_TYPE_DMESG) {
+                oops_hdr = (struct oops_log_info *)buff;
+                *buf = buff + sizeof(*oops_hdr);
+                if (err_type == ERR_TYPE_KERNEL_PANIC_GZ) {
+                        big_buff = kmalloc(big_oops_buf_sz, GFP_KERNEL);
+                        if (!big_buff)
+                                return -ENOMEM;
+                        rc = unzip_oops(buff, big_buff);
+                        if (rc != 0) {
+                                kfree(buff);
+                                kfree(big_buff);
+                                goto read_partition;
+                        }
+                        oops_hdr = (struct oops_log_info *)big_buff;
+                        *buf = big_buff + sizeof(*oops_hdr);
+                        kfree(buff);
+                }
+                time->tv_sec = oops_hdr->timestamp;
+                time->tv_nsec = 0;
+                return oops_hdr->report_length;
+        }
+        *buf = buff;
+        return part->size;
+}
+static struct pstore_info nvram_pstore_info = {
+        .owner = THIS_MODULE,
+        .name = "nvram",
+        .open = nvram_pstore_open,
+        .read = nvram_pstore_read,
+        .write = nvram_pstore_write,
+};
+static int nvram_pstore_init(void)
+{
+        int rc = 0;
+        if (big_oops_buf) {
+                nvram_pstore_info.buf = big_oops_buf;
+                nvram_pstore_info.bufsize = big_oops_buf_sz;
+        } else {
+                nvram_pstore_info.buf = oops_data;
+                nvram_pstore_info.bufsize = oops_data_sz;
+        }
+        rc = pstore_register(&nvram_pstore_info);
+        if (rc != 0)
+                pr_err("nvram: pstore_register() failed, defaults to "
+                                "kmsg_dump; returned %d\n", rc);
+        return rc;
+}
+#else
+static int nvram_pstore_init(void)
+{
+        return -1;
+}
+#endif
 static void __init nvram_init_oops_partition(int rtas_partition_exists)
 {
        int rc;
@@ -425,9 +833,8 @@ static void __init nvram_init_oops_partition(int rtas_partition_exists)
                                                oops_log_partition.name);
                return;
        }
-        oops_len = (u16*) oops_buf;
+        oops_data = oops_buf + sizeof(struct oops_log_info);
-        oops_data = oops_buf + sizeof(u16);
+        oops_data_sz = oops_log_partition.size - sizeof(struct oops_log_info);
-        oops_data_sz = oops_log_partition.size - sizeof(u16);
        /*
         * Figure compression (preceded by elimination of each line's <n>
@@ -452,6 +859,11 @@ static void __init nvram_init_oops_partition(int rtas_partition_exists)
                stream.workspace = NULL;
        }
+        rc = nvram_pstore_init();
+        if (!rc)
+                return;
        rc = kmsg_dump_register(&nvram_kmsg_dumper);
        if (rc != 0) {
                pr_err("nvram: kmsg_dump_register() failed; returned %d\n", rc);
@@ -501,70 +913,6 @@ int __init pSeries_nvram_init(void)
        return 0;
 }
-/*
- * Are we using the ibm,rtas-log for oops/panic reports?  And if so,
- * would logging this oops/panic overwrite an RTAS event that rtas_errd
- * hasn't had a chance to read and process?  Return 1 if so, else 0.
- *
- * We assume that if rtas_errd hasn't read the RTAS event in
- * NVRAM_RTAS_READ_TIMEOUT seconds, it's probably not going to.
- */
-static int clobbering_unread_rtas_event(void)
-{
-        return (oops_log_partition.index == rtas_log_partition.index
-                && last_unread_rtas_event
-                && get_seconds() - last_unread_rtas_event <=
-                                                NVRAM_RTAS_READ_TIMEOUT);
-}
-/* Derived from logfs_compress() */
-static int nvram_compress(const void *in, void *out, size_t inlen,
-                                                        size_t outlen)
-{
-        int err, ret;
-        ret = -EIO;
-        err = zlib_deflateInit2(&stream, COMPR_LEVEL, Z_DEFLATED, WINDOW_BITS,
-                                                MEM_LEVEL, Z_DEFAULT_STRATEGY);
-        if (err != Z_OK)
-                goto error;
-        stream.next_in = in;
-        stream.avail_in = inlen;
-        stream.total_in = 0;
-        stream.next_out = out;
-        stream.avail_out = outlen;
-        stream.total_out = 0;
-        err = zlib_deflate(&stream, Z_FINISH);
-        if (err != Z_STREAM_END)
-                goto error;
-        err = zlib_deflateEnd(&stream);
-        if (err != Z_OK)
-                goto error;
-        if (stream.total_out >= stream.total_in)
-                goto error;
-        ret = stream.total_out;
-error:
-        return ret;
-}
-/* Compress the text from big_oops_buf into oops_buf. */
-static int zip_oops(size_t text_len)
-{
-        int zipped_len = nvram_compress(big_oops_buf, oops_data, text_len,
-                                                                oops_data_sz);
-        if (zipped_len < 0) {
-                pr_err("nvram: compression failed; returned %d\n", zipped_len);
-                pr_err("nvram: logging uncompressed oops/panic report\n");
-                return -1;
-        }
-        *oops_len = (u16) zipped_len;
-        return 0;
-}
 /*
 * This is our kmsg_dump callback, called after an oops or panic report
@@ -576,6 +924,7 @@ static int zip_oops(size_t text_len)
 static void oops_to_nvram(struct kmsg_dumper *dumper,
                          enum kmsg_dump_reason reason)
 {
+        struct oops_log_info *oops_hdr = (struct oops_log_info *)oops_buf;
        static unsigned int oops_count = 0;
        static bool panicking = false;
        static DEFINE_SPINLOCK(lock);
@@ -619,14 +968,17 @@ static void oops_to_nvram(struct kmsg_dumper *dumper,
        }
        if (rc != 0) {
                kmsg_dump_rewind(dumper);
-                kmsg_dump_get_buffer(dumper, true,
+                kmsg_dump_get_buffer(dumper, false,
                                     oops_data, oops_data_sz, &text_len);
                err_type = ERR_TYPE_KERNEL_PANIC;
-                *oops_len = (u16) text_len;
+                oops_hdr->version = OOPS_HDR_VERSION;
+                oops_hdr->report_length = (u16) text_len;
+                oops_hdr->timestamp = get_seconds();
        }
        (void) nvram_write_os_partition(&oops_log_partition, oops_buf,
-                (int) (sizeof(*oops_len) + *oops_len), err_type, ++oops_count);
+                (int) (sizeof(*oops_hdr) + oops_hdr->report_length), err_type,
+                ++oops_count);
        spin_unlock_irqrestore(&lock, flags);
 }
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index c91b22be9288..efe61374f6ea 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -64,91 +64,6 @@ pcibios_find_pci_bus(struct device_node *dn)
 }
 EXPORT_SYMBOL_GPL(pcibios_find_pci_bus);
-/**
- * __pcibios_remove_pci_devices - remove all devices under this bus
- * @bus: the indicated PCI bus
- * @purge_pe: destroy the PE on removal of PCI devices
- *
- * Remove all of the PCI devices under this bus both from the
- * linux pci device tree, and from the powerpc EEH address cache.
- * By default, the corresponding PE will be destroied during the
- * normal PCI hotplug path. For PCI hotplug during EEH recovery,
- * the corresponding PE won't be destroied and deallocated.
- */
-void __pcibios_remove_pci_devices(struct pci_bus *bus, int purge_pe)
-{
-        struct pci_dev *dev, *tmp;
-        struct pci_bus *child_bus;
-        /* First go down child busses */
-        list_for_each_entry(child_bus, &bus->children, node)
-                __pcibios_remove_pci_devices(child_bus, purge_pe);
-        pr_debug("PCI: Removing devices on bus %04x:%02x\n",
-                pci_domain_nr(bus),  bus->number);
-        list_for_each_entry_safe(dev, tmp, &bus->devices, bus_list) {
-                pr_debug("     * Removing %s...\n", pci_name(dev));
-                eeh_remove_bus_device(dev, purge_pe);
-                pci_stop_and_remove_bus_device(dev);
-        }
-}
-/**
- * pcibios_remove_pci_devices - remove all devices under this bus
- *
- * Remove all of the PCI devices under this bus both from the
- * linux pci device tree, and from the powerpc EEH address cache.
- */
-void pcibios_remove_pci_devices(struct pci_bus *bus)
-{
-        __pcibios_remove_pci_devices(bus, 1);
-}
-EXPORT_SYMBOL_GPL(pcibios_remove_pci_devices);
-/**
- * pcibios_add_pci_devices - adds new pci devices to bus
- *
- * This routine will find and fixup new pci devices under
- * the indicated bus. This routine presumes that there
- * might already be some devices under this bridge, so
- * it carefully tries to add only new devices.  (And that
- * is how this routine differs from other, similar pcibios
- * routines.)
- */
-void pcibios_add_pci_devices(struct pci_bus * bus)
-{
-        int slotno, num, mode, pass, max;
-        struct pci_dev *dev;
-        struct device_node *dn = pci_bus_to_OF_node(bus);
-        eeh_add_device_tree_early(dn);
-        mode = PCI_PROBE_NORMAL;
-        if (ppc_md.pci_probe_mode)
-                mode = ppc_md.pci_probe_mode(bus);
-        if (mode == PCI_PROBE_DEVTREE) {
-                /* use ofdt-based probe */
-                of_rescan_bus(dn, bus);
-        } else if (mode == PCI_PROBE_NORMAL) {
-                /* use legacy probe */
-                slotno = PCI_SLOT(PCI_DN(dn->child)->devfn);
-                num = pci_scan_slot(bus, PCI_DEVFN(slotno, 0));
-                if (!num)
-                        return;
-                pcibios_setup_bus_devices(bus);
-                max = bus->busn_res.start;
-                for (pass=0; pass < 2; pass++)
-                        list_for_each_entry(dev, &bus->devices, bus_list) {
-                        if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE ||
-                            dev->hdr_type == PCI_HEADER_TYPE_CARDBUS)
-                                max = pci_scan_bridge(bus, dev, max, pass);
-                }
-        }
-        pcibios_finish_adding_to_bus(bus);
-}
-EXPORT_SYMBOL_GPL(pcibios_add_pci_devices);
 struct pci_controller *init_phb_dynamic(struct device_node *dn)
 {
        struct pci_controller *phb;
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index c4dfccd3a3d9..7b3cbde8c783 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -83,7 +83,7 @@ static void handle_system_shutdown(char event_modifier)
        switch (event_modifier) {
        case EPOW_SHUTDOWN_NORMAL:
                pr_emerg("Firmware initiated power off");
-                orderly_poweroff(1);
+                orderly_poweroff(true);
                break;
        case EPOW_SHUTDOWN_ON_UPS:
@@ -95,13 +95,13 @@ static void handle_system_shutdown(char event_modifier)
                pr_emerg("Loss of system critical functions reported by "
                        "firmware");
                pr_emerg("Check RTAS error log for details");
-                orderly_poweroff(1);
+                orderly_poweroff(true);
                break;
        case EPOW_SHUTDOWN_AMBIENT_TEMPERATURE_TOO_HIGH:
                pr_emerg("Ambient temperature too high reported by firmware");
                pr_emerg("Check RTAS error log for details");
-                orderly_poweroff(1);
+                orderly_poweroff(true);
                break;
        default:
@@ -162,7 +162,7 @@ void rtas_parse_epow_errlog(struct rtas_error_log *log)
        case EPOW_SYSTEM_HALT:
                pr_emerg("Firmware initiated power off");
-                orderly_poweroff(1);
+                orderly_poweroff(true);
                break;
        case EPOW_MAIN_ENCLOSURE:
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 12bc8c3663ad..306643cc9dbc 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -192,7 +192,7 @@ static int smp_pSeries_cpu_bootable(unsigned int nr)
        /* Special case - we inhibit secondary thread startup
         * during boot if the user requests it.
         */
-        if (system_state < SYSTEM_RUNNING && cpu_has_feature(CPU_FTR_SMT)) {
+        if (system_state == SYSTEM_BOOTING && cpu_has_feature(CPU_FTR_SMT)) {
                if (!smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
                        return 0;
                if (smt_enabled_at_boot
diff --git a/arch/powerpc/sysdev/Makefile b/arch/powerpc/sysdev/Makefile
index 99464a7bdb3b..f67ac900d870 100644
--- a/arch/powerpc/sysdev/Makefile
+++ b/arch/powerpc/sysdev/Makefile
@@ -4,6 +4,8 @@ ccflags-$(CONFIG_PPC64)		:= $(NO_MINIMAL_TOC)
 mpic-msi-obj-$(CONFIG_PCI_MSI)  += mpic_msi.o mpic_u3msi.o mpic_pasemi_msi.o
 obj-$(CONFIG_MPIC)              += mpic.o $(mpic-msi-obj-y)
+obj-$(CONFIG_MPIC_TIMER)        += mpic_timer.o
+obj-$(CONFIG_FSL_MPIC_TIMER_WAKEUP)     += fsl_mpic_timer_wakeup.o
 mpic-msgr-obj-$(CONFIG_MPIC_MSGR)       += mpic_msgr.o
 obj-$(CONFIG_MPIC)              += mpic.o $(mpic-msi-obj-y) $(mpic-msgr-obj-y)
 obj-$(CONFIG_PPC_EPAPR_HV_PIC)  += ehv_pic.o
diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
index d4fa03f2b6ac..5e6ff38ea69f 100644
--- a/arch/powerpc/sysdev/cpm1.c
+++ b/arch/powerpc/sysdev/cpm1.c
@@ -120,6 +120,7 @@ static irqreturn_t cpm_error_interrupt(int irq, void *dev)
 static struct irqaction cpm_error_irqaction = {
        .handler = cpm_error_interrupt,
+        .flags = IRQF_NO_THREAD,
        .name = "error",
 };
diff --git a/arch/powerpc/sysdev/fsl_mpic_timer_wakeup.c b/arch/powerpc/sysdev/fsl_mpic_timer_wakeup.c
new file mode 100644
index 000000000000..1707bf04dec6
--- /dev/null
+++ b/arch/powerpc/sysdev/fsl_mpic_timer_wakeup.c
@@ -0,0 +1,161 @@
+/*
+ * MPIC timer wakeup driver
+ *
+ * Copyright 2013 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/device.h>
+#include <asm/mpic_timer.h>
+#include <asm/mpic.h>
+struct fsl_mpic_timer_wakeup {
+        struct mpic_timer *timer;
+        struct work_struct free_work;
+};
+static struct fsl_mpic_timer_wakeup *fsl_wakeup;
+static DEFINE_MUTEX(sysfs_lock);
+static void fsl_free_resource(struct work_struct *ws)
+{
+        struct fsl_mpic_timer_wakeup *wakeup =
+                container_of(ws, struct fsl_mpic_timer_wakeup, free_work);
+        mutex_lock(&sysfs_lock);
+        if (wakeup->timer) {
+                disable_irq_wake(wakeup->timer->irq);
+                mpic_free_timer(wakeup->timer);
+        }
+        wakeup->timer = NULL;
+        mutex_unlock(&sysfs_lock);
+}
+static irqreturn_t fsl_mpic_timer_irq(int irq, void *dev_id)
+{
+        struct fsl_mpic_timer_wakeup *wakeup = dev_id;
+        schedule_work(&wakeup->free_work);
+        return wakeup->timer ? IRQ_HANDLED : IRQ_NONE;
+}
+static ssize_t fsl_timer_wakeup_show(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct timeval interval;
+        int val = 0;
+        mutex_lock(&sysfs_lock);
+        if (fsl_wakeup->timer) {
+                mpic_get_remain_time(fsl_wakeup->timer, &interval);
+                val = interval.tv_sec + 1;
+        }
+        mutex_unlock(&sysfs_lock);
+        return sprintf(buf, "%d\n", val);
+}
+static ssize_t fsl_timer_wakeup_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf,
+                                size_t count)
+{
+        struct timeval interval;
+        int ret;
+        interval.tv_usec = 0;
+        if (kstrtol(buf, 0, &interval.tv_sec))
+                return -EINVAL;
+        mutex_lock(&sysfs_lock);
+        if (fsl_wakeup->timer) {
+                disable_irq_wake(fsl_wakeup->timer->irq);
+                mpic_free_timer(fsl_wakeup->timer);
+                fsl_wakeup->timer = NULL;
+        }
+        if (!interval.tv_sec) {
+                mutex_unlock(&sysfs_lock);
+                return count;
+        }
+        fsl_wakeup->timer = mpic_request_timer(fsl_mpic_timer_irq,
+                                                fsl_wakeup, &interval);
+        if (!fsl_wakeup->timer) {
+                mutex_unlock(&sysfs_lock);
+                return -EINVAL;
+        }
+        ret = enable_irq_wake(fsl_wakeup->timer->irq);
+        if (ret) {
+                mpic_free_timer(fsl_wakeup->timer);
+                fsl_wakeup->timer = NULL;
+                mutex_unlock(&sysfs_lock);
+                return ret;
+        }
+        mpic_start_timer(fsl_wakeup->timer);
+        mutex_unlock(&sysfs_lock);
+        return count;
+}
+static struct device_attribute mpic_attributes = __ATTR(timer_wakeup, 0644,
+                        fsl_timer_wakeup_show, fsl_timer_wakeup_store);
+static int __init fsl_wakeup_sys_init(void)
+{
+        int ret;
+        fsl_wakeup = kzalloc(sizeof(struct fsl_mpic_timer_wakeup), GFP_KERNEL);
+        if (!fsl_wakeup)
+                return -ENOMEM;
+        INIT_WORK(&fsl_wakeup->free_work, fsl_free_resource);
+        ret = device_create_file(mpic_subsys.dev_root, &mpic_attributes);
+        if (ret)
+                kfree(fsl_wakeup);
+        return ret;
+}
+static void __exit fsl_wakeup_sys_exit(void)
+{
+        device_remove_file(mpic_subsys.dev_root, &mpic_attributes);
+        mutex_lock(&sysfs_lock);
+        if (fsl_wakeup->timer) {
+                disable_irq_wake(fsl_wakeup->timer->irq);
+                mpic_free_timer(fsl_wakeup->timer);
+        }
+        kfree(fsl_wakeup);
+        mutex_unlock(&sysfs_lock);
+}
+module_init(fsl_wakeup_sys_init);
+module_exit(fsl_wakeup_sys_exit);
+MODULE_DESCRIPTION("Freescale MPIC global timer wakeup driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Wang Dongsheng <dongsheng.wang@freescale.com>");
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 3cc2f9159ab1..1be54faf60dd 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -48,6 +48,12 @@
 #define DBG(fmt...)
 #endif
+struct bus_type mpic_subsys = {
+        .name = "mpic",
+        .dev_name = "mpic",
+};
+EXPORT_SYMBOL_GPL(mpic_subsys);
 static struct mpic *mpics;
 static struct mpic *mpic_primary;
 static DEFINE_RAW_SPINLOCK(mpic_lock);
@@ -920,6 +926,22 @@ int mpic_set_irq_type(struct irq_data *d, unsigned int flow_type)
        return IRQ_SET_MASK_OK_NOCOPY;
 }
+static int mpic_irq_set_wake(struct irq_data *d, unsigned int on)
+{
+        struct irq_desc *desc = container_of(d, struct irq_desc, irq_data);
+        struct mpic *mpic = mpic_from_irq_data(d);
+        if (!(mpic->flags & MPIC_FSL))
+                return -ENXIO;
+        if (on)
+                desc->action->flags |= IRQF_NO_SUSPEND;
+        else
+                desc->action->flags &= ~IRQF_NO_SUSPEND;
+        return 0;
+}
 void mpic_set_vector(unsigned int virq, unsigned int vector)
 {
        struct mpic *mpic = mpic_from_irq(virq);
@@ -957,6 +979,7 @@ static struct irq_chip mpic_irq_chip = {
        .irq_unmask     = mpic_unmask_irq,
        .irq_eoi        = mpic_end_irq,
        .irq_set_type   = mpic_set_irq_type,
+        .irq_set_wake   = mpic_irq_set_wake,
 };
 #ifdef CONFIG_SMP
@@ -971,6 +994,7 @@ static struct irq_chip mpic_tm_chip = {
        .irq_mask       = mpic_mask_tm,
        .irq_unmask     = mpic_unmask_tm,
        .irq_eoi        = mpic_end_irq,
+        .irq_set_wake   = mpic_irq_set_wake,
 };
 #ifdef CONFIG_MPIC_U3_HT_IRQS
@@ -1173,10 +1197,33 @@ static struct irq_domain_ops mpic_host_ops = {
        .xlate = mpic_host_xlate,
 };
+static u32 fsl_mpic_get_version(struct mpic *mpic)
+{
+        u32 brr1;
+        if (!(mpic->flags & MPIC_FSL))
+                return 0;
+        brr1 = _mpic_read(mpic->reg_type, &mpic->thiscpuregs,
+                        MPIC_FSL_BRR1);
+        return brr1 & MPIC_FSL_BRR1_VER;
+}
 /*
 * Exported functions
 */
+u32 fsl_mpic_primary_get_version(void)
+{
+        struct mpic *mpic = mpic_primary;
+        if (mpic)
+                return fsl_mpic_get_version(mpic);
+        return 0;
+}
 struct mpic * __init mpic_alloc(struct device_node *node,
                                phys_addr_t phys_addr,
                                unsigned int flags,
@@ -1323,7 +1370,6 @@ struct mpic * __init mpic_alloc(struct device_node *node,
        mpic_map(mpic, mpic->paddr, &mpic->tmregs, MPIC_INFO(TIMER_BASE), 0x1000);
        if (mpic->flags & MPIC_FSL) {
-                u32 brr1;
                int ret;
                /*
@@ -1334,9 +1380,7 @@ struct mpic * __init mpic_alloc(struct device_node *node,
                mpic_map(mpic, mpic->paddr, &mpic->thiscpuregs,
                         MPIC_CPU_THISBASE, 0x1000);
-                brr1 = _mpic_read(mpic->reg_type, &mpic->thiscpuregs,
+                fsl_version = fsl_mpic_get_version(mpic);
-                                MPIC_FSL_BRR1);
-                fsl_version = brr1 & MPIC_FSL_BRR1_VER;
                /* Error interrupt mask register (EIMR) is required for
                 * handling individual device error interrupts. EIMR
@@ -1526,9 +1570,7 @@ void __init mpic_init(struct mpic *mpic)
        mpic_cpu_write(MPIC_INFO(CPU_CURRENT_TASK_PRI), 0xf);
        if (mpic->flags & MPIC_FSL) {
-                u32 brr1 = _mpic_read(mpic->reg_type, &mpic->thiscpuregs,
+                u32 version = fsl_mpic_get_version(mpic);
-                                      MPIC_FSL_BRR1);
-                u32 version = brr1 & MPIC_FSL_BRR1_VER;
                /*
                 * Timer group B is present at the latest in MPIC 3.1 (e.g.
@@ -1999,6 +2041,8 @@ static struct syscore_ops mpic_syscore_ops = {
 static int mpic_init_sys(void)
 {
        register_syscore_ops(&mpic_syscore_ops);
+        subsys_system_register(&mpic_subsys, NULL);
        return 0;
 }
diff --git a/arch/powerpc/sysdev/mpic_timer.c b/arch/powerpc/sysdev/mpic_timer.c
new file mode 100644
index 000000000000..c06db92a4fb1
--- /dev/null
+++ b/arch/powerpc/sysdev/mpic_timer.c
@@ -0,0 +1,593 @@
+/*
+ * MPIC timer driver
+ *
+ * Copyright 2013 Freescale Semiconductor, Inc.
+ * Author: Dongsheng Wang <Dongsheng.Wang@freescale.com>
+ *         Li Yang <leoli@freescale.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/syscore_ops.h>
+#include <sysdev/fsl_soc.h>
+#include <asm/io.h>
+#include <asm/mpic_timer.h>
+#define FSL_GLOBAL_TIMER                0x1
+/* Clock Ratio
+ * Divide by 64 0x00000300
+ * Divide by 32 0x00000200
+ * Divide by 16 0x00000100
+ * Divide by  8 0x00000000 (Hardware default div)
+ */
+#define MPIC_TIMER_TCR_CLKDIV           0x00000300
+#define MPIC_TIMER_TCR_ROVR_OFFSET      24
+#define TIMER_STOP                      0x80000000
+#define TIMERS_PER_GROUP                4
+#define MAX_TICKS                       (~0U >> 1)
+#define MAX_TICKS_CASCADE               (~0U)
+#define TIMER_OFFSET(num)               (1 << (TIMERS_PER_GROUP - 1 - num))
+/* tv_usec should be less than ONE_SECOND, otherwise use tv_sec */
+#define ONE_SECOND                      1000000
+struct timer_regs {
+        u32     gtccr;
+        u32     res0[3];
+        u32     gtbcr;
+        u32     res1[3];
+        u32     gtvpr;
+        u32     res2[3];
+        u32     gtdr;
+        u32     res3[3];
+};
+struct cascade_priv {
+        u32 tcr_value;                  /* TCR register: CASC & ROVR value */
+        unsigned int cascade_map;       /* cascade map */
+        unsigned int timer_num;         /* cascade control timer */
+};
+struct timer_group_priv {
+        struct timer_regs __iomem       *regs;
+        struct mpic_timer               timer[TIMERS_PER_GROUP];
+        struct list_head                node;
+        unsigned int                    timerfreq;
+        unsigned int                    idle;
+        unsigned int                    flags;
+        spinlock_t                      lock;
+        void __iomem                    *group_tcr;
+};
+static struct cascade_priv cascade_timer[] = {
+        /* cascade timer 0 and 1 */
+        {0x1, 0xc, 0x1},
+        /* cascade timer 1 and 2 */
+        {0x2, 0x6, 0x2},
+        /* cascade timer 2 and 3 */
+        {0x4, 0x3, 0x3}
+};
+static LIST_HEAD(timer_group_list);
+static void convert_ticks_to_time(struct timer_group_priv *priv,
+                const u64 ticks, struct timeval *time)
+{
+        u64 tmp_sec;
+        time->tv_sec = (__kernel_time_t)div_u64(ticks, priv->timerfreq);
+        tmp_sec = (u64)time->tv_sec * (u64)priv->timerfreq;
+        time->tv_usec = (__kernel_suseconds_t)
+                div_u64((ticks - tmp_sec) * 1000000, priv->timerfreq);
+        return;
+}
+/* the time set by the user is converted to "ticks" */
+static int convert_time_to_ticks(struct timer_group_priv *priv,
+                const struct timeval *time, u64 *ticks)
+{
+        u64 max_value;          /* prevent u64 overflow */
+        u64 tmp = 0;
+        u64 tmp_sec;
+        u64 tmp_ms;
+        u64 tmp_us;
+        max_value = div_u64(ULLONG_MAX, priv->timerfreq);
+        if (time->tv_sec > max_value ||
+                        (time->tv_sec == max_value && time->tv_usec > 0))
+                return -EINVAL;
+        tmp_sec = (u64)time->tv_sec * (u64)priv->timerfreq;
+        tmp += tmp_sec;
+        tmp_ms = time->tv_usec / 1000;
+        tmp_ms = div_u64((u64)tmp_ms * (u64)priv->timerfreq, 1000);
+        tmp += tmp_ms;
+        tmp_us = time->tv_usec % 1000;
+        tmp_us = div_u64((u64)tmp_us * (u64)priv->timerfreq, 1000000);
+        tmp += tmp_us;
+        *ticks = tmp;
+        return 0;
+}
+/* detect whether there is a cascade timer available */
+static struct mpic_timer *detect_idle_cascade_timer(
+                                        struct timer_group_priv *priv)
+{
+        struct cascade_priv *casc_priv;
+        unsigned int map;
+        unsigned int array_size = ARRAY_SIZE(cascade_timer);
+        unsigned int num;
+        unsigned int i;
+        unsigned long flags;
+        casc_priv = cascade_timer;
+        for (i = 0; i < array_size; i++) {
+                spin_lock_irqsave(&priv->lock, flags);
+                map = casc_priv->cascade_map & priv->idle;
+                if (map == casc_priv->cascade_map) {
+                        num = casc_priv->timer_num;
+                        priv->timer[num].cascade_handle = casc_priv;
+                        /* set timer busy */
+                        priv->idle &= ~casc_priv->cascade_map;
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                        return &priv->timer[num];
+                }
+                spin_unlock_irqrestore(&priv->lock, flags);
+                casc_priv++;
+        }
+        return NULL;
+}
+static int set_cascade_timer(struct timer_group_priv *priv, u64 ticks,
+                unsigned int num)
+{
+        struct cascade_priv *casc_priv;
+        u32 tcr;
+        u32 tmp_ticks;
+        u32 rem_ticks;
+        /* set group tcr reg for cascade */
+        casc_priv = priv->timer[num].cascade_handle;
+        if (!casc_priv)
+                return -EINVAL;
+        tcr = casc_priv->tcr_value |
+                (casc_priv->tcr_value << MPIC_TIMER_TCR_ROVR_OFFSET);
+        setbits32(priv->group_tcr, tcr);
+        tmp_ticks = div_u64_rem(ticks, MAX_TICKS_CASCADE, &rem_ticks);
+        out_be32(&priv->regs[num].gtccr, 0);
+        out_be32(&priv->regs[num].gtbcr, tmp_ticks | TIMER_STOP);
+        out_be32(&priv->regs[num - 1].gtccr, 0);
+        out_be32(&priv->regs[num - 1].gtbcr, rem_ticks);
+        return 0;
+}
+static struct mpic_timer *get_cascade_timer(struct timer_group_priv *priv,
+                                        u64 ticks)
+{
+        struct mpic_timer *allocated_timer;
+        /* Two cascade timers: Support the maximum time */
+        const u64 max_ticks = (u64)MAX_TICKS * (u64)MAX_TICKS_CASCADE;
+        int ret;
+        if (ticks > max_ticks)
+                return NULL;
+        /* detect idle timer */
+        allocated_timer = detect_idle_cascade_timer(priv);
+        if (!allocated_timer)
+                return NULL;
+        /* set ticks to timer */
+        ret = set_cascade_timer(priv, ticks, allocated_timer->num);
+        if (ret < 0)
+                return NULL;
+        return allocated_timer;
+}
+static struct mpic_timer *get_timer(const struct timeval *time)
+{
+        struct timer_group_priv *priv;
+        struct mpic_timer *timer;
+        u64 ticks;
+        unsigned int num;
+        unsigned int i;
+        unsigned long flags;
+        int ret;
+        list_for_each_entry(priv, &timer_group_list, node) {
+                ret = convert_time_to_ticks(priv, time, &ticks);
+                if (ret < 0)
+                        return NULL;
+                if (ticks > MAX_TICKS) {
+                        if (!(priv->flags & FSL_GLOBAL_TIMER))
+                                return NULL;
+                        timer = get_cascade_timer(priv, ticks);
+                        if (!timer)
+                                continue;
+                        return timer;
+                }
+                for (i = 0; i < TIMERS_PER_GROUP; i++) {
+                        /* one timer: Reverse allocation */
+                        num = TIMERS_PER_GROUP - 1 - i;
+                        spin_lock_irqsave(&priv->lock, flags);
+                        if (priv->idle & (1 << i)) {
+                                /* set timer busy */
+                                priv->idle &= ~(1 << i);
+                                /* set ticks & stop timer */
+                                out_be32(&priv->regs[num].gtbcr,
+                                        ticks | TIMER_STOP);
+                                out_be32(&priv->regs[num].gtccr, 0);
+                                priv->timer[num].cascade_handle = NULL;
+                                spin_unlock_irqrestore(&priv->lock, flags);
+                                return &priv->timer[num];
+                        }
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                }
+        }
+        return NULL;
+}
+/**
+ * mpic_start_timer - start hardware timer
+ * @handle: the timer to be started.
+ *
+ * It will do ->fn(->dev) callback from the hardware interrupt at
+ * the ->timeval point in the future.
+ */
+void mpic_start_timer(struct mpic_timer *handle)
+{
+        struct timer_group_priv *priv = container_of(handle,
+                        struct timer_group_priv, timer[handle->num]);
+        clrbits32(&priv->regs[handle->num].gtbcr, TIMER_STOP);
+}
+EXPORT_SYMBOL(mpic_start_timer);
+/**
+ * mpic_stop_timer - stop hardware timer
+ * @handle: the timer to be stoped
+ *
+ * The timer periodically generates an interrupt. Unless user stops the timer.
+ */
+void mpic_stop_timer(struct mpic_timer *handle)
+{
+        struct timer_group_priv *priv = container_of(handle,
+                        struct timer_group_priv, timer[handle->num]);
+        struct cascade_priv *casc_priv;
+        setbits32(&priv->regs[handle->num].gtbcr, TIMER_STOP);
+        casc_priv = priv->timer[handle->num].cascade_handle;
+        if (casc_priv) {
+                out_be32(&priv->regs[handle->num].gtccr, 0);
+                out_be32(&priv->regs[handle->num - 1].gtccr, 0);
+        } else {
+                out_be32(&priv->regs[handle->num].gtccr, 0);
+        }
+}
+EXPORT_SYMBOL(mpic_stop_timer);
+/**
+ * mpic_get_remain_time - get timer time
+ * @handle: the timer to be selected.
+ * @time: time for timer
+ *
+ * Query timer remaining time.
+ */
+void mpic_get_remain_time(struct mpic_timer *handle, struct timeval *time)
+{
+        struct timer_group_priv *priv = container_of(handle,
+                        struct timer_group_priv, timer[handle->num]);
+        struct cascade_priv *casc_priv;
+        u64 ticks;
+        u32 tmp_ticks;
+        casc_priv = priv->timer[handle->num].cascade_handle;
+        if (casc_priv) {
+                tmp_ticks = in_be32(&priv->regs[handle->num].gtccr);
+                ticks = ((u64)tmp_ticks & UINT_MAX) * (u64)MAX_TICKS_CASCADE;
+                tmp_ticks = in_be32(&priv->regs[handle->num - 1].gtccr);
+                ticks += tmp_ticks;
+        } else {
+                ticks = in_be32(&priv->regs[handle->num].gtccr);
+        }
+        convert_ticks_to_time(priv, ticks, time);
+}
+EXPORT_SYMBOL(mpic_get_remain_time);
+/**
+ * mpic_free_timer - free hardware timer
+ * @handle: the timer to be removed.
+ *
+ * Free the timer.
+ *
+ * Note: can not be used in interrupt context.
+ */
+void mpic_free_timer(struct mpic_timer *handle)
+{
+        struct timer_group_priv *priv = container_of(handle,
+                        struct timer_group_priv, timer[handle->num]);
+        struct cascade_priv *casc_priv;
+        unsigned long flags;
+        mpic_stop_timer(handle);
+        casc_priv = priv->timer[handle->num].cascade_handle;
+        free_irq(priv->timer[handle->num].irq, priv->timer[handle->num].dev);
+        spin_lock_irqsave(&priv->lock, flags);
+        if (casc_priv) {
+                u32 tcr;
+                tcr = casc_priv->tcr_value | (casc_priv->tcr_value <<
+                                        MPIC_TIMER_TCR_ROVR_OFFSET);
+                clrbits32(priv->group_tcr, tcr);
+                priv->idle |= casc_priv->cascade_map;
+                priv->timer[handle->num].cascade_handle = NULL;
+        } else {
+                priv->idle |= TIMER_OFFSET(handle->num);
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+EXPORT_SYMBOL(mpic_free_timer);
+/**
+ * mpic_request_timer - get a hardware timer
+ * @fn: interrupt handler function
+ * @dev: callback function of the data
+ * @time: time for timer
+ *
+ * This executes the "request_irq", returning NULL
+ * else "handle" on success.
+ */
+struct mpic_timer *mpic_request_timer(irq_handler_t fn, void *dev,
+                                        const struct timeval *time)
+{
+        struct mpic_timer *allocated_timer;
+        int ret;
+        if (list_empty(&timer_group_list))
+                return NULL;
+        if (!(time->tv_sec + time->tv_usec) ||
+                        time->tv_sec < 0 || time->tv_usec < 0)
+                return NULL;
+        if (time->tv_usec > ONE_SECOND)
+                return NULL;
+        allocated_timer = get_timer(time);
+        if (!allocated_timer)
+                return NULL;
+        ret = request_irq(allocated_timer->irq, fn,
+                        IRQF_TRIGGER_LOW, "global-timer", dev);
+        if (ret) {
+                mpic_free_timer(allocated_timer);
+                return NULL;
+        }
+        allocated_timer->dev = dev;
+        return allocated_timer;
+}
+EXPORT_SYMBOL(mpic_request_timer);
+static int timer_group_get_freq(struct device_node *np,
+                        struct timer_group_priv *priv)
+{
+        u32 div;
+        if (priv->flags & FSL_GLOBAL_TIMER) {
+                struct device_node *dn;
+                dn = of_find_compatible_node(NULL, NULL, "fsl,mpic");
+                if (dn) {
+                        of_property_read_u32(dn, "clock-frequency",
+                                        &priv->timerfreq);
+                        of_node_put(dn);
+                }
+        }
+        if (priv->timerfreq <= 0)
+                return -EINVAL;
+        if (priv->flags & FSL_GLOBAL_TIMER) {
+                div = (1 << (MPIC_TIMER_TCR_CLKDIV >> 8)) * 8;
+                priv->timerfreq /= div;
+        }
+        return 0;
+}
+static int timer_group_get_irq(struct device_node *np,
+                struct timer_group_priv *priv)
+{
+        const u32 all_timer[] = { 0, TIMERS_PER_GROUP };
+        const u32 *p;
+        u32 offset;
+        u32 count;
+        unsigned int i;
+        unsigned int j;
+        unsigned int irq_index = 0;
+        unsigned int irq;
+        int len;
+        p = of_get_property(np, "fsl,available-ranges", &len);
+        if (p && len % (2 * sizeof(u32)) != 0) {
+                pr_err("%s: malformed available-ranges property.\n",
+                                np->full_name);
+                return -EINVAL;
+        }
+        if (!p) {
+                p = all_timer;
+                len = sizeof(all_timer);
+        }
+        len /= 2 * sizeof(u32);
+        for (i = 0; i < len; i++) {
+                offset = p[i * 2];
+                count = p[i * 2 + 1];
+                for (j = 0; j < count; j++) {
+                        irq = irq_of_parse_and_map(np, irq_index);
+                        if (!irq) {
+                                pr_err("%s: irq parse and map failed.\n",
+                                                np->full_name);
+                                return -EINVAL;
+                        }
+                        /* Set timer idle */
+                        priv->idle |= TIMER_OFFSET((offset + j));
+                        priv->timer[offset + j].irq = irq;
+                        priv->timer[offset + j].num = offset + j;
+                        irq_index++;
+                }
+        }
+        return 0;
+}
+static void timer_group_init(struct device_node *np)
+{
+        struct timer_group_priv *priv;
+        unsigned int i = 0;
+        int ret;
+        priv = kzalloc(sizeof(struct timer_group_priv), GFP_KERNEL);
+        if (!priv) {
+                pr_err("%s: cannot allocate memory for group.\n",
+                                np->full_name);
+                return;
+        }
+        if (of_device_is_compatible(np, "fsl,mpic-global-timer"))
+                priv->flags |= FSL_GLOBAL_TIMER;
+        priv->regs = of_iomap(np, i++);
+        if (!priv->regs) {
+                pr_err("%s: cannot ioremap timer register address.\n",
+                                np->full_name);
+                goto out;
+        }
+        if (priv->flags & FSL_GLOBAL_TIMER) {
+                priv->group_tcr = of_iomap(np, i++);
+                if (!priv->group_tcr) {
+                        pr_err("%s: cannot ioremap tcr address.\n",
+                                        np->full_name);
+                        goto out;
+                }
+        }
+        ret = timer_group_get_freq(np, priv);
+        if (ret < 0) {
+                pr_err("%s: cannot get timer frequency.\n", np->full_name);
+                goto out;
+        }
+        ret = timer_group_get_irq(np, priv);
+        if (ret < 0) {
+                pr_err("%s: cannot get timer irqs.\n", np->full_name);
+                goto out;
+        }
+        spin_lock_init(&priv->lock);
+        /* Init FSL timer hardware */
+        if (priv->flags & FSL_GLOBAL_TIMER)
+                setbits32(priv->group_tcr, MPIC_TIMER_TCR_CLKDIV);
+        list_add_tail(&priv->node, &timer_group_list);
+        return;
+out:
+        if (priv->regs)
+                iounmap(priv->regs);
+        if (priv->group_tcr)
+                iounmap(priv->group_tcr);
+        kfree(priv);
+}
+static void mpic_timer_resume(void)
+{
+        struct timer_group_priv *priv;
+        list_for_each_entry(priv, &timer_group_list, node) {
+                /* Init FSL timer hardware */
+                if (priv->flags & FSL_GLOBAL_TIMER)
+                        setbits32(priv->group_tcr, MPIC_TIMER_TCR_CLKDIV);
+        }
+}
+static const struct of_device_id mpic_timer_ids[] = {
+        { .compatible = "fsl,mpic-global-timer", },
+        {},
+};
+static struct syscore_ops mpic_timer_syscore_ops = {
+        .resume = mpic_timer_resume,
+};
+static int __init mpic_timer_init(void)
+{
+        struct device_node *np = NULL;
+        for_each_matching_node(np, mpic_timer_ids)
+                timer_group_init(np);
+        register_syscore_ops(&mpic_timer_syscore_ops);
+        if (list_empty(&timer_group_list))
+                return -ENODEV;
+        return 0;
+}
+subsys_initcall(mpic_timer_init);
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 0ea4e591fa78..75fb726de91f 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1364,10 +1364,11 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 #define __HAVE_ARCH_PGTABLE_DEPOSIT
-extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable);
+extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
+                                       pgtable_t pgtable);
 #define __HAVE_ARCH_PGTABLE_WITHDRAW
-extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm);
+extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp);
 static inline int pmd_trans_splitting(pmd_t pmd)
 {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 17bf4d3d303a..a8154a1a2c94 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -1165,7 +1165,8 @@ void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
        }
 }
-void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable)
+void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
+                                pgtable_t pgtable)
 {
        struct list_head *lh = (struct list_head *) pgtable;
@@ -1179,7 +1180,7 @@ void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable)
        mm->pmd_huge_pte = pgtable;
 }
-pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm)
+pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
 {
        struct list_head *lh;
        pgtable_t pgtable;
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 79c214efa3fe..36760317814f 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -853,10 +853,11 @@ extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
                                 pmd_t *pmd);
 #define __HAVE_ARCH_PGTABLE_DEPOSIT
-extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable);
+extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
+                                       pgtable_t pgtable);
 #define __HAVE_ARCH_PGTABLE_WITHDRAW
-extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm);
+extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp);
 #endif
 /* Encode and de-code a swap entry */
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index 37e7bc4c95b3..7a91f288c708 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -188,7 +188,8 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
        }
 }
-void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable)
+void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
+                                pgtable_t pgtable)
 {
        struct list_head *lh = (struct list_head *) pgtable;
@@ -202,7 +203,7 @@ void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable)
        mm->pmd_huge_pte = pgtable;
 }
-pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm)
+pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
 {
        struct list_head *lh;
        pgtable_t pgtable;