Merge branch 'linus' into x86/gart

82 files changed, 1587 insertions, 841 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 03980cb04291..ac2fb0641a04 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -21,12 +21,16 @@ config X86
         select HAVE_UNSTABLE_SCHED_CLOCK
         select HAVE_IDE
         select HAVE_OPROFILE
+        select HAVE_IOREMAP_PROT
         select HAVE_KPROBES
+        select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_KRETPROBES
         select HAVE_DYNAMIC_FTRACE
         select HAVE_FTRACE
         select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
         select HAVE_ARCH_KGDB if !X86_VOYAGER
+        select HAVE_GENERIC_DMA_COHERENT if X86_32
+        select HAVE_EFFICIENT_UNALIGNED_ACCESS
 
 config ARCH_DEFCONFIG
         string
@@ -329,20 +333,6 @@ config X86_BIGSMP
 
 endif
 
-config X86_RDC321X
-        bool "RDC R-321x SoC"
-        depends on X86_32
-        select M486
-        select X86_REBOOTFIXUPS
-        select GENERIC_GPIO
-        select LEDS_CLASS
-        select LEDS_GPIO
-        select NEW_LEDS
-        help
-          This option is needed for RDC R-321x system-on-chip, also known
-          as R-8610-(G).
-          If you don't have one of these chips, you should say N here.
-
 config X86_VSMP
         bool "Support for ScaleMP vSMP"
         select PARAVIRT
@@ -366,6 +356,16 @@ config X86_VISWS
           A kernel compiled for the Visual Workstation will run on general
           PCs as well. See <file:Documentation/sgi-visws.txt> for details.
 
+config X86_RDC321X
+        bool "RDC R-321x SoC"
+        depends on X86_32
+        select M486
+        select X86_REBOOTFIXUPS
+        help
+          This option is needed for RDC R-321x system-on-chip, also known
+          as R-8610-(G).
+          If you don't have one of these chips, you should say N here.
+
 config SCHED_NO_NO_OMIT_FRAME_POINTER
         def_bool y
         prompt "Single-depth WCHAN output"
@@ -1276,6 +1276,14 @@ config CRASH_DUMP
           (CONFIG_RELOCATABLE=y).
           For more details see Documentation/kdump/kdump.txt
 
+config KEXEC_JUMP
+        bool "kexec jump (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        depends on KEXEC && HIBERNATION && X86_32
+        help
+          Jump between original kernel and kexeced kernel and invoke
+          code in physical address mode via KEXEC
+
 config PHYSICAL_START
         hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
         default "0x1000000" if X86_NUMAQ
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 919ce21ea654..f5631da585b6 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -118,11 +118,6 @@ mflags-$(CONFIG_X86_GENERICARCH):= -Iinclude/asm-x86/mach-generic
 fcore-$(CONFIG_X86_GENERICARCH) += arch/x86/mach-generic/
 mcore-$(CONFIG_X86_GENERICARCH) := arch/x86/mach-default/
 
-# RDC R-321x subarch support
-mflags-$(CONFIG_X86_RDC321X)    := -Iinclude/asm-x86/mach-rdc321x
-mcore-$(CONFIG_X86_RDC321X)     := arch/x86/mach-default/
-core-$(CONFIG_X86_RDC321X)      += arch/x86/mach-rdc321x/
-
 # default subarch .h files
 mflags-y += -Iinclude/asm-x86/mach-default
 
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index bc5553b496f7..9fea73706479 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -182,8 +182,6 @@ static unsigned		outcnt;
 static int  fill_inbuf(void);
 static void flush_window(void);
 static void error(char *m);
-static void gzip_mark(void **);
-static void gzip_release(void **);
 
 /*
  * This is set up by the setup-routine at boot-time
@@ -196,9 +194,6 @@ extern int input_len;
 
 static long bytes_out;
 
-static void *malloc(int size);
-static void free(void *where);
-
 static void *memset(void *s, int c, unsigned n);
 static void *memcpy(void *dest, const void *src, unsigned n);
 
@@ -220,40 +215,6 @@ static int lines, cols;
 
 #include "../../../../lib/inflate.c"
 
-static void *malloc(int size)
-{
-        void *p;
-
-        if (size < 0)
-                error("Malloc error");
-        if (free_mem_ptr <= 0)
-                error("Memory error");
-
-        free_mem_ptr = (free_mem_ptr + 3) & ~3; /* Align */
-
-        p = (void *)free_mem_ptr;
-        free_mem_ptr += size;
-
-        if (free_mem_ptr >= free_mem_end_ptr)
-                error("Out of memory");
-
-        return p;
-}
-
-static void free(void *where)
-{       /* Don't care */
-}
-
-static void gzip_mark(void **ptr)
-{
-        *ptr = (void *) free_mem_ptr;
-}
-
-static void gzip_release(void **ptr)
-{
-        free_mem_ptr = (memptr) *ptr;
-}
-
 static void scroll(void)
 {
         int i;
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index 58cccb6483b0..a0e1dbe67dc1 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -441,12 +441,6 @@ beyond_if:
         regs->r8 = regs->r9 = regs->r10 = regs->r11 =
         regs->r12 = regs->r13 = regs->r14 = regs->r15 = 0;
         set_fs(USER_DS);
-        if (unlikely(current->ptrace & PT_PTRACED)) {
-                if (current->ptrace & PT_TRACE_EXEC)
-                        ptrace_notify((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
-                else
-                        send_sig(SIGTRAP, current, 0);
-        }
         return 0;
 }
 
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 23d146ce676b..ffc1bb4fed7d 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -15,6 +15,16 @@
 #include <asm/irqflags.h>
 #include <linux/linkage.h>
 
+/* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+#include <linux/elf-em.h>
+#define AUDIT_ARCH_I386         (EM_386|__AUDIT_ARCH_LE)
+#define __AUDIT_ARCH_LE    0x40000000
+
+#ifndef CONFIG_AUDITSYSCALL
+#define sysexit_audit int_ret_from_sys_call
+#define sysretl_audit int_ret_from_sys_call
+#endif
+
 #define IA32_NR_syscalls ((ia32_syscall_end - ia32_sys_call_table)/8)
 
         .macro IA32_ARG_FIXUP noebp=0
@@ -148,13 +158,15 @@ ENTRY(ia32_sysenter_target)
         ja      ia32_badsys
 sysenter_do_call:
         IA32_ARG_FIXUP 1
+sysenter_dispatch:
         call    *ia32_sys_call_table(,%rax,8)
         movq    %rax,RAX-ARGOFFSET(%rsp)
         GET_THREAD_INFO(%r10)
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
         testl   $_TIF_ALLWORK_MASK,TI_flags(%r10)
-        jnz     int_ret_from_sys_call
+        jnz     sysexit_audit
+sysexit_from_sys_call:
         andl    $~TS_COMPAT,TI_status(%r10)
         /* clear IF, that popfq doesn't enable interrupts early */
         andl  $~0x200,EFLAGS-R11(%rsp) 
@@ -170,9 +182,63 @@ sysenter_do_call:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS_SYSEXIT32
 
-sysenter_tracesys:
+#ifdef CONFIG_AUDITSYSCALL
+        .macro auditsys_entry_common
+        movl %esi,%r9d                  /* 6th arg: 4th syscall arg */
+        movl %edx,%r8d                  /* 5th arg: 3rd syscall arg */
+        /* (already in %ecx)               4th arg: 2nd syscall arg */
+        movl %ebx,%edx                  /* 3rd arg: 1st syscall arg */
+        movl %eax,%esi                  /* 2nd arg: syscall number */
+        movl $AUDIT_ARCH_I386,%edi      /* 1st arg: audit arch */
+        call audit_syscall_entry
+        movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall number */
+        cmpl $(IA32_NR_syscalls-1),%eax
+        ja ia32_badsys
+        movl %ebx,%edi                  /* reload 1st syscall arg */
+        movl RCX-ARGOFFSET(%rsp),%esi   /* reload 2nd syscall arg */
+        movl RDX-ARGOFFSET(%rsp),%edx   /* reload 3rd syscall arg */
+        movl RSI-ARGOFFSET(%rsp),%ecx   /* reload 4th syscall arg */
+        movl RDI-ARGOFFSET(%rsp),%r8d   /* reload 5th syscall arg */
+        .endm
+
+        .macro auditsys_exit exit,ebpsave=RBP
+        testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
+        jnz int_ret_from_sys_call
+        TRACE_IRQS_ON
+        sti
+        movl %eax,%esi          /* second arg, syscall return value */
+        cmpl $0,%eax            /* is it < 0? */
+        setl %al                /* 1 if so, 0 if not */
+        movzbl %al,%edi         /* zero-extend that into %edi */
+        inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
+        call audit_syscall_exit
+        GET_THREAD_INFO(%r10)
+        movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall return value */
+        movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */
+        movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
+        cli
+        TRACE_IRQS_OFF
+        testl %edi,TI_flags(%r10)
+        jnz int_with_check
+        jmp \exit
+        .endm
+
+sysenter_auditsys:
         CFI_RESTORE_STATE
+        auditsys_entry_common
+        movl %ebp,%r9d                  /* reload 6th syscall arg */
+        jmp sysenter_dispatch
+
+sysexit_audit:
+        auditsys_exit sysexit_from_sys_call
+#endif
+
+sysenter_tracesys:
         xchgl   %r9d,%ebp
+#ifdef CONFIG_AUDITSYSCALL
+        testl   $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
+        jz      sysenter_auditsys
+#endif
         SAVE_REST
         CLEAR_RREGS
         movq    %r9,R9(%rsp)
@@ -252,13 +318,15 @@ cstar_do_call:
         cmpl $IA32_NR_syscalls-1,%eax
         ja  ia32_badsys
         IA32_ARG_FIXUP 1
+cstar_dispatch:
         call *ia32_sys_call_table(,%rax,8)
         movq %rax,RAX-ARGOFFSET(%rsp)
         GET_THREAD_INFO(%r10)
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
         testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
-        jnz  int_ret_from_sys_call
+        jnz sysretl_audit
+sysretl_from_sys_call:
         andl $~TS_COMPAT,TI_status(%r10)
         RESTORE_ARGS 1,-ARG_SKIP,1,1,1
         movl RIP-ARGOFFSET(%rsp),%ecx
@@ -270,8 +338,23 @@ cstar_do_call:
         CFI_RESTORE rsp
         USERGS_SYSRET32
         
-cstar_tracesys: 
+#ifdef CONFIG_AUDITSYSCALL
+cstar_auditsys:
         CFI_RESTORE_STATE
+        movl %r9d,R9-ARGOFFSET(%rsp)    /* register to be clobbered by call */
+        auditsys_entry_common
+        movl R9-ARGOFFSET(%rsp),%r9d    /* reload 6th syscall arg */
+        jmp cstar_dispatch
+
+sysretl_audit:
+        auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */
+#endif
+
+cstar_tracesys:
+#ifdef CONFIG_AUDITSYSCALL
+        testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
+        jz cstar_auditsys
+#endif
         xchgl %r9d,%ebp
         SAVE_REST
         CLEAR_RREGS
@@ -743,4 +826,10 @@ ia32_sys_call_table:
         .quad sys32_fallocate
         .quad compat_sys_timerfd_settime        /* 325 */
         .quad compat_sys_timerfd_gettime
+        .quad compat_sys_signalfd4
+        .quad sys_eventfd2
+        .quad sys_epoll_create1
+        .quad sys_dup3                  /* 330 */
+        .quad sys_pipe2
+        .quad sys_inotify_init1
 ia32_syscall_end:
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index f00afdf61e67..d3c64088b981 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -238,7 +238,7 @@ asmlinkage long sys32_pipe(int __user *fd)
         int retval;
         int fds[2];
 
-        retval = do_pipe(fds);
+        retval = do_pipe_flags(fds, 0);
         if (retval)
                 goto out;
         if (copy_to_user(fd, fds, sizeof(fds)))
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index a3ddad18aaa3..fa2161d5003b 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -150,6 +150,10 @@ static int __init acpi_sleep_setup(char *str)
                         acpi_realmode_flags |= 2;
                 if (strncmp(str, "s3_beep", 7) == 0)
                         acpi_realmode_flags |= 4;
+#ifdef CONFIG_HIBERNATION
+                if (strncmp(str, "s4_nohwsig", 10) == 0)
+                        acpi_no_s4_hw_signature();
+#endif
                 if (strncmp(str, "old_ordering", 12) == 0)
                         acpi_old_suspend_ordering();
                 str = strchr(str, ',');
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index c25210e6ac88..22d7d050905d 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -29,9 +29,6 @@
 
 #define CMD_SET_TYPE(cmd, t) ((cmd)->data[1] |= ((t) << 28))
 
-#define to_pages(addr, size) \
-         (round_up(((addr) & ~PAGE_MASK) + (size), PAGE_SIZE) >> PAGE_SHIFT)
-
 #define EXIT_LOOP_COUNT 10000000
 
 static DEFINE_RWLOCK(amd_iommu_devtable_lock);
@@ -185,7 +182,7 @@ static int iommu_flush_pages(struct amd_iommu *iommu, u16 domid,
                 u64 address, size_t size)
 {
         int s = 0;
-        unsigned pages = to_pages(address, size);
+        unsigned pages = iommu_num_pages(address, size);
 
         address &= PAGE_MASK;
 
@@ -557,8 +554,8 @@ static struct dma_ops_domain *dma_ops_domain_alloc(struct amd_iommu *iommu,
         if (iommu->exclusion_start &&
             iommu->exclusion_start < dma_dom->aperture_size) {
                 unsigned long startpage = iommu->exclusion_start >> PAGE_SHIFT;
-                int pages = to_pages(iommu->exclusion_start,
-                                iommu->exclusion_length);
+                int pages = iommu_num_pages(iommu->exclusion_start,
+                                            iommu->exclusion_length);
                 dma_ops_reserve_addresses(dma_dom, startpage, pages);
         }
 
@@ -667,7 +664,7 @@ static int get_device_resources(struct device *dev,
         _bdf = calc_devid(pcidev->bus->number, pcidev->devfn);
 
         /* device not translated by any IOMMU in the system? */
-        if (_bdf >= amd_iommu_last_bdf) {
+        if (_bdf > amd_iommu_last_bdf) {
                 *iommu = NULL;
                 *domain = NULL;
                 *bdf = 0xffff;
@@ -767,7 +764,7 @@ static dma_addr_t __map_single(struct device *dev,
         unsigned int pages;
         int i;
 
-        pages = to_pages(paddr, size);
+        pages = iommu_num_pages(paddr, size);
         paddr &= PAGE_MASK;
 
         address = dma_ops_alloc_addresses(dev, dma_dom, pages);
@@ -802,7 +799,7 @@ static void __unmap_single(struct amd_iommu *iommu,
         if ((dma_addr == 0) || (dma_addr + size > dma_dom->aperture_size))
                 return;
 
-        pages = to_pages(dma_addr, size);
+        pages = iommu_num_pages(dma_addr, size);
         dma_addr &= PAGE_MASK;
         start = dma_addr;
 
@@ -1085,7 +1082,7 @@ void prealloc_protection_domains(void)
 
         while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
                 devid = (dev->bus->number << 8) | dev->devfn;
-                if (devid >= amd_iommu_last_bdf)
+                if (devid > amd_iommu_last_bdf)
                         continue;
                 devid = amd_iommu_alias_table[devid];
                 if (domain_for_device(devid))
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index c9d8ff2eb130..d9a9da597e79 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -732,7 +732,7 @@ static int __init init_exclusion_range(struct ivmd_header *m)
                 set_device_exclusion_range(m->devid, m);
                 break;
         case ACPI_IVMD_TYPE_ALL:
-                for (i = 0; i < amd_iommu_last_bdf; ++i)
+                for (i = 0; i <= amd_iommu_last_bdf; ++i)
                         set_device_exclusion_range(i, m);
                 break;
         case ACPI_IVMD_TYPE_RANGE:
@@ -934,7 +934,7 @@ int __init amd_iommu_init(void)
         /*
          * let all alias entries point to itself
          */
-        for (i = 0; i < amd_iommu_last_bdf; ++i)
+        for (i = 0; i <= amd_iommu_last_bdf; ++i)
                 amd_iommu_alias_table[i] = i;
 
         /*
diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
index d6c898358371..039a8d4aaf62 100644
--- a/arch/x86/kernel/apic_32.c
+++ b/arch/x86/kernel/apic_32.c
@@ -1720,15 +1720,19 @@ static int __init parse_lapic_timer_c2_ok(char *arg)
 }
 early_param("lapic_timer_c2_ok", parse_lapic_timer_c2_ok);
 
-static int __init apic_set_verbosity(char *str)
+static int __init apic_set_verbosity(char *arg)
 {
-        if (strcmp("debug", str) == 0)
+        if (!arg)
+                return -EINVAL;
+
+        if (strcmp(arg, "debug") == 0)
                 apic_verbosity = APIC_DEBUG;
-        else if (strcmp("verbose", str) == 0)
+        else if (strcmp(arg, "verbose") == 0)
                 apic_verbosity = APIC_VERBOSE;
-        return 1;
+
+        return 0;
 }
-__setup("apic=", apic_set_verbosity);
+early_param("apic", apic_set_verbosity);
 
 static int __init lapic_insert_resource(void)
 {
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index bf9b441331e9..9ee24e6bc4b0 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -219,7 +219,6 @@
 #include <linux/time.h>
 #include <linux/sched.h>
 #include <linux/pm.h>
-#include <linux/pm_legacy.h>
 #include <linux/capability.h>
 #include <linux/device.h>
 #include <linux/kernel.h>
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index c9b58a806e85..c8e315f1aa83 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -50,6 +50,8 @@ static double __initdata y = 3145727.0;
  */
 static void __init check_fpu(void)
 {
+        s32 fdiv_bug;
+
         if (!boot_cpu_data.hard_math) {
 #ifndef CONFIG_MATH_EMULATION
                 printk(KERN_EMERG "No coprocessor found and no math emulation present.\n");
@@ -74,8 +76,10 @@ static void __init check_fpu(void)
                 "fistpl %0\n\t"
                 "fwait\n\t"
                 "fninit"
-                : "=m" (*&boot_cpu_data.fdiv_bug)
+                : "=m" (*&fdiv_bug)
                 : "m" (*&x), "m" (*&y));
+
+        boot_cpu_data.fdiv_bug = fdiv_bug;
         if (boot_cpu_data.fdiv_bug)
                 printk("Hmm, FPU with FDIV bug.\n");
 }
diff --git a/arch/x86/kernel/cpu/cpufreq/Kconfig b/arch/x86/kernel/cpu/cpufreq/Kconfig
index cb7a5715596d..efae3b22a0ff 100644
--- a/arch/x86/kernel/cpu/cpufreq/Kconfig
+++ b/arch/x86/kernel/cpu/cpufreq/Kconfig
@@ -235,9 +235,9 @@ config X86_LONGHAUL
           If in doubt, say N.
 
 config X86_E_POWERSAVER
-        tristate "VIA C7 Enhanced PowerSaver (EXPERIMENTAL)"
+        tristate "VIA C7 Enhanced PowerSaver"
         select CPU_FREQ_TABLE
-        depends on X86_32 && EXPERIMENTAL
+        depends on X86_32
         help
           This adds the CPUFreq driver for VIA C7 processors.
 
diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
index b0c8208df9fa..dd097b835839 100644
--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -202,7 +202,7 @@ static void drv_write(struct drv_cmd *cmd)
         cpumask_t saved_mask = current->cpus_allowed;
         unsigned int i;
 
-        for_each_cpu_mask(i, cmd->mask) {
+        for_each_cpu_mask_nr(i, cmd->mask) {
                 set_cpus_allowed_ptr(current, &cpumask_of_cpu(i));
                 do_drv_write(cmd);
         }
@@ -451,7 +451,7 @@ static int acpi_cpufreq_target(struct cpufreq_policy *policy,
 
         freqs.old = perf->states[perf->state].core_frequency * 1000;
         freqs.new = data->freq_table[next_state].frequency;
-        for_each_cpu_mask(i, cmd.mask) {
+        for_each_cpu_mask_nr(i, cmd.mask) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
         }
@@ -466,7 +466,7 @@ static int acpi_cpufreq_target(struct cpufreq_policy *policy,
                 }
         }
 
-        for_each_cpu_mask(i, cmd.mask) {
+        for_each_cpu_mask_nr(i, cmd.mask) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
         }
diff --git a/arch/x86/kernel/cpu/cpufreq/elanfreq.c b/arch/x86/kernel/cpu/cpufreq/elanfreq.c
index 94619c22f563..e4a4bf870e94 100644
--- a/arch/x86/kernel/cpu/cpufreq/elanfreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/elanfreq.c
@@ -44,7 +44,7 @@ struct s_elan_multiplier {
  * It is important that the frequencies
  * are listed in ascending order here!
  */
-struct s_elan_multiplier elan_multiplier[] = {
+static struct s_elan_multiplier elan_multiplier[] = {
         {1000,  0x02,   0x18},
         {2000,  0x02,   0x10},
         {4000,  0x02,   0x08},
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index 199e4e05e5dc..f1685fb91fbd 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -122,7 +122,7 @@ static int cpufreq_p4_target(struct cpufreq_policy *policy,
                 return 0;
 
         /* notifiers */
-        for_each_cpu_mask(i, policy->cpus) {
+        for_each_cpu_mask_nr(i, policy->cpus) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
         }
@@ -130,11 +130,11 @@ static int cpufreq_p4_target(struct cpufreq_policy *policy,
         /* run on each logical CPU, see section 13.15.3 of IA32 Intel Architecture Software
          * Developer's Manual, Volume 3
          */
-        for_each_cpu_mask(i, policy->cpus)
+        for_each_cpu_mask_nr(i, policy->cpus)
                 cpufreq_p4_setdc(i, p4clockmod_table[newstate].index);
 
         /* notifiers */
-        for_each_cpu_mask(i, policy->cpus) {
+        for_each_cpu_mask_nr(i, policy->cpus) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
         }
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 206791eb46e3..4e7271999a74 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -66,7 +66,6 @@ static u32 find_freq_from_fid(u32 fid)
         return 800 + (fid * 100);
 }
 
-
 /* Return a frequency in KHz, given an input fid */
 static u32 find_khz_freq_from_fid(u32 fid)
 {
@@ -78,7 +77,6 @@ static u32 find_khz_freq_from_pstate(struct cpufreq_frequency_table *data, u32 p
         return data[pstate].frequency;
 }
 
-
 /* Return the vco fid for an input fid
  *
  * Each "low" fid has corresponding "high" fid, and you can get to "low" fids
@@ -166,7 +164,6 @@ static void fidvid_msr_init(void)
         wrmsr(MSR_FIDVID_CTL, lo, hi);
 }
 
-
 /* write the new fid value along with the other control fields to the msr */
 static int write_new_fid(struct powernow_k8_data *data, u32 fid)
 {
@@ -740,44 +737,63 @@ static int find_psb_table(struct powernow_k8_data *data)
 #ifdef CONFIG_X86_POWERNOW_K8_ACPI
 static void powernow_k8_acpi_pst_values(struct powernow_k8_data *data, unsigned int index)
 {
-        if (!data->acpi_data.state_count || (cpu_family == CPU_HW_PSTATE))
+        if (!data->acpi_data->state_count || (cpu_family == CPU_HW_PSTATE))
                 return;
 
-        data->irt = (data->acpi_data.states[index].control >> IRT_SHIFT) & IRT_MASK;
-        data->rvo = (data->acpi_data.states[index].control >> RVO_SHIFT) & RVO_MASK;
-        data->exttype = (data->acpi_data.states[index].control >> EXT_TYPE_SHIFT) & EXT_TYPE_MASK;
-        data->plllock = (data->acpi_data.states[index].control >> PLL_L_SHIFT) & PLL_L_MASK;
-        data->vidmvs = 1 << ((data->acpi_data.states[index].control >> MVS_SHIFT) & MVS_MASK);
-        data->vstable = (data->acpi_data.states[index].control >> VST_SHIFT) & VST_MASK;
+        data->irt = (data->acpi_data->states[index].control >> IRT_SHIFT) & IRT_MASK;
+        data->rvo = (data->acpi_data->states[index].control >> RVO_SHIFT) & RVO_MASK;
+        data->exttype = (data->acpi_data->states[index].control >> EXT_TYPE_SHIFT) & EXT_TYPE_MASK;
+        data->plllock = (data->acpi_data->states[index].control >> PLL_L_SHIFT) & PLL_L_MASK;
+        data->vidmvs = 1 << ((data->acpi_data->states[index].control >> MVS_SHIFT) & MVS_MASK);
+        data->vstable = (data->acpi_data->states[index].control >> VST_SHIFT) & VST_MASK;
+}
+
+
+static struct acpi_processor_performance *acpi_perf_data;
+static int preregister_valid;
+
+static int powernow_k8_cpu_preinit_acpi(void)
+{
+        acpi_perf_data = alloc_percpu(struct acpi_processor_performance);
+        if (!acpi_perf_data)
+                return -ENODEV;
+
+        if (acpi_processor_preregister_performance(acpi_perf_data))
+                return -ENODEV;
+        else
+                preregister_valid = 1;
+        return 0;
 }
 
 static int powernow_k8_cpu_init_acpi(struct powernow_k8_data *data)
 {
         struct cpufreq_frequency_table *powernow_table;
         int ret_val;
+        int cpu = 0;
 
-        if (acpi_processor_register_performance(&data->acpi_data, data->cpu)) {
+        data->acpi_data = percpu_ptr(acpi_perf_data, cpu);
+        if (acpi_processor_register_performance(data->acpi_data, data->cpu)) {
                 dprintk("register performance failed: bad ACPI data\n");
                 return -EIO;
         }
 
         /* verify the data contained in the ACPI structures */
-        if (data->acpi_data.state_count <= 1) {
+        if (data->acpi_data->state_count <= 1) {
                 dprintk("No ACPI P-States\n");
                 goto err_out;
         }
 
-        if ((data->acpi_data.control_register.space_id != ACPI_ADR_SPACE_FIXED_HARDWARE) ||
-                (data->acpi_data.status_register.space_id != ACPI_ADR_SPACE_FIXED_HARDWARE)) {
+        if ((data->acpi_data->control_register.space_id != ACPI_ADR_SPACE_FIXED_HARDWARE) ||
+                (data->acpi_data->status_register.space_id != ACPI_ADR_SPACE_FIXED_HARDWARE)) {
                 dprintk("Invalid control/status registers (%x - %x)\n",
-                        data->acpi_data.control_register.space_id,
-                        data->acpi_data.status_register.space_id);
+                        data->acpi_data->control_register.space_id,
+                        data->acpi_data->status_register.space_id);
                 goto err_out;
         }
 
         /* fill in data->powernow_table */
         powernow_table = kmalloc((sizeof(struct cpufreq_frequency_table)
-                * (data->acpi_data.state_count + 1)), GFP_KERNEL);
+                * (data->acpi_data->state_count + 1)), GFP_KERNEL);
         if (!powernow_table) {
                 dprintk("powernow_table memory alloc failure\n");
                 goto err_out;
@@ -790,12 +806,12 @@ static int powernow_k8_cpu_init_acpi(struct powernow_k8_data *data)
         if (ret_val)
                 goto err_out_mem;
 
-        powernow_table[data->acpi_data.state_count].frequency = CPUFREQ_TABLE_END;
-        powernow_table[data->acpi_data.state_count].index = 0;
+        powernow_table[data->acpi_data->state_count].frequency = CPUFREQ_TABLE_END;
+        powernow_table[data->acpi_data->state_count].index = 0;
         data->powernow_table = powernow_table;
 
         /* fill in data */
-        data->numps = data->acpi_data.state_count;
+        data->numps = data->acpi_data->state_count;
         if (first_cpu(per_cpu(cpu_core_map, data->cpu)) == data->cpu)
                 print_basics(data);
         powernow_k8_acpi_pst_values(data, 0);
@@ -803,16 +819,31 @@ static int powernow_k8_cpu_init_acpi(struct powernow_k8_data *data)
         /* notify BIOS that we exist */
         acpi_processor_notify_smm(THIS_MODULE);
 
+        /* determine affinity, from ACPI if available */
+        if (preregister_valid) {
+                if ((data->acpi_data->shared_type == CPUFREQ_SHARED_TYPE_ALL) ||
+                        (data->acpi_data->shared_type == CPUFREQ_SHARED_TYPE_ANY))
+                        data->starting_core_affinity = data->acpi_data->shared_cpu_map;
+                else
+                        data->starting_core_affinity = cpumask_of_cpu(data->cpu);
+        } else {
+        /* best guess from family if not */
+                if (cpu_family == CPU_HW_PSTATE)
+                        data->starting_core_affinity = cpumask_of_cpu(data->cpu);
+                else
+                        data->starting_core_affinity = per_cpu(cpu_core_map, data->cpu);
+        }
+
         return 0;
 
 err_out_mem:
         kfree(powernow_table);
 
 err_out:
-        acpi_processor_unregister_performance(&data->acpi_data, data->cpu);
+        acpi_processor_unregister_performance(data->acpi_data, data->cpu);
 
         /* data->acpi_data.state_count informs us at ->exit() whether ACPI was used */
-        data->acpi_data.state_count = 0;
+        data->acpi_data->state_count = 0;
 
         return -ENODEV;
 }
@@ -824,10 +855,10 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data, struct cpuf
         rdmsr(MSR_PSTATE_CUR_LIMIT, hi, lo);
         data->max_hw_pstate = (hi & HW_PSTATE_MAX_MASK) >> HW_PSTATE_MAX_SHIFT;
 
-        for (i = 0; i < data->acpi_data.state_count; i++) {
+        for (i = 0; i < data->acpi_data->state_count; i++) {
                 u32 index;
 
-                index = data->acpi_data.states[i].control & HW_PSTATE_MASK;
+                index = data->acpi_data->states[i].control & HW_PSTATE_MASK;
                 if (index > data->max_hw_pstate) {
                         printk(KERN_ERR PFX "invalid pstate %d - bad value %d.\n", i, index);
                         printk(KERN_ERR PFX "Please report to BIOS manufacturer\n");
@@ -843,7 +874,7 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data, struct cpuf
 
                 powernow_table[i].index = index;
 
-                powernow_table[i].frequency = data->acpi_data.states[i].core_frequency * 1000;
+                powernow_table[i].frequency = data->acpi_data->states[i].core_frequency * 1000;
         }
         return 0;
 }
@@ -852,16 +883,16 @@ static int fill_powernow_table_fidvid(struct powernow_k8_data *data, struct cpuf
 {
         int i;
         int cntlofreq = 0;
-        for (i = 0; i < data->acpi_data.state_count; i++) {
+        for (i = 0; i < data->acpi_data->state_count; i++) {
                 u32 fid;
                 u32 vid;
 
                 if (data->exttype) {
-                        fid = data->acpi_data.states[i].status & EXT_FID_MASK;
-                        vid = (data->acpi_data.states[i].status >> VID_SHIFT) & EXT_VID_MASK;
+                        fid = data->acpi_data->states[i].status & EXT_FID_MASK;
+                        vid = (data->acpi_data->states[i].status >> VID_SHIFT) & EXT_VID_MASK;
                 } else {
-                        fid = data->acpi_data.states[i].control & FID_MASK;
-                        vid = (data->acpi_data.states[i].control >> VID_SHIFT) & VID_MASK;
+                        fid = data->acpi_data->states[i].control & FID_MASK;
+                        vid = (data->acpi_data->states[i].control >> VID_SHIFT) & VID_MASK;
                 }
 
                 dprintk("   %d : fid 0x%x, vid 0x%x\n", i, fid, vid);
@@ -902,10 +933,10 @@ static int fill_powernow_table_fidvid(struct powernow_k8_data *data, struct cpuf
                                 cntlofreq = i;
                 }
 
-                if (powernow_table[i].frequency != (data->acpi_data.states[i].core_frequency * 1000)) {
+                if (powernow_table[i].frequency != (data->acpi_data->states[i].core_frequency * 1000)) {
                         printk(KERN_INFO PFX "invalid freq entries %u kHz vs. %u kHz\n",
                                 powernow_table[i].frequency,
-                                (unsigned int) (data->acpi_data.states[i].core_frequency * 1000));
+                                (unsigned int) (data->acpi_data->states[i].core_frequency * 1000));
                         powernow_table[i].frequency = CPUFREQ_ENTRY_INVALID;
                         continue;
                 }
@@ -915,11 +946,12 @@ static int fill_powernow_table_fidvid(struct powernow_k8_data *data, struct cpuf
 
 static void powernow_k8_cpu_exit_acpi(struct powernow_k8_data *data)
 {
-        if (data->acpi_data.state_count)
-                acpi_processor_unregister_performance(&data->acpi_data, data->cpu);
+        if (data->acpi_data->state_count)
+                acpi_processor_unregister_performance(data->acpi_data, data->cpu);
 }
 
 #else
+static int powernow_k8_cpu_preinit_acpi(void) { return -ENODEV; }
 static int powernow_k8_cpu_init_acpi(struct powernow_k8_data *data) { return -ENODEV; }
 static void powernow_k8_cpu_exit_acpi(struct powernow_k8_data *data) { return; }
 static void powernow_k8_acpi_pst_values(struct powernow_k8_data *data, unsigned int index) { return; }
@@ -966,7 +998,7 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data, unsigned i
         freqs.old = find_khz_freq_from_fid(data->currfid);
         freqs.new = find_khz_freq_from_fid(fid);
 
-        for_each_cpu_mask(i, *(data->available_cores)) {
+        for_each_cpu_mask_nr(i, *(data->available_cores)) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
         }
@@ -974,7 +1006,7 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data, unsigned i
         res = transition_fid_vid(data, fid, vid);
         freqs.new = find_khz_freq_from_fid(data->currfid);
 
-        for_each_cpu_mask(i, *(data->available_cores)) {
+        for_each_cpu_mask_nr(i, *(data->available_cores)) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
         }
@@ -997,7 +1029,7 @@ static int transition_frequency_pstate(struct powernow_k8_data *data, unsigned i
         freqs.old = find_khz_freq_from_pstate(data->powernow_table, data->currpstate);
         freqs.new = find_khz_freq_from_pstate(data->powernow_table, pstate);
 
-        for_each_cpu_mask(i, *(data->available_cores)) {
+        for_each_cpu_mask_nr(i, *(data->available_cores)) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
         }
@@ -1005,7 +1037,7 @@ static int transition_frequency_pstate(struct powernow_k8_data *data, unsigned i
         res = transition_pstate(data, pstate);
         freqs.new = find_khz_freq_from_pstate(data->powernow_table, pstate);
 
-        for_each_cpu_mask(i, *(data->available_cores)) {
+        for_each_cpu_mask_nr(i, *(data->available_cores)) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
         }
@@ -1104,7 +1136,7 @@ static int powernowk8_verify(struct cpufreq_policy *pol)
 static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data;
-        cpumask_t oldmask;
+        cpumask_t oldmask = CPU_MASK_ALL;
         int rc;
 
         if (!cpu_online(pol->cpu))
@@ -1177,10 +1209,7 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
         /* run on any CPU again */
         set_cpus_allowed_ptr(current, &oldmask);
 
-        if (cpu_family == CPU_HW_PSTATE)
-                pol->cpus = cpumask_of_cpu(pol->cpu);
-        else
-                pol->cpus = per_cpu(cpu_core_map, pol->cpu);
+        pol->cpus = data->starting_core_affinity;
         data->available_cores = &(pol->cpus);
 
         /* Take a crude guess here.
@@ -1303,6 +1332,7 @@ static int __cpuinit powernowk8_init(void)
         }
 
         if (supported_cpus == num_online_cpus()) {
+                powernow_k8_cpu_preinit_acpi();
                 printk(KERN_INFO PFX "Found %d %s "
                         "processors (%d cpu cores) (" VERSION ")\n",
                         num_online_nodes(),
@@ -1319,6 +1349,10 @@ static void __exit powernowk8_exit(void)
         dprintk("exit\n");
 
         cpufreq_unregister_driver(&cpufreq_amd64_driver);
+
+#ifdef CONFIG_X86_POWERNOW_K8_ACPI
+        free_percpu(acpi_perf_data);
+#endif
 }
 
 MODULE_AUTHOR("Paul Devriendt <paul.devriendt@amd.com> and Mark Langsdorf <mark.langsdorf@amd.com>");
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.h b/arch/x86/kernel/cpu/cpufreq/powernow-k8.h
index ab48cfed4d96..a62612cd4be8 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.h
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.h
@@ -33,12 +33,13 @@ struct powernow_k8_data {
 #ifdef CONFIG_X86_POWERNOW_K8_ACPI
         /* the acpi table needs to be kept. it's only available if ACPI was
          * used to determine valid frequency/vid/fid states */
-        struct acpi_processor_performance acpi_data;
+        struct acpi_processor_performance *acpi_data;
 #endif
         /* we need to keep track of associated cores, but let cpufreq
          * handle hotplug events - so just point at cpufreq pol->cpus
          * structure */
         cpumask_t *available_cores;
+        cpumask_t starting_core_affinity;
 };
 
 
diff --git a/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c b/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
index 908dd347c67e..15e13c01cc36 100644
--- a/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
+++ b/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
@@ -28,7 +28,8 @@
 #define PFX             "speedstep-centrino: "
 #define MAINTAINER      "cpufreq@lists.linux.org.uk"
 
-#define dprintk(msg...) cpufreq_debug_printk(CPUFREQ_DEBUG_DRIVER, "speedstep-centrino", msg)
+#define dprintk(msg...) \
+        cpufreq_debug_printk(CPUFREQ_DEBUG_DRIVER, "speedstep-centrino", msg)
 
 #define INTEL_MSR_RANGE (0xffff)
 
@@ -66,11 +67,12 @@ struct cpu_model
 
         struct cpufreq_frequency_table *op_points; /* clock/voltage pairs */
 };
-static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c, const struct cpu_id *x);
+static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c,
+                                  const struct cpu_id *x);
 
 /* Operating points for current CPU */
-static struct cpu_model *centrino_model[NR_CPUS];
-static const struct cpu_id *centrino_cpu[NR_CPUS];
+static DEFINE_PER_CPU(struct cpu_model *, centrino_model);
+static DEFINE_PER_CPU(const struct cpu_id *, centrino_cpu);
 
 static struct cpufreq_driver centrino_driver;
 
@@ -255,7 +257,7 @@ static int centrino_cpu_init_table(struct cpufreq_policy *policy)
                 return -ENOENT;
         }
 
-        centrino_model[policy->cpu] = model;
+        per_cpu(centrino_model, policy->cpu) = model;
 
         dprintk("found \"%s\": max frequency: %dkHz\n",
                model->model_name, model->max_freq);
@@ -264,10 +266,14 @@ static int centrino_cpu_init_table(struct cpufreq_policy *policy)
 }
 
 #else
-static inline int centrino_cpu_init_table(struct cpufreq_policy *policy) { return -ENODEV; }
+static inline int centrino_cpu_init_table(struct cpufreq_policy *policy)
+{
+        return -ENODEV;
+}
 #endif /* CONFIG_X86_SPEEDSTEP_CENTRINO_TABLE */
 
-static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c, const struct cpu_id *x)
+static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c,
+                                  const struct cpu_id *x)
 {
         if ((c->x86 == x->x86) &&
             (c->x86_model == x->x86_model) &&
@@ -286,23 +292,28 @@ static unsigned extract_clock(unsigned msr, unsigned int cpu, int failsafe)
          * for centrino, as some DSDTs are buggy.
          * Ideally, this can be done using the acpi_data structure.
          */
-        if ((centrino_cpu[cpu] == &cpu_ids[CPU_BANIAS]) ||
-            (centrino_cpu[cpu] == &cpu_ids[CPU_DOTHAN_A1]) ||
-            (centrino_cpu[cpu] == &cpu_ids[CPU_DOTHAN_B0])) {
+        if ((per_cpu(centrino_cpu, cpu) == &cpu_ids[CPU_BANIAS]) ||
+            (per_cpu(centrino_cpu, cpu) == &cpu_ids[CPU_DOTHAN_A1]) ||
+            (per_cpu(centrino_cpu, cpu) == &cpu_ids[CPU_DOTHAN_B0])) {
                 msr = (msr >> 8) & 0xff;
                 return msr * 100000;
         }
 
-        if ((!centrino_model[cpu]) || (!centrino_model[cpu]->op_points))
+        if ((!per_cpu(centrino_model, cpu)) ||
+            (!per_cpu(centrino_model, cpu)->op_points))
                 return 0;
 
         msr &= 0xffff;
-        for (i=0;centrino_model[cpu]->op_points[i].frequency != CPUFREQ_TABLE_END; i++) {
-                if (msr == centrino_model[cpu]->op_points[i].index)
-                        return centrino_model[cpu]->op_points[i].frequency;
+        for (i = 0;
+                per_cpu(centrino_model, cpu)->op_points[i].frequency
+                                                        != CPUFREQ_TABLE_END;
+             i++) {
+                if (msr == per_cpu(centrino_model, cpu)->op_points[i].index)
+                        return per_cpu(centrino_model, cpu)->
+                                                        op_points[i].frequency;
         }
         if (failsafe)
-                return centrino_model[cpu]->op_points[i-1].frequency;
+                return per_cpu(centrino_model, cpu)->op_points[i-1].frequency;
         else
                 return 0;
 }
@@ -347,7 +358,8 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
         int i;
 
         /* Only Intel makes Enhanced Speedstep-capable CPUs */
-        if (cpu->x86_vendor != X86_VENDOR_INTEL || !cpu_has(cpu, X86_FEATURE_EST))
+        if (cpu->x86_vendor != X86_VENDOR_INTEL ||
+            !cpu_has(cpu, X86_FEATURE_EST))
                 return -ENODEV;
 
         if (cpu_has(cpu, X86_FEATURE_CONSTANT_TSC))
@@ -361,9 +373,9 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
                         break;
 
         if (i != N_IDS)
-                centrino_cpu[policy->cpu] = &cpu_ids[i];
+                per_cpu(centrino_cpu, policy->cpu) = &cpu_ids[i];
 
-        if (!centrino_cpu[policy->cpu]) {
+        if (!per_cpu(centrino_cpu, policy->cpu)) {
                 dprintk("found unsupported CPU with "
                 "Enhanced SpeedStep: send /proc/cpuinfo to "
                 MAINTAINER "\n");
@@ -386,23 +398,26 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
                 /* check to see if it stuck */
                 rdmsr(MSR_IA32_MISC_ENABLE, l, h);
                 if (!(l & (1<<16))) {
-                        printk(KERN_INFO PFX "couldn't enable Enhanced SpeedStep\n");
+                        printk(KERN_INFO PFX
+                                "couldn't enable Enhanced SpeedStep\n");
                         return -ENODEV;
                 }
         }
 
         freq = get_cur_freq(policy->cpu);
-
-        policy->cpuinfo.transition_latency = 10000; /* 10uS transition latency */
+        policy->cpuinfo.transition_latency = 10000;
+                                                /* 10uS transition latency */
         policy->cur = freq;
 
         dprintk("centrino_cpu_init: cur=%dkHz\n", policy->cur);
 
-        ret = cpufreq_frequency_table_cpuinfo(policy, centrino_model[policy->cpu]->op_points);
+        ret = cpufreq_frequency_table_cpuinfo(policy,
+                per_cpu(centrino_model, policy->cpu)->op_points);
         if (ret)
                 return (ret);
 
-        cpufreq_frequency_table_get_attr(centrino_model[policy->cpu]->op_points, policy->cpu);
+        cpufreq_frequency_table_get_attr(
+                per_cpu(centrino_model, policy->cpu)->op_points, policy->cpu);
 
         return 0;
 }
@@ -411,12 +426,12 @@ static int centrino_cpu_exit(struct cpufreq_policy *policy)
 {
         unsigned int cpu = policy->cpu;
 
-        if (!centrino_model[cpu])
+        if (!per_cpu(centrino_model, cpu))
                 return -ENODEV;
 
         cpufreq_frequency_table_put_attr(cpu);
 
-        centrino_model[cpu] = NULL;
+        per_cpu(centrino_model, cpu) = NULL;
 
         return 0;
 }
@@ -430,17 +445,26 @@ static int centrino_cpu_exit(struct cpufreq_policy *policy)
  */
 static int centrino_verify (struct cpufreq_policy *policy)
 {
-        return cpufreq_frequency_table_verify(policy, centrino_model[policy->cpu]->op_points);
+        return cpufreq_frequency_table_verify(policy,
+                        per_cpu(centrino_model, policy->cpu)->op_points);
 }
 
 /**
  * centrino_setpolicy - set a new CPUFreq policy
  * @policy: new policy
  * @target_freq: the target frequency
- * @relation: how that frequency relates to achieved frequency (CPUFREQ_RELATION_L or CPUFREQ_RELATION_H)
+ * @relation: how that frequency relates to achieved frequency
+ *      (CPUFREQ_RELATION_L or CPUFREQ_RELATION_H)
  *
  * Sets a new CPUFreq policy.
  */
+struct allmasks {
+        cpumask_t               online_policy_cpus;
+        cpumask_t               saved_mask;
+        cpumask_t               set_mask;
+        cpumask_t               covered_cpus;
+};
+
 static int centrino_target (struct cpufreq_policy *policy,
                             unsigned int target_freq,
                             unsigned int relation)
@@ -448,48 +472,55 @@ static int centrino_target (struct cpufreq_policy *policy,
         unsigned int    newstate = 0;
         unsigned int    msr, oldmsr = 0, h = 0, cpu = policy->cpu;
         struct cpufreq_freqs    freqs;
-        cpumask_t               online_policy_cpus;
-        cpumask_t               saved_mask;
-        cpumask_t               set_mask;
-        cpumask_t               covered_cpus;
         int                     retval = 0;
         unsigned int            j, k, first_cpu, tmp;
-
-        if (unlikely(centrino_model[cpu] == NULL))
-                return -ENODEV;
+        CPUMASK_ALLOC(allmasks);
+        CPUMASK_PTR(online_policy_cpus, allmasks);
+        CPUMASK_PTR(saved_mask, allmasks);
+        CPUMASK_PTR(set_mask, allmasks);
+        CPUMASK_PTR(covered_cpus, allmasks);
+
+        if (unlikely(allmasks == NULL))
+                return -ENOMEM;
+
+        if (unlikely(per_cpu(centrino_model, cpu) == NULL)) {
+                retval = -ENODEV;
+                goto out;
+        }
 
         if (unlikely(cpufreq_frequency_table_target(policy,
-                        centrino_model[cpu]->op_points,
+                        per_cpu(centrino_model, cpu)->op_points,
                         target_freq,
                         relation,
                         &newstate))) {
-                return -EINVAL;
+                retval = -EINVAL;
+                goto out;
         }
 
 #ifdef CONFIG_HOTPLUG_CPU
         /* cpufreq holds the hotplug lock, so we are safe from here on */
-        cpus_and(online_policy_cpus, cpu_online_map, policy->cpus);
+        cpus_and(*online_policy_cpus, cpu_online_map, policy->cpus);
 #else
-        online_policy_cpus = policy->cpus;
+        *online_policy_cpus = policy->cpus;
 #endif
 
-        saved_mask = current->cpus_allowed;
+        *saved_mask = current->cpus_allowed;
         first_cpu = 1;
-        cpus_clear(covered_cpus);
-        for_each_cpu_mask(j, online_policy_cpus) {
+        cpus_clear(*covered_cpus);
+        for_each_cpu_mask_nr(j, *online_policy_cpus) {
                 /*
                  * Support for SMP systems.
                  * Make sure we are running on CPU that wants to change freq
                  */
-                cpus_clear(set_mask);
+                cpus_clear(*set_mask);
                 if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY)
-                        cpus_or(set_mask, set_mask, online_policy_cpus);
+                        cpus_or(*set_mask, *set_mask, *online_policy_cpus);
                 else
-                        cpu_set(j, set_mask);
+                        cpu_set(j, *set_mask);
 
-                set_cpus_allowed_ptr(current, &set_mask);
+                set_cpus_allowed_ptr(current, set_mask);
                 preempt_disable();
-                if (unlikely(!cpu_isset(smp_processor_id(), set_mask))) {
+                if (unlikely(!cpu_isset(smp_processor_id(), *set_mask))) {
                         dprintk("couldn't limit to CPUs in this domain\n");
                         retval = -EAGAIN;
                         if (first_cpu) {
@@ -500,7 +531,7 @@ static int centrino_target (struct cpufreq_policy *policy,
                         break;
                 }
 
-                msr = centrino_model[cpu]->op_points[newstate].index;
+                msr = per_cpu(centrino_model, cpu)->op_points[newstate].index;
 
                 if (first_cpu) {
                         rdmsr(MSR_IA32_PERF_CTL, oldmsr, h);
@@ -517,7 +548,7 @@ static int centrino_target (struct cpufreq_policy *policy,
                         dprintk("target=%dkHz old=%d new=%d msr=%04x\n",
                                 target_freq, freqs.old, freqs.new, msr);
 
-                        for_each_cpu_mask(k, online_policy_cpus) {
+                        for_each_cpu_mask_nr(k, *online_policy_cpus) {
                                 freqs.cpu = k;
                                 cpufreq_notify_transition(&freqs,
                                         CPUFREQ_PRECHANGE);
@@ -536,11 +567,11 @@ static int centrino_target (struct cpufreq_policy *policy,
                         break;
                 }
 
-                cpu_set(j, covered_cpus);
+                cpu_set(j, *covered_cpus);
                 preempt_enable();
         }
 
-        for_each_cpu_mask(k, online_policy_cpus) {
+        for_each_cpu_mask_nr(k, *online_policy_cpus) {
                 freqs.cpu = k;
                 cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
         }
@@ -553,30 +584,32 @@ static int centrino_target (struct cpufreq_policy *policy,
                  * Best effort undo..
                  */
 
-                if (!cpus_empty(covered_cpus)) {
-                        for_each_cpu_mask(j, covered_cpus) {
+                if (!cpus_empty(*covered_cpus))
+                        for_each_cpu_mask_nr(j, *covered_cpus) {
                                 set_cpus_allowed_ptr(current,
                                                      &cpumask_of_cpu(j));
                                 wrmsr(MSR_IA32_PERF_CTL, oldmsr, h);
                         }
-                }
 
                 tmp = freqs.new;
                 freqs.new = freqs.old;
                 freqs.old = tmp;
-                for_each_cpu_mask(j, online_policy_cpus) {
+                for_each_cpu_mask_nr(j, *online_policy_cpus) {
                         freqs.cpu = j;
                         cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
                         cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
                 }
         }
-        set_cpus_allowed_ptr(current, &saved_mask);
-        return 0;
+        set_cpus_allowed_ptr(current, saved_mask);
+        retval = 0;
+        goto out;
 
 migrate_end:
         preempt_enable();
-        set_cpus_allowed_ptr(current, &saved_mask);
-        return 0;
+        set_cpus_allowed_ptr(current, saved_mask);
+out:
+        CPUMASK_FREE(allmasks);
+        return retval;
 }
 
 static struct freq_attr* centrino_attr[] = {
diff --git a/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c b/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
index 1b50244b1fdf..191f7263c61d 100644
--- a/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
+++ b/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
@@ -279,7 +279,7 @@ static int speedstep_target (struct cpufreq_policy *policy,
 
         cpus_allowed = current->cpus_allowed;
 
-        for_each_cpu_mask(i, policy->cpus) {
+        for_each_cpu_mask_nr(i, policy->cpus) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
         }
@@ -292,7 +292,7 @@ static int speedstep_target (struct cpufreq_policy *policy,
         /* allow to be run on all CPUs */
         set_cpus_allowed_ptr(current, &cpus_allowed);
 
-        for_each_cpu_mask(i, policy->cpus) {
+        for_each_cpu_mask_nr(i, policy->cpus) {
                 freqs.cpu = i;
                 cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
         }
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index ff517f0b8cc4..6b0a10b002f1 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -489,7 +489,7 @@ static void __cpuinit cache_remove_shared_cpu_map(unsigned int cpu, int index)
         int sibling;
 
         this_leaf = CPUID4_INFO_IDX(cpu, index);
-        for_each_cpu_mask(sibling, this_leaf->shared_cpu_map) {
+        for_each_cpu_mask_nr(sibling, this_leaf->shared_cpu_map) {
                 sibling_leaf = CPUID4_INFO_IDX(sibling, index); 
                 cpu_clear(cpu, sibling_leaf->shared_cpu_map);
         }
diff --git a/arch/x86/kernel/cpu/mcheck/mce_64.c b/arch/x86/kernel/cpu/mcheck/mce_64.c
index 9ab65be82427..65a339678ece 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_64.c
@@ -580,7 +580,7 @@ static ssize_t mce_read(struct file *filp, char __user *ubuf, size_t usize,
         char __user *buf = ubuf;
         int i, err;
 
-        cpu_tsc = kmalloc(NR_CPUS * sizeof(long), GFP_KERNEL);
+        cpu_tsc = kmalloc(nr_cpu_ids * sizeof(long), GFP_KERNEL);
         if (!cpu_tsc)
                 return -ENOMEM;
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd_64.c b/arch/x86/kernel/cpu/mcheck/mce_amd_64.c
index 7c9a813e1193..88736cadbaa6 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd_64.c
@@ -527,7 +527,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
         if (err)
                 goto out_free;
 
-        for_each_cpu_mask(i, b->cpus) {
+        for_each_cpu_mask_nr(i, b->cpus) {
                 if (i == cpu)
                         continue;
 
@@ -617,7 +617,7 @@ static void threshold_remove_bank(unsigned int cpu, int bank)
 #endif
 
         /* remove all sibling symlinks before unregistering */
-        for_each_cpu_mask(i, b->cpus) {
+        for_each_cpu_mask_nr(i, b->cpus) {
                 if (i == cpu)
                         continue;
 
diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
index 0d0d9057e7c0..a26c480b9491 100644
--- a/arch/x86/kernel/cpu/proc.c
+++ b/arch/x86/kernel/cpu/proc.c
@@ -160,7 +160,7 @@ static void *c_start(struct seq_file *m, loff_t *pos)
 {
         if (*pos == 0)  /* just in case, cpu 0 is not the first */
                 *pos = first_cpu(cpu_online_map);
-        if ((*pos) < NR_CPUS && cpu_online(*pos))
+        if ((*pos) < nr_cpu_ids && cpu_online(*pos))
                 return &cpu_data(*pos);
         return NULL;
 }
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index cdfd94cc6b14..109792bc7cfa 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -54,6 +54,16 @@
 #include <asm/ftrace.h>
 #include <asm/irq_vectors.h>
 
+/* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+#include <linux/elf-em.h>
+#define AUDIT_ARCH_I386         (EM_386|__AUDIT_ARCH_LE)
+#define __AUDIT_ARCH_LE    0x40000000
+
+#ifndef CONFIG_AUDITSYSCALL
+#define sysenter_audit  syscall_trace_entry
+#define sysexit_audit   syscall_exit_work
+#endif
+
 /*
  * We use macros for low-level operations which need to be overridden
  * for paravirtualization.  The following will never clobber any registers:
@@ -333,7 +343,8 @@ sysenter_past_esp:
 
         /* Note, _TIF_SECCOMP is bit number 8, and so it needs testw and not testb */
         testw $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
-        jnz syscall_trace_entry
+        jnz sysenter_audit
+sysenter_do_call:
         cmpl $(nr_syscalls), %eax
         jae syscall_badsys
         call *sys_call_table(,%eax,4)
@@ -343,7 +354,8 @@ sysenter_past_esp:
         TRACE_IRQS_OFF
         movl TI_flags(%ebp), %ecx
         testw $_TIF_ALLWORK_MASK, %cx
-        jne syscall_exit_work
+        jne sysexit_audit
+sysenter_exit:
 /* if something modifies registers it must also disable sysexit */
         movl PT_EIP(%esp), %edx
         movl PT_OLDESP(%esp), %ecx
@@ -351,6 +363,45 @@ sysenter_past_esp:
         TRACE_IRQS_ON
 1:      mov  PT_FS(%esp), %fs
         ENABLE_INTERRUPTS_SYSEXIT
+
+#ifdef CONFIG_AUDITSYSCALL
+sysenter_audit:
+        testw $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%ebp)
+        jnz syscall_trace_entry
+        addl $4,%esp
+        CFI_ADJUST_CFA_OFFSET -4
+        /* %esi already in 8(%esp)         6th arg: 4th syscall arg */
+        /* %edx already in 4(%esp)         5th arg: 3rd syscall arg */
+        /* %ecx already in 0(%esp)         4th arg: 2nd syscall arg */
+        movl %ebx,%ecx                  /* 3rd arg: 1st syscall arg */
+        movl %eax,%edx                  /* 2nd arg: syscall number */
+        movl $AUDIT_ARCH_I386,%eax      /* 1st arg: audit arch */
+        call audit_syscall_entry
+        pushl %ebx
+        CFI_ADJUST_CFA_OFFSET 4
+        movl PT_EAX(%esp),%eax          /* reload syscall number */
+        jmp sysenter_do_call
+
+sysexit_audit:
+        testw $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT), %cx
+        jne syscall_exit_work
+        TRACE_IRQS_ON
+        ENABLE_INTERRUPTS(CLBR_ANY)
+        movl %eax,%edx          /* second arg, syscall return value */
+        cmpl $0,%eax            /* is it < 0? */
+        setl %al                /* 1 if so, 0 if not */
+        movzbl %al,%eax         /* zero-extend that */
+        inc %eax /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
+        call audit_syscall_exit
+        DISABLE_INTERRUPTS(CLBR_ANY)
+        TRACE_IRQS_OFF
+        movl TI_flags(%ebp), %ecx
+        testw $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT), %cx
+        jne syscall_exit_work
+        movl PT_EAX(%esp),%eax  /* reload syscall return value */
+        jmp sysenter_exit
+#endif
+
         CFI_ENDPROC
 .pushsection .fixup,"ax"
 2:      movl $0,PT_FS(%esp)
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 8410e26f4183..89434d439605 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -53,6 +53,12 @@
 #include <asm/paravirt.h>
 #include <asm/ftrace.h>
 
+/* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+#include <linux/elf-em.h>
+#define AUDIT_ARCH_X86_64       (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define __AUDIT_ARCH_64BIT 0x80000000
+#define __AUDIT_ARCH_LE    0x40000000
+
         .code64
 
 #ifdef CONFIG_FTRACE
@@ -351,6 +357,7 @@ ENTRY(system_call_after_swapgs)
         GET_THREAD_INFO(%rcx)
         testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%rcx)
         jnz tracesys
+system_call_fastpath:
         cmpq $__NR_syscall_max,%rax
         ja badsys
         movq %r10,%rcx
@@ -402,16 +409,16 @@ sysret_careful:
 sysret_signal:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS(CLBR_NONE)
-        testl $_TIF_DO_NOTIFY_MASK,%edx
-        jz    1f
-
-        /* Really a signal */
+#ifdef CONFIG_AUDITSYSCALL
+        bt $TIF_SYSCALL_AUDIT,%edx
+        jc sysret_audit
+#endif
         /* edx: work flags (arg3) */
         leaq do_notify_resume(%rip),%rax
         leaq -ARGOFFSET(%rsp),%rdi # &pt_regs -> arg1
         xorl %esi,%esi # oldset -> arg2
         call ptregscall_common
-1:      movl $_TIF_WORK_MASK,%edi
+        movl $_TIF_WORK_MASK,%edi
         /* Use IRET because user could have changed frame. This
            works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
         DISABLE_INTERRUPTS(CLBR_NONE)
@@ -422,8 +429,45 @@ badsys:
         movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
         jmp ret_from_sys_call
 
+#ifdef CONFIG_AUDITSYSCALL
+        /*
+         * Fast path for syscall audit without full syscall trace.
+         * We just call audit_syscall_entry() directly, and then
+         * jump back to the normal fast path.
+         */
+auditsys:
+        movq %r10,%r9                   /* 6th arg: 4th syscall arg */
+        movq %rdx,%r8                   /* 5th arg: 3rd syscall arg */
+        movq %rsi,%rcx                  /* 4th arg: 2nd syscall arg */
+        movq %rdi,%rdx                  /* 3rd arg: 1st syscall arg */
+        movq %rax,%rsi                  /* 2nd arg: syscall number */
+        movl $AUDIT_ARCH_X86_64,%edi    /* 1st arg: audit arch */
+        call audit_syscall_entry
+        LOAD_ARGS 0             /* reload call-clobbered registers */
+        jmp system_call_fastpath
+
+        /*
+         * Return fast path for syscall audit.  Call audit_syscall_exit()
+         * directly and then jump back to the fast path with TIF_SYSCALL_AUDIT
+         * masked off.
+         */
+sysret_audit:
+        movq %rax,%rsi          /* second arg, syscall return value */
+        cmpq $0,%rax            /* is it < 0? */
+        setl %al                /* 1 if so, 0 if not */
+        movzbl %al,%edi         /* zero-extend that into %edi */
+        inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
+        call audit_syscall_exit
+        movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
+        jmp sysret_check
+#endif  /* CONFIG_AUDITSYSCALL */
+
         /* Do syscall tracing */
 tracesys:                        
+#ifdef CONFIG_AUDITSYSCALL
+        testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%rcx)
+        jz auditsys
+#endif
         SAVE_REST
         movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
         FIXUP_TOP_OF_STACK %rdi
@@ -448,6 +492,7 @@ tracesys:
  * Has correct top of stack, but partial stack frame.
  */
         .globl int_ret_from_sys_call
+        .globl int_with_check
 int_ret_from_sys_call:
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
diff --git a/arch/x86/kernel/genapic_64.c b/arch/x86/kernel/genapic_64.c
index 1fa8be5bd217..eaff0bbb1444 100644
--- a/arch/x86/kernel/genapic_64.c
+++ b/arch/x86/kernel/genapic_64.c
@@ -99,3 +99,4 @@ int is_uv_system(void)
 {
         return uv_system_type != UV_NONE;
 }
+EXPORT_SYMBOL_GPL(is_uv_system);
diff --git a/arch/x86/kernel/genapic_flat_64.c b/arch/x86/kernel/genapic_flat_64.c
index 1a9c68845ee8..786548a62d38 100644
--- a/arch/x86/kernel/genapic_flat_64.c
+++ b/arch/x86/kernel/genapic_flat_64.c
@@ -168,7 +168,7 @@ static unsigned int physflat_cpu_mask_to_apicid(cpumask_t cpumask)
          * May as well be the first.
          */
         cpu = first_cpu(cpumask);
-        if ((unsigned)cpu < NR_CPUS)
+        if ((unsigned)cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
         else
                 return BAD_APICID;
diff --git a/arch/x86/kernel/genx2apic_uv_x.c b/arch/x86/kernel/genx2apic_uv_x.c
index 3c3929340692..2cfcbded888a 100644
--- a/arch/x86/kernel/genx2apic_uv_x.c
+++ b/arch/x86/kernel/genx2apic_uv_x.c
@@ -98,7 +98,7 @@ static void uv_send_IPI_mask(cpumask_t mask, int vector)
 {
         unsigned int cpu;
 
-        for (cpu = 0; cpu < NR_CPUS; ++cpu)
+        for_each_possible_cpu(cpu)
                 if (cpu_isset(cpu, mask))
                         uv_send_IPI_one(cpu, vector);
 }
@@ -132,7 +132,7 @@ static unsigned int uv_cpu_mask_to_apicid(cpumask_t cpumask)
          * May as well be the first.
          */
         cpu = first_cpu(cpumask);
-        if ((unsigned)cpu < NR_CPUS)
+        if ((unsigned)cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
         else
                 return BAD_APICID;
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index f67e93441caf..a7010c3a377a 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -456,9 +456,6 @@ is386:	movl $2,%ecx		# set MP
 1:
 #endif /* CONFIG_SMP */
         jmp *(initial_code)
-.align 4
-ENTRY(initial_code)
-        .long i386_start_kernel
 
 /*
  * We depend on ET to be correct. This checks for 287/387.
@@ -601,6 +598,11 @@ ignore_int:
 #endif
         iret
 
+.section .cpuinit.data,"wa"
+.align 4
+ENTRY(initial_code)
+        .long i386_start_kernel
+
 .section .text
 /*
  * Real beginning of normal "text" segment
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 0ea6a19bfdfe..ad2b15a1334d 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -468,7 +468,7 @@ void hpet_disable(void)
 #define RTC_NUM_INTS            1
 
 static unsigned long hpet_rtc_flags;
-static unsigned long hpet_prev_update_sec;
+static int hpet_prev_update_sec;
 static struct rtc_time hpet_alarm_time;
 static unsigned long hpet_pie_count;
 static unsigned long hpet_t1_cmp;
@@ -575,6 +575,9 @@ int hpet_set_rtc_irq_bit(unsigned long bit_mask)
 
         hpet_rtc_flags |= bit_mask;
 
+        if ((bit_mask & RTC_UIE) && !(oldbits & RTC_UIE))
+                hpet_prev_update_sec = -1;
+
         if (!oldbits)
                 hpet_rtc_timer_init();
 
@@ -652,7 +655,7 @@ static void hpet_rtc_timer_reinit(void)
                 if (hpet_rtc_flags & RTC_PIE)
                         hpet_pie_count += lost_ints;
                 if (printk_ratelimit())
-                        printk(KERN_WARNING "rtc: lost %d interrupts\n",
+                        printk(KERN_WARNING "hpet1: lost %d rtc interrupts\n",
                                 lost_ints);
         }
 }
@@ -670,7 +673,8 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
 
         if (hpet_rtc_flags & RTC_UIE &&
             curr_time.tm_sec != hpet_prev_update_sec) {
-                rtc_int_flag = RTC_UF;
+                if (hpet_prev_update_sec >= 0)
+                        rtc_int_flag = RTC_UF;
                 hpet_prev_update_sec = curr_time.tm_sec;
         }
 
diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
index de9aa0e3a9c5..09cddb57bec4 100644
--- a/arch/x86/kernel/io_apic_32.c
+++ b/arch/x86/kernel/io_apic_32.c
@@ -57,7 +57,7 @@ atomic_t irq_mis_count;
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
 static DEFINE_SPINLOCK(ioapic_lock);
-static DEFINE_SPINLOCK(vector_lock);
+DEFINE_SPINLOCK(vector_lock);
 
 int timer_through_8259 __initdata;
 
@@ -1209,10 +1209,6 @@ static int assign_irq_vector(int irq)
         return vector;
 }
 
-void setup_vector_irq(int cpu)
-{
-}
-
 static struct irq_chip ioapic_chip;
 
 #define IOAPIC_AUTO     -1
diff --git a/arch/x86/kernel/io_apic_64.c b/arch/x86/kernel/io_apic_64.c
index 64a46affd858..61a83b70c18f 100644
--- a/arch/x86/kernel/io_apic_64.c
+++ b/arch/x86/kernel/io_apic_64.c
@@ -101,7 +101,7 @@ int timer_through_8259 __initdata;
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
 static DEFINE_SPINLOCK(ioapic_lock);
-DEFINE_SPINLOCK(vector_lock);
+static DEFINE_SPINLOCK(vector_lock);
 
 /*
  * # of IRQ routing registers
@@ -697,6 +697,19 @@ static int pin_2_irq(int idx, int apic, int pin)
         return irq;
 }
 
+void lock_vector_lock(void)
+{
+        /* Used to the online set of cpus does not change
+         * during assign_irq_vector.
+         */
+        spin_lock(&vector_lock);
+}
+
+void unlock_vector_lock(void)
+{
+        spin_unlock(&vector_lock);
+}
+
 static int __assign_irq_vector(int irq, cpumask_t mask)
 {
         /*
@@ -732,7 +745,7 @@ static int __assign_irq_vector(int irq, cpumask_t mask)
                         return 0;
         }
 
-        for_each_cpu_mask(cpu, mask) {
+        for_each_cpu_mask_nr(cpu, mask) {
                 cpumask_t domain, new_mask;
                 int new_cpu;
                 int vector, offset;
@@ -753,7 +766,7 @@ next:
                         continue;
                 if (vector == IA32_SYSCALL_VECTOR)
                         goto next;
-                for_each_cpu_mask(new_cpu, new_mask)
+                for_each_cpu_mask_nr(new_cpu, new_mask)
                         if (per_cpu(vector_irq, new_cpu)[vector] != -1)
                                 goto next;
                 /* Found one! */
@@ -763,7 +776,7 @@ next:
                         cfg->move_in_progress = 1;
                         cfg->old_domain = cfg->domain;
                 }
-                for_each_cpu_mask(new_cpu, new_mask)
+                for_each_cpu_mask_nr(new_cpu, new_mask)
                         per_cpu(vector_irq, new_cpu)[vector] = irq;
                 cfg->vector = vector;
                 cfg->domain = domain;
@@ -795,14 +808,14 @@ static void __clear_irq_vector(int irq)
 
         vector = cfg->vector;
         cpus_and(mask, cfg->domain, cpu_online_map);
-        for_each_cpu_mask(cpu, mask)
+        for_each_cpu_mask_nr(cpu, mask)
                 per_cpu(vector_irq, cpu)[vector] = -1;
 
         cfg->vector = 0;
         cpus_clear(cfg->domain);
 }
 
-static void __setup_vector_irq(int cpu)
+void __setup_vector_irq(int cpu)
 {
         /* Initialize vector_irq on a new cpu */
         /* This function must be called with vector_lock held */
@@ -825,14 +838,6 @@ static void __setup_vector_irq(int cpu)
         }
 }
 
-void setup_vector_irq(int cpu)
-{
-        spin_lock(&vector_lock);
-        __setup_vector_irq(smp_processor_id());
-        spin_unlock(&vector_lock);
-}
-
-
 static struct irq_chip ioapic_chip;
 
 static void ioapic_register_intr(int irq, unsigned long trigger)
@@ -1373,12 +1378,10 @@ static unsigned int startup_ioapic_irq(unsigned int irq)
 static int ioapic_retrigger_irq(unsigned int irq)
 {
         struct irq_cfg *cfg = &irq_cfg[irq];
-        cpumask_t mask;
         unsigned long flags;
 
         spin_lock_irqsave(&vector_lock, flags);
-        mask = cpumask_of_cpu(first_cpu(cfg->domain));
-        send_IPI_mask(mask, cfg->vector);
+        send_IPI_mask(cpumask_of_cpu(first_cpu(cfg->domain)), cfg->vector);
         spin_unlock_irqrestore(&vector_lock, flags);
 
         return 1;
diff --git a/arch/x86/kernel/irqinit_64.c b/arch/x86/kernel/irqinit_64.c
index 0373e88de95a..1f26fd9ec4f4 100644
--- a/arch/x86/kernel/irqinit_64.c
+++ b/arch/x86/kernel/irqinit_64.c
@@ -43,10 +43,11 @@
 
 #define BUILD_IRQ(nr)                           \
         asmlinkage void IRQ_NAME(nr);           \
-        asm("\n.p2align\n"                      \
+        asm("\n.text\n.p2align\n"               \
             "IRQ" #nr "_interrupt:\n\t"         \
             "push $~(" #nr ") ; "               \
-            "jmp common_interrupt");
+            "jmp common_interrupt\n"            \
+            ".previous");
 
 #define BI(x,y) \
         BUILD_IRQ(x##y)
diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
index 43c019f85f0d..6c27679ec6aa 100644
--- a/arch/x86/kernel/kprobes.c
+++ b/arch/x86/kernel/kprobes.c
@@ -431,7 +431,6 @@ static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
                 regs->ip = (unsigned long)p->ainsn.insn;
 }
 
-/* Called with kretprobe_lock held */
 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
                                       struct pt_regs *regs)
 {
@@ -682,8 +681,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 
         INIT_HLIST_HEAD(&empty_rp);
-        spin_lock_irqsave(&kretprobe_lock, flags);
-        head = kretprobe_inst_table_head(current);
+        kretprobe_hash_lock(current, &head, &flags);
         /* fixup registers */
 #ifdef CONFIG_X86_64
         regs->cs = __KERNEL_CS;
@@ -732,7 +730,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
 
-        spin_unlock_irqrestore(&kretprobe_lock, flags);
+        kretprobe_hash_unlock(current, &flags);
 
         hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index a8449571858a..b68e21f06f4f 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -62,12 +62,10 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
 
         if (reload) {
 #ifdef CONFIG_SMP
-                cpumask_t mask;
-
                 preempt_disable();
                 load_LDT(pc);
-                mask = cpumask_of_cpu(smp_processor_id());
-                if (!cpus_equal(current->mm->cpu_vm_mask, mask))
+                if (!cpus_equal(current->mm->cpu_vm_mask,
+                                cpumask_of_cpu(smp_processor_id())))
                         smp_call_function(flush_ldt, current->mm, 1);
                 preempt_enable();
 #else
diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
index 8864230d55af..9fe478d98406 100644
--- a/arch/x86/kernel/machine_kexec_32.c
+++ b/arch/x86/kernel/machine_kexec_32.c
@@ -22,6 +22,7 @@
 #include <asm/cpufeature.h>
 #include <asm/desc.h>
 #include <asm/system.h>
+#include <asm/cacheflush.h>
 
 #define PAGE_ALIGNED __attribute__ ((__aligned__(PAGE_SIZE)))
 static u32 kexec_pgd[1024] PAGE_ALIGNED;
@@ -85,10 +86,12 @@ static void load_segments(void)
  * reboot code buffer to allow us to avoid allocations
  * later.
  *
- * Currently nothing.
+ * Make control page executable.
  */
 int machine_kexec_prepare(struct kimage *image)
 {
+        if (nx_enabled)
+                set_pages_x(image->control_code_page, 1);
         return 0;
 }
 
@@ -98,27 +101,48 @@ int machine_kexec_prepare(struct kimage *image)
  */
 void machine_kexec_cleanup(struct kimage *image)
 {
+        if (nx_enabled)
+                set_pages_nx(image->control_code_page, 1);
 }
 
 /*
  * Do not allocate memory (or fail in any way) in machine_kexec().
  * We are past the point of no return, committed to rebooting now.
  */
-NORET_TYPE void machine_kexec(struct kimage *image)
+void machine_kexec(struct kimage *image)
 {
         unsigned long page_list[PAGES_NR];
         void *control_page;
+        asmlinkage unsigned long
+                (*relocate_kernel_ptr)(unsigned long indirection_page,
+                                       unsigned long control_page,
+                                       unsigned long start_address,
+                                       unsigned int has_pae,
+                                       unsigned int preserve_context);
 
         tracer_disable();
 
         /* Interrupts aren't acceptable while we reboot */
         local_irq_disable();
 
+        if (image->preserve_context) {
+#ifdef CONFIG_X86_IO_APIC
+                /* We need to put APICs in legacy mode so that we can
+                 * get timer interrupts in second kernel. kexec/kdump
+                 * paths already have calls to disable_IO_APIC() in
+                 * one form or other. kexec jump path also need
+                 * one.
+                 */
+                disable_IO_APIC();
+#endif
+        }
+
         control_page = page_address(image->control_code_page);
-        memcpy(control_page, relocate_kernel, PAGE_SIZE);
+        memcpy(control_page, relocate_kernel, PAGE_SIZE/2);
 
+        relocate_kernel_ptr = control_page;
         page_list[PA_CONTROL_PAGE] = __pa(control_page);
-        page_list[VA_CONTROL_PAGE] = (unsigned long)relocate_kernel;
+        page_list[VA_CONTROL_PAGE] = (unsigned long)control_page;
         page_list[PA_PGD] = __pa(kexec_pgd);
         page_list[VA_PGD] = (unsigned long)kexec_pgd;
 #ifdef CONFIG_X86_PAE
@@ -131,6 +155,7 @@ NORET_TYPE void machine_kexec(struct kimage *image)
         page_list[VA_PTE_0] = (unsigned long)kexec_pte0;
         page_list[PA_PTE_1] = __pa(kexec_pte1);
         page_list[VA_PTE_1] = (unsigned long)kexec_pte1;
+        page_list[PA_SWAP_PAGE] = (page_to_pfn(image->swap_page) << PAGE_SHIFT);
 
         /* The segment registers are funny things, they have both a
          * visible and an invisible part.  Whenever the visible part is
@@ -149,8 +174,10 @@ NORET_TYPE void machine_kexec(struct kimage *image)
         set_idt(phys_to_virt(0),0);
 
         /* now call it */
-        relocate_kernel((unsigned long)image->head, (unsigned long)page_list,
-                        image->start, cpu_has_pae);
+        image->start = relocate_kernel_ptr((unsigned long)image->head,
+                                           (unsigned long)page_list,
+                                           image->start, cpu_has_pae,
+                                           image->preserve_context);
 }
 
 void arch_crash_save_vmcoreinfo(void)
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 9dd9262693a3..c43caa3a91f3 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -181,7 +181,7 @@ void machine_kexec_cleanup(struct kimage *image)
  * Do not allocate memory (or fail in any way) in machine_kexec().
  * We are past the point of no return, committed to rebooting now.
  */
-NORET_TYPE void machine_kexec(struct kimage *image)
+void machine_kexec(struct kimage *image)
 {
         unsigned long page_list[PAGES_NR];
         void *control_page;
diff --git a/arch/x86/kernel/microcode.c b/arch/x86/kernel/microcode.c
index fc4790638b69..652fa5c38ebe 100644
--- a/arch/x86/kernel/microcode.c
+++ b/arch/x86/kernel/microcode.c
@@ -657,9 +657,7 @@ static ssize_t reload_store(struct sys_device *dev,
         if (end == buf)
                 return -EINVAL;
         if (val == 1) {
-                cpumask_t old;
-
-                old = current->cpus_allowed;
+                cpumask_t old = current->cpus_allowed;
 
                 get_online_cpus();
                 set_cpus_allowed_ptr(current, &cpumask_of_cpu(cpu));
diff --git a/arch/x86/kernel/module_64.c b/arch/x86/kernel/module_64.c
index 0e867676b5a5..6ba87830d4b1 100644
--- a/arch/x86/kernel/module_64.c
+++ b/arch/x86/kernel/module_64.c
@@ -22,6 +22,7 @@
 #include <linux/fs.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
+#include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/bug.h>
 
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 6ae005ccaed8..678090508a62 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -83,7 +83,7 @@ static void __init MP_bus_info(struct mpc_config_bus *m)
         if (x86_quirks->mpc_oem_bus_info)
                 x86_quirks->mpc_oem_bus_info(m, str);
         else
-                printk(KERN_INFO "Bus #%d is %s\n", m->mpc_busid, str);
+                apic_printk(APIC_VERBOSE, "Bus #%d is %s\n", m->mpc_busid, str);
 
 #if MAX_MP_BUSSES < 256
         if (m->mpc_busid >= MAX_MP_BUSSES) {
@@ -154,7 +154,7 @@ static void __init MP_ioapic_info(struct mpc_config_ioapic *m)
 
 static void print_MP_intsrc_info(struct mpc_config_intsrc *m)
 {
-        printk(KERN_CONT "Int: type %d, pol %d, trig %d, bus %02x,"
+        apic_printk(APIC_VERBOSE, "Int: type %d, pol %d, trig %d, bus %02x,"
                 " IRQ %02x, APIC ID %x, APIC INT %02x\n",
                 m->mpc_irqtype, m->mpc_irqflag & 3,
                 (m->mpc_irqflag >> 2) & 3, m->mpc_srcbus,
@@ -163,7 +163,7 @@ static void print_MP_intsrc_info(struct mpc_config_intsrc *m)
 
 static void __init print_mp_irq_info(struct mp_config_intsrc *mp_irq)
 {
-        printk(KERN_CONT "Int: type %d, pol %d, trig %d, bus %02x,"
+        apic_printk(APIC_VERBOSE, "Int: type %d, pol %d, trig %d, bus %02x,"
                 " IRQ %02x, APIC ID %x, APIC INT %02x\n",
                 mp_irq->mp_irqtype, mp_irq->mp_irqflag & 3,
                 (mp_irq->mp_irqflag >> 2) & 3, mp_irq->mp_srcbus,
@@ -235,7 +235,7 @@ static void __init MP_intsrc_info(struct mpc_config_intsrc *m)
 
 static void __init MP_lintsrc_info(struct mpc_config_lintsrc *m)
 {
-        printk(KERN_INFO "Lint: type %d, pol %d, trig %d, bus %02x,"
+        apic_printk(APIC_VERBOSE, "Lint: type %d, pol %d, trig %d, bus %02x,"
                 " IRQ %02x, APIC ID %x, APIC LINT %02x\n",
                 m->mpc_irqtype, m->mpc_irqflag & 3,
                 (m->mpc_irqflag >> 2) & 3, m->mpc_srcbusid,
@@ -695,7 +695,8 @@ static int __init smp_scan_config(unsigned long base, unsigned long length,
         unsigned int *bp = phys_to_virt(base);
         struct intel_mp_floating *mpf;
 
-        printk(KERN_DEBUG "Scan SMP from %p for %ld bytes.\n", bp, length);
+        apic_printk(APIC_VERBOSE, "Scan SMP from %p for %ld bytes.\n",
+                        bp, length);
         BUILD_BUG_ON(sizeof(*mpf) != 16);
 
         while (length > 0) {
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index 151f2d171f7c..02d19328525d 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -29,6 +29,7 @@
 #include <linux/mm.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
+#include <linux/crash_dump.h>
 #include <linux/dma-mapping.h>
 #include <linux/bitops.h>
 #include <linux/pci_ids.h>
@@ -36,6 +37,7 @@
 #include <linux/delay.h>
 #include <linux/scatterlist.h>
 #include <linux/iommu-helper.h>
+
 #include <asm/iommu.h>
 #include <asm/calgary.h>
 #include <asm/tce.h>
@@ -167,6 +169,8 @@ static void calgary_dump_error_regs(struct iommu_table *tbl);
 static void calioc2_handle_quirks(struct iommu_table *tbl, struct pci_dev *dev);
 static void calioc2_tce_cache_blast(struct iommu_table *tbl);
 static void calioc2_dump_error_regs(struct iommu_table *tbl);
+static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl);
+static void get_tce_space_from_tar(void);
 
 static struct cal_chipset_ops calgary_chip_ops = {
         .handle_quirks = calgary_handle_quirks,
@@ -410,22 +414,6 @@ static void calgary_unmap_sg(struct device *dev,
         }
 }
 
-static int calgary_nontranslate_map_sg(struct device* dev,
-        struct scatterlist *sg, int nelems, int direction)
-{
-        struct scatterlist *s;
-        int i;
-
-        for_each_sg(sg, s, nelems, i) {
-                struct page *p = sg_page(s);
-
-                BUG_ON(!p);
-                s->dma_address = virt_to_bus(sg_virt(s));
-                s->dma_length = s->length;
-        }
-        return nelems;
-}
-
 static int calgary_map_sg(struct device *dev, struct scatterlist *sg,
         int nelems, int direction)
 {
@@ -436,9 +424,6 @@ static int calgary_map_sg(struct device *dev, struct scatterlist *sg,
         unsigned long entry;
         int i;
 
-        if (!translation_enabled(tbl))
-                return calgary_nontranslate_map_sg(dev, sg, nelems, direction);
-
         for_each_sg(sg, s, nelems, i) {
                 BUG_ON(!sg_page(s));
 
@@ -474,7 +459,6 @@ error:
 static dma_addr_t calgary_map_single(struct device *dev, phys_addr_t paddr,
         size_t size, int direction)
 {
-        dma_addr_t dma_handle = bad_dma_address;
         void *vaddr = phys_to_virt(paddr);
         unsigned long uaddr;
         unsigned int npages;
@@ -483,12 +467,7 @@ static dma_addr_t calgary_map_single(struct device *dev, phys_addr_t paddr,
         uaddr = (unsigned long)vaddr;
         npages = num_dma_pages(uaddr, size);
 
-        if (translation_enabled(tbl))
-                dma_handle = iommu_alloc(dev, tbl, vaddr, npages, direction);
-        else
-                dma_handle = virt_to_bus(vaddr);
-
-        return dma_handle;
+        return iommu_alloc(dev, tbl, vaddr, npages, direction);
 }
 
 static void calgary_unmap_single(struct device *dev, dma_addr_t dma_handle,
@@ -497,9 +476,6 @@ static void calgary_unmap_single(struct device *dev, dma_addr_t dma_handle,
         struct iommu_table *tbl = find_iommu_table(dev);
         unsigned int npages;
 
-        if (!translation_enabled(tbl))
-                return;
-
         npages = num_dma_pages(dma_handle, size);
         iommu_free(tbl, dma_handle, npages);
 }
@@ -522,18 +498,12 @@ static void* calgary_alloc_coherent(struct device *dev, size_t size,
                 goto error;
         memset(ret, 0, size);
 
-        if (translation_enabled(tbl)) {
-                /* set up tces to cover the allocated range */
-                mapping = iommu_alloc(dev, tbl, ret, npages, DMA_BIDIRECTIONAL);
-                if (mapping == bad_dma_address)
-                        goto free;
-
-                *dma_handle = mapping;
-        } else /* non translated slot */
-                *dma_handle = virt_to_bus(ret);
-
+        /* set up tces to cover the allocated range */
+        mapping = iommu_alloc(dev, tbl, ret, npages, DMA_BIDIRECTIONAL);
+        if (mapping == bad_dma_address)
+                goto free;
+        *dma_handle = mapping;
         return ret;
-
 free:
         free_pages((unsigned long)ret, get_order(size));
         ret = NULL;
@@ -541,7 +511,7 @@ error:
         return ret;
 }
 
-static const struct dma_mapping_ops calgary_dma_ops = {
+static struct dma_mapping_ops calgary_dma_ops = {
         .alloc_coherent = calgary_alloc_coherent,
         .map_single = calgary_map_single,
         .unmap_single = calgary_unmap_single,
@@ -830,7 +800,11 @@ static int __init calgary_setup_tar(struct pci_dev *dev, void __iomem *bbar)
 
         tbl = pci_iommu(dev->bus);
         tbl->it_base = (unsigned long)bus_info[dev->bus->number].tce_space;
-        tce_free(tbl, 0, tbl->it_size);
+
+        if (is_kdump_kernel())
+                calgary_init_bitmap_from_tce_table(tbl);
+        else
+                tce_free(tbl, 0, tbl->it_size);
 
         if (is_calgary(dev->device))
                 tbl->chip_ops = &calgary_chip_ops;
@@ -1209,6 +1183,10 @@ static int __init calgary_init(void)
         if (ret)
                 return ret;
 
+        /* Purely for kdump kernel case */
+        if (is_kdump_kernel())
+                get_tce_space_from_tar();
+
         do {
                 dev = pci_get_device(PCI_VENDOR_ID_IBM, PCI_ANY_ID, dev);
                 if (!dev)
@@ -1230,6 +1208,16 @@ static int __init calgary_init(void)
                         goto error;
         } while (1);
 
+        dev = NULL;
+        for_each_pci_dev(dev) {
+                struct iommu_table *tbl;
+
+                tbl = find_iommu_table(&dev->dev);
+
+                if (translation_enabled(tbl))
+                        dev->dev.archdata.dma_ops = &calgary_dma_ops;
+        }
+
         return ret;
 
 error:
@@ -1251,6 +1239,7 @@ error:
                 calgary_disable_translation(dev);
                 calgary_free_bus(dev);
                 pci_dev_put(dev); /* Undo calgary_init_one()'s pci_dev_get() */
+                dev->dev.archdata.dma_ops = NULL;
         } while (1);
 
         return ret;
@@ -1339,6 +1328,61 @@ static int __init calgary_bus_has_devices(int bus, unsigned short pci_dev)
         return (val != 0xffffffff);
 }
 
+/*
+ * calgary_init_bitmap_from_tce_table():
+ * Funtion for kdump case. In the second/kdump kernel initialize
+ * the bitmap based on the tce table entries obtained from first kernel
+ */
+static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl)
+{
+        u64 *tp;
+        unsigned int index;
+        tp = ((u64 *)tbl->it_base);
+        for (index = 0 ; index < tbl->it_size; index++) {
+                if (*tp != 0x0)
+                        set_bit(index, tbl->it_map);
+                tp++;
+        }
+}
+
+/*
+ * get_tce_space_from_tar():
+ * Function for kdump case. Get the tce tables from first kernel
+ * by reading the contents of the base adress register of calgary iommu
+ */
+static void get_tce_space_from_tar(void)
+{
+        int bus;
+        void __iomem *target;
+        unsigned long tce_space;
+
+        for (bus = 0; bus < MAX_PHB_BUS_NUM; bus++) {
+                struct calgary_bus_info *info = &bus_info[bus];
+                unsigned short pci_device;
+                u32 val;
+
+                val = read_pci_config(bus, 0, 0, 0);
+                pci_device = (val & 0xFFFF0000) >> 16;
+
+                if (!is_cal_pci_dev(pci_device))
+                        continue;
+                if (info->translation_disabled)
+                        continue;
+
+                if (calgary_bus_has_devices(bus, pci_device) ||
+                                                translate_empty_slots) {
+                        target = calgary_reg(bus_info[bus].bbar,
+                                                tar_offset(bus));
+                        tce_space = be64_to_cpu(readq(target));
+                        tce_space = tce_space & TAR_SW_BITS;
+
+                        tce_space = tce_space & (~specified_table_size);
+                        info->tce_space = (u64 *)__va(tce_space);
+                }
+        }
+        return;
+}
+
 void __init detect_calgary(void)
 {
         int bus;
@@ -1394,7 +1438,8 @@ void __init detect_calgary(void)
                 return;
         }
 
-        specified_table_size = determine_tce_table_size(max_pfn * PAGE_SIZE);
+        specified_table_size = determine_tce_table_size((is_kdump_kernel() ?
+                                        saved_max_pfn : max_pfn) * PAGE_SIZE);
 
         for (bus = 0; bus < MAX_PHB_BUS_NUM; bus++) {
                 struct calgary_bus_info *info = &bus_info[bus];
@@ -1412,10 +1457,16 @@ void __init detect_calgary(void)
 
                 if (calgary_bus_has_devices(bus, pci_device) ||
                     translate_empty_slots) {
-                        tbl = alloc_tce_table();
-                        if (!tbl)
-                                goto cleanup;
-                        info->tce_space = tbl;
+                        /*
+                         * If it is kdump kernel, find and use tce tables
+                         * from first kernel, else allocate tce tables here
+                         */
+                        if (!is_kdump_kernel()) {
+                                tbl = alloc_tce_table();
+                                if (!tbl)
+                                        goto cleanup;
+                                info->tce_space = tbl;
+                        }
                         calgary_found = 1;
                 }
         }
@@ -1430,6 +1481,10 @@ void __init detect_calgary(void)
                 printk(KERN_INFO "PCI-DMA: Calgary TCE table spec is %d, "
                        "CONFIG_IOMMU_DEBUG is %s.\n", specified_table_size,
                        debugging ? "enabled" : "disabled");
+
+                /* swiotlb for devices that aren't behind the Calgary. */
+                if (max_pfn > MAX_DMA32_PFN)
+                        swiotlb = 1;
         }
         return;
 
@@ -1446,7 +1501,7 @@ int __init calgary_iommu_init(void)
 {
         int ret;
 
-        if (no_iommu || swiotlb)
+        if (no_iommu || (swiotlb && !calgary_detected))
                 return -ENODEV;
 
         if (!calgary_detected)
@@ -1459,15 +1514,14 @@ int __init calgary_iommu_init(void)
         if (ret) {
                 printk(KERN_ERR "PCI-DMA: Calgary init failed %d, "
                        "falling back to no_iommu\n", ret);
-                if (max_pfn > MAX_DMA32_PFN)
-                        printk(KERN_ERR "WARNING more than 4GB of memory, "
-                                        "32bit PCI may malfunction.\n");
                 return ret;
         }
 
         force_iommu = 1;
         bad_dma_address = 0x0;
-        dma_ops = &calgary_dma_ops;
+        /* dma_ops is set to swiotlb or nommu */
+        if (!dma_ops)
+                dma_ops = &nommu_dma_ops;
 
         return 0;
 }
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index cbecb05551bb..87d4d6964ec2 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -11,7 +11,7 @@
 
 static int forbid_dac __read_mostly;
 
-const struct dma_mapping_ops *dma_ops;
+struct dma_mapping_ops *dma_ops;
 EXPORT_SYMBOL(dma_ops);
 
 static int iommu_sac_force __read_mostly;
@@ -123,6 +123,14 @@ void __init pci_iommu_alloc(void)
 
         pci_swiotlb_init();
 }
+
+unsigned long iommu_num_pages(unsigned long addr, unsigned long len)
+{
+        unsigned long size = roundup((addr & ~PAGE_MASK) + len, PAGE_SIZE);
+
+        return size >> PAGE_SHIFT;
+}
+EXPORT_SYMBOL(iommu_num_pages);
 #endif
 
 /*
@@ -192,126 +200,10 @@ static __init int iommu_setup(char *p)
 }
 early_param("iommu", iommu_setup);
 
-#ifdef CONFIG_X86_32
-int dma_declare_coherent_memory(struct device *dev, dma_addr_t bus_addr,
-                                dma_addr_t device_addr, size_t size, int flags)
-{
-        void __iomem *mem_base = NULL;
-        int pages = size >> PAGE_SHIFT;
-        int bitmap_size = BITS_TO_LONGS(pages) * sizeof(long);
-
-        if ((flags & (DMA_MEMORY_MAP | DMA_MEMORY_IO)) == 0)
-                goto out;
-        if (!size)
-                goto out;
-        if (dev->dma_mem)
-                goto out;
-
-        /* FIXME: this routine just ignores DMA_MEMORY_INCLUDES_CHILDREN */
-
-        mem_base = ioremap(bus_addr, size);
-        if (!mem_base)
-                goto out;
-
-        dev->dma_mem = kzalloc(sizeof(struct dma_coherent_mem), GFP_KERNEL);
-        if (!dev->dma_mem)
-                goto out;
-        dev->dma_mem->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
-        if (!dev->dma_mem->bitmap)
-                goto free1_out;
-
-        dev->dma_mem->virt_base = mem_base;
-        dev->dma_mem->device_base = device_addr;
-        dev->dma_mem->size = pages;
-        dev->dma_mem->flags = flags;
-
-        if (flags & DMA_MEMORY_MAP)
-                return DMA_MEMORY_MAP;
-
-        return DMA_MEMORY_IO;
-
- free1_out:
-        kfree(dev->dma_mem);
- out:
-        if (mem_base)
-                iounmap(mem_base);
-        return 0;
-}
-EXPORT_SYMBOL(dma_declare_coherent_memory);
-
-void dma_release_declared_memory(struct device *dev)
-{
-        struct dma_coherent_mem *mem = dev->dma_mem;
-
-        if (!mem)
-                return;
-        dev->dma_mem = NULL;
-        iounmap(mem->virt_base);
-        kfree(mem->bitmap);
-        kfree(mem);
-}
-EXPORT_SYMBOL(dma_release_declared_memory);
-
-void *dma_mark_declared_memory_occupied(struct device *dev,
-                                        dma_addr_t device_addr, size_t size)
-{
-        struct dma_coherent_mem *mem = dev->dma_mem;
-        int pos, err;
-        int pages = (size + (device_addr & ~PAGE_MASK) + PAGE_SIZE - 1);
-
-        pages >>= PAGE_SHIFT;
-
-        if (!mem)
-                return ERR_PTR(-EINVAL);
-
-        pos = (device_addr - mem->device_base) >> PAGE_SHIFT;
-        err = bitmap_allocate_region(mem->bitmap, pos, get_order(pages));
-        if (err != 0)
-                return ERR_PTR(err);
-        return mem->virt_base + (pos << PAGE_SHIFT);
-}
-EXPORT_SYMBOL(dma_mark_declared_memory_occupied);
-
-static int dma_alloc_from_coherent_mem(struct device *dev, ssize_t size,
-                                       dma_addr_t *dma_handle, void **ret)
-{
-        struct dma_coherent_mem *mem = dev ? dev->dma_mem : NULL;
-        int order = get_order(size);
-
-        if (mem) {
-                int page = bitmap_find_free_region(mem->bitmap, mem->size,
-                                                     order);
-                if (page >= 0) {
-                        *dma_handle = mem->device_base + (page << PAGE_SHIFT);
-                        *ret = mem->virt_base + (page << PAGE_SHIFT);
-                        memset(*ret, 0, size);
-                }
-                if (mem->flags & DMA_MEMORY_EXCLUSIVE)
-                        *ret = NULL;
-        }
-        return (mem != NULL);
-}
-
-static int dma_release_coherent(struct device *dev, int order, void *vaddr)
-{
-        struct dma_coherent_mem *mem = dev ? dev->dma_mem : NULL;
-
-        if (mem && vaddr >= mem->virt_base && vaddr <
-                   (mem->virt_base + (mem->size << PAGE_SHIFT))) {
-                int page = (vaddr - mem->virt_base) >> PAGE_SHIFT;
-
-                bitmap_release_region(mem->bitmap, page, order);
-                return 1;
-        }
-        return 0;
-}
-#else
-#define dma_alloc_from_coherent_mem(dev, size, handle, ret) (0)
-#define dma_release_coherent(dev, order, vaddr) (0)
-#endif /* CONFIG_X86_32 */
-
 int dma_supported(struct device *dev, u64 mask)
 {
+        struct dma_mapping_ops *ops = get_dma_ops(dev);
+
 #ifdef CONFIG_PCI
         if (mask > 0xffffffff && forbid_dac > 0) {
                 dev_info(dev, "PCI: Disallowing DAC for device\n");
@@ -319,8 +211,8 @@ int dma_supported(struct device *dev, u64 mask)
         }
 #endif
 
-        if (dma_ops->dma_supported)
-                return dma_ops->dma_supported(dev, mask);
+        if (ops->dma_supported)
+                return ops->dma_supported(dev, mask);
 
         /* Copied from i386. Doesn't make much sense, because it will
            only work for pci_alloc_coherent.
@@ -367,6 +259,7 @@ void *
 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
                    gfp_t gfp)
 {
+        struct dma_mapping_ops *ops = get_dma_ops(dev);
         void *memory = NULL;
         struct page *page;
         unsigned long dma_mask = 0;
@@ -376,7 +269,7 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
         /* ignore region specifiers */
         gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
 
-        if (dma_alloc_from_coherent_mem(dev, size, dma_handle, &memory))
+        if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
                 return memory;
 
         if (!dev) {
@@ -435,8 +328,8 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
                         /* Let low level make its own zone decisions */
                         gfp &= ~(GFP_DMA32|GFP_DMA);
 
-                        if (dma_ops->alloc_coherent)
-                                return dma_ops->alloc_coherent(dev, size,
+                        if (ops->alloc_coherent)
+                                return ops->alloc_coherent(dev, size,
                                                            dma_handle, gfp);
                         return NULL;
                 }
@@ -448,14 +341,14 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
                 }
         }
 
-        if (dma_ops->alloc_coherent) {
+        if (ops->alloc_coherent) {
                 free_pages((unsigned long)memory, get_order(size));
                 gfp &= ~(GFP_DMA|GFP_DMA32);
-                return dma_ops->alloc_coherent(dev, size, dma_handle, gfp);
+                return ops->alloc_coherent(dev, size, dma_handle, gfp);
         }
 
-        if (dma_ops->map_simple) {
-                *dma_handle = dma_ops->map_simple(dev, virt_to_phys(memory),
+        if (ops->map_simple) {
+                *dma_handle = ops->map_simple(dev, virt_to_phys(memory),
                                               size,
                                               PCI_DMA_BIDIRECTIONAL);
                 if (*dma_handle != bad_dma_address)
@@ -477,12 +370,14 @@ EXPORT_SYMBOL(dma_alloc_coherent);
 void dma_free_coherent(struct device *dev, size_t size,
                          void *vaddr, dma_addr_t bus)
 {
+        struct dma_mapping_ops *ops = get_dma_ops(dev);
+
         int order = get_order(size);
         WARN_ON(irqs_disabled());       /* for portability */
-        if (dma_release_coherent(dev, order, vaddr))
+        if (dma_release_from_coherent(dev, order, vaddr))
                 return;
-        if (dma_ops->unmap_single)
-                dma_ops->unmap_single(dev, bus, size, 0);
+        if (ops->unmap_single)
+                ops->unmap_single(dev, bus, size, 0);
         free_pages((unsigned long)vaddr, order);
 }
 EXPORT_SYMBOL(dma_free_coherent);
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index 1062dc1e6396..cdab67849074 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -67,9 +67,6 @@ static u32 gart_unmapped_entry;
         (((x) & 0xfffff000) | (((x) >> 32) << 4) | GPTE_VALID | GPTE_COHERENT)
 #define GPTE_DECODE(x) (((x) & 0xfffff000) | (((u64)(x) & 0xff0) << 28))
 
-#define to_pages(addr, size) \
-        (round_up(((addr) & ~PAGE_MASK) + (size), PAGE_SIZE) >> PAGE_SHIFT)
-
 #define EMERGENCY_PAGES 32 /* = 128KB */
 
 #ifdef CONFIG_AGP
@@ -241,7 +238,7 @@ nonforced_iommu(struct device *dev, unsigned long addr, size_t size)
 static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
                                 size_t size, int dir)
 {
-        unsigned long npages = to_pages(phys_mem, size);
+        unsigned long npages = iommu_num_pages(phys_mem, size);
         unsigned long iommu_page = alloc_iommu(dev, npages);
         int i;
 
@@ -304,7 +301,7 @@ static void gart_unmap_single(struct device *dev, dma_addr_t dma_addr,
                 return;
 
         iommu_page = (dma_addr - iommu_bus_base)>>PAGE_SHIFT;
-        npages = to_pages(dma_addr, size);
+        npages = iommu_num_pages(dma_addr, size);
         for (i = 0; i < npages; i++) {
                 iommu_gatt_base[iommu_page + i] = gart_unmapped_entry;
                 CLEAR_LEAK(iommu_page + i);
@@ -387,7 +384,7 @@ static int __dma_map_cont(struct device *dev, struct scatterlist *start,
                 }
 
                 addr = phys_addr;
-                pages = to_pages(s->offset, s->length);
+                pages = iommu_num_pages(s->offset, s->length);
                 while (pages--) {
                         iommu_gatt_base[iommu_page] = GPTE_ENCODE(addr);
                         SET_LEAK(iommu_page);
@@ -470,7 +467,7 @@ gart_map_sg(struct device *dev, struct scatterlist *sg, int nents, int dir)
 
                 seg_size += s->length;
                 need = nextneed;
-                pages += to_pages(s->offset, s->length);
+                pages += iommu_num_pages(s->offset, s->length);
                 ps = s;
         }
         if (dma_map_cont(dev, start_sg, i - start, sgmap, pages, need) < 0)
@@ -692,8 +689,7 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
 
 extern int agp_amd64_init(void);
 
-static const struct dma_mapping_ops gart_dma_ops = {
-        .mapping_error                  = NULL,
+static struct dma_mapping_ops gart_dma_ops = {
         .map_single                     = gart_map_single,
         .map_simple                     = gart_map_simple,
         .unmap_single                   = gart_unmap_single,
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index 792b9179eff3..3f91f71cdc3e 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -72,21 +72,9 @@ static int nommu_map_sg(struct device *hwdev, struct scatterlist *sg,
         return nents;
 }
 
-/* Make sure we keep the same behaviour */
-static int nommu_mapping_error(dma_addr_t dma_addr)
-{
-#ifdef CONFIG_X86_32
-        return 0;
-#else
-        return (dma_addr == bad_dma_address);
-#endif
-}
-
-
-const struct dma_mapping_ops nommu_dma_ops = {
+struct dma_mapping_ops nommu_dma_ops = {
         .map_single = nommu_map_single,
         .map_sg = nommu_map_sg,
-        .mapping_error = nommu_mapping_error,
         .is_phys = 1,
 };
 
diff --git a/arch/x86/kernel/pci-swiotlb_64.c b/arch/x86/kernel/pci-swiotlb_64.c
index 20df839b9c20..c4ce0332759e 100644
--- a/arch/x86/kernel/pci-swiotlb_64.c
+++ b/arch/x86/kernel/pci-swiotlb_64.c
@@ -18,7 +18,7 @@ swiotlb_map_single_phys(struct device *hwdev, phys_addr_t paddr, size_t size,
         return swiotlb_map_single(hwdev, phys_to_virt(paddr), size, direction);
 }
 
-const struct dma_mapping_ops swiotlb_dma_ops = {
+struct dma_mapping_ops swiotlb_dma_ops = {
         .mapping_error = swiotlb_dma_mapping_error,
         .alloc_coherent = swiotlb_alloc_coherent,
         .free_coherent = swiotlb_free_coherent,
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 0c3927accb00..53bc653ed5ca 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -128,7 +128,7 @@ void cpu_idle(void)
 
         /* endless idle loop with no priority at all */
         while (1) {
-                tick_nohz_stop_sched_tick();
+                tick_nohz_stop_sched_tick(1);
                 while (!need_resched()) {
 
                         check_pgt_cache();
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index e8a8e1b99817..3fb62a7d9a16 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -120,7 +120,7 @@ void cpu_idle(void)
         current_thread_info()->status |= TS_POLLING;
         /* endless idle loop with no priority at all */
         while (1) {
-                tick_nohz_stop_sched_tick();
+                tick_nohz_stop_sched_tick(1);
                 while (!need_resched()) {
 
                         rmb();
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 9dcf39c02972..724adfc63cb9 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -411,10 +411,9 @@ void native_machine_shutdown(void)
 {
         /* Stop the cpus and apics */
 #ifdef CONFIG_SMP
-        int reboot_cpu_id;
 
         /* The boot cpu is always logical cpu 0 */
-        reboot_cpu_id = 0;
+        int reboot_cpu_id = 0;
 
 #ifdef CONFIG_X86_32
         /* See if there has been given a command line override */
diff --git a/arch/x86/kernel/relocate_kernel_32.S b/arch/x86/kernel/relocate_kernel_32.S
index c30fe25d470d..703310a99023 100644
--- a/arch/x86/kernel/relocate_kernel_32.S
+++ b/arch/x86/kernel/relocate_kernel_32.S
@@ -20,11 +20,44 @@
 #define PAGE_ATTR (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY)
 #define PAE_PGD_ATTR (_PAGE_PRESENT)
 
+/* control_page + PAGE_SIZE/2 ~ control_page + PAGE_SIZE * 3/4 are
+ * used to save some data for jumping back
+ */
+#define DATA(offset)            (PAGE_SIZE/2+(offset))
+
+/* Minimal CPU state */
+#define ESP                     DATA(0x0)
+#define CR0                     DATA(0x4)
+#define CR3                     DATA(0x8)
+#define CR4                     DATA(0xc)
+
+/* other data */
+#define CP_VA_CONTROL_PAGE      DATA(0x10)
+#define CP_PA_PGD               DATA(0x14)
+#define CP_PA_SWAP_PAGE         DATA(0x18)
+#define CP_PA_BACKUP_PAGES_MAP  DATA(0x1c)
+
         .text
         .align PAGE_SIZE
         .globl relocate_kernel
 relocate_kernel:
-        movl    8(%esp), %ebp /* list of pages */
+        /* Save the CPU context, used for jumping back */
+
+        pushl   %ebx
+        pushl   %esi
+        pushl   %edi
+        pushl   %ebp
+        pushf
+
+        movl    20+8(%esp), %ebp /* list of pages */
+        movl    PTR(VA_CONTROL_PAGE)(%ebp), %edi
+        movl    %esp, ESP(%edi)
+        movl    %cr0, %eax
+        movl    %eax, CR0(%edi)
+        movl    %cr3, %eax
+        movl    %eax, CR3(%edi)
+        movl    %cr4, %eax
+        movl    %eax, CR4(%edi)
 
 #ifdef CONFIG_X86_PAE
         /* map the control page at its virtual address */
@@ -138,15 +171,25 @@ relocate_kernel:
 
 relocate_new_kernel:
         /* read the arguments and say goodbye to the stack */
-        movl  4(%esp), %ebx /* page_list */
-        movl  8(%esp), %ebp /* list of pages */
-        movl  12(%esp), %edx /* start address */
-        movl  16(%esp), %ecx /* cpu_has_pae */
+        movl  20+4(%esp), %ebx /* page_list */
+        movl  20+8(%esp), %ebp /* list of pages */
+        movl  20+12(%esp), %edx /* start address */
+        movl  20+16(%esp), %ecx /* cpu_has_pae */
+        movl  20+20(%esp), %esi /* preserve_context */
 
         /* zero out flags, and disable interrupts */
         pushl $0
         popfl
 
+        /* save some information for jumping back */
+        movl    PTR(VA_CONTROL_PAGE)(%ebp), %edi
+        movl    %edi, CP_VA_CONTROL_PAGE(%edi)
+        movl    PTR(PA_PGD)(%ebp), %eax
+        movl    %eax, CP_PA_PGD(%edi)
+        movl    PTR(PA_SWAP_PAGE)(%ebp), %eax
+        movl    %eax, CP_PA_SWAP_PAGE(%edi)
+        movl    %ebx, CP_PA_BACKUP_PAGES_MAP(%edi)
+
         /* get physical address of control page now */
         /* this is impossible after page table switch */
         movl    PTR(PA_CONTROL_PAGE)(%ebp), %edi
@@ -197,8 +240,90 @@ identity_mapped:
         xorl    %eax, %eax
         movl    %eax, %cr3
 
+        movl    CP_PA_SWAP_PAGE(%edi), %eax
+        pushl   %eax
+        pushl   %ebx
+        call    swap_pages
+        addl    $8, %esp
+
+        /* To be certain of avoiding problems with self-modifying code
+         * I need to execute a serializing instruction here.
+         * So I flush the TLB, it's handy, and not processor dependent.
+         */
+        xorl    %eax, %eax
+        movl    %eax, %cr3
+
+        /* set all of the registers to known values */
+        /* leave %esp alone */
+
+        testl   %esi, %esi
+        jnz 1f
+        xorl    %edi, %edi
+        xorl    %eax, %eax
+        xorl    %ebx, %ebx
+        xorl    %ecx, %ecx
+        xorl    %edx, %edx
+        xorl    %esi, %esi
+        xorl    %ebp, %ebp
+        ret
+1:
+        popl    %edx
+        movl    CP_PA_SWAP_PAGE(%edi), %esp
+        addl    $PAGE_SIZE, %esp
+2:
+        call    *%edx
+
+        /* get the re-entry point of the peer system */
+        movl    0(%esp), %ebp
+        call    1f
+1:
+        popl    %ebx
+        subl    $(1b - relocate_kernel), %ebx
+        movl    CP_VA_CONTROL_PAGE(%ebx), %edi
+        lea     PAGE_SIZE(%ebx), %esp
+        movl    CP_PA_SWAP_PAGE(%ebx), %eax
+        movl    CP_PA_BACKUP_PAGES_MAP(%ebx), %edx
+        pushl   %eax
+        pushl   %edx
+        call    swap_pages
+        addl    $8, %esp
+        movl    CP_PA_PGD(%ebx), %eax
+        movl    %eax, %cr3
+        movl    %cr0, %eax
+        orl     $(1<<31), %eax
+        movl    %eax, %cr0
+        lea     PAGE_SIZE(%edi), %esp
+        movl    %edi, %eax
+        addl    $(virtual_mapped - relocate_kernel), %eax
+        pushl   %eax
+        ret
+
+virtual_mapped:
+        movl    CR4(%edi), %eax
+        movl    %eax, %cr4
+        movl    CR3(%edi), %eax
+        movl    %eax, %cr3
+        movl    CR0(%edi), %eax
+        movl    %eax, %cr0
+        movl    ESP(%edi), %esp
+        movl    %ebp, %eax
+
+        popf
+        popl    %ebp
+        popl    %edi
+        popl    %esi
+        popl    %ebx
+        ret
+
         /* Do the copies */
-        movl    %ebx, %ecx
+swap_pages:
+        movl    8(%esp), %edx
+        movl    4(%esp), %ecx
+        pushl   %ebp
+        pushl   %ebx
+        pushl   %edi
+        pushl   %esi
+        movl    %ecx, %ebx
         jmp     1f
 
 0:      /* top, read another word from the indirection page */
@@ -226,27 +351,28 @@ identity_mapped:
         movl    %ecx,   %esi /* For every source page do a copy */
         andl    $0xfffff000, %esi
 
+        movl    %edi, %eax
+        movl    %esi, %ebp
+
+        movl    %edx, %edi
         movl    $1024, %ecx
         rep ; movsl
-        jmp     0b
 
-3:
-
-        /* To be certain of avoiding problems with self-modifying code
-         * I need to execute a serializing instruction here.
-         * So I flush the TLB, it's handy, and not processor dependent.
-         */
-        xorl    %eax, %eax
-        movl    %eax, %cr3
+        movl    %ebp, %edi
+        movl    %eax, %esi
+        movl    $1024, %ecx
+        rep ; movsl
 
-        /* set all of the registers to known values */
-        /* leave %esp alone */
+        movl    %eax, %edi
+        movl    %edx, %esi
+        movl    $1024, %ecx
+        rep ; movsl
 
-        xorl    %eax, %eax
-        xorl    %ebx, %ebx
-        xorl    %ecx, %ecx
-        xorl    %edx, %edx
-        xorl    %esi, %esi
-        xorl    %edi, %edi
-        xorl    %ebp, %ebp
+        lea     PAGE_SIZE(%ebp), %esi
+        jmp     0b
+3:
+        popl    %esi
+        popl    %edi
+        popl    %ebx
+        popl    %ebp
         ret
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index b4aacb9f52e3..68b48e3fbcbd 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -597,13 +597,21 @@ void __init setup_arch(char **cmdline_p)
         memcpy(&boot_cpu_data, &new_cpu_data, sizeof(new_cpu_data));
         visws_early_detect();
         pre_setup_arch_hook();
-        early_cpu_init();
 #else
         printk(KERN_INFO "Command line: %s\n", boot_command_line);
 #endif
 
+        early_cpu_init();
         early_ioremap_init();
 
+#if defined(CONFIG_VMI) && defined(CONFIG_X86_32)
+        /*
+         * Must be before kernel pagetables are setup
+         * or fixmap area is touched.
+         */
+        vmi_init();
+#endif
+
         ROOT_DEV = old_decode_dev(boot_params.hdr.root_dev);
         screen_info = boot_params.screen_info;
         edid_info = boot_params.edid_info;
@@ -665,9 +673,6 @@ void __init setup_arch(char **cmdline_p)
         bss_resource.start = virt_to_phys(&__bss_start);
         bss_resource.end = virt_to_phys(&__bss_stop)-1;
 
-#ifdef CONFIG_X86_64
-        early_cpu_init();
-#endif
         strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
         *cmdline_p = command_line;
 
@@ -791,10 +796,6 @@ void __init setup_arch(char **cmdline_p)
 
         initmem_init(0, max_pfn);
 
-#ifdef CONFIG_X86_64
-        dma32_reserve_bootmem();
-#endif
-
 #ifdef CONFIG_ACPI_SLEEP
         /*
          * Reserve low memory region for sleep support.
@@ -809,20 +810,21 @@ void __init setup_arch(char **cmdline_p)
 #endif
         reserve_crashkernel();
 
+#ifdef CONFIG_X86_64
+        /*
+         * dma32_reserve_bootmem() allocates bootmem which may conflict
+         * with the crashkernel command line, so do that after
+         * reserve_crashkernel()
+         */
+        dma32_reserve_bootmem();
+#endif
+
         reserve_ibft_region();
 
 #ifdef CONFIG_KVM_CLOCK
         kvmclock_init();
 #endif
 
-#if defined(CONFIG_VMI) && defined(CONFIG_X86_32)
-        /*
-         * Must be after max_low_pfn is determined, and before kernel
-         * pagetables are setup.
-         */
-        vmi_init();
-#endif
-
         paravirt_pagetable_setup_start(swapper_pg_dir);
         paging_init();
         paravirt_pagetable_setup_done(swapper_pg_dir);
@@ -859,12 +861,6 @@ void __init setup_arch(char **cmdline_p)
         init_apic_mappings();
         ioapic_init_mappings();
 
-#if defined(CONFIG_SMP) && defined(CONFIG_X86_PC) && defined(CONFIG_X86_32)
-        if (def_to_bigsmp)
-                printk(KERN_WARNING "More than 8 CPUs detected and "
-                        "CONFIG_X86_PC cannot handle it.\nUse "
-                        "CONFIG_X86_GENERICARCH or CONFIG_X86_BIGSMP.\n");
-#endif
         kvm_guest_init();
 
         e820_reserve_resources();
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index f7745f94c006..76e305e064f9 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -80,24 +80,6 @@ static void __init setup_per_cpu_maps(void)
 #endif
 }
 
-#ifdef CONFIG_HAVE_CPUMASK_OF_CPU_MAP
-cpumask_t *cpumask_of_cpu_map __read_mostly;
-EXPORT_SYMBOL(cpumask_of_cpu_map);
-
-/* requires nr_cpu_ids to be initialized */
-static void __init setup_cpumask_of_cpu(void)
-{
-        int i;
-
-        /* alloc_bootmem zeroes memory */
-        cpumask_of_cpu_map = alloc_bootmem_low(sizeof(cpumask_t) * nr_cpu_ids);
-        for (i = 0; i < nr_cpu_ids; i++)
-                cpu_set(i, cpumask_of_cpu_map[i]);
-}
-#else
-static inline void setup_cpumask_of_cpu(void) { }
-#endif
-
 #ifdef CONFIG_X86_32
 /*
  * Great future not-so-futuristic plan: make i386 and x86_64 do it
@@ -197,9 +179,6 @@ void __init setup_per_cpu_areas(void)
 
         /* Setup node to cpumask map */
         setup_node_to_cpumask_map();
-
-        /* Setup cpumask_of_cpu map */
-        setup_cpumask_of_cpu();
 }
 
 #endif
diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
index 07faaa5109cb..6fb5bcdd8933 100644
--- a/arch/x86/kernel/signal_32.c
+++ b/arch/x86/kernel/signal_32.c
@@ -661,8 +661,5 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
         if (thread_info_flags & _TIF_SIGPENDING)
                 do_signal(regs);
 
-        if (thread_info_flags & _TIF_HRTICK_RESCHED)
-                hrtick_resched();
-
         clear_thread_flag(TIF_IRET);
 }
diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
index bf87684474f1..b45ef8ddd651 100644
--- a/arch/x86/kernel/signal_64.c
+++ b/arch/x86/kernel/signal_64.c
@@ -53,6 +53,59 @@ sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
         return do_sigaltstack(uss, uoss, regs->sp);
 }
 
+/*
+ * Signal frame handlers.
+ */
+
+static inline int save_i387(struct _fpstate __user *buf)
+{
+        struct task_struct *tsk = current;
+        int err = 0;
+
+        BUILD_BUG_ON(sizeof(struct user_i387_struct) !=
+                        sizeof(tsk->thread.xstate->fxsave));
+
+        if ((unsigned long)buf % 16)
+                printk("save_i387: bad fpstate %p\n", buf);
+
+        if (!used_math())
+                return 0;
+        clear_used_math(); /* trigger finit */
+        if (task_thread_info(tsk)->status & TS_USEDFPU) {
+                err = save_i387_checking((struct i387_fxsave_struct __user *)
+                                         buf);
+                if (err)
+                        return err;
+                task_thread_info(tsk)->status &= ~TS_USEDFPU;
+                stts();
+        } else {
+                if (__copy_to_user(buf, &tsk->thread.xstate->fxsave,
+                                   sizeof(struct i387_fxsave_struct)))
+                        return -1;
+        }
+        return 1;
+}
+
+/*
+ * This restores directly out of user space. Exceptions are handled.
+ */
+static inline int restore_i387(struct _fpstate __user *buf)
+{
+        struct task_struct *tsk = current;
+        int err;
+
+        if (!used_math()) {
+                err = init_fpu(tsk);
+                if (err)
+                        return err;
+        }
+
+        if (!(task_thread_info(current)->status & TS_USEDFPU)) {
+                clts();
+                task_thread_info(current)->status |= TS_USEDFPU;
+        }
+        return restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
+}
 
 /*
  * Do a signal return; undo the signal stack.
@@ -496,9 +549,6 @@ void do_notify_resume(struct pt_regs *regs, void *unused,
         /* deal with pending signal delivery */
         if (thread_info_flags & _TIF_SIGPENDING)
                 do_signal(regs);
-
-        if (thread_info_flags & _TIF_HRTICK_RESCHED)
-                hrtick_resched();
 }
 
 void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 4b53a647bc0a..91055d7fc1b0 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -326,12 +326,16 @@ static void __cpuinit start_secondary(void *unused)
          * for which cpus receive the IPI. Holding this
          * lock helps us to not include this cpu in a currently in progress
          * smp_call_function().
+         *
+         * We need to hold vector_lock so there the set of online cpus
+         * does not change while we are assigning vectors to cpus.  Holding
+         * this lock ensures we don't half assign or remove an irq from a cpu.
          */
         ipi_call_lock_irq();
-#ifdef CONFIG_X86_IO_APIC
-        setup_vector_irq(smp_processor_id());
-#endif
+        lock_vector_lock();
+        __setup_vector_irq(smp_processor_id());
         cpu_set(smp_processor_id(), cpu_online_map);
+        unlock_vector_lock();
         ipi_call_unlock_irq();
         per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
 
@@ -438,7 +442,7 @@ void __cpuinit set_cpu_sibling_map(int cpu)
         cpu_set(cpu, cpu_sibling_setup_map);
 
         if (smp_num_siblings > 1) {
-                for_each_cpu_mask(i, cpu_sibling_setup_map) {
+                for_each_cpu_mask_nr(i, cpu_sibling_setup_map) {
                         if (c->phys_proc_id == cpu_data(i).phys_proc_id &&
                             c->cpu_core_id == cpu_data(i).cpu_core_id) {
                                 cpu_set(i, per_cpu(cpu_sibling_map, cpu));
@@ -461,7 +465,7 @@ void __cpuinit set_cpu_sibling_map(int cpu)
                 return;
         }
 
-        for_each_cpu_mask(i, cpu_sibling_setup_map) {
+        for_each_cpu_mask_nr(i, cpu_sibling_setup_map) {
                 if (per_cpu(cpu_llc_id, cpu) != BAD_APICID &&
                     per_cpu(cpu_llc_id, cpu) == per_cpu(cpu_llc_id, i)) {
                         cpu_set(i, c->llc_shared_map);
@@ -990,7 +994,17 @@ int __cpuinit native_cpu_up(unsigned int cpu)
         flush_tlb_all();
         low_mappings = 1;
 
+#ifdef CONFIG_X86_PC
+        if (def_to_bigsmp && apicid > 8) {
+                printk(KERN_WARNING
+                        "More than 8 CPUs detected - skipping them.\n"
+                        "Use CONFIG_X86_GENERICARCH and CONFIG_X86_BIGSMP.\n");
+                err = -1;
+        } else
+                err = do_boot_cpu(apicid, cpu);
+#else
         err = do_boot_cpu(apicid, cpu);
+#endif
 
         zap_low_mappings();
         low_mappings = 0;
@@ -1219,7 +1233,7 @@ static void remove_siblinginfo(int cpu)
         int sibling;
         struct cpuinfo_x86 *c = &cpu_data(cpu);
 
-        for_each_cpu_mask(sibling, per_cpu(cpu_core_map, cpu)) {
+        for_each_cpu_mask_nr(sibling, per_cpu(cpu_core_map, cpu)) {
                 cpu_clear(cpu, per_cpu(cpu_core_map, sibling));
                 /*/
                  * last thread sibling in this cpu core going down
@@ -1228,7 +1242,7 @@ static void remove_siblinginfo(int cpu)
                         cpu_data(sibling).booted_cores--;
         }
 
-        for_each_cpu_mask(sibling, per_cpu(cpu_sibling_map, cpu))
+        for_each_cpu_mask_nr(sibling, per_cpu(cpu_sibling_map, cpu))
                 cpu_clear(cpu, per_cpu(cpu_sibling_map, sibling));
         cpus_clear(per_cpu(cpu_sibling_map, cpu));
         cpus_clear(per_cpu(cpu_core_map, cpu));
@@ -1336,7 +1350,9 @@ int __cpu_disable(void)
         remove_siblinginfo(cpu);
 
         /* It's now safe to remove this processor from the online map */
+        lock_vector_lock();
         remove_cpu_from_maps(cpu);
+        unlock_vector_lock();
         fixup_irqs(cpu_online_map);
         return 0;
 }
diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
index adff5562f5fd..d44395ff34c3 100644
--- a/arch/x86/kernel/syscall_table_32.S
+++ b/arch/x86/kernel/syscall_table_32.S
@@ -326,3 +326,9 @@ ENTRY(sys_call_table)
         .long sys_fallocate
         .long sys_timerfd_settime       /* 325 */
         .long sys_timerfd_gettime
+        .long sys_signalfd4
+        .long sys_eventfd2
+        .long sys_epoll_create1
+        .long sys_dup3                  /* 330 */
+        .long sys_pipe2
+        .long sys_inotify_init1
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index 0a1b1a9d922d..6ca515d6db54 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -37,6 +37,7 @@
 #include <asm/timer.h>
 #include <asm/vmi_time.h>
 #include <asm/kmap_types.h>
+#include <asm/setup.h>
 
 /* Convenient for calling VMI functions indirectly in the ROM */
 typedef u32 __attribute__((regparm(1))) (VROMFUNC)(void);
@@ -683,7 +684,7 @@ void vmi_bringup(void)
 {
         /* We must establish the lowmem mapping for MMU ops to work */
         if (vmi_ops.set_linear_mapping)
-                vmi_ops.set_linear_mapping(0, (void *)__PAGE_OFFSET, max_low_pfn, 0);
+                vmi_ops.set_linear_mapping(0, (void *)__PAGE_OFFSET, MAXMEM_PFN, 0);
 }
 
 /*
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 8d45fabc5f3b..ce3251ce5504 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -21,6 +21,7 @@ config KVM
         tristate "Kernel-based Virtual Machine (KVM) support"
         depends on HAVE_KVM
         select PREEMPT_NOTIFIERS
+        select MMU_NOTIFIER
         select ANON_INODES
         ---help---
           Support hosting fully virtualized guest machines using hardware
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index b0e4ddca6c18..0bfe2bd305eb 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -653,6 +653,84 @@ static void rmap_write_protect(struct kvm *kvm, u64 gfn)
         account_shadowed(kvm, gfn);
 }
 
+static int kvm_unmap_rmapp(struct kvm *kvm, unsigned long *rmapp)
+{
+        u64 *spte;
+        int need_tlb_flush = 0;
+
+        while ((spte = rmap_next(kvm, rmapp, NULL))) {
+                BUG_ON(!(*spte & PT_PRESENT_MASK));
+                rmap_printk("kvm_rmap_unmap_hva: spte %p %llx\n", spte, *spte);
+                rmap_remove(kvm, spte);
+                set_shadow_pte(spte, shadow_trap_nonpresent_pte);
+                need_tlb_flush = 1;
+        }
+        return need_tlb_flush;
+}
+
+static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
+                          int (*handler)(struct kvm *kvm, unsigned long *rmapp))
+{
+        int i;
+        int retval = 0;
+
+        /*
+         * If mmap_sem isn't taken, we can look the memslots with only
+         * the mmu_lock by skipping over the slots with userspace_addr == 0.
+         */
+        for (i = 0; i < kvm->nmemslots; i++) {
+                struct kvm_memory_slot *memslot = &kvm->memslots[i];
+                unsigned long start = memslot->userspace_addr;
+                unsigned long end;
+
+                /* mmu_lock protects userspace_addr */
+                if (!start)
+                        continue;
+
+                end = start + (memslot->npages << PAGE_SHIFT);
+                if (hva >= start && hva < end) {
+                        gfn_t gfn_offset = (hva - start) >> PAGE_SHIFT;
+                        retval |= handler(kvm, &memslot->rmap[gfn_offset]);
+                        retval |= handler(kvm,
+                                          &memslot->lpage_info[
+                                                  gfn_offset /
+                                                  KVM_PAGES_PER_HPAGE].rmap_pde);
+                }
+        }
+
+        return retval;
+}
+
+int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
+{
+        return kvm_handle_hva(kvm, hva, kvm_unmap_rmapp);
+}
+
+static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp)
+{
+        u64 *spte;
+        int young = 0;
+
+        spte = rmap_next(kvm, rmapp, NULL);
+        while (spte) {
+                int _young;
+                u64 _spte = *spte;
+                BUG_ON(!(_spte & PT_PRESENT_MASK));
+                _young = _spte & PT_ACCESSED_MASK;
+                if (_young) {
+                        young = 1;
+                        clear_bit(PT_ACCESSED_SHIFT, (unsigned long *)spte);
+                }
+                spte = rmap_next(kvm, rmapp, spte);
+        }
+        return young;
+}
+
+int kvm_age_hva(struct kvm *kvm, unsigned long hva)
+{
+        return kvm_handle_hva(kvm, hva, kvm_age_rmapp);
+}
+
 #ifdef MMU_DEBUG
 static int is_empty_shadow_page(u64 *spt)
 {
@@ -1203,6 +1281,7 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, int write, gfn_t gfn)
         int r;
         int largepage = 0;
         pfn_t pfn;
+        unsigned long mmu_seq;
 
         down_read(&current->mm->mmap_sem);
         if (is_largepage_backed(vcpu, gfn & ~(KVM_PAGES_PER_HPAGE-1))) {
@@ -1210,6 +1289,8 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, int write, gfn_t gfn)
                 largepage = 1;
         }
 
+        mmu_seq = vcpu->kvm->mmu_notifier_seq;
+        /* implicit mb(), we'll read before PT lock is unlocked */
         pfn = gfn_to_pfn(vcpu->kvm, gfn);
         up_read(&current->mm->mmap_sem);
 
@@ -1220,6 +1301,8 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, int write, gfn_t gfn)
         }
 
         spin_lock(&vcpu->kvm->mmu_lock);
+        if (mmu_notifier_retry(vcpu, mmu_seq))
+                goto out_unlock;
         kvm_mmu_free_some_pages(vcpu);
         r = __direct_map(vcpu, v, write, largepage, gfn, pfn,
                          PT32E_ROOT_LEVEL);
@@ -1227,6 +1310,11 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, int write, gfn_t gfn)
 
 
         return r;
+
+out_unlock:
+        spin_unlock(&vcpu->kvm->mmu_lock);
+        kvm_release_pfn_clean(pfn);
+        return 0;
 }
 
 
@@ -1345,6 +1433,7 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa,
         int r;
         int largepage = 0;
         gfn_t gfn = gpa >> PAGE_SHIFT;
+        unsigned long mmu_seq;
 
         ASSERT(vcpu);
         ASSERT(VALID_PAGE(vcpu->arch.mmu.root_hpa));
@@ -1358,6 +1447,8 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa,
                 gfn &= ~(KVM_PAGES_PER_HPAGE-1);
                 largepage = 1;
         }
+        mmu_seq = vcpu->kvm->mmu_notifier_seq;
+        /* implicit mb(), we'll read before PT lock is unlocked */
         pfn = gfn_to_pfn(vcpu->kvm, gfn);
         up_read(&current->mm->mmap_sem);
         if (is_error_pfn(pfn)) {
@@ -1365,12 +1456,19 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa,
                 return 1;
         }
         spin_lock(&vcpu->kvm->mmu_lock);
+        if (mmu_notifier_retry(vcpu, mmu_seq))
+                goto out_unlock;
         kvm_mmu_free_some_pages(vcpu);
         r = __direct_map(vcpu, gpa, error_code & PFERR_WRITE_MASK,
                          largepage, gfn, pfn, kvm_x86_ops->get_tdp_level());
         spin_unlock(&vcpu->kvm->mmu_lock);
 
         return r;
+
+out_unlock:
+        spin_unlock(&vcpu->kvm->mmu_lock);
+        kvm_release_pfn_clean(pfn);
+        return 0;
 }
 
 static void nonpaging_free(struct kvm_vcpu *vcpu)
@@ -1670,6 +1768,8 @@ static void mmu_guess_page_from_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
                 gfn &= ~(KVM_PAGES_PER_HPAGE-1);
                 vcpu->arch.update_pte.largepage = 1;
         }
+        vcpu->arch.update_pte.mmu_seq = vcpu->kvm->mmu_notifier_seq;
+        /* implicit mb(), we'll read before PT lock is unlocked */
         pfn = gfn_to_pfn(vcpu->kvm, gfn);
         up_read(&current->mm->mmap_sem);
 
@@ -1814,6 +1914,7 @@ int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
         spin_unlock(&vcpu->kvm->mmu_lock);
         return r;
 }
+EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page_virt);
 
 void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
 {
@@ -1870,6 +1971,12 @@ void kvm_enable_tdp(void)
 }
 EXPORT_SYMBOL_GPL(kvm_enable_tdp);
 
+void kvm_disable_tdp(void)
+{
+        tdp_enabled = false;
+}
+EXPORT_SYMBOL_GPL(kvm_disable_tdp);
+
 static void free_mmu_pages(struct kvm_vcpu *vcpu)
 {
         struct kvm_mmu_page *sp;
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 4d918220baeb..f72ac1fa35f0 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -263,6 +263,8 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
         pfn = vcpu->arch.update_pte.pfn;
         if (is_error_pfn(pfn))
                 return;
+        if (mmu_notifier_retry(vcpu, vcpu->arch.update_pte.mmu_seq))
+                return;
         kvm_get_pfn(pfn);
         mmu_set_spte(vcpu, spte, page->role.access, pte_access, 0, 0,
                      gpte & PT_DIRTY_MASK, NULL, largepage, gpte_to_gfn(gpte),
@@ -380,6 +382,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         int r;
         pfn_t pfn;
         int largepage = 0;
+        unsigned long mmu_seq;
 
         pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
         kvm_mmu_audit(vcpu, "pre page fault");
@@ -413,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
                         largepage = 1;
                 }
         }
+        mmu_seq = vcpu->kvm->mmu_notifier_seq;
+        /* implicit mb(), we'll read before PT lock is unlocked */
         pfn = gfn_to_pfn(vcpu->kvm, walker.gfn);
         up_read(&current->mm->mmap_sem);
 
@@ -424,6 +429,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         }
 
         spin_lock(&vcpu->kvm->mmu_lock);
+        if (mmu_notifier_retry(vcpu, mmu_seq))
+                goto out_unlock;
         kvm_mmu_free_some_pages(vcpu);
         shadow_pte = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
                                   largepage, &write_pt, pfn);
@@ -439,6 +446,11 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         spin_unlock(&vcpu->kvm->mmu_lock);
 
         return write_pt;
+
+out_unlock:
+        spin_unlock(&vcpu->kvm->mmu_lock);
+        kvm_release_pfn_clean(pfn);
+        return 0;
 }
 
 static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index b756e876dce3..e2ee264740c7 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -453,7 +453,8 @@ static __init int svm_hardware_setup(void)
         if (npt_enabled) {
                 printk(KERN_INFO "kvm: Nested Paging enabled\n");
                 kvm_enable_tdp();
-        }
+        } else
+                kvm_disable_tdp();
 
         return 0;
 
@@ -1007,10 +1008,13 @@ static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
         struct kvm *kvm = svm->vcpu.kvm;
         u64 fault_address;
         u32 error_code;
+        bool event_injection = false;
 
         if (!irqchip_in_kernel(kvm) &&
-                is_external_interrupt(exit_int_info))
+            is_external_interrupt(exit_int_info)) {
+                event_injection = true;
                 push_irq(&svm->vcpu, exit_int_info & SVM_EVTINJ_VEC_MASK);
+        }
 
         fault_address  = svm->vmcb->control.exit_info_2;
         error_code = svm->vmcb->control.exit_info_1;
@@ -1024,6 +1028,8 @@ static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
                             (u32)fault_address, (u32)(fault_address >> 32),
                             handler);
 
+        if (event_injection)
+                kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
         return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
 }
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 0cac63701719..2a69773e3b26 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2298,6 +2298,8 @@ static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 cr2 = vmcs_readl(EXIT_QUALIFICATION);
                 KVMTRACE_3D(PAGE_FAULT, vcpu, error_code, (u32)cr2,
                             (u32)((u64)cr2 >> 32), handler);
+                if (vect_info & VECTORING_INFO_VALID_MASK)
+                        kvm_mmu_unprotect_page_virt(vcpu, cr2);
                 return kvm_mmu_page_fault(vcpu, cr2, error_code);
         }
 
@@ -3116,15 +3118,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
                 return ERR_PTR(-ENOMEM);
 
         allocate_vpid(vmx);
-        if (id == 0 && vm_need_ept()) {
-                kvm_mmu_set_base_ptes(VMX_EPT_READABLE_MASK |
-                        VMX_EPT_WRITABLE_MASK |
-                        VMX_EPT_DEFAULT_MT << VMX_EPT_MT_EPTE_SHIFT);
-                kvm_mmu_set_mask_ptes(0ull, VMX_EPT_FAKE_ACCESSED_MASK,
-                                VMX_EPT_FAKE_DIRTY_MASK, 0ull,
-                                VMX_EPT_EXECUTABLE_MASK);
-                kvm_enable_tdp();
-        }
 
         err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
         if (err)
@@ -3303,8 +3296,17 @@ static int __init vmx_init(void)
         vmx_disable_intercept_for_msr(vmx_msr_bitmap, MSR_IA32_SYSENTER_ESP);
         vmx_disable_intercept_for_msr(vmx_msr_bitmap, MSR_IA32_SYSENTER_EIP);
 
-        if (cpu_has_vmx_ept())
+        if (vm_need_ept()) {
                 bypass_guest_pf = 0;
+                kvm_mmu_set_base_ptes(VMX_EPT_READABLE_MASK |
+                        VMX_EPT_WRITABLE_MASK |
+                        VMX_EPT_DEFAULT_MT << VMX_EPT_MT_EPTE_SHIFT);
+                kvm_mmu_set_mask_ptes(0ull, VMX_EPT_FAKE_ACCESSED_MASK,
+                                VMX_EPT_FAKE_DIRTY_MASK, 0ull,
+                                VMX_EPT_EXECUTABLE_MASK);
+                kvm_enable_tdp();
+        } else
+                kvm_disable_tdp();
 
         if (bypass_guest_pf)
                 kvm_mmu_set_nonpresent_ptes(~0xffeull, 0ull);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9f1cdb011cff..0d682fc6aeb3 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -883,6 +883,7 @@ int kvm_dev_ioctl_check_extension(long ext)
         case KVM_CAP_PIT:
         case KVM_CAP_NOP_IO_DELAY:
         case KVM_CAP_MP_STATE:
+        case KVM_CAP_SYNC_MMU:
                 r = 1;
                 break;
         case KVM_CAP_COALESCED_MMIO:
@@ -1495,6 +1496,7 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
                 goto out;
 
         down_write(&kvm->slots_lock);
+        spin_lock(&kvm->mmu_lock);
 
         p = &kvm->arch.aliases[alias->slot];
         p->base_gfn = alias->guest_phys_addr >> PAGE_SHIFT;
@@ -1506,6 +1508,7 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
                         break;
         kvm->arch.naliases = n;
 
+        spin_unlock(&kvm->mmu_lock);
         kvm_mmu_zap_all(kvm);
 
         up_write(&kvm->slots_lock);
@@ -3184,6 +3187,10 @@ static void seg_desct_to_kvm_desct(struct desc_struct *seg_desc, u16 selector,
         kvm_desct->base |= seg_desc->base2 << 24;
         kvm_desct->limit = seg_desc->limit0;
         kvm_desct->limit |= seg_desc->limit << 16;
+        if (seg_desc->g) {
+                kvm_desct->limit <<= 12;
+                kvm_desct->limit |= 0xfff;
+        }
         kvm_desct->selector = selector;
         kvm_desct->type = seg_desc->type;
         kvm_desct->present = seg_desc->p;
@@ -3223,6 +3230,7 @@ static void get_segment_descritptor_dtable(struct kvm_vcpu *vcpu,
 static int load_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
                                          struct desc_struct *seg_desc)
 {
+        gpa_t gpa;
         struct descriptor_table dtable;
         u16 index = selector >> 3;
 
@@ -3232,13 +3240,16 @@ static int load_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
                 kvm_queue_exception_e(vcpu, GP_VECTOR, selector & 0xfffc);
                 return 1;
         }
-        return kvm_read_guest(vcpu->kvm, dtable.base + index * 8, seg_desc, 8);
+        gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, dtable.base);
+        gpa += index * 8;
+        return kvm_read_guest(vcpu->kvm, gpa, seg_desc, 8);
 }
 
 /* allowed just for 8 bytes segments */
 static int save_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
                                          struct desc_struct *seg_desc)
 {
+        gpa_t gpa;
         struct descriptor_table dtable;
         u16 index = selector >> 3;
 
@@ -3246,7 +3257,9 @@ static int save_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
 
         if (dtable.limit < index * 8 + 7)
                 return 1;
-        return kvm_write_guest(vcpu->kvm, dtable.base + index * 8, seg_desc, 8);
+        gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, dtable.base);
+        gpa += index * 8;
+        return kvm_write_guest(vcpu->kvm, gpa, seg_desc, 8);
 }
 
 static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
@@ -3258,55 +3271,7 @@ static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
         base_addr |= (seg_desc->base1 << 16);
         base_addr |= (seg_desc->base2 << 24);
 
-        return base_addr;
-}
-
-static int load_tss_segment32(struct kvm_vcpu *vcpu,
-                              struct desc_struct *seg_desc,
-                              struct tss_segment_32 *tss)
-{
-        u32 base_addr;
-
-        base_addr = get_tss_base_addr(vcpu, seg_desc);
-
-        return kvm_read_guest(vcpu->kvm, base_addr, tss,
-                              sizeof(struct tss_segment_32));
-}
-
-static int save_tss_segment32(struct kvm_vcpu *vcpu,
-                              struct desc_struct *seg_desc,
-                              struct tss_segment_32 *tss)
-{
-        u32 base_addr;
-
-        base_addr = get_tss_base_addr(vcpu, seg_desc);
-
-        return kvm_write_guest(vcpu->kvm, base_addr, tss,
-                               sizeof(struct tss_segment_32));
-}
-
-static int load_tss_segment16(struct kvm_vcpu *vcpu,
-                              struct desc_struct *seg_desc,
-                              struct tss_segment_16 *tss)
-{
-        u32 base_addr;
-
-        base_addr = get_tss_base_addr(vcpu, seg_desc);
-
-        return kvm_read_guest(vcpu->kvm, base_addr, tss,
-                              sizeof(struct tss_segment_16));
-}
-
-static int save_tss_segment16(struct kvm_vcpu *vcpu,
-                              struct desc_struct *seg_desc,
-                              struct tss_segment_16 *tss)
-{
-        u32 base_addr;
-
-        base_addr = get_tss_base_addr(vcpu, seg_desc);
-
-        return kvm_write_guest(vcpu->kvm, base_addr, tss,
-                               sizeof(struct tss_segment_16));
+        return vcpu->arch.mmu.gva_to_gpa(vcpu, base_addr);
 }
 
 static u16 get_segment_selector(struct kvm_vcpu *vcpu, int seg)
@@ -3466,20 +3431,26 @@ static int load_state_from_tss16(struct kvm_vcpu *vcpu,
 }
 
 static int kvm_task_switch_16(struct kvm_vcpu *vcpu, u16 tss_selector,
-                       struct desc_struct *cseg_desc,
+                       u32 old_tss_base,
                        struct desc_struct *nseg_desc)
 {
         struct tss_segment_16 tss_segment_16;
         int ret = 0;
 
-        if (load_tss_segment16(vcpu, cseg_desc, &tss_segment_16))
+        if (kvm_read_guest(vcpu->kvm, old_tss_base, &tss_segment_16,
+                           sizeof tss_segment_16))
                 goto out;
 
         save_state_to_tss16(vcpu, &tss_segment_16);
-        save_tss_segment16(vcpu, cseg_desc, &tss_segment_16);
 
-        if (load_tss_segment16(vcpu, nseg_desc, &tss_segment_16))
+        if (kvm_write_guest(vcpu->kvm, old_tss_base, &tss_segment_16,
+                            sizeof tss_segment_16))
+                goto out;
+
+        if (kvm_read_guest(vcpu->kvm, get_tss_base_addr(vcpu, nseg_desc),
+                           &tss_segment_16, sizeof tss_segment_16))
                 goto out;
+
         if (load_state_from_tss16(vcpu, &tss_segment_16))
                 goto out;
 
@@ -3489,20 +3460,26 @@ out:
 }
 
 static int kvm_task_switch_32(struct kvm_vcpu *vcpu, u16 tss_selector,
-                       struct desc_struct *cseg_desc,
+                       u32 old_tss_base,
                        struct desc_struct *nseg_desc)
 {
         struct tss_segment_32 tss_segment_32;
         int ret = 0;
 
-        if (load_tss_segment32(vcpu, cseg_desc, &tss_segment_32))
+        if (kvm_read_guest(vcpu->kvm, old_tss_base, &tss_segment_32,
+                           sizeof tss_segment_32))
                 goto out;
 
         save_state_to_tss32(vcpu, &tss_segment_32);
-        save_tss_segment32(vcpu, cseg_desc, &tss_segment_32);
 
-        if (load_tss_segment32(vcpu, nseg_desc, &tss_segment_32))
+        if (kvm_write_guest(vcpu->kvm, old_tss_base, &tss_segment_32,
+                            sizeof tss_segment_32))
                 goto out;
+
+        if (kvm_read_guest(vcpu->kvm, get_tss_base_addr(vcpu, nseg_desc),
+                           &tss_segment_32, sizeof tss_segment_32))
+                goto out;
+
         if (load_state_from_tss32(vcpu, &tss_segment_32))
                 goto out;
 
@@ -3517,16 +3494,20 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
         struct desc_struct cseg_desc;
         struct desc_struct nseg_desc;
         int ret = 0;
+        u32 old_tss_base = get_segment_base(vcpu, VCPU_SREG_TR);
+        u16 old_tss_sel = get_segment_selector(vcpu, VCPU_SREG_TR);
 
-        kvm_get_segment(vcpu, &tr_seg, VCPU_SREG_TR);
+        old_tss_base = vcpu->arch.mmu.gva_to_gpa(vcpu, old_tss_base);
 
+        /* FIXME: Handle errors. Failure to read either TSS or their
+         * descriptors should generate a pagefault.
+         */
         if (load_guest_segment_descriptor(vcpu, tss_selector, &nseg_desc))
                 goto out;
 
-        if (load_guest_segment_descriptor(vcpu, tr_seg.selector, &cseg_desc))
+        if (load_guest_segment_descriptor(vcpu, old_tss_sel, &cseg_desc))
                 goto out;
 
-
         if (reason != TASK_SWITCH_IRET) {
                 int cpl;
 
@@ -3544,8 +3525,7 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
 
         if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
                 cseg_desc.type &= ~(1 << 1); //clear the B flag
-                save_guest_segment_descriptor(vcpu, tr_seg.selector,
-                                              &cseg_desc);
+                save_guest_segment_descriptor(vcpu, old_tss_sel, &cseg_desc);
         }
 
         if (reason == TASK_SWITCH_IRET) {
@@ -3557,10 +3537,10 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
         kvm_x86_ops->cache_regs(vcpu);
 
         if (nseg_desc.type & 8)
-                ret = kvm_task_switch_32(vcpu, tss_selector, &cseg_desc,
+                ret = kvm_task_switch_32(vcpu, tss_selector, old_tss_base,
                                          &nseg_desc);
         else
-                ret = kvm_task_switch_16(vcpu, tss_selector, &cseg_desc,
+                ret = kvm_task_switch_16(vcpu, tss_selector, old_tss_base,
                                          &nseg_desc);
 
         if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE) {
@@ -3995,16 +3975,23 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
          */
         if (!user_alloc) {
                 if (npages && !old.rmap) {
+                        unsigned long userspace_addr;
+
                         down_write(&current->mm->mmap_sem);
-                        memslot->userspace_addr = do_mmap(NULL, 0,
-                                                     npages * PAGE_SIZE,
-                                                     PROT_READ | PROT_WRITE,
-                                                     MAP_SHARED | MAP_ANONYMOUS,
-                                                     0);
+                        userspace_addr = do_mmap(NULL, 0,
+                                                 npages * PAGE_SIZE,
+                                                 PROT_READ | PROT_WRITE,
+                                                 MAP_SHARED | MAP_ANONYMOUS,
+                                                 0);
                         up_write(&current->mm->mmap_sem);
 
-                        if (IS_ERR((void *)memslot->userspace_addr))
-                                return PTR_ERR((void *)memslot->userspace_addr);
+                        if (IS_ERR((void *)userspace_addr))
+                                return PTR_ERR((void *)userspace_addr);
+
+                        /* set userspace_addr atomically for kvm_hva_to_rmapp */
+                        spin_lock(&kvm->mmu_lock);
+                        memslot->userspace_addr = userspace_addr;
+                        spin_unlock(&kvm->mmu_lock);
                 } else {
                         if (!old.user_alloc && old.rmap) {
                                 int ret;
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 0313a5eec412..d9249a882aa5 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -1014,6 +1014,9 @@ __init void lguest_init(void)
         init_pg_tables_start = __pa(pg0);
         init_pg_tables_end = __pa(pg0);
 
+        /* As described in head_32.S, we map the first 128M of memory. */
+        max_pfn_mapped = (128*1024*1024) >> PAGE_SHIFT;
+
         /* Load the %fs segment register (the per-cpu segment register) with
          * the normal data segment to get through booting. */
         asm volatile ("mov %0, %%fs" : : "r" (__KERNEL_DS) : "memory");
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index dfdf428975c0..f118c110af32 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -52,7 +52,7 @@
         jnz 100b
 102:
         .section .fixup,"ax"
-103:    addl %r8d,%edx                  /* ecx is zerorest also */
+103:    addl %ecx,%edx                  /* ecx is zerorest also */
         jmp copy_user_handle_tail
         .previous
 
diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
index 40e0e309d27e..cb0c112386fb 100644
--- a/arch/x86/lib/copy_user_nocache_64.S
+++ b/arch/x86/lib/copy_user_nocache_64.S
@@ -32,7 +32,7 @@
         jnz 100b
 102:
         .section .fixup,"ax"
-103:    addl %r8d,%edx                  /* ecx is zerorest also */
+103:    addl %ecx,%edx                  /* ecx is zerorest also */
         jmp copy_user_handle_tail
         .previous
 
@@ -108,7 +108,6 @@ ENTRY(__copy_user_nocache)
         jmp 60f
 50:     movl %ecx,%edx
 60:     sfence
-        movl %r8d,%ecx
         jmp copy_user_handle_tail
         .previous
 
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index 1fbb844c3d7a..dfb932dcf136 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -1,5 +1,5 @@
 obj-y   :=  init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
-            pat.o pgtable.o
+            pat.o pgtable.o gup.o
 
 obj-$(CONFIG_X86_32)            += pgtable_32.o
 
diff --git a/arch/x86/mm/discontig_32.c b/arch/x86/mm/discontig_32.c
index 5dfef9fa061a..62fa440678d8 100644
--- a/arch/x86/mm/discontig_32.c
+++ b/arch/x86/mm/discontig_32.c
@@ -42,7 +42,6 @@
 
 struct pglist_data *node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
-static bootmem_data_t node0_bdata;
 
 /*
  * numa interface - we expect the numa architecture specific code to have
@@ -385,7 +384,7 @@ void __init initmem_init(unsigned long start_pfn,
         for_each_online_node(nid)
                 memset(NODE_DATA(nid), 0, sizeof(struct pglist_data));
 
-        NODE_DATA(0)->bdata = &node0_bdata;
+        NODE_DATA(0)->bdata = &bootmem_node_data[0];
         setup_bootmem_allocator();
 }
 
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
new file mode 100644
index 000000000000..007bb06c7504
--- /dev/null
+++ b/arch/x86/mm/gup.c
@@ -0,0 +1,298 @@
+/*
+ * Lockless get_user_pages_fast for x86
+ *
+ * Copyright (C) 2008 Nick Piggin
+ * Copyright (C) 2008 Novell Inc.
+ */
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/vmstat.h>
+#include <linux/highmem.h>
+
+#include <asm/pgtable.h>
+
+static inline pte_t gup_get_pte(pte_t *ptep)
+{
+#ifndef CONFIG_X86_PAE
+        return *ptep;
+#else
+        /*
+         * With get_user_pages_fast, we walk down the pagetables without taking
+         * any locks.  For this we would like to load the pointers atoimcally,
+         * but that is not possible (without expensive cmpxchg8b) on PAE.  What
+         * we do have is the guarantee that a pte will only either go from not
+         * present to present, or present to not present or both -- it will not
+         * switch to a completely different present page without a TLB flush in
+         * between; something that we are blocking by holding interrupts off.
+         *
+         * Setting ptes from not present to present goes:
+         * ptep->pte_high = h;
+         * smp_wmb();
+         * ptep->pte_low = l;
+         *
+         * And present to not present goes:
+         * ptep->pte_low = 0;
+         * smp_wmb();
+         * ptep->pte_high = 0;
+         *
+         * We must ensure here that the load of pte_low sees l iff pte_high
+         * sees h. We load pte_high *after* loading pte_low, which ensures we
+         * don't see an older value of pte_high.  *Then* we recheck pte_low,
+         * which ensures that we haven't picked up a changed pte high. We might
+         * have got rubbish values from pte_low and pte_high, but we are
+         * guaranteed that pte_low will not have the present bit set *unless*
+         * it is 'l'. And get_user_pages_fast only operates on present ptes, so
+         * we're safe.
+         *
+         * gup_get_pte should not be used or copied outside gup.c without being
+         * very careful -- it does not atomically load the pte or anything that
+         * is likely to be useful for you.
+         */
+        pte_t pte;
+
+retry:
+        pte.pte_low = ptep->pte_low;
+        smp_rmb();
+        pte.pte_high = ptep->pte_high;
+        smp_rmb();
+        if (unlikely(pte.pte_low != ptep->pte_low))
+                goto retry;
+
+        return pte;
+#endif
+}
+
+/*
+ * The performance critical leaf functions are made noinline otherwise gcc
+ * inlines everything into a single function which results in too much
+ * register pressure.
+ */
+static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        unsigned long mask;
+        pte_t *ptep;
+
+        mask = _PAGE_PRESENT|_PAGE_USER;
+        if (write)
+                mask |= _PAGE_RW;
+
+        ptep = pte_offset_map(&pmd, addr);
+        do {
+                pte_t pte = gup_get_pte(ptep);
+                struct page *page;
+
+                if ((pte_val(pte) & (mask | _PAGE_SPECIAL)) != mask) {
+                        pte_unmap(ptep);
+                        return 0;
+                }
+                VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+                page = pte_page(pte);
+                get_page(page);
+                pages[*nr] = page;
+                (*nr)++;
+
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
+        pte_unmap(ptep - 1);
+
+        return 1;
+}
+
+static inline void get_head_page_multiple(struct page *page, int nr)
+{
+        VM_BUG_ON(page != compound_head(page));
+        VM_BUG_ON(page_count(page) == 0);
+        atomic_add(nr, &page->_count);
+}
+
+static noinline int gup_huge_pmd(pmd_t pmd, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        unsigned long mask;
+        pte_t pte = *(pte_t *)&pmd;
+        struct page *head, *page;
+        int refs;
+
+        mask = _PAGE_PRESENT|_PAGE_USER;
+        if (write)
+                mask |= _PAGE_RW;
+        if ((pte_val(pte) & mask) != mask)
+                return 0;
+        /* hugepages are never "special" */
+        VM_BUG_ON(pte_val(pte) & _PAGE_SPECIAL);
+        VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+
+        refs = 0;
+        head = pte_page(pte);
+        page = head + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
+        do {
+                VM_BUG_ON(compound_head(page) != head);
+                pages[*nr] = page;
+                (*nr)++;
+                page++;
+                refs++;
+        } while (addr += PAGE_SIZE, addr != end);
+        get_head_page_multiple(head, refs);
+
+        return 1;
+}
+
+static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
+                int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        pmd_t *pmdp;
+
+        pmdp = pmd_offset(&pud, addr);
+        do {
+                pmd_t pmd = *pmdp;
+
+                next = pmd_addr_end(addr, end);
+                if (pmd_none(pmd))
+                        return 0;
+                if (unlikely(pmd_large(pmd))) {
+                        if (!gup_huge_pmd(pmd, addr, next, write, pages, nr))
+                                return 0;
+                } else {
+                        if (!gup_pte_range(pmd, addr, next, write, pages, nr))
+                                return 0;
+                }
+        } while (pmdp++, addr = next, addr != end);
+
+        return 1;
+}
+
+static noinline int gup_huge_pud(pud_t pud, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        unsigned long mask;
+        pte_t pte = *(pte_t *)&pud;
+        struct page *head, *page;
+        int refs;
+
+        mask = _PAGE_PRESENT|_PAGE_USER;
+        if (write)
+                mask |= _PAGE_RW;
+        if ((pte_val(pte) & mask) != mask)
+                return 0;
+        /* hugepages are never "special" */
+        VM_BUG_ON(pte_val(pte) & _PAGE_SPECIAL);
+        VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+
+        refs = 0;
+        head = pte_page(pte);
+        page = head + ((addr & ~PUD_MASK) >> PAGE_SHIFT);
+        do {
+                VM_BUG_ON(compound_head(page) != head);
+                pages[*nr] = page;
+                (*nr)++;
+                page++;
+                refs++;
+        } while (addr += PAGE_SIZE, addr != end);
+        get_head_page_multiple(head, refs);
+
+        return 1;
+}
+
+static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
+                        int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        pud_t *pudp;
+
+        pudp = pud_offset(&pgd, addr);
+        do {
+                pud_t pud = *pudp;
+
+                next = pud_addr_end(addr, end);
+                if (pud_none(pud))
+                        return 0;
+                if (unlikely(pud_large(pud))) {
+                        if (!gup_huge_pud(pud, addr, next, write, pages, nr))
+                                return 0;
+                } else {
+                        if (!gup_pmd_range(pud, addr, next, write, pages, nr))
+                                return 0;
+                }
+        } while (pudp++, addr = next, addr != end);
+
+        return 1;
+}
+
+int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                        struct page **pages)
+{
+        struct mm_struct *mm = current->mm;
+        unsigned long addr, len, end;
+        unsigned long next;
+        pgd_t *pgdp;
+        int nr = 0;
+
+        start &= PAGE_MASK;
+        addr = start;
+        len = (unsigned long) nr_pages << PAGE_SHIFT;
+        end = start + len;
+        if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+                                        start, len)))
+                goto slow_irqon;
+
+        /*
+         * XXX: batch / limit 'nr', to avoid large irq off latency
+         * needs some instrumenting to determine the common sizes used by
+         * important workloads (eg. DB2), and whether limiting the batch size
+         * will decrease performance.
+         *
+         * It seems like we're in the clear for the moment. Direct-IO is
+         * the main guy that batches up lots of get_user_pages, and even
+         * they are limited to 64-at-a-time which is not so many.
+         */
+        /*
+         * This doesn't prevent pagetable teardown, but does prevent
+         * the pagetables and pages from being freed on x86.
+         *
+         * So long as we atomically load page table pointers versus teardown
+         * (which we do on x86, with the above PAE exception), we can follow the
+         * address down to the the page and take a ref on it.
+         */
+        local_irq_disable();
+        pgdp = pgd_offset(mm, addr);
+        do {
+                pgd_t pgd = *pgdp;
+
+                next = pgd_addr_end(addr, end);
+                if (pgd_none(pgd))
+                        goto slow;
+                if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
+                        goto slow;
+        } while (pgdp++, addr = next, addr != end);
+        local_irq_enable();
+
+        VM_BUG_ON(nr != (end - start) >> PAGE_SHIFT);
+        return nr;
+
+        {
+                int ret;
+
+slow:
+                local_irq_enable();
+slow_irqon:
+                /* Try to get the remaining pages with get_user_pages */
+                start += nr << PAGE_SHIFT;
+                pages += nr;
+
+                down_read(&mm->mmap_sem);
+                ret = get_user_pages(current, mm, start,
+                        (end - start) >> PAGE_SHIFT, write, 0, pages, NULL);
+                up_read(&mm->mmap_sem);
+
+                /* Have to be a bit careful with return values */
+                if (nr > 0) {
+                        if (ret < 0)
+                                ret = nr;
+                        else
+                                ret += nr;
+                }
+
+                return ret;
+        }
+}
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 0b3d567e686d..8f307d914c2e 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -124,7 +124,8 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
         return 1;
 }
 
-pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr)
+pte_t *huge_pte_alloc(struct mm_struct *mm,
+                        unsigned long addr, unsigned long sz)
 {
         pgd_t *pgd;
         pud_t *pud;
@@ -133,9 +134,14 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr)
         pgd = pgd_offset(mm, addr);
         pud = pud_alloc(mm, pgd, addr);
         if (pud) {
-                if (pud_none(*pud))
-                        huge_pmd_share(mm, addr, pud);
-                pte = (pte_t *) pmd_alloc(mm, pud, addr);
+                if (sz == PUD_SIZE) {
+                        pte = (pte_t *)pud;
+                } else {
+                        BUG_ON(sz != PMD_SIZE);
+                        if (pud_none(*pud))
+                                huge_pmd_share(mm, addr, pud);
+                        pte = (pte_t *) pmd_alloc(mm, pud, addr);
+                }
         }
         BUG_ON(pte && !pte_none(*pte) && !pte_huge(*pte));
 
@@ -151,8 +157,11 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
         pgd = pgd_offset(mm, addr);
         if (pgd_present(*pgd)) {
                 pud = pud_offset(pgd, addr);
-                if (pud_present(*pud))
+                if (pud_present(*pud)) {
+                        if (pud_large(*pud))
+                                return (pte_t *)pud;
                         pmd = pmd_offset(pud, addr);
+                }
         }
         return (pte_t *) pmd;
 }
@@ -188,6 +197,11 @@ int pmd_huge(pmd_t pmd)
         return 0;
 }
 
+int pud_huge(pud_t pud)
+{
+        return 0;
+}
+
 struct page *
 follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                 pmd_t *pmd, int write)
@@ -208,6 +222,11 @@ int pmd_huge(pmd_t pmd)
         return !!(pmd_val(pmd) & _PAGE_PSE);
 }
 
+int pud_huge(pud_t pud)
+{
+        return !!(pud_val(pud) & _PAGE_PSE);
+}
+
 struct page *
 follow_huge_pmd(struct mm_struct *mm, unsigned long address,
                 pmd_t *pmd, int write)
@@ -216,9 +235,22 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 
         page = pte_page(*(pte_t *)pmd);
         if (page)
-                page += ((address & ~HPAGE_MASK) >> PAGE_SHIFT);
+                page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
+        return page;
+}
+
+struct page *
+follow_huge_pud(struct mm_struct *mm, unsigned long address,
+                pud_t *pud, int write)
+{
+        struct page *page;
+
+        page = pte_page(*(pte_t *)pud);
+        if (page)
+                page += ((address & ~PUD_MASK) >> PAGE_SHIFT);
         return page;
 }
+
 #endif
 
 /* x86_64 also uses this file */
@@ -228,6 +260,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
                 unsigned long addr, unsigned long len,
                 unsigned long pgoff, unsigned long flags)
 {
+        struct hstate *h = hstate_file(file);
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
         unsigned long start_addr;
@@ -240,7 +273,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
         }
 
 full_search:
-        addr = ALIGN(start_addr, HPAGE_SIZE);
+        addr = ALIGN(start_addr, huge_page_size(h));
 
         for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
                 /* At this point:  (!vma || addr < vma->vm_end). */
@@ -262,7 +295,7 @@ full_search:
                 }
                 if (addr + mm->cached_hole_size < vma->vm_start)
                         mm->cached_hole_size = vma->vm_start - addr;
-                addr = ALIGN(vma->vm_end, HPAGE_SIZE);
+                addr = ALIGN(vma->vm_end, huge_page_size(h));
         }
 }
 
@@ -270,6 +303,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
                 unsigned long addr0, unsigned long len,
                 unsigned long pgoff, unsigned long flags)
 {
+        struct hstate *h = hstate_file(file);
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma, *prev_vma;
         unsigned long base = mm->mmap_base, addr = addr0;
@@ -290,7 +324,7 @@ try_again:
                 goto fail;
 
         /* either no address requested or cant fit in requested address hole */
-        addr = (mm->free_area_cache - len) & HPAGE_MASK;
+        addr = (mm->free_area_cache - len) & huge_page_mask(h);
         do {
                 /*
                  * Lookup failure means no vma is above this address,
@@ -321,7 +355,7 @@ try_again:
                         largest_hole = vma->vm_start - addr;
 
                 /* try just below the current vma->vm_start */
-                addr = (vma->vm_start - len) & HPAGE_MASK;
+                addr = (vma->vm_start - len) & huge_page_mask(h);
         } while (len <= vma->vm_start);
 
 fail:
@@ -359,22 +393,23 @@ unsigned long
 hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 unsigned long len, unsigned long pgoff, unsigned long flags)
 {
+        struct hstate *h = hstate_file(file);
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
 
-        if (len & ~HPAGE_MASK)
+        if (len & ~huge_page_mask(h))
                 return -EINVAL;
         if (len > TASK_SIZE)
                 return -ENOMEM;
 
         if (flags & MAP_FIXED) {
-                if (prepare_hugepage_range(addr, len))
+                if (prepare_hugepage_range(file, addr, len))
                         return -EINVAL;
                 return addr;
         }
 
         if (addr) {
-                addr = ALIGN(addr, HPAGE_SIZE);
+                addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
                     (!vma || addr + len <= vma->vm_start))
@@ -390,3 +425,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
 
 #endif /*HAVE_ARCH_HUGETLB_UNMAPPED_AREA*/
 
+#ifdef CONFIG_X86_64
+static __init int setup_hugepagesz(char *opt)
+{
+        unsigned long ps = memparse(opt, &opt);
+        if (ps == PMD_SIZE) {
+                hugetlb_add_hstate(PMD_SHIFT - PAGE_SHIFT);
+        } else if (ps == PUD_SIZE && cpu_has_gbpages) {
+                hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
+        } else {
+                printk(KERN_ERR "hugepagesz: Unsupported page size %lu M\n",
+                        ps >> 20);
+                return 0;
+        }
+        return 1;
+}
+__setup("hugepagesz=", setup_hugepagesz);
+#endif
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index ec37121f6709..129618ca0ea2 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -86,43 +86,6 @@ early_param("gbpages", parse_direct_gbpages_on);
  * around without checking the pgd every time.
  */
 
-void show_mem(void)
-{
-        long i, total = 0, reserved = 0;
-        long shared = 0, cached = 0;
-        struct page *page;
-        pg_data_t *pgdat;
-
-        printk(KERN_INFO "Mem-info:\n");
-        show_free_areas();
-        for_each_online_pgdat(pgdat) {
-                for (i = 0; i < pgdat->node_spanned_pages; ++i) {
-                        /*
-                         * This loop can take a while with 256 GB and
-                         * 4k pages so defer the NMI watchdog:
-                         */
-                        if (unlikely(i % MAX_ORDER_NR_PAGES == 0))
-                                touch_nmi_watchdog();
-
-                        if (!pfn_valid(pgdat->node_start_pfn + i))
-                                continue;
-
-                        page = pfn_to_page(pgdat->node_start_pfn + i);
-                        total++;
-                        if (PageReserved(page))
-                                reserved++;
-                        else if (PageSwapCache(page))
-                                cached++;
-                        else if (page_count(page))
-                                shared += page_count(page) - 1;
-                }
-        }
-        printk(KERN_INFO "%lu pages of RAM\n",          total);
-        printk(KERN_INFO "%lu reserved pages\n",        reserved);
-        printk(KERN_INFO "%lu pages shared\n",          shared);
-        printk(KERN_INFO "%lu pages swap cached\n",     cached);
-}
-
 int after_bootmem;
 
 static __init void *spp_getpage(void)
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 24c1d3c30186..016f335bbeea 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -330,6 +330,14 @@ static void __iomem *ioremap_default(resource_size_t phys_addr,
         return (void __iomem *)ret;
 }
 
+void __iomem *ioremap_prot(resource_size_t phys_addr, unsigned long size,
+                                unsigned long prot_val)
+{
+        return __ioremap_caller(phys_addr, size, (prot_val & _PAGE_CACHE_MASK),
+                                __builtin_return_address(0));
+}
+EXPORT_SYMBOL(ioremap_prot);
+
 /**
  * iounmap - Free a IO remapping
  * @addr: virtual address from ioremap_*
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index 9782f42dd319..a4dd793d6003 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -23,8 +23,6 @@
 struct pglist_data *node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
 
-static bootmem_data_t plat_node_bdata[MAX_NUMNODES];
-
 struct memnode memnode;
 
 s16 apicid_to_node[MAX_LOCAL_APIC] __cpuinitdata = {
@@ -198,7 +196,7 @@ void __init setup_node_bootmem(int nodeid, unsigned long start,
                 nodedata_phys + pgdat_size - 1);
 
         memset(NODE_DATA(nodeid), 0, sizeof(pg_data_t));
-        NODE_DATA(nodeid)->bdata = &plat_node_bdata[nodeid];
+        NODE_DATA(nodeid)->bdata = &bootmem_node_data[nodeid];
         NODE_DATA(nodeid)->node_start_pfn = start_pfn;
         NODE_DATA(nodeid)->node_spanned_pages = last_pfn - start_pfn;
 
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 557b2abceef8..d50302774fe2 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -207,6 +207,9 @@ static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
         unsigned long addr;
         int i;
 
+        if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
+                return;
+
         pud = pud_offset(pgd, 0);
 
         for (addr = i = 0; i < PREALLOCATED_PMDS;
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index b4becbf8c570..cab0abbd1ebe 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -20,53 +20,6 @@
 #include <asm/tlb.h>
 #include <asm/tlbflush.h>
 
-void show_mem(void)
-{
-        int total = 0, reserved = 0;
-        int shared = 0, cached = 0;
-        int highmem = 0;
-        struct page *page;
-        pg_data_t *pgdat;
-        unsigned long i;
-        unsigned long flags;
-
-        printk(KERN_INFO "Mem-info:\n");
-        show_free_areas();
-        for_each_online_pgdat(pgdat) {
-                pgdat_resize_lock(pgdat, &flags);
-                for (i = 0; i < pgdat->node_spanned_pages; ++i) {
-                        if (unlikely(i % MAX_ORDER_NR_PAGES == 0))
-                                touch_nmi_watchdog();
-                        page = pgdat_page_nr(pgdat, i);
-                        total++;
-                        if (PageHighMem(page))
-                                highmem++;
-                        if (PageReserved(page))
-                                reserved++;
-                        else if (PageSwapCache(page))
-                                cached++;
-                        else if (page_count(page))
-                                shared += page_count(page) - 1;
-                }
-                pgdat_resize_unlock(pgdat, &flags);
-        }
-        printk(KERN_INFO "%d pages of RAM\n", total);
-        printk(KERN_INFO "%d pages of HIGHMEM\n", highmem);
-        printk(KERN_INFO "%d reserved pages\n", reserved);
-        printk(KERN_INFO "%d pages shared\n", shared);
-        printk(KERN_INFO "%d pages swap cached\n", cached);
-
-        printk(KERN_INFO "%lu pages dirty\n", global_page_state(NR_FILE_DIRTY));
-        printk(KERN_INFO "%lu pages writeback\n",
-                                        global_page_state(NR_WRITEBACK));
-        printk(KERN_INFO "%lu pages mapped\n", global_page_state(NR_FILE_MAPPED));
-        printk(KERN_INFO "%lu pages slab\n",
-                global_page_state(NR_SLAB_RECLAIMABLE) +
-                global_page_state(NR_SLAB_UNRECLAIMABLE));
-        printk(KERN_INFO "%lu pages pagetables\n",
-                                        global_page_state(NR_PAGETABLE));
-}
-
 /*
  * Associate a virtual page frame with a given physical page frame 
  * and protection flags for that frame.
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 7f3329b55d2e..3f90289410e6 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -369,20 +369,34 @@ static int __init ppro_init(char **cpu_type)
 {
         __u8 cpu_model = boot_cpu_data.x86_model;
 
-        if (cpu_model == 14)
+        switch (cpu_model) {
+        case 0 ... 2:
+                *cpu_type = "i386/ppro";
+                break;
+        case 3 ... 5:
+                *cpu_type = "i386/pii";
+                break;
+        case 6 ... 8:
+                *cpu_type = "i386/piii";
+                break;
+        case 9:
+                *cpu_type = "i386/p6_mobile";
+                break;
+        case 10 ... 13:
+                *cpu_type = "i386/p6";
+                break;
+        case 14:
                 *cpu_type = "i386/core";
-        else if (cpu_model == 15 || cpu_model == 23)
+                break;
+        case 15: case 23:
+                *cpu_type = "i386/core_2";
+                break;
+        case 26:
                 *cpu_type = "i386/core_2";
-        else if (cpu_model > 0xd)
+                break;
+        default:
+                /* Unknown */
                 return 0;
-        else if (cpu_model == 9) {
-                *cpu_type = "i386/p6_mobile";
-        } else if (cpu_model > 5) {
-                *cpu_type = "i386/piii";
-        } else if (cpu_model > 2) {
-                *cpu_type = "i386/pii";
-        } else {
-                *cpu_type = "i386/ppro";
         }
 
         model = &op_ppro_spec;
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index ff3a6a336342..4bdaa590375d 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -23,7 +23,8 @@ static void __devinit pci_fixup_i450nx(struct pci_dev *d)
                 pci_read_config_byte(d, reg++, &busno);
                 pci_read_config_byte(d, reg++, &suba);
                 pci_read_config_byte(d, reg++, &subb);
-                DBG("i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno, suba, subb);
+                dev_dbg(&d->dev, "i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno,
+                        suba, subb);
                 if (busno)
                         pci_scan_bus_with_sysdata(busno);       /* Bus A */
                 if (suba < subb)
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index 2aafb67dc5f1..5807d1bc73f7 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -128,10 +128,8 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                 pr = pci_find_parent_resource(dev, r);
                                 if (!r->start || !pr ||
                                     request_resource(pr, r) < 0) {
-                                        printk(KERN_ERR "PCI: Cannot allocate "
-                                                "resource region %d "
-                                                "of bridge %s\n",
-                                                idx, pci_name(dev));
+                                        dev_err(&dev->dev, "BAR %d: can't "
+                                                "allocate resource\n", idx);
                                         /*
                                          * Something is wrong with the region.
                                          * Invalidate the resource to prevent
@@ -166,15 +164,15 @@ static void __init pcibios_allocate_resources(int pass)
                         else
                                 disabled = !(command & PCI_COMMAND_MEMORY);
                         if (pass == disabled) {
-                                DBG("PCI: Resource %08lx-%08lx "
-                                    "(f=%lx, d=%d, p=%d)\n",
-                                    r->start, r->end, r->flags, disabled, pass);
+                                dev_dbg(&dev->dev, "resource %#08llx-%#08llx "
+                                        "(f=%lx, d=%d, p=%d)\n",
+                                        (unsigned long long) r->start,
+                                        (unsigned long long) r->end,
+                                        r->flags, disabled, pass);
                                 pr = pci_find_parent_resource(dev, r);
                                 if (!pr || request_resource(pr, r) < 0) {
-                                        printk(KERN_ERR "PCI: Cannot allocate "
-                                                "resource region %d "
-                                                "of device %s\n",
-                                                idx, pci_name(dev));
+                                        dev_err(&dev->dev, "BAR %d: can't "
+                                                "allocate resource\n", idx);
                                         /* We'll assign a new address later */
                                         r->end -= r->start;
                                         r->start = 0;
@@ -187,8 +185,7 @@ static void __init pcibios_allocate_resources(int pass)
                                 /* Turn the ROM off, leave the resource region,
                                  * but keep it unregistered. */
                                 u32 reg;
-                                DBG("PCI: Switching off ROM of %s\n",
-                                        pci_name(dev));
+                                dev_dbg(&dev->dev, "disabling ROM\n");
                                 r->flags &= ~IORESOURCE_ROM_ENABLE;
                                 pci_read_config_dword(dev,
                                                 dev->rom_base_reg, &reg);
@@ -257,8 +254,7 @@ void pcibios_set_master(struct pci_dev *dev)
                 lat = pcibios_max_latency;
         else
                 return;
-        printk(KERN_DEBUG "PCI: Setting latency timer of device %s to %d\n",
-                pci_name(dev), lat);
+        dev_printk(KERN_DEBUG, &dev->dev, "setting latency timer to %d\n", lat);
         pci_write_config_byte(dev, PCI_LATENCY_TIMER, lat);
 }
 
@@ -280,6 +276,7 @@ static void pci_track_mmap_page_range(struct vm_area_struct *vma)
 static struct vm_operations_struct pci_mmap_ops = {
         .open  = pci_track_mmap_page_range,
         .close = pci_unmap_page_range,
+        .access = generic_access_phys,
 };
 
 int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index 6a06a2eb0597..fec0123b33a9 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -436,7 +436,7 @@ static int pirq_vlsi_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
 {
         WARN_ON_ONCE(pirq >= 9);
         if (pirq > 8) {
-                printk(KERN_INFO "VLSI router pirq escape (%d)\n", pirq);
+                dev_info(&dev->dev, "VLSI router PIRQ escape (%d)\n", pirq);
                 return 0;
         }
         return read_config_nybble(router, 0x74, pirq-1);
@@ -446,7 +446,7 @@ static int pirq_vlsi_set(struct pci_dev *router, struct pci_dev *dev, int pirq,
 {
         WARN_ON_ONCE(pirq >= 9);
         if (pirq > 8) {
-                printk(KERN_INFO "VLSI router pirq escape (%d)\n", pirq);
+                dev_info(&dev->dev, "VLSI router PIRQ escape (%d)\n", pirq);
                 return 0;
         }
         write_config_nybble(router, 0x74, pirq-1, irq);
@@ -492,15 +492,17 @@ static int pirq_amd756_get(struct pci_dev *router, struct pci_dev *dev, int pirq
         irq = 0;
         if (pirq <= 4)
                 irq = read_config_nybble(router, 0x56, pirq - 1);
-        printk(KERN_INFO "AMD756: dev %04x:%04x, router pirq : %d get irq : %2d\n",
-                dev->vendor, dev->device, pirq, irq);
+        dev_info(&dev->dev,
+                 "AMD756: dev [%04x/%04x], router PIRQ %d get IRQ %d\n",
+                 dev->vendor, dev->device, pirq, irq);
         return irq;
 }
 
 static int pirq_amd756_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
 {
-        printk(KERN_INFO "AMD756: dev %04x:%04x, router pirq : %d SET irq : %2d\n",
-                dev->vendor, dev->device, pirq, irq);
+        dev_info(&dev->dev,
+                 "AMD756: dev [%04x/%04x], router PIRQ %d set IRQ %d\n",
+                 dev->vendor, dev->device, pirq, irq);
         if (pirq <= 4)
                 write_config_nybble(router, 0x56, pirq - 1, irq);
         return 1;
@@ -730,7 +732,6 @@ static __init int ali_router_probe(struct irq_router *r, struct pci_dev *router,
         switch (device) {
         case PCI_DEVICE_ID_AL_M1533:
         case PCI_DEVICE_ID_AL_M1563:
-                printk(KERN_DEBUG "PCI: Using ALI IRQ Router\n");
                 r->name = "ALI";
                 r->get = pirq_ali_get;
                 r->set = pirq_ali_set;
@@ -840,11 +841,9 @@ static void __init pirq_find_router(struct irq_router *r)
                         h->probe(r, pirq_router_dev, pirq_router_dev->device))
                         break;
         }
-        printk(KERN_INFO "PCI: Using IRQ router %s [%04x/%04x] at %s\n",
-                pirq_router.name,
-                pirq_router_dev->vendor,
-                pirq_router_dev->device,
-                pci_name(pirq_router_dev));
+        dev_info(&pirq_router_dev->dev, "%s IRQ router [%04x/%04x]\n",
+                 pirq_router.name,
+                 pirq_router_dev->vendor, pirq_router_dev->device);
 
         /* The device remains referenced for the kernel lifetime */
 }
@@ -877,7 +876,7 @@ static int pcibios_lookup_irq(struct pci_dev *dev, int assign)
         /* Find IRQ pin */
         pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
         if (!pin) {
-                DBG(KERN_DEBUG " -> no interrupt pin\n");
+                dev_dbg(&dev->dev, "no interrupt pin\n");
                 return 0;
         }
         pin = pin - 1;
@@ -887,20 +886,20 @@ static int pcibios_lookup_irq(struct pci_dev *dev, int assign)
         if (!pirq_table)
                 return 0;
 
-        DBG(KERN_DEBUG "IRQ for %s[%c]", pci_name(dev), 'A' + pin);
         info = pirq_get_info(dev);
         if (!info) {
-                DBG(" -> not found in routing table\n" KERN_DEBUG);
+                dev_dbg(&dev->dev, "PCI INT %c not found in routing table\n",
+                        'A' + pin);
                 return 0;
         }
         pirq = info->irq[pin].link;
         mask = info->irq[pin].bitmap;
         if (!pirq) {
-                DBG(" -> not routed\n" KERN_DEBUG);
+                dev_dbg(&dev->dev, "PCI INT %c not routed\n", 'A' + pin);
                 return 0;
         }
-        DBG(" -> PIRQ %02x, mask %04x, excl %04x", pirq, mask,
-                pirq_table->exclusive_irqs);
+        dev_dbg(&dev->dev, "PCI INT %c -> PIRQ %02x, mask %04x, excl %04x",
+                'A' + pin, pirq, mask, pirq_table->exclusive_irqs);
         mask &= pcibios_irq_mask;
 
         /* Work around broken HP Pavilion Notebooks which assign USB to
@@ -930,10 +929,8 @@ static int pcibios_lookup_irq(struct pci_dev *dev, int assign)
                 if (pci_probe & PCI_USE_PIRQ_MASK)
                         newirq = 0;
                 else
-                        printk("\n" KERN_WARNING
-                                "PCI: IRQ %i for device %s doesn't match PIRQ mask - try pci=usepirqmask\n"
-                                KERN_DEBUG, newirq,
-                                pci_name(dev));
+                        dev_warn(&dev->dev, "IRQ %d doesn't match PIRQ mask "
+                                 "%#x; try pci=usepirqmask\n", newirq, mask);
         }
         if (!newirq && assign) {
                 for (i = 0; i < 16; i++) {
@@ -944,39 +941,35 @@ static int pcibios_lookup_irq(struct pci_dev *dev, int assign)
                                 newirq = i;
                 }
         }
-        DBG(" -> newirq=%d", newirq);
+        dev_dbg(&dev->dev, "PCI INT %c -> newirq %d", 'A' + pin, newirq);
 
         /* Check if it is hardcoded */
         if ((pirq & 0xf0) == 0xf0) {
                 irq = pirq & 0xf;
-                DBG(" -> hardcoded IRQ %d\n", irq);
-                msg = "Hardcoded";
+                msg = "hardcoded";
         } else if (r->get && (irq = r->get(pirq_router_dev, dev, pirq)) && \
         ((!(pci_probe & PCI_USE_PIRQ_MASK)) || ((1 << irq) & mask))) {
-                DBG(" -> got IRQ %d\n", irq);
-                msg = "Found";
+                msg = "found";
                 eisa_set_level_irq(irq);
         } else if (newirq && r->set &&
                 (dev->class >> 8) != PCI_CLASS_DISPLAY_VGA) {
-                DBG(" -> assigning IRQ %d", newirq);
                 if (r->set(pirq_router_dev, dev, pirq, newirq)) {
                         eisa_set_level_irq(newirq);
-                        DBG(" ... OK\n");
-                        msg = "Assigned";
+                        msg = "assigned";
                         irq = newirq;
                 }
         }
 
         if (!irq) {
-                DBG(" ... failed\n");
                 if (newirq && mask == (1 << newirq)) {
-                        msg = "Guessed";
+                        msg = "guessed";
                         irq = newirq;
-                } else
+                } else {
+                        dev_dbg(&dev->dev, "can't route interrupt\n");
                         return 0;
+                }
         }
-        printk(KERN_INFO "PCI: %s IRQ %d for device %s\n", msg, irq,
-                pci_name(dev));
+        dev_info(&dev->dev, "%s PCI INT %c -> IRQ %d\n", msg, 'A' + pin, irq);
 
         /* Update IRQ for all devices with the same pirq value */
         while ((dev2 = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev2)) != NULL) {
@@ -996,17 +989,17 @@ static int pcibios_lookup_irq(struct pci_dev *dev, int assign)
                         (!(pci_probe & PCI_USE_PIRQ_MASK) || \
                         ((1 << dev2->irq) & mask))) {
 #ifndef CONFIG_PCI_MSI
-                                printk(KERN_INFO "IRQ routing conflict for %s, have irq %d, want irq %d\n",
-                                       pci_name(dev2), dev2->irq, irq);
+                                dev_info(&dev2->dev, "IRQ routing conflict: "
+                                         "have IRQ %d, want IRQ %d\n",
+                                         dev2->irq, irq);
 #endif
                                 continue;
                         }
                         dev2->irq = irq;
                         pirq_penalty[irq]++;
                         if (dev != dev2)
-                                printk(KERN_INFO
-                                        "PCI: Sharing IRQ %d with %s\n",
-                                        irq, pci_name(dev2));
+                                dev_info(&dev->dev, "sharing IRQ %d with %s\n",
+                                         irq, pci_name(dev2));
                 }
         }
         return 1;
@@ -1025,8 +1018,7 @@ static void __init pcibios_fixup_irqs(void)
                  * already in use.
                  */
                 if (dev->irq >= 16) {
-                        DBG(KERN_DEBUG "%s: ignoring bogus IRQ %d\n",
-                                pci_name(dev), dev->irq);
+                        dev_dbg(&dev->dev, "ignoring bogus IRQ %d\n", dev->irq);
                         dev->irq = 0;
                 }
                 /*
@@ -1070,12 +1062,12 @@ static void __init pcibios_fixup_irqs(void)
                                         irq = IO_APIC_get_PCI_irq_vector(bridge->bus->number,
                                                         PCI_SLOT(bridge->devfn), pin);
                                         if (irq >= 0)
-                                                printk(KERN_WARNING "PCI: using PPB %s[%c] to get irq %d\n",
-                                                        pci_name(bridge), 'A' + pin, irq);
+                                                dev_warn(&dev->dev, "using bridge %s INT %c to get IRQ %d\n",
+                                                         pci_name(bridge),
+                                                         'A' + pin, irq);
                                 }
                                 if (irq >= 0) {
-                                        printk(KERN_INFO "PCI->APIC IRQ transform: %s[%c] -> IRQ %d\n",
-                                                pci_name(dev), 'A' + pin, irq);
+                                        dev_info(&dev->dev, "PCI->APIC IRQ transform: INT %c -> IRQ %d\n", 'A' + pin, irq);
                                         dev->irq = irq;
                                 }
                         }
@@ -1231,25 +1223,24 @@ static int pirq_enable_irq(struct pci_dev *dev)
                                 irq = IO_APIC_get_PCI_irq_vector(bridge->bus->number,
                                                 PCI_SLOT(bridge->devfn), pin);
                                 if (irq >= 0)
-                                        printk(KERN_WARNING
-                                                "PCI: using PPB %s[%c] to get irq %d\n",
-                                                pci_name(bridge),
-                                                'A' + pin, irq);
+                                        dev_warn(&dev->dev, "using bridge %s "
+                                                 "INT %c to get IRQ %d\n",
+                                                 pci_name(bridge), 'A' + pin,
+                                                 irq);
                                 dev = bridge;
                         }
                         dev = temp_dev;
                         if (irq >= 0) {
-                                printk(KERN_INFO
-                                        "PCI->APIC IRQ transform: %s[%c] -> IRQ %d\n",
-                                        pci_name(dev), 'A' + pin, irq);
+                                dev_info(&dev->dev, "PCI->APIC IRQ transform: "
+                                         "INT %c -> IRQ %d\n", 'A' + pin, irq);
                                 dev->irq = irq;
                                 return 0;
                         } else
-                                msg = " Probably buggy MP table.";
+                                msg = "; probably buggy MP table";
                 } else if (pci_probe & PCI_BIOS_IRQ_SCAN)
                         msg = "";
                 else
-                        msg = " Please try using pci=biosirq.";
+                        msg = "; please try using pci=biosirq";
 
                 /*
                  * With IDE legacy devices the IRQ lookup failure is not
@@ -1259,9 +1250,8 @@ static int pirq_enable_irq(struct pci_dev *dev)
                                 !(dev->class & 0x5))
                         return 0;
 
-                printk(KERN_WARNING
-                        "PCI: No IRQ known for interrupt pin %c of device %s.%s\n",
-                        'A' + pin, pci_name(dev), msg);
+                dev_warn(&dev->dev, "can't find IRQ for PCI INT %c%s\n",
+                         'A' + pin, msg);
         }
         return 0;
 }
diff --git a/arch/x86/pci/numaq_32.c b/arch/x86/pci/numaq_32.c
index f4b16dc11dad..1177845d3186 100644
--- a/arch/x86/pci/numaq_32.c
+++ b/arch/x86/pci/numaq_32.c
@@ -131,13 +131,14 @@ static void __devinit pci_fixup_i450nx(struct pci_dev *d)
         u8 busno, suba, subb;
         int quad = BUS2QUAD(d->bus->number);
 
-        printk("PCI: Searching for i450NX host bridges on %s\n", pci_name(d));
+        dev_info(&d->dev, "searching for i450NX host bridges\n");
         reg = 0xd0;
         for(pxb=0; pxb<2; pxb++) {
                 pci_read_config_byte(d, reg++, &busno);
                 pci_read_config_byte(d, reg++, &suba);
                 pci_read_config_byte(d, reg++, &subb);
-                DBG("i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno, suba, subb);
+                dev_dbg(&d->dev, "i450NX PXB %d: %02x/%02x/%02x\n",
+                        pxb, busno, suba, subb);
                 if (busno) {
                         /* Bus A */
                         pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, busno));
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index e693812ac59a..d8faf79a0a1d 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -367,7 +367,7 @@ static void xen_send_IPI_mask(cpumask_t mask, enum ipi_vector vector)
 
         cpus_and(mask, mask, cpu_online_map);
 
-        for_each_cpu_mask(cpu, mask)
+        for_each_cpu_mask_nr(cpu, mask)
                 xen_send_IPI_one(cpu, vector);
 }
 
@@ -378,7 +378,7 @@ static void xen_smp_send_call_function_ipi(cpumask_t mask)
         xen_send_IPI_mask(mask, XEN_CALL_FUNCTION_VECTOR);
 
         /* Make sure other vcpus get a chance to run if they need to. */
-        for_each_cpu_mask(cpu, mask) {
+        for_each_cpu_mask_nr(cpu, mask) {
                 if (xen_vcpu_stolen(cpu)) {
                         HYPERVISOR_sched_op(SCHEDOP_yield, 0);
                         break;
diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
index 4038cbfe3331..7f58304fafb3 100644
--- a/arch/x86/xen/xen-asm_64.S
+++ b/arch/x86/xen/xen-asm_64.S
@@ -173,7 +173,7 @@ ENTRY(xen_sysexit)
         pushq $__USER32_CS
         pushq %rdx
 
-        pushq $VGCF_in_syscall
+        pushq $0
 1:      jmp hypercall_iret
 ENDPATCH(xen_sysexit)
 RELOC(xen_sysexit, 1b+1)