Merge tag 'v3.10-rc7' into for-3.11/drivers

Linux 3.10-rc7

Pull this in early to avoid doing it with the bcache merge,
since there are a number of changes to bcache between my old
base (3.10-rc1) and the new pull request.

82 files changed, 1208 insertions, 483 deletions

diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 5416e28a7538..863d877e0b5f 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -262,8 +262,31 @@ config PPC_EARLY_DEBUG_OPAL_HVSI
           Select this to enable early debugging for the PowerNV platform
           using an "hvsi" console
 
+config PPC_EARLY_DEBUG_MEMCONS
+        bool "In memory console"
+        help
+          Select this to enable early debugging using an in memory console.
+          This console provides input and output buffers stored within the
+          kernel BSS and should be safe to select on any system. A debugger
+          can then be used to read kernel output or send input to the console.
 endchoice
 
+config PPC_MEMCONS_OUTPUT_SIZE
+        int "In memory console output buffer size"
+        depends on PPC_EARLY_DEBUG_MEMCONS
+        default 4096
+        help
+          Selects the size of the output buffer (in bytes) of the in memory
+          console.
+
+config PPC_MEMCONS_INPUT_SIZE
+        int "In memory console input buffer size"
+        depends on PPC_EARLY_DEBUG_MEMCONS
+        default 128
+        help
+          Selects the size of the input buffer (in bytes) of the in memory
+          console.
+
 config PPC_EARLY_DEBUG_OPAL
         def_bool y
         depends on PPC_EARLY_DEBUG_OPAL_RAW || PPC_EARLY_DEBUG_OPAL_HVSI
diff --git a/arch/powerpc/configs/ps3_defconfig b/arch/powerpc/configs/ps3_defconfig
index f79196232917..139a8308070c 100644
--- a/arch/powerpc/configs/ps3_defconfig
+++ b/arch/powerpc/configs/ps3_defconfig
@@ -136,7 +136,6 @@ CONFIG_HID_SMARTJOYPLUS=m
 CONFIG_USB_HIDDEV=y
 CONFIG_USB=m
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
-CONFIG_USB_SUSPEND=y
 CONFIG_USB_MON=m
 CONFIG_USB_EHCI_HCD=m
 # CONFIG_USB_EHCI_HCD_PPC_OF is not set
diff --git a/arch/powerpc/include/asm/context_tracking.h b/arch/powerpc/include/asm/context_tracking.h
new file mode 100644
index 000000000000..b6f5a33b8ee2
--- /dev/null
+++ b/arch/powerpc/include/asm/context_tracking.h
@@ -0,0 +1,10 @@
+#ifndef _ASM_POWERPC_CONTEXT_TRACKING_H
+#define _ASM_POWERPC_CONTEXT_TRACKING_H
+
+#ifdef CONFIG_CONTEXT_TRACKING
+#define SCHEDULE_USER bl        .schedule_user
+#else
+#define SCHEDULE_USER bl        .schedule
+#endif
+
+#endif
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index 26807e5aff51..6f3887d884d2 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -176,6 +176,7 @@ extern const char *powerpc_base_platform;
 #define CPU_FTR_CFAR                    LONG_ASM_CONST(0x0100000000000000)
 #define CPU_FTR_HAS_PPR                 LONG_ASM_CONST(0x0200000000000000)
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
+#define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 
 #ifndef __ASSEMBLY__
 
@@ -394,19 +395,20 @@ extern const char *powerpc_base_platform;
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_201 | \
             CPU_FTR_ALTIVEC_COMP | CPU_FTR_CAN_NAP | CPU_FTR_MMCRA | \
             CPU_FTR_CP_USE_DCBTZ | CPU_FTR_STCX_CHECKS_ADDRESS | \
-            CPU_FTR_HVMODE)
+            CPU_FTR_HVMODE | CPU_FTR_DABRX)
 #define CPU_FTRS_POWER5 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
             CPU_FTR_MMCRA | CPU_FTR_SMT | \
             CPU_FTR_COHERENT_ICACHE | CPU_FTR_PURR | \
-            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB)
+            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_DABRX)
 #define CPU_FTRS_POWER6 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
             CPU_FTR_MMCRA | CPU_FTR_SMT | \
             CPU_FTR_COHERENT_ICACHE | \
             CPU_FTR_PURR | CPU_FTR_SPURR | CPU_FTR_REAL_LE | \
             CPU_FTR_DSCR | CPU_FTR_UNALIGNED_LD_STD | \
-            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_CFAR)
+            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_CFAR | \
+            CPU_FTR_DABRX)
 #define CPU_FTRS_POWER7 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_206 |\
             CPU_FTR_MMCRA | CPU_FTR_SMT | \
@@ -415,7 +417,7 @@ extern const char *powerpc_base_platform;
             CPU_FTR_DSCR | CPU_FTR_SAO  | CPU_FTR_ASYM_SMT | \
             CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
             CPU_FTR_ICSWX | CPU_FTR_CFAR | CPU_FTR_HVMODE | \
-            CPU_FTR_VMX_COPY | CPU_FTR_HAS_PPR)
+            CPU_FTR_VMX_COPY | CPU_FTR_HAS_PPR | CPU_FTR_DABRX)
 #define CPU_FTRS_POWER8 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_206 |\
             CPU_FTR_MMCRA | CPU_FTR_SMT | \
@@ -430,14 +432,15 @@ extern const char *powerpc_base_platform;
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
             CPU_FTR_ALTIVEC_COMP | CPU_FTR_MMCRA | CPU_FTR_SMT | \
             CPU_FTR_PAUSE_ZERO  | CPU_FTR_CELL_TB_BUG | CPU_FTR_CP_USE_DCBTZ | \
-            CPU_FTR_UNALIGNED_LD_STD)
+            CPU_FTR_UNALIGNED_LD_STD | CPU_FTR_DABRX)
 #define CPU_FTRS_PA6T (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
             CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_ALTIVEC_COMP | \
-            CPU_FTR_PURR | CPU_FTR_REAL_LE)
+            CPU_FTR_PURR | CPU_FTR_REAL_LE | CPU_FTR_DABRX)
 #define CPU_FTRS_COMPATIBLE     (CPU_FTR_USE_TB | CPU_FTR_PPCAS_ARCH_V2)
 
 #define CPU_FTRS_A2 (CPU_FTR_USE_TB | CPU_FTR_SMT | CPU_FTR_DBELL | \
-                     CPU_FTR_NOEXECUTE | CPU_FTR_NODSISRALIGN | CPU_FTR_ICSWX)
+                     CPU_FTR_NOEXECUTE | CPU_FTR_NODSISRALIGN | \
+                     CPU_FTR_ICSWX | CPU_FTR_DABRX )
 
 #ifdef __powerpc64__
 #ifdef CONFIG_PPC_BOOK3E
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 8e5fae8beaf6..46793b58a761 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -513,7 +513,7 @@ label##_common:							\
  */
 #define STD_EXCEPTION_COMMON_ASYNC(trap, label, hdlr)             \
         EXCEPTION_COMMON(trap, label, hdlr, ret_from_except_lite, \
-                         FINISH_NAP;RUNLATCH_ON;DISABLE_INTS)
+                         FINISH_NAP;DISABLE_INTS;RUNLATCH_ON)
 
 /*
  * When the idle code in power4_idle puts the CPU into NAP mode,
diff --git a/arch/powerpc/include/asm/firmware.h b/arch/powerpc/include/asm/firmware.h
index 0df54646f968..681bc0314b6b 100644
--- a/arch/powerpc/include/asm/firmware.h
+++ b/arch/powerpc/include/asm/firmware.h
@@ -52,6 +52,7 @@
 #define FW_FEATURE_BEST_ENERGY  ASM_CONST(0x0000000080000000)
 #define FW_FEATURE_TYPE1_AFFINITY ASM_CONST(0x0000000100000000)
 #define FW_FEATURE_PRRN         ASM_CONST(0x0000000200000000)
+#define FW_FEATURE_OPALv3       ASM_CONST(0x0000000400000000)
 
 #ifndef __ASSEMBLY__
 
@@ -69,7 +70,8 @@ enum {
                 FW_FEATURE_SET_MODE | FW_FEATURE_BEST_ENERGY |
                 FW_FEATURE_TYPE1_AFFINITY | FW_FEATURE_PRRN,
         FW_FEATURE_PSERIES_ALWAYS = 0,
-        FW_FEATURE_POWERNV_POSSIBLE = FW_FEATURE_OPAL | FW_FEATURE_OPALv2,
+        FW_FEATURE_POWERNV_POSSIBLE = FW_FEATURE_OPAL | FW_FEATURE_OPALv2 |
+                FW_FEATURE_OPALv3,
         FW_FEATURE_POWERNV_ALWAYS = 0,
         FW_FEATURE_PS3_POSSIBLE = FW_FEATURE_LPAR | FW_FEATURE_PS3_LV1,
         FW_FEATURE_PS3_ALWAYS = FW_FEATURE_LPAR | FW_FEATURE_PS3_LV1,
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index cf4df8e2139a..0c7f2bfcf134 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -264,6 +264,7 @@
 #define H_GET_MPP               0x2D4
 #define H_HOME_NODE_ASSOCIATIVITY 0x2EC
 #define H_BEST_ENERGY           0x2F4
+#define H_XIRR_X                0x2FC
 #define H_RANDOM                0x300
 #define H_COP                   0x304
 #define H_GET_MPP_X             0x314
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index d615b28dda82..ba713f166fa5 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -96,11 +96,12 @@ static inline bool arch_irqs_disabled(void)
 #endif
 
 #define hard_irq_disable()      do {                    \
+        u8 _was_enabled = get_paca()->soft_enabled;     \
         __hard_irq_disable();                           \
-        if (local_paca->soft_enabled)                   \
-                trace_hardirqs_off();                   \
         get_paca()->soft_enabled = 0;                   \
         get_paca()->irq_happened |= PACA_IRQ_HARD_DIS;  \
+        if (_was_enabled)                               \
+                trace_hardirqs_off();                   \
 } while(0)
 
 static inline bool lazy_irq_pending(void)
diff --git a/arch/powerpc/include/asm/kvm_asm.h b/arch/powerpc/include/asm/kvm_asm.h
index b9dd382cb349..851bac7afa4b 100644
--- a/arch/powerpc/include/asm/kvm_asm.h
+++ b/arch/powerpc/include/asm/kvm_asm.h
@@ -54,8 +54,16 @@
 #define BOOKE_INTERRUPT_DEBUG 15
 
 /* E500 */
-#define BOOKE_INTERRUPT_SPE_UNAVAIL 32
-#define BOOKE_INTERRUPT_SPE_FP_DATA 33
+#define BOOKE_INTERRUPT_SPE_ALTIVEC_UNAVAIL 32
+#define BOOKE_INTERRUPT_SPE_FP_DATA_ALTIVEC_ASSIST 33
+/*
+ * TODO: Unify 32-bit and 64-bit kernel exception handlers to use same defines
+ */
+#define BOOKE_INTERRUPT_SPE_UNAVAIL BOOKE_INTERRUPT_SPE_ALTIVEC_UNAVAIL
+#define BOOKE_INTERRUPT_SPE_FP_DATA BOOKE_INTERRUPT_SPE_FP_DATA_ALTIVEC_ASSIST
+#define BOOKE_INTERRUPT_ALTIVEC_UNAVAIL BOOKE_INTERRUPT_SPE_ALTIVEC_UNAVAIL
+#define BOOKE_INTERRUPT_ALTIVEC_ASSIST \
+                                BOOKE_INTERRUPT_SPE_FP_DATA_ALTIVEC_ASSIST
 #define BOOKE_INTERRUPT_SPE_FP_ROUND 34
 #define BOOKE_INTERRUPT_PERFORMANCE_MONITOR 35
 #define BOOKE_INTERRUPT_DOORBELL 36
@@ -67,10 +75,6 @@
 #define BOOKE_INTERRUPT_HV_SYSCALL 40
 #define BOOKE_INTERRUPT_HV_PRIV 41
 
-/* altivec */
-#define BOOKE_INTERRUPT_ALTIVEC_UNAVAIL 42
-#define BOOKE_INTERRUPT_ALTIVEC_ASSIST 43
-
 /* book3s */
 
 #define BOOK3S_INTERRUPT_SYSTEM_RESET   0x100
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index b6c8b58b1d76..cbb9305ab15a 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -243,7 +243,8 @@ enum OpalMCE_TlbErrorType {
 
 enum OpalThreadStatus {
         OPAL_THREAD_INACTIVE = 0x0,
-        OPAL_THREAD_STARTED = 0x1
+        OPAL_THREAD_STARTED = 0x1,
+        OPAL_THREAD_UNAVAILABLE = 0x2 /* opal-v3 */
 };
 
 enum OpalPciBusCompare {
@@ -563,6 +564,8 @@ extern void opal_nvram_init(void);
 
 extern int opal_machine_check(struct pt_regs *regs);
 
+extern void opal_shutdown(void);
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* __OPAL_H */
diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
index 8b11b5bd9938..2c1d8cb9b265 100644
--- a/arch/powerpc/include/asm/pci-bridge.h
+++ b/arch/powerpc/include/asm/pci-bridge.h
@@ -174,6 +174,8 @@ struct pci_dn {
 /* Get the pointer to a device_node's pci_dn */
 #define PCI_DN(dn)      ((struct pci_dn *) (dn)->data)
 
+extern struct pci_dn *pci_get_pdn(struct pci_dev *pdev);
+
 extern void * update_dn_pci_info(struct device_node *dn, void *data);
 
 static inline int pci_device_from_OF_node(struct device_node *np,
diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
index 91acb12bac92..b66ae722a8e9 100644
--- a/arch/powerpc/include/asm/pgalloc-64.h
+++ b/arch/powerpc/include/asm/pgalloc-64.h
@@ -186,7 +186,7 @@ static inline void pmd_populate(struct mm_struct *mm, pmd_t *pmd,
 
 static inline pgtable_t pmd_pgtable(pmd_t pmd)
 {
-        return (pgtable_t)(pmd_val(pmd) & -sizeof(pte_t)*PTRS_PER_PTE);
+        return (pgtable_t)(pmd_val(pmd) & ~PMD_MASKED_BITS);
 }
 
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index cea8496091ff..2f1b6c5f8174 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -523,6 +523,17 @@ END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,946)
 #define PPC440EP_ERR42
 #endif
 
+/* The following stops all load and store data streams associated with stream
+ * ID (ie. streams created explicitly).  The embedded and server mnemonics for
+ * dcbt are different so we use machine "power4" here explicitly.
+ */
+#define DCBT_STOP_ALL_STREAM_IDS(scratch)       \
+.machine push ;                                 \
+.machine "power4" ;                             \
+       lis     scratch,0x60000000@h;            \
+       dcbt    r0,scratch,0b01010;              \
+.machine pop
+
 /*
  * toreal/fromreal/tophys/tovirt macros. 32-bit BookE makes them
  * keep the address intact to be compatible with code shared with
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index d7e67ca8b4a6..14a658363698 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -284,6 +284,12 @@ struct thread_struct {
         unsigned long   ebbrr;
         unsigned long   ebbhr;
         unsigned long   bescr;
+        unsigned long   siar;
+        unsigned long   sdar;
+        unsigned long   sier;
+        unsigned long   mmcr0;
+        unsigned long   mmcr2;
+        unsigned long   mmcra;
 #endif
 };
 
@@ -403,21 +409,16 @@ static inline void prefetchw(const void *x)
 #endif
 
 #ifdef CONFIG_PPC64
-static inline unsigned long get_clean_sp(struct pt_regs *regs, int is_32)
+static inline unsigned long get_clean_sp(unsigned long sp, int is_32)
 {
-        unsigned long sp;
-
         if (is_32)
-                sp = regs->gpr[1] & 0x0ffffffffUL;
-        else
-                sp = regs->gpr[1];
-
+                return sp & 0x0ffffffffUL;
         return sp;
 }
 #else
-static inline unsigned long get_clean_sp(struct pt_regs *regs, int is_32)
+static inline unsigned long get_clean_sp(unsigned long sp, int is_32)
 {
-        return regs->gpr[1];
+        return sp;
 }
 #endif
 
diff --git a/arch/powerpc/include/asm/pte-hash64-64k.h b/arch/powerpc/include/asm/pte-hash64-64k.h
index 3e13e23e4fdf..d836d945068d 100644
--- a/arch/powerpc/include/asm/pte-hash64-64k.h
+++ b/arch/powerpc/include/asm/pte-hash64-64k.h
@@ -47,7 +47,7 @@
  * generic accessors and iterators here
  */
 #define __real_pte(e,p)         ((real_pte_t) { \
-                        (e), ((e) & _PAGE_COMBO) ? \
+                        (e), (pte_val(e) & _PAGE_COMBO) ? \
                                 (pte_val(*((p) + PTRS_PER_PTE))) : 0 })
 #define __rpte_to_hidx(r,index) ((pte_val((r).pte) & _PAGE_COMBO) ? \
         (((r).hidx >> ((index)<<2)) & 0xf) : ((pte_val((r).pte) >> 12) & 0xf))
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index a6136515c7f2..4a9e408644fe 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -111,17 +111,6 @@
 #define MSR_TM_TRANSACTIONAL(x) (((x) & MSR_TS_MASK) == MSR_TS_T)
 #define MSR_TM_SUSPENDED(x)     (((x) & MSR_TS_MASK) == MSR_TS_S)
 
-/* Reason codes describing kernel causes for transaction aborts.  By
-   convention, bit0 is copied to TEXASR[56] (IBM bit 7) which is set if
-   the failure is persistent.
-*/
-#define TM_CAUSE_RESCHED        0xfe
-#define TM_CAUSE_TLBI           0xfc
-#define TM_CAUSE_FAC_UNAV       0xfa
-#define TM_CAUSE_SYSCALL        0xf9 /* Persistent */
-#define TM_CAUSE_MISC           0xf6
-#define TM_CAUSE_SIGNAL         0xf4
-
 #if defined(CONFIG_PPC_BOOK3S_64)
 #define MSR_64BIT       MSR_SF
 
diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
index a8bc2bb4adc9..34fd70488d83 100644
--- a/arch/powerpc/include/asm/rtas.h
+++ b/arch/powerpc/include/asm/rtas.h
@@ -264,6 +264,8 @@ extern void rtas_progress(char *s, unsigned short hex);
 extern void rtas_initialize(void);
 extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data);
 extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data);
+extern int rtas_online_cpus_mask(cpumask_var_t cpus);
+extern int rtas_offline_cpus_mask(cpumask_var_t cpus);
 extern int rtas_ibm_suspend_me(struct rtas_args *);
 
 struct rtc_time;
diff --git a/arch/powerpc/include/asm/signal.h b/arch/powerpc/include/asm/signal.h
index fbe66c463891..9322c28aebd2 100644
--- a/arch/powerpc/include/asm/signal.h
+++ b/arch/powerpc/include/asm/signal.h
@@ -3,5 +3,8 @@
 
 #define __ARCH_HAS_SA_RESTORER
 #include <uapi/asm/signal.h>
+#include <uapi/asm/ptrace.h>
+
+extern unsigned long get_tm_stackpointer(struct pt_regs *regs);
 
 #endif /* _ASM_POWERPC_SIGNAL_H */
diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
index 8ceea14d6fe4..ba7b1973866e 100644
--- a/arch/powerpc/include/asm/thread_info.h
+++ b/arch/powerpc/include/asm/thread_info.h
@@ -97,7 +97,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_PERFMON_CTXSW       6       /* perfmon needs ctxsw calls */
 #define TIF_SYSCALL_AUDIT       7       /* syscall auditing active */
 #define TIF_SINGLESTEP          8       /* singlestepping active */
-#define TIF_MEMDIE              9       /* is terminating due to OOM killer */
+#define TIF_NOHZ                9       /* in adaptive nohz mode */
 #define TIF_SECCOMP             10      /* secure computing */
 #define TIF_RESTOREALL          11      /* Restore all regs (implies NOERROR) */
 #define TIF_NOERROR             12      /* Force successful syscall return */
@@ -106,6 +106,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_SYSCALL_TRACEPOINT  15      /* syscall tracepoint instrumentation */
 #define TIF_EMULATE_STACK_STORE 16      /* Is an instruction emulation
                                                 for stack store? */
+#define TIF_MEMDIE              17      /* is terminating due to OOM killer */
 
 /* as above, but as bit values */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
@@ -124,8 +125,10 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_UPROBE             (1<<TIF_UPROBE)
 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
 #define _TIF_EMULATE_STACK_STORE        (1<<TIF_EMULATE_STACK_STORE)
+#define _TIF_NOHZ               (1<<TIF_NOHZ)
 #define _TIF_SYSCALL_T_OR_A     (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
-                                 _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT)
+                                 _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \
+                                 _TIF_NOHZ)
 
 #define _TIF_USER_WORK_MASK     (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
                                  _TIF_NOTIFY_RESUME | _TIF_UPROBE)
diff --git a/arch/powerpc/include/asm/tm.h b/arch/powerpc/include/asm/tm.h
index 4b4449abf3f8..9dfbc34bdbf5 100644
--- a/arch/powerpc/include/asm/tm.h
+++ b/arch/powerpc/include/asm/tm.h
@@ -5,6 +5,8 @@
  * Copyright 2012 Matt Evans & Michael Neuling, IBM Corporation.
  */
 
+#include <uapi/asm/tm.h>
+
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
 extern void do_load_up_transact_fpu(struct thread_struct *thread);
 extern void do_load_up_transact_altivec(struct thread_struct *thread);
diff --git a/arch/powerpc/include/asm/udbg.h b/arch/powerpc/include/asm/udbg.h
index 5a7510e9d09d..dc590919f8eb 100644
--- a/arch/powerpc/include/asm/udbg.h
+++ b/arch/powerpc/include/asm/udbg.h
@@ -52,6 +52,7 @@ extern void __init udbg_init_40x_realmode(void);
 extern void __init udbg_init_cpm(void);
 extern void __init udbg_init_usbgecko(void);
 extern void __init udbg_init_wsp(void);
+extern void __init udbg_init_memcons(void);
 extern void __init udbg_init_ehv_bc(void);
 extern void __init udbg_init_ps3gelic(void);
 extern void __init udbg_init_debug_opal_raw(void);
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index f7bca6370745..5182c8622b54 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -40,6 +40,7 @@ header-y += statfs.h
 header-y += swab.h
 header-y += termbits.h
 header-y += termios.h
+header-y += tm.h
 header-y += types.h
 header-y += ucontext.h
 header-y += unistd.h
diff --git a/arch/powerpc/include/uapi/asm/tm.h b/arch/powerpc/include/uapi/asm/tm.h
new file mode 100644
index 000000000000..85059a00f560
--- /dev/null
+++ b/arch/powerpc/include/uapi/asm/tm.h
@@ -0,0 +1,18 @@
+#ifndef _ASM_POWERPC_TM_H
+#define _ASM_POWERPC_TM_H
+
+/* Reason codes describing kernel causes for transaction aborts.  By
+ * convention, bit0 is copied to TEXASR[56] (IBM bit 7) which is set if
+ * the failure is persistent.  PAPR saves 0xff-0xe0 for the hypervisor.
+ */
+#define TM_CAUSE_PERSISTENT     0x01
+#define TM_CAUSE_RESCHED        0xde
+#define TM_CAUSE_TLBI           0xdc
+#define TM_CAUSE_FAC_UNAV       0xda
+#define TM_CAUSE_SYSCALL        0xd8  /* future use */
+#define TM_CAUSE_MISC           0xd6  /* future use */
+#define TM_CAUSE_SIGNAL         0xd4
+#define TM_CAUSE_ALIGNMENT      0xd2
+#define TM_CAUSE_EMULATE        0xd0
+
+#endif
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index b51a97cfedf8..6f16ffafa6f0 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -127,6 +127,12 @@ int main(void)
         DEFINE(THREAD_BESCR, offsetof(struct thread_struct, bescr));
         DEFINE(THREAD_EBBHR, offsetof(struct thread_struct, ebbhr));
         DEFINE(THREAD_EBBRR, offsetof(struct thread_struct, ebbrr));
+        DEFINE(THREAD_SIAR, offsetof(struct thread_struct, siar));
+        DEFINE(THREAD_SDAR, offsetof(struct thread_struct, sdar));
+        DEFINE(THREAD_SIER, offsetof(struct thread_struct, sier));
+        DEFINE(THREAD_MMCR0, offsetof(struct thread_struct, mmcr0));
+        DEFINE(THREAD_MMCR2, offsetof(struct thread_struct, mmcr2));
+        DEFINE(THREAD_MMCRA, offsetof(struct thread_struct, mmcra));
 #endif
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
         DEFINE(PACATMSCRATCH, offsetof(struct paca_struct, tm_scratch));
diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
index a283b6442b26..18b5b9cf8e37 100644
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -135,8 +135,12 @@ __init_HFSCR:
         blr
 
 __init_TLB:
-        /* Clear the TLB */
-        li      r6,128
+        /*
+         * Clear the TLB using the "IS 3" form of tlbiel instruction
+         * (invalidate by congruence class). P7 has 128 CCs, P8 has 512
+         * so we just always do 512
+         */
+        li      r6,512
         mtctr   r6
         li      r7,0xc00        /* IS field = 0b11 */
         ptesync
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index c60bbec25c1f..2a45d0f04385 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -452,7 +452,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .mmu_features           = MMU_FTRS_POWER8,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
-                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .oprofile_type          = PPC_OPROFILE_INVALID,
                 .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
                 .cpu_setup              = __setup_cpu_power8,
                 .cpu_restore            = __restore_cpu_power8,
@@ -482,7 +482,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_name               = "POWER7+ (raw)",
                 .cpu_features           = CPU_FTRS_POWER7,
                 .cpu_user_features      = COMMON_USER_POWER7,
-                .cpu_user_features      = COMMON_USER2_POWER7,
+                .cpu_user_features2     = COMMON_USER2_POWER7,
                 .mmu_features           = MMU_FTRS_POWER7,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
@@ -507,7 +507,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .num_pmcs               = 6,
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/power8",
-                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .oprofile_type          = PPC_OPROFILE_INVALID,
                 .cpu_setup              = __setup_cpu_power8,
                 .cpu_restore            = __restore_cpu_power8,
                 .platform               = "power8",
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index e514de57a125..22b45a4955cd 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -439,8 +439,6 @@ ret_from_fork:
 ret_from_kernel_thread:
         REST_NVGPRS(r1)
         bl      schedule_tail
-        li      r3,0
-        stw     r3,0(r1)
         mtlr    r14
         mr      r3,r15
         PPC440EP_ERR42
@@ -851,7 +849,7 @@ resume_kernel:
         /* check current_thread_info, _TIF_EMULATE_STACK_STORE */
         CURRENT_THREAD_INFO(r9, r1)
         lwz     r8,TI_FLAGS(r9)
-        andis.  r8,r8,_TIF_EMULATE_STACK_STORE@h
+        andis.  r0,r8,_TIF_EMULATE_STACK_STORE@h
         beq+    1f
 
         addi    r8,r1,INT_FRAME_SIZE    /* Get the kprobed function entry */
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 915fbb4fc2fe..8741c854e03d 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -33,6 +33,7 @@
 #include <asm/irqflags.h>
 #include <asm/ftrace.h>
 #include <asm/hw_irq.h>
+#include <asm/context_tracking.h>
 
 /*
  * System calls.
@@ -376,8 +377,6 @@ _GLOBAL(ret_from_fork)
 _GLOBAL(ret_from_kernel_thread)
         bl      .schedule_tail
         REST_NVGPRS(r1)
-        li      r3,0
-        std     r3,0(r1)
         ld      r14, 0(r14)
         mtlr    r14
         mr      r3,r15
@@ -488,6 +487,13 @@ BEGIN_FTR_SECTION
         ldarx   r6,0,r1
 END_FTR_SECTION_IFSET(CPU_FTR_STCX_CHECKS_ADDRESS)
 
+#ifdef CONFIG_PPC_BOOK3S
+/* Cancel all explict user streams as they will have no use after context
+ * switch and will stop the HW from creating streams itself
+ */
+        DCBT_STOP_ALL_STREAM_IDS(r6)
+#endif
+
         addi    r6,r4,-THREAD   /* Convert THREAD to 'current' */
         std     r6,PACACURRENT(r13)     /* Set new 'current' */
 
@@ -634,7 +640,7 @@ _GLOBAL(ret_from_except_lite)
         andi.   r0,r4,_TIF_NEED_RESCHED
         beq     1f
         bl      .restore_interrupts
-        bl      .schedule
+        SCHEDULE_USER
         b       .ret_from_except_lite
 
 1:      bl      .save_nvgprs
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
index 42a756eec9ff..645170a07ada 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -489,7 +489,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
          */
 
         mfspr   r14,SPRN_DBSR           /* check single-step/branch taken */
-        andis.  r15,r14,DBSR_IC@h
+        andis.  r15,r14,(DBSR_IC|DBSR_BT)@h
         beq+    1f
 
         LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
@@ -500,7 +500,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
         bge+    cr1,1f
 
         /* here it looks like we got an inappropriate debug exception. */
-        lis     r14,DBSR_IC@h           /* clear the IC event */
+        lis     r14,(DBSR_IC|DBSR_BT)@h         /* clear the event */
         rlwinm  r11,r11,0,~MSR_DE       /* clear DE in the CSRR1 value */
         mtspr   SPRN_DBSR,r14
         mtspr   SPRN_CSRR1,r11
@@ -555,7 +555,7 @@ kernel_dbg_exc:
          */
 
         mfspr   r14,SPRN_DBSR           /* check single-step/branch taken */
-        andis.  r15,r14,DBSR_IC@h
+        andis.  r15,r14,(DBSR_IC|DBSR_BT)@h
         beq+    1f
 
         LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
@@ -566,7 +566,7 @@ kernel_dbg_exc:
         bge+    cr1,1f
 
         /* here it looks like we got an inappropriate debug exception. */
-        lis     r14,DBSR_IC@h           /* clear the IC event */
+        lis     r14,(DBSR_IC|DBSR_BT)@h         /* clear the event */
         rlwinm  r11,r11,0,~MSR_DE       /* clear DE in the DSRR1 value */
         mtspr   SPRN_DBSR,r14
         mtspr   SPRN_DSRR1,r11
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index e6eba1bf61ad..40e4a17c8ba0 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -454,38 +454,14 @@ BEGIN_FTR_SECTION
         xori    r10,r10,(MSR_FE0|MSR_FE1)
         mtmsrd  r10
         sync
-        fmr     0,0
-        fmr     1,1
-        fmr     2,2
-        fmr     3,3
-        fmr     4,4
-        fmr     5,5
-        fmr     6,6
-        fmr     7,7
-        fmr     8,8
-        fmr     9,9
-        fmr     10,10
-        fmr     11,11
-        fmr     12,12
-        fmr     13,13
-        fmr     14,14
-        fmr     15,15
-        fmr     16,16
-        fmr     17,17
-        fmr     18,18
-        fmr     19,19
-        fmr     20,20
-        fmr     21,21
-        fmr     22,22
-        fmr     23,23
-        fmr     24,24
-        fmr     25,25
-        fmr     26,26
-        fmr     27,27
-        fmr     28,28
-        fmr     29,29
-        fmr     30,30
-        fmr     31,31
+
+#define FMR2(n)  fmr (n), (n) ; fmr n+1, n+1
+#define FMR4(n)  FMR2(n) ; FMR2(n+2)
+#define FMR8(n)  FMR4(n) ; FMR4(n+4)
+#define FMR16(n) FMR8(n) ; FMR8(n+8)
+#define FMR32(n) FMR16(n) ; FMR16(n+16)
+        FMR32(0)
+
 FTR_SECTION_ELSE
 /*
  * To denormalise we need to move a copy of the register to itself.
@@ -495,39 +471,25 @@ FTR_SECTION_ELSE
         oris    r10,r10,MSR_VSX@h
         mtmsrd  r10
         sync
-        XVCPSGNDP(0,0,0)
-        XVCPSGNDP(1,1,1)
-        XVCPSGNDP(2,2,2)
-        XVCPSGNDP(3,3,3)
-        XVCPSGNDP(4,4,4)
-        XVCPSGNDP(5,5,5)
-        XVCPSGNDP(6,6,6)
-        XVCPSGNDP(7,7,7)
-        XVCPSGNDP(8,8,8)
-        XVCPSGNDP(9,9,9)
-        XVCPSGNDP(10,10,10)
-        XVCPSGNDP(11,11,11)
-        XVCPSGNDP(12,12,12)
-        XVCPSGNDP(13,13,13)
-        XVCPSGNDP(14,14,14)
-        XVCPSGNDP(15,15,15)
-        XVCPSGNDP(16,16,16)
-        XVCPSGNDP(17,17,17)
-        XVCPSGNDP(18,18,18)
-        XVCPSGNDP(19,19,19)
-        XVCPSGNDP(20,20,20)
-        XVCPSGNDP(21,21,21)
-        XVCPSGNDP(22,22,22)
-        XVCPSGNDP(23,23,23)
-        XVCPSGNDP(24,24,24)
-        XVCPSGNDP(25,25,25)
-        XVCPSGNDP(26,26,26)
-        XVCPSGNDP(27,27,27)
-        XVCPSGNDP(28,28,28)
-        XVCPSGNDP(29,29,29)
-        XVCPSGNDP(30,30,30)
-        XVCPSGNDP(31,31,31)
+
+#define XVCPSGNDP2(n) XVCPSGNDP(n,n,n) ; XVCPSGNDP(n+1,n+1,n+1)
+#define XVCPSGNDP4(n) XVCPSGNDP2(n) ; XVCPSGNDP2(n+2)
+#define XVCPSGNDP8(n) XVCPSGNDP4(n) ; XVCPSGNDP4(n+4)
+#define XVCPSGNDP16(n) XVCPSGNDP8(n) ; XVCPSGNDP8(n+8)
+#define XVCPSGNDP32(n) XVCPSGNDP16(n) ; XVCPSGNDP16(n+16)
+        XVCPSGNDP32(0)
+
 ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_206)
+
+BEGIN_FTR_SECTION
+        b       denorm_done
+END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+/*
+ * To denormalise we need to move a copy of the register to itself.
+ * For POWER8 we need to do that for all 64 VSX registers
+ */
+        XVCPSGNDP32(32)
+denorm_done:
         mtspr   SPRN_HSRR0,r11
         mtcrf   0x80,r9
         ld      r9,PACA_EXGEN+EX_R9(r13)
@@ -721,7 +683,7 @@ machine_check_common:
         STD_EXCEPTION_COMMON(0xb00, trap_0b, .unknown_exception)
         STD_EXCEPTION_COMMON(0xd00, single_step, .single_step_exception)
         STD_EXCEPTION_COMMON(0xe00, trap_0e, .unknown_exception)
-        STD_EXCEPTION_COMMON(0xe40, emulation_assist, .program_check_exception)
+        STD_EXCEPTION_COMMON(0xe40, emulation_assist, .emulation_assist_interrupt)
         STD_EXCEPTION_COMMON(0xe60, hmi_exception, .unknown_exception)
 #ifdef CONFIG_PPC_DOORBELL
         STD_EXCEPTION_COMMON_ASYNC(0xe80, h_doorbell, .doorbell_exception)
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 5cbcf4d5a808..ea185e0b3cae 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -162,7 +162,7 @@ notrace unsigned int __check_irq_replay(void)
          * in case we also had a rollover while hard disabled
          */
         local_paca->irq_happened &= ~PACA_IRQ_DEC;
-        if (decrementer_check_overflow())
+        if ((happened & PACA_IRQ_DEC) || decrementer_check_overflow())
                 return 0x900;
 
         /* Finally check if an external interrupt happened */
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 466a2908bb63..611acdf30096 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/cpu.h>
+#include <linux/hardirq.h>
 
 #include <asm/page.h>
 #include <asm/current.h>
@@ -335,10 +336,13 @@ void default_machine_kexec(struct kimage *image)
         pr_debug("kexec: Starting switchover sequence.\n");
 
         /* switch to a staticly allocated stack.  Based on irq stack code.
+         * We setup preempt_count to avoid using VMX in memcpy.
          * XXX: the task struct will likely be invalid once we do the copy!
          */
         kexec_stack.thread_info.task = current_thread_info()->task;
         kexec_stack.thread_info.flags = 0;
+        kexec_stack.thread_info.preempt_count = HARDIRQ_OFFSET;
+        kexec_stack.thread_info.cpu = current_thread_info()->cpu;
 
         /* We need a static PACA, too; copy this CPU's PACA over and switch to
          * it.  Also poison per_cpu_offset to catch anyone using non-static
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index 19e096bd0e73..e469f30e6eeb 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -657,6 +657,17 @@ _GLOBAL(__ucmpdi2)
         li      r3,2
         blr
 
+_GLOBAL(__bswapdi2)
+        rotlwi  r9,r4,8
+        rotlwi  r10,r3,8
+        rlwimi  r9,r4,24,0,7
+        rlwimi  r10,r3,24,0,7
+        rlwimi  r9,r4,24,16,23
+        rlwimi  r10,r3,24,16,23
+        mr      r3,r9
+        mr      r4,r10
+        blr
+
 _GLOBAL(abs)
         srawi   r4,r3,31
         xor     r3,r3,r4
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index 5cfa8008693b..6820e45f557b 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -234,6 +234,17 @@ _GLOBAL(__flush_dcache_icache)
         isync
         blr
 
+_GLOBAL(__bswapdi2)
+        srdi    r8,r3,32
+        rlwinm  r7,r3,8,0xffffffff
+        rlwimi  r7,r3,24,0,7
+        rlwinm  r9,r8,8,0xffffffff
+        rlwimi  r7,r3,24,16,23
+        rlwimi  r9,r8,24,0,7
+        rlwimi  r9,r8,24,16,23
+        sldi    r7,r7,32
+        or      r3,r7,r9
+        blr
 
 #if defined(CONFIG_PPC_PMAC) || defined(CONFIG_PPC_MAPLE)
 /*
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index f5c5c90799a7..eabeec991016 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -359,7 +359,6 @@ static pgprot_t __pci_mmap_set_pgprot(struct pci_dev *dev, struct resource *rp,
                                       enum pci_mmap_state mmap_state,
                                       int write_combine)
 {
-        unsigned long prot = pgprot_val(protection);
 
         /* Write combine is always 0 on non-memory space mappings. On
          * memory space, if the user didn't pass 1, we check for a
@@ -376,9 +375,9 @@ static pgprot_t __pci_mmap_set_pgprot(struct pci_dev *dev, struct resource *rp,
 
         /* XXX would be nice to have a way to ask for write-through */
         if (write_combine)
-                return pgprot_noncached_wc(prot);
+                return pgprot_noncached_wc(protection);
         else
-                return pgprot_noncached(prot);
+                return pgprot_noncached(protection);
 }
 
 /*
@@ -658,15 +657,6 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar,
  *     ranges. However, some machines (thanks Apple !) tend to split their
  *     space into lots of small contiguous ranges. So we have to coalesce.
  *
- *   - We can only cope with all memory ranges having the same offset
- *     between CPU addresses and PCI addresses. Unfortunately, some bridges
- *     are setup for a large 1:1 mapping along with a small "window" which
- *     maps PCI address 0 to some arbitrary high address of the CPU space in
- *     order to give access to the ISA memory hole.
- *     The way out of here that I've chosen for now is to always set the
- *     offset based on the first resource found, then override it if we
- *     have a different offset and the previous was set by an ISA hole.
- *
  *   - Some busses have IO space not starting at 0, which causes trouble with
  *     the way we do our IO resource renumbering. The code somewhat deals with
  *     it for 64 bits but I would expect problems on 32 bits.
@@ -681,10 +671,9 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
         int rlen;
         int pna = of_n_addr_cells(dev);
         int np = pna + 5;
-        int memno = 0, isa_hole = -1;
+        int memno = 0;
         u32 pci_space;
         unsigned long long pci_addr, cpu_addr, pci_next, cpu_next, size;
-        unsigned long long isa_mb = 0;
         struct resource *res;
 
         printk(KERN_INFO "PCI host bridge %s %s ranges:\n",
@@ -778,8 +767,6 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                         }
                         /* Handles ISA memory hole space here */
                         if (pci_addr == 0) {
-                                isa_mb = cpu_addr;
-                                isa_hole = memno;
                                 if (primary || isa_mem_base == 0)
                                         isa_mem_base = cpu_addr;
                                 hose->isa_mem_phys = cpu_addr;
@@ -840,6 +827,7 @@ static void pcibios_fixup_resources(struct pci_dev *dev)
         }
         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
                 struct resource *res = dev->resource + i;
+                struct pci_bus_region reg;
                 if (!res->flags)
                         continue;
 
@@ -848,8 +836,9 @@ static void pcibios_fixup_resources(struct pci_dev *dev)
                  * at 0 as unset as well, except if PCI_PROBE_ONLY is also set
                  * since in that case, we don't want to re-assign anything
                  */
+                pcibios_resource_to_bus(dev, &reg, res);
                 if (pci_has_flag(PCI_REASSIGN_ALL_RSRC) ||
-                    (res->start == 0 && !pci_has_flag(PCI_PROBE_ONLY))) {
+                    (reg.start == 0 && !pci_has_flag(PCI_PROBE_ONLY))) {
                         /* Only print message if not re-assigning */
                         if (!pci_has_flag(PCI_REASSIGN_ALL_RSRC))
                                 pr_debug("PCI:%s Resource %d %016llx-%016llx [%x] "
@@ -1521,9 +1510,10 @@ static void pcibios_setup_phb_resources(struct pci_controller *hose,
         for (i = 0; i < 3; ++i) {
                 res = &hose->mem_resources[i];
                 if (!res->flags) {
-                        printk(KERN_ERR "PCI: Memory resource 0 not set for "
-                               "host bridge %s (domain %d)\n",
-                               hose->dn->full_name, hose->global_number);
+                        if (i == 0)
+                                printk(KERN_ERR "PCI: Memory resource 0 not set for "
+                                       "host bridge %s (domain %d)\n",
+                                       hose->dn->full_name, hose->global_number);
                         continue;
                 }
                 offset = hose->mem_offset[i];
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 873050d26840..2e8629654ca8 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -266,3 +266,13 @@ int pcibus_to_node(struct pci_bus *bus)
 }
 EXPORT_SYMBOL(pcibus_to_node);
 #endif
+
+static void quirk_radeon_32bit_msi(struct pci_dev *dev)
+{
+        struct pci_dn *pdn = pci_get_pdn(dev);
+
+        if (pdn)
+                pdn->force_32bit_msi = 1;
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x68f2, quirk_radeon_32bit_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0xaa68, quirk_radeon_32bit_msi);
diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
index e7af165f8b9d..df038442548a 100644
--- a/arch/powerpc/kernel/pci_dn.c
+++ b/arch/powerpc/kernel/pci_dn.c
@@ -32,6 +32,14 @@
 #include <asm/ppc-pci.h>
 #include <asm/firmware.h>
 
+struct pci_dn *pci_get_pdn(struct pci_dev *pdev)
+{
+        struct device_node *dn = pci_device_to_OF_node(pdev);
+        if (!dn)
+                return NULL;
+        return PCI_DN(dn);
+}
+
 /*
  * Traverse_func that inits the PCI fields of the device node.
  * NOTE: this *must* be done before read/write config to the device.
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index 78b8766fd79e..c29666586998 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -143,7 +143,8 @@ EXPORT_SYMBOL(__lshrdi3);
 int __ucmpdi2(unsigned long long, unsigned long long);
 EXPORT_SYMBOL(__ucmpdi2);
 #endif
-
+long long __bswapdi2(long long);
+EXPORT_SYMBOL(__bswapdi2);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index ceb4e7b62cf4..076d1242507a 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -339,6 +339,13 @@ static void set_debug_reg_defaults(struct thread_struct *thread)
 
 static void prime_debug_regs(struct thread_struct *thread)
 {
+        /*
+         * We could have inherited MSR_DE from userspace, since
+         * it doesn't get cleared on exception entry.  Make sure
+         * MSR_DE is clear before we enable any debug events.
+         */
+        mtmsr(mfmsr() & ~MSR_DE);
+
         mtspr(SPRN_IAC1, thread->iac1);
         mtspr(SPRN_IAC2, thread->iac2);
 #if CONFIG_PPC_ADV_DEBUG_IACS > 2
@@ -392,7 +399,8 @@ static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
 static inline int __set_dabr(unsigned long dabr, unsigned long dabrx)
 {
         mtspr(SPRN_DABR, dabr);
-        mtspr(SPRN_DABRX, dabrx);
+        if (cpu_has_feature(CPU_FTR_DABRX))
+                mtspr(SPRN_DABRX, dabrx);
         return 0;
 }
 #else
@@ -971,6 +979,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
          * do some house keeping and then return from the fork or clone
          * system call, using the stack frame created above.
          */
+        ((unsigned long *)sp)[0] = 0;
         sp -= sizeof(struct pt_regs);
         kregs = (struct pt_regs *) sp;
         sp -= STACK_FRAME_OVERHEAD;
@@ -1360,7 +1369,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
 
 #ifdef CONFIG_PPC64
 /* Called with hard IRQs off */
-void __ppc64_runlatch_on(void)
+void notrace __ppc64_runlatch_on(void)
 {
         struct thread_info *ti = current_thread_info();
         unsigned long ctrl;
@@ -1373,7 +1382,7 @@ void __ppc64_runlatch_on(void)
 }
 
 /* Called with hard IRQs off */
-void __ppc64_runlatch_off(void)
+void notrace __ppc64_runlatch_off(void)
 {
         struct thread_info *ti = current_thread_info();
         unsigned long ctrl;
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 3b14d320e69f..98c2fc198712 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -32,6 +32,7 @@
 #include <trace/syscall.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/perf_event.h>
+#include <linux/context_tracking.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -1788,6 +1789,8 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 {
         long ret = 0;
 
+        user_exit();
+
         secure_computing_strict(regs->gpr[0]);
 
         if (test_thread_flag(TIF_SYSCALL_TRACE) &&
@@ -1832,4 +1835,6 @@ void do_syscall_trace_leave(struct pt_regs *regs)
         step = test_thread_flag(TIF_SINGLESTEP);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
                 tracehook_report_syscall_exit(regs, step);
+
+        user_enter();
 }
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 1fd6e7b2f390..52add6f3e201 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/capability.h>
 #include <linux/delay.h>
+#include <linux/cpu.h>
 #include <linux/smp.h>
 #include <linux/completion.h>
 #include <linux/cpumask.h>
@@ -807,6 +808,95 @@ static void rtas_percpu_suspend_me(void *info)
         __rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1);
 }
 
+enum rtas_cpu_state {
+        DOWN,
+        UP,
+};
+
+#ifndef CONFIG_SMP
+static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+                                cpumask_var_t cpus)
+{
+        if (!cpumask_empty(cpus)) {
+                cpumask_clear(cpus);
+                return -EINVAL;
+        } else
+                return 0;
+}
+#else
+/* On return cpumask will be altered to indicate CPUs changed.
+ * CPUs with states changed will be set in the mask,
+ * CPUs with status unchanged will be unset in the mask. */
+static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+                                cpumask_var_t cpus)
+{
+        int cpu;
+        int cpuret = 0;
+        int ret = 0;
+
+        if (cpumask_empty(cpus))
+                return 0;
+
+        for_each_cpu(cpu, cpus) {
+                switch (state) {
+                case DOWN:
+                        cpuret = cpu_down(cpu);
+                        break;
+                case UP:
+                        cpuret = cpu_up(cpu);
+                        break;
+                }
+                if (cpuret) {
+                        pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
+                                        __func__,
+                                        ((state == UP) ? "up" : "down"),
+                                        cpu, cpuret);
+                        if (!ret)
+                                ret = cpuret;
+                        if (state == UP) {
+                                /* clear bits for unchanged cpus, return */
+                                cpumask_shift_right(cpus, cpus, cpu);
+                                cpumask_shift_left(cpus, cpus, cpu);
+                                break;
+                        } else {
+                                /* clear bit for unchanged cpu, continue */
+                                cpumask_clear_cpu(cpu, cpus);
+                        }
+                }
+        }
+
+        return ret;
+}
+#endif
+
+int rtas_online_cpus_mask(cpumask_var_t cpus)
+{
+        int ret;
+
+        ret = rtas_cpu_state_change_mask(UP, cpus);
+
+        if (ret) {
+                cpumask_var_t tmp_mask;
+
+                if (!alloc_cpumask_var(&tmp_mask, GFP_TEMPORARY))
+                        return ret;
+
+                /* Use tmp_mask to preserve cpus mask from first failure */
+                cpumask_copy(tmp_mask, cpus);
+                rtas_offline_cpus_mask(tmp_mask);
+                free_cpumask_var(tmp_mask);
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(rtas_online_cpus_mask);
+
+int rtas_offline_cpus_mask(cpumask_var_t cpus)
+{
+        return rtas_cpu_state_change_mask(DOWN, cpus);
+}
+EXPORT_SYMBOL(rtas_offline_cpus_mask);
+
 int rtas_ibm_suspend_me(struct rtas_args *args)
 {
         long state;
@@ -814,6 +904,8 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
         unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
         struct rtas_suspend_me_data data;
         DECLARE_COMPLETION_ONSTACK(done);
+        cpumask_var_t offline_mask;
+        int cpuret;
 
         if (!rtas_service_present("ibm,suspend-me"))
                 return -ENOSYS;
@@ -837,11 +929,24 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
                 return 0;
         }
 
+        if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
+                return -ENOMEM;
+
         atomic_set(&data.working, 0);
         atomic_set(&data.done, 0);
         atomic_set(&data.error, 0);
         data.token = rtas_token("ibm,suspend-me");
         data.complete = &done;
+
+        /* All present CPUs must be online */
+        cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
+        cpuret = rtas_online_cpus_mask(offline_mask);
+        if (cpuret) {
+                pr_err("%s: Could not bring present CPUs online.\n", __func__);
+                atomic_set(&data.error, cpuret);
+                goto out;
+        }
+
         stop_topology_update();
 
         /* Call function on all CPUs.  One of us will make the
@@ -857,6 +962,14 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
 
         start_topology_update();
 
+        /* Take down CPUs not online prior to suspend */
+        cpuret = rtas_offline_cpus_mask(offline_mask);
+        if (cpuret)
+                pr_warn("%s: Could not restore CPUs to offline state.\n",
+                                __func__);
+
+out:
+        free_cpumask_var(offline_mask);
         return atomic_read(&data.error);
 }
 #else /* CONFIG_PPC_PSERIES */
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 5b3022470126..2f3cdb01506d 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -89,6 +89,7 @@
 
 /* Array sizes */
 #define VALIDATE_BUF_SIZE 4096    
+#define VALIDATE_MSG_LEN  256
 #define RTAS_MSG_MAXLEN   64
 
 /* Quirk - RTAS requires 4k list length and block size */
@@ -466,7 +467,7 @@ static void validate_flash(struct rtas_validate_flash_t *args_buf)
 }
 
 static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf, 
-                                   char *msg)
+                                   char *msg, int msglen)
 {
         int n;
 
@@ -474,7 +475,8 @@ static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf,
                 n = sprintf(msg, "%d\n", args_buf->update_results);
                 if ((args_buf->update_results >= VALIDATE_CUR_UNKNOWN) ||
                     (args_buf->update_results == VALIDATE_TMP_UPDATE))
-                        n += sprintf(msg + n, "%s\n", args_buf->buf);
+                        n += snprintf(msg + n, msglen - n, "%s\n",
+                                        args_buf->buf);
         } else {
                 n = sprintf(msg, "%d\n", args_buf->status);
         }
@@ -486,11 +488,11 @@ static ssize_t validate_flash_read(struct file *file, char __user *buf,
 {
         struct rtas_validate_flash_t *const args_buf =
                 &rtas_validate_flash_data;
-        char msg[RTAS_MSG_MAXLEN];
+        char msg[VALIDATE_MSG_LEN];
         int msglen;
 
         mutex_lock(&rtas_validate_flash_mutex);
-        msglen = get_validate_flash_msg(args_buf, msg);
+        msglen = get_validate_flash_msg(args_buf, msg, VALIDATE_MSG_LEN);
         mutex_unlock(&rtas_validate_flash_mutex);
 
         return simple_read_from_buffer(buf, count, ppos, msg, msglen);
diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
index cf12eae02de5..457e97aa2945 100644
--- a/arch/powerpc/kernel/signal.c
+++ b/arch/powerpc/kernel/signal.c
@@ -13,10 +13,12 @@
 #include <linux/signal.h>
 #include <linux/uprobes.h>
 #include <linux/key.h>
+#include <linux/context_tracking.h>
 #include <asm/hw_breakpoint.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include <asm/debug.h>
+#include <asm/tm.h>
 
 #include "signal.h"
 
@@ -24,18 +26,18 @@
  * through debug.exception-trace sysctl.
  */
 
-int show_unhandled_signals = 0;
+int show_unhandled_signals = 1;
 
 /*
  * Allocate space for the signal frame
  */
-void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
+void __user * get_sigframe(struct k_sigaction *ka, unsigned long sp,
                            size_t frame_size, int is_32)
 {
         unsigned long oldsp, newsp;
 
         /* Default to using normal stack */
-        oldsp = get_clean_sp(regs, is_32);
+        oldsp = get_clean_sp(sp, is_32);
 
         /* Check for alt stack */
         if ((ka->sa.sa_flags & SA_ONSTACK) &&
@@ -159,6 +161,8 @@ static int do_signal(struct pt_regs *regs)
 
 void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags)
 {
+        user_exit();
+
         if (thread_info_flags & _TIF_UPROBE)
                 uprobe_notify_resume(regs);
 
@@ -169,4 +173,41 @@ void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags)
                 clear_thread_flag(TIF_NOTIFY_RESUME);
                 tracehook_notify_resume(regs);
         }
+
+        user_enter();
+}
+
+unsigned long get_tm_stackpointer(struct pt_regs *regs)
+{
+        /* When in an active transaction that takes a signal, we need to be
+         * careful with the stack.  It's possible that the stack has moved back
+         * up after the tbegin.  The obvious case here is when the tbegin is
+         * called inside a function that returns before a tend.  In this case,
+         * the stack is part of the checkpointed transactional memory state.
+         * If we write over this non transactionally or in suspend, we are in
+         * trouble because if we get a tm abort, the program counter and stack
+         * pointer will be back at the tbegin but our in memory stack won't be
+         * valid anymore.
+         *
+         * To avoid this, when taking a signal in an active transaction, we
+         * need to use the stack pointer from the checkpointed state, rather
+         * than the speculated state.  This ensures that the signal context
+         * (written tm suspended) will be written below the stack required for
+         * the rollback.  The transaction is aborted becuase of the treclaim,
+         * so any memory written between the tbegin and the signal will be
+         * rolled back anyway.
+         *
+         * For signals taken in non-TM or suspended mode, we use the
+         * normal/non-checkpointed stack pointer.
+         */
+
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        if (MSR_TM_ACTIVE(regs->msr)) {
+                tm_enable();
+                tm_reclaim(&current->thread, regs->msr, TM_CAUSE_SIGNAL);
+                if (MSR_TM_TRANSACTIONAL(regs->msr))
+                        return current->thread.ckpt_regs.gpr[1];
+        }
+#endif
+        return regs->gpr[1];
 }
diff --git a/arch/powerpc/kernel/signal.h b/arch/powerpc/kernel/signal.h
index ec84c901ceab..c69b9aeb9f23 100644
--- a/arch/powerpc/kernel/signal.h
+++ b/arch/powerpc/kernel/signal.h
@@ -12,7 +12,7 @@
 
 extern void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags);
 
-extern void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
+extern void __user * get_sigframe(struct k_sigaction *ka, unsigned long sp,
                                   size_t frame_size, int is_32);
 
 extern int handle_signal32(unsigned long sig, struct k_sigaction *ka,
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 95068bf569ad..201385c3a1ae 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -503,12 +503,6 @@ static int save_tm_user_regs(struct pt_regs *regs,
 {
         unsigned long msr = regs->msr;
 
-        /* tm_reclaim rolls back all reg states, updating thread.ckpt_regs,
-         * thread.transact_fpr[], thread.transact_vr[], etc.
-         */
-        tm_enable();
-        tm_reclaim(&current->thread, msr, TM_CAUSE_SIGNAL);
-
         /* Make sure floating point registers are stored in regs */
         flush_fp_to_thread(current);
 
@@ -965,7 +959,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
 
         /* Set up Signal Frame */
         /* Put a Real Time Context onto stack */
-        rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf), 1);
+        rt_sf = get_sigframe(ka, get_tm_stackpointer(regs), sizeof(*rt_sf), 1);
         addr = rt_sf;
         if (unlikely(rt_sf == NULL))
                 goto badframe;
@@ -1403,7 +1397,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
         unsigned long tramp;
 
         /* Set up Signal Frame */
-        frame = get_sigframe(ka, regs, sizeof(*frame), 1);
+        frame = get_sigframe(ka, get_tm_stackpointer(regs), sizeof(*frame), 1);
         if (unlikely(frame == NULL))
                 goto badframe;
         sc = (struct sigcontext __user *) &frame->sctx;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index c1794286098c..345947367ec0 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -154,11 +154,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
  * As above, but Transactional Memory is in use, so deliver sigcontexts
  * containing checkpointed and transactional register states.
  *
- * To do this, we treclaim to gather both sets of registers and set up the
- * 'normal' sigcontext registers with rolled-back register values such that a
- * simple signal handler sees a correct checkpointed register state.
- * If interested, a TM-aware sighandler can examine the transactional registers
- * in the 2nd sigcontext to determine the real origin of the signal.
+ * To do this, we treclaim (done before entering here) to gather both sets of
+ * registers and set up the 'normal' sigcontext registers with rolled-back
+ * register values such that a simple signal handler sees a correct
+ * checkpointed register state.  If interested, a TM-aware sighandler can
+ * examine the transactional registers in the 2nd sigcontext to determine the
+ * real origin of the signal.
  */
 static long setup_tm_sigcontexts(struct sigcontext __user *sc,
                                  struct sigcontext __user *tm_sc,
@@ -184,16 +185,6 @@ static long setup_tm_sigcontexts(struct sigcontext __user *sc,
 
         BUG_ON(!MSR_TM_ACTIVE(regs->msr));
 
-        /* tm_reclaim rolls back all reg states, saving checkpointed (older)
-         * GPRs to thread.ckpt_regs and (if used) FPRs to (newer)
-         * thread.transact_fp and/or VRs to (newer) thread.transact_vr.
-         * THEN we save out FP/VRs, if necessary, to the checkpointed (older)
-         * thread.fr[]/vr[]s.  The transactional (newer) GPRs are on the
-         * stack, in *regs.
-         */
-        tm_enable();
-        tm_reclaim(&current->thread, msr, TM_CAUSE_SIGNAL);
-
         flush_fp_to_thread(current);
 
 #ifdef CONFIG_ALTIVEC
@@ -711,7 +702,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
         unsigned long newsp = 0;
         long err = 0;
 
-        frame = get_sigframe(ka, regs, sizeof(*frame), 0);
+        frame = get_sigframe(ka, get_tm_stackpointer(regs), sizeof(*frame), 0);
         if (unlikely(frame == NULL))
                 goto badframe;
 
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 83efa2f7d926..c0e5caf8ccc7 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -35,6 +35,7 @@
 #include <linux/kdebug.h>
 #include <linux/debugfs.h>
 #include <linux/ratelimit.h>
+#include <linux/context_tracking.h>
 
 #include <asm/emulated_ops.h>
 #include <asm/pgtable.h>
@@ -52,6 +53,7 @@
 #ifdef CONFIG_PPC64
 #include <asm/firmware.h>
 #include <asm/processor.h>
+#include <asm/tm.h>
 #endif
 #include <asm/kexec.h>
 #include <asm/ppc-opcode.h>
@@ -667,6 +669,7 @@ int machine_check_generic(struct pt_regs *regs)
 
 void machine_check_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
         int recover = 0;
 
         __get_cpu_var(irq_stat).mce_exceptions++;
@@ -683,7 +686,7 @@ void machine_check_exception(struct pt_regs *regs)
                 recover = cur_cpu_spec->machine_check(regs);
 
         if (recover > 0)
-                return;
+                goto bail;
 
 #if defined(CONFIG_8xx) && defined(CONFIG_PCI)
         /* the qspan pci read routines can cause machine checks -- Cort
@@ -693,20 +696,23 @@ void machine_check_exception(struct pt_regs *regs)
          * -- BenH
          */
         bad_page_fault(regs, regs->dar, SIGBUS);
-        return;
+        goto bail;
 #endif
 
         if (debugger_fault_handler(regs))
-                return;
+                goto bail;
 
         if (check_io_access(regs))
-                return;
+                goto bail;
 
         die("Machine check", regs, SIGBUS);
 
         /* Must die if the interrupt is not recoverable */
         if (!(regs->msr & MSR_RI))
                 panic("Unrecoverable Machine check");
+
+bail:
+        exception_exit(prev_state);
 }
 
 void SMIException(struct pt_regs *regs)
@@ -716,20 +722,29 @@ void SMIException(struct pt_regs *regs)
 
 void unknown_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
+
         printk("Bad trap at PC: %lx, SR: %lx, vector=%lx\n",
                regs->nip, regs->msr, regs->trap);
 
         _exception(SIGTRAP, regs, 0, 0);
+
+        exception_exit(prev_state);
 }
 
 void instruction_breakpoint_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
+
         if (notify_die(DIE_IABR_MATCH, "iabr_match", regs, 5,
                                         5, SIGTRAP) == NOTIFY_STOP)
-                return;
+                goto bail;
         if (debugger_iabr_match(regs))
-                return;
+                goto bail;
         _exception(SIGTRAP, regs, TRAP_BRKPT, regs->nip);
+
+bail:
+        exception_exit(prev_state);
 }
 
 void RunModeException(struct pt_regs *regs)
@@ -739,15 +754,20 @@ void RunModeException(struct pt_regs *regs)
 
 void __kprobes single_step_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
+
         clear_single_step(regs);
 
         if (notify_die(DIE_SSTEP, "single_step", regs, 5,
                                         5, SIGTRAP) == NOTIFY_STOP)
-                return;
+                goto bail;
         if (debugger_sstep(regs))
-                return;
+                goto bail;
 
         _exception(SIGTRAP, regs, TRAP_TRACE, regs->nip);
+
+bail:
+        exception_exit(prev_state);
 }
 
 /*
@@ -913,6 +933,28 @@ static int emulate_isel(struct pt_regs *regs, u32 instword)
         return 0;
 }
 
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+static inline bool tm_abort_check(struct pt_regs *regs, int cause)
+{
+        /* If we're emulating a load/store in an active transaction, we cannot
+         * emulate it as the kernel operates in transaction suspended context.
+         * We need to abort the transaction.  This creates a persistent TM
+         * abort so tell the user what caused it with a new code.
+         */
+        if (MSR_TM_TRANSACTIONAL(regs->msr)) {
+                tm_enable();
+                tm_abort(cause);
+                return true;
+        }
+        return false;
+}
+#else
+static inline bool tm_abort_check(struct pt_regs *regs, int reason)
+{
+        return false;
+}
+#endif
+
 static int emulate_instruction(struct pt_regs *regs)
 {
         u32 instword;
@@ -952,6 +994,9 @@ static int emulate_instruction(struct pt_regs *regs)
 
         /* Emulate load/store string insn. */
         if ((instword & PPC_INST_STRING_GEN_MASK) == PPC_INST_STRING) {
+                if (tm_abort_check(regs,
+                                   TM_CAUSE_EMULATE | TM_CAUSE_PERSISTENT))
+                        return -EINVAL;
                 PPC_WARN_EMULATED(string, regs);
                 return emulate_string_inst(regs, instword);
         }
@@ -1005,6 +1050,7 @@ int is_valid_bugaddr(unsigned long addr)
 
 void __kprobes program_check_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
         unsigned int reason = get_reason(regs);
         extern int do_mathemu(struct pt_regs *regs);
 
@@ -1014,26 +1060,26 @@ void __kprobes program_check_exception(struct pt_regs *regs)
         if (reason & REASON_FP) {
                 /* IEEE FP exception */
                 parse_fpe(regs);
-                return;
+                goto bail;
         }
         if (reason & REASON_TRAP) {
                 /* Debugger is first in line to stop recursive faults in
                  * rcu_lock, notify_die, or atomic_notifier_call_chain */
                 if (debugger_bpt(regs))
-                        return;
+                        goto bail;
 
                 /* trap exception */
                 if (notify_die(DIE_BPT, "breakpoint", regs, 5, 5, SIGTRAP)
                                 == NOTIFY_STOP)
-                        return;
+                        goto bail;
 
                 if (!(regs->msr & MSR_PR) &&  /* not user-mode */
                     report_bug(regs->nip, regs) == BUG_TRAP_TYPE_WARN) {
                         regs->nip += 4;
-                        return;
+                        goto bail;
                 }
                 _exception(SIGTRAP, regs, TRAP_BRKPT, regs->nip);
-                return;
+                goto bail;
         }
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
         if (reason & REASON_TM) {
@@ -1049,7 +1095,7 @@ void __kprobes program_check_exception(struct pt_regs *regs)
                 if (!user_mode(regs) &&
                     report_bug(regs->nip, regs) == BUG_TRAP_TYPE_WARN) {
                         regs->nip += 4;
-                        return;
+                        goto bail;
                 }
                 /* If usermode caused this, it's done something illegal and
                  * gets a SIGILL slap on the wrist.  We call it an illegal
@@ -1059,7 +1105,7 @@ void __kprobes program_check_exception(struct pt_regs *regs)
                  */
                 if (user_mode(regs)) {
                         _exception(SIGILL, regs, ILL_ILLOPN, regs->nip);
-                        return;
+                        goto bail;
                 } else {
                         printk(KERN_EMERG "Unexpected TM Bad Thing exception "
                                "at %lx (msr 0x%x)\n", regs->nip, reason);
@@ -1083,16 +1129,16 @@ void __kprobes program_check_exception(struct pt_regs *regs)
         switch (do_mathemu(regs)) {
         case 0:
                 emulate_single_step(regs);
-                return;
+                goto bail;
         case 1: {
                         int code = 0;
                         code = __parse_fpscr(current->thread.fpscr.val);
                         _exception(SIGFPE, regs, code, regs->nip);
-                        return;
+                        goto bail;
                 }
         case -EFAULT:
                 _exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
-                return;
+                goto bail;
         }
         /* fall through on any other errors */
 #endif /* CONFIG_MATH_EMULATION */
@@ -1103,10 +1149,10 @@ void __kprobes program_check_exception(struct pt_regs *regs)
                 case 0:
                         regs->nip += 4;
                         emulate_single_step(regs);
-                        return;
+                        goto bail;
                 case -EFAULT:
                         _exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
-                        return;
+                        goto bail;
                 }
         }
 
@@ -1114,16 +1160,33 @@ void __kprobes program_check_exception(struct pt_regs *regs)
                 _exception(SIGILL, regs, ILL_PRVOPC, regs->nip);
         else
                 _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
+
+bail:
+        exception_exit(prev_state);
+}
+
+/*
+ * This occurs when running in hypervisor mode on POWER6 or later
+ * and an illegal instruction is encountered.
+ */
+void __kprobes emulation_assist_interrupt(struct pt_regs *regs)
+{
+        regs->msr |= REASON_ILLEGAL;
+        program_check_exception(regs);
 }
 
 void alignment_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
         int sig, code, fixed = 0;
 
         /* We restore the interrupt state now */
         if (!arch_irq_disabled_regs(regs))
                 local_irq_enable();
 
+        if (tm_abort_check(regs, TM_CAUSE_ALIGNMENT | TM_CAUSE_PERSISTENT))
+                goto bail;
+
         /* we don't implement logging of alignment exceptions */
         if (!(current->thread.align_ctl & PR_UNALIGN_SIGBUS))
                 fixed = fix_alignment(regs);
@@ -1131,7 +1194,7 @@ void alignment_exception(struct pt_regs *regs)
         if (fixed == 1) {
                 regs->nip += 4; /* skip over emulated instruction */
                 emulate_single_step(regs);
-                return;
+                goto bail;
         }
 
         /* Operand address was bad */
@@ -1146,6 +1209,9 @@ void alignment_exception(struct pt_regs *regs)
                 _exception(sig, regs, code, regs->dar);
         else
                 bad_page_fault(regs, regs->dar, sig);
+
+bail:
+        exception_exit(prev_state);
 }
 
 void StackOverflow(struct pt_regs *regs)
@@ -1174,23 +1240,32 @@ void trace_syscall(struct pt_regs *regs)
 
 void kernel_fp_unavailable_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
+
         printk(KERN_EMERG "Unrecoverable FP Unavailable Exception "
                           "%lx at %lx\n", regs->trap, regs->nip);
         die("Unrecoverable FP Unavailable Exception", regs, SIGABRT);
+
+        exception_exit(prev_state);
 }
 
 void altivec_unavailable_exception(struct pt_regs *regs)
 {
+        enum ctx_state prev_state = exception_enter();
+
         if (user_mode(regs)) {
                 /* A user program has executed an altivec instruction,
                    but this kernel doesn't support altivec. */
                 _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
-                return;
+                goto bail;
         }
 
         printk(KERN_EMERG "Unrecoverable VMX/Altivec Unavailable Exception "
                         "%lx at %lx\n", regs->trap, regs->nip);
         die("Unrecoverable VMX/Altivec Unavailable Exception", regs, SIGABRT);
+
+bail:
+        exception_exit(prev_state);
 }
 
 void vsx_unavailable_exception(struct pt_regs *regs)
diff --git a/arch/powerpc/kernel/udbg.c b/arch/powerpc/kernel/udbg.c
index 13b867093499..9d3fdcd66290 100644
--- a/arch/powerpc/kernel/udbg.c
+++ b/arch/powerpc/kernel/udbg.c
@@ -64,6 +64,9 @@ void __init udbg_early_init(void)
         udbg_init_usbgecko();
 #elif defined(CONFIG_PPC_EARLY_DEBUG_WSP)
         udbg_init_wsp();
+#elif defined(CONFIG_PPC_EARLY_DEBUG_MEMCONS)
+        /* In memory console */
+        udbg_init_memcons();
 #elif defined(CONFIG_PPC_EARLY_DEBUG_EHV_BC)
         udbg_init_ehv_bc();
 #elif defined(CONFIG_PPC_EARLY_DEBUG_PS3GELIC)
diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index 5dd3ab469976..ed0385448148 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -441,6 +441,7 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
         struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
         struct kvmppc_44x_tlbe *tlbe;
         unsigned int gtlb_index;
+        int idx;
 
         gtlb_index = kvmppc_get_gpr(vcpu, ra);
         if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
@@ -473,6 +474,8 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
                 return EMULATE_FAIL;
         }
 
+        idx = srcu_read_lock(&vcpu->kvm->srcu);
+
         if (tlbe_is_host_safe(vcpu, tlbe)) {
                 gva_t eaddr;
                 gpa_t gpaddr;
@@ -489,6 +492,8 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
                 kvmppc_mmu_map(vcpu, eaddr, gpaddr, gtlb_index);
         }
 
+        srcu_read_unlock(&vcpu->kvm->srcu, idx);
+
         trace_kvm_gtlb_write(gtlb_index, tlbe->tid, tlbe->word0, tlbe->word1,
                              tlbe->word2);
 
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 9de24f8e03c7..550f5928b394 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -562,6 +562,8 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
         case H_CPPR:
         case H_EOI:
         case H_IPI:
+        case H_IPOLL:
+        case H_XIRR_X:
                 if (kvmppc_xics_enabled(vcpu)) {
                         ret = kvmppc_xics_hcall(vcpu, req);
                         break;
diff --git a/arch/powerpc/kvm/book3s_pr_papr.c b/arch/powerpc/kvm/book3s_pr_papr.c
index b24309c6c2d5..da0e0bc268bd 100644
--- a/arch/powerpc/kvm/book3s_pr_papr.c
+++ b/arch/powerpc/kvm/book3s_pr_papr.c
@@ -257,6 +257,8 @@ int kvmppc_h_pr(struct kvm_vcpu *vcpu, unsigned long cmd)
         case H_CPPR:
         case H_EOI:
         case H_IPI:
+        case H_IPOLL:
+        case H_XIRR_X:
                 if (kvmppc_xics_enabled(vcpu))
                         return kvmppc_h_pr_xics_hcall(vcpu, cmd);
                 break;
diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
index f7a103756618..94c1dd46b83d 100644
--- a/arch/powerpc/kvm/book3s_xics.c
+++ b/arch/powerpc/kvm/book3s_xics.c
@@ -650,6 +650,23 @@ static noinline int kvmppc_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
         return H_SUCCESS;
 }
 
+static int kvmppc_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)
+{
+        union kvmppc_icp_state state;
+        struct kvmppc_icp *icp;
+
+        icp = vcpu->arch.icp;
+        if (icp->server_num != server) {
+                icp = kvmppc_xics_find_server(vcpu->kvm, server);
+                if (!icp)
+                        return H_PARAMETER;
+        }
+        state = ACCESS_ONCE(icp->state);
+        kvmppc_set_gpr(vcpu, 4, ((u32)state.cppr << 24) | state.xisr);
+        kvmppc_set_gpr(vcpu, 5, state.mfrr);
+        return H_SUCCESS;
+}
+
 static noinline void kvmppc_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
 {
         union kvmppc_icp_state old_state, new_state;
@@ -787,6 +804,18 @@ int kvmppc_xics_hcall(struct kvm_vcpu *vcpu, u32 req)
         if (!xics || !vcpu->arch.icp)
                 return H_HARDWARE;
 
+        /* These requests don't have real-mode implementations at present */
+        switch (req) {
+        case H_XIRR_X:
+                res = kvmppc_h_xirr(vcpu);
+                kvmppc_set_gpr(vcpu, 4, res);
+                kvmppc_set_gpr(vcpu, 5, get_tb());
+                return rc;
+        case H_IPOLL:
+                rc = kvmppc_h_ipoll(vcpu, kvmppc_get_gpr(vcpu, 4));
+                return rc;
+        }
+
         /* Check for real mode returning too hard */
         if (xics->real_mode)
                 return kvmppc_xics_rm_complete(vcpu, req);
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index 1020119226db..1a1b51189773 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -673,7 +673,6 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
                 ret = s;
                 goto out;
         }
-        kvmppc_lazy_ee_enable();
 
         kvm_guest_enter();
 
@@ -699,6 +698,8 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
         kvmppc_load_guest_fp(vcpu);
 #endif
 
+        kvmppc_lazy_ee_enable();
+
         ret = __kvmppc_vcpu_run(kvm_run, vcpu);
 
         /* No need for kvm_guest_exit. It's done in handle_exit.
@@ -832,6 +833,18 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
 {
         int r = RESUME_HOST;
         int s;
+        int idx;
+
+#ifdef CONFIG_PPC64
+        WARN_ON(local_paca->irq_happened != 0);
+#endif
+
+        /*
+         * We enter with interrupts disabled in hardware, but
+         * we need to call hard_irq_disable anyway to ensure that
+         * the software state is kept in sync.
+         */
+        hard_irq_disable();
 
         /* update before a new last_exit_type is rewritten */
         kvmppc_update_timing_stats(vcpu);
@@ -1053,6 +1066,8 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         break;
                 }
 
+                idx = srcu_read_lock(&vcpu->kvm->srcu);
+
                 gpaddr = kvmppc_mmu_xlate(vcpu, gtlb_index, eaddr);
                 gfn = gpaddr >> PAGE_SHIFT;
 
@@ -1075,6 +1090,7 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         kvmppc_account_exit(vcpu, MMIO_EXITS);
                 }
 
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
                 break;
         }
 
@@ -1098,6 +1114,8 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
 
                 kvmppc_account_exit(vcpu, ITLB_VIRT_MISS_EXITS);
 
+                idx = srcu_read_lock(&vcpu->kvm->srcu);
+
                 gpaddr = kvmppc_mmu_xlate(vcpu, gtlb_index, eaddr);
                 gfn = gpaddr >> PAGE_SHIFT;
 
@@ -1114,6 +1132,7 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_MACHINE_CHECK);
                 }
 
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
                 break;
         }
 
diff --git a/arch/powerpc/kvm/e500_mmu.c b/arch/powerpc/kvm/e500_mmu.c
index c41a5a96b558..6d6f153b6c1d 100644
--- a/arch/powerpc/kvm/e500_mmu.c
+++ b/arch/powerpc/kvm/e500_mmu.c
@@ -396,6 +396,7 @@ int kvmppc_e500_emul_tlbwe(struct kvm_vcpu *vcpu)
         struct kvm_book3e_206_tlb_entry *gtlbe;
         int tlbsel, esel;
         int recal = 0;
+        int idx;
 
         tlbsel = get_tlb_tlbsel(vcpu);
         esel = get_tlb_esel(vcpu, tlbsel);
@@ -430,6 +431,8 @@ int kvmppc_e500_emul_tlbwe(struct kvm_vcpu *vcpu)
                         kvmppc_set_tlb1map_range(vcpu, gtlbe);
         }
 
+        idx = srcu_read_lock(&vcpu->kvm->srcu);
+
         /* Invalidate shadow mappings for the about-to-be-clobbered TLBE. */
         if (tlbe_is_host_safe(vcpu, gtlbe)) {
                 u64 eaddr = get_tlb_eaddr(gtlbe);
@@ -444,6 +447,8 @@ int kvmppc_e500_emul_tlbwe(struct kvm_vcpu *vcpu)
                 kvmppc_mmu_map(vcpu, eaddr, raddr, index_of(tlbsel, esel));
         }
 
+        srcu_read_unlock(&vcpu->kvm->srcu, idx);
+
         kvmppc_set_exit_type(vcpu, EMULATED_TLBWE_EXITS);
         return EMULATE_DONE;
 }
diff --git a/arch/powerpc/kvm/e500mc.c b/arch/powerpc/kvm/e500mc.c
index 753cc99eff2b..19c8379575f7 100644
--- a/arch/powerpc/kvm/e500mc.c
+++ b/arch/powerpc/kvm/e500mc.c
@@ -177,8 +177,6 @@ int kvmppc_core_check_processor_compat(void)
                 r = 0;
         else if (strcmp(cur_cpu_spec->cpu_name, "e5500") == 0)
                 r = 0;
-        else if (strcmp(cur_cpu_spec->cpu_name, "e6500") == 0)
-                r = 0;
         else
                 r = -ENOTSUPP;
 
diff --git a/arch/powerpc/lib/copypage_power7.S b/arch/powerpc/lib/copypage_power7.S
index 0ef75bf0695c..395c594722a2 100644
--- a/arch/powerpc/lib/copypage_power7.S
+++ b/arch/powerpc/lib/copypage_power7.S
@@ -28,13 +28,14 @@ _GLOBAL(copypage_power7)
          * aligned we don't need to clear the bottom 7 bits of either
          * address.
          */
-        ori     r9,r3,1         /* stream=1 */
+        ori     r9,r3,1         /* stream=1 => to */
 
 #ifdef CONFIG_PPC_64K_PAGES
-        lis     r7,0x0E01       /* depth=7, units=512 */
+        lis     r7,0x0E01       /* depth=7
+                                 * units/cachelines=512 */
 #else
         lis     r7,0x0E00       /* depth=7 */
-        ori     r7,r7,0x1000    /* units=32 */
+        ori     r7,r7,0x1000    /* units/cachelines=32 */
 #endif
         ori     r10,r7,1        /* stream=1 */
 
@@ -43,12 +44,14 @@ _GLOBAL(copypage_power7)
 
 .machine push
 .machine "power4"
-        dcbt    r0,r4,0b01000
-        dcbt    r0,r7,0b01010
-        dcbtst  r0,r9,0b01000
-        dcbtst  r0,r10,0b01010
+        /* setup read stream 0  */
+        dcbt    r0,r4,0b01000   /* addr from */
+        dcbt    r0,r7,0b01010   /* length and depth from */
+        /* setup write stream 1 */
+        dcbtst  r0,r9,0b01000   /* addr to */
+        dcbtst  r0,r10,0b01010  /* length and depth to */
         eieio
-        dcbt    r0,r8,0b01010   /* GO */
+        dcbt    r0,r8,0b01010   /* all streams GO */
 .machine pop
 
 #ifdef CONFIG_ALTIVEC
diff --git a/arch/powerpc/lib/copyuser_power7.S b/arch/powerpc/lib/copyuser_power7.S
index 0d24ff15f5f6..d1f11795a7ad 100644
--- a/arch/powerpc/lib/copyuser_power7.S
+++ b/arch/powerpc/lib/copyuser_power7.S
@@ -318,12 +318,14 @@ err1;	stb	r0,0(r3)
 
 .machine push
 .machine "power4"
-        dcbt    r0,r6,0b01000
-        dcbt    r0,r7,0b01010
-        dcbtst  r0,r9,0b01000
-        dcbtst  r0,r10,0b01010
+        /* setup read stream 0 */
+        dcbt    r0,r6,0b01000   /* addr from */
+        dcbt    r0,r7,0b01010   /* length and depth from */
+        /* setup write stream 1 */
+        dcbtst  r0,r9,0b01000   /* addr to */
+        dcbtst  r0,r10,0b01010  /* length and depth to */
         eieio
-        dcbt    r0,r8,0b01010   /* GO */
+        dcbt    r0,r8,0b01010   /* all streams GO */
 .machine pop
 
         beq     cr1,.Lunwind_stack_nonvmx_copy
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 229951ffc351..8726779e1409 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -32,6 +32,7 @@
 #include <linux/perf_event.h>
 #include <linux/magic.h>
 #include <linux/ratelimit.h>
+#include <linux/context_tracking.h>
 
 #include <asm/firmware.h>
 #include <asm/page.h>
@@ -196,6 +197,7 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, int fault)
 int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
                             unsigned long error_code)
 {
+        enum ctx_state prev_state = exception_enter();
         struct vm_area_struct * vma;
         struct mm_struct *mm = current->mm;
         unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
@@ -204,6 +206,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
         int trap = TRAP(regs);
         int is_exec = trap == 0x400;
         int fault;
+        int rc = 0;
 
 #if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
         /*
@@ -230,28 +233,30 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
          * look at it
          */
         if (error_code & ICSWX_DSI_UCT) {
-                int rc = acop_handle_fault(regs, address, error_code);
+                rc = acop_handle_fault(regs, address, error_code);
                 if (rc)
-                        return rc;
+                        goto bail;
         }
 #endif /* CONFIG_PPC_ICSWX */
 
         if (notify_page_fault(regs))
-                return 0;
+                goto bail;
 
         if (unlikely(debugger_fault_handler(regs)))
-                return 0;
+                goto bail;
 
         /* On a kernel SLB miss we can only check for a valid exception entry */
-        if (!user_mode(regs) && (address >= TASK_SIZE))
-                return SIGSEGV;
+        if (!user_mode(regs) && (address >= TASK_SIZE)) {
+                rc = SIGSEGV;
+                goto bail;
+        }
 
 #if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE) || \
                              defined(CONFIG_PPC_BOOK3S_64))
         if (error_code & DSISR_DABRMATCH) {
                 /* breakpoint match */
                 do_break(regs, address, error_code);
-                return 0;
+                goto bail;
         }
 #endif
 
@@ -260,8 +265,10 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
                 local_irq_enable();
 
         if (in_atomic() || mm == NULL) {
-                if (!user_mode(regs))
-                        return SIGSEGV;
+                if (!user_mode(regs)) {
+                        rc = SIGSEGV;
+                        goto bail;
+                }
                 /* in_atomic() in user mode is really bad,
                    as is current->mm == NULL. */
                 printk(KERN_EMERG "Page fault in user mode with "
@@ -417,9 +424,11 @@ good_area:
          */
         fault = handle_mm_fault(mm, vma, address, flags);
         if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
-                int rc = mm_fault_error(regs, address, fault);
+                rc = mm_fault_error(regs, address, fault);
                 if (rc >= MM_FAULT_RETURN)
-                        return rc;
+                        goto bail;
+                else
+                        rc = 0;
         }
 
         /*
@@ -454,7 +463,7 @@ good_area:
         }
 
         up_read(&mm->mmap_sem);
-        return 0;
+        goto bail;
 
 bad_area:
         up_read(&mm->mmap_sem);
@@ -463,7 +472,7 @@ bad_area_nosemaphore:
         /* User mode accesses cause a SIGSEGV */
         if (user_mode(regs)) {
                 _exception(SIGSEGV, regs, code, address);
-                return 0;
+                goto bail;
         }
 
         if (is_exec && (error_code & DSISR_PROTFAULT))
@@ -471,7 +480,11 @@ bad_area_nosemaphore:
                                    " page (%lx) - exploit attempt? (uid: %d)\n",
                                    address, from_kuid(&init_user_ns, current_uid()));
 
-        return SIGSEGV;
+        rc = SIGSEGV;
+
+bail:
+        exception_exit(prev_state);
+        return rc;
 
 }
 
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index 6a2aead5b0e5..4c122c3f1623 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -336,11 +336,18 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
 
         hpte_v = hptep->v;
         actual_psize = hpte_actual_psize(hptep, psize);
+        /*
+         * We need to invalidate the TLB always because hpte_remove doesn't do
+         * a tlb invalidate. If a hash bucket gets full, we "evict" a more/less
+         * random entry from it. When we do that we don't invalidate the TLB
+         * (hpte_remove) because we assume the old translation is still
+         * technically "valid".
+         */
         if (actual_psize < 0) {
-                native_unlock_hpte(hptep);
-                return -1;
+                actual_psize = psize;
+                ret = -1;
+                goto err_out;
         }
-        /* Even if we miss, we need to invalidate the TLB */
         if (!HPTE_V_COMPARE(hpte_v, want_v)) {
                 DBG_LOW(" -> miss\n");
                 ret = -1;
@@ -350,6 +357,7 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
                 hptep->r = (hptep->r & ~(HPTE_R_PP | HPTE_R_N)) |
                         (newpp & (HPTE_R_PP | HPTE_R_N | HPTE_R_C));
         }
+err_out:
         native_unlock_hpte(hptep);
 
         /* Ensure it is out of the tlb too. */
@@ -409,7 +417,7 @@ static void native_hpte_updateboltedpp(unsigned long newpp, unsigned long ea,
         hptep = htab_address + slot;
         actual_psize = hpte_actual_psize(hptep, psize);
         if (actual_psize < 0)
-                return;
+                actual_psize = psize;
 
         /* Update the HPTE */
         hptep->r = (hptep->r & ~(HPTE_R_PP | HPTE_R_N)) |
@@ -437,21 +445,27 @@ static void native_hpte_invalidate(unsigned long slot, unsigned long vpn,
         hpte_v = hptep->v;
 
         actual_psize = hpte_actual_psize(hptep, psize);
+        /*
+         * We need to invalidate the TLB always because hpte_remove doesn't do
+         * a tlb invalidate. If a hash bucket gets full, we "evict" a more/less
+         * random entry from it. When we do that we don't invalidate the TLB
+         * (hpte_remove) because we assume the old translation is still
+         * technically "valid".
+         */
         if (actual_psize < 0) {
+                actual_psize = psize;
                 native_unlock_hpte(hptep);
-                local_irq_restore(flags);
-                return;
+                goto err_out;
         }
-        /* Even if we miss, we need to invalidate the TLB */
         if (!HPTE_V_COMPARE(hpte_v, want_v))
                 native_unlock_hpte(hptep);
         else
                 /* Invalidate the hpte. NOTE: this also unlocks it */
                 hptep->v = 0;
 
+err_out:
         /* Invalidate the TLB */
         tlbie(vpn, psize, actual_psize, ssize, local);
-
         local_irq_restore(flags);
 }
 
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 88ac0eeaadde..e303a6d74e3a 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -33,6 +33,7 @@
 #include <linux/init.h>
 #include <linux/signal.h>
 #include <linux/memblock.h>
+#include <linux/context_tracking.h>
 
 #include <asm/processor.h>
 #include <asm/pgtable.h>
@@ -954,6 +955,7 @@ void hash_failure_debug(unsigned long ea, unsigned long access,
  */
 int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
 {
+        enum ctx_state prev_state = exception_enter();
         pgd_t *pgdir;
         unsigned long vsid;
         struct mm_struct *mm;
@@ -973,7 +975,8 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                 mm = current->mm;
                 if (! mm) {
                         DBG_LOW(" user region with no mm !\n");
-                        return 1;
+                        rc = 1;
+                        goto bail;
                 }
                 psize = get_slice_psize(mm, ea);
                 ssize = user_segment_size(ea);
@@ -992,19 +995,23 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                 /* Not a valid range
                  * Send the problem up to do_page_fault 
                  */
-                return 1;
+                rc = 1;
+                goto bail;
         }
         DBG_LOW(" mm=%p, mm->pgdir=%p, vsid=%016lx\n", mm, mm->pgd, vsid);
 
         /* Bad address. */
         if (!vsid) {
                 DBG_LOW("Bad address!\n");
-                return 1;
+                rc = 1;
+                goto bail;
         }
         /* Get pgdir */
         pgdir = mm->pgd;
-        if (pgdir == NULL)
-                return 1;
+        if (pgdir == NULL) {
+                rc = 1;
+                goto bail;
+        }
 
         /* Check CPU locality */
         tmp = cpumask_of(smp_processor_id());
@@ -1027,7 +1034,8 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
         ptep = find_linux_pte_or_hugepte(pgdir, ea, &hugeshift);
         if (ptep == NULL || !pte_present(*ptep)) {
                 DBG_LOW(" no PTE !\n");
-                return 1;
+                rc = 1;
+                goto bail;
         }
 
         /* Add _PAGE_PRESENT to the required access perm */
@@ -1038,13 +1046,16 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
          */
         if (access & ~pte_val(*ptep)) {
                 DBG_LOW(" no access !\n");
-                return 1;
+                rc = 1;
+                goto bail;
         }
 
 #ifdef CONFIG_HUGETLB_PAGE
-        if (hugeshift)
-                return __hash_page_huge(ea, access, vsid, ptep, trap, local,
+        if (hugeshift) {
+                rc = __hash_page_huge(ea, access, vsid, ptep, trap, local,
                                         ssize, hugeshift, psize);
+                goto bail;
+        }
 #endif /* CONFIG_HUGETLB_PAGE */
 
 #ifndef CONFIG_PPC_64K_PAGES
@@ -1124,6 +1135,9 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                 pte_val(*(ptep + PTRS_PER_PTE)));
 #endif
         DBG_LOW(" -> rc=%d\n", rc);
+
+bail:
+        exception_exit(prev_state);
         return rc;
 }
 EXPORT_SYMBOL_GPL(hash_page);
@@ -1259,6 +1273,8 @@ void flush_hash_range(unsigned long number, int local)
  */
 void low_hash_fault(struct pt_regs *regs, unsigned long address, int rc)
 {
+        enum ctx_state prev_state = exception_enter();
+
         if (user_mode(regs)) {
 #ifdef CONFIG_PPC_SUBPAGE_PROT
                 if (rc == -2)
@@ -1268,6 +1284,8 @@ void low_hash_fault(struct pt_regs *regs, unsigned long address, int rc)
                         _exception(SIGBUS, regs, BUS_ADRERR, address);
         } else
                 bad_page_fault(regs, address, SIGBUS);
+
+        exception_exit(prev_state);
 }
 
 long hpte_insert_repeating(unsigned long hash, unsigned long vpn,
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 237c8e5f2640..77fdd2cef33b 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -592,8 +592,14 @@ static void hugetlb_free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
         do {
                 pmd = pmd_offset(pud, addr);
                 next = pmd_addr_end(addr, end);
-                if (pmd_none_or_clear_bad(pmd))
+                if (!is_hugepd(pmd)) {
+                        /*
+                         * if it is not hugepd pointer, we should already find
+                         * it cleared.
+                         */
+                        WARN_ON(!pmd_none_or_clear_bad(pmd));
                         continue;
+                }
 #ifdef CONFIG_PPC_FSL_BOOK3E
                 /*
                  * Increment next by the size of the huge mapping since
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index c2787bf779ca..a90b9c458990 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -215,7 +215,8 @@ static void __meminit vmemmap_create_mapping(unsigned long start,
                                              unsigned long phys)
 {
         int  mapped = htab_bolt_mapping(start, start + page_size, phys,
-                                        PAGE_KERNEL, mmu_vmemmap_psize,
+                                        pgprot_val(PAGE_KERNEL),
+                                        mmu_vmemmap_psize,
                                         mmu_kernel_ssize);
         BUG_ON(mapped < 0);
 }
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index c627843c5b2e..29c6482890c8 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -13,11 +13,13 @@
 #include <linux/perf_event.h>
 #include <linux/percpu.h>
 #include <linux/hardirq.h>
+#include <linux/uaccess.h>
 #include <asm/reg.h>
 #include <asm/pmc.h>
 #include <asm/machdep.h>
 #include <asm/firmware.h>
 #include <asm/ptrace.h>
+#include <asm/code-patching.h>
 
 #define BHRB_MAX_ENTRIES        32
 #define BHRB_TARGET             0x0000000000000002
@@ -100,11 +102,15 @@ static inline int siar_valid(struct pt_regs *regs)
         return 1;
 }
 
+static inline void power_pmu_bhrb_enable(struct perf_event *event) {}
+static inline void power_pmu_bhrb_disable(struct perf_event *event) {}
+void power_pmu_flush_branch_stack(void) {}
+static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {}
 #endif /* CONFIG_PPC32 */
 
 static bool regs_use_siar(struct pt_regs *regs)
 {
-        return !!(regs->result & 1);
+        return !!regs->result;
 }
 
 /*
@@ -130,22 +136,30 @@ static inline unsigned long perf_ip_adjust(struct pt_regs *regs)
  * If we're not doing instruction sampling, give them the SDAR
  * (sampled data address).  If we are doing instruction sampling, then
  * only give them the SDAR if it corresponds to the instruction
- * pointed to by SIAR; this is indicated by the [POWER6_]MMCRA_SDSYNC or
- * the [POWER7P_]MMCRA_SDAR_VALID bit in MMCRA.
+ * pointed to by SIAR; this is indicated by the [POWER6_]MMCRA_SDSYNC, the
+ * [POWER7P_]MMCRA_SDAR_VALID bit in MMCRA, or the SDAR_VALID bit in SIER.
  */
 static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp)
 {
         unsigned long mmcra = regs->dsisr;
-        unsigned long sdsync;
+        bool sdar_valid;
 
-        if (ppmu->flags & PPMU_SIAR_VALID)
-                sdsync = POWER7P_MMCRA_SDAR_VALID;
-        else if (ppmu->flags & PPMU_ALT_SIPR)
-                sdsync = POWER6_MMCRA_SDSYNC;
-        else
-                sdsync = MMCRA_SDSYNC;
+        if (ppmu->flags & PPMU_HAS_SIER)
+                sdar_valid = regs->dar & SIER_SDAR_VALID;
+        else {
+                unsigned long sdsync;
+
+                if (ppmu->flags & PPMU_SIAR_VALID)
+                        sdsync = POWER7P_MMCRA_SDAR_VALID;
+                else if (ppmu->flags & PPMU_ALT_SIPR)
+                        sdsync = POWER6_MMCRA_SDSYNC;
+                else
+                        sdsync = MMCRA_SDSYNC;
 
-        if (!(mmcra & MMCRA_SAMPLE_ENABLE) || (mmcra & sdsync))
+                sdar_valid = mmcra & sdsync;
+        }
+
+        if (!(mmcra & MMCRA_SAMPLE_ENABLE) || sdar_valid)
                 *addrp = mfspr(SPRN_SDAR);
 }
 
@@ -175,11 +189,6 @@ static bool regs_sipr(struct pt_regs *regs)
         return !!(regs->dsisr & sipr);
 }
 
-static bool regs_no_sipr(struct pt_regs *regs)
-{
-        return !!(regs->result & 2);
-}
-
 static inline u32 perf_flags_from_msr(struct pt_regs *regs)
 {
         if (regs->msr & MSR_PR)
@@ -202,7 +211,7 @@ static inline u32 perf_get_misc_flags(struct pt_regs *regs)
          * SIAR which should give slightly more reliable
          * results
          */
-        if (regs_no_sipr(regs)) {
+        if (ppmu->flags & PPMU_NO_SIPR) {
                 unsigned long siar = mfspr(SPRN_SIAR);
                 if (siar >= PAGE_OFFSET)
                         return PERF_RECORD_MISC_KERNEL;
@@ -233,22 +242,9 @@ static inline void perf_read_regs(struct pt_regs *regs)
         int use_siar;
 
         regs->dsisr = mmcra;
-        regs->result = 0;
-
-        if (ppmu->flags & PPMU_NO_SIPR)
-                regs->result |= 2;
-
-        /*
-         * On power8 if we're in random sampling mode, the SIER is updated.
-         * If we're in continuous sampling mode, we don't have SIPR.
-         */
-        if (ppmu->flags & PPMU_HAS_SIER) {
-                if (marked)
-                        regs->dar = mfspr(SPRN_SIER);
-                else
-                        regs->result |= 2;
-        }
 
+        if (ppmu->flags & PPMU_HAS_SIER)
+                regs->dar = mfspr(SPRN_SIER);
 
         /*
          * If this isn't a PMU exception (eg a software event) the SIAR is
@@ -273,12 +269,12 @@ static inline void perf_read_regs(struct pt_regs *regs)
                 use_siar = 1;
         else if ((ppmu->flags & PPMU_NO_CONT_SAMPLING))
                 use_siar = 0;
-        else if (!regs_no_sipr(regs) && regs_sipr(regs))
+        else if (!(ppmu->flags & PPMU_NO_SIPR) && regs_sipr(regs))
                 use_siar = 0;
         else
                 use_siar = 1;
 
-        regs->result |= use_siar;
+        regs->result = use_siar;
 }
 
 /*
@@ -302,12 +298,170 @@ static inline int siar_valid(struct pt_regs *regs)
         unsigned long mmcra = regs->dsisr;
         int marked = mmcra & MMCRA_SAMPLE_ENABLE;
 
-        if ((ppmu->flags & PPMU_SIAR_VALID) && marked)
-                return mmcra & POWER7P_MMCRA_SIAR_VALID;
+        if (marked) {
+                if (ppmu->flags & PPMU_HAS_SIER)
+                        return regs->dar & SIER_SIAR_VALID;
+
+                if (ppmu->flags & PPMU_SIAR_VALID)
+                        return mmcra & POWER7P_MMCRA_SIAR_VALID;
+        }
 
         return 1;
 }
 
+
+/* Reset all possible BHRB entries */
+static void power_pmu_bhrb_reset(void)
+{
+        asm volatile(PPC_CLRBHRB);
+}
+
+static void power_pmu_bhrb_enable(struct perf_event *event)
+{
+        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+
+        if (!ppmu->bhrb_nr)
+                return;
+
+        /* Clear BHRB if we changed task context to avoid data leaks */
+        if (event->ctx->task && cpuhw->bhrb_context != event->ctx) {
+                power_pmu_bhrb_reset();
+                cpuhw->bhrb_context = event->ctx;
+        }
+        cpuhw->bhrb_users++;
+}
+
+static void power_pmu_bhrb_disable(struct perf_event *event)
+{
+        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+
+        if (!ppmu->bhrb_nr)
+                return;
+
+        cpuhw->bhrb_users--;
+        WARN_ON_ONCE(cpuhw->bhrb_users < 0);
+
+        if (!cpuhw->disabled && !cpuhw->bhrb_users) {
+                /* BHRB cannot be turned off when other
+                 * events are active on the PMU.
+                 */
+
+                /* avoid stale pointer */
+                cpuhw->bhrb_context = NULL;
+        }
+}
+
+/* Called from ctxsw to prevent one process's branch entries to
+ * mingle with the other process's entries during context switch.
+ */
+void power_pmu_flush_branch_stack(void)
+{
+        if (ppmu->bhrb_nr)
+                power_pmu_bhrb_reset();
+}
+/* Calculate the to address for a branch */
+static __u64 power_pmu_bhrb_to(u64 addr)
+{
+        unsigned int instr;
+        int ret;
+        __u64 target;
+
+        if (is_kernel_addr(addr))
+                return branch_target((unsigned int *)addr);
+
+        /* Userspace: need copy instruction here then translate it */
+        pagefault_disable();
+        ret = __get_user_inatomic(instr, (unsigned int __user *)addr);
+        if (ret) {
+                pagefault_enable();
+                return 0;
+        }
+        pagefault_enable();
+
+        target = branch_target(&instr);
+        if ((!target) || (instr & BRANCH_ABSOLUTE))
+                return target;
+
+        /* Translate relative branch target from kernel to user address */
+        return target - (unsigned long)&instr + addr;
+}
+
+/* Processing BHRB entries */
+void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw)
+{
+        u64 val;
+        u64 addr;
+        int r_index, u_index, pred;
+
+        r_index = 0;
+        u_index = 0;
+        while (r_index < ppmu->bhrb_nr) {
+                /* Assembly read function */
+                val = read_bhrb(r_index++);
+                if (!val)
+                        /* Terminal marker: End of valid BHRB entries */
+                        break;
+                else {
+                        addr = val & BHRB_EA;
+                        pred = val & BHRB_PREDICTION;
+
+                        if (!addr)
+                                /* invalid entry */
+                                continue;
+
+                        /* Branches are read most recent first (ie. mfbhrb 0 is
+                         * the most recent branch).
+                         * There are two types of valid entries:
+                         * 1) a target entry which is the to address of a
+                         *    computed goto like a blr,bctr,btar.  The next
+                         *    entry read from the bhrb will be branch
+                         *    corresponding to this target (ie. the actual
+                         *    blr/bctr/btar instruction).
+                         * 2) a from address which is an actual branch.  If a
+                         *    target entry proceeds this, then this is the
+                         *    matching branch for that target.  If this is not
+                         *    following a target entry, then this is a branch
+                         *    where the target is given as an immediate field
+                         *    in the instruction (ie. an i or b form branch).
+                         *    In this case we need to read the instruction from
+                         *    memory to determine the target/to address.
+                         */
+
+                        if (val & BHRB_TARGET) {
+                                /* Target branches use two entries
+                                 * (ie. computed gotos/XL form)
+                                 */
+                                cpuhw->bhrb_entries[u_index].to = addr;
+                                cpuhw->bhrb_entries[u_index].mispred = pred;
+                                cpuhw->bhrb_entries[u_index].predicted = ~pred;
+
+                                /* Get from address in next entry */
+                                val = read_bhrb(r_index++);
+                                addr = val & BHRB_EA;
+                                if (val & BHRB_TARGET) {
+                                        /* Shouldn't have two targets in a
+                                           row.. Reset index and try again */
+                                        r_index--;
+                                        addr = 0;
+                                }
+                                cpuhw->bhrb_entries[u_index].from = addr;
+                        } else {
+                                /* Branches to immediate field 
+                                   (ie I or B form) */
+                                cpuhw->bhrb_entries[u_index].from = addr;
+                                cpuhw->bhrb_entries[u_index].to =
+                                        power_pmu_bhrb_to(addr);
+                                cpuhw->bhrb_entries[u_index].mispred = pred;
+                                cpuhw->bhrb_entries[u_index].predicted = ~pred;
+                        }
+                        u_index++;
+
+                }
+        }
+        cpuhw->bhrb_stack.nr = u_index;
+        return;
+}
+
 #endif /* CONFIG_PPC64 */
 
 static void perf_event_interrupt(struct pt_regs *regs);
@@ -904,47 +1058,6 @@ static int collect_events(struct perf_event *group, int max_count,
         return n;
 }
 
-/* Reset all possible BHRB entries */
-static void power_pmu_bhrb_reset(void)
-{
-        asm volatile(PPC_CLRBHRB);
-}
-
-void power_pmu_bhrb_enable(struct perf_event *event)
-{
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
-
-        if (!ppmu->bhrb_nr)
-                return;
-
-        /* Clear BHRB if we changed task context to avoid data leaks */
-        if (event->ctx->task && cpuhw->bhrb_context != event->ctx) {
-                power_pmu_bhrb_reset();
-                cpuhw->bhrb_context = event->ctx;
-        }
-        cpuhw->bhrb_users++;
-}
-
-void power_pmu_bhrb_disable(struct perf_event *event)
-{
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
-
-        if (!ppmu->bhrb_nr)
-                return;
-
-        cpuhw->bhrb_users--;
-        WARN_ON_ONCE(cpuhw->bhrb_users < 0);
-
-        if (!cpuhw->disabled && !cpuhw->bhrb_users) {
-                /* BHRB cannot be turned off when other
-                 * events are active on the PMU.
-                 */
-
-                /* avoid stale pointer */
-                cpuhw->bhrb_context = NULL;
-        }
-}
-
 /*
  * Add a event to the PMU.
  * If all events are not already frozen, then we disable and
@@ -1180,15 +1293,6 @@ int power_pmu_commit_txn(struct pmu *pmu)
         return 0;
 }
 
-/* Called from ctxsw to prevent one process's branch entries to
- * mingle with the other process's entries during context switch.
- */
-void power_pmu_flush_branch_stack(void)
-{
-        if (ppmu->bhrb_nr)
-                power_pmu_bhrb_reset();
-}
-
 /*
  * Return 1 if we might be able to put event on a limited PMC,
  * or 0 if not.
@@ -1458,77 +1562,6 @@ struct pmu power_pmu = {
         .flush_branch_stack = power_pmu_flush_branch_stack,
 };
 
-/* Processing BHRB entries */
-void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw)
-{
-        u64 val;
-        u64 addr;
-        int r_index, u_index, target, pred;
-
-        r_index = 0;
-        u_index = 0;
-        while (r_index < ppmu->bhrb_nr) {
-                /* Assembly read function */
-                val = read_bhrb(r_index);
-
-                /* Terminal marker: End of valid BHRB entries */
-                if (val == 0) {
-                        break;
-                } else {
-                        /* BHRB field break up */
-                        addr = val & BHRB_EA;
-                        pred = val & BHRB_PREDICTION;
-                        target = val & BHRB_TARGET;
-
-                        /* Probable Missed entry: Not applicable for POWER8 */
-                        if ((addr == 0) && (target == 0) && (pred == 1)) {
-                                r_index++;
-                                continue;
-                        }
-
-                        /* Real Missed entry: Power8 based missed entry */
-                        if ((addr == 0) && (target == 1) && (pred == 1)) {
-                                r_index++;
-                                continue;
-                        }
-
-                        /* Reserved condition: Not a valid entry  */
-                        if ((addr == 0) && (target == 1) && (pred == 0)) {
-                                r_index++;
-                                continue;
-                        }
-
-                        /* Is a target address */
-                        if (val & BHRB_TARGET) {
-                                /* First address cannot be a target address */
-                                if (r_index == 0) {
-                                        r_index++;
-                                        continue;
-                                }
-
-                                /* Update target address for the previous entry */
-                                cpuhw->bhrb_entries[u_index - 1].to = addr;
-                                cpuhw->bhrb_entries[u_index - 1].mispred = pred;
-                                cpuhw->bhrb_entries[u_index - 1].predicted = ~pred;
-
-                                /* Dont increment u_index */
-                                r_index++;
-                        } else {
-                                /* Update address, flags for current entry */
-                                cpuhw->bhrb_entries[u_index].from = addr;
-                                cpuhw->bhrb_entries[u_index].mispred = pred;
-                                cpuhw->bhrb_entries[u_index].predicted = ~pred;
-
-                                /* Successfully popullated one entry */
-                                u_index++;
-                                r_index++;
-                        }
-                }
-        }
-        cpuhw->bhrb_stack.nr = u_index;
-        return;
-}
-
 /*
  * A counter has overflowed; update its count and record
  * things if requested.  Note that interrupts are hard-disabled
@@ -1725,7 +1758,7 @@ static void perf_event_interrupt(struct pt_regs *regs)
                         }
                 }
         }
-        if ((!found) && printk_ratelimit())
+        if (!found && !nmi && printk_ratelimit())
                 printk(KERN_WARNING "Can't find PMC that caused IRQ\n");
 
         /*
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index a881232a3cce..b62aab3e22ec 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -128,7 +128,7 @@ config PPC_RTAS_DAEMON
 
 config RTAS_PROC
         bool "Proc interface to RTAS"
-        depends on PPC_RTAS
+        depends on PPC_RTAS && PROC_FS
         default y
 
 config RTAS_FLASH
diff --git a/arch/powerpc/platforms/powernv/Kconfig b/arch/powerpc/platforms/powernv/Kconfig
index d3e840d643af..c24684c818ab 100644
--- a/arch/powerpc/platforms/powernv/Kconfig
+++ b/arch/powerpc/platforms/powernv/Kconfig
@@ -6,6 +6,7 @@ config PPC_POWERNV
         select PPC_ICP_NATIVE
         select PPC_P7_NAP
         select PPC_PCI_CHOICE if EMBEDDED
+        select EPAPR_BOOT
         default y
 
 config POWERNV_MSI
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index ade4463226c6..628c564ceadb 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -15,6 +15,7 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <asm/opal.h>
 #include <asm/firmware.h>
 
@@ -28,6 +29,8 @@ struct opal {
 static struct device_node *opal_node;
 static DEFINE_SPINLOCK(opal_write_lock);
 extern u64 opal_mc_secondary_handler[];
+static unsigned int *opal_irqs;
+static unsigned int opal_irq_count;
 
 int __init early_init_dt_scan_opal(unsigned long node,
                                    const char *uname, int depth, void *data)
@@ -53,7 +56,11 @@ int __init early_init_dt_scan_opal(unsigned long node,
                  opal.entry, entryp, entrysz);
 
         powerpc_firmware_features |= FW_FEATURE_OPAL;
-        if (of_flat_dt_is_compatible(node, "ibm,opal-v2")) {
+        if (of_flat_dt_is_compatible(node, "ibm,opal-v3")) {
+                powerpc_firmware_features |= FW_FEATURE_OPALv2;
+                powerpc_firmware_features |= FW_FEATURE_OPALv3;
+                printk("OPAL V3 detected !\n");
+        } else if (of_flat_dt_is_compatible(node, "ibm,opal-v2")) {
                 powerpc_firmware_features |= FW_FEATURE_OPALv2;
                 printk("OPAL V2 detected !\n");
         } else {
@@ -144,6 +151,13 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len)
                                 rc == OPAL_BUSY_EVENT || rc == OPAL_SUCCESS)) {
                 len = total_len;
                 rc = opal_console_write(vtermno, &len, data);
+
+                /* Closed or other error drop */
+                if (rc != OPAL_SUCCESS && rc != OPAL_BUSY &&
+                    rc != OPAL_BUSY_EVENT) {
+                        written = total_len;
+                        break;
+                }
                 if (rc == OPAL_SUCCESS) {
                         total_len -= len;
                         data += len;
@@ -316,6 +330,8 @@ static int __init opal_init(void)
         irqs = of_get_property(opal_node, "opal-interrupts", &irqlen);
         pr_debug("opal: Found %d interrupts reserved for OPAL\n",
                  irqs ? (irqlen / 4) : 0);
+        opal_irq_count = irqlen / 4;
+        opal_irqs = kzalloc(opal_irq_count * sizeof(unsigned int), GFP_KERNEL);
         for (i = 0; irqs && i < (irqlen / 4); i++, irqs++) {
                 unsigned int hwirq = be32_to_cpup(irqs);
                 unsigned int irq = irq_create_mapping(NULL, hwirq);
@@ -327,7 +343,19 @@ static int __init opal_init(void)
                 if (rc)
                         pr_warning("opal: Error %d requesting irq %d"
                                    " (0x%x)\n", rc, irq, hwirq);
+                opal_irqs[i] = irq;
         }
         return 0;
 }
 subsys_initcall(opal_init);
+
+void opal_shutdown(void)
+{
+        unsigned int i;
+
+        for (i = 0; i < opal_irq_count; i++) {
+                if (opal_irqs[i])
+                        free_irq(opal_irqs[i], 0);
+                opal_irqs[i] = 0;
+        }
+}
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 1da578b7c1bf..9c9d15e4cdf2 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -68,16 +68,6 @@ define_pe_printk_level(pe_err, KERN_ERR);
 define_pe_printk_level(pe_warn, KERN_WARNING);
 define_pe_printk_level(pe_info, KERN_INFO);
 
-static struct pci_dn *pnv_ioda_get_pdn(struct pci_dev *dev)
-{
-        struct device_node *np;
-
-        np = pci_device_to_OF_node(dev);
-        if (!np)
-                return NULL;
-        return PCI_DN(np);
-}
-
 static int pnv_ioda_alloc_pe(struct pnv_phb *phb)
 {
         unsigned long pe;
@@ -110,7 +100,7 @@ static struct pnv_ioda_pe *pnv_ioda_get_pe(struct pci_dev *dev)
 {
         struct pci_controller *hose = pci_bus_to_host(dev->bus);
         struct pnv_phb *phb = hose->private_data;
-        struct pci_dn *pdn = pnv_ioda_get_pdn(dev);
+        struct pci_dn *pdn = pci_get_pdn(dev);
 
         if (!pdn)
                 return NULL;
@@ -173,7 +163,7 @@ static int pnv_ioda_configure_pe(struct pnv_phb *phb, struct pnv_ioda_pe *pe)
 
         /* Add to all parents PELT-V */
         while (parent) {
-                struct pci_dn *pdn = pnv_ioda_get_pdn(parent);
+                struct pci_dn *pdn = pci_get_pdn(parent);
                 if (pdn && pdn->pe_number != IODA_INVALID_PE) {
                         rc = opal_pci_set_peltv(phb->opal_id, pdn->pe_number,
                                                 pe->pe_number, OPAL_ADD_PE_TO_DOMAIN);
@@ -252,7 +242,7 @@ static struct pnv_ioda_pe *pnv_ioda_setup_dev_PE(struct pci_dev *dev)
 {
         struct pci_controller *hose = pci_bus_to_host(dev->bus);
         struct pnv_phb *phb = hose->private_data;
-        struct pci_dn *pdn = pnv_ioda_get_pdn(dev);
+        struct pci_dn *pdn = pci_get_pdn(dev);
         struct pnv_ioda_pe *pe;
         int pe_num;
 
@@ -323,7 +313,7 @@ static void pnv_ioda_setup_same_PE(struct pci_bus *bus, struct pnv_ioda_pe *pe)
         struct pci_dev *dev;
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
-                struct pci_dn *pdn = pnv_ioda_get_pdn(dev);
+                struct pci_dn *pdn = pci_get_pdn(dev);
 
                 if (pdn == NULL) {
                         pr_warn("%s: No device node associated with device !\n",
@@ -436,7 +426,7 @@ static void pnv_pci_ioda_setup_PEs(void)
 
 static void pnv_pci_ioda_dma_dev_setup(struct pnv_phb *phb, struct pci_dev *pdev)
 {
-        struct pci_dn *pdn = pnv_ioda_get_pdn(pdev);
+        struct pci_dn *pdn = pci_get_pdn(pdev);
         struct pnv_ioda_pe *pe;
 
         /*
@@ -768,6 +758,7 @@ static int pnv_pci_ioda_msi_setup(struct pnv_phb *phb, struct pci_dev *dev,
                                   unsigned int is_64, struct msi_msg *msg)
 {
         struct pnv_ioda_pe *pe = pnv_ioda_get_pe(dev);
+        struct pci_dn *pdn = pci_get_pdn(dev);
         struct irq_data *idata;
         struct irq_chip *ichip;
         unsigned int xive_num = hwirq - phb->msi_base;
@@ -783,6 +774,10 @@ static int pnv_pci_ioda_msi_setup(struct pnv_phb *phb, struct pci_dev *dev,
         if (pe->mve_number < 0)
                 return -ENXIO;
 
+        /* Force 32-bit MSI on some broken devices */
+        if (pdn && pdn->force_32bit_msi)
+                is_64 = 0;
+
         /* Assign XIVE to PE */
         rc = opal_pci_set_xive_pe(phb->opal_id, pe->pe_number, xive_num);
         if (rc) {
@@ -1035,7 +1030,7 @@ static int pnv_pci_enable_device_hook(struct pci_dev *dev)
         if (!phb->initialized)
                 return 0;
 
-        pdn = pnv_ioda_get_pdn(dev);
+        pdn = pci_get_pdn(dev);
         if (!pdn || pdn->pe_number == IODA_INVALID_PE)
                 return -EINVAL;
 
@@ -1048,6 +1043,12 @@ static u32 pnv_ioda_bdfn_to_pe(struct pnv_phb *phb, struct pci_bus *bus,
         return phb->ioda.pe_rmap[(bus->number << 8) | devfn];
 }
 
+static void pnv_pci_ioda_shutdown(struct pnv_phb *phb)
+{
+        opal_pci_reset(phb->opal_id, OPAL_PCI_IODA_TABLE_RESET,
+                       OPAL_ASSERT_RESET);
+}
+
 void __init pnv_pci_init_ioda_phb(struct device_node *np, int ioda_type)
 {
         struct pci_controller *hose;
@@ -1178,6 +1179,9 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np, int ioda_type)
         /* Setup TCEs */
         phb->dma_dev_setup = pnv_pci_ioda_dma_dev_setup;
 
+        /* Setup shutdown function for kexec */
+        phb->shutdown = pnv_pci_ioda_shutdown;
+
         /* Setup MSI support */
         pnv_pci_init_ioda_msis(phb);
 
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 55dfca844ddf..277343cc6a3d 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -47,6 +47,10 @@ static int pnv_msi_check_device(struct pci_dev* pdev, int nvec, int type)
 {
         struct pci_controller *hose = pci_bus_to_host(pdev->bus);
         struct pnv_phb *phb = hose->private_data;
+        struct pci_dn *pdn = pci_get_pdn(pdev);
+
+        if (pdn && pdn->force_32bit_msi && !phb->msi32_support)
+                return -ENODEV;
 
         return (phb && phb->msi_bmp.bitmap) ? 0 : -ENODEV;
 }
@@ -367,7 +371,7 @@ static void pnv_tce_free(struct iommu_table *tbl, long index, long npages)
         while (npages--)
                 *(tcep++) = 0;
 
-        if (tbl->it_type & TCE_PCI_SWINV_CREATE)
+        if (tbl->it_type & TCE_PCI_SWINV_FREE)
                 pnv_pci_ioda_tce_invalidate(tbl, tces, tcep - 1);
 }
 
@@ -450,6 +454,18 @@ static void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
                 pnv_pci_dma_fallback_setup(hose, pdev);
 }
 
+void pnv_pci_shutdown(void)
+{
+        struct pci_controller *hose;
+
+        list_for_each_entry(hose, &hose_list, list_node) {
+                struct pnv_phb *phb = hose->private_data;
+
+                if (phb && phb->shutdown)
+                        phb->shutdown(phb);
+        }
+}
+
 /* Fixup wrong class code in p7ioc and p8 root complex */
 static void pnv_p7ioc_rc_quirk(struct pci_dev *dev)
 {
diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
index 48dc4bb856a1..25d76c4df50b 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -86,6 +86,7 @@ struct pnv_phb {
         void (*dma_dev_setup)(struct pnv_phb *phb, struct pci_dev *pdev);
         void (*fixup_phb)(struct pci_controller *hose);
         u32 (*bdfn_to_pe)(struct pnv_phb *phb, struct pci_bus *bus, u32 devfn);
+        void (*shutdown)(struct pnv_phb *phb);
 
         union {
                 struct {
@@ -158,4 +159,5 @@ extern void pnv_pci_init_ioda_hub(struct device_node *np);
 extern void pnv_pci_init_ioda2_phb(struct device_node *np);
 extern void pnv_pci_ioda_tce_invalidate(struct iommu_table *tbl,
                                         u64 *startp, u64 *endp);
+
 #endif /* __POWERNV_PCI_H */
diff --git a/arch/powerpc/platforms/powernv/powernv.h b/arch/powerpc/platforms/powernv/powernv.h
index 8a9df7f9667e..a1c6f83fc391 100644
--- a/arch/powerpc/platforms/powernv/powernv.h
+++ b/arch/powerpc/platforms/powernv/powernv.h
@@ -9,8 +9,10 @@ static inline void pnv_smp_init(void) { }
 
 #ifdef CONFIG_PCI
 extern void pnv_pci_init(void);
+extern void pnv_pci_shutdown(void);
 #else
 static inline void pnv_pci_init(void) { }
+static inline void pnv_pci_shutdown(void) { }
 #endif
 
 #endif /* _POWERNV_H */
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index db1ad1c8f68f..d4459bfc92f7 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -78,7 +78,9 @@ static void pnv_show_cpuinfo(struct seq_file *m)
         if (root)
                 model = of_get_property(root, "model", NULL);
         seq_printf(m, "machine\t\t: PowerNV %s\n", model);
-        if (firmware_has_feature(FW_FEATURE_OPALv2))
+        if (firmware_has_feature(FW_FEATURE_OPALv3))
+                seq_printf(m, "firmware\t: OPAL v3\n");
+        else if (firmware_has_feature(FW_FEATURE_OPALv2))
                 seq_printf(m, "firmware\t: OPAL v2\n");
         else if (firmware_has_feature(FW_FEATURE_OPAL))
                 seq_printf(m, "firmware\t: OPAL v1\n");
@@ -126,6 +128,17 @@ static void pnv_progress(char *s, unsigned short hex)
 {
 }
 
+static void pnv_shutdown(void)
+{
+        /* Let the PCI code clear up IODA tables */
+        pnv_pci_shutdown();
+
+        /* And unregister all OPAL interrupts so they don't fire
+         * up while we kexec
+         */
+        opal_shutdown();
+}
+
 #ifdef CONFIG_KEXEC
 static void pnv_kexec_cpu_down(int crash_shutdown, int secondary)
 {
@@ -187,6 +200,7 @@ define_machine(powernv) {
         .init_IRQ               = pnv_init_IRQ,
         .show_cpuinfo           = pnv_show_cpuinfo,
         .progress               = pnv_progress,
+        .machine_shutdown       = pnv_shutdown,
         .power_save             = power7_idle,
         .calibrate_decr         = generic_calibrate_decr,
 #ifdef CONFIG_KEXEC
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 6a3ecca5b725..88c9459c3e07 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -71,18 +71,68 @@ int pnv_smp_kick_cpu(int nr)
 
         BUG_ON(nr < 0 || nr >= NR_CPUS);
 
-        /* On OPAL v2 the CPU are still spinning inside OPAL itself,
-         * get them back now
+        /*
+         * If we already started or OPALv2 is not supported, we just
+         * kick the CPU via the PACA
          */
-        if (!paca[nr].cpu_start && firmware_has_feature(FW_FEATURE_OPALv2)) {
-                pr_devel("OPAL: Starting CPU %d (HW 0x%x)...\n", nr, pcpu);
-                rc = opal_start_cpu(pcpu, start_here);
+        if (paca[nr].cpu_start || !firmware_has_feature(FW_FEATURE_OPALv2))
+                goto kick;
+
+        /*
+         * At this point, the CPU can either be spinning on the way in
+         * from kexec or be inside OPAL waiting to be started for the
+         * first time. OPAL v3 allows us to query OPAL to know if it
+         * has the CPUs, so we do that
+         */
+        if (firmware_has_feature(FW_FEATURE_OPALv3)) {
+                uint8_t status;
+
+                rc = opal_query_cpu_status(pcpu, &status);
                 if (rc != OPAL_SUCCESS) {
-                        pr_warn("OPAL Error %ld starting CPU %d\n",
+                        pr_warn("OPAL Error %ld querying CPU %d state\n",
                                 rc, nr);
                         return -ENODEV;
                 }
+
+                /*
+                 * Already started, just kick it, probably coming from
+                 * kexec and spinning
+                 */
+                if (status == OPAL_THREAD_STARTED)
+                        goto kick;
+
+                /*
+                 * Available/inactive, let's kick it
+                 */
+                if (status == OPAL_THREAD_INACTIVE) {
+                        pr_devel("OPAL: Starting CPU %d (HW 0x%x)...\n",
+                                 nr, pcpu);
+                        rc = opal_start_cpu(pcpu, start_here);
+                        if (rc != OPAL_SUCCESS) {
+                                pr_warn("OPAL Error %ld starting CPU %d\n",
+                                        rc, nr);
+                                return -ENODEV;
+                        }
+                } else {
+                        /*
+                         * An unavailable CPU (or any other unknown status)
+                         * shouldn't be started. It should also
+                         * not be in the possible map but currently it can
+                         * happen
+                         */
+                        pr_devel("OPAL: CPU %d (HW 0x%x) is unavailable"
+                                 " (status %d)...\n", nr, pcpu, status);
+                        return -ENODEV;
+                }
+        } else {
+                /*
+                 * On OPAL v2, we just kick it and hope for the best,
+                 * we must not test the error from opal_start_cpu() or
+                 * we would fail to get CPUs from kexec.
+                 */
+                opal_start_cpu(pcpu, start_here);
         }
+ kick:
         return smp_generic_kick_cpu(nr);
 }
 
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 9a0941bc4d31..4459eff7a75a 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -18,6 +18,9 @@ config PPC_PSERIES
         select PPC_PCI_CHOICE if EXPERT
         select ZLIB_DEFLATE
         select PPC_DOORBELL
+        select HAVE_CONTEXT_TRACKING
+        select HOTPLUG if SMP
+        select HOTPLUG_CPU if SMP
         default y
 
 config PPC_SPLPAR
diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
index 19506f935737..b456b157d33d 100644
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -83,7 +83,11 @@ static int pseries_eeh_init(void)
         ibm_configure_pe                = rtas_token("ibm,configure-pe");
         ibm_configure_bridge            = rtas_token("ibm,configure-bridge");
 
-        /* necessary sanity check */
+        /*
+         * Necessary sanity check. We needn't check "get-config-addr-info"
+         * and its variant since the old firmware probably support address
+         * of domain/bus/slot/function for EEH RTAS operations.
+         */
         if (ibm_set_eeh_option == RTAS_UNKNOWN_SERVICE) {
                 pr_warning("%s: RTAS service <ibm,set-eeh-option> invalid\n",
                         __func__);
@@ -102,12 +106,6 @@ static int pseries_eeh_init(void)
                 pr_warning("%s: RTAS service <ibm,slot-error-detail> invalid\n",
                         __func__);
                 return -EINVAL;
-        } else if (ibm_get_config_addr_info2 == RTAS_UNKNOWN_SERVICE &&
-                   ibm_get_config_addr_info == RTAS_UNKNOWN_SERVICE) {
-                pr_warning("%s: RTAS service <ibm,get-config-addr-info2> and "
-                        "<ibm,get-config-addr-info> invalid\n",
-                        __func__);
-                return -EINVAL;
         } else if (ibm_configure_pe == RTAS_UNKNOWN_SERVICE &&
                    ibm_configure_bridge == RTAS_UNKNOWN_SERVICE) {
                 pr_warning("%s: RTAS service <ibm,configure-pe> and "
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
index 420524e6f8c9..6d2f0abce6fa 100644
--- a/arch/powerpc/platforms/pseries/msi.c
+++ b/arch/powerpc/platforms/pseries/msi.c
@@ -26,26 +26,6 @@ static int query_token, change_token;
 #define RTAS_CHANGE_MSIX_FN     4
 #define RTAS_CHANGE_32MSI_FN    5
 
-static struct pci_dn *get_pdn(struct pci_dev *pdev)
-{
-        struct device_node *dn;
-        struct pci_dn *pdn;
-
-        dn = pci_device_to_OF_node(pdev);
-        if (!dn) {
-                dev_dbg(&pdev->dev, "rtas_msi: No OF device node\n");
-                return NULL;
-        }
-
-        pdn = PCI_DN(dn);
-        if (!pdn) {
-                dev_dbg(&pdev->dev, "rtas_msi: No PCI DN\n");
-                return NULL;
-        }
-
-        return pdn;
-}
-
 /* RTAS Helpers */
 
 static int rtas_change_msi(struct pci_dn *pdn, u32 func, u32 num_irqs)
@@ -91,7 +71,7 @@ static void rtas_disable_msi(struct pci_dev *pdev)
 {
         struct pci_dn *pdn;
 
-        pdn = get_pdn(pdev);
+        pdn = pci_get_pdn(pdev);
         if (!pdn)
                 return;
 
@@ -152,7 +132,7 @@ static int check_req(struct pci_dev *pdev, int nvec, char *prop_name)
         struct pci_dn *pdn;
         const u32 *req_msi;
 
-        pdn = get_pdn(pdev);
+        pdn = pci_get_pdn(pdev);
         if (!pdn)
                 return -ENODEV;
 
@@ -394,6 +374,23 @@ static int check_msix_entries(struct pci_dev *pdev)
         return 0;
 }
 
+static void rtas_hack_32bit_msi_gen2(struct pci_dev *pdev)
+{
+        u32 addr_hi, addr_lo;
+
+        /*
+         * We should only get in here for IODA1 configs. This is based on the
+         * fact that we using RTAS for MSIs, we don't have the 32 bit MSI RTAS
+         * support, and we are in a PCIe Gen2 slot.
+         */
+        dev_info(&pdev->dev,
+                 "rtas_msi: No 32 bit MSI firmware support, forcing 32 bit MSI\n");
+        pci_read_config_dword(pdev, pdev->msi_cap + PCI_MSI_ADDRESS_HI, &addr_hi);
+        addr_lo = 0xffff0000 | ((addr_hi >> (48 - 32)) << 4);
+        pci_write_config_dword(pdev, pdev->msi_cap + PCI_MSI_ADDRESS_LO, addr_lo);
+        pci_write_config_dword(pdev, pdev->msi_cap + PCI_MSI_ADDRESS_HI, 0);
+}
+
 static int rtas_setup_msi_irqs(struct pci_dev *pdev, int nvec_in, int type)
 {
         struct pci_dn *pdn;
@@ -401,8 +398,9 @@ static int rtas_setup_msi_irqs(struct pci_dev *pdev, int nvec_in, int type)
         struct msi_desc *entry;
         struct msi_msg msg;
         int nvec = nvec_in;
+        int use_32bit_msi_hack = 0;
 
-        pdn = get_pdn(pdev);
+        pdn = pci_get_pdn(pdev);
         if (!pdn)
                 return -ENODEV;
 
@@ -428,15 +426,31 @@ static int rtas_setup_msi_irqs(struct pci_dev *pdev, int nvec_in, int type)
          */
 again:
         if (type == PCI_CAP_ID_MSI) {
-                if (pdn->force_32bit_msi)
+                if (pdn->force_32bit_msi) {
                         rc = rtas_change_msi(pdn, RTAS_CHANGE_32MSI_FN, nvec);
-                else
+                        if (rc < 0) {
+                                /*
+                                 * We only want to run the 32 bit MSI hack below if
+                                 * the max bus speed is Gen2 speed
+                                 */
+                                if (pdev->bus->max_bus_speed != PCIE_SPEED_5_0GT)
+                                        return rc;
+
+                                use_32bit_msi_hack = 1;
+                        }
+                } else
+                        rc = -1;
+
+                if (rc < 0)
                         rc = rtas_change_msi(pdn, RTAS_CHANGE_MSI_FN, nvec);
 
-                if (rc < 0 && !pdn->force_32bit_msi) {
+                if (rc < 0) {
                         pr_debug("rtas_msi: trying the old firmware call.\n");
                         rc = rtas_change_msi(pdn, RTAS_CHANGE_FN, nvec);
                 }
+
+                if (use_32bit_msi_hack && rc > 0)
+                        rtas_hack_32bit_msi_gen2(pdev);
         } else
                 rc = rtas_change_msi(pdn, RTAS_CHANGE_MSIX_FN, nvec);
 
@@ -518,12 +532,3 @@ static int rtas_msi_init(void)
 }
 arch_initcall(rtas_msi_init);
 
-static void quirk_radeon(struct pci_dev *dev)
-{
-        struct pci_dn *pdn = get_pdn(dev);
-
-        if (pdn)
-                pdn->force_32bit_msi = 1;
-}
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x68f2, quirk_radeon);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0xaa68, quirk_radeon);
diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index 47226e04126d..5f997e79d570 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -16,6 +16,7 @@
   * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
   */
 
+#include <linux/cpu.h>
 #include <linux/delay.h>
 #include <linux/suspend.h>
 #include <linux/stat.h>
@@ -126,11 +127,15 @@ static ssize_t store_hibernate(struct device *dev,
                                struct device_attribute *attr,
                                const char *buf, size_t count)
 {
+        cpumask_var_t offline_mask;
         int rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
+                return -ENOMEM;
+
         stream_id = simple_strtoul(buf, NULL, 16);
 
         do {
@@ -140,15 +145,32 @@ static ssize_t store_hibernate(struct device *dev,
         } while (rc == -EAGAIN);
 
         if (!rc) {
+                /* All present CPUs must be online */
+                cpumask_andnot(offline_mask, cpu_present_mask,
+                                cpu_online_mask);
+                rc = rtas_online_cpus_mask(offline_mask);
+                if (rc) {
+                        pr_err("%s: Could not bring present CPUs online.\n",
+                                        __func__);
+                        goto out;
+                }
+
                 stop_topology_update();
                 rc = pm_suspend(PM_SUSPEND_MEM);
                 start_topology_update();
+
+                /* Take down CPUs not online prior to suspend */
+                if (!rtas_offline_cpus_mask(offline_mask))
+                        pr_warn("%s: Could not restore CPUs to offline "
+                                        "state.\n", __func__);
         }
 
         stream_id = 0;
 
         if (!rc)
                 rc = count;
+out:
+        free_cpumask_var(offline_mask);
         return rc;
 }
 
diff --git a/arch/powerpc/platforms/wsp/ics.c b/arch/powerpc/platforms/wsp/ics.c
index 97fe82ee8633..2d3b1dd9571d 100644
--- a/arch/powerpc/platforms/wsp/ics.c
+++ b/arch/powerpc/platforms/wsp/ics.c
@@ -361,7 +361,7 @@ static int wsp_chip_set_affinity(struct irq_data *d,
         xive = xive_set_server(xive, get_irq_server(ics, hw_irq));
         wsp_ics_set_xive(ics, hw_irq, xive);
 
-        return 0;
+        return IRQ_SET_MASK_OK;
 }
 
 static struct irq_chip wsp_irq_chip = {
diff --git a/arch/powerpc/sysdev/Makefile b/arch/powerpc/sysdev/Makefile
index b0a518e97599..99464a7bdb3b 100644
--- a/arch/powerpc/sysdev/Makefile
+++ b/arch/powerpc/sysdev/Makefile
@@ -64,6 +64,8 @@ endif
 
 obj-$(CONFIG_PPC_SCOM)          += scom.o
 
+obj-$(CONFIG_PPC_EARLY_DEBUG_MEMCONS)   += udbg_memcons.o
+
 subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
 
 obj-$(CONFIG_PPC_XICS)          += xics/
diff --git a/arch/powerpc/sysdev/ehv_pic.c b/arch/powerpc/sysdev/ehv_pic.c
index 6e0e1005227f..9cd0e60716fe 100644
--- a/arch/powerpc/sysdev/ehv_pic.c
+++ b/arch/powerpc/sysdev/ehv_pic.c
@@ -81,7 +81,7 @@ int ehv_pic_set_affinity(struct irq_data *d, const struct cpumask *dest,
         ev_int_set_config(src, config, prio, cpuid);
         spin_unlock_irqrestore(&ehv_pic_lock, flags);
 
-        return 0;
+        return IRQ_SET_MASK_OK;
 }
 
 static unsigned int ehv_pic_type_to_vecpri(unsigned int type)
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index ee21b5e71aec..3cc2f9159ab1 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -54,7 +54,7 @@ static DEFINE_RAW_SPINLOCK(mpic_lock);
 
 #ifdef CONFIG_PPC32     /* XXX for now */
 #ifdef CONFIG_IRQ_ALL_CPUS
-#define distribute_irqs (!(mpic->flags & MPIC_SINGLE_DEST_CPU))
+#define distribute_irqs (1)
 #else
 #define distribute_irqs (0)
 #endif
@@ -836,7 +836,7 @@ int mpic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,
                                mpic_physmask(mask));
         }
 
-        return 0;
+        return IRQ_SET_MASK_OK;
 }
 
 static unsigned int mpic_type_to_vecpri(struct mpic *mpic, unsigned int type)
@@ -1703,7 +1703,7 @@ void mpic_setup_this_cpu(void)
          * it differently, then we should make sure we also change the default
          * values of irq_desc[].affinity in irq.c.
          */
-        if (distribute_irqs) {
+        if (distribute_irqs && !(mpic->flags & MPIC_SINGLE_DEST_CPU)) {
                 for (i = 0; i < mpic->num_sources ; i++)
                         mpic_irq_write(i, MPIC_INFO(IRQ_DESTINATION),
                                 mpic_irq_read(i, MPIC_INFO(IRQ_DESTINATION)) | msk);
diff --git a/arch/powerpc/sysdev/udbg_memcons.c b/arch/powerpc/sysdev/udbg_memcons.c
new file mode 100644
index 000000000000..ce5a7b489e4b
--- /dev/null
+++ b/arch/powerpc/sysdev/udbg_memcons.c
@@ -0,0 +1,105 @@
+/*
+ * A udbg backend which logs messages and reads input from in memory
+ * buffers.
+ *
+ * The console output can be read from memcons_output which is a
+ * circular buffer whose next write position is stored in memcons.output_pos.
+ *
+ * Input may be passed by writing into the memcons_input buffer when it is
+ * empty. The input buffer is empty when both input_pos == input_start and
+ * *input_start == '\0'.
+ *
+ * Copyright (C) 2003-2005 Anton Blanchard and Milton Miller, IBM Corp
+ * Copyright (C) 2013 Alistair Popple, IBM Corp
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <asm/barrier.h>
+#include <asm/page.h>
+#include <asm/processor.h>
+#include <asm/udbg.h>
+
+struct memcons {
+        char *output_start;
+        char *output_pos;
+        char *output_end;
+        char *input_start;
+        char *input_pos;
+        char *input_end;
+};
+
+static char memcons_output[CONFIG_PPC_MEMCONS_OUTPUT_SIZE];
+static char memcons_input[CONFIG_PPC_MEMCONS_INPUT_SIZE];
+
+struct memcons memcons = {
+        .output_start = memcons_output,
+        .output_pos = memcons_output,
+        .output_end = &memcons_output[CONFIG_PPC_MEMCONS_OUTPUT_SIZE],
+        .input_start = memcons_input,
+        .input_pos = memcons_input,
+        .input_end = &memcons_input[CONFIG_PPC_MEMCONS_INPUT_SIZE],
+};
+
+void memcons_putc(char c)
+{
+        char *new_output_pos;
+
+        *memcons.output_pos = c;
+        wmb();
+        new_output_pos = memcons.output_pos + 1;
+        if (new_output_pos >= memcons.output_end)
+                new_output_pos = memcons.output_start;
+
+        memcons.output_pos = new_output_pos;
+}
+
+int memcons_getc_poll(void)
+{
+        char c;
+        char *new_input_pos;
+
+        if (*memcons.input_pos) {
+                c = *memcons.input_pos;
+
+                new_input_pos = memcons.input_pos + 1;
+                if (new_input_pos >= memcons.input_end)
+                        new_input_pos = memcons.input_start;
+                else if (*new_input_pos == '\0')
+                        new_input_pos = memcons.input_start;
+
+                *memcons.input_pos = '\0';
+                wmb();
+                memcons.input_pos = new_input_pos;
+                return c;
+        }
+
+        return -1;
+}
+
+int memcons_getc(void)
+{
+        int c;
+
+        while (1) {
+                c = memcons_getc_poll();
+                if (c == -1)
+                        cpu_relax();
+                else
+                        break;
+        }
+
+        return c;
+}
+
+void udbg_init_memcons(void)
+{
+        udbg_putc = memcons_putc;
+        udbg_getc = memcons_getc;
+        udbg_getc_poll = memcons_getc_poll;
+}
diff --git a/arch/powerpc/sysdev/xics/ics-opal.c b/arch/powerpc/sysdev/xics/ics-opal.c
index f7e8609df0d5..39d72212655e 100644
--- a/arch/powerpc/sysdev/xics/ics-opal.c
+++ b/arch/powerpc/sysdev/xics/ics-opal.c
@@ -148,7 +148,7 @@ static int ics_opal_set_affinity(struct irq_data *d,
                        __func__, d->irq, hw_irq, server, rc);
                 return -1;
         }
-        return 0;
+        return IRQ_SET_MASK_OK;
 }
 
 static struct irq_chip ics_opal_irq_chip = {