1036 files changed, 32375 insertions, 14409 deletions

diff --git a/Documentation/CodingStyle b/Documentation/CodingStyle
index 3171822c22a5..618a33c940df 100644
--- a/Documentation/CodingStyle
+++ b/Documentation/CodingStyle
@@ -392,7 +392,12 @@ The goto statement comes in handy when a function exits from multiple
 locations and some common work such as cleanup has to be done.  If there is no
 cleanup needed then just return directly.
 
-The rationale is:
+Choose label names which say what the goto does or why the goto exists.  An
+example of a good name could be "out_buffer:" if the goto frees "buffer".  Avoid
+using GW-BASIC names like "err1:" and "err2:".  Also don't name them after the
+goto location like "err_kmalloc_failed:"
+
+The rationale for using gotos is:
 
 - unconditional statements are easier to understand and follow
 - nesting is reduced
@@ -403,9 +408,10 @@ The rationale is:
 int fun(int a)
 {
         int result = 0;
-        char *buffer = kmalloc(SIZE);
+        char *buffer;
 
-        if (buffer == NULL)
+        buffer = kmalloc(SIZE, GFP_KERNEL);
+        if (!buffer)
                 return -ENOMEM;
 
         if (condition1) {
@@ -413,14 +419,25 @@ int fun(int a)
                         ...
                 }
                 result = 1;
-                goto out;
+                goto out_buffer;
         }
         ...
-out:
+out_buffer:
         kfree(buffer);
         return result;
 }
 
+A common type of bug to be aware of it "one err bugs" which look like this:
+
+err:
+        kfree(foo->bar);
+        kfree(foo);
+        return ret;
+
+The bug in this code is that on some exit paths "foo" is NULL.  Normally the
+fix for this is to split it up into two error labels "err_bar:" and "err_foo:".
+
+
                 Chapter 8: Commenting
 
 Comments are good, but there is also a danger of over-commenting.  NEVER
@@ -845,6 +862,49 @@ next instruction in the assembly output:
              : /* outputs */ : /* inputs */ : /* clobbers */);
 
 
+                Chapter 20: Conditional Compilation
+
+Wherever possible, don't use preprocessor conditionals (#if, #ifdef) in .c
+files; doing so makes code harder to read and logic harder to follow.  Instead,
+use such conditionals in a header file defining functions for use in those .c
+files, providing no-op stub versions in the #else case, and then call those
+functions unconditionally from .c files.  The compiler will avoid generating
+any code for the stub calls, producing identical results, but the logic will
+remain easy to follow.
+
+Prefer to compile out entire functions, rather than portions of functions or
+portions of expressions.  Rather than putting an ifdef in an expression, factor
+out part or all of the expression into a separate helper function and apply the
+conditional to that function.
+
+If you have a function or variable which may potentially go unused in a
+particular configuration, and the compiler would warn about its definition
+going unused, mark the definition as __maybe_unused rather than wrapping it in
+a preprocessor conditional.  (However, if a function or variable *always* goes
+unused, delete it.)
+
+Within code, where possible, use the IS_ENABLED macro to convert a Kconfig
+symbol into a C boolean expression, and use it in a normal C conditional:
+
+        if (IS_ENABLED(CONFIG_SOMETHING)) {
+                ...
+        }
+
+The compiler will constant-fold the conditional away, and include or exclude
+the block of code just as with an #ifdef, so this will not add any runtime
+overhead.  However, this approach still allows the C compiler to see the code
+inside the block, and check it for correctness (syntax, types, symbol
+references, etc).  Thus, you still have to use an #ifdef if the code inside the
+block references symbols that will not exist if the condition is not met.
+
+At the end of any non-trivial #if or #ifdef block (more than a few lines),
+place a comment after the #endif on the same line, noting the conditional
+expression used.  For instance:
+
+#ifdef CONFIG_SOMETHING
+...
+#endif /* CONFIG_SOMETHING */
+
 
                 Appendix I: References
 
diff --git a/Documentation/IPMI.txt b/Documentation/IPMI.txt
index f13c9132e9f2..653d5d739d7f 100644
--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@@ -42,7 +42,13 @@ The driver interface depends on your hardware.  If your system
 properly provides the SMBIOS info for IPMI, the driver will detect it
 and just work.  If you have a board with a standard interface (These
 will generally be either "KCS", "SMIC", or "BT", consult your hardware
-manual), choose the 'IPMI SI handler' option.
+manual), choose the 'IPMI SI handler' option.  A driver also exists
+for direct I2C access to the IPMI management controller.  Some boards
+support this, but it is unknown if it will work on every board.  For
+this, choose 'IPMI SMBus handler', but be ready to try to do some
+figuring to see if it will work on your system if the SMBIOS/APCI
+information is wrong or not present.  It is fairly safe to have both
+these enabled and let the drivers auto-detect what is present.
 
 You should generally enable ACPI on your system, as systems with IPMI
 can have ACPI tables describing them.
@@ -52,7 +58,8 @@ their job correctly, the IPMI controller should be automatically
 detected (via ACPI or SMBIOS tables) and should just work.  Sadly,
 many boards do not have this information.  The driver attempts
 standard defaults, but they may not work.  If you fall into this
-situation, you need to read the section below named 'The SI Driver'.
+situation, you need to read the section below named 'The SI Driver' or
+"The SMBus Driver" on how to hand-configure your system.
 
 IPMI defines a standard watchdog timer.  You can enable this with the
 'IPMI Watchdog Timer' config option.  If you compile the driver into
@@ -97,7 +104,12 @@ driver, each open file for this device ties in to the message handler
 as an IPMI user.
 
 ipmi_si - A driver for various system interfaces.  This supports KCS,
-SMIC, and BT interfaces.
+SMIC, and BT interfaces.  Unless you have an SMBus interface or your
+own custom interface, you probably need to use this.
+
+ipmi_ssif - A driver for accessing BMCs on the SMBus. It uses the
+I2C kernel driver's SMBus interfaces to send and receive IPMI messages
+over the SMBus.
 
 ipmi_watchdog - IPMI requires systems to have a very capable watchdog
 timer.  This driver implements the standard Linux watchdog timer
@@ -476,6 +488,62 @@ for specifying an interface.  Note that when removing an interface,
 only the first three parameters (si type, address type, and address)
 are used for the comparison.  Any options are ignored for removing.
 
+The SMBus Driver (SSIF)
+-----------------------
+
+The SMBus driver allows up to 4 SMBus devices to be configured in the
+system.  By default, the driver will only register with something it
+finds in DMI or ACPI tables.  You can change this
+at module load time (for a module) with:
+
+  modprobe ipmi_ssif.o
+        addr=<i2caddr1>[,<i2caddr2>[,...]]
+        adapter=<adapter1>[,<adapter2>[...]]
+        dbg=<flags1>,<flags2>...
+        slave_addrs=<addr1>,<addr2>,...
+        [dbg_probe=1]
+
+The addresses are normal I2C addresses.  The adapter is the string
+name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name.
+It is *NOT* i2c-<n> itself.
+
+The debug flags are bit flags for each BMC found, they are:
+IPMI messages: 1, driver state: 2, timing: 4, I2C probe: 8
+
+Setting dbg_probe to 1 will enable debugging of the probing and
+detection process for BMCs on the SMBusses.
+
+The slave_addrs specifies the IPMI address of the local BMC.  This is
+usually 0x20 and the driver defaults to that, but in case it's not, it
+can be specified when the driver starts up.
+
+Discovering the IPMI compliant BMC on the SMBus can cause devices on
+the I2C bus to fail. The SMBus driver writes a "Get Device ID" IPMI
+message as a block write to the I2C bus and waits for a response.
+This action can be detrimental to some I2C devices. It is highly
+recommended that the known I2C address be given to the SMBus driver in
+the smb_addr parameter unless you have DMI or ACPI data to tell the
+driver what to use.
+
+When compiled into the kernel, the addresses can be specified on the
+kernel command line as:
+
+  ipmb_ssif.addr=<i2caddr1>[,<i2caddr2>[...]]
+        ipmi_ssif.adapter=<adapter1>[,<adapter2>[...]]
+        ipmi_ssif.dbg=<flags1>[,<flags2>[...]]
+        ipmi_ssif.dbg_probe=1
+        ipmi_ssif.slave_addrs=<addr1>[,<addr2>[...]]
+
+These are the same options as on the module command line.
+
+The I2C driver does not support non-blocking access or polling, so
+this driver cannod to IPMI panic events, extend the watchdog at panic
+time, or other panic-related IPMI functions without special kernel
+patches and driver modifications.  You can get those at the openipmi
+web page.
+
+The driver supports a hot add and remove of interfaces through the I2C
+sysfs interface.
 
 Other Pieces
 ------------
diff --git a/Documentation/arm/memory.txt b/Documentation/arm/memory.txt
index 38dc06d0a791..4178ebda6e66 100644
--- a/Documentation/arm/memory.txt
+++ b/Documentation/arm/memory.txt
@@ -41,7 +41,7 @@ fffe8000	fffeffff	DTCM mapping area for platforms with
 fffe0000        fffe7fff        ITCM mapping area for platforms with
                                 ITCM mounted inside the CPU.
 
-ffc00000        ffdfffff        Fixmap mapping region.  Addresses provided
+ffc00000        ffefffff        Fixmap mapping region.  Addresses provided
                                 by fix_to_virt() will be located here.
 
 fee00000        feffffff        Mapping of PCI I/O space. This is a static
diff --git a/Documentation/cgroups/cgroups.txt b/Documentation/cgroups/cgroups.txt
index 10c949b293e4..f935fac1e73b 100644
--- a/Documentation/cgroups/cgroups.txt
+++ b/Documentation/cgroups/cgroups.txt
@@ -312,10 +312,10 @@ the "cpuset" cgroup subsystem, the steps are something like:
  2) mkdir /sys/fs/cgroup/cpuset
  3) mount -t cgroup -ocpuset cpuset /sys/fs/cgroup/cpuset
  4) Create the new cgroup by doing mkdir's and write's (or echo's) in
-    the /sys/fs/cgroup virtual file system.
+    the /sys/fs/cgroup/cpuset virtual file system.
  5) Start a task that will be the "founding father" of the new job.
  6) Attach that task to the new cgroup by writing its PID to the
-    /sys/fs/cgroup/cpuset/tasks file for that cgroup.
+    /sys/fs/cgroup/cpuset tasks file for that cgroup.
  7) fork, exec or clone the job tasks from this founding father task.
 
 For example, the following sequence of commands will setup a cgroup
diff --git a/Documentation/devicetree/bindings/ata/sata_rcar.txt b/Documentation/devicetree/bindings/ata/sata_rcar.txt
index 80ae87a0784b..2493a5a31655 100644
--- a/Documentation/devicetree/bindings/ata/sata_rcar.txt
+++ b/Documentation/devicetree/bindings/ata/sata_rcar.txt
@@ -3,18 +3,21 @@
 Required properties:
 - compatible            : should contain one of the following:
                           - "renesas,sata-r8a7779" for R-Car H1
+                            ("renesas,rcar-sata" is deprecated)
                           - "renesas,sata-r8a7790-es1" for R-Car H2 ES1
                           - "renesas,sata-r8a7790" for R-Car H2 other than ES1
                           - "renesas,sata-r8a7791" for R-Car M2-W
                           - "renesas,sata-r8a7793" for R-Car M2-N
 - reg                   : address and length of the SATA registers;
 - interrupts            : must consist of one interrupt specifier.
+- clocks                : must contain a reference to the functional clock.
 
 Example:
 
-sata: sata@fc600000 {
-        compatible = "renesas,sata-r8a7779";
-        reg = <0xfc600000 0x2000>;
+sata0: sata@ee300000 {
+        compatible = "renesas,sata-r8a7791";
+        reg = <0 0xee300000 0 0x2000>;
         interrupt-parent = <&gic>;
-        interrupts = <0 100 IRQ_TYPE_LEVEL_HIGH>;
+        interrupts = <0 105 IRQ_TYPE_LEVEL_HIGH>;
+        clocks = <&mstp8_clks R8A7791_CLK_SATA0>;
 };
diff --git a/Documentation/devicetree/bindings/clock/qoriq-clock.txt b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
index 5666812fc42b..266ff9d23229 100644
--- a/Documentation/devicetree/bindings/clock/qoriq-clock.txt
+++ b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
@@ -62,6 +62,8 @@ Required properties:
                 It takes parent's clock-frequency as its clock.
         * "fsl,qoriq-sysclk-2.0": for input system clock (v2.0).
                 It takes parent's clock-frequency as its clock.
+        * "fsl,qoriq-platform-pll-1.0" for the platform PLL clock (v1.0)
+        * "fsl,qoriq-platform-pll-2.0" for the platform PLL clock (v2.0)
 - #clock-cells: From common clock binding. The number of cells in a
         clock-specifier. Should be <0> for "fsl,qoriq-sysclk-[1,2].0"
         clocks, or <1> for "fsl,qoriq-core-pll-[1,2].0" clocks.
@@ -128,8 +130,16 @@ Example for clock block and clock provider:
                         clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
                         clock-output-names = "cmux1";
                 };
+
+                platform-pll: platform-pll@c00 {
+                        #clock-cells = <1>;
+                        reg = <0xc00 0x4>;
+                        compatible = "fsl,qoriq-platform-pll-1.0";
+                        clocks = <&sysclk>;
+                        clock-output-names = "platform-pll", "platform-pll-div2";
+                };
         };
-  }
+};
 
 Example for clock consumer:
 
@@ -139,4 +149,4 @@ Example for clock consumer:
                 clocks = <&mux0>;
                 ...
         };
-  }
+};
diff --git a/Documentation/devicetree/bindings/clock/st/st,flexgen.txt b/Documentation/devicetree/bindings/clock/st/st,flexgen.txt
index 1d3ace088172..b7ee5c7e0f75 100644
--- a/Documentation/devicetree/bindings/clock/st/st,flexgen.txt
+++ b/Documentation/devicetree/bindings/clock/st/st,flexgen.txt
@@ -11,7 +11,7 @@ Please find an example below:
 
     Clockgen block diagram
     -------------------------------------------------------------------
-   |                     Flexgen stucture                              |
+   |                     Flexgen structure                             |
    |                  ---------------------------------------------    |
    |                 |    -------       --------       --------    |   |
 clk_sysin            |   |       |     |        |     |        |   |   |
diff --git a/Documentation/devicetree/bindings/dma/atmel-xdma.txt b/Documentation/devicetree/bindings/dma/atmel-xdma.txt
new file mode 100644
index 000000000000..0eb2b3207e08
--- /dev/null
+++ b/Documentation/devicetree/bindings/dma/atmel-xdma.txt
@@ -0,0 +1,54 @@
+* Atmel Extensible Direct Memory Access Controller (XDMAC)
+
+* XDMA Controller
+Required properties:
+- compatible: Should be "atmel,<chip>-dma".
+  <chip> compatible description:
+  - sama5d4: first SoC adding the XDMAC
+- reg: Should contain DMA registers location and length.
+- interrupts: Should contain DMA interrupt.
+- #dma-cells: Must be <1>, used to represent the number of integer cells in
+the dmas property of client devices.
+  - The 1st cell specifies the channel configuration register:
+    - bit 13: SIF, source interface identifier, used to get the memory
+    interface identifier,
+    - bit 14: DIF, destination interface identifier, used to get the peripheral
+    interface identifier,
+    - bit 30-24: PERID, peripheral identifier.
+
+Example:
+
+dma1: dma-controller@f0004000 {
+        compatible = "atmel,sama5d4-dma";
+        reg = <0xf0004000 0x200>;
+        interrupts = <50 4 0>;
+        #dma-cells = <1>;
+};
+
+
+* DMA clients
+DMA clients connected to the Atmel XDMA controller must use the format
+described in the dma.txt file, using a one-cell specifier for each channel.
+The two cells in order are:
+1. A phandle pointing to the DMA controller.
+2. Channel configuration register. Configurable fields are:
+    - bit 13: SIF, source interface identifier, used to get the memory
+    interface identifier,
+    - bit 14: DIF, destination interface identifier, used to get the peripheral
+    interface identifier,
+  - bit 30-24: PERID, peripheral identifier.
+
+Example:
+
+i2c2: i2c@f8024000 {
+        compatible = "atmel,at91sam9x5-i2c";
+        reg = <0xf8024000 0x4000>;
+        interrupts = <34 4 6>;
+        dmas = <&dma1
+                (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+                 | AT91_XDMAC_DT_PERID(6))>,
+               <&dma1
+                (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+                | AT91_XDMAC_DT_PERID(7))>;
+        dma-names = "tx", "rx";
+};
diff --git a/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt b/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt
index 4659fd952301..dc8d3aac1aa9 100644
--- a/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt
+++ b/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt
@@ -48,6 +48,7 @@ The full ID of peripheral types can be found below.
         21      ESAI
         22      SSI Dual FIFO   (needs firmware ver >= 2)
         23      Shared ASRC
+        24      SAI
 
 The third cell specifies the transfer priority as below.
 
diff --git a/Documentation/devicetree/bindings/dma/qcom_bam_dma.txt b/Documentation/devicetree/bindings/dma/qcom_bam_dma.txt
index d75a9d767022..f8c3311b7153 100644
--- a/Documentation/devicetree/bindings/dma/qcom_bam_dma.txt
+++ b/Documentation/devicetree/bindings/dma/qcom_bam_dma.txt
@@ -1,7 +1,9 @@
 QCOM BAM DMA controller
 
 Required properties:
-- compatible: must contain "qcom,bam-v1.4.0" for MSM8974
+- compatible: must be one of the following:
+ * "qcom,bam-v1.4.0" for MSM8974, APQ8074 and APQ8084
+ * "qcom,bam-v1.3.0" for APQ8064, IPQ8064 and MSM8960
 - reg: Address range for DMA registers
 - interrupts: Should contain the one interrupt shared by all channels
 - #dma-cells: must be <1>, the cell in the dmas property of the client device
diff --git a/Documentation/devicetree/bindings/dma/sun6i-dma.txt b/Documentation/devicetree/bindings/dma/sun6i-dma.txt
index 3e145c1675b1..9cdcba24d7c3 100644
--- a/Documentation/devicetree/bindings/dma/sun6i-dma.txt
+++ b/Documentation/devicetree/bindings/dma/sun6i-dma.txt
@@ -4,7 +4,7 @@ This driver follows the generic DMA bindings defined in dma.txt.
 
 Required properties:
 
-- compatible:   Must be "allwinner,sun6i-a31-dma"
+- compatible:   Must be "allwinner,sun6i-a31-dma" or "allwinner,sun8i-a23-dma"
 - reg:          Should contain the registers base address and length
 - interrupts:   Should contain a reference to the interrupt used by this device
 - clocks:       Should contain a reference to the parent AHB clock
diff --git a/Documentation/devicetree/bindings/interrupt-controller/mips-gic.txt b/Documentation/devicetree/bindings/interrupt-controller/mips-gic.txt
new file mode 100644
index 000000000000..5a65478e5d40
--- /dev/null
+++ b/Documentation/devicetree/bindings/interrupt-controller/mips-gic.txt
@@ -0,0 +1,55 @@
+MIPS Global Interrupt Controller (GIC)
+
+The MIPS GIC routes external interrupts to individual VPEs and IRQ pins.
+It also supports local (per-processor) interrupts and software-generated
+interrupts which can be used as IPIs.  The GIC also includes a free-running
+global timer, per-CPU count/compare timers, and a watchdog.
+
+Required properties:
+- compatible : Should be "mti,gic".
+- interrupt-controller : Identifies the node as an interrupt controller
+- #interrupt-cells : Specifies the number of cells needed to encode an
+  interrupt specifier.  Should be 3.
+  - The first cell is the type of interrupt, local or shared.
+    See <include/dt-bindings/interrupt-controller/mips-gic.h>.
+  - The second cell is the GIC interrupt number.
+  - The third cell encodes the interrupt flags.
+    See <include/dt-bindings/interrupt-controller/irq.h> for a list of valid
+    flags.
+
+Optional properties:
+- reg : Base address and length of the GIC registers.  If not present,
+  the base address reported by the hardware GCR_GIC_BASE will be used.
+- mti,reserved-cpu-vectors : Specifies the list of CPU interrupt vectors
+  to which the GIC may not route interrupts.  Valid values are 2 - 7.
+  This property is ignored if the CPU is started in EIC mode.
+
+Required properties for timer sub-node:
+- compatible : Should be "mti,gic-timer".
+- interrupts : Interrupt for the GIC local timer.
+- clock-frequency : Clock frequency at which the GIC timers operate.
+
+Example:
+
+        gic: interrupt-controller@1bdc0000 {
+                compatible = "mti,gic";
+                reg = <0x1bdc0000 0x20000>;
+
+                interrupt-controller;
+                #interrupt-cells = <3>;
+
+                mti,reserved-cpu-vectors = <7>;
+
+                timer {
+                        compatible = "mti,gic-timer";
+                        interrupts = <GIC_LOCAL 1 IRQ_TYPE_NONE>;
+                        clock-frequency = <50000000>;
+                };
+        };
+
+        uart@18101400 {
+                ...
+                interrupt-parent = <&gic>;
+                interrupts = <GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH>;
+                ...
+        };
diff --git a/Documentation/devicetree/bindings/iommu/rockchip,iommu.txt b/Documentation/devicetree/bindings/iommu/rockchip,iommu.txt
new file mode 100644
index 000000000000..9a55ac3735e5
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/rockchip,iommu.txt
@@ -0,0 +1,26 @@
+Rockchip IOMMU
+==============
+
+A Rockchip DRM iommu translates io virtual addresses to physical addresses for
+its master device.  Each slave device is bound to a single master device, and
+shares its clocks, power domain and irq.
+
+Required properties:
+- compatible      : Should be "rockchip,iommu"
+- reg             : Address space for the configuration registers
+- interrupts      : Interrupt specifier for the IOMMU instance
+- interrupt-names : Interrupt name for the IOMMU instance
+- #iommu-cells    : Should be <0>.  This indicates the iommu is a
+                    "single-master" device, and needs no additional information
+                    to associate with its master device.  See:
+                    Documentation/devicetree/bindings/iommu/iommu.txt
+
+Example:
+
+        vopl_mmu: iommu@ff940300 {
+                compatible = "rockchip,iommu";
+                reg = <0xff940300 0x100>;
+                interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>;
+                interrupt-names = "vopl_mmu";
+                #iommu-cells = <0>;
+        };
diff --git a/Documentation/devicetree/bindings/mips/brcm/bcm3384-intc.txt b/Documentation/devicetree/bindings/mips/brcm/bcm3384-intc.txt
new file mode 100644
index 000000000000..d4e0141d3620
--- /dev/null
+++ b/Documentation/devicetree/bindings/mips/brcm/bcm3384-intc.txt
@@ -0,0 +1,37 @@
+* Interrupt Controller
+
+Properties:
+- compatible: "brcm,bcm3384-intc"
+
+  Compatibility with BCM3384 and possibly other BCM33xx/BCM63xx SoCs.
+
+- reg: Address/length pairs for each mask/status register set.  Length must
+  be 8.  If multiple register sets are specified, the first set will
+  handle IRQ offsets 0..31, the second set 32..63, and so on.
+
+- interrupt-controller: This is an interrupt controller.
+
+- #interrupt-cells: Must be <1>.  Just a simple IRQ offset; no level/edge
+  or polarity configuration is possible with this controller.
+
+- interrupt-parent: This controller is cascaded from a MIPS CPU HW IRQ, or
+  from another INTC.
+
+- interrupts: The IRQ on the parent controller.
+
+Example:
+        periph_intc: periph_intc@14e00038 {
+                compatible = "brcm,bcm3384-intc";
+
+                /*
+                 * IRQs 0..31:  mask reg 0x14e00038, status reg 0x14e0003c
+                 * IRQs 32..63: mask reg 0x14e00340, status reg 0x14e00344
+                 */
+                reg = <0x14e00038 0x8 0x14e00340 0x8>;
+
+                interrupt-controller;
+                #interrupt-cells = <1>;
+
+                interrupt-parent = <&cpu_intc>;
+                interrupts = <4>;
+        };
diff --git a/Documentation/devicetree/bindings/mips/brcm/bmips.txt b/Documentation/devicetree/bindings/mips/brcm/bmips.txt
new file mode 100644
index 000000000000..8ef71b4085ca
--- /dev/null
+++ b/Documentation/devicetree/bindings/mips/brcm/bmips.txt
@@ -0,0 +1,8 @@
+* Broadcom MIPS (BMIPS) CPUs
+
+Required properties:
+- compatible: "brcm,bmips3300", "brcm,bmips4350", "brcm,bmips4380",
+  "brcm,bmips5000"
+
+- mips-hpt-frequency: This is common to all CPUs in the system so it lives
+  under the "cpus" node.
diff --git a/Documentation/devicetree/bindings/mips/brcm/cm-dsl.txt b/Documentation/devicetree/bindings/mips/brcm/cm-dsl.txt
new file mode 100644
index 000000000000..8a139cb3c0b5
--- /dev/null
+++ b/Documentation/devicetree/bindings/mips/brcm/cm-dsl.txt
@@ -0,0 +1,11 @@
+* Broadcom cable/DSL platforms
+
+SoCs:
+
+Required properties:
+- compatible: "brcm,bcm3384", "brcm,bcm33843"
+
+Boards:
+
+Required properties:
+- compatible: "brcm,bcm93384wvg"
diff --git a/Documentation/devicetree/bindings/mips/brcm/usb.txt b/Documentation/devicetree/bindings/mips/brcm/usb.txt
new file mode 100644
index 000000000000..452c45c7bf29
--- /dev/null
+++ b/Documentation/devicetree/bindings/mips/brcm/usb.txt
@@ -0,0 +1,11 @@
+* Broadcom USB controllers
+
+Required properties:
+- compatible: "brcm,bcm3384-ohci", "brcm,bcm3384-ehci"
+
+  These currently use the generic-ohci and generic-ehci drivers.  On some
+  systems, special handling may be needed in the following cases:
+
+  - Restoring state after systemwide power save modes
+  - Sharing PHYs with the USBD (UDC) hardware
+  - Figuring out which controllers are disabled on ASIC bondout variants
diff --git a/Documentation/devicetree/bindings/mips/cpu_irq.txt b/Documentation/devicetree/bindings/mips/cpu_irq.txt
index 13aa4b62c62a..fc149f326dae 100644
--- a/Documentation/devicetree/bindings/mips/cpu_irq.txt
+++ b/Documentation/devicetree/bindings/mips/cpu_irq.txt
@@ -1,6 +1,6 @@
 MIPS CPU interrupt controller
 
-On MIPS the mips_cpu_intc_init() helper can be used to initialize the 8 CPU
+On MIPS the mips_cpu_irq_of_init() helper can be used to initialize the 8 CPU
 IRQs from a devicetree file and create a irq_domain for IRQ controller.
 
 With the irq_domain in place we can describe how the 8 IRQs are wired to the
@@ -36,7 +36,7 @@ Example devicetree:
 
 Example platform irq.c:
 static struct of_device_id __initdata of_irq_ids[] = {
-        { .compatible = "mti,cpu-interrupt-controller", .data = mips_cpu_intc_init },
+        { .compatible = "mti,cpu-interrupt-controller", .data = mips_cpu_irq_of_init },
         { .compatible = "ralink,rt2880-intc", .data = intc_of_init },
         {},
 };
diff --git a/Documentation/devicetree/bindings/powerpc/fsl/fman.txt b/Documentation/devicetree/bindings/powerpc/fsl/fman.txt
new file mode 100644
index 000000000000..edeea160ca39
--- /dev/null
+++ b/Documentation/devicetree/bindings/powerpc/fsl/fman.txt
@@ -0,0 +1,534 @@
+=============================================================================
+Freescale Frame Manager Device Bindings
+
+CONTENTS
+  - FMan Node
+  - FMan Port Node
+  - FMan MURAM Node
+  - FMan dTSEC/XGEC/mEMAC Node
+  - FMan IEEE 1588 Node
+  - Example
+
+=============================================================================
+FMan Node
+
+DESCRIPTION
+
+Due to the fact that the FMan is an aggregation of sub-engines (ports, MACs,
+etc.) the FMan node will have child nodes for each of them.
+
+PROPERTIES
+
+- compatible
+                Usage: required
+                Value type: <stringlist>
+                Definition: Must include "fsl,fman"
+                FMan version can be determined via FM_IP_REV_1 register in the
+                FMan block. The offset is 0xc4 from the beginning of the
+                Frame Processing Manager memory map (0xc3000 from the
+                beginning of the FMan node).
+
+- cell-index
+                Usage: required
+                Value type: <u32>
+                Definition: Specifies the index of the FMan unit.
+
+                The cell-index value may be used by the SoC, to identify the
+                FMan unit in the SoC memory map. In the table bellow,
+                there's a description of the cell-index use in each SoC:
+
+                - P1023:
+                register[bit]                   FMan unit       cell-index
+                ============================================================
+                DEVDISR[1]                      1               0
+
+                - P2041, P3041, P4080 P5020, P5040:
+                register[bit]                   FMan unit       cell-index
+                ============================================================
+                DCFG_DEVDISR2[6]                1               0
+                DCFG_DEVDISR2[14]               2               1
+                        (Second FM available only in P4080 and P5040)
+
+                - B4860, T1040, T2080, T4240:
+                register[bit]                   FMan unit       cell-index
+                ============================================================
+                DCFG_CCSR_DEVDISR2[24]          1               0
+                DCFG_CCSR_DEVDISR2[25]          2               1
+                        (Second FM available only in T4240)
+
+                DEVDISR, DCFG_DEVDISR2 and DCFG_CCSR_DEVDISR2 are located in
+                the specific SoC "Device Configuration/Pin Control" Memory
+                Map.
+
+- reg
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: A standard property. Specifies the offset of the
+                following configuration registers:
+                - BMI configuration registers.
+                - QMI configuration registers.
+                - DMA configuration registers.
+                - FPM configuration registers.
+                - FMan controller configuration registers.
+
+- ranges
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: A standard property.
+
+- clocks
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: phandle for the fman input clock.
+
+- clock-names
+                usage: required
+                Value type: <stringlist>
+                Definition: "fmanclk" for the fman input clock.
+
+- interrupts
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: A pair of IRQs are specified in this property.
+                The first element is associated with the event interrupts and
+                the second element is associated with the error interrupts.
+
+- fsl,qman-channel-range
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: Specifies the range of the available dedicated
+                channels in the FMan. The first cell specifies the beginning
+                of the range and the second cell specifies the number of
+                channels.
+                Further information available at:
+                "Work Queue (WQ) Channel Assignments in the QMan" section
+                in DPAA Reference Manual.
+
+- fsl,qman
+- fsl,bman
+                Usage: required
+                Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt
+
+=============================================================================
+FMan MURAM Node
+
+DESCRIPTION
+
+FMan Internal memory - shared between all the FMan modules.
+It contains data structures that are common and written to or read by
+the modules.
+FMan internal memory is split into the following parts:
+        Packet buffering (Tx/Rx FIFOs)
+        Frames internal context
+
+PROPERTIES
+
+- compatible
+                Usage: required
+                Value type: <stringlist>
+                Definition: Must include "fsl,fman-muram"
+
+- ranges
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: A standard property.
+                Specifies the multi-user memory offset and the size within
+                the FMan.
+
+EXAMPLE
+
+muram@0 {
+        compatible = "fsl,fman-muram";
+        ranges = <0 0x000000 0x28000>;
+};
+
+=============================================================================
+FMan Port Node
+
+DESCRIPTION
+
+The Frame Manager (FMan) supports several types of hardware ports:
+        Ethernet receiver (RX)
+        Ethernet transmitter (TX)
+        Offline/Host command (O/H)
+
+PROPERTIES
+
+- compatible
+                Usage: required
+                Value type: <stringlist>
+                Definition: A standard property.
+                Must include one of the following:
+                        - "fsl,fman-v2-port-oh" for FManV2 OH ports
+                        - "fsl,fman-v2-port-rx" for FManV2 RX ports
+                        - "fsl,fman-v2-port-tx" for FManV2 TX ports
+                        - "fsl,fman-v3-port-oh" for FManV3 OH ports
+                        - "fsl,fman-v3-port-rx" for FManV3 RX ports
+                        - "fsl,fman-v3-port-tx" for FManV3 TX ports
+
+- cell-index
+                Usage: required
+                Value type: <u32>
+                Definition: Specifies the hardware port id.
+                Each hardware port on the FMan has its own hardware PortID.
+                Super set of all hardware Port IDs available at FMan Reference
+                Manual under "FMan Hardware Ports in Freescale Devices" table.
+
+                Each hardware port is assigned a 4KB, port-specific page in
+                the FMan hardware port memory region (which is part of the
+                FMan memory map). The first 4 KB in the FMan hardware ports
+                memory region is used for what are called common registers.
+                The subsequent 63 4KB pages are allocated to the hardware
+                ports.
+                The page of a specific port is determined by the cell-index.
+
+- reg
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: There is one reg region describing the port
+                configuration registers.
+
+EXAMPLE
+
+port@a8000 {
+        cell-index = <0x28>;
+        compatible = "fsl,fman-v2-port-tx";
+        reg = <0xa8000 0x1000>;
+};
+
+port@88000 {
+        cell-index = <0x8>;
+        compatible = "fsl,fman-v2-port-rx";
+        reg = <0x88000 0x1000>;
+};
+
+port@81000 {
+        cell-index = <0x1>;
+        compatible = "fsl,fman-v2-port-oh";
+        reg = <0x81000 0x1000>;
+};
+
+=============================================================================
+FMan dTSEC/XGEC/mEMAC Node
+
+DESCRIPTION
+
+mEMAC/dTSEC/XGEC are the Ethernet network interfaces
+
+PROPERTIES
+
+- compatible
+                Usage: required
+                Value type: <stringlist>
+                Definition: A standard property.
+                Must include one of the following:
+                - "fsl,fman-dtsec" for dTSEC MAC
+                - "fsl,fman-xgec" for XGEC MAC
+                - "fsl,fman-memac for mEMAC MAC
+
+- cell-index
+                Usage: required
+                Value type: <u32>
+                Definition: Specifies the MAC id.
+
+                The cell-index value may be used by the FMan or the SoC, to
+                identify the MAC unit in the FMan (or SoC) memory map.
+                In the tables bellow there's a description of the cell-index
+                use, there are two tables, one describes the use of cell-index
+                by the FMan, the second describes the use by the SoC:
+
+                1. FMan Registers
+
+                FManV2:
+                register[bit]           MAC             cell-index
+                ============================================================
+                FM_EPI[16]              XGEC            8
+                FM_EPI[16+n]            dTSECn          n-1
+                FM_NPI[11+n]            dTSECn          n-1
+                        n = 1,..,5
+
+                FManV3:
+                register[bit]           MAC             cell-index
+                ============================================================
+                FM_EPI[16+n]            mEMACn          n-1
+                FM_EPI[25]              mEMAC10         9
+
+                FM_NPI[11+n]            mEMACn          n-1
+                FM_NPI[10]              mEMAC10         9
+                FM_NPI[11]              mEMAC9          8
+                        n = 1,..8
+
+                FM_EPI and FM_NPI are located in the FMan memory map.
+
+                2. SoC registers:
+
+                - P2041, P3041, P4080 P5020, P5040:
+                register[bit]           FMan            MAC             cell
+                                        Unit                            index
+                ============================================================
+                DCFG_DEVDISR2[7]        1               XGEC            8
+                DCFG_DEVDISR2[7+n]      1               dTSECn          n-1
+                DCFG_DEVDISR2[15]       2               XGEC            8
+                DCFG_DEVDISR2[15+n]     2               dTSECn          n-1
+                        n = 1,..5
+
+                - T1040, T2080, T4240, B4860:
+                register[bit]                   FMan    MAC             cell
+                                                Unit                    index
+                ============================================================
+                DCFG_CCSR_DEVDISR2[n-1]         1       mEMACn          n-1
+                DCFG_CCSR_DEVDISR2[11+n]        2       mEMACn          n-1
+                        n = 1,..6,9,10
+
+                EVDISR, DCFG_DEVDISR2 and DCFG_CCSR_DEVDISR2 are located in
+                the specific SoC "Device Configuration/Pin Control" Memory
+                Map.
+
+- reg
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: A standard property.
+
+- fsl,fman-ports
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: An array of two phandles - the first references is
+                the FMan RX port and the second is the TX port used by this
+                MAC.
+
+- ptp-timer
+                Usage required
+                Value type: <phandle>
+                Definition: A phandle for 1EEE1588 timer.
+
+EXAMPLE
+
+fman1_tx28: port@a8000 {
+        cell-index = <0x28>;
+        compatible = "fsl,fman-v2-port-tx";
+        reg = <0xa8000 0x1000>;
+};
+
+fman1_rx8: port@88000 {
+        cell-index = <0x8>;
+        compatible = "fsl,fman-v2-port-rx";
+        reg = <0x88000 0x1000>;
+};
+
+ptp-timer: ptp_timer@fe000 {
+        compatible = "fsl,fman-ptp-timer";
+        reg = <0xfe000 0x1000>;
+};
+
+ethernet@e0000 {
+        compatible = "fsl,fman-dtsec";
+        cell-index = <0>;
+        reg = <0xe0000 0x1000>;
+        fsl,fman-ports = <&fman1_rx8 &fman1_tx28>;
+        ptp-timer = <&ptp-timer>;
+};
+
+============================================================================
+FMan IEEE 1588 Node
+
+DESCRIPTION
+
+The FMan interface to support IEEE 1588
+
+
+PROPERTIES
+
+- compatible
+                Usage: required
+                Value type: <stringlist>
+                Definition: A standard property.
+                Must include "fsl,fman-ptp-timer".
+
+- reg
+                Usage: required
+                Value type: <prop-encoded-array>
+                Definition: A standard property.
+
+EXAMPLE
+
+ptp-timer@fe000 {
+        compatible = "fsl,fman-ptp-timer";
+        reg = <0xfe000 0x1000>;
+};
+
+=============================================================================
+Example
+
+fman@400000 {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        cell-index = <1>;
+        compatible = "fsl,fman"
+        ranges = <0 0x400000 0x100000>;
+        reg = <0x400000 0x100000>;
+        clocks = <&fman_clk>;
+        clock-names = "fmanclk";
+        interrupts = <
+                96 2 0 0
+                16 2 1 1>;
+        fsl,qman-channel-range = <0x40 0xc>;
+
+        muram@0 {
+                compatible = "fsl,fman-muram";
+                reg = <0x0 0x28000>;
+        };
+
+        port@81000 {
+                cell-index = <1>;
+                compatible = "fsl,fman-v2-port-oh";
+                reg = <0x81000 0x1000>;
+        };
+
+        port@82000 {
+                cell-index = <2>;
+                compatible = "fsl,fman-v2-port-oh";
+                reg = <0x82000 0x1000>;
+        };
+
+        port@83000 {
+                cell-index = <3>;
+                compatible = "fsl,fman-v2-port-oh";
+                reg = <0x83000 0x1000>;
+        };
+
+        port@84000 {
+                cell-index = <4>;
+                compatible = "fsl,fman-v2-port-oh";
+                reg = <0x84000 0x1000>;
+        };
+
+        port@85000 {
+                cell-index = <5>;
+                compatible = "fsl,fman-v2-port-oh";
+                reg = <0x85000 0x1000>;
+        };
+
+        port@86000 {
+                cell-index = <6>;
+                compatible = "fsl,fman-v2-port-oh";
+                reg = <0x86000 0x1000>;
+        };
+
+        fman1_rx_0x8: port@88000 {
+                cell-index = <0x8>;
+                compatible = "fsl,fman-v2-port-rx";
+                reg = <0x88000 0x1000>;
+        };
+
+        fman1_rx_0x9: port@89000 {
+                cell-index = <0x9>;
+                compatible = "fsl,fman-v2-port-rx";
+                reg = <0x89000 0x1000>;
+        };
+
+        fman1_rx_0xa: port@8a000 {
+                cell-index = <0xa>;
+                compatible = "fsl,fman-v2-port-rx";
+                reg = <0x8a000 0x1000>;
+        };
+
+        fman1_rx_0xb: port@8b000 {
+                cell-index = <0xb>;
+                compatible = "fsl,fman-v2-port-rx";
+                reg = <0x8b000 0x1000>;
+        };
+
+        fman1_rx_0xc: port@8c000 {
+                cell-index = <0xc>;
+                compatible = "fsl,fman-v2-port-rx";
+                reg = <0x8c000 0x1000>;
+        };
+
+        fman1_rx_0x10: port@90000 {
+                cell-index = <0x10>;
+                compatible = "fsl,fman-v2-port-rx";
+                reg = <0x90000 0x1000>;
+        };
+
+        fman1_tx_0x28: port@a8000 {
+                cell-index = <0x28>;
+                compatible = "fsl,fman-v2-port-tx";
+                reg = <0xa8000 0x1000>;
+        };
+
+        fman1_tx_0x29: port@a9000 {
+                cell-index = <0x29>;
+                compatible = "fsl,fman-v2-port-tx";
+                reg = <0xa9000 0x1000>;
+        };
+
+        fman1_tx_0x2a: port@aa000 {
+                cell-index = <0x2a>;
+                compatible = "fsl,fman-v2-port-tx";
+                reg = <0xaa000 0x1000>;
+        };
+
+        fman1_tx_0x2b: port@ab000 {
+                cell-index = <0x2b>;
+                compatible = "fsl,fman-v2-port-tx";
+                reg = <0xab000 0x1000>;
+        };
+
+        fman1_tx_0x2c: port@ac0000 {
+                cell-index = <0x2c>;
+                compatible = "fsl,fman-v2-port-tx";
+                reg = <0xac000 0x1000>;
+        };
+
+        fman1_tx_0x30: port@b0000 {
+                cell-index = <0x30>;
+                compatible = "fsl,fman-v2-port-tx";
+                reg = <0xb0000 0x1000>;
+        };
+
+        ethernet@e0000 {
+                compatible = "fsl,fman-dtsec";
+                cell-index = <0>;
+                reg = <0xe0000 0x1000>;
+                fsl,fman-ports = <&fman1_rx_0x8 &fman1_tx_0x28>;
+        };
+
+        ethernet@e2000 {
+                compatible = "fsl,fman-dtsec";
+                cell-index = <1>;
+                reg = <0xe2000 0x1000>;
+                fsl,fman-ports = <&fman1_rx_0x9 &fman1_tx_0x29>;
+        };
+
+        ethernet@e4000 {
+                compatible = "fsl,fman-dtsec";
+                cell-index = <2>;
+                reg = <0xe4000 0x1000>;
+                fsl,fman-ports = <&fman1_rx_0xa &fman1_tx_0x2a>;
+        };
+
+        ethernet@e6000 {
+                compatible = "fsl,fman-dtsec";
+                cell-index = <3>;
+                reg = <0xe6000 0x1000>;
+                fsl,fman-ports = <&fman1_rx_0xb &fman1_tx_0x2b>;
+        };
+
+        ethernet@e8000 {
+                compatible = "fsl,fman-dtsec";
+                cell-index = <4>;
+                reg = <0xf0000 0x1000>;
+                fsl,fman-ports = <&fman1_rx_0xc &fman1_tx_0x2c>;
+
+        ethernet@f0000 {
+                cell-index = <8>;
+                compatible = "fsl,fman-xgec";
+                reg = <0xf0000 0x1000>;
+                fsl,fman-ports = <&fman1_rx_0x10 &fman1_tx_0x30>;
+        };
+
+        ptp-timer@fe000 {
+                compatible = "fsl,fman-ptp-timer";
+                reg = <0xfe000 0x1000>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/rtc/rtc-opal.txt b/Documentation/devicetree/bindings/rtc/rtc-opal.txt
new file mode 100644
index 000000000000..af87e5ecac54
--- /dev/null
+++ b/Documentation/devicetree/bindings/rtc/rtc-opal.txt
@@ -0,0 +1,16 @@
+IBM OPAL real-time clock
+------------------------
+
+Required properties:
+- comapatible: Should be "ibm,opal-rtc"
+
+Optional properties:
+- has-tpo: Decides if the wakeup is supported or not.
+
+Example:
+        rtc {
+                compatible = "ibm,opal-rtc";
+                has-tpo;
+                phandle = <0x10000029>;
+                linux,phandle = <0x10000029>;
+        };
diff --git a/Documentation/devicetree/bindings/soc/fsl/bman-portals.txt b/Documentation/devicetree/bindings/soc/fsl/bman-portals.txt
new file mode 100644
index 000000000000..2a00e14e11e0
--- /dev/null
+++ b/Documentation/devicetree/bindings/soc/fsl/bman-portals.txt
@@ -0,0 +1,56 @@
+QorIQ DPAA Buffer Manager Portals Device Tree Binding
+
+Copyright (C) 2008 - 2014 Freescale Semiconductor Inc.
+
+CONTENTS
+
+        - BMan Portal
+        - Example
+
+BMan Portal Node
+
+Portals are memory mapped interfaces to BMan that allow low-latency, lock-less
+interaction by software running on processor cores, accelerators and network
+interfaces with the BMan
+
+PROPERTIES
+
+- compatible
+        Usage:          Required
+        Value type:     <stringlist>
+        Definition:     Must include "fsl,bman-portal-<hardware revision>"
+                        May include "fsl,<SoC>-bman-portal" or "fsl,bman-portal"
+
+- reg
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Two regions. The first is the cache-enabled region of
+                        the portal. The second is the cache-inhibited region of
+                        the portal
+
+- interrupts
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Standard property
+
+EXAMPLE
+
+The example below shows a (P4080) BMan portals container/bus node with two portals
+
+        bman-portals@ff4000000 {
+                #address-cells = <1>;
+                #size-cells = <1>;
+                compatible = "simple-bus";
+                ranges = <0 0xf 0xf4000000 0x200000>;
+
+                bman-portal@0 {
+                        compatible = "fsl,bman-portal-1.0.0", "fsl,bman-portal";
+                        reg = <0x0 0x4000>, <0x100000 0x1000>;
+                        interrupts = <105 2 0 0>;
+                };
+                bman-portal@4000 {
+                        compatible = "fsl,bman-portal-1.0.0", "fsl,bman-portal";
+                        reg = <0x4000 0x4000>, <0x101000 0x1000>;
+                        interrupts = <107 2 0 0>;
+                };
+        };
diff --git a/Documentation/devicetree/bindings/soc/fsl/bman.txt b/Documentation/devicetree/bindings/soc/fsl/bman.txt
new file mode 100644
index 000000000000..9f80bf8709ac
--- /dev/null
+++ b/Documentation/devicetree/bindings/soc/fsl/bman.txt
@@ -0,0 +1,125 @@
+QorIQ DPAA Buffer Manager Device Tree Bindings
+
+Copyright (C) 2008 - 2014 Freescale Semiconductor Inc.
+
+CONTENTS
+
+        - BMan Node
+        - BMan Private Memory Node
+        - Example
+
+BMan Node
+
+The Buffer Manager is part of the Data-Path Acceleration Architecture (DPAA).
+BMan supports hardware allocation and deallocation of buffers belonging to pools
+originally created by software with configurable depletion thresholds. This
+binding covers the CCSR space programming model
+
+PROPERTIES
+
+- compatible
+        Usage:          Required
+        Value type:     <stringlist>
+        Definition:     Must include "fsl,bman"
+                        May include "fsl,<SoC>-bman"
+
+- reg
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Registers region within the CCSR address space
+
+The BMan revision information is located in the BMAN_IP_REV_1/2 registers which
+are located at offsets 0xbf8 and 0xbfc
+
+- interrupts
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Standard property. The error interrupt
+
+- fsl,liodn
+        Usage:          See pamu.txt
+        Value type:     <prop-encoded-array>
+        Definition:     PAMU property used for static LIODN assignment
+
+- fsl,iommu-parent
+        Usage:          See pamu.txt
+        Value type:     <phandle>
+        Definition:     PAMU property used for dynamic LIODN assignment
+
+        For additional details about the PAMU/LIODN binding(s) see pamu.txt
+
+Devices connected to a BMan instance via Direct Connect Portals (DCP) must link
+to the respective BMan instance
+
+- fsl,bman
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Description:    List of phandle and DCP index pairs, to the BMan instance
+                        to which this device is connected via the DCP
+
+BMan Private Memory Node
+
+BMan requires a contiguous range of physical memory used for the backing store
+for BMan Free Buffer Proxy Records (FBPR). This memory is reserved/allocated as a
+node under the /reserved-memory node
+
+The BMan FBPR memory node must be named "bman-fbpr"
+
+PROPERTIES
+
+- compatible
+        Usage:          required
+        Value type:     <stringlist>
+        Definition:     Must inclide "fsl,bman-fbpr"
+
+The following constraints are relevant to the FBPR private memory:
+        - The size must be 2^(size + 1), with size = 11..33. That is 4 KiB to
+          16 GiB
+        - The alignment must be a muliptle of the memory size
+
+The size of the FBPR must be chosen by observing the hardware features configured
+via the Reset Configuration Word (RCW) and that are relevant to a specific board
+(e.g. number of MAC(s) pinned-out, number of offline/host command FMan ports,
+etc.). The size configured in the DT must reflect the hardware capabilities and
+not the specific needs of an application
+
+For additional details about reserved memory regions see reserved-memory.txt
+
+EXAMPLE
+
+The example below shows a BMan FBPR dynamic allocation memory node
+
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                bman_fbpr: bman-fbpr {
+                        compatible = "fsl,bman-fbpr";
+                        alloc-ranges = <0 0 0xf 0xffffffff>;
+                        size = <0 0x1000000>;
+                        alignment = <0 0x1000000>;
+                };
+        };
+
+The example below shows a (P4080) BMan CCSR-space node
+
+        crypto@300000 {
+                ...
+                fsl,bman = <&bman, 2>;
+                ...
+        };
+
+        bman: bman@31a000 {
+                compatible = "fsl,bman";
+                reg = <0x31a000 0x1000>;
+                interrupts = <16 2 1 2>;
+                fsl,liodn = <0x17>;
+                memory-region = <&bman_fbpr>;
+        };
+
+        fman@400000 {
+                ...
+                fsl,bman = <&bman, 0>;
+                ...
+        };
diff --git a/Documentation/devicetree/bindings/soc/fsl/qman-portals.txt b/Documentation/devicetree/bindings/soc/fsl/qman-portals.txt
new file mode 100644
index 000000000000..48c4dae5d6f9
--- /dev/null
+++ b/Documentation/devicetree/bindings/soc/fsl/qman-portals.txt
@@ -0,0 +1,154 @@
+QorIQ DPAA Queue Manager Portals Device Tree Binding
+
+Copyright (C) 2008 - 2014 Freescale Semiconductor Inc.
+
+CONTENTS
+
+        - QMan Portal
+        - QMan Pool Channel
+        - Example
+
+QMan Portal Node
+
+Portals are memory mapped interfaces to QMan that allow low-latency, lock-less
+interaction by software running on processor cores, accelerators and network
+interfaces with the QMan
+
+PROPERTIES
+
+- compatible
+        Usage:          Required
+        Value type:     <stringlist>
+        Definition:     Must include "fsl,qman-portal-<hardware revision>"
+                        May include "fsl,<SoC>-qman-portal" or "fsl,qman-portal"
+
+- reg
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Two regions. The first is the cache-enabled region of
+                        the portal. The second is the cache-inhibited region of
+                        the portal
+
+- interrupts
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Standard property
+
+- fsl,liodn
+        Usage:          See pamu.txt
+        Value type:     <prop-encoded-array>
+        Definition:     Two LIODN(s). DQRR LIODN (DLIODN) and Frame LIODN
+                        (FLIODN)
+
+- fsl,iommu-parent
+        Usage:          See pamu.txt
+        Value type:     <phandle>
+        Definition:     PAMU property used for dynamic LIODN assignment
+
+        For additional details about the PAMU/LIODN binding(s) see pamu.txt
+
+- fsl,qman-channel-id
+        Usage:          Required
+        Value type:     <u32>
+        Definition:     The hardware index of the channel. This can also be
+                        determined by dividing any of the channel's 8 work queue
+                        IDs by 8
+
+In addition to these properties the qman-portals should have sub-nodes to
+represent the HW devices/portals that are connected to the software portal
+described here
+
+The currently supported sub-nodes are:
+        * fman0
+        * fman1
+        * pme
+        * crypto
+
+These subnodes should have the following properties:
+
+- fsl,liodn
+        Usage:          See pamu.txt
+        Value type:     <prop-encoded-array>
+        Definition:     PAMU property used for static LIODN assignment
+
+- fsl,iommu-parent
+        Usage:          See pamu.txt
+        Value type:     <phandle>
+        Definition:     PAMU property used for dynamic LIODN assignment
+
+- dev-handle
+        Usage:          Required
+        Value type:     <phandle>
+        Definition:     The phandle to the particular hardware device that this
+                        portal is connected to.
+
+DPAA QMan Pool Channel Nodes
+
+Pool Channels are defined with the following properties.
+
+PROPERTIES
+
+- compatible
+        Usage:          Required
+        Value type:     <stringlist>
+        Definition:     Must include "fsl,qman-pool-channel"
+                        May include "fsl,<SoC>-qman-pool-channel"
+
+- fsl,qman-channel-id
+        Usage:          Required
+        Value type:     <u32>
+        Definition:     The hardware index of the channel. This can also be
+                        determined by dividing any of the channel's 8 work queue
+                        IDs by 8
+
+EXAMPLE
+
+The example below shows a (P4080) QMan portals container/bus node with two portals
+
+        qman-portals@ff4200000 {
+                #address-cells = <1>;
+                #size-cells = <1>;
+                compatible = "simple-bus";
+                ranges = <0 0xf 0xf4200000 0x200000>;
+
+                qman-portal@0 {
+                        compatible = "fsl,qman-portal-1.2.0", "fsl,qman-portal";
+                        reg = <0 0x4000>, <0x100000 0x1000>;
+                        interrupts = <104 2 0 0>;
+                        fsl,liodn = <1 2>;
+                        fsl,qman-channel-id = <0>;
+
+                        fman0 {
+                                fsl,liodn = <0x21>;
+                                dev-handle = <&fman0>;
+                        };
+                        fman1 {
+                                fsl,liodn = <0xa1>;
+                                dev-handle = <&fman1>;
+                        };
+                        crypto {
+                                fsl,liodn = <0x41 0x66>;
+                                dev-handle = <&crypto>;
+                        };
+                };
+                qman-portal@4000 {
+                        compatible = "fsl,qman-portal-1.2.0", "fsl,qman-portal";
+                        reg = <0x4000 0x4000>, <0x101000 0x1000>;
+                        interrupts = <106 2 0 0>;
+                        fsl,liodn = <3 4>;
+                        fsl,qman-channel-id = <1>;
+
+                        fman0 {
+                                fsl,liodn = <0x22>;
+                                dev-handle = <&fman0>;
+                        };
+                        fman1 {
+                                fsl,liodn = <0xa2>;
+                                dev-handle = <&fman1>;
+                        };
+                        crypto {
+                                fsl,liodn = <0x42 0x67>;
+                                dev-handle = <&crypto>;
+                        };
+                };
+        };
diff --git a/Documentation/devicetree/bindings/soc/fsl/qman.txt b/Documentation/devicetree/bindings/soc/fsl/qman.txt
new file mode 100644
index 000000000000..063e3a0b9d04
--- /dev/null
+++ b/Documentation/devicetree/bindings/soc/fsl/qman.txt
@@ -0,0 +1,165 @@
+QorIQ DPAA Queue Manager Device Tree Binding
+
+Copyright (C) 2008 - 2014 Freescale Semiconductor Inc.
+
+CONTENTS
+
+        - QMan Node
+        - QMan Private Memory Nodes
+        - Example
+
+QMan Node
+
+The Queue Manager is part of the Data-Path Acceleration Architecture (DPAA). QMan
+supports queuing and QoS scheduling of frames to CPUs, network interfaces and
+DPAA logic modules, maintains packet ordering within flows. Besides providing
+flow-level queuing, is also responsible for congestion management functions such
+as RED/WRED, congestion notifications and tail discards. This binding covers the
+CCSR space programming model
+
+PROPERTIES
+
+- compatible
+        Usage:          Required
+        Value type:     <stringlist>
+        Definition:     Must include "fsl,qman"
+                        May include "fsl,<SoC>-qman"
+
+- reg
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Registers region within the CCSR address space
+
+The QMan revision information is located in the QMAN_IP_REV_1/2 registers which
+are located at offsets 0xbf8 and 0xbfc
+
+- interrupts
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Definition:     Standard property. The error interrupt
+
+- fsl,liodn
+        Usage:          See pamu.txt
+        Value type:     <prop-encoded-array>
+        Definition:     PAMU property used for static LIODN assignment
+
+- fsl,iommu-parent
+        Usage:          See pamu.txt
+        Value type:     <phandle>
+        Definition:     PAMU property used for dynamic LIODN assignment
+
+        For additional details about the PAMU/LIODN binding(s) see pamu.txt
+
+- clocks
+        Usage:          See clock-bindings.txt and qoriq-clock.txt
+        Value type:     <prop-encoded-array>
+        Definition:     Reference input clock. Its frequency is half of the
+                        platform clock
+
+Devices connected to a QMan instance via Direct Connect Portals (DCP) must link
+to the respective QMan instance
+
+- fsl,qman
+        Usage:          Required
+        Value type:     <prop-encoded-array>
+        Description:    List of phandle and DCP index pairs, to the QMan instance
+                        to which this device is connected via the DCP
+
+QMan Private Memory Nodes
+
+QMan requires two contiguous range of physical memory used for the backing store
+for QMan Frame Queue Descriptor (FQD) and Packed Frame Descriptor Record (PFDR).
+This memory is reserved/allocated as a nodes under the /reserved-memory node
+
+The QMan FQD memory node must be named "qman-fqd"
+
+PROPERTIES
+
+- compatible
+        Usage:          required
+        Value type:     <stringlist>
+        Definition:     Must inclide "fsl,qman-fqd"
+
+The QMan PFDR memory node must be named "qman-pfdr"
+
+PROPERTIES
+
+- compatible
+        Usage:          required
+        Value type:     <stringlist>
+        Definition:     Must inclide "fsl,qman-pfdr"
+
+The following constraints are relevant to the FQD and PFDR private memory:
+        - The size must be 2^(size + 1), with size = 11..29. That is 4 KiB to
+          1 GiB
+        - The alignment must be a muliptle of the memory size
+
+The size of the FQD and PFDP must be chosen by observing the hardware features
+configured via the Reset Configuration Word (RCW) and that are relevant to a
+specific board (e.g. number of MAC(s) pinned-out, number of offline/host command
+FMan ports, etc.). The size configured in the DT must reflect the hardware
+capabilities and not the specific needs of an application
+
+For additional details about reserved memory regions see reserved-memory.txt
+
+EXAMPLE
+
+The example below shows a QMan FQD and a PFDR dynamic allocation memory nodes
+
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                qman_fqd: qman-fqd {
+                        compatible = "fsl,qman-fqd";
+                        alloc-ranges = <0 0 0xf 0xffffffff>;
+                        size = <0 0x400000>;
+                        alignment = <0 0x400000>;
+                };
+                qman_pfdr: qman-pfdr {
+                        compatible = "fsl,qman-pfdr";
+                        alloc-ranges = <0 0 0xf 0xffffffff>;
+                        size = <0 0x2000000>;
+                        alignment = <0 0x2000000>;
+                };
+        };
+
+The example below shows a (P4080) QMan CCSR-space node
+
+        clockgen: global-utilities@e1000 {
+                ...
+                sysclk: sysclk {
+                        ...
+                };
+                ...
+                platform_pll: platform-pll@c00 {
+                        #clock-cells = <1>;
+                        reg = <0xc00 0x4>;
+                        compatible = "fsl,qoriq-platform-pll-1.0";
+                        clocks = <&sysclk>;
+                        clock-output-names = "platform-pll", "platform-pll-div2";
+                };
+                ...
+        };
+
+        crypto@300000 {
+                ...
+                fsl,qman = <&qman, 2>;
+                ...
+        };
+
+        qman: qman@318000 {
+                compatible = "fsl,qman";
+                reg = <0x318000 0x1000>;
+                interrupts = <16 2 1 3>
+                fsl,liodn = <0x16>;
+                memory-region = <&qman_fqd &qman_pfdr>;
+                clocks = <&platform_pll 1>;
+        };
+
+        fman@400000 {
+                ...
+                fsl,qman = <&qman, 0>;
+                ...
+        };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 2417cb0b493b..cc6151c431c8 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -101,6 +101,7 @@ mitsubishi	Mitsubishi Electric Corporation
 mosaixtech      Mosaix Technologies, Inc.
 moxa    Moxa
 mpl     MPL AG
+mti     Imagination Technologies Ltd. (formerly MIPS Technologies Inc.)
 mundoreader     Mundo Reader S.L.
 murata  Murata Manufacturing Co., Ltd.
 mxicy   Macronix International Co., Ltd.
diff --git a/Documentation/dmaengine.txt b/Documentation/dmaengine/client.txt
index 11fb87ff6cd0..11fb87ff6cd0 100644
--- a/Documentation/dmaengine.txt
+++ b/Documentation/dmaengine/client.txt
diff --git a/Documentation/dmatest.txt b/Documentation/dmaengine/dmatest.txt
index dd77a81bdb80..dd77a81bdb80 100644
--- a/Documentation/dmatest.txt
+++ b/Documentation/dmaengine/dmatest.txt
diff --git a/Documentation/dmaengine/provider.txt b/Documentation/dmaengine/provider.txt
new file mode 100644
index 000000000000..766658ccf235
--- /dev/null
+++ b/Documentation/dmaengine/provider.txt
@@ -0,0 +1,366 @@
+DMAengine controller documentation
+==================================
+
+Hardware Introduction
++++++++++++++++++++++
+
+Most of the Slave DMA controllers have the same general principles of
+operations.
+
+They have a given number of channels to use for the DMA transfers, and
+a given number of requests lines.
+
+Requests and channels are pretty much orthogonal. Channels can be used
+to serve several to any requests. To simplify, channels are the
+entities that will be doing the copy, and requests what endpoints are
+involved.
+
+The request lines actually correspond to physical lines going from the
+DMA-eligible devices to the controller itself. Whenever the device
+will want to start a transfer, it will assert a DMA request (DRQ) by
+asserting that request line.
+
+A very simple DMA controller would only take into account a single
+parameter: the transfer size. At each clock cycle, it would transfer a
+byte of data from one buffer to another, until the transfer size has
+been reached.
+
+That wouldn't work well in the real world, since slave devices might
+require a specific number of bits to be transferred in a single
+cycle. For example, we may want to transfer as much data as the
+physical bus allows to maximize performances when doing a simple
+memory copy operation, but our audio device could have a narrower FIFO
+that requires data to be written exactly 16 or 24 bits at a time. This
+is why most if not all of the DMA controllers can adjust this, using a
+parameter called the transfer width.
+
+Moreover, some DMA controllers, whenever the RAM is used as a source
+or destination, can group the reads or writes in memory into a buffer,
+so instead of having a lot of small memory accesses, which is not
+really efficient, you'll get several bigger transfers. This is done
+using a parameter called the burst size, that defines how many single
+reads/writes it's allowed to do without the controller splitting the
+transfer into smaller sub-transfers.
+
+Our theoretical DMA controller would then only be able to do transfers
+that involve a single contiguous block of data. However, some of the
+transfers we usually have are not, and want to copy data from
+non-contiguous buffers to a contiguous buffer, which is called
+scatter-gather.
+
+DMAEngine, at least for mem2dev transfers, require support for
+scatter-gather. So we're left with two cases here: either we have a
+quite simple DMA controller that doesn't support it, and we'll have to
+implement it in software, or we have a more advanced DMA controller,
+that implements in hardware scatter-gather.
+
+The latter are usually programmed using a collection of chunks to
+transfer, and whenever the transfer is started, the controller will go
+over that collection, doing whatever we programmed there.
+
+This collection is usually either a table or a linked list. You will
+then push either the address of the table and its number of elements,
+or the first item of the list to one channel of the DMA controller,
+and whenever a DRQ will be asserted, it will go through the collection
+to know where to fetch the data from.
+
+Either way, the format of this collection is completely dependent on
+your hardware. Each DMA controller will require a different structure,
+but all of them will require, for every chunk, at least the source and
+destination addresses, whether it should increment these addresses or
+not and the three parameters we saw earlier: the burst size, the
+transfer width and the transfer size.
+
+The one last thing is that usually, slave devices won't issue DRQ by
+default, and you have to enable this in your slave device driver first
+whenever you're willing to use DMA.
+
+These were just the general memory-to-memory (also called mem2mem) or
+memory-to-device (mem2dev) kind of transfers. Most devices often
+support other kind of transfers or memory operations that dmaengine
+support and will be detailed later in this document.
+
+DMA Support in Linux
+++++++++++++++++++++
+
+Historically, DMA controller drivers have been implemented using the
+async TX API, to offload operations such as memory copy, XOR,
+cryptography, etc., basically any memory to memory operation.
+
+Over time, the need for memory to device transfers arose, and
+dmaengine was extended. Nowadays, the async TX API is written as a
+layer on top of dmaengine, and acts as a client. Still, dmaengine
+accommodates that API in some cases, and made some design choices to
+ensure that it stayed compatible.
+
+For more information on the Async TX API, please look the relevant
+documentation file in Documentation/crypto/async-tx-api.txt.
+
+DMAEngine Registration
+++++++++++++++++++++++
+
+struct dma_device Initialization
+--------------------------------
+
+Just like any other kernel framework, the whole DMAEngine registration
+relies on the driver filling a structure and registering against the
+framework. In our case, that structure is dma_device.
+
+The first thing you need to do in your driver is to allocate this
+structure. Any of the usual memory allocators will do, but you'll also
+need to initialize a few fields in there:
+
+  * channels:   should be initialized as a list using the
+                INIT_LIST_HEAD macro for example
+
+  * dev:        should hold the pointer to the struct device associated
+                to your current driver instance.
+
+Supported transaction types
+---------------------------
+
+The next thing you need is to set which transaction types your device
+(and driver) supports.
+
+Our dma_device structure has a field called cap_mask that holds the
+various types of transaction supported, and you need to modify this
+mask using the dma_cap_set function, with various flags depending on
+transaction types you support as an argument.
+
+All those capabilities are defined in the dma_transaction_type enum,
+in include/linux/dmaengine.h
+
+Currently, the types available are:
+  * DMA_MEMCPY
+    - The device is able to do memory to memory copies
+
+  * DMA_XOR
+    - The device is able to perform XOR operations on memory areas
+    - Used to accelerate XOR intensive tasks, such as RAID5
+
+  * DMA_XOR_VAL
+    - The device is able to perform parity check using the XOR
+      algorithm against a memory buffer.
+
+  * DMA_PQ
+    - The device is able to perform RAID6 P+Q computations, P being a
+      simple XOR, and Q being a Reed-Solomon algorithm.
+
+  * DMA_PQ_VAL
+    - The device is able to perform parity check using RAID6 P+Q
+      algorithm against a memory buffer.
+
+  * DMA_INTERRUPT
+    - The device is able to trigger a dummy transfer that will
+      generate periodic interrupts
+    - Used by the client drivers to register a callback that will be
+      called on a regular basis through the DMA controller interrupt
+
+  * DMA_SG
+    - The device supports memory to memory scatter-gather
+      transfers.
+    - Even though a plain memcpy can look like a particular case of a
+      scatter-gather transfer, with a single chunk to transfer, it's a
+      distinct transaction type in the mem2mem transfers case
+
+  * DMA_PRIVATE
+    - The devices only supports slave transfers, and as such isn't
+      available for async transfers.
+
+  * DMA_ASYNC_TX
+    - Must not be set by the device, and will be set by the framework
+      if needed
+    - /* TODO: What is it about? */
+
+  * DMA_SLAVE
+    - The device can handle device to memory transfers, including
+      scatter-gather transfers.
+    - While in the mem2mem case we were having two distinct types to
+      deal with a single chunk to copy or a collection of them, here,
+      we just have a single transaction type that is supposed to
+      handle both.
+    - If you want to transfer a single contiguous memory buffer,
+      simply build a scatter list with only one item.
+
+  * DMA_CYCLIC
+    - The device can handle cyclic transfers.
+    - A cyclic transfer is a transfer where the chunk collection will
+      loop over itself, with the last item pointing to the first.
+    - It's usually used for audio transfers, where you want to operate
+      on a single ring buffer that you will fill with your audio data.
+
+  * DMA_INTERLEAVE
+    - The device supports interleaved transfer.
+    - These transfers can transfer data from a non-contiguous buffer
+      to a non-contiguous buffer, opposed to DMA_SLAVE that can
+      transfer data from a non-contiguous data set to a continuous
+      destination buffer.
+    - It's usually used for 2d content transfers, in which case you
+      want to transfer a portion of uncompressed data directly to the
+      display to print it
+
+These various types will also affect how the source and destination
+addresses change over time.
+
+Addresses pointing to RAM are typically incremented (or decremented)
+after each transfer. In case of a ring buffer, they may loop
+(DMA_CYCLIC). Addresses pointing to a device's register (e.g. a FIFO)
+are typically fixed.
+
+Device operations
+-----------------
+
+Our dma_device structure also requires a few function pointers in
+order to implement the actual logic, now that we described what
+operations we were able to perform.
+
+The functions that we have to fill in there, and hence have to
+implement, obviously depend on the transaction types you reported as
+supported.
+
+   * device_alloc_chan_resources
+   * device_free_chan_resources
+     - These functions will be called whenever a driver will call
+       dma_request_channel or dma_release_channel for the first/last
+       time on the channel associated to that driver.
+     - They are in charge of allocating/freeing all the needed
+       resources in order for that channel to be useful for your
+       driver.
+     - These functions can sleep.
+
+   * device_prep_dma_*
+     - These functions are matching the capabilities you registered
+       previously.
+     - These functions all take the buffer or the scatterlist relevant
+       for the transfer being prepared, and should create a hardware
+       descriptor or a list of hardware descriptors from it
+     - These functions can be called from an interrupt context
+     - Any allocation you might do should be using the GFP_NOWAIT
+       flag, in order not to potentially sleep, but without depleting
+       the emergency pool either.
+     - Drivers should try to pre-allocate any memory they might need
+       during the transfer setup at probe time to avoid putting to
+       much pressure on the nowait allocator.
+
+     - It should return a unique instance of the
+       dma_async_tx_descriptor structure, that further represents this
+       particular transfer.
+
+     - This structure can be initialized using the function
+       dma_async_tx_descriptor_init.
+     - You'll also need to set two fields in this structure:
+       + flags:
+                TODO: Can it be modified by the driver itself, or
+                should it be always the flags passed in the arguments
+
+       + tx_submit:     A pointer to a function you have to implement,
+                        that is supposed to push the current
+                        transaction descriptor to a pending queue, waiting
+                        for issue_pending to be called.
+
+   * device_issue_pending
+     - Takes the first transaction descriptor in the pending queue,
+       and starts the transfer. Whenever that transfer is done, it
+       should move to the next transaction in the list.
+     - This function can be called in an interrupt context
+
+   * device_tx_status
+     - Should report the bytes left to go over on the given channel
+     - Should only care about the transaction descriptor passed as
+       argument, not the currently active one on a given channel
+     - The tx_state argument might be NULL
+     - Should use dma_set_residue to report it
+     - In the case of a cyclic transfer, it should only take into
+       account the current period.
+     - This function can be called in an interrupt context.
+
+   * device_control
+     - Used by client drivers to control and configure the channel it
+       has a handle on.
+     - Called with a command and an argument
+       + The command is one of the values listed by the enum
+         dma_ctrl_cmd. The valid commands are:
+         + DMA_PAUSE
+           + Pauses a transfer on the channel
+           + This command should operate synchronously on the channel,
+             pausing right away the work of the given channel
+         + DMA_RESUME
+           + Restarts a transfer on the channel
+           + This command should operate synchronously on the channel,
+             resuming right away the work of the given channel
+         + DMA_TERMINATE_ALL
+           + Aborts all the pending and ongoing transfers on the
+             channel
+           + This command should operate synchronously on the channel,
+             terminating right away all the channels
+         + DMA_SLAVE_CONFIG
+           + Reconfigures the channel with passed configuration
+           + This command should NOT perform synchronously, or on any
+             currently queued transfers, but only on subsequent ones
+           + In this case, the function will receive a
+             dma_slave_config structure pointer as an argument, that
+             will detail which configuration to use.
+           + Even though that structure contains a direction field,
+             this field is deprecated in favor of the direction
+             argument given to the prep_* functions
+         + FSLDMA_EXTERNAL_START
+           + TODO: Why does that even exist?
+       + The argument is an opaque unsigned long. This actually is a
+         pointer to a struct dma_slave_config that should be used only
+         in the DMA_SLAVE_CONFIG.
+
+  * device_slave_caps
+    - Called through the framework by client drivers in order to have
+      an idea of what are the properties of the channel allocated to
+      them.
+    - Such properties are the buswidth, available directions, etc.
+    - Required for every generic layer doing DMA transfers, such as
+      ASoC.
+
+Misc notes (stuff that should be documented, but don't really know
+where to put them)
+------------------------------------------------------------------
+  * dma_run_dependencies
+    - Should be called at the end of an async TX transfer, and can be
+      ignored in the slave transfers case.
+    - Makes sure that dependent operations are run before marking it
+      as complete.
+
+  * dma_cookie_t
+    - it's a DMA transaction ID that will increment over time.
+    - Not really relevant any more since the introduction of virt-dma
+      that abstracts it away.
+
+  * DMA_CTRL_ACK
+    - Undocumented feature
+    - No one really has an idea of what it's about, besides being
+      related to reusing the DMA transaction descriptors or having
+      additional transactions added to it in the async-tx API
+    - Useless in the case of the slave API
+
+General Design Notes
+--------------------
+
+Most of the DMAEngine drivers you'll see are based on a similar design
+that handles the end of transfer interrupts in the handler, but defer
+most work to a tasklet, including the start of a new transfer whenever
+the previous transfer ended.
+
+This is a rather inefficient design though, because the inter-transfer
+latency will be not only the interrupt latency, but also the
+scheduling latency of the tasklet, which will leave the channel idle
+in between, which will slow down the global transfer rate.
+
+You should avoid this kind of practice, and instead of electing a new
+transfer in your tasklet, move that part to the interrupt handler in
+order to have a shorter idle window (that we can't really avoid
+anyway).
+
+Glossary
+--------
+
+Burst:          A number of consecutive read or write operations
+                that can be queued to buffers before being flushed to
+                memory.
+Chunk:          A contiguous collection of bursts
+Transfer:       A collection of chunks (be it contiguous or not)
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index 9af538be3751..eede6088f978 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -77,6 +77,17 @@ should appear, and then pressing CTRL-R let you specify the patch file
 to insert into the message.
 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Claws Mail (GUI)
+
+Works. Some people use this successfully for patches.
+
+To insert a patch use Message->Insert File (CTRL+i) or an external editor.
+
+If the inserted patch has to be edited in the Claws composition window
+"Auto wrapping" in Configuration->Preferences->Compose->Wrapping should be
+disabled.
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Evolution (GUI)
 
 Some people use this successfully for patches.
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index eb8a10e22f7c..aae9dd13c91f 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1272,7 +1272,7 @@ softirq.
 
 
 1.9 Ext4 file system parameters
-------------------------------
+-------------------------------
 
 Information about mounted ext4 file systems can be found in
 /proc/fs/ext4.  Each mounted filesystem will have a directory in
diff --git a/Documentation/input/xpad.txt b/Documentation/input/xpad.txt
index 7cc9a436e6a1..d1b23f295db4 100644
--- a/Documentation/input/xpad.txt
+++ b/Documentation/input/xpad.txt
@@ -1,18 +1,22 @@
-xpad - Linux USB driver for X-Box gamepads
+xpad - Linux USB driver for Xbox compatible controllers
 
-This is the very first release of a driver for X-Box gamepads.
-Basically, this was hacked away in just a few hours, so don't expect
-miracles.
+This driver exposes all first-party and third-party Xbox compatible
+controllers. It has a long history and has enjoyed considerable usage
+as Window's xinput library caused most PC games to focus on Xbox
+controller compatibility.
 
-In particular, there is currently NO support for the rumble pack.
-You won't find many ff-aware linux applications anyway.
+Due to backwards compatibility all buttons are reported as digital.
+This only effects Original Xbox controllers. All later controller models
+have only digital face buttons.
+
+Rumble is supported on some models of Xbox 360 controllers but not of
+Original Xbox controllers nor on Xbox One controllers. As of writing
+the Xbox One's rumble protocol has not been reverse engineered but in
+the future could be supported.
 
 
 0. Notes
 --------
-
-Driver updated for kernel 2.6.17.11. (Based on a patch for 2.6.11.4.)
-
 The number of buttons/axes reported varies based on 3 things:
 - if you are using a known controller
 - if you are using a known dance pad
@@ -20,12 +24,16 @@ The number of buttons/axes reported varies based on 3 things:
   module configuration for "Map D-PAD to buttons rather than axes for unknown
   pads" (module option dpad_to_buttons)
 
-If you set dpad_to_buttons to 0 and you are using an unknown device (one
-not listed below), the driver will map the directional pad to axes (X/Y),
-if you said N it will map the d-pad to buttons, which is needed for dance
-style games to function correctly.  The default is Y.
+If you set dpad_to_buttons to N and you are using an unknown device
+the driver will map the directional pad to axes (X/Y).
+If you said Y it will map the d-pad to buttons, which is needed for dance
+style games to function correctly. The default is Y.
+
+dpad_to_buttons has no effect for known pads. A erroneous commit message
+claimed dpad_to_buttons could be used to force behavior on known devices.
+This is not true. Both dpad_to_buttons and triggers_to_buttons only affect
+unknown controllers.
 
-dpad_to_buttons has no effect for known pads.
 
 0.1 Normal Controllers
 ----------------------
@@ -80,17 +88,29 @@ to the list of supported devices, ensuring that it will work out of the
 box in the future.
 
 
-1. USB adapter
+1. USB adapters
 --------------
+All generations of Xbox controllers speak USB over the wire.
+- Original Xbox controllers use a proprietary connector and require adapters.
+- Wireless Xbox 360 controllers require a 'Xbox 360 Wireless Gaming Receiver
+  for Windows'
+- Wired Xbox 360 controllers use standard USB connectors.
+- Xbox One controllers can be wireless but speak Wi-Fi Direct and are not
+  yet supported.
+- Xbox One controllers can be wired and use standard Micro-USB connectors.
+
 
-Before you can actually use the driver, you need to get yourself an
-adapter cable to connect the X-Box controller to your Linux-Box. You
-can buy these online fairly cheap, or build your own.
+
+1.1 Original Xbox USB adapters
+--------------
+Using this driver with an Original Xbox controller requires an
+adapter cable to break out the proprietary connector's pins to USB.
+You can buy these online fairly cheap, or build your own.
 
 Such a cable is pretty easy to build. The Controller itself is a USB
 compound device (a hub with three ports for two expansion slots and
 the controller device) with the only difference in a nonstandard connector
-(5 pins vs. 4 on standard USB connector).
+(5 pins vs. 4 on standard USB 1.0 connectors).
 
 You just need to solder a USB connector onto the cable and keep the
 yellow wire unconnected. The other pins have the same order on both
@@ -102,26 +122,41 @@ original one. You can buy an extension cable and cut that instead. That way,
 you can still use the controller with your X-Box, if you have one ;)
 
 
+
 2. Driver Installation
 ----------------------
 
-Once you have the adapter cable and the controller is connected, you need
-to load your USB subsystem and should cat /proc/bus/usb/devices.
-There should be an entry like the one at the end [4].
+Once you have the adapter cable, if needed, and the controller connected
+the xpad module should be auto loaded. To confirm you can cat
+/proc/bus/usb/devices. There should be an entry like the one at the end [4].
+
+
 
-Currently (as of version 0.0.6), the following devices are included:
- original Microsoft XBOX controller (US), vendor=0x045e, product=0x0202
- smaller  Microsoft XBOX controller (US), vendor=0x045e, product=0x0289
+3. Supported Controllers
+------------------------
+For a full list of supported controllers and associated vendor and product
+IDs see the xpad_device[] array[6].
+
+As of the historic version 0.0.6 (2006-10-10) the following devices
+were supported:
+ original Microsoft XBOX controller (US),    vendor=0x045e, product=0x0202
+ smaller  Microsoft XBOX controller (US),    vendor=0x045e, product=0x0289
  original Microsoft XBOX controller (Japan), vendor=0x045e, product=0x0285
- InterAct PowerPad Pro (Germany), vendor=0x05fd, product=0x107a
- RedOctane Xbox Dance Pad (US), vendor=0x0c12, product=0x8809
+ InterAct PowerPad Pro (Germany),            vendor=0x05fd, product=0x107a
+ RedOctane Xbox Dance Pad (US),              vendor=0x0c12, product=0x8809
+
+Unrecognized models of Xbox controllers should function as Generic
+Xbox controllers. Unrecognized Dance Pad controllers require setting
+the module option 'dpad_to_buttons'.
+
+If you have an unrecognized controller please see 0.3 - Unknown Controllers
 
-The driver should work with xbox pads not listed above as well, however
-you will need to do something extra for dance pads to work.
 
-If you have a controller not listed above, see 0.3 - Unknown Controllers
+4. Manual Testing
+-----------------
+To test this driver's functionality you may use 'jstest'.
 
-If you compiled and installed the driver, test the functionality:
+For example:
 > modprobe xpad
 > modprobe joydev
 > jstest /dev/js0
@@ -134,7 +169,8 @@ show 20 inputs (6 axes, 14 buttons).
 It works? Voila, you're done ;)
 
 
-3. Thanks
+
+5. Thanks
 ---------
 
 I have to thank ITO Takayuki for the detailed info on his site
@@ -145,14 +181,14 @@ His useful info and both the usb-skeleton as well as the iforce input driver
 the basic functionality.
 
 
-4. References
--------------
 
-1. http://euc.jp/periphs/xbox-controller.ja.html (ITO Takayuki)
-2. http://xpad.xbox-scene.com/
-3. http://www.markosweb.com/www/xboxhackz.com/ 
+6. References
+-------------
 
-4. /proc/bus/usb/devices - dump from InterAct PowerPad Pro (Germany):
+[1]: http://euc.jp/periphs/xbox-controller.ja.html (ITO Takayuki)
+[2]: http://xpad.xbox-scene.com/
+[3]: http://www.markosweb.com/www/xboxhackz.com/
+[4]: /proc/bus/usb/devices - dump from InterAct PowerPad Pro (Germany):
 
 T:  Bus=01 Lev=03 Prnt=04 Port=00 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
 D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=32 #Cfgs=  1
@@ -162,7 +198,7 @@ I:  If#= 0 Alt= 0 #EPs= 2 Cls=58(unk. ) Sub=42 Prot=00 Driver=(none)
 E:  Ad=81(I) Atr=03(Int.) MxPS=  32 Ivl= 10ms
 E:  Ad=02(O) Atr=03(Int.) MxPS=  32 Ivl= 10ms
 
-5. /proc/bus/usb/devices - dump from Redoctane Xbox Dance Pad (US):
+[5]: /proc/bus/usb/devices - dump from Redoctane Xbox Dance Pad (US):
 
 T:  Bus=01 Lev=02 Prnt=09 Port=00 Cnt=01 Dev#= 10 Spd=12  MxCh= 0
 D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
@@ -173,7 +209,12 @@ I:  If#= 0 Alt= 0 #EPs= 2 Cls=58(unk. ) Sub=42 Prot=00 Driver=xpad
 E:  Ad=82(I) Atr=03(Int.) MxPS=  32 Ivl=4ms
 E:  Ad=02(O) Atr=03(Int.) MxPS=  32 Ivl=4ms
 
--- 
+[6]: http://lxr.free-electrons.com/ident?i=xpad_device
+
+
+
+7. Historic Edits
+-----------------
 Marko Friedemann <mfr@bmx-chemnitz.de>
 2002-07-16
  - original doc
@@ -181,3 +222,5 @@ Marko Friedemann <mfr@bmx-chemnitz.de>
 Dominic Cerquetti <binary1230@yahoo.com>
 2005-03-19
  - added stuff for dance pads, new d-pad->axes mappings
+
+Later changes may be viewed with 'git log Documentation/input/xpad.txt'
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index eacb2e0397ae..43ecdcd39df2 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3434,6 +3434,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         neutralize any effect of /proc/sys/kernel/sysrq.
                         Useful for debugging.
 
+        tcpmhash_entries= [KNL,NET]
+                        Set the number of tcp_metrics_hash slots.
+                        Default value is 8192 or 16384 depending on total
+                        ram pages. This is used to specify the TCP metrics
+                        cache size. See Documentation/networking/ip-sysctl.txt
+                        "tcp_no_metrics_save" section for more details.
+
         tdfx=           [HW,DRM]
 
         test_suspend=   [SUSPEND][,N]
diff --git a/Documentation/kobject.txt b/Documentation/kobject.txt
index f87241dfed87..1be59a3a521c 100644
--- a/Documentation/kobject.txt
+++ b/Documentation/kobject.txt
@@ -173,7 +173,7 @@ This should be done only after any attributes or children of the kobject
 have been initialized properly, as userspace will instantly start to look
 for them when this call happens.
 
-When the kobject is removed from the kernel (details on how to do that is
+When the kobject is removed from the kernel (details on how to do that are
 below), the uevent for KOBJ_REMOVE will be automatically created by the
 kobject core, so the caller does not have to worry about doing that by
 hand.
diff --git a/tools/testing/selftests/README.txt b/Documentation/kselftest.txt
index 2660d5ff9179..a87d840bacfe 100644
--- a/tools/testing/selftests/README.txt
+++ b/Documentation/kselftest.txt
@@ -15,37 +15,45 @@ Running the selftests (hotplug tests are run in limited mode)
 =============================================================
 
 To build the tests:
-
   $ make -C tools/testing/selftests
 
 
 To run the tests:
-
   $ make -C tools/testing/selftests run_tests
 
+To build and run the tests with a single command, use:
+  $ make kselftest
+
 - note that some tests will require root privileges.
 
-To run only tests targeted for a single subsystem: (including
-hotplug targets in limited mode)
 
-  $  make -C tools/testing/selftests TARGETS=cpu-hotplug run_tests
+Running a subset of selftests
+========================================
+You can use the "TARGETS" variable on the make command line to specify
+single test to run, or a list of tests to run.
+
+To run only tests targeted for a single subsystem:
+  $  make -C tools/testing/selftests TARGETS=ptrace run_tests
+
+You can specify multiple tests to build and run:
+  $  make TARGETS="size timers" kselftest
+
+See the top-level tools/testing/selftests/Makefile for the list of all
+possible targets.
 
-See the top-level tools/testing/selftests/Makefile for the list of all possible
-targets.
 
 Running the full range hotplug selftests
 ========================================
 
-To build the tests:
-
+To build the hotplug tests:
   $ make -C tools/testing/selftests hotplug
 
-To run the tests:
-
+To run the hotplug tests:
   $ make -C tools/testing/selftests run_hotplug
 
 - note that some tests will require root privileges.
 
+
 Contributing new tests
 ======================
 
diff --git a/Documentation/mailbox.txt b/Documentation/mailbox.txt
index 60f43ff629aa..1092ad9578da 100644
--- a/Documentation/mailbox.txt
+++ b/Documentation/mailbox.txt
@@ -53,7 +53,7 @@ static void message_from_remote(struct mbox_client *cl, void *mssg)
 {
         struct demo_client *dc = container_of(mbox_client,
                                                 struct demo_client, cl);
-        if (dc->aysnc) {
+        if (dc->async) {
                 if (is_an_ack(mssg)) {
                         /* An ACK to our last sample sent */
                         return; /* Or do something else here */
diff --git a/Documentation/mic/mpssd/Makefile b/Documentation/mic/mpssd/Makefile
index 0f3156888048..f47fe6ba7300 100644
--- a/Documentation/mic/mpssd/Makefile
+++ b/Documentation/mic/mpssd/Makefile
@@ -1,5 +1,5 @@
 # List of programs to build
-hostprogs-y := mpssd
+hostprogs-$(CONFIG_X86_64) := mpssd
 
 mpssd-objs := mpssd.o sysfs.o
 
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index f32ce5419573..44fe1d28a163 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -229,13 +229,13 @@ defined in include/linux/pm.h:
     - if set, the value of child_count is ignored (but still updated)
 
   unsigned int disable_depth;
-    - used for disabling the helper funcions (they work normally if this is
+    - used for disabling the helper functions (they work normally if this is
       equal to zero); the initial value of it is 1 (i.e. runtime PM is
       initially disabled for all devices)
 
   int runtime_error;
     - if set, there was a fatal error (one of the callbacks returned error code
-      as described in Section 2), so the helper funtions will not work until
+      as described in Section 2), so the helper functions will not work until
       this flag is cleared; this is the error code returned by the failing
       callback
 
@@ -468,6 +468,10 @@ drivers/base/power/runtime.c and include/linux/pm_runtime.h:
     - set the power.irq_safe flag for the device, causing the runtime-PM
       callbacks to be invoked with interrupts off
 
+  bool pm_runtime_is_irq_safe(struct device *dev);
+    - return true if power.irq_safe flag was set for the device, causing
+      the runtime-PM callbacks to be invoked with interrupts off
+
   void pm_runtime_mark_last_busy(struct device *dev);
     - set the power.last_busy field to the current time
 
@@ -524,7 +528,7 @@ pm_runtime_put_sync_autosuspend()
 5. Runtime PM Initialization, Device Probing and Removal
 
 Initially, the runtime PM is disabled for all devices, which means that the
-majority of the runtime PM helper funtions described in Section 4 will return
+majority of the runtime PM helper functions described in Section 4 will return
 -EAGAIN until pm_runtime_enable() is called for the device.
 
 In addition to that, the initial runtime PM status of all devices is
diff --git a/Documentation/power/suspend-and-interrupts.txt b/Documentation/power/suspend-and-interrupts.txt
index 69663640dea5..2f9c5a5fcb25 100644
--- a/Documentation/power/suspend-and-interrupts.txt
+++ b/Documentation/power/suspend-and-interrupts.txt
@@ -77,7 +77,7 @@ Calling enable_irq_wake() causes suspend_device_irqs() to treat the given IRQ
 in a special way.  Namely, the IRQ remains enabled, by on the first interrupt
 it will be disabled, marked as pending and "suspended" so that it will be
 re-enabled by resume_device_irqs() during the subsequent system resume.  Also
-the PM core is notified about the event which casues the system suspend in
+the PM core is notified about the event which causes the system suspend in
 progress to be aborted (that doesn't have to happen immediately, but at one
 of the points where the suspend thread looks for pending wakeup events).
 
diff --git a/Documentation/power/userland-swsusp.txt b/Documentation/power/userland-swsusp.txt
index 0e870825c1b9..bbfcd1bbedc5 100644
--- a/Documentation/power/userland-swsusp.txt
+++ b/Documentation/power/userland-swsusp.txt
@@ -99,7 +99,7 @@ SNAPSHOT_S2RAM - suspend to RAM; using this call causes the kernel to
 The device's read() operation can be used to transfer the snapshot image from
 the kernel.  It has the following limitations:
 - you cannot read() more than one virtual memory page at a time
-- read()s across page boundaries are impossible (ie. if ypu read() 1/2 of
+- read()s across page boundaries are impossible (ie. if you read() 1/2 of
         a page in the previous call, you will only be able to read()
         _at_ _most_ 1/2 of the page in the next call)
 
diff --git a/Documentation/ramoops.txt b/Documentation/ramoops.txt
index 69b3cac4749d..5d8675615e59 100644
--- a/Documentation/ramoops.txt
+++ b/Documentation/ramoops.txt
@@ -14,11 +14,19 @@ survive after a restart.
 
 1. Ramoops concepts
 
-Ramoops uses a predefined memory area to store the dump. The start and size of
-the memory area are set using two variables:
+Ramoops uses a predefined memory area to store the dump. The start and size
+and type of the memory area are set using three variables:
   * "mem_address" for the start
   * "mem_size" for the size. The memory size will be rounded down to a
   power of two.
+  * "mem_type" to specifiy if the memory type (default is pgprot_writecombine).
+
+Typically the default value of mem_type=0 should be used as that sets the pstore
+mapping to pgprot_writecombine. Setting mem_type=1 attempts to use
+pgprot_noncached, which only works on some platforms. This is because pstore
+depends on atomic operations. At least on ARM, pgprot_noncached causes the
+memory to be mapped strongly ordered, and atomic operations on strongly ordered
+memory are implementation defined, and won't work on many ARMs such as omaps.
 
 The memory area is divided into "record_size" chunks (also rounded down to
 power of two) and each oops/panic writes a "record_size" chunk of
@@ -55,6 +63,7 @@ Setting the ramoops parameters can be done in 2 different manners:
 static struct ramoops_platform_data ramoops_data = {
         .mem_size               = <...>,
         .mem_address            = <...>,
+        .mem_type               = <...>,
         .record_size            = <...>,
         .dump_oops              = <...>,
         .ecc                    = <...>,
diff --git a/Documentation/s390/Debugging390.txt b/Documentation/s390/Debugging390.txt
index 462321c1aeea..08911b5c6b0e 100644
--- a/Documentation/s390/Debugging390.txt
+++ b/Documentation/s390/Debugging390.txt
@@ -26,11 +26,6 @@ The Linux for s/390 & z/Architecture Kernel Task Structure
 Register Usage & Stackframes on Linux for s/390 & z/Architecture
 A sample program with comments
 Compiling programs for debugging on Linux for s/390 & z/Architecture
-Figuring out gcc compile errors
-Debugging Tools
-objdump
-strace
-Performance Debugging 
 Debugging under VM
 s/390 & z/Architecture IO Overview
 Debugging IO on s/390 & z/Architecture under VM
@@ -114,28 +109,25 @@ s/390 z/Architecture
 
 16-17 16-17   Address Space Control
 
-              00 Primary Space Mode when DAT on
-              The linux kernel currently runs in this mode, CR1 is affiliated with 
-              this mode & points to the primary segment table origin etc.
-
-              01 Access register mode this mode is used in functions to 
-              copy data between kernel & user space.
-
-              10 Secondary space mode not used in linux however CR7 the
-              register affiliated with this mode is & this & normally
-              CR13=CR7 to allow us to copy data between kernel & user space.
-              We do this as follows:
-              We set ar2 to 0 to designate its
-              affiliated gpr ( gpr2 )to point to primary=kernel space.
-              We set ar4 to 1 to designate its
-              affiliated gpr ( gpr4 ) to point to secondary=home=user space
-              & then essentially do a memcopy(gpr2,gpr4,size) to
-              copy data between the address spaces, the reason we use home space for the
-              kernel & don't keep secondary space free is that code will not run in 
-              secondary space.
-
-              11 Home Space Mode all user programs run in this mode.
-              it is affiliated with CR13.
+              00 Primary Space Mode:
+              The register CR1 contains the primary address-space control ele-
+              ment (PASCE), which points to the primary space region/segment
+              table origin.
+
+              01 Access register mode
+
+              10 Secondary Space Mode:
+              The register CR7 contains the secondary address-space control
+              element (SASCE), which points to the secondary space region or
+              segment table origin.
+
+              11 Home Space Mode:
+              The register CR13 contains the home space address-space control
+              element (HASCE), which points to the home space region/segment
+              table origin.
+
+              See "Address Spaces on Linux for s/390 & z/Architecture" below
+              for more information about address space usage in Linux.
 
 18-19 18-19   Condition codes (CC)
 
@@ -249,9 +241,9 @@ currently 4TB of physical memory currently on z/Architecture.
 Address Spaces on Linux for s/390 & z/Architecture
 ==================================================
 
-Our addressing scheme is as follows
-
+Our addressing scheme is basically as follows:
 
+                                   Primary Space               Home Space
 Himem 0x7fffffff 2GB on s/390    *****************          ****************
 currently 0x3ffffffffff (2^42)-1 *  User Stack   *          *              *
 on z/Architecture.               *****************          *              *
@@ -264,9 +256,46 @@ on z/Architecture.		 *****************          *              *
                                  *   Sections    *          *              *
 0x00000000                       *****************          ****************
 
-This also means that we need to look at the PSW problem state bit
-or the addressing mode to decide whether we are looking at
-user or kernel space.
+This also means that we need to look at the PSW problem state bit and the
+addressing mode to decide whether we are looking at user or kernel space.
+
+User space runs in primary address mode (or access register mode within
+the vdso code).
+
+The kernel usually also runs in home space mode, however when accessing
+user space the kernel switches to primary or secondary address mode if
+the mvcos instruction is not available or if a compare-and-swap (futex)
+instruction on a user space address is performed.
+
+When also looking at the ASCE control registers, this means:
+
+User space:
+- runs in primary or access register mode
+- cr1 contains the user asce
+- cr7 contains the user asce
+- cr13 contains the kernel asce
+
+Kernel space:
+- runs in home space mode
+- cr1 contains the user or kernel asce
+  -> the kernel asce is loaded when a uaccess requires primary or
+     secondary address mode
+- cr7 contains the user or kernel asce, (changed with set_fs())
+- cr13 contains the kernel asce
+
+In case of uaccess the kernel changes to:
+- primary space mode in case of a uaccess (copy_to_user) and uses
+  e.g. the mvcp instruction to access user space. However the kernel
+  will stay in home space mode if the mvcos instruction is available
+- secondary space mode in case of futex atomic operations, so that the
+  instructions come from primary address space and data from secondary
+  space
+
+In case of KVM, the kernel runs in home space mode, but cr1 gets switched
+to contain the gmap asce before the SIE instruction gets executed. When
+the SIE instruction is finished, cr1 will be switched back to contain the
+user asce.
+
 
 Virtual Addresses on s/390 & z/Architecture
 ===========================================
@@ -706,376 +735,7 @@ Debugging with optimisation has since much improved after fixing
 some bugs, please make sure you are using gdb-5.0 or later developed 
 after Nov'2000.
 
-Figuring out gcc compile errors
-===============================
-If you are getting a lot of syntax errors compiling a program & the problem
-isn't blatantly obvious from the source.
-It often helps to just preprocess the file, this is done with the -E
-option in gcc.
-What this does is that it runs through the very first phase of compilation
-( compilation in gcc is done in several stages & gcc calls many programs to
-achieve its end result ) with the -E option gcc just calls the gcc preprocessor (cpp).
-The c preprocessor does the following, it joins all the files #included together
-recursively ( #include files can #include other files ) & also the c file you wish to compile.
-It puts a fully qualified path of the #included files in a comment & it
-does macro expansion.
-This is useful for debugging because
-1) You can double check whether the files you expect to be included are the ones
-that are being included ( e.g. double check that you aren't going to the i386 asm directory ).
-2) Check that macro definitions aren't clashing with typedefs,
-3) Check that definitions aren't being used before they are being included.
-4) Helps put the line emitting the error under the microscope if it contains macros.
-
-For convenience the Linux kernel's makefile will do preprocessing automatically for you
-by suffixing the file you want built with .i ( instead of .o )
-
-e.g.
-from the linux directory type
-make arch/s390/kernel/signal.i
-this will build
-
-s390-gcc -D__KERNEL__ -I/home1/barrow/linux/include -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer
--fno-strict-aliasing -D__SMP__ -pipe -fno-strength-reduce   -E arch/s390/kernel/signal.c
-> arch/s390/kernel/signal.i  
-
-Now look at signal.i you should see something like.
-
-
-# 1 "/home1/barrow/linux/include/asm/types.h" 1
-typedef unsigned short umode_t;
-typedef __signed__ char __s8;
-typedef unsigned char __u8;
-typedef __signed__ short __s16;
-typedef unsigned short __u16;
-
-If instead you are getting errors further down e.g.
-unknown instruction:2515 "move.l" or better still unknown instruction:2515 
-"Fixme not implemented yet, call Martin" you are probably are attempting to compile some code 
-meant for another architecture or code that is simply not implemented, with a fixme statement
-stuck into the inline assembly code so that the author of the file now knows he has work to do.
-To look at the assembly emitted by gcc just before it is about to call gas ( the gnu assembler )
-use the -S option.
-Again for your convenience the Linux kernel's Makefile will hold your hand &
-do all this donkey work for you also by building the file with the .s suffix.
-e.g.
-from the Linux directory type 
-make arch/s390/kernel/signal.s 
-
-s390-gcc -D__KERNEL__ -I/home1/barrow/linux/include -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer
--fno-strict-aliasing -D__SMP__ -pipe -fno-strength-reduce  -S arch/s390/kernel/signal.c 
--o arch/s390/kernel/signal.s  
-
-
-This will output something like, ( please note the constant pool & the useful comments
-in the prologue to give you a hand at interpreting it ).
-
-.LC54:
-        .string "misaligned (__u16 *) in __xchg\n"
-.LC57:
-        .string "misaligned (__u32 *) in __xchg\n"
-.L$PG1: # Pool sys_sigsuspend
-.LC192:
-        .long   -262401
-.LC193:
-        .long   -1
-.LC194:
-        .long   schedule-.L$PG1
-.LC195:
-        .long   do_signal-.L$PG1
-        .align 4
-.globl sys_sigsuspend
-        .type    sys_sigsuspend,@function
-sys_sigsuspend:
-#       leaf function           0
-#       automatics              16
-#       outgoing args           0
-#       need frame pointer      0
-#       call alloca             0
-#       has varargs             0
-#       incoming args (stack)   0
-#       function length         168
-        STM     8,15,32(15)
-        LR      0,15
-        AHI     15,-112
-        BASR    13,0
-.L$CO1: AHI     13,.L$PG1-.L$CO1
-        ST      0,0(15)
-        LR    8,2
-        N     5,.LC192-.L$PG1(13) 
-
-Adding -g to the above output makes the output even more useful
-e.g. typing
-make CC:="s390-gcc -g" kernel/sched.s
-
-which compiles.
-s390-gcc -g -D__KERNEL__ -I/home/barrow/linux-2.3/include -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-strict-aliasing -pipe -fno-strength-reduce   -S kernel/sched.c -o kernel/sched.s 
-
-also outputs stabs ( debugger ) info, from this info you can find out the
-offsets & sizes of various elements in structures.
-e.g. the stab for the structure
-struct rlimit {
-        unsigned long   rlim_cur;
-        unsigned long   rlim_max;
-};
-is
-.stabs "rlimit:T(151,2)=s8rlim_cur:(0,5),0,32;rlim_max:(0,5),32,32;;",128,0,0,0
-from this stab you can see that 
-rlimit_cur starts at bit offset 0 & is 32 bits in size
-rlimit_max starts at bit offset 32 & is 32 bits in size.
-
-
-Debugging Tools:
-================
-
-objdump
-=======
-This is a tool with many options the most useful being ( if compiled with -g).
-objdump --source <victim program or object file> > <victims debug listing >
-
-
-The whole kernel can be compiled like this ( Doing this will make a 17MB kernel
-& a 200 MB listing ) however you have to strip it before building the image
-using the strip command to make it a more reasonable size to boot it.
-
-A source/assembly mixed dump of the kernel can be done with the line
-objdump --source vmlinux > vmlinux.lst
-Also, if the file isn't compiled -g, this will output as much debugging information
-as it can (e.g. function names). This is very slow as it spends lots
-of time searching for debugging info. The following self explanatory line should be used 
-instead if the code isn't compiled -g, as it is much faster:
-objdump --disassemble-all --syms vmlinux > vmlinux.lst  
-
-As hard drive space is valuable most of us use the following approach.
-1) Look at the emitted psw on the console to find the crash address in the kernel.
-2) Look at the file System.map ( in the linux directory ) produced when building 
-the kernel to find the closest address less than the current PSW to find the
-offending function.
-3) use grep or similar to search the source tree looking for the source file
- with this function if you don't know where it is.
-4) rebuild this object file with -g on, as an example suppose the file was
-( /arch/s390/kernel/signal.o ) 
-5) Assuming the file with the erroneous function is signal.c Move to the base of the 
-Linux source tree.
-6) rm /arch/s390/kernel/signal.o
-7) make /arch/s390/kernel/signal.o
-8) watch the gcc command line emitted
-9) type it in again or alternatively cut & paste it on the console adding the -g option.
-10) objdump --source arch/s390/kernel/signal.o > signal.lst
-This will output the source & the assembly intermixed, as the snippet below shows
-This will unfortunately output addresses which aren't the same
-as the kernel ones you should be able to get around the mental arithmetic
-by playing with the --adjust-vma parameter to objdump.
-
-
-
-
-static inline void spin_lock(spinlock_t *lp)
-{
-      a0:       18 34           lr      %r3,%r4
-      a2:       a7 3a 03 bc     ahi     %r3,956
-        __asm__ __volatile("    lhi   1,-1\n"
-      a6:       a7 18 ff ff     lhi     %r1,-1
-      aa:       1f 00           slr     %r0,%r0
-      ac:       ba 01 30 00     cs      %r0,%r1,0(%r3)
-      b0:       a7 44 ff fd     jm      aa <sys_sigsuspend+0x2e>
-        saveset = current->blocked;
-      b4:       d2 07 f0 68     mvc     104(8,%r15),972(%r4)
-      b8:       43 cc
-        return (set->sig[0] & mask) != 0;
-} 
-
-6) If debugging under VM go down to that section in the document for more info.
-
-
-I now have a tool which takes the pain out of --adjust-vma
-& you are able to do something like
-make /arch/s390/kernel/traps.lst
-& it automatically generates the correctly relocated entries for
-the text segment in traps.lst.
-This tool is now standard in linux distro's in scripts/makelst
-
-strace:
--------
-Q. What is it ?
-A. It is a tool for intercepting calls to the kernel & logging them
-to a file & on the screen.
-
-Q. What use is it ?
-A. You can use it to find out what files a particular program opens.
-
-
 
-Example 1
----------
-If you wanted to know does ping work but didn't have the source 
-strace ping -c 1 127.0.0.1  
-& then look at the man pages for each of the syscalls below,
-( In fact this is sometimes easier than looking at some spaghetti
-source which conditionally compiles for several architectures ).
-Not everything that it throws out needs to make sense immediately.
-
-Just looking quickly you can see that it is making up a RAW socket
-for the ICMP protocol.
-Doing an alarm(10) for a 10 second timeout
-& doing a gettimeofday call before & after each read to see 
-how long the replies took, & writing some text to stdout so the user
-has an idea what is going on.
-
-socket(PF_INET, SOCK_RAW, IPPROTO_ICMP) = 3
-getuid()                                = 0
-setuid(0)                               = 0
-stat("/usr/share/locale/C/libc.cat", 0xbffff134) = -1 ENOENT (No such file or directory)
-stat("/usr/share/locale/libc/C", 0xbffff134) = -1 ENOENT (No such file or directory)
-stat("/usr/local/share/locale/C/libc.cat", 0xbffff134) = -1 ENOENT (No such file or directory)
-getpid()                                = 353
-setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
-setsockopt(3, SOL_SOCKET, SO_RCVBUF, [49152], 4) = 0
-fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(3, 1), ...}) = 0
-mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40008000
-ioctl(1, TCGETS, {B9600 opost isig icanon echo ...}) = 0
-write(1, "PING 127.0.0.1 (127.0.0.1): 56 d"..., 42PING 127.0.0.1 (127.0.0.1): 56 data bytes
-) = 42
-sigaction(SIGINT, {0x8049ba0, [], SA_RESTART}, {SIG_DFL}) = 0 
-sigaction(SIGALRM, {0x8049600, [], SA_RESTART}, {SIG_DFL}) = 0
-gettimeofday({948904719, 138951}, NULL) = 0
-sendto(3, "\10\0D\201a\1\0\0\17#\2178\307\36"..., 64, 0, {sin_family=AF_INET,
-sin_port=htons(0), sin_addr=inet_addr("127.0.0.1")}, 16) = 64
-sigaction(SIGALRM, {0x8049600, [], SA_RESTART}, {0x8049600, [], SA_RESTART}) = 0
-sigaction(SIGALRM, {0x8049ba0, [], SA_RESTART}, {0x8049600, [], SA_RESTART}) = 0
-alarm(10)                               = 0
-recvfrom(3, "E\0\0T\0005\0\0@\1|r\177\0\0\1\177"..., 192, 0, 
-{sin_family=AF_INET, sin_port=htons(50882), sin_addr=inet_addr("127.0.0.1")}, [16]) = 84
-gettimeofday({948904719, 160224}, NULL) = 0
-recvfrom(3, "E\0\0T\0006\0\0\377\1\275p\177\0"..., 192, 0, 
-{sin_family=AF_INET, sin_port=htons(50882), sin_addr=inet_addr("127.0.0.1")}, [16]) = 84
-gettimeofday({948904719, 166952}, NULL) = 0
-write(1, "64 bytes from 127.0.0.1: icmp_se"..., 
-5764 bytes from 127.0.0.1: icmp_seq=0 ttl=255 time=28.0 ms
-
-Example 2
----------
-strace passwd 2>&1 | grep open
-produces the following output
-open("/etc/ld.so.cache", O_RDONLY)      = 3
-open("/opt/kde/lib/libc.so.5", O_RDONLY) = -1 ENOENT (No such file or directory)
-open("/lib/libc.so.5", O_RDONLY)        = 3
-open("/dev", O_RDONLY)                  = 3
-open("/var/run/utmp", O_RDONLY)         = 3
-open("/etc/passwd", O_RDONLY)           = 3
-open("/etc/shadow", O_RDONLY)           = 3
-open("/etc/login.defs", O_RDONLY)       = 4
-open("/dev/tty", O_RDONLY)              = 4 
-
-The 2>&1 is done to redirect stderr to stdout & grep is then filtering this input 
-through the pipe for each line containing the string open.
-
-
-Example 3
----------
-Getting sophisticated
-telnetd crashes & I don't know why
-
-Steps
------
-1) Replace the following line in /etc/inetd.conf
-telnet  stream  tcp     nowait  root    /usr/sbin/in.telnetd -h 
-with
-telnet  stream  tcp     nowait  root    /blah
-
-2) Create the file /blah with the following contents to start tracing telnetd 
-#!/bin/bash
-/usr/bin/strace -o/t1 -f /usr/sbin/in.telnetd -h 
-3) chmod 700 /blah to make it executable only to root
-4)
-killall -HUP inetd
-or ps aux | grep inetd
-get inetd's process id
-& kill -HUP inetd to restart it.
-
-Important options
------------------
--o is used to tell strace to output to a file in our case t1 in the root directory
--f is to follow children i.e.
-e.g in our case above telnetd will start the login process & subsequently a shell like bash.
-You will be able to tell which is which from the process ID's listed on the left hand side
-of the strace output.
--p<pid> will tell strace to attach to a running process, yup this can be done provided
- it isn't being traced or debugged already & you have enough privileges,
-the reason 2 processes cannot trace or debug the same program is that strace
-becomes the parent process of the one being debugged & processes ( unlike people )
-can have only one parent.
-
-
-However the file /t1 will get big quite quickly
-to test it telnet 127.0.0.1
-
-now look at what files in.telnetd execve'd
-413   execve("/usr/sbin/in.telnetd", ["/usr/sbin/in.telnetd", "-h"], [/* 17 vars */]) = 0
-414   execve("/bin/login", ["/bin/login", "-h", "localhost", "-p"], [/* 2 vars */]) = 0 
-
-Whey it worked!.
-
-
-Other hints:
-------------
-If the program is not very interactive ( i.e. not much keyboard input )
-& is crashing in one architecture but not in another you can do 
-an strace of both programs under as identical a scenario as you can
-on both architectures outputting to a file then.
-do a diff of the two traces using the diff program
-i.e.
-diff output1 output2
-& maybe you'll be able to see where the call paths differed, this
-is possibly near the cause of the crash. 
-
-More info
----------
-Look at man pages for strace & the various syscalls
-e.g. man strace, man alarm, man socket.
-
-
-Performance Debugging
-=====================
-gcc is capable of compiling in profiling code just add the -p option
-to the CFLAGS, this obviously affects program size & performance.
-This can be used by the gprof gnu profiling tool or the
-gcov the gnu code coverage tool ( code coverage is a means of testing
-code quality by checking if all the code in an executable in exercised by
-a tester ).
-
-
-Using top to find out where processes are sleeping in the kernel
-----------------------------------------------------------------
-To do this copy the System.map from the root directory where
-the linux kernel was built to the /boot directory on your 
-linux machine.
-Start top
-Now type fU<return>
-You should see a new field called WCHAN which
-tells you where each process is sleeping here is a typical output.
- 
- 6:59pm  up 41 min,  1 user,  load average: 0.00, 0.00, 0.00
-28 processes: 27 sleeping, 1 running, 0 zombie, 0 stopped
-CPU states:  0.0% user,  0.1% system,  0.0% nice, 99.8% idle
-Mem:   254900K av,   45976K used,  208924K free,       0K shrd,   28636K buff
-Swap:       0K av,       0K used,       0K free                    8620K cached
-
-  PID USER     PRI  NI  SIZE  RSS SHARE WCHAN     STAT  LIB %CPU %MEM   TIME COMMAND
-  750 root      12   0   848  848   700 do_select S       0  0.1  0.3   0:00 in.telnetd
-  767 root      16   0  1140 1140   964           R       0  0.1  0.4   0:00 top
-    1 root       8   0   212  212   180 do_select S       0  0.0  0.0   0:00 init
-    2 root       9   0     0    0     0 down_inte SW      0  0.0  0.0   0:00 kmcheck
-
-The time command
-----------------
-Another related command is the time command which gives you an indication
-of where a process is spending the majority of its time.
-e.g.
-time ping -c 5 nc
-outputs
-real    0m4.054s
-user    0m0.010s
-sys     0m0.010s
 
 Debugging under VM
 ==================
diff --git a/Documentation/scsi/scsi_eh.txt b/Documentation/scsi/scsi_eh.txt
index a0c85110a07e..8638f61c8c9d 100644
--- a/Documentation/scsi/scsi_eh.txt
+++ b/Documentation/scsi/scsi_eh.txt
@@ -172,7 +172,7 @@ ways.
 
  - eh_strategy_handler() callback
         This is one big callback which should perform whole error
-        handling.  As such, it should do all choirs SCSI midlayer
+        handling.  As such, it should do all chores the SCSI midlayer
         performs during recovery.  This will be discussed in [2-2].
 
  Once recovery is complete, SCSI EH resumes normal operation by
@@ -428,7 +428,7 @@ scmd->allowed.
 scsi_unjam_host() and it is responsible for whole recovery process.
 On completion, the handler should have made lower layers forget about
 all failed scmds and either ready for new commands or offline.  Also,
-it should perform SCSI EH maintenance choirs to maintain integrity of
+it should perform SCSI EH maintenance chores to maintain integrity of
 SCSI midlayer.  IOW, of the steps described in [2-1-2], all steps
 except for #1 must be implemented by eh_strategy_handler().
 
diff --git a/Documentation/usb/gadget_configfs.txt b/Documentation/usb/gadget_configfs.txt
index 4cf53e406613..635e57493709 100644
--- a/Documentation/usb/gadget_configfs.txt
+++ b/Documentation/usb/gadget_configfs.txt
@@ -376,7 +376,7 @@ functions and binds them. This way the whole gadget is bound.
 configured, so config_groups for particular functions are defined
 in the functions implementation files drivers/usb/gadget/f_*.c.
 
-5. Funciton's code is written in such a way that it uses
+5. Function's code is written in such a way that it uses
 
 usb_get_function_instance(), which, in turn, calls request_module.
 So, provided that modprobe works, modules for particular functions
diff --git a/Documentation/vm/hugetlbpage.txt b/Documentation/vm/hugetlbpage.txt
index b64e0af9cc56..f2d3a100fe38 100644
--- a/Documentation/vm/hugetlbpage.txt
+++ b/Documentation/vm/hugetlbpage.txt
@@ -1,8 +1,8 @@
 
 The intent of this file is to give a brief summary of hugetlbpage support in
 the Linux kernel.  This support is built on top of multiple page size support
-that is provided by most modern architectures.  For example, i386
-architecture supports 4K and 4M (2M in PAE mode) page sizes, ia64
+that is provided by most modern architectures.  For example, x86 CPUs normally
+support 4K and 2M (1G if architecturally supported) page sizes, ia64
 architecture supports multiple page sizes 4K, 8K, 64K, 256K, 1M, 4M, 16M,
 256M and ppc64 supports 4K and 16M.  A TLB is a cache of virtual-to-physical
 translations.  Typically this is a very scarce resource on processor.
diff --git a/MAINTAINERS b/MAINTAINERS
index 34b4b841da40..326dc2d1652d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1722,6 +1722,13 @@ F:	drivers/dma/at_hdmac.c
 F:      drivers/dma/at_hdmac_regs.h
 F:      include/linux/platform_data/dma-atmel.h
 
+ATMEL XDMA DRIVER
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+L:      linux-arm-kernel@lists.infradead.org
+L:      dmaengine@vger.kernel.org
+S:      Supported
+F:      drivers/dma/at_xdmac.c
+
 ATMEL I2C DRIVER
 M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 L:      linux-i2c@vger.kernel.org
@@ -2085,6 +2092,14 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/rpi/linux-rpi.git
 S:      Maintained
 N:      bcm2835
 
+BROADCOM BCM33XX MIPS ARCHITECTURE
+M:      Kevin Cernekee <cernekee@gmail.com>
+L:      linux-mips@linux-mips.org
+S:      Maintained
+F:      arch/mips/bcm3384/*
+F:      arch/mips/include/asm/mach-bcm3384/*
+F:      arch/mips/kernel/*bmips*
+
 BROADCOM BCM5301X ARM ARCHITECTURE
 M:      Hauke Mehrtens <hauke@hauke-m.de>
 L:      linux-arm-kernel@lists.infradead.org
@@ -2101,6 +2116,12 @@ S:	Maintained
 F:      arch/arm/mach-bcm/bcm63xx.c
 F:      arch/arm/include/debug/bcm63xx.S
 
+BROADCOM BCM63XX/BCM33XX UDC DRIVER
+M:      Kevin Cernekee <cernekee@gmail.com>
+L:      linux-usb@vger.kernel.org
+S:      Maintained
+F:      drivers/usb/gadget/udc/bcm63xx_udc.*
+
 BROADCOM BCM7XXX ARM ARCHITECTURE
 M:      Marc Carino <marc.ceeeee@gmail.com>
 M:      Brian Norris <computersforpeace@gmail.com>
@@ -2112,6 +2133,18 @@ F:	arch/arm/mach-bcm/*brcmstb*
 F:      arch/arm/boot/dts/bcm7*.dts*
 F:      drivers/bus/brcmstb_gisb.c
 
+BROADCOM BMIPS MIPS ARCHITECTURE
+M:      Kevin Cernekee <cernekee@gmail.com>
+M:      Florian Fainelli <f.fainelli@gmail.com>
+L:      linux-mips@linux-mips.org
+S:      Maintained
+F:      arch/mips/bmips/*
+F:      arch/mips/include/asm/mach-bmips/*
+F:      arch/mips/kernel/*bmips*
+F:      arch/mips/boot/dts/bcm*.dts*
+F:      drivers/irqchip/irq-bcm7*
+F:      drivers/irqchip/irq-brcmstb*
+
 BROADCOM TG3 GIGABIT ETHERNET DRIVER
 M:      Prashant Sreedharan <prashant@broadcom.com>
 M:      Michael Chan <mchan@broadcom.com>
@@ -3136,7 +3169,8 @@ Q:	https://patchwork.kernel.org/project/linux-dmaengine/list/
 S:      Maintained
 F:      drivers/dma/
 F:      include/linux/dma*
-T:      git git://git.infradead.org/users/vkoul/slave-dma.git (slave-dma)
+F:      Documentation/dmaengine/
+T:      git git://git.infradead.org/users/vkoul/slave-dma.git
 
 DME1737 HARDWARE MONITOR DRIVER
 M:      Juerg Haefliger <juergh@gmail.com>
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index c8424a85bc04..0bee1fe209b1 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -687,7 +687,9 @@ config ARCH_SA1100
         select CPU_SA1100
         select GENERIC_CLOCKEVENTS
         select HAVE_IDE
+        select IRQ_DOMAIN
         select ISA
+        select MULTI_IRQ_HANDLER
         select NEED_MACH_MEMORY_H
         select SPARSE_IRQ
         help
diff --git a/arch/arm/boot/dts/bcm63138.dtsi b/arch/arm/boot/dts/bcm63138.dtsi
index f3bb2dd6269e..d2d8e94e0aa2 100644
--- a/arch/arm/boot/dts/bcm63138.dtsi
+++ b/arch/arm/boot/dts/bcm63138.dtsi
@@ -102,7 +102,7 @@
                 twd_watchdog: watchdog@1e620 {
                         compatible = "arm,cortex-a9-twd-wdt";
                         reg = <0x1e620 0x20>;
-                        interupts = <GIC_PPI 14 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 14 IRQ_TYPE_LEVEL_HIGH>;
                 };
         };
 
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index e57d7e5bf96a..7b69c5f9cd74 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -282,8 +282,8 @@ static int sa1111_retrigger_lowirq(struct irq_data *d)
         }
 
         if (i == 8)
-                printk(KERN_ERR "Danger Will Robinson: failed to "
-                        "re-trigger IRQ%d\n", d->irq);
+                pr_err("Danger Will Robinson: failed to re-trigger IRQ%d\n",
+                       d->irq);
         return i == 8 ? -1 : 0;
 }
 
@@ -384,8 +384,8 @@ static int sa1111_retrigger_highirq(struct irq_data *d)
         }
 
         if (i == 8)
-                printk(KERN_ERR "Danger Will Robinson: failed to "
-                        "re-trigger IRQ%d\n", d->irq);
+                pr_err("Danger Will Robinson: failed to re-trigger IRQ%d\n",
+                       d->irq);
         return i == 8 ? -1 : 0;
 }
 
@@ -740,9 +740,8 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
                 goto err_unmap;
         }
 
-        printk(KERN_INFO "SA1111 Microprocessor Companion Chip: "
-                "silicon revision %lx, metal revision %lx\n",
-                (id & SKID_SIREV_MASK)>>4, (id & SKID_MTREV_MASK));
+        pr_info("SA1111 Microprocessor Companion Chip: silicon revision %lx, metal revision %lx\n",
+                (id & SKID_SIREV_MASK) >> 4, id & SKID_MTREV_MASK);
 
         /*
          * We found it.  Wake the chip up, and initialise.
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index 10e78d00a0bb..2d46862e7bef 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -487,6 +487,16 @@ int set_memory_rw(unsigned long addr, int numpages);
 int set_memory_x(unsigned long addr, int numpages);
 int set_memory_nx(unsigned long addr, int numpages);
 
+#ifdef CONFIG_DEBUG_RODATA
+void mark_rodata_ro(void);
+void set_kernel_text_rw(void);
+void set_kernel_text_ro(void);
+#else
+static inline void set_kernel_text_rw(void) { }
+static inline void set_kernel_text_ro(void) { }
+#endif
+
 void flush_uprobe_xol_access(struct page *page, unsigned long uaddr,
                              void *kaddr, unsigned long len);
+
 #endif
diff --git a/arch/arm/include/asm/device.h b/arch/arm/include/asm/device.h
index dc662fca9230..4111592f0130 100644
--- a/arch/arm/include/asm/device.h
+++ b/arch/arm/include/asm/device.h
@@ -17,6 +17,7 @@ struct dev_archdata {
 #ifdef CONFIG_ARM_DMA_USE_IOMMU
         struct dma_iommu_mapping        *mapping;
 #endif
+        bool dma_coherent;
 };
 
 struct omap_device;
diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
index 85738b200023..e6e3446abdf6 100644
--- a/arch/arm/include/asm/dma-mapping.h
+++ b/arch/arm/include/asm/dma-mapping.h
@@ -123,11 +123,18 @@ static inline unsigned long dma_max_pfn(struct device *dev)
 
 static inline int set_arch_dma_coherent_ops(struct device *dev)
 {
+        dev->archdata.dma_coherent = true;
         set_dma_ops(dev, &arm_coherent_dma_ops);
         return 0;
 }
 #define set_arch_dma_coherent_ops(dev)  set_arch_dma_coherent_ops(dev)
 
+/* do not use this function in a driver */
+static inline bool is_device_dma_coherent(struct device *dev)
+{
+        return dev->archdata.dma_coherent;
+}
+
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
 {
         unsigned int offset = paddr & ~PAGE_MASK;
diff --git a/arch/arm/include/asm/fixmap.h b/arch/arm/include/asm/fixmap.h
index 74124b0d0d79..0415eae1df27 100644
--- a/arch/arm/include/asm/fixmap.h
+++ b/arch/arm/include/asm/fixmap.h
@@ -2,27 +2,24 @@
 #define _ASM_FIXMAP_H
 
 #define FIXADDR_START           0xffc00000UL
-#define FIXADDR_TOP             0xffe00000UL
-#define FIXADDR_SIZE            (FIXADDR_TOP - FIXADDR_START)
+#define FIXADDR_END             0xfff00000UL
+#define FIXADDR_TOP             (FIXADDR_END - PAGE_SIZE)
 
-#define FIX_KMAP_NR_PTES        (FIXADDR_SIZE >> PAGE_SHIFT)
+#include <asm/kmap_types.h>
 
-#define __fix_to_virt(x)        (FIXADDR_START + ((x) << PAGE_SHIFT))
-#define __virt_to_fix(x)        (((x) - FIXADDR_START) >> PAGE_SHIFT)
+enum fixed_addresses {
+        FIX_KMAP_BEGIN,
+        FIX_KMAP_END = FIX_KMAP_BEGIN + (KM_TYPE_NR * NR_CPUS) - 1,
 
-extern void __this_fixmap_does_not_exist(void);
+        /* Support writing RO kernel text via kprobes, jump labels, etc. */
+        FIX_TEXT_POKE0,
+        FIX_TEXT_POKE1,
 
-static inline unsigned long fix_to_virt(const unsigned int idx)
-{
-        if (idx >= FIX_KMAP_NR_PTES)
-                __this_fixmap_does_not_exist();
-        return __fix_to_virt(idx);
-}
+        __end_of_fixed_addresses
+};
 
-static inline unsigned int virt_to_fix(const unsigned long vaddr)
-{
-        BUG_ON(vaddr >= FIXADDR_TOP || vaddr < FIXADDR_START);
-        return __virt_to_fix(vaddr);
-}
+void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot);
+
+#include <asm-generic/fixmap.h>
 
 #endif
diff --git a/arch/arm/include/asm/hw_irq.h b/arch/arm/include/asm/hw_irq.h
index a71b417b1856..af79da40af2a 100644
--- a/arch/arm/include/asm/hw_irq.h
+++ b/arch/arm/include/asm/hw_irq.h
@@ -8,6 +8,7 @@ static inline void ack_bad_irq(int irq)
 {
         extern unsigned long irq_err_count;
         irq_err_count++;
+        pr_crit("unexpected IRQ trap at vector %02x\n", irq);
 }
 
 void set_irq_flags(unsigned int irq, unsigned int flags);
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index d428e386c88e..3446f6a1d9fa 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -219,6 +219,23 @@ void __mcpm_outbound_leave_critical(unsigned int cluster, int state);
 bool __mcpm_outbound_enter_critical(unsigned int this_cpu, unsigned int cluster);
 int __mcpm_cluster_state(unsigned int cluster);
 
+/**
+ * mcpm_sync_init - Initialize the cluster synchronization support
+ *
+ * @power_up_setup: platform specific function invoked during very
+ *                  early CPU/cluster bringup stage.
+ *
+ * This prepares memory used by vlocks and the MCPM state machine used
+ * across CPUs that may have their caches active or inactive. Must be
+ * called only after a successful call to mcpm_platform_register().
+ *
+ * The power_up_setup argument is a pointer to assembly code called when
+ * the MMU and caches are still disabled during boot  and no stack space is
+ * available. The affinity level passed to that code corresponds to the
+ * resource that needs to be initialized (e.g. 1 for cluster level, 0 for
+ * CPU level).  Proper exclusion mechanisms are already activated at that
+ * point.
+ */
 int __init mcpm_sync_init(
         void (*power_up_setup)(unsigned int affinity_level));
 
diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h
index 209e6504922e..a89b4076cde4 100644
--- a/arch/arm/include/asm/percpu.h
+++ b/arch/arm/include/asm/percpu.h
@@ -30,14 +30,14 @@ static inline void set_my_cpu_offset(unsigned long off)
 static inline unsigned long __my_cpu_offset(void)
 {
         unsigned long off;
-        register unsigned long *sp asm ("sp");
 
         /*
          * Read TPIDRPRW.
          * We want to allow caching the value, so avoid using volatile and
          * instead use a fake stack read to hazard against barrier().
          */
-        asm("mrc p15, 0, %0, c13, c0, 4" : "=r" (off) : "Q" (*sp));
+        asm("mrc p15, 0, %0, c13, c0, 4" : "=r" (off)
+                : "Q" (*(const unsigned long *)current_stack_pointer));
 
         return off;
 }
diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
index 78a779361682..19cfab526d13 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -157,7 +157,15 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)
 static inline void
 pmd_populate(struct mm_struct *mm, pmd_t *pmdp, pgtable_t ptep)
 {
-        __pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE);
+        extern pmdval_t user_pmd_table;
+        pmdval_t prot;
+
+        if (__LINUX_ARM_ARCH__ >= 6 && !IS_ENABLED(CONFIG_ARM_LPAE))
+                prot = user_pmd_table;
+        else
+                prot = _PAGE_USER_TABLE;
+
+        __pmd_populate(pmdp, page_to_phys(ptep), prot);
 }
 #define pmd_pgtable(pmd) pmd_page(pmd)
 
diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
index 5cfba15cb401..5e68278e953e 100644
--- a/arch/arm/include/asm/pgtable-2level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
@@ -20,12 +20,14 @@
 #define PMD_TYPE_FAULT          (_AT(pmdval_t, 0) << 0)
 #define PMD_TYPE_TABLE          (_AT(pmdval_t, 1) << 0)
 #define PMD_TYPE_SECT           (_AT(pmdval_t, 2) << 0)
+#define PMD_PXNTABLE            (_AT(pmdval_t, 1) << 2)     /* v7 */
 #define PMD_BIT4                (_AT(pmdval_t, 1) << 4)
 #define PMD_DOMAIN(x)           (_AT(pmdval_t, (x)) << 5)
 #define PMD_PROTECTION          (_AT(pmdval_t, 1) << 9)         /* v5 */
 /*
  *   - section
  */
+#define PMD_SECT_PXN    (_AT(pmdval_t, 1) << 0)     /* v7 */
 #define PMD_SECT_BUFFERABLE     (_AT(pmdval_t, 1) << 2)
 #define PMD_SECT_CACHEABLE      (_AT(pmdval_t, 1) << 3)
 #define PMD_SECT_XN             (_AT(pmdval_t, 1) << 4)         /* v6 */
diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
index 9fd61c72a33a..f8f1cff62065 100644
--- a/arch/arm/include/asm/pgtable-3level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
@@ -76,6 +76,7 @@
 #define PTE_EXT_SHARED          (_AT(pteval_t, 3) << 8)         /* SH[1:0], inner shareable */
 #define PTE_EXT_AF              (_AT(pteval_t, 1) << 10)        /* Access Flag */
 #define PTE_EXT_NG              (_AT(pteval_t, 1) << 11)        /* nG */
+#define PTE_EXT_PXN             (_AT(pteval_t, 1) << 53)        /* PXN */
 #define PTE_EXT_XN              (_AT(pteval_t, 1) << 54)        /* XN */
 
 /*
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index 3b30062975b2..d5cac545ba33 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -252,17 +252,57 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
         set_pte_ext(ptep, pteval, ext);
 }
 
-#define PTE_BIT_FUNC(fn,op) \
-static inline pte_t pte_##fn(pte_t pte) { pte_val(pte) op; return pte; }
-
-PTE_BIT_FUNC(wrprotect, |= L_PTE_RDONLY);
-PTE_BIT_FUNC(mkwrite,   &= ~L_PTE_RDONLY);
-PTE_BIT_FUNC(mkclean,   &= ~L_PTE_DIRTY);
-PTE_BIT_FUNC(mkdirty,   |= L_PTE_DIRTY);
-PTE_BIT_FUNC(mkold,     &= ~L_PTE_YOUNG);
-PTE_BIT_FUNC(mkyoung,   |= L_PTE_YOUNG);
-PTE_BIT_FUNC(mkexec,   &= ~L_PTE_XN);
-PTE_BIT_FUNC(mknexec,   |= L_PTE_XN);
+static inline pte_t clear_pte_bit(pte_t pte, pgprot_t prot)
+{
+        pte_val(pte) &= ~pgprot_val(prot);
+        return pte;
+}
+
+static inline pte_t set_pte_bit(pte_t pte, pgprot_t prot)
+{
+        pte_val(pte) |= pgprot_val(prot);
+        return pte;
+}
+
+static inline pte_t pte_wrprotect(pte_t pte)
+{
+        return set_pte_bit(pte, __pgprot(L_PTE_RDONLY));
+}
+
+static inline pte_t pte_mkwrite(pte_t pte)
+{
+        return clear_pte_bit(pte, __pgprot(L_PTE_RDONLY));
+}
+
+static inline pte_t pte_mkclean(pte_t pte)
+{
+        return clear_pte_bit(pte, __pgprot(L_PTE_DIRTY));
+}
+
+static inline pte_t pte_mkdirty(pte_t pte)
+{
+        return set_pte_bit(pte, __pgprot(L_PTE_DIRTY));
+}
+
+static inline pte_t pte_mkold(pte_t pte)
+{
+        return clear_pte_bit(pte, __pgprot(L_PTE_YOUNG));
+}
+
+static inline pte_t pte_mkyoung(pte_t pte)
+{
+        return set_pte_bit(pte, __pgprot(L_PTE_YOUNG));
+}
+
+static inline pte_t pte_mkexec(pte_t pte)
+{
+        return clear_pte_bit(pte, __pgprot(L_PTE_XN));
+}
+
+static inline pte_t pte_mknexec(pte_t pte)
+{
+        return set_pte_bit(pte, __pgprot(L_PTE_XN));
+}
 
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
index 601264d983fa..51622ba7c4a6 100644
--- a/arch/arm/include/asm/ptrace.h
+++ b/arch/arm/include/asm/ptrace.h
@@ -154,9 +154,8 @@ static inline unsigned long user_stack_pointer(struct pt_regs *regs)
         return regs->ARM_sp;
 }
 
-#define current_pt_regs(void) ({                                \
-        register unsigned long sp asm ("sp");                   \
-        (struct pt_regs *)((sp | (THREAD_SIZE - 1)) - 7) - 1;   \
+#define current_pt_regs(void) ({ (struct pt_regs *)                     \
+                ((current_stack_pointer | (THREAD_SIZE - 1)) - 7) - 1;  \
 })
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index ce73ab635414..d890e41f5520 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -90,14 +90,19 @@ struct thread_info {
 #define init_stack              (init_thread_union.stack)
 
 /*
+ * how to get the current stack pointer in C
+ */
+register unsigned long current_stack_pointer asm ("sp");
+
+/*
  * how to get the thread information struct from C
  */
 static inline struct thread_info *current_thread_info(void) __attribute_const__;
 
 static inline struct thread_info *current_thread_info(void)
 {
-        register unsigned long sp asm ("sp");
-        return (struct thread_info *)(sp & ~(THREAD_SIZE - 1));
+        return (struct thread_info *)
+                (current_stack_pointer & ~(THREAD_SIZE - 1));
 }
 
 #define thread_saved_pc(tsk)    \
diff --git a/arch/arm/include/asm/vfp.h b/arch/arm/include/asm/vfp.h
index f4ab34fd4f72..ee5f3084243c 100644
--- a/arch/arm/include/asm/vfp.h
+++ b/arch/arm/include/asm/vfp.h
@@ -22,6 +22,7 @@
 #define FPSID_NODOUBLE          (1<<20)
 #define FPSID_ARCH_BIT          (16)
 #define FPSID_ARCH_MASK         (0xF  << FPSID_ARCH_BIT)
+#define FPSID_CPUID_ARCH_MASK   (0x7F  << FPSID_ARCH_BIT)
 #define FPSID_PART_BIT          (8)
 #define FPSID_PART_MASK         (0xFF << FPSID_PART_BIT)
 #define FPSID_VARIANT_BIT       (4)
@@ -75,6 +76,10 @@
 /* MVFR0 bits */
 #define MVFR0_A_SIMD_BIT        (0)
 #define MVFR0_A_SIMD_MASK       (0xf << MVFR0_A_SIMD_BIT)
+#define MVFR0_SP_BIT            (4)
+#define MVFR0_SP_MASK           (0xf << MVFR0_SP_BIT)
+#define MVFR0_DP_BIT            (8)
+#define MVFR0_DP_MASK           (0xf << MVFR0_DP_BIT)
 
 /* Bit patterns for decoding the packaged operation descriptors */
 #define VFPOPDESC_LENGTH_BIT    (9)
diff --git a/arch/arm/include/asm/xen/page-coherent.h b/arch/arm/include/asm/xen/page-coherent.h
index e8275ea88e88..efd562412850 100644
--- a/arch/arm/include/asm/xen/page-coherent.h
+++ b/arch/arm/include/asm/xen/page-coherent.h
@@ -5,6 +5,18 @@
 #include <linux/dma-attrs.h>
 #include <linux/dma-mapping.h>
 
+void __xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, struct dma_attrs *attrs);
+void __xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir,
+                struct dma_attrs *attrs);
+void __xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir);
+
+void __xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir);
+
 static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
                 dma_addr_t *dma_handle, gfp_t flags,
                 struct dma_attrs *attrs)
@@ -20,20 +32,56 @@ static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
 }
 
 static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             unsigned long offset, size_t size, enum dma_data_direction dir,
-             struct dma_attrs *attrs)
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, struct dma_attrs *attrs)
 {
-        __generic_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
+        bool local = PFN_DOWN(dev_addr) == page_to_pfn(page);
+        /* Dom0 is mapped 1:1, so if pfn == mfn the page is local otherwise
+         * is a foreign page grant-mapped in dom0. If the page is local we
+         * can safely call the native dma_ops function, otherwise we call
+         * the xen specific function. */
+        if (local)
+                __generic_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
 }
 
-void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
                 size_t size, enum dma_data_direction dir,
-                struct dma_attrs *attrs);
+                struct dma_attrs *attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /* Dom0 is mapped 1:1, so calling pfn_valid on a foreign mfn will
+         * always return false. If the page is local we can safely call the
+         * native dma_ops function, otherwise we call the xen specific
+         * function. */
+        if (pfn_valid(pfn)) {
+                if (__generic_dma_ops(hwdev)->unmap_page)
+                        __generic_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
+        } else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
 
-void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir);
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (__generic_dma_ops(hwdev)->sync_single_for_cpu)
+                        __generic_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
 
-void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir);
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (__generic_dma_ops(hwdev)->sync_single_for_device)
+                        __generic_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
 
 #endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
index 135c24a5ba26..68c739b3fdf4 100644
--- a/arch/arm/include/asm/xen/page.h
+++ b/arch/arm/include/asm/xen/page.h
@@ -107,4 +107,8 @@ static inline bool set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 #define xen_remap(cookie, size) ioremap_cache((cookie), (size))
 #define xen_unmap(cookie) iounmap((cookie))
 
+bool xen_arch_need_swiotlb(struct device *dev,
+                           unsigned long pfn,
+                           unsigned long mfn);
+
 #endif /* _ASM_ARM_XEN_PAGE_H */
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 8dcbed5016ac..f290ac892a95 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -47,6 +47,7 @@ endif
 obj-$(CONFIG_HAVE_ARM_SCU)      += smp_scu.o
 obj-$(CONFIG_HAVE_ARM_TWD)      += smp_twd.o
 obj-$(CONFIG_ARM_ARCH_TIMER)    += arch_timer.o
+obj-$(CONFIG_FUNCTION_TRACER)   += entry-ftrace.o
 obj-$(CONFIG_DYNAMIC_FTRACE)    += ftrace.o insn.o
 obj-$(CONFIG_FUNCTION_GRAPH_TRACER)     += ftrace.o insn.o
 obj-$(CONFIG_JUMP_LABEL)        += jump_label.o insn.o patch.o
@@ -67,7 +68,7 @@ test-kprobes-objs		+= kprobes-test-arm.o
 endif
 obj-$(CONFIG_OABI_COMPAT)       += sys_oabi-compat.o
 obj-$(CONFIG_ARM_THUMBEE)       += thumbee.o
-obj-$(CONFIG_KGDB)              += kgdb.o
+obj-$(CONFIG_KGDB)              += kgdb.o patch.o
 obj-$(CONFIG_ARM_UNWIND)        += unwind.o
 obj-$(CONFIG_HAVE_TCM)          += tcm.o
 obj-$(CONFIG_OF)                += devtree.o
@@ -84,6 +85,7 @@ obj-$(CONFIG_CPU_PJ4B)		+= pj4-cp0.o
 obj-$(CONFIG_IWMMXT)            += iwmmxt.o
 obj-$(CONFIG_PERF_EVENTS)       += perf_regs.o perf_callchain.o
 obj-$(CONFIG_HW_PERF_EVENTS)    += perf_event.o perf_event_cpu.o
+CFLAGS_pj4-cp0.o                := -marm
 AFLAGS_iwmmxt.o                 := -Wa,-mcpu=iwmmxt
 obj-$(CONFIG_ARM_CPU_TOPOLOGY)  += topology.o
 
diff --git a/arch/arm/kernel/atags_compat.c b/arch/arm/kernel/atags_compat.c
index 5236ad38f417..05c28b12353c 100644
--- a/arch/arm/kernel/atags_compat.c
+++ b/arch/arm/kernel/atags_compat.c
@@ -97,8 +97,7 @@ static void __init build_tag_list(struct param_struct *params, void *taglist)
         struct tag *tag = taglist;
 
         if (params->u1.s.page_size != PAGE_SIZE) {
-                printk(KERN_WARNING "Warning: bad configuration page, "
-                       "trying to continue\n");
+                pr_warn("Warning: bad configuration page, trying to continue\n");
                 return;
         }
 
@@ -109,8 +108,7 @@ static void __init build_tag_list(struct param_struct *params, void *taglist)
             params->u1.s.nr_pages != 0x04000 &&
             params->u1.s.nr_pages != 0x08000 &&
             params->u1.s.nr_pages != 0x10000) {
-                printk(KERN_WARNING "Warning: bad NeTTrom parameters "
-                       "detected, using defaults\n");
+                pr_warn("Warning: bad NeTTrom parameters detected, using defaults\n");
 
                 params->u1.s.nr_pages = 0x1000; /* 16MB */
                 params->u1.s.ramdisk_size = 0;
diff --git a/arch/arm/kernel/atags_parse.c b/arch/arm/kernel/atags_parse.c
index 528f8af2addb..68c6ae0b9e4c 100644
--- a/arch/arm/kernel/atags_parse.c
+++ b/arch/arm/kernel/atags_parse.c
@@ -167,8 +167,7 @@ static void __init parse_tags(const struct tag *t)
 {
         for (; t->hdr.size; t = tag_next(t))
                 if (!parse_tag(t))
-                        printk(KERN_WARNING
-                                "Ignoring unrecognised tag 0x%08x\n",
+                        pr_warn("Ignoring unrecognised tag 0x%08x\n",
                                 t->hdr.tag);
 }
 
@@ -193,7 +192,7 @@ setup_machine_tags(phys_addr_t __atags_pointer, unsigned int machine_nr)
          */
         for_each_machine_desc(p)
                 if (machine_nr == p->nr) {
-                        printk("Machine: %s\n", p->name);
+                        pr_info("Machine: %s\n", p->name);
                         mdesc = p;
                         break;
                 }
diff --git a/arch/arm/kernel/atags_proc.c b/arch/arm/kernel/atags_proc.c
index c7ff8073416f..5a3379055f55 100644
--- a/arch/arm/kernel/atags_proc.c
+++ b/arch/arm/kernel/atags_proc.c
@@ -41,7 +41,7 @@ static int __init init_atags_procfs(void)
         size_t size;
 
         if (tag->hdr.tag != ATAG_CORE) {
-                printk(KERN_INFO "No ATAGs?");
+                pr_info("No ATAGs?");
                 return -EINVAL;
         }
 
@@ -68,7 +68,7 @@ static int __init init_atags_procfs(void)
 
 nomem:
         kfree(b);
-        printk(KERN_ERR "Exporting ATAGs: not enough memory\n");
+        pr_err("Exporting ATAGs: not enough memory\n");
 
         return -ENOMEM;
 }
diff --git a/arch/arm/kernel/bios32.c b/arch/arm/kernel/bios32.c
index daaff73bc776..a4effd6d8f2f 100644
--- a/arch/arm/kernel/bios32.c
+++ b/arch/arm/kernel/bios32.c
@@ -364,7 +364,7 @@ void pcibios_fixup_bus(struct pci_bus *bus)
         /*
          * Report what we did for this bus
          */
-        printk(KERN_INFO "PCI: bus%d: Fast back to back transfers %sabled\n",
+        pr_info("PCI: bus%d: Fast back to back transfers %sabled\n",
                 bus->number, (features & PCI_COMMAND_FAST_BACK) ? "en" : "dis");
 }
 EXPORT_SYMBOL(pcibios_fixup_bus);
diff --git a/arch/arm/kernel/dma-isa.c b/arch/arm/kernel/dma-isa.c
index 360bb6d701f5..84363fe7bad2 100644
--- a/arch/arm/kernel/dma-isa.c
+++ b/arch/arm/kernel/dma-isa.c
@@ -213,8 +213,8 @@ void __init isa_init_dma(void)
                 for (chan = 0; chan < 8; chan++) {
                         int ret = isa_dma_add(chan, &isa_dma[chan]);
                         if (ret)
-                                printk(KERN_ERR "ISADMA%u: unable to register: %d\n",
-                                        chan, ret);
+                                pr_err("ISADMA%u: unable to register: %d\n",
+                                       chan, ret);
                 }
 
                 request_dma(DMA_ISA_CASCADE, "cascade");
diff --git a/arch/arm/kernel/dma.c b/arch/arm/kernel/dma.c
index 7b829d9663b1..e651c4d0a0d9 100644
--- a/arch/arm/kernel/dma.c
+++ b/arch/arm/kernel/dma.c
@@ -79,7 +79,7 @@ int request_dma(unsigned int chan, const char *device_id)
         return ret;
 
 bad_dma:
-        printk(KERN_ERR "dma: trying to allocate DMA%d\n", chan);
+        pr_err("dma: trying to allocate DMA%d\n", chan);
         return -EINVAL;
 
 busy:
@@ -100,7 +100,7 @@ void free_dma(unsigned int chan)
                 goto bad_dma;
 
         if (dma->active) {
-                printk(KERN_ERR "dma%d: freeing active DMA\n", chan);
+                pr_err("dma%d: freeing active DMA\n", chan);
                 dma->d_ops->disable(chan, dma);
                 dma->active = 0;
         }
@@ -111,11 +111,11 @@ void free_dma(unsigned int chan)
                 return;
         }
 
-        printk(KERN_ERR "dma%d: trying to free free DMA\n", chan);
+        pr_err("dma%d: trying to free free DMA\n", chan);
         return;
 
 bad_dma:
-        printk(KERN_ERR "dma: trying to free DMA%d\n", chan);
+        pr_err("dma: trying to free DMA%d\n", chan);
 }
 EXPORT_SYMBOL(free_dma);
 
@@ -126,8 +126,7 @@ void set_dma_sg (unsigned int chan, struct scatterlist *sg, int nr_sg)
         dma_t *dma = dma_channel(chan);
 
         if (dma->active)
-                printk(KERN_ERR "dma%d: altering DMA SG while "
-                       "DMA active\n", chan);
+                pr_err("dma%d: altering DMA SG while DMA active\n", chan);
 
         dma->sg = sg;
         dma->sgcount = nr_sg;
@@ -144,8 +143,7 @@ void __set_dma_addr (unsigned int chan, void *addr)
         dma_t *dma = dma_channel(chan);
 
         if (dma->active)
-                printk(KERN_ERR "dma%d: altering DMA address while "
-                       "DMA active\n", chan);
+                pr_err("dma%d: altering DMA address while DMA active\n", chan);
 
         dma->sg = NULL;
         dma->addr = addr;
@@ -162,8 +160,7 @@ void set_dma_count (unsigned int chan, unsigned long count)
         dma_t *dma = dma_channel(chan);
 
         if (dma->active)
-                printk(KERN_ERR "dma%d: altering DMA count while "
-                       "DMA active\n", chan);
+                pr_err("dma%d: altering DMA count while DMA active\n", chan);
 
         dma->sg = NULL;
         dma->count = count;
@@ -178,8 +175,7 @@ void set_dma_mode (unsigned int chan, unsigned int mode)
         dma_t *dma = dma_channel(chan);
 
         if (dma->active)
-                printk(KERN_ERR "dma%d: altering DMA mode while "
-                       "DMA active\n", chan);
+                pr_err("dma%d: altering DMA mode while DMA active\n", chan);
 
         dma->dma_mode = mode;
         dma->invalid = 1;
@@ -202,7 +198,7 @@ void enable_dma (unsigned int chan)
         return;
 
 free_dma:
-        printk(KERN_ERR "dma%d: trying to enable free DMA\n", chan);
+        pr_err("dma%d: trying to enable free DMA\n", chan);
         BUG();
 }
 EXPORT_SYMBOL(enable_dma);
@@ -223,7 +219,7 @@ void disable_dma (unsigned int chan)
         return;
 
 free_dma:
-        printk(KERN_ERR "dma%d: trying to disable free DMA\n", chan);
+        pr_err("dma%d: trying to disable free DMA\n", chan);
         BUG();
 }
 EXPORT_SYMBOL(disable_dma);
@@ -240,7 +236,7 @@ EXPORT_SYMBOL(dma_channel_active);
 
 void set_dma_page(unsigned int chan, char pagenr)
 {
-        printk(KERN_ERR "dma%d: trying to set_dma_page\n", chan);
+        pr_err("dma%d: trying to set_dma_page\n", chan);
 }
 EXPORT_SYMBOL(set_dma_page);
 
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 6bb09d4abdea..f8ccc21fa032 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -109,241 +109,6 @@ ENDPROC(ret_from_fork)
 #undef CALL
 #define CALL(x) .long x
 
-#ifdef CONFIG_FUNCTION_TRACER
-/*
- * When compiling with -pg, gcc inserts a call to the mcount routine at the
- * start of every function.  In mcount, apart from the function's address (in
- * lr), we need to get hold of the function's caller's address.
- *
- * Older GCCs (pre-4.4) inserted a call to a routine called mcount like this:
- *
- *      bl      mcount
- *
- * These versions have the limitation that in order for the mcount routine to
- * be able to determine the function's caller's address, an APCS-style frame
- * pointer (which is set up with something like the code below) is required.
- *
- *      mov     ip, sp
- *      push    {fp, ip, lr, pc}
- *      sub     fp, ip, #4
- *
- * With EABI, these frame pointers are not available unless -mapcs-frame is
- * specified, and if building as Thumb-2, not even then.
- *
- * Newer GCCs (4.4+) solve this problem by introducing a new version of mcount,
- * with call sites like:
- *
- *      push    {lr}
- *      bl      __gnu_mcount_nc
- *
- * With these compilers, frame pointers are not necessary.
- *
- * mcount can be thought of as a function called in the middle of a subroutine
- * call.  As such, it needs to be transparent for both the caller and the
- * callee: the original lr needs to be restored when leaving mcount, and no
- * registers should be clobbered.  (In the __gnu_mcount_nc implementation, we
- * clobber the ip register.  This is OK because the ARM calling convention
- * allows it to be clobbered in subroutines and doesn't use it to hold
- * parameters.)
- *
- * When using dynamic ftrace, we patch out the mcount call by a "mov r0, r0"
- * for the mcount case, and a "pop {lr}" for the __gnu_mcount_nc case (see
- * arch/arm/kernel/ftrace.c).
- */
-
-#ifndef CONFIG_OLD_MCOUNT
-#if (__GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 4))
-#error Ftrace requires CONFIG_FRAME_POINTER=y with GCC older than 4.4.0.
-#endif
-#endif
-
-.macro mcount_adjust_addr rd, rn
-        bic     \rd, \rn, #1            @ clear the Thumb bit if present
-        sub     \rd, \rd, #MCOUNT_INSN_SIZE
-.endm
-
-.macro __mcount suffix
-        mcount_enter
-        ldr     r0, =ftrace_trace_function
-        ldr     r2, [r0]
-        adr     r0, .Lftrace_stub
-        cmp     r0, r2
-        bne     1f
-
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        ldr     r1, =ftrace_graph_return
-        ldr     r2, [r1]
-        cmp     r0, r2
-        bne     ftrace_graph_caller\suffix
-
-        ldr     r1, =ftrace_graph_entry
-        ldr     r2, [r1]
-        ldr     r0, =ftrace_graph_entry_stub
-        cmp     r0, r2
-        bne     ftrace_graph_caller\suffix
-#endif
-
-        mcount_exit
-
-1:      mcount_get_lr   r1                      @ lr of instrumented func
-        mcount_adjust_addr      r0, lr          @ instrumented function
-        adr     lr, BSYM(2f)
-        mov     pc, r2
-2:      mcount_exit
-.endm
-
-.macro __ftrace_caller suffix
-        mcount_enter
-
-        mcount_get_lr   r1                      @ lr of instrumented func
-        mcount_adjust_addr      r0, lr          @ instrumented function
-
-        .globl ftrace_call\suffix
-ftrace_call\suffix:
-        bl      ftrace_stub
-
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        .globl ftrace_graph_call\suffix
-ftrace_graph_call\suffix:
-        mov     r0, r0
-#endif
-
-        mcount_exit
-.endm
-
-.macro __ftrace_graph_caller
-        sub     r0, fp, #4              @ &lr of instrumented routine (&parent)
-#ifdef CONFIG_DYNAMIC_FTRACE
-        @ called from __ftrace_caller, saved in mcount_enter
-        ldr     r1, [sp, #16]           @ instrumented routine (func)
-        mcount_adjust_addr      r1, r1
-#else
-        @ called from __mcount, untouched in lr
-        mcount_adjust_addr      r1, lr  @ instrumented routine (func)
-#endif
-        mov     r2, fp                  @ frame pointer
-        bl      prepare_ftrace_return
-        mcount_exit
-.endm
-
-#ifdef CONFIG_OLD_MCOUNT
-/*
- * mcount
- */
-
-.macro mcount_enter
-        stmdb   sp!, {r0-r3, lr}
-.endm
-
-.macro mcount_get_lr reg
-        ldr     \reg, [fp, #-4]
-.endm
-
-.macro mcount_exit
-        ldr     lr, [fp, #-4]
-        ldmia   sp!, {r0-r3, pc}
-.endm
-
-ENTRY(mcount)
-#ifdef CONFIG_DYNAMIC_FTRACE
-        stmdb   sp!, {lr}
-        ldr     lr, [fp, #-4]
-        ldmia   sp!, {pc}
-#else
-        __mcount _old
-#endif
-ENDPROC(mcount)
-
-#ifdef CONFIG_DYNAMIC_FTRACE
-ENTRY(ftrace_caller_old)
-        __ftrace_caller _old
-ENDPROC(ftrace_caller_old)
-#endif
-
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-ENTRY(ftrace_graph_caller_old)
-        __ftrace_graph_caller
-ENDPROC(ftrace_graph_caller_old)
-#endif
-
-.purgem mcount_enter
-.purgem mcount_get_lr
-.purgem mcount_exit
-#endif
-
-/*
- * __gnu_mcount_nc
- */
-
-.macro mcount_enter
-/*
- * This pad compensates for the push {lr} at the call site.  Note that we are
- * unable to unwind through a function which does not otherwise save its lr.
- */
- UNWIND(.pad    #4)
-        stmdb   sp!, {r0-r3, lr}
- UNWIND(.save   {r0-r3, lr})
-.endm
-
-.macro mcount_get_lr reg
-        ldr     \reg, [sp, #20]
-.endm
-
-.macro mcount_exit
-        ldmia   sp!, {r0-r3, ip, lr}
-        ret     ip
-.endm
-
-ENTRY(__gnu_mcount_nc)
-UNWIND(.fnstart)
-#ifdef CONFIG_DYNAMIC_FTRACE
-        mov     ip, lr
-        ldmia   sp!, {lr}
-        ret     ip
-#else
-        __mcount
-#endif
-UNWIND(.fnend)
-ENDPROC(__gnu_mcount_nc)
-
-#ifdef CONFIG_DYNAMIC_FTRACE
-ENTRY(ftrace_caller)
-UNWIND(.fnstart)
-        __ftrace_caller
-UNWIND(.fnend)
-ENDPROC(ftrace_caller)
-#endif
-
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-ENTRY(ftrace_graph_caller)
-UNWIND(.fnstart)
-        __ftrace_graph_caller
-UNWIND(.fnend)
-ENDPROC(ftrace_graph_caller)
-#endif
-
-.purgem mcount_enter
-.purgem mcount_get_lr
-.purgem mcount_exit
-
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        .globl return_to_handler
-return_to_handler:
-        stmdb   sp!, {r0-r3}
-        mov     r0, fp                  @ frame pointer
-        bl      ftrace_return_to_handler
-        mov     lr, r0                  @ r0 has real ret addr
-        ldmia   sp!, {r0-r3}
-        ret     lr
-#endif
-
-ENTRY(ftrace_stub)
-.Lftrace_stub:
-        ret     lr
-ENDPROC(ftrace_stub)
-
-#endif /* CONFIG_FUNCTION_TRACER */
-
 /*=============================================================================
  * SWI handler
  *-----------------------------------------------------------------------------
diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S
new file mode 100644
index 000000000000..fe57c73e70a4
--- /dev/null
+++ b/arch/arm/kernel/entry-ftrace.S
@@ -0,0 +1,243 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <asm/assembler.h>
+#include <asm/ftrace.h>
+#include <asm/unwind.h>
+
+#include "entry-header.S"
+
+/*
+ * When compiling with -pg, gcc inserts a call to the mcount routine at the
+ * start of every function.  In mcount, apart from the function's address (in
+ * lr), we need to get hold of the function's caller's address.
+ *
+ * Older GCCs (pre-4.4) inserted a call to a routine called mcount like this:
+ *
+ *      bl      mcount
+ *
+ * These versions have the limitation that in order for the mcount routine to
+ * be able to determine the function's caller's address, an APCS-style frame
+ * pointer (which is set up with something like the code below) is required.
+ *
+ *      mov     ip, sp
+ *      push    {fp, ip, lr, pc}
+ *      sub     fp, ip, #4
+ *
+ * With EABI, these frame pointers are not available unless -mapcs-frame is
+ * specified, and if building as Thumb-2, not even then.
+ *
+ * Newer GCCs (4.4+) solve this problem by introducing a new version of mcount,
+ * with call sites like:
+ *
+ *      push    {lr}
+ *      bl      __gnu_mcount_nc
+ *
+ * With these compilers, frame pointers are not necessary.
+ *
+ * mcount can be thought of as a function called in the middle of a subroutine
+ * call.  As such, it needs to be transparent for both the caller and the
+ * callee: the original lr needs to be restored when leaving mcount, and no
+ * registers should be clobbered.  (In the __gnu_mcount_nc implementation, we
+ * clobber the ip register.  This is OK because the ARM calling convention
+ * allows it to be clobbered in subroutines and doesn't use it to hold
+ * parameters.)
+ *
+ * When using dynamic ftrace, we patch out the mcount call by a "mov r0, r0"
+ * for the mcount case, and a "pop {lr}" for the __gnu_mcount_nc case (see
+ * arch/arm/kernel/ftrace.c).
+ */
+
+#ifndef CONFIG_OLD_MCOUNT
+#if (__GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 4))
+#error Ftrace requires CONFIG_FRAME_POINTER=y with GCC older than 4.4.0.
+#endif
+#endif
+
+.macro mcount_adjust_addr rd, rn
+        bic     \rd, \rn, #1            @ clear the Thumb bit if present
+        sub     \rd, \rd, #MCOUNT_INSN_SIZE
+.endm
+
+.macro __mcount suffix
+        mcount_enter
+        ldr     r0, =ftrace_trace_function
+        ldr     r2, [r0]
+        adr     r0, .Lftrace_stub
+        cmp     r0, r2
+        bne     1f
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        ldr     r1, =ftrace_graph_return
+        ldr     r2, [r1]
+        cmp     r0, r2
+        bne     ftrace_graph_caller\suffix
+
+        ldr     r1, =ftrace_graph_entry
+        ldr     r2, [r1]
+        ldr     r0, =ftrace_graph_entry_stub
+        cmp     r0, r2
+        bne     ftrace_graph_caller\suffix
+#endif
+
+        mcount_exit
+
+1:      mcount_get_lr   r1                      @ lr of instrumented func
+        mcount_adjust_addr      r0, lr          @ instrumented function
+        adr     lr, BSYM(2f)
+        mov     pc, r2
+2:      mcount_exit
+.endm
+
+.macro __ftrace_caller suffix
+        mcount_enter
+
+        mcount_get_lr   r1                      @ lr of instrumented func
+        mcount_adjust_addr      r0, lr          @ instrumented function
+
+        .globl ftrace_call\suffix
+ftrace_call\suffix:
+        bl      ftrace_stub
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        .globl ftrace_graph_call\suffix
+ftrace_graph_call\suffix:
+        mov     r0, r0
+#endif
+
+        mcount_exit
+.endm
+
+.macro __ftrace_graph_caller
+        sub     r0, fp, #4              @ &lr of instrumented routine (&parent)
+#ifdef CONFIG_DYNAMIC_FTRACE
+        @ called from __ftrace_caller, saved in mcount_enter
+        ldr     r1, [sp, #16]           @ instrumented routine (func)
+        mcount_adjust_addr      r1, r1
+#else
+        @ called from __mcount, untouched in lr
+        mcount_adjust_addr      r1, lr  @ instrumented routine (func)
+#endif
+        mov     r2, fp                  @ frame pointer
+        bl      prepare_ftrace_return
+        mcount_exit
+.endm
+
+#ifdef CONFIG_OLD_MCOUNT
+/*
+ * mcount
+ */
+
+.macro mcount_enter
+        stmdb   sp!, {r0-r3, lr}
+.endm
+
+.macro mcount_get_lr reg
+        ldr     \reg, [fp, #-4]
+.endm
+
+.macro mcount_exit
+        ldr     lr, [fp, #-4]
+        ldmia   sp!, {r0-r3, pc}
+.endm
+
+ENTRY(mcount)
+#ifdef CONFIG_DYNAMIC_FTRACE
+        stmdb   sp!, {lr}
+        ldr     lr, [fp, #-4]
+        ldmia   sp!, {pc}
+#else
+        __mcount _old
+#endif
+ENDPROC(mcount)
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+ENTRY(ftrace_caller_old)
+        __ftrace_caller _old
+ENDPROC(ftrace_caller_old)
+#endif
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ENTRY(ftrace_graph_caller_old)
+        __ftrace_graph_caller
+ENDPROC(ftrace_graph_caller_old)
+#endif
+
+.purgem mcount_enter
+.purgem mcount_get_lr
+.purgem mcount_exit
+#endif
+
+/*
+ * __gnu_mcount_nc
+ */
+
+.macro mcount_enter
+/*
+ * This pad compensates for the push {lr} at the call site.  Note that we are
+ * unable to unwind through a function which does not otherwise save its lr.
+ */
+ UNWIND(.pad    #4)
+        stmdb   sp!, {r0-r3, lr}
+ UNWIND(.save   {r0-r3, lr})
+.endm
+
+.macro mcount_get_lr reg
+        ldr     \reg, [sp, #20]
+.endm
+
+.macro mcount_exit
+        ldmia   sp!, {r0-r3, ip, lr}
+        ret     ip
+.endm
+
+ENTRY(__gnu_mcount_nc)
+UNWIND(.fnstart)
+#ifdef CONFIG_DYNAMIC_FTRACE
+        mov     ip, lr
+        ldmia   sp!, {lr}
+        ret     ip
+#else
+        __mcount
+#endif
+UNWIND(.fnend)
+ENDPROC(__gnu_mcount_nc)
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+ENTRY(ftrace_caller)
+UNWIND(.fnstart)
+        __ftrace_caller
+UNWIND(.fnend)
+ENDPROC(ftrace_caller)
+#endif
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ENTRY(ftrace_graph_caller)
+UNWIND(.fnstart)
+        __ftrace_graph_caller
+UNWIND(.fnend)
+ENDPROC(ftrace_graph_caller)
+#endif
+
+.purgem mcount_enter
+.purgem mcount_get_lr
+.purgem mcount_exit
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        .globl return_to_handler
+return_to_handler:
+        stmdb   sp!, {r0-r3}
+        mov     r0, fp                  @ frame pointer
+        bl      ftrace_return_to_handler
+        mov     lr, r0                  @ r0 has real ret addr
+        ldmia   sp!, {r0-r3}
+        ret     lr
+#endif
+
+ENTRY(ftrace_stub)
+.Lftrace_stub:
+        ret     lr
+ENDPROC(ftrace_stub)
diff --git a/arch/arm/kernel/etm.c b/arch/arm/kernel/etm.c
index 131a6ab5f355..8b96972dcb1d 100644
--- a/arch/arm/kernel/etm.c
+++ b/arch/arm/kernel/etm.c
@@ -213,7 +213,7 @@ static void etm_dump(void)
         int length;
 
         if (!t->etb_regs) {
-                printk(KERN_INFO "No tracing hardware found\n");
+                pr_info("No tracing hardware found\n");
                 return;
         }
 
@@ -229,11 +229,11 @@ static void etm_dump(void)
 
         etb_writel(t, first, ETBR_READADDR);
 
-        printk(KERN_INFO "Trace buffer contents length: %d\n", length);
-        printk(KERN_INFO "--- ETB buffer begin ---\n");
+        pr_info("Trace buffer contents length: %d\n", length);
+        pr_info("--- ETB buffer begin ---\n");
         for (; length; length--)
                 printk("%08x", cpu_to_be32(etb_readl(t, ETBR_READMEM)));
-        printk(KERN_INFO "\n--- ETB buffer end ---\n");
+        pr_info("\n--- ETB buffer end ---\n");
 
         /* deassert the overflow bit */
         etb_writel(t, 1, ETBR_CTRL);
@@ -633,14 +633,14 @@ static int __init etm_init(void)
 
         retval = amba_driver_register(&etb_driver);
         if (retval) {
-                printk(KERN_ERR "Failed to register etb\n");
+                pr_err("Failed to register etb\n");
                 return retval;
         }
 
         retval = amba_driver_register(&etm_driver);
         if (retval) {
                 amba_driver_unregister(&etb_driver);
-                printk(KERN_ERR "Failed to probe etm\n");
+                pr_err("Failed to probe etm\n");
                 return retval;
         }
 
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index b37752a96652..059c3da0fee3 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -124,7 +124,7 @@ int claim_fiq(struct fiq_handler *f)
 void release_fiq(struct fiq_handler *f)
 {
         if (current_fiq != f) {
-                printk(KERN_ERR "%s FIQ trying to release %s FIQ\n",
+                pr_err("%s FIQ trying to release %s FIQ\n",
                        f->name, current_fiq->name);
                 dump_stack();
                 return;
diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
index af9a8a927a4e..b8c75e45a950 100644
--- a/arch/arm/kernel/ftrace.c
+++ b/arch/arm/kernel/ftrace.c
@@ -15,6 +15,7 @@
 #include <linux/ftrace.h>
 #include <linux/uaccess.h>
 #include <linux/module.h>
+#include <linux/stop_machine.h>
 
 #include <asm/cacheflush.h>
 #include <asm/opcodes.h>
@@ -35,6 +36,22 @@
 
 #define OLD_NOP         0xe1a00000      /* mov r0, r0 */
 
+static int __ftrace_modify_code(void *data)
+{
+        int *command = data;
+
+        set_kernel_text_rw();
+        ftrace_modify_all_code(*command);
+        set_kernel_text_ro();
+
+        return 0;
+}
+
+void arch_ftrace_update_code(int command)
+{
+        stop_machine(__ftrace_modify_code, &command, NULL);
+}
+
 static unsigned long ftrace_nop_replace(struct dyn_ftrace *rec)
 {
         return rec->arch.old_mcount ? OLD_NOP : NOP;
@@ -73,6 +90,8 @@ int ftrace_arch_code_modify_prepare(void)
 int ftrace_arch_code_modify_post_process(void)
 {
         set_all_modules_text_ro();
+        /* Make sure any TLB misses during machine stop are cleared. */
+        flush_tlb_all();
         return 0;
 }
 
diff --git a/arch/arm/kernel/io.c b/arch/arm/kernel/io.c
index 9203cf883330..eedefe050022 100644
--- a/arch/arm/kernel/io.c
+++ b/arch/arm/kernel/io.c
@@ -51,6 +51,7 @@ void _memcpy_fromio(void *to, const volatile void __iomem *from, size_t count)
                 from++;
         }
 }
+EXPORT_SYMBOL(_memcpy_fromio);
 
 /*
  * Copy data from "real" memory space to IO memory space.
@@ -66,6 +67,7 @@ void _memcpy_toio(volatile void __iomem *to, const void *from, size_t count)
                 to++;
         }
 }
+EXPORT_SYMBOL(_memcpy_toio);
 
 /*
  * "memset" on IO memory space.
@@ -79,7 +81,4 @@ void _memset_io(volatile void __iomem *dst, int c, size_t count)
                 dst++;
         }
 }
-
-EXPORT_SYMBOL(_memcpy_fromio);
-EXPORT_SYMBOL(_memcpy_toio);
 EXPORT_SYMBOL(_memset_io);
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 7c81ec428b9b..ad857bada96c 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -31,6 +31,7 @@
 #include <linux/smp.h>
 #include <linux/init.h>
 #include <linux/seq_file.h>
+#include <linux/ratelimit.h>
 #include <linux/errno.h>
 #include <linux/list.h>
 #include <linux/kallsyms.h>
@@ -82,7 +83,7 @@ void set_irq_flags(unsigned int irq, unsigned int iflags)
         unsigned long clr = 0, set = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
 
         if (irq >= nr_irqs) {
-                printk(KERN_ERR "Trying to set irq flags for IRQ%d\n", irq);
+                pr_err("Trying to set irq flags for IRQ%d\n", irq);
                 return;
         }
 
@@ -135,7 +136,6 @@ int __init arch_probe_nr_irqs(void)
 #endif
 
 #ifdef CONFIG_HOTPLUG_CPU
-
 static bool migrate_one_irq(struct irq_desc *desc)
 {
         struct irq_data *d = irq_desc_get_irq_data(desc);
@@ -187,8 +187,8 @@ void migrate_irqs(void)
                 affinity_broken = migrate_one_irq(desc);
                 raw_spin_unlock(&desc->lock);
 
-                if (affinity_broken && printk_ratelimit())
-                        pr_warn("IRQ%u no longer affine to CPU%u\n",
+                if (affinity_broken)
+                        pr_warn_ratelimited("IRQ%u no longer affine to CPU%u\n",
                                 i, smp_processor_id());
         }
 
diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
index ad58e565fe98..49fadbda8c63 100644
--- a/arch/arm/kernel/iwmmxt.S
+++ b/arch/arm/kernel/iwmmxt.S
@@ -58,6 +58,7 @@
 #define MMX_SIZE                (0x98)
 
         .text
+        .arm
 
 /*
  * Lazy switching of Concan coprocessor context
@@ -182,6 +183,8 @@ concan_load:
         tmcr    wCon, r2
         ret     lr
 
+ENDPROC(iwmmxt_task_enable)
+
 /*
  * Back up Concan regs to save area and disable access to them
  * (mainly for gdb or sleep mode usage)
@@ -232,6 +235,8 @@ ENTRY(iwmmxt_task_disable)
 1:      msr     cpsr_c, ip                      @ restore interrupt mode
         ldmfd   sp!, {r4, pc}
 
+ENDPROC(iwmmxt_task_disable)
+
 /*
  * Copy Concan state to given memory address
  *
@@ -268,6 +273,8 @@ ENTRY(iwmmxt_task_copy)
         msr     cpsr_c, ip                      @ restore interrupt mode
         ret     r3
 
+ENDPROC(iwmmxt_task_copy)
+
 /*
  * Restore Concan state from given memory address
  *
@@ -304,6 +311,8 @@ ENTRY(iwmmxt_task_restore)
         msr     cpsr_c, ip                      @ restore interrupt mode
         ret     r3
 
+ENDPROC(iwmmxt_task_restore)
+
 /*
  * Concan handling on task switch
  *
@@ -335,6 +344,8 @@ ENTRY(iwmmxt_task_switch)
         mrc     p15, 0, r1, c2, c0, 0
         sub     pc, lr, r1, lsr #32             @ cpwait and return
 
+ENDPROC(iwmmxt_task_switch)
+
 /*
  * Remove Concan ownership of given task
  *
@@ -353,6 +364,8 @@ ENTRY(iwmmxt_task_release)
         msr     cpsr_c, r2                      @ restore interrupts
         ret     lr
 
+ENDPROC(iwmmxt_task_release)
+
         .data
 concan_owner:
         .word   0
diff --git a/arch/arm/kernel/jump_label.c b/arch/arm/kernel/jump_label.c
index 4ce4f789446d..afeeb9ea6f43 100644
--- a/arch/arm/kernel/jump_label.c
+++ b/arch/arm/kernel/jump_label.c
@@ -19,7 +19,7 @@ static void __arch_jump_label_transform(struct jump_entry *entry,
                 insn = arm_gen_nop();
 
         if (is_static)
-                __patch_text(addr, insn);
+                __patch_text_early(addr, insn);
         else
                 patch_text(addr, insn);
 }
diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
index a74b53c1b7df..07db2f8a1b45 100644
--- a/arch/arm/kernel/kgdb.c
+++ b/arch/arm/kernel/kgdb.c
@@ -12,8 +12,12 @@
 #include <linux/irq.h>
 #include <linux/kdebug.h>
 #include <linux/kgdb.h>
+#include <linux/uaccess.h>
+
 #include <asm/traps.h>
 
+#include "patch.h"
+
 struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] =
 {
         { "r0", 4, offsetof(struct pt_regs, ARM_r0)},
@@ -244,6 +248,31 @@ void kgdb_arch_exit(void)
         unregister_die_notifier(&kgdb_notifier);
 }
 
+int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
+{
+        int err;
+
+        /* patch_text() only supports int-sized breakpoints */
+        BUILD_BUG_ON(sizeof(int) != BREAK_INSTR_SIZE);
+
+        err = probe_kernel_read(bpt->saved_instr, (char *)bpt->bpt_addr,
+                                BREAK_INSTR_SIZE);
+        if (err)
+                return err;
+
+        patch_text((void *)bpt->bpt_addr,
+                   *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr);
+
+        return err;
+}
+
+int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
+{
+        patch_text((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr);
+
+        return 0;
+}
+
 /*
  * Register our undef instruction hooks with ARM undef core.
  * We regsiter a hook specifically looking for the KGB break inst
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 8cf0996aa1a8..de2b085ad753 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -29,6 +29,7 @@ extern unsigned long kexec_boot_atags;
 
 static atomic_t waiting_for_crash_ipi;
 
+static unsigned long dt_mem;
 /*
  * Provide a dummy crash_notes definition while crash dump arrives to arm.
  * This prevents breakage of crash_notes attribute in kernel/ksysfs.c.
@@ -64,7 +65,7 @@ int machine_kexec_prepare(struct kimage *image)
                         return err;
 
                 if (be32_to_cpu(header) == OF_DT_HEADER)
-                        kexec_boot_atags = current_segment->mem;
+                        dt_mem = current_segment->mem;
         }
         return 0;
 }
@@ -126,12 +127,12 @@ void machine_crash_shutdown(struct pt_regs *regs)
                 msecs--;
         }
         if (atomic_read(&waiting_for_crash_ipi) > 0)
-                printk(KERN_WARNING "Non-crashing CPUs did not react to IPI\n");
+                pr_warn("Non-crashing CPUs did not react to IPI\n");
 
         crash_save_cpu(regs, smp_processor_id());
         machine_kexec_mask_interrupts();
 
-        printk(KERN_INFO "Loading crashdump kernel...\n");
+        pr_info("Loading crashdump kernel...\n");
 }
 
 /*
@@ -163,12 +164,12 @@ void machine_kexec(struct kimage *image)
         reboot_code_buffer = page_address(image->control_code_page);
 
         /* Prepare parameters for reboot_code_buffer*/
+        set_kernel_text_rw();
         kexec_start_address = image->start;
         kexec_indirection_page = page_list;
         kexec_mach_type = machine_arch_type;
-        if (!kexec_boot_atags)
-                kexec_boot_atags = image->start - KEXEC_ARM_ZIMAGE_OFFSET + KEXEC_ARM_ATAGS_OFFSET;
-
+        kexec_boot_atags = dt_mem ?: image->start - KEXEC_ARM_ZIMAGE_OFFSET
+                                     + KEXEC_ARM_ATAGS_OFFSET;
 
         /* copy our kernel relocation code to the control code page */
         reboot_entry = fncpy(reboot_code_buffer,
@@ -177,7 +178,7 @@ void machine_kexec(struct kimage *image)
         reboot_entry_phys = (unsigned long)reboot_entry +
                 (reboot_code_buffer_phys - (unsigned long)reboot_code_buffer);
 
-        printk(KERN_INFO "Bye!\n");
+        pr_info("Bye!\n");
 
         if (kexec_reinit)
                 kexec_reinit();
diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
index 6a4dffefd357..bea7db9e5b80 100644
--- a/arch/arm/kernel/module.c
+++ b/arch/arm/kernel/module.c
@@ -251,7 +251,7 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex,
 #endif
 
                 default:
-                        printk(KERN_ERR "%s: unknown relocation: %u\n",
+                        pr_err("%s: unknown relocation: %u\n",
                                module->name, ELF32_R_TYPE(rel->r_info));
                         return -ENOEXEC;
                 }
diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
index 07314af47733..5038960e3c55 100644
--- a/arch/arm/kernel/patch.c
+++ b/arch/arm/kernel/patch.c
@@ -1,8 +1,11 @@
 #include <linux/kernel.h>
+#include <linux/spinlock.h>
 #include <linux/kprobes.h>
+#include <linux/mm.h>
 #include <linux/stop_machine.h>
 
 #include <asm/cacheflush.h>
+#include <asm/fixmap.h>
 #include <asm/smp_plat.h>
 #include <asm/opcodes.h>
 
@@ -13,21 +16,77 @@ struct patch {
         unsigned int insn;
 };
 
-void __kprobes __patch_text(void *addr, unsigned int insn)
+static DEFINE_SPINLOCK(patch_lock);
+
+static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
+        __acquires(&patch_lock)
+{
+        unsigned int uintaddr = (uintptr_t) addr;
+        bool module = !core_kernel_text(uintaddr);
+        struct page *page;
+
+        if (module && IS_ENABLED(CONFIG_DEBUG_SET_MODULE_RONX))
+                page = vmalloc_to_page(addr);
+        else if (!module && IS_ENABLED(CONFIG_DEBUG_RODATA))
+                page = virt_to_page(addr);
+        else
+                return addr;
+
+        if (flags)
+                spin_lock_irqsave(&patch_lock, *flags);
+        else
+                __acquire(&patch_lock);
+
+        set_fixmap(fixmap, page_to_phys(page));
+
+        return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK));
+}
+
+static void __kprobes patch_unmap(int fixmap, unsigned long *flags)
+        __releases(&patch_lock)
+{
+        clear_fixmap(fixmap);
+
+        if (flags)
+                spin_unlock_irqrestore(&patch_lock, *flags);
+        else
+                __release(&patch_lock);
+}
+
+void __kprobes __patch_text_real(void *addr, unsigned int insn, bool remap)
 {
         bool thumb2 = IS_ENABLED(CONFIG_THUMB2_KERNEL);
+        unsigned int uintaddr = (uintptr_t) addr;
+        bool twopage = false;
+        unsigned long flags;
+        void *waddr = addr;
         int size;
 
+        if (remap)
+                waddr = patch_map(addr, FIX_TEXT_POKE0, &flags);
+        else
+                __acquire(&patch_lock);
+
         if (thumb2 && __opcode_is_thumb16(insn)) {
-                *(u16 *)addr = __opcode_to_mem_thumb16(insn);
+                *(u16 *)waddr = __opcode_to_mem_thumb16(insn);
                 size = sizeof(u16);
-        } else if (thumb2 && ((uintptr_t)addr & 2)) {
+        } else if (thumb2 && (uintaddr & 2)) {
                 u16 first = __opcode_thumb32_first(insn);
                 u16 second = __opcode_thumb32_second(insn);
-                u16 *addrh = addr;
+                u16 *addrh0 = waddr;
+                u16 *addrh1 = waddr + 2;
+
+                twopage = (uintaddr & ~PAGE_MASK) == PAGE_SIZE - 2;
+                if (twopage && remap)
+                        addrh1 = patch_map(addr + 2, FIX_TEXT_POKE1, NULL);
+
+                *addrh0 = __opcode_to_mem_thumb16(first);
+                *addrh1 = __opcode_to_mem_thumb16(second);
 
-                addrh[0] = __opcode_to_mem_thumb16(first);
-                addrh[1] = __opcode_to_mem_thumb16(second);
+                if (twopage && addrh1 != addr + 2) {
+                        flush_kernel_vmap_range(addrh1, 2);
+                        patch_unmap(FIX_TEXT_POKE1, NULL);
+                }
 
                 size = sizeof(u32);
         } else {
@@ -36,10 +95,16 @@ void __kprobes __patch_text(void *addr, unsigned int insn)
                 else
                         insn = __opcode_to_mem_arm(insn);
 
-                *(u32 *)addr = insn;
+                *(u32 *)waddr = insn;
                 size = sizeof(u32);
         }
 
+        if (waddr != addr) {
+                flush_kernel_vmap_range(waddr, twopage ? size / 2 : size);
+                patch_unmap(FIX_TEXT_POKE0, &flags);
+        } else
+                __release(&patch_lock);
+
         flush_icache_range((uintptr_t)(addr),
                            (uintptr_t)(addr) + size);
 }
@@ -60,16 +125,5 @@ void __kprobes patch_text(void *addr, unsigned int insn)
                 .insn = insn,
         };
 
-        if (cache_ops_need_broadcast()) {
-                stop_machine(patch_text_stop_machine, &patch, cpu_online_mask);
-        } else {
-                bool straddles_word = IS_ENABLED(CONFIG_THUMB2_KERNEL)
-                                      && __opcode_is_thumb32(insn)
-                                      && ((uintptr_t)addr & 2);
-
-                if (straddles_word)
-                        stop_machine(patch_text_stop_machine, &patch, NULL);
-                else
-                        __patch_text(addr, insn);
-        }
+        stop_machine(patch_text_stop_machine, &patch, NULL);
 }
diff --git a/arch/arm/kernel/patch.h b/arch/arm/kernel/patch.h
index b4731f2dac38..77e054c2f6cd 100644
--- a/arch/arm/kernel/patch.h
+++ b/arch/arm/kernel/patch.h
@@ -2,6 +2,16 @@
 #define _ARM_KERNEL_PATCH_H
 
 void patch_text(void *addr, unsigned int insn);
-void __patch_text(void *addr, unsigned int insn);
+void __patch_text_real(void *addr, unsigned int insn, bool remap);
+
+static inline void __patch_text(void *addr, unsigned int insn)
+{
+        __patch_text_real(addr, insn, true);
+}
+
+static inline void __patch_text_early(void *addr, unsigned int insn)
+{
+        __patch_text_real(addr, insn, false);
+}
 
 #endif
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index fe972a2f3df3..fdfa3a78ec8c 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -51,8 +51,8 @@ EXPORT_SYMBOL(__stack_chk_guard);
 static const char *processor_modes[] __maybe_unused = {
   "USER_26", "FIQ_26" , "IRQ_26" , "SVC_26" , "UK4_26" , "UK5_26" , "UK6_26" , "UK7_26" ,
   "UK8_26" , "UK9_26" , "UK10_26", "UK11_26", "UK12_26", "UK13_26", "UK14_26", "UK15_26",
-  "USER_32", "FIQ_32" , "IRQ_32" , "SVC_32" , "UK4_32" , "UK5_32" , "UK6_32" , "ABT_32" ,
-  "UK8_32" , "UK9_32" , "UK10_32", "UND_32" , "UK12_32", "UK13_32", "UK14_32", "SYS_32"
+  "USER_32", "FIQ_32" , "IRQ_32" , "SVC_32" , "UK4_32" , "UK5_32" , "MON_32" , "ABT_32" ,
+  "UK8_32" , "UK9_32" , "HYP_32", "UND_32" , "UK12_32", "UK13_32", "UK14_32", "SYS_32"
 };
 
 static const char *isa_modes[] __maybe_unused = {
diff --git a/arch/arm/kernel/return_address.c b/arch/arm/kernel/return_address.c
index 98ea4b7eb406..24b4a04846eb 100644
--- a/arch/arm/kernel/return_address.c
+++ b/arch/arm/kernel/return_address.c
@@ -39,13 +39,12 @@ void *return_address(unsigned int level)
 {
         struct return_address_data data;
         struct stackframe frame;
-        register unsigned long current_sp asm ("sp");
 
         data.level = level + 2;
         data.addr = NULL;
 
         frame.fp = (unsigned long)__builtin_frame_address(0);
-        frame.sp = current_sp;
+        frame.sp = current_stack_pointer;
         frame.lr = (unsigned long)__builtin_return_address(0);
         frame.pc = (unsigned long)return_address;
 
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index c03106378b49..8361652b6dab 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -900,6 +900,7 @@ void __init setup_arch(char **cmdline_p)
                 mdesc = setup_machine_tags(__atags_pointer, __machine_arch_type);
         machine_desc = mdesc;
         machine_name = mdesc->name;
+        dump_stack_set_arch_desc("%s", mdesc->name);
 
         if (mdesc->reboot_mode != REBOOT_HARD)
                 reboot_mode = mdesc->reboot_mode;
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index bd1983437205..8aa6f1b87c9e 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -592,7 +592,6 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
                                 }
                                 syscall = 0;
                         } else if (thread_flags & _TIF_UPROBE) {
-                                clear_thread_flag(TIF_UPROBE);
                                 uprobe_notify_resume(regs);
                         } else {
                                 clear_thread_flag(TIF_NOTIFY_RESUME);
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 13396d3d600e..5e6052e18850 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -225,7 +225,7 @@ void __cpu_die(unsigned int cpu)
                 pr_err("CPU%u: cpu didn't die\n", cpu);
                 return;
         }
-        printk(KERN_NOTICE "CPU%u: shutdown\n", cpu);
+        pr_notice("CPU%u: shutdown\n", cpu);
 
         /*
          * platform_cpu_kill() is generally expected to do the powering off
@@ -235,7 +235,7 @@ void __cpu_die(unsigned int cpu)
          * the requesting CPU and the dying CPU actually losing power.
          */
         if (!platform_cpu_kill(cpu))
-                printk("CPU%u: unable to kill\n", cpu);
+                pr_err("CPU%u: unable to kill\n", cpu);
 }
 
 /*
@@ -351,7 +351,7 @@ asmlinkage void secondary_start_kernel(void)
 
         cpu_init();
 
-        printk("CPU%u: Booted secondary processor\n", cpu);
+        pr_debug("CPU%u: Booted secondary processor\n", cpu);
 
         preempt_disable();
         trace_hardirqs_off();
@@ -387,9 +387,6 @@ asmlinkage void secondary_start_kernel(void)
 
 void __init smp_cpus_done(unsigned int max_cpus)
 {
-        printk(KERN_INFO "SMP: Total of %d processors activated.\n",
-               num_online_cpus());
-
         hyp_mode_check();
 }
 
@@ -521,7 +518,7 @@ static void ipi_cpu_stop(unsigned int cpu)
         if (system_state == SYSTEM_BOOTING ||
             system_state == SYSTEM_RUNNING) {
                 raw_spin_lock(&stop_lock);
-                printk(KERN_CRIT "CPU%u: stopping\n", cpu);
+                pr_crit("CPU%u: stopping\n", cpu);
                 dump_stack();
                 raw_spin_unlock(&stop_lock);
         }
@@ -615,8 +612,8 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
                 break;
 
         default:
-                printk(KERN_CRIT "CPU%u: Unknown IPI message 0x%x\n",
-                       cpu, ipinr);
+                pr_crit("CPU%u: Unknown IPI message 0x%x\n",
+                        cpu, ipinr);
                 break;
         }
 
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index 93090213c71c..172c6a05d27f 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -199,7 +199,7 @@ static void twd_calibrate_rate(void)
          * the timer ticks
          */
         if (twd_timer_rate == 0) {
-                printk(KERN_INFO "Calibrating local timer... ");
+                pr_info("Calibrating local timer... ");
 
                 /* Wait for a tick to start */
                 waitjiffies = get_jiffies_64() + 1;
@@ -223,7 +223,7 @@ static void twd_calibrate_rate(void)
 
                 twd_timer_rate = (0xFFFFFFFFU - count) * (HZ / 5);
 
-                printk("%lu.%02luMHz.\n", twd_timer_rate / 1000000,
+                pr_cont("%lu.%02luMHz.\n", twd_timer_rate / 1000000,
                         (twd_timer_rate / 10000) % 100);
         }
 }
diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index f065eb05d254..92b72375c4c7 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -134,12 +134,10 @@ static noinline void __save_stack_trace(struct task_struct *tsk,
                 frame.pc = thread_saved_pc(tsk);
 #endif
         } else {
-                register unsigned long current_sp asm ("sp");
-
                 /* We don't want this function nor the caller */
                 data.skip += 2;
                 frame.fp = (unsigned long)__builtin_frame_address(0);
-                frame.sp = current_sp;
+                frame.sp = current_stack_pointer;
                 frame.lr = (unsigned long)__builtin_return_address(0);
                 frame.pc = (unsigned long)__save_stack_trace;
         }
diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
index 587fdfe1a72c..afdd51e30bec 100644
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -260,7 +260,7 @@ static int __init swp_emulation_init(void)
                 return -ENOMEM;
 #endif /* CONFIG_PROC_FS */
 
-        printk(KERN_NOTICE "Registering SWP/SWPB emulation handler\n");
+        pr_notice("Registering SWP/SWPB emulation handler\n");
         register_undef_hook(&swp_hook);
 
         return 0;
diff --git a/arch/arm/kernel/thumbee.c b/arch/arm/kernel/thumbee.c
index 80f0d69205e7..8ff8dbfbe9fb 100644
--- a/arch/arm/kernel/thumbee.c
+++ b/arch/arm/kernel/thumbee.c
@@ -72,7 +72,7 @@ static int __init thumbee_init(void)
         if ((pfr0 & 0x0000f000) != 0x00001000)
                 return 0;
 
-        printk(KERN_INFO "ThumbEE CPU extension supported.\n");
+        pr_info("ThumbEE CPU extension supported.\n");
         elf_hwcap |= HWCAP_THUMBEE;
         thread_register_notifier(&thumbee_notifier_block);
 
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index 89cfdd6e50cb..08b7847bf912 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -165,7 +165,7 @@ static void update_cpu_capacity(unsigned int cpu)
 
         set_capacity_scale(cpu, cpu_capacity(cpu) / middle_capacity);
 
-        printk(KERN_INFO "CPU%u: update cpu_capacity %lu\n",
+        pr_info("CPU%u: update cpu_capacity %lu\n",
                 cpu, arch_scale_cpu_capacity(NULL, cpu));
 }
 
@@ -269,7 +269,7 @@ void store_cpu_topology(unsigned int cpuid)
 
         update_cpu_capacity(cpuid);
 
-        printk(KERN_INFO "CPU%u: thread %d, cpu %d, socket %d, mpidr %x\n",
+        pr_info("CPU%u: thread %d, cpu %d, socket %d, mpidr %x\n",
                 cpuid, cpu_topology[cpuid].thread_id,
                 cpu_topology[cpuid].core_id,
                 cpu_topology[cpuid].socket_id, mpidr);
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 9f5d81881eb6..788e23fe64d8 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -198,14 +198,14 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
         }
 
         if (!fp) {
-                printk("no frame pointer");
+                pr_cont("no frame pointer");
                 ok = 0;
         } else if (verify_stack(fp)) {
-                printk("invalid frame pointer 0x%08x", fp);
+                pr_cont("invalid frame pointer 0x%08x", fp);
                 ok = 0;
         } else if (fp < (unsigned long)end_of_stack(tsk))
-                printk("frame pointer underflow");
-        printk("\n");
+                pr_cont("frame pointer underflow");
+        pr_cont("\n");
 
         if (ok)
                 c_backtrace(fp, mode);
@@ -240,8 +240,8 @@ static int __die(const char *str, int err, struct pt_regs *regs)
         static int die_counter;
         int ret;
 
-        printk(KERN_EMERG "Internal error: %s: %x [#%d]" S_PREEMPT S_SMP
-               S_ISA "\n", str, err, ++die_counter);
+        pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP S_ISA "\n",
+                 str, err, ++die_counter);
 
         /* trap and error numbers are mostly meaningless on ARM */
         ret = notify_die(DIE_OOPS, str, regs, err, tsk->thread.trap_no, SIGSEGV);
@@ -250,8 +250,8 @@ static int __die(const char *str, int err, struct pt_regs *regs)
 
         print_modules();
         __show_regs(regs);
-        printk(KERN_EMERG "Process %.*s (pid: %d, stack limit = 0x%p)\n",
-                TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk));
+        pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
+                 TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk));
 
         if (!user_mode(regs) || in_interrupt()) {
                 dump_mem(KERN_EMERG, "Stack: ", regs->ARM_sp,
@@ -446,7 +446,7 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
 die_sig:
 #ifdef CONFIG_DEBUG_USER
         if (user_debug & UDBG_UNDEFINED) {
-                printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
+                pr_info("%s (%d): undefined instruction: pc=%p\n",
                         current->comm, task_pid_nr(current), pc);
                 __show_regs(regs);
                 dump_instr(KERN_INFO, regs);
@@ -496,7 +496,7 @@ asmlinkage void bad_mode(struct pt_regs *regs, int reason)
 {
         console_verbose();
 
-        printk(KERN_CRIT "Bad mode in %s handler detected\n", handler[reason]);
+        pr_crit("Bad mode in %s handler detected\n", handler[reason]);
 
         die("Oops - bad mode", regs, 0);
         local_irq_disable();
@@ -516,7 +516,7 @@ static int bad_syscall(int n, struct pt_regs *regs)
 
 #ifdef CONFIG_DEBUG_USER
         if (user_debug & UDBG_SYSCALL) {
-                printk(KERN_ERR "[%d] %s: obsolete system call %08x.\n",
+                pr_err("[%d] %s: obsolete system call %08x.\n",
                         task_pid_nr(current), current->comm, n);
                 dump_instr(KERN_ERR, regs);
         }
@@ -694,7 +694,7 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
          * something catastrophic has happened
          */
         if (user_debug & UDBG_SYSCALL) {
-                printk("[%d] %s: arm syscall %d\n",
+                pr_err("[%d] %s: arm syscall %d\n",
                        task_pid_nr(current), current->comm, no);
                 dump_instr("", regs);
                 if (user_mode(regs)) {
@@ -753,8 +753,8 @@ late_initcall(arm_mrc_hook_init);
 
 void __bad_xchg(volatile void *ptr, int size)
 {
-        printk("xchg: bad data size: pc 0x%p, ptr 0x%p, size %d\n",
-                __builtin_return_address(0), ptr, size);
+        pr_err("xchg: bad data size: pc 0x%p, ptr 0x%p, size %d\n",
+               __builtin_return_address(0), ptr, size);
         BUG();
 }
 EXPORT_SYMBOL(__bad_xchg);
@@ -771,8 +771,8 @@ baddataabort(int code, unsigned long instr, struct pt_regs *regs)
 
 #ifdef CONFIG_DEBUG_USER
         if (user_debug & UDBG_BADABORT) {
-                printk(KERN_ERR "[%d] %s: bad data abort: code %d instr 0x%08lx\n",
-                        task_pid_nr(current), current->comm, code, instr);
+                pr_err("[%d] %s: bad data abort: code %d instr 0x%08lx\n",
+                       task_pid_nr(current), current->comm, code, instr);
                 dump_instr(KERN_ERR, regs);
                 show_pte(current->mm, addr);
         }
@@ -788,29 +788,29 @@ baddataabort(int code, unsigned long instr, struct pt_regs *regs)
 
 void __readwrite_bug(const char *fn)
 {
-        printk("%s called, but not implemented\n", fn);
+        pr_err("%s called, but not implemented\n", fn);
         BUG();
 }
 EXPORT_SYMBOL(__readwrite_bug);
 
 void __pte_error(const char *file, int line, pte_t pte)
 {
-        printk("%s:%d: bad pte %08llx.\n", file, line, (long long)pte_val(pte));
+        pr_err("%s:%d: bad pte %08llx.\n", file, line, (long long)pte_val(pte));
 }
 
 void __pmd_error(const char *file, int line, pmd_t pmd)
 {
-        printk("%s:%d: bad pmd %08llx.\n", file, line, (long long)pmd_val(pmd));
+        pr_err("%s:%d: bad pmd %08llx.\n", file, line, (long long)pmd_val(pmd));
 }
 
 void __pgd_error(const char *file, int line, pgd_t pgd)
 {
-        printk("%s:%d: bad pgd %08llx.\n", file, line, (long long)pgd_val(pgd));
+        pr_err("%s:%d: bad pgd %08llx.\n", file, line, (long long)pgd_val(pgd));
 }
 
 asmlinkage void __div0(void)
 {
-        printk("Division by zero in kernel.\n");
+        pr_err("Division by zero in kernel.\n");
         dump_stack();
 }
 EXPORT_SYMBOL(__div0);
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index cbb85c5fabf9..0bee233fef9a 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -471,7 +471,6 @@ int unwind_frame(struct stackframe *frame)
 void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
 {
         struct stackframe frame;
-        register unsigned long current_sp asm ("sp");
 
         pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
 
@@ -485,7 +484,7 @@ void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
                         frame.pc = regs->ARM_lr;
         } else if (tsk == current) {
                 frame.fp = (unsigned long)__builtin_frame_address(0);
-                frame.sp = current_sp;
+                frame.sp = current_stack_pointer;
                 frame.lr = (unsigned long)__builtin_return_address(0);
                 frame.pc = (unsigned long)unwind_backtrace;
         } else {
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 8e95aa47457a..b31aa73e8076 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -8,6 +8,9 @@
 #include <asm/thread_info.h>
 #include <asm/memory.h>
 #include <asm/page.h>
+#ifdef CONFIG_ARM_KERNMEM_PERMS
+#include <asm/pgtable.h>
+#endif
         
 #define PROC_INFO                                                       \
         . = ALIGN(4);                                                   \
@@ -90,6 +93,11 @@ SECTIONS
                 _text = .;
                 HEAD_TEXT
         }
+
+#ifdef CONFIG_ARM_KERNMEM_PERMS
+        . = ALIGN(1<<SECTION_SHIFT);
+#endif
+
         .text : {                       /* Real text segment            */
                 _stext = .;             /* Text and read-only data      */
                         __exception_text_start = .;
@@ -112,6 +120,9 @@ SECTIONS
                         ARM_CPU_KEEP(PROC_INFO)
         }
 
+#ifdef CONFIG_DEBUG_RODATA
+        . = ALIGN(1<<SECTION_SHIFT);
+#endif
         RO_DATA(PAGE_SIZE)
 
         . = ALIGN(4);
@@ -145,7 +156,11 @@ SECTIONS
         _etext = .;                     /* End of text and rodata section */
 
 #ifndef CONFIG_XIP_KERNEL
+# ifdef CONFIG_ARM_KERNMEM_PERMS
+        . = ALIGN(1<<SECTION_SHIFT);
+# else
         . = ALIGN(PAGE_SIZE);
+# endif
         __init_begin = .;
 #endif
         /*
@@ -219,7 +234,11 @@ SECTIONS
         __data_loc = ALIGN(4);          /* location in binary */
         . = PAGE_OFFSET + TEXT_OFFSET;
 #else
+#ifdef CONFIG_ARM_KERNMEM_PERMS
+        . = ALIGN(1<<SECTION_SHIFT);
+#else
         . = ALIGN(THREAD_SIZE);
+#endif
         __init_end = .;
         __data_loc = .;
 #endif
diff --git a/arch/arm/kernel/xscale-cp0.c b/arch/arm/kernel/xscale-cp0.c
index e42adc6bcdb1..bdbb8853a19b 100644
--- a/arch/arm/kernel/xscale-cp0.c
+++ b/arch/arm/kernel/xscale-cp0.c
@@ -157,15 +157,14 @@ static int __init xscale_cp0_init(void)
 
         if (cpu_has_iwmmxt()) {
 #ifndef CONFIG_IWMMXT
-                printk(KERN_WARNING "CAUTION: XScale iWMMXt coprocessor "
-                        "detected, but kernel support is missing.\n");
+                pr_warn("CAUTION: XScale iWMMXt coprocessor detected, but kernel support is missing.\n");
 #else
-                printk(KERN_INFO "XScale iWMMXt coprocessor detected.\n");
+                pr_info("XScale iWMMXt coprocessor detected.\n");
                 elf_hwcap |= HWCAP_IWMMXT;
                 thread_register_notifier(&iwmmxt_notifier_block);
 #endif
         } else {
-                printk(KERN_INFO "XScale DSP coprocessor detected.\n");
+                pr_info("XScale DSP coprocessor detected.\n");
                 thread_register_notifier(&dsp_notifier_block);
                 cp_access |= 1;
         }
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 66a477a3e3cc..7a235b9952be 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -12,6 +12,7 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/unwind.h>
 
 /*
  * Prototype:
@@ -77,6 +78,10 @@
         stmdb   sp!, {r0, r2, r3, \reg1, \reg2}
         .endm
 
+        .macro usave reg1 reg2
+        UNWIND( .save {r0, r2, r3, \reg1, \reg2}        )
+        .endm
+
         .macro exit reg1 reg2
         add     sp, sp, #8
         ldmfd   sp!, {r0, \reg1, \reg2}
diff --git a/arch/arm/lib/copy_template.S b/arch/arm/lib/copy_template.S
index 3bc8eb811a73..652e4d98cd47 100644
--- a/arch/arm/lib/copy_template.S
+++ b/arch/arm/lib/copy_template.S
@@ -53,6 +53,12 @@
  *      data as needed by the implementation including this code. Called
  *      upon code entry.
  *
+ * usave reg1 reg2
+ *
+ *      Unwind annotation macro is corresponding for 'enter' macro.
+ *      It tell unwinder that preserved some provided registers on the stack
+ *      and additional data by a prior 'enter' macro.
+ *
  * exit reg1 reg2
  *
  *      Restore registers with the values previously saved with the
@@ -67,7 +73,12 @@
  */
 
 
+        UNWIND( .fnstart                        )
                 enter   r4, lr
+        UNWIND( .fnend                          )
+
+        UNWIND( .fnstart                        )
+                usave   r4, lr                    @ in first stmdb block
 
                 subs    r2, r2, #4
                 blt     8f
@@ -79,6 +90,11 @@
 
 1:              subs    r2, r2, #(28)
                 stmfd   sp!, {r5 - r8}
+        UNWIND( .fnend                          )
+
+        UNWIND( .fnstart                        )
+                usave   r4, lr
+        UNWIND( .save   {r5 - r8}               ) @ in second stmfd block
                 blt     5f
 
         CALGN(  ands    ip, r0, #31             )
@@ -144,7 +160,10 @@
         CALGN(  bcs     2b                      )
 
 7:              ldmfd   sp!, {r5 - r8}
+        UNWIND( .fnend                          ) @ end of second stmfd block
 
+        UNWIND( .fnstart                        )
+                usave   r4, lr                    @ still in first stmdb block
 8:              movs    r2, r2, lsl #31
                 ldr1b   r1, r3, ne, abort=21f
                 ldr1b   r1, r4, cs, abort=21f
@@ -173,10 +192,13 @@
                 ldr1w   r1, lr, abort=21f
                 beq     17f
                 bgt     18f
+        UNWIND( .fnend                          )
 
 
                 .macro  forward_copy_shift pull push
 
+        UNWIND( .fnstart                        )
+                usave   r4, lr                    @ still in first stmdb block
                 subs    r2, r2, #28
                 blt     14f
 
@@ -187,7 +209,11 @@
         CALGN(  bcc     15f                     )
 
 11:             stmfd   sp!, {r5 - r9}
+        UNWIND( .fnend                          )
 
+        UNWIND( .fnstart                        )
+                usave   r4, lr
+        UNWIND( .save   {r5 - r9}               ) @ in new second stmfd block
         PLD(    pld     [r1, #0]                )
         PLD(    subs    r2, r2, #96             )
         PLD(    pld     [r1, #28]               )
@@ -221,7 +247,10 @@
         PLD(    bge     13b                     )
 
                 ldmfd   sp!, {r5 - r9}
+        UNWIND( .fnend                          ) @ end of the second stmfd block
 
+        UNWIND( .fnstart                        )
+                usave   r4, lr                    @ still in first stmdb block
 14:             ands    ip, r2, #28
                 beq     16f
 
@@ -236,6 +265,7 @@
 
 16:             sub     r1, r1, #(\push / 8)
                 b       8b
+        UNWIND( .fnend                          )
 
                 .endm
 
diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
index d066df686e17..a9d3db16ecb5 100644
--- a/arch/arm/lib/copy_to_user.S
+++ b/arch/arm/lib/copy_to_user.S
@@ -12,6 +12,7 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/unwind.h>
 
 /*
  * Prototype:
@@ -80,6 +81,10 @@
         stmdb   sp!, {r0, r2, r3, \reg1, \reg2}
         .endm
 
+        .macro usave reg1 reg2
+        UNWIND( .save {r0, r2, r3, \reg1, \reg2}        )
+        .endm
+
         .macro exit reg1 reg2
         add     sp, sp, #8
         ldmfd   sp!, {r0, \reg1, \reg2}
diff --git a/arch/arm/lib/memcpy.S b/arch/arm/lib/memcpy.S
index a9b9e2287a09..7797e81e40e0 100644
--- a/arch/arm/lib/memcpy.S
+++ b/arch/arm/lib/memcpy.S
@@ -12,6 +12,7 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/unwind.h>
 
 #define LDR1W_SHIFT     0
 #define STR1W_SHIFT     0
@@ -48,6 +49,10 @@
         stmdb sp!, {r0, \reg1, \reg2}
         .endm
 
+        .macro usave reg1 reg2
+        UNWIND( .save   {r0, \reg1, \reg2}      )
+        .endm
+
         .macro exit reg1 reg2
         ldmfd sp!, {r0, \reg1, \reg2}
         .endm
diff --git a/arch/arm/lib/memmove.S b/arch/arm/lib/memmove.S
index d1fc0c0c342c..69a9d47fc5ab 100644
--- a/arch/arm/lib/memmove.S
+++ b/arch/arm/lib/memmove.S
@@ -12,6 +12,7 @@
 
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/unwind.h>
 
                 .text
 
@@ -27,12 +28,17 @@
  */
 
 ENTRY(memmove)
+        UNWIND( .fnstart                        )
 
                 subs    ip, r0, r1
                 cmphi   r2, ip
                 bls     memcpy
 
                 stmfd   sp!, {r0, r4, lr}
+        UNWIND( .fnend                          )
+
+        UNWIND( .fnstart                        )
+        UNWIND( .save   {r0, r4, lr}            ) @ in first stmfd block
                 add     r1, r1, r2
                 add     r0, r0, r2
                 subs    r2, r2, #4
@@ -45,6 +51,11 @@ ENTRY(memmove)
 
 1:              subs    r2, r2, #(28)
                 stmfd   sp!, {r5 - r8}
+        UNWIND( .fnend                          )
+
+        UNWIND( .fnstart                        )
+        UNWIND( .save   {r0, r4, lr}            )
+        UNWIND( .save   {r5 - r8}               ) @ in second stmfd block
                 blt     5f
 
         CALGN(  ands    ip, r0, #31             )
@@ -97,6 +108,10 @@ ENTRY(memmove)
         CALGN(  bcs     2b                      )
 
 7:              ldmfd   sp!, {r5 - r8}
+        UNWIND( .fnend                          ) @ end of second stmfd block
+
+        UNWIND( .fnstart                        )
+        UNWIND( .save   {r0, r4, lr}            ) @ still in first stmfd block
 
 8:              movs    r2, r2, lsl #31
                 ldrneb  r3, [r1, #-1]!
@@ -124,10 +139,13 @@ ENTRY(memmove)
                 ldr     r3, [r1, #0]
                 beq     17f
                 blt     18f
+        UNWIND( .fnend                          )
 
 
                 .macro  backward_copy_shift push pull
 
+        UNWIND( .fnstart                        )
+        UNWIND( .save   {r0, r4, lr}            ) @ still in first stmfd block
                 subs    r2, r2, #28
                 blt     14f
 
@@ -137,6 +155,11 @@ ENTRY(memmove)
         CALGN(  bcc     15f                     )
 
 11:             stmfd   sp!, {r5 - r9}
+        UNWIND( .fnend                          )
+
+        UNWIND( .fnstart                        )
+        UNWIND( .save   {r0, r4, lr}            )
+        UNWIND( .save   {r5 - r9}               ) @ in new second stmfd block
 
         PLD(    pld     [r1, #-4]               )
         PLD(    subs    r2, r2, #96             )
@@ -171,6 +194,10 @@ ENTRY(memmove)
         PLD(    bge     13b                     )
 
                 ldmfd   sp!, {r5 - r9}
+        UNWIND( .fnend                          ) @ end of the second stmfd block
+
+        UNWIND( .fnstart                        )
+        UNWIND( .save {r0, r4, lr}              ) @ still in first stmfd block
 
 14:             ands    ip, r2, #28
                 beq     16f
@@ -186,6 +213,7 @@ ENTRY(memmove)
 
 16:             add     r1, r1, #(\pull / 8)
                 b       8b
+        UNWIND( .fnend                          )
 
                 .endm
 
diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index 671455c854fa..a4ee97b5a2bf 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -11,11 +11,13 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/unwind.h>
 
         .text
         .align  5
 
 ENTRY(memset)
+UNWIND( .fnstart         )
         ands    r3, r0, #3              @ 1 unaligned?
         mov     ip, r0                  @ preserve r0 as return value
         bne     6f                      @ 1
@@ -34,6 +36,9 @@ ENTRY(memset)
  * We need 2 extra registers for this loop - use r8 and the LR
  */
         stmfd   sp!, {r8, lr}
+UNWIND( .fnend              )
+UNWIND( .fnstart            )
+UNWIND( .save {r8, lr}      )
         mov     r8, r1
         mov     lr, r1
 
@@ -53,6 +58,7 @@ ENTRY(memset)
         tst     r2, #16
         stmneia ip!, {r1, r3, r8, lr}
         ldmfd   sp!, {r8, lr}
+UNWIND( .fnend              )
 
 #else
 
@@ -62,6 +68,9 @@ ENTRY(memset)
  */
 
         stmfd   sp!, {r4-r8, lr}
+UNWIND( .fnend                 )
+UNWIND( .fnstart               )
+UNWIND( .save {r4-r8, lr}      )
         mov     r4, r1
         mov     r5, r1
         mov     r6, r1
@@ -94,9 +103,11 @@ ENTRY(memset)
         tst     r2, #16
         stmneia ip!, {r4-r7}
         ldmfd   sp!, {r4-r8, lr}
+UNWIND( .fnend                 )
 
 #endif
 
+UNWIND( .fnstart            )
 4:      tst     r2, #8
         stmneia ip!, {r1, r3}
         tst     r2, #4
@@ -120,4 +131,5 @@ ENTRY(memset)
         strb    r1, [ip], #1            @ 1
         add     r2, r2, r3              @ 1 (r2 = r2 - (4 - r3))
         b       1b
+UNWIND( .fnend   )
 ENDPROC(memset)
diff --git a/arch/arm/lib/memzero.S b/arch/arm/lib/memzero.S
index 385ccb306fa2..0eded952e089 100644
--- a/arch/arm/lib/memzero.S
+++ b/arch/arm/lib/memzero.S
@@ -9,6 +9,7 @@
  */
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/unwind.h>
 
         .text
         .align  5
@@ -18,6 +19,7 @@
  * mis-aligned by, and r1 is the number of bytes.  If r1 < 4, then we
  * don't bother; we use byte stores instead.
  */
+UNWIND( .fnstart                        )
 1:      subs    r1, r1, #4              @ 1 do we have enough
         blt     5f                      @ 1 bytes to align with?
         cmp     r3, #2                  @ 1
@@ -47,6 +49,9 @@ ENTRY(__memzero)
  * use the LR
  */
         str     lr, [sp, #-4]!          @ 1
+UNWIND( .fnend                          )
+UNWIND( .fnstart                        )
+UNWIND( .save   {lr}                    )
         mov     ip, r2                  @ 1
         mov     lr, r2                  @ 1
 
@@ -66,6 +71,7 @@ ENTRY(__memzero)
         tst     r1, #16                 @ 1 16 bytes or more?
         stmneia r0!, {r2, r3, ip, lr}   @ 4
         ldr     lr, [sp], #4            @ 1
+UNWIND( .fnend                          )
 
 #else
 
@@ -75,6 +81,9 @@ ENTRY(__memzero)
  */
 
         stmfd   sp!, {r4-r7, lr}
+UNWIND( .fnend                 )
+UNWIND( .fnstart               )
+UNWIND( .save   {r4-r7, lr}    )
         mov     r4, r2
         mov     r5, r2
         mov     r6, r2
@@ -105,9 +114,11 @@ ENTRY(__memzero)
         tst     r1, #16
         stmneia r0!, {r4-r7}
         ldmfd   sp!, {r4-r7, lr}
+UNWIND( .fnend                 )
 
 #endif
 
+UNWIND( .fnstart                        )
 4:      tst     r1, #8                  @ 1 8 bytes or more?
         stmneia r0!, {r2, r3}           @ 2
         tst     r1, #4                  @ 1 4 bytes or more?
@@ -122,4 +133,5 @@ ENTRY(__memzero)
         tst     r1, #1                  @ 1 a byte left over
         strneb  r2, [r0], #1            @ 1
         ret     lr                      @ 1
+UNWIND( .fnend                          )
 ENDPROC(__memzero)
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index b9e3f1c61baf..e4a00bafffc1 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -34,7 +34,7 @@ config ARCH_EXYNOS3
         bool "SAMSUNG EXYNOS3"
         select ARM_CPU_SUSPEND if PM
         help
-          Samsung EXYNOS3 (Crotex-A7) SoC based systems
+          Samsung EXYNOS3 (Cortex-A7) SoC based systems
 
 config ARCH_EXYNOS4
         bool "SAMSUNG EXYNOS4"
diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
index 9fa6a990cf03..03c75a811cb0 100644
--- a/arch/arm/mach-sa1100/clock.c
+++ b/arch/arm/mach-sa1100/clock.c
@@ -15,10 +15,12 @@
 #include <linux/clkdev.h>
 
 #include <mach/hardware.h>
+#include <mach/generic.h>
 
 struct clkops {
         void                    (*enable)(struct clk *);
         void                    (*disable)(struct clk *);
+        unsigned long           (*get_rate)(struct clk *);
 };
 
 struct clk {
@@ -33,13 +35,6 @@ struct clk clk_##_name = {				\
 
 static DEFINE_SPINLOCK(clocks_lock);
 
-/* Dummy clk routine to build generic kernel parts that may be using them */
-unsigned long clk_get_rate(struct clk *clk)
-{
-        return 0;
-}
-EXPORT_SYMBOL(clk_get_rate);
-
 static void clk_gpio27_enable(struct clk *clk)
 {
         /*
@@ -58,6 +53,19 @@ static void clk_gpio27_disable(struct clk *clk)
         GAFR &= ~GPIO_32_768kHz;
 }
 
+static void clk_cpu_enable(struct clk *clk)
+{
+}
+
+static void clk_cpu_disable(struct clk *clk)
+{
+}
+
+static unsigned long clk_cpu_get_rate(struct clk *clk)
+{
+        return sa11x0_getspeed(0) * 1000;
+}
+
 int clk_enable(struct clk *clk)
 {
         unsigned long flags;
@@ -87,16 +95,37 @@ void clk_disable(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_disable);
 
+unsigned long clk_get_rate(struct clk *clk)
+{
+        if (clk && clk->ops && clk->ops->get_rate)
+                return clk->ops->get_rate(clk);
+
+        return 0;
+}
+EXPORT_SYMBOL(clk_get_rate);
+
 const struct clkops clk_gpio27_ops = {
         .enable         = clk_gpio27_enable,
         .disable        = clk_gpio27_disable,
 };
 
+const struct clkops clk_cpu_ops = {
+        .enable         = clk_cpu_enable,
+        .disable        = clk_cpu_disable,
+        .get_rate       = clk_cpu_get_rate,
+};
+
 static DEFINE_CLK(gpio27, &clk_gpio27_ops);
 
+static DEFINE_CLK(cpu, &clk_cpu_ops);
+
 static struct clk_lookup sa11xx_clkregs[] = {
         CLKDEV_INIT("sa1111.0", NULL, &clk_gpio27),
         CLKDEV_INIT("sa1100-rtc", NULL, NULL),
+        CLKDEV_INIT("sa11x0-fb", NULL, &clk_cpu),
+        CLKDEV_INIT("sa11x0-pcmcia", NULL, &clk_cpu),
+        /* sa1111 names devices using internal offsets, PCMCIA is at 0x1800 */
+        CLKDEV_INIT("1800", NULL, &clk_cpu),
 };
 
 static int __init sa11xx_clk_init(void)
diff --git a/arch/arm/mach-sa1100/collie.c b/arch/arm/mach-sa1100/collie.c
index 108939f8d053..b90c7d828391 100644
--- a/arch/arm/mach-sa1100/collie.c
+++ b/arch/arm/mach-sa1100/collie.c
@@ -30,7 +30,7 @@
 #include <linux/gpio_keys.h>
 #include <linux/input.h>
 #include <linux/gpio.h>
-#include <linux/pda_power.h>
+#include <linux/power/gpio-charger.h>
 
 #include <video/sa1100fb.h>
 
@@ -131,62 +131,24 @@ static struct irda_platform_data collie_ir_data = {
 /*
  * Collie AC IN
  */
-static int collie_power_init(struct device *dev)
-{
-        int ret = gpio_request(COLLIE_GPIO_AC_IN, "ac in");
-        if (ret)
-                goto err_gpio_req;
-
-        ret = gpio_direction_input(COLLIE_GPIO_AC_IN);
-        if (ret)
-                goto err_gpio_in;
-
-        return 0;
-
-err_gpio_in:
-        gpio_free(COLLIE_GPIO_AC_IN);
-err_gpio_req:
-        return ret;
-}
-
-static void collie_power_exit(struct device *dev)
-{
-        gpio_free(COLLIE_GPIO_AC_IN);
-}
-
-static int collie_power_ac_online(void)
-{
-        return gpio_get_value(COLLIE_GPIO_AC_IN) == 2;
-}
-
 static char *collie_ac_supplied_to[] = {
         "main-battery",
         "backup-battery",
 };
 
-static struct pda_power_pdata collie_power_data = {
-        .init                   = collie_power_init,
-        .is_ac_online           = collie_power_ac_online,
-        .exit                   = collie_power_exit,
+
+static struct gpio_charger_platform_data collie_power_data = {
+        .name                   = "charger",
+        .type                   = POWER_SUPPLY_TYPE_MAINS,
+        .gpio                   = COLLIE_GPIO_AC_IN,
         .supplied_to            = collie_ac_supplied_to,
         .num_supplicants        = ARRAY_SIZE(collie_ac_supplied_to),
 };
 
-static struct resource collie_power_resource[] = {
-        {
-                .name           = "ac",
-                .flags          = IORESOURCE_IRQ |
-                                  IORESOURCE_IRQ_HIGHEDGE |
-                                  IORESOURCE_IRQ_LOWEDGE,
-        },
-};
-
 static struct platform_device collie_power_device = {
-        .name                   = "pda-power",
+        .name                   = "gpio-charger",
         .id                     = -1,
         .dev.platform_data      = &collie_power_data,
-        .resource               = collie_power_resource,
-        .num_resources          = ARRAY_SIZE(collie_power_resource),
 };
 
 #ifdef CONFIG_SHARP_LOCOMO
@@ -420,9 +382,6 @@ static void __init collie_init(void)
 
         GPSR |= _COLLIE_GPIO_UCB1x00_RESET;
 
-        collie_power_resource[0].start = gpio_to_irq(COLLIE_GPIO_AC_IN);
-        collie_power_resource[0].end = gpio_to_irq(COLLIE_GPIO_AC_IN);
-
         sa11x0_ppc_configure_mcp();
 
 
diff --git a/arch/arm/mach-sa1100/include/mach/entry-macro.S b/arch/arm/mach-sa1100/include/mach/entry-macro.S
deleted file mode 100644
index 8cf7630bf024..000000000000
--- a/arch/arm/mach-sa1100/include/mach/entry-macro.S
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * arch/arm/mach-sa1100/include/mach/entry-macro.S
- *
- * Low-level IRQ helper macros for SA1100-based platforms
- *
- * This file is licensed under  the terms of the GNU General Public
- * License version 2. This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-
-                .macro  get_irqnr_preamble, base, tmp
-                mov     \base, #0xfa000000              @ ICIP = 0xfa050000
-                add     \base, \base, #0x00050000
-                .endm
-
-                .macro  get_irqnr_and_base, irqnr, irqstat, base, tmp
-                ldr     \irqstat, [\base]               @ get irqs
-                ldr     \irqnr, [\base, #4]             @ ICMR = 0xfa050004
-                ands    \irqstat, \irqstat, \irqnr
-                mov     \irqnr, #0
-                beq     1001f
-                tst     \irqstat, #0xff
-                moveq   \irqstat, \irqstat, lsr #8
-                addeq   \irqnr, \irqnr, #8
-                tsteq   \irqstat, #0xff
-                moveq   \irqstat, \irqstat, lsr #8
-                addeq   \irqnr, \irqnr, #8
-                tsteq   \irqstat, #0xff
-                moveq   \irqstat, \irqstat, lsr #8
-                addeq   \irqnr, \irqnr, #8
-                tst     \irqstat, #0x0f
-                moveq   \irqstat, \irqstat, lsr #4
-                addeq   \irqnr, \irqnr, #4
-                tst     \irqstat, #0x03
-                moveq   \irqstat, \irqstat, lsr #2
-                addeq   \irqnr, \irqnr, #2
-                tst     \irqstat, #0x01
-                addeqs  \irqnr, \irqnr, #1
-1001:
-                .endm
-
diff --git a/arch/arm/mach-sa1100/include/mach/irqs.h b/arch/arm/mach-sa1100/include/mach/irqs.h
index 3790298b7142..de0983494c7e 100644
--- a/arch/arm/mach-sa1100/include/mach/irqs.h
+++ b/arch/arm/mach-sa1100/include/mach/irqs.h
@@ -8,56 +8,56 @@
  * 2001/11/14   RMK     Cleaned up and standardised a lot of the IRQs.
  */
 
-#define IRQ_GPIO0               0
-#define IRQ_GPIO1               1
-#define IRQ_GPIO2               2
-#define IRQ_GPIO3               3
-#define IRQ_GPIO4               4
-#define IRQ_GPIO5               5
-#define IRQ_GPIO6               6
-#define IRQ_GPIO7               7
-#define IRQ_GPIO8               8
-#define IRQ_GPIO9               9
-#define IRQ_GPIO10              10
-#define IRQ_GPIO11_27           11
-#define IRQ_LCD                 12      /* LCD controller           */
-#define IRQ_Ser0UDC             13      /* Ser. port 0 UDC          */
-#define IRQ_Ser1SDLC            14      /* Ser. port 1 SDLC         */
-#define IRQ_Ser1UART            15      /* Ser. port 1 UART         */
-#define IRQ_Ser2ICP             16      /* Ser. port 2 ICP          */
-#define IRQ_Ser3UART            17      /* Ser. port 3 UART         */
-#define IRQ_Ser4MCP             18      /* Ser. port 4 MCP          */
-#define IRQ_Ser4SSP             19      /* Ser. port 4 SSP          */
-#define IRQ_DMA0                20      /* DMA controller channel 0 */
-#define IRQ_DMA1                21      /* DMA controller channel 1 */
-#define IRQ_DMA2                22      /* DMA controller channel 2 */
-#define IRQ_DMA3                23      /* DMA controller channel 3 */
-#define IRQ_DMA4                24      /* DMA controller channel 4 */
-#define IRQ_DMA5                25      /* DMA controller channel 5 */
-#define IRQ_OST0                26      /* OS Timer match 0         */
-#define IRQ_OST1                27      /* OS Timer match 1         */
-#define IRQ_OST2                28      /* OS Timer match 2         */
-#define IRQ_OST3                29      /* OS Timer match 3         */
-#define IRQ_RTC1Hz              30      /* RTC 1 Hz clock           */
-#define IRQ_RTCAlrm             31      /* RTC Alarm                */
+#define IRQ_GPIO0               1
+#define IRQ_GPIO1               2
+#define IRQ_GPIO2               3
+#define IRQ_GPIO3               4
+#define IRQ_GPIO4               5
+#define IRQ_GPIO5               6
+#define IRQ_GPIO6               7
+#define IRQ_GPIO7               8
+#define IRQ_GPIO8               9
+#define IRQ_GPIO9               10
+#define IRQ_GPIO10              11
+#define IRQ_GPIO11_27           12
+#define IRQ_LCD                 13      /* LCD controller           */
+#define IRQ_Ser0UDC             14      /* Ser. port 0 UDC          */
+#define IRQ_Ser1SDLC            15      /* Ser. port 1 SDLC         */
+#define IRQ_Ser1UART            16      /* Ser. port 1 UART         */
+#define IRQ_Ser2ICP             17      /* Ser. port 2 ICP          */
+#define IRQ_Ser3UART            18      /* Ser. port 3 UART         */
+#define IRQ_Ser4MCP             19      /* Ser. port 4 MCP          */
+#define IRQ_Ser4SSP             20      /* Ser. port 4 SSP          */
+#define IRQ_DMA0                21      /* DMA controller channel 0 */
+#define IRQ_DMA1                22      /* DMA controller channel 1 */
+#define IRQ_DMA2                23      /* DMA controller channel 2 */
+#define IRQ_DMA3                24      /* DMA controller channel 3 */
+#define IRQ_DMA4                25      /* DMA controller channel 4 */
+#define IRQ_DMA5                26      /* DMA controller channel 5 */
+#define IRQ_OST0                27      /* OS Timer match 0         */
+#define IRQ_OST1                28      /* OS Timer match 1         */
+#define IRQ_OST2                29      /* OS Timer match 2         */
+#define IRQ_OST3                30      /* OS Timer match 3         */
+#define IRQ_RTC1Hz              31      /* RTC 1 Hz clock           */
+#define IRQ_RTCAlrm             32      /* RTC Alarm                */
 
-#define IRQ_GPIO11              32
-#define IRQ_GPIO12              33
-#define IRQ_GPIO13              34
-#define IRQ_GPIO14              35
-#define IRQ_GPIO15              36
-#define IRQ_GPIO16              37
-#define IRQ_GPIO17              38
-#define IRQ_GPIO18              39
-#define IRQ_GPIO19              40
-#define IRQ_GPIO20              41
-#define IRQ_GPIO21              42
-#define IRQ_GPIO22              43
-#define IRQ_GPIO23              44
-#define IRQ_GPIO24              45
-#define IRQ_GPIO25              46
-#define IRQ_GPIO26              47
-#define IRQ_GPIO27              48
+#define IRQ_GPIO11              33
+#define IRQ_GPIO12              34
+#define IRQ_GPIO13              35
+#define IRQ_GPIO14              36
+#define IRQ_GPIO15              37
+#define IRQ_GPIO16              38
+#define IRQ_GPIO17              39
+#define IRQ_GPIO18              40
+#define IRQ_GPIO19              41
+#define IRQ_GPIO20              42
+#define IRQ_GPIO21              43
+#define IRQ_GPIO22              44
+#define IRQ_GPIO23              45
+#define IRQ_GPIO24              46
+#define IRQ_GPIO25              47
+#define IRQ_GPIO26              48
+#define IRQ_GPIO27              49
 
 /*
  * The next 16 interrupts are for board specific purposes.  Since
@@ -65,8 +65,8 @@
  * these.  If you need more, increase IRQ_BOARD_END, but keep it
  * within sensible limits.  IRQs 49 to 64 are available.
  */
-#define IRQ_BOARD_START         49
-#define IRQ_BOARD_END           65
+#define IRQ_BOARD_START         50
+#define IRQ_BOARD_END           66
 
 /*
  * Figure out the MAX IRQ number.
diff --git a/arch/arm/mach-sa1100/irq.c b/arch/arm/mach-sa1100/irq.c
index 2124f1fc2fbe..63e2901db416 100644
--- a/arch/arm/mach-sa1100/irq.c
+++ b/arch/arm/mach-sa1100/irq.c
@@ -14,17 +14,73 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/irq.h>
+#include <linux/irqdomain.h>
 #include <linux/ioport.h>
 #include <linux/syscore_ops.h>
 
 #include <mach/hardware.h>
 #include <mach/irqs.h>
 #include <asm/mach/irq.h>
+#include <asm/exception.h>
 
 #include "generic.h"
 
 
 /*
+ * We don't need to ACK IRQs on the SA1100 unless they're GPIOs
+ * this is for internal IRQs i.e. from IRQ LCD to RTCAlrm.
+ */
+static void sa1100_mask_irq(struct irq_data *d)
+{
+        ICMR &= ~BIT(d->hwirq);
+}
+
+static void sa1100_unmask_irq(struct irq_data *d)
+{
+        ICMR |= BIT(d->hwirq);
+}
+
+/*
+ * Apart form GPIOs, only the RTC alarm can be a wakeup event.
+ */
+static int sa1100_set_wake(struct irq_data *d, unsigned int on)
+{
+        if (BIT(d->hwirq) == IC_RTCAlrm) {
+                if (on)
+                        PWER |= PWER_RTC;
+                else
+                        PWER &= ~PWER_RTC;
+                return 0;
+        }
+        return -EINVAL;
+}
+
+static struct irq_chip sa1100_normal_chip = {
+        .name           = "SC",
+        .irq_ack        = sa1100_mask_irq,
+        .irq_mask       = sa1100_mask_irq,
+        .irq_unmask     = sa1100_unmask_irq,
+        .irq_set_wake   = sa1100_set_wake,
+};
+
+static int sa1100_normal_irqdomain_map(struct irq_domain *d,
+                unsigned int irq, irq_hw_number_t hwirq)
+{
+        irq_set_chip_and_handler(irq, &sa1100_normal_chip,
+                                 handle_level_irq);
+        set_irq_flags(irq, IRQF_VALID);
+
+        return 0;
+}
+
+static struct irq_domain_ops sa1100_normal_irqdomain_ops = {
+        .map = sa1100_normal_irqdomain_map,
+        .xlate = irq_domain_xlate_onetwocell,
+};
+
+static struct irq_domain *sa1100_normal_irqdomain;
+
+/*
  * SA1100 GPIO edge detection for IRQs:
  * IRQs are generated on Falling-Edge, Rising-Edge, or both.
  * Use this instead of directly setting GRER/GFER.
@@ -33,20 +89,11 @@ static int GPIO_IRQ_rising_edge;
 static int GPIO_IRQ_falling_edge;
 static int GPIO_IRQ_mask = (1 << 11) - 1;
 
-/*
- * To get the GPIO number from an IRQ number
- */
-#define GPIO_11_27_IRQ(i)       ((i) - 21)
-#define GPIO11_27_MASK(irq)     (1 << GPIO_11_27_IRQ(irq))
-
 static int sa1100_gpio_type(struct irq_data *d, unsigned int type)
 {
         unsigned int mask;
 
-        if (d->irq <= 10)
-                mask = 1 << d->irq;
-        else
-                mask = GPIO11_27_MASK(d->irq);
+        mask = BIT(d->hwirq);
 
         if (type == IRQ_TYPE_PROBE) {
                 if ((GPIO_IRQ_rising_edge | GPIO_IRQ_falling_edge) & mask)
@@ -70,41 +117,51 @@ static int sa1100_gpio_type(struct irq_data *d, unsigned int type)
 }
 
 /*
- * GPIO IRQs must be acknowledged.  This is for IRQs from 0 to 10.
+ * GPIO IRQs must be acknowledged.
  */
-static void sa1100_low_gpio_ack(struct irq_data *d)
-{
-        GEDR = (1 << d->irq);
-}
-
-static void sa1100_low_gpio_mask(struct irq_data *d)
-{
-        ICMR &= ~(1 << d->irq);
-}
-
-static void sa1100_low_gpio_unmask(struct irq_data *d)
+static void sa1100_gpio_ack(struct irq_data *d)
 {
-        ICMR |= 1 << d->irq;
+        GEDR = BIT(d->hwirq);
 }
 
-static int sa1100_low_gpio_wake(struct irq_data *d, unsigned int on)
+static int sa1100_gpio_wake(struct irq_data *d, unsigned int on)
 {
         if (on)
-                PWER |= 1 << d->irq;
+                PWER |= BIT(d->hwirq);
         else
-                PWER &= ~(1 << d->irq);
+                PWER &= ~BIT(d->hwirq);
         return 0;
 }
 
+/*
+ * This is for IRQs from 0 to 10.
+ */
 static struct irq_chip sa1100_low_gpio_chip = {
         .name           = "GPIO-l",
-        .irq_ack        = sa1100_low_gpio_ack,
-        .irq_mask       = sa1100_low_gpio_mask,
-        .irq_unmask     = sa1100_low_gpio_unmask,
+        .irq_ack        = sa1100_gpio_ack,
+        .irq_mask       = sa1100_mask_irq,
+        .irq_unmask     = sa1100_unmask_irq,
         .irq_set_type   = sa1100_gpio_type,
-        .irq_set_wake   = sa1100_low_gpio_wake,
+        .irq_set_wake   = sa1100_gpio_wake,
+};
+
+static int sa1100_low_gpio_irqdomain_map(struct irq_domain *d,
+                unsigned int irq, irq_hw_number_t hwirq)
+{
+        irq_set_chip_and_handler(irq, &sa1100_low_gpio_chip,
+                                 handle_edge_irq);
+        set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+
+        return 0;
+}
+
+static struct irq_domain_ops sa1100_low_gpio_irqdomain_ops = {
+        .map = sa1100_low_gpio_irqdomain_map,
+        .xlate = irq_domain_xlate_onetwocell,
 };
 
+static struct irq_domain *sa1100_low_gpio_irqdomain;
+
 /*
  * IRQ11 (GPIO11 through 27) handler.  We enter here with the
  * irq_controller_lock held, and IRQs disabled.  Decode the IRQ
@@ -141,16 +198,9 @@ sa1100_high_gpio_handler(unsigned int irq, struct irq_desc *desc)
  * In addition, the IRQs are all collected up into one bit in the
  * interrupt controller registers.
  */
-static void sa1100_high_gpio_ack(struct irq_data *d)
-{
-        unsigned int mask = GPIO11_27_MASK(d->irq);
-
-        GEDR = mask;
-}
-
 static void sa1100_high_gpio_mask(struct irq_data *d)
 {
-        unsigned int mask = GPIO11_27_MASK(d->irq);
+        unsigned int mask = BIT(d->hwirq);
 
         GPIO_IRQ_mask &= ~mask;
 
@@ -160,7 +210,7 @@ static void sa1100_high_gpio_mask(struct irq_data *d)
 
 static void sa1100_high_gpio_unmask(struct irq_data *d)
 {
-        unsigned int mask = GPIO11_27_MASK(d->irq);
+        unsigned int mask = BIT(d->hwirq);
 
         GPIO_IRQ_mask |= mask;
 
@@ -168,61 +218,32 @@ static void sa1100_high_gpio_unmask(struct irq_data *d)
         GFER = GPIO_IRQ_falling_edge & GPIO_IRQ_mask;
 }
 
-static int sa1100_high_gpio_wake(struct irq_data *d, unsigned int on)
-{
-        if (on)
-                PWER |= GPIO11_27_MASK(d->irq);
-        else
-                PWER &= ~GPIO11_27_MASK(d->irq);
-        return 0;
-}
-
 static struct irq_chip sa1100_high_gpio_chip = {
         .name           = "GPIO-h",
-        .irq_ack        = sa1100_high_gpio_ack,
+        .irq_ack        = sa1100_gpio_ack,
         .irq_mask       = sa1100_high_gpio_mask,
         .irq_unmask     = sa1100_high_gpio_unmask,
         .irq_set_type   = sa1100_gpio_type,
-        .irq_set_wake   = sa1100_high_gpio_wake,
+        .irq_set_wake   = sa1100_gpio_wake,
 };
 
-/*
- * We don't need to ACK IRQs on the SA1100 unless they're GPIOs
- * this is for internal IRQs i.e. from 11 to 31.
- */
-static void sa1100_mask_irq(struct irq_data *d)
-{
-        ICMR &= ~(1 << d->irq);
-}
-
-static void sa1100_unmask_irq(struct irq_data *d)
+static int sa1100_high_gpio_irqdomain_map(struct irq_domain *d,
+                unsigned int irq, irq_hw_number_t hwirq)
 {
-        ICMR |= (1 << d->irq);
-}
+        irq_set_chip_and_handler(irq, &sa1100_high_gpio_chip,
+                                 handle_edge_irq);
+        set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
 
-/*
- * Apart form GPIOs, only the RTC alarm can be a wakeup event.
- */
-static int sa1100_set_wake(struct irq_data *d, unsigned int on)
-{
-        if (d->irq == IRQ_RTCAlrm) {
-                if (on)
-                        PWER |= PWER_RTC;
-                else
-                        PWER &= ~PWER_RTC;
-                return 0;
-        }
-        return -EINVAL;
+        return 0;
 }
 
-static struct irq_chip sa1100_normal_chip = {
-        .name           = "SC",
-        .irq_ack        = sa1100_mask_irq,
-        .irq_mask       = sa1100_mask_irq,
-        .irq_unmask     = sa1100_unmask_irq,
-        .irq_set_wake   = sa1100_set_wake,
+static struct irq_domain_ops sa1100_high_gpio_irqdomain_ops = {
+        .map = sa1100_high_gpio_irqdomain_map,
+        .xlate = irq_domain_xlate_onetwocell,
 };
 
+static struct irq_domain *sa1100_high_gpio_irqdomain;
+
 static struct resource irq_resource =
         DEFINE_RES_MEM_NAMED(0x90050000, SZ_64K, "irqs");
 
@@ -291,10 +312,25 @@ static int __init sa1100irq_init_devicefs(void)
 
 device_initcall(sa1100irq_init_devicefs);
 
-void __init sa1100_init_irq(void)
+static asmlinkage void __exception_irq_entry
+sa1100_handle_irq(struct pt_regs *regs)
 {
-        unsigned int irq;
+        uint32_t icip, icmr, mask;
+
+        do {
+                icip = (ICIP);
+                icmr = (ICMR);
+                mask = icip & icmr;
+
+                if (mask == 0)
+                        break;
+
+                handle_IRQ(ffs(mask) - 1 + IRQ_GPIO0, regs);
+        } while (1);
+}
 
+void __init sa1100_init_irq(void)
+{
         request_resource(&iomem_resource, &irq_resource);
 
         /* disable all IRQs */
@@ -314,29 +350,24 @@ void __init sa1100_init_irq(void)
          */
         ICCR = 1;
 
-        for (irq = 0; irq <= 10; irq++) {
-                irq_set_chip_and_handler(irq, &sa1100_low_gpio_chip,
-                                         handle_edge_irq);
-                set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
-        }
+        sa1100_low_gpio_irqdomain = irq_domain_add_legacy(NULL,
+                        11, IRQ_GPIO0, 0,
+                        &sa1100_low_gpio_irqdomain_ops, NULL);
 
-        for (irq = 12; irq <= 31; irq++) {
-                irq_set_chip_and_handler(irq, &sa1100_normal_chip,
-                                         handle_level_irq);
-                set_irq_flags(irq, IRQF_VALID);
-        }
+        sa1100_normal_irqdomain = irq_domain_add_legacy(NULL,
+                        21, IRQ_GPIO11_27, 11,
+                        &sa1100_normal_irqdomain_ops, NULL);
 
-        for (irq = 32; irq <= 48; irq++) {
-                irq_set_chip_and_handler(irq, &sa1100_high_gpio_chip,
-                                         handle_edge_irq);
-                set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
-        }
+        sa1100_high_gpio_irqdomain = irq_domain_add_legacy(NULL,
+                        17, IRQ_GPIO11, 11,
+                        &sa1100_high_gpio_irqdomain_ops, NULL);
 
         /*
          * Install handler for GPIO 11-27 edge detect interrupts
          */
-        irq_set_chip(IRQ_GPIO11_27, &sa1100_normal_chip);
         irq_set_chained_handler(IRQ_GPIO11_27, sa1100_high_gpio_handler);
 
+        set_handle_irq(sa1100_handle_irq);
+
         sa1100_init_gpio();
 }
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index ab906b801047..03823e784f63 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -1009,3 +1009,24 @@ config ARCH_SUPPORTS_BIG_ENDIAN
         help
           This option specifies the architecture can support big endian
           operation.
+
+config ARM_KERNMEM_PERMS
+        bool "Restrict kernel memory permissions"
+        help
+          If this is set, kernel memory other than kernel text (and rodata)
+          will be made non-executable. The tradeoff is that each region is
+          padded to section-size (1MiB) boundaries (because their permissions
+          are different and splitting the 1M pages into 4K ones causes TLB
+          performance problems), wasting memory.
+
+config DEBUG_RODATA
+        bool "Make kernel text and rodata read-only"
+        depends on ARM_KERNMEM_PERMS
+        default y
+        help
+          If this is set, kernel text and rodata will be made read-only. This
+          is to help catch accidental or malicious attempts to change the
+          kernel's executable code. Additionally splits rodata from kernel
+          text so it can be made explicitly non-executable. This creates
+          another section-size padded region, so it can waste more memory
+          space while gaining the read-only protections.
diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile
index 91da64de440f..d3afdf9eb65a 100644
--- a/arch/arm/mm/Makefile
+++ b/arch/arm/mm/Makefile
@@ -6,7 +6,7 @@ obj-y				:= dma-mapping.o extable.o fault.o init.o \
                                    iomap.o
 
 obj-$(CONFIG_MMU)               += fault-armv.o flush.o idmap.o ioremap.o \
-                                   mmap.o pgd.o mmu.o
+                                   mmap.o pgd.o mmu.o pageattr.o
 
 ifneq ($(CONFIG_MMU),y)
 obj-y                           += nommu.o
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 83792f4324ea..2c0c541c60ca 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -113,7 +113,7 @@ static int safe_usermode(int new_usermode, bool warn)
                 new_usermode |= UM_FIXUP;
 
                 if (warn)
-                        printk(KERN_WARNING "alignment: ignoring faults is unsafe on this CPU.  Defaulting to fixup mode.\n");
+                        pr_warn("alignment: ignoring faults is unsafe on this CPU.  Defaulting to fixup mode.\n");
         }
 
         return new_usermode;
@@ -523,7 +523,7 @@ do_alignment_ldmstm(unsigned long addr, unsigned long instr, struct pt_regs *reg
          * processor for us.
          */
         if (addr != eaddr) {
-                printk(KERN_ERR "LDMSTM: PC = %08lx, instr = %08lx, "
+                pr_err("LDMSTM: PC = %08lx, instr = %08lx, "
                         "addr = %08lx, eaddr = %08lx\n",
                          instruction_pointer(regs), instr, addr, eaddr);
                 show_regs(regs);
@@ -567,7 +567,7 @@ fault:
         return TYPE_FAULT;
 
 bad:
-        printk(KERN_ERR "Alignment trap: not handling ldm with s-bit set\n");
+        pr_err("Alignment trap: not handling ldm with s-bit set\n");
         return TYPE_ERROR;
 }
 
@@ -899,13 +899,13 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         return 0;
 
  swp:
-        printk(KERN_ERR "Alignment trap: not handling swp instruction\n");
+        pr_err("Alignment trap: not handling swp instruction\n");
 
  bad:
         /*
          * Oops, we didn't handle the instruction.
          */
-        printk(KERN_ERR "Alignment trap: not handling instruction "
+        pr_err("Alignment trap: not handling instruction "
                 "%0*lx at [<%08lx>]\n",
                 isize << 1,
                 isize == 2 ? tinstr : instr, instrptr);
diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
index e028a7f2ebcc..097181e08c25 100644
--- a/arch/arm/mm/cache-feroceon-l2.c
+++ b/arch/arm/mm/cache-feroceon-l2.c
@@ -313,7 +313,7 @@ static void __init disable_l2_prefetch(void)
          */
         u = read_extra_features();
         if (!(u & 0x01000000)) {
-                printk(KERN_INFO "Feroceon L2: Disabling L2 prefetch.\n");
+                pr_info("Feroceon L2: Disabling L2 prefetch.\n");
                 write_extra_features(u | 0x01000000);
         }
 }
@@ -326,7 +326,7 @@ static void __init enable_l2(void)
         if (!(u & 0x00400000)) {
                 int i, d;
 
-                printk(KERN_INFO "Feroceon L2: Enabling L2\n");
+                pr_info("Feroceon L2: Enabling L2\n");
 
                 d = flush_and_disable_dcache();
                 i = invalidate_and_disable_icache();
@@ -353,7 +353,7 @@ void __init feroceon_l2_init(int __l2_wt_override)
 
         enable_l2();
 
-        printk(KERN_INFO "Feroceon L2: Cache support initialised%s.\n",
+        pr_info("Feroceon L2: Cache support initialised%s.\n",
                          l2_wt_override ? ", in WT override mode" : "");
 }
 #ifdef CONFIG_OF
diff --git a/arch/arm/mm/cache-tauros2.c b/arch/arm/mm/cache-tauros2.c
index b273739e6359..1e373d268c04 100644
--- a/arch/arm/mm/cache-tauros2.c
+++ b/arch/arm/mm/cache-tauros2.c
@@ -185,7 +185,7 @@ static void enable_extra_feature(unsigned int features)
                 u &= ~0x01000000;
         else
                 u |= 0x01000000;
-        printk(KERN_INFO "Tauros2: %s L2 prefetch.\n",
+        pr_info("Tauros2: %s L2 prefetch.\n",
                         (features & CACHE_TAUROS2_PREFETCH_ON)
                         ? "Enabling" : "Disabling");
 
@@ -193,7 +193,7 @@ static void enable_extra_feature(unsigned int features)
                 u |= 0x00100000;
         else
                 u &= ~0x00100000;
-        printk(KERN_INFO "Tauros2: %s line fill burt8.\n",
+        pr_info("Tauros2: %s line fill burt8.\n",
                         (features & CACHE_TAUROS2_LINEFILL_BURST8)
                         ? "Enabling" : "Disabling");
 
@@ -216,7 +216,7 @@ static void __init tauros2_internal_init(unsigned int features)
                  */
                 feat = read_extra_features();
                 if (!(feat & 0x00400000)) {
-                        printk(KERN_INFO "Tauros2: Enabling L2 cache.\n");
+                        pr_info("Tauros2: Enabling L2 cache.\n");
                         write_extra_features(feat | 0x00400000);
                 }
 
@@ -253,7 +253,7 @@ static void __init tauros2_internal_init(unsigned int features)
                  */
                 actlr = read_actlr();
                 if (!(actlr & 0x00000002)) {
-                        printk(KERN_INFO "Tauros2: Enabling L2 cache.\n");
+                        pr_info("Tauros2: Enabling L2 cache.\n");
                         write_actlr(actlr | 0x00000002);
                 }
 
@@ -262,11 +262,11 @@ static void __init tauros2_internal_init(unsigned int features)
 #endif
 
         if (mode == NULL) {
-                printk(KERN_CRIT "Tauros2: Unable to detect CPU mode.\n");
+                pr_crit("Tauros2: Unable to detect CPU mode.\n");
                 return;
         }
 
-        printk(KERN_INFO "Tauros2: L2 cache support initialised "
+        pr_info("Tauros2: L2 cache support initialised "
                          "in %s mode.\n", mode);
 }
 
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 6eb97b3a7481..91892569710f 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -184,36 +184,46 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
         u64 asid = atomic64_read(&mm->context.id);
         u64 generation = atomic64_read(&asid_generation);
 
-        if (asid != 0 && is_reserved_asid(asid)) {
+        if (asid != 0) {
                 /*
-                 * Our current ASID was active during a rollover, we can
-                 * continue to use it and this was just a false alarm.
+                 * If our current ASID was active during a rollover, we
+                 * can continue to use it and this was just a false alarm.
                  */
-                asid = generation | (asid & ~ASID_MASK);
-        } else {
+                if (is_reserved_asid(asid))
+                        return generation | (asid & ~ASID_MASK);
+
                 /*
-                 * Allocate a free ASID. If we can't find one, take a
-                 * note of the currently active ASIDs and mark the TLBs
-                 * as requiring flushes. We always count from ASID #1,
-                 * as we reserve ASID #0 to switch via TTBR0 and to
-                 * avoid speculative page table walks from hitting in
-                 * any partial walk caches, which could be populated
-                 * from overlapping level-1 descriptors used to map both
-                 * the module area and the userspace stack.
+                 * We had a valid ASID in a previous life, so try to re-use
+                 * it if possible.,
                  */
-                asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, cur_idx);
-                if (asid == NUM_USER_ASIDS) {
-                        generation = atomic64_add_return(ASID_FIRST_VERSION,
-                                                         &asid_generation);
-                        flush_context(cpu);
-                        asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
-                }
-                __set_bit(asid, asid_map);
-                cur_idx = asid;
-                asid |= generation;
-                cpumask_clear(mm_cpumask(mm));
+                asid &= ~ASID_MASK;
+                if (!__test_and_set_bit(asid, asid_map))
+                        goto bump_gen;
         }
 
+        /*
+         * Allocate a free ASID. If we can't find one, take a note of the
+         * currently active ASIDs and mark the TLBs as requiring flushes.
+         * We always count from ASID #1, as we reserve ASID #0 to switch
+         * via TTBR0 and to avoid speculative page table walks from hitting
+         * in any partial walk caches, which could be populated from
+         * overlapping level-1 descriptors used to map both the module
+         * area and the userspace stack.
+         */
+        asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, cur_idx);
+        if (asid == NUM_USER_ASIDS) {
+                generation = atomic64_add_return(ASID_FIRST_VERSION,
+                                                 &asid_generation);
+                flush_context(cpu);
+                asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+        }
+
+        __set_bit(asid, asid_map);
+        cur_idx = asid;
+
+bump_gen:
+        asid |= generation;
+        cpumask_clear(mm_cpumask(mm));
         return asid;
 }
 
diff --git a/arch/arm/mm/copypage-v6.c b/arch/arm/mm/copypage-v6.c
index b9bcc9d79176..70423345da26 100644
--- a/arch/arm/mm/copypage-v6.c
+++ b/arch/arm/mm/copypage-v6.c
@@ -62,7 +62,7 @@ static void discard_old_kernel_data(void *kto)
         __asm__("mcrr   p15, 0, %1, %0, c6      @ 0xec401f06"
            :
            : "r" (kto),
-             "r" ((unsigned long)kto + PAGE_SIZE - L1_CACHE_BYTES)
+             "r" ((unsigned long)kto + PAGE_SIZE - 1)
            : "cc");
 }
 
diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index ff379ac115df..d9e0d00a6699 100644
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -235,7 +235,7 @@ void __init check_writebuffer_bugs(void)
         const char *reason;
         unsigned long v = 1;
 
-        printk(KERN_INFO "CPU: Testing write buffer coherency: ");
+        pr_info("CPU: Testing write buffer coherency: ");
 
         page = alloc_page(GFP_KERNEL);
         if (page) {
@@ -261,9 +261,9 @@ void __init check_writebuffer_bugs(void)
         }
 
         if (v) {
-                printk("failed, %s\n", reason);
+                pr_cont("failed, %s\n", reason);
                 shared_pte_mask = L_PTE_MT_UNCACHED;
         } else {
-                printk("ok\n");
+                pr_cont("ok\n");
         }
 }
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index eb8830a4c5ed..a982dc3190df 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -63,9 +63,9 @@ void show_pte(struct mm_struct *mm, unsigned long addr)
         if (!mm)
                 mm = &init_mm;
 
-        printk(KERN_ALERT "pgd = %p\n", mm->pgd);
+        pr_alert("pgd = %p\n", mm->pgd);
         pgd = pgd_offset(mm, addr);
-        printk(KERN_ALERT "[%08lx] *pgd=%08llx",
+        pr_alert("[%08lx] *pgd=%08llx",
                         addr, (long long)pgd_val(*pgd));
 
         do {
@@ -77,31 +77,31 @@ void show_pte(struct mm_struct *mm, unsigned long addr)
                         break;
 
                 if (pgd_bad(*pgd)) {
-                        printk("(bad)");
+                        pr_cont("(bad)");
                         break;
                 }
 
                 pud = pud_offset(pgd, addr);
                 if (PTRS_PER_PUD != 1)
-                        printk(", *pud=%08llx", (long long)pud_val(*pud));
+                        pr_cont(", *pud=%08llx", (long long)pud_val(*pud));
 
                 if (pud_none(*pud))
                         break;
 
                 if (pud_bad(*pud)) {
-                        printk("(bad)");
+                        pr_cont("(bad)");
                         break;
                 }
 
                 pmd = pmd_offset(pud, addr);
                 if (PTRS_PER_PMD != 1)
-                        printk(", *pmd=%08llx", (long long)pmd_val(*pmd));
+                        pr_cont(", *pmd=%08llx", (long long)pmd_val(*pmd));
 
                 if (pmd_none(*pmd))
                         break;
 
                 if (pmd_bad(*pmd)) {
-                        printk("(bad)");
+                        pr_cont("(bad)");
                         break;
                 }
 
@@ -110,15 +110,15 @@ void show_pte(struct mm_struct *mm, unsigned long addr)
                         break;
 
                 pte = pte_offset_map(pmd, addr);
-                printk(", *pte=%08llx", (long long)pte_val(*pte));
+                pr_cont(", *pte=%08llx", (long long)pte_val(*pte));
 #ifndef CONFIG_ARM_LPAE
-                printk(", *ppte=%08llx",
+                pr_cont(", *ppte=%08llx",
                        (long long)pte_val(pte[PTE_HWTABLE_PTRS]));
 #endif
                 pte_unmap(pte);
         } while(0);
 
-        printk("\n");
+        pr_cont("\n");
 }
 #else                                   /* CONFIG_MMU */
 void show_pte(struct mm_struct *mm, unsigned long addr)
@@ -142,10 +142,9 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
          * No handler, we'll have to terminate things with extreme prejudice.
          */
         bust_spinlocks(1);
-        printk(KERN_ALERT
-                "Unable to handle kernel %s at virtual address %08lx\n",
-                (addr < PAGE_SIZE) ? "NULL pointer dereference" :
-                "paging request", addr);
+        pr_alert("Unable to handle kernel %s at virtual address %08lx\n",
+                 (addr < PAGE_SIZE) ? "NULL pointer dereference" :
+                 "paging request", addr);
 
         show_pte(mm, addr);
         die("Oops", regs, fsr);
@@ -551,7 +550,7 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
                 return;
 
-        printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
+        pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
                 inf->name, fsr, addr);
 
         info.si_signo = inf->sig;
@@ -583,7 +582,7 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
         if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
                 return;
 
-        printk(KERN_ALERT "Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
+        pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
                 inf->name, ifsr, addr);
 
         info.si_signo = inf->sig;
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 265b836b3bd1..34b66af516ea 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -33,7 +33,7 @@ static void flush_pfn_alias(unsigned long pfn, unsigned long vaddr)
         asm(    "mcrr   p15, 0, %1, %0, c14\n"
         "       mcr     p15, 0, %2, c7, c10, 4"
             :
-            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES), "r" (zero)
+            : "r" (to), "r" (to + PAGE_SIZE - 1), "r" (zero)
             : "cc");
 }
 
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index e17ed00828d7..b98895d9fe57 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -18,19 +18,20 @@
 #include <asm/tlbflush.h>
 #include "mm.h"
 
-pte_t *fixmap_page_table;
-
 static inline void set_fixmap_pte(int idx, pte_t pte)
 {
         unsigned long vaddr = __fix_to_virt(idx);
-        set_pte_ext(fixmap_page_table + idx, pte, 0);
+        pte_t *ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
+
+        set_pte_ext(ptep, pte, 0);
         local_flush_tlb_kernel_page(vaddr);
 }
 
 static inline pte_t get_fixmap_pte(unsigned long vaddr)
 {
-        unsigned long idx = __virt_to_fix(vaddr);
-        return *(fixmap_page_table + idx);
+        pte_t *ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
+
+        return *ptep;
 }
 
 void *kmap(struct page *page)
@@ -84,7 +85,7 @@ void *kmap_atomic(struct page *page)
          * With debugging enabled, kunmap_atomic forces that entry to 0.
          * Make sure it was indeed properly unmapped.
          */
-        BUG_ON(!pte_none(*(fixmap_page_table + idx)));
+        BUG_ON(!pte_none(get_fixmap_pte(vaddr)));
 #endif
         /*
          * When debugging is off, kunmap_atomic leaves the previous mapping
@@ -137,7 +138,7 @@ void *kmap_atomic_pfn(unsigned long pfn)
         idx = type + KM_TYPE_NR * smp_processor_id();
         vaddr = __fix_to_virt(idx);
 #ifdef CONFIG_DEBUG_HIGHMEM
-        BUG_ON(!pte_none(*(fixmap_page_table + idx)));
+        BUG_ON(!pte_none(get_fixmap_pte(vaddr)));
 #endif
         set_fixmap_pte(idx, pfn_pte(pfn, kmap_prot));
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 9481f85c56e6..98ad9c79ea0e 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -29,6 +29,7 @@
 #include <asm/prom.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
+#include <asm/system_info.h>
 #include <asm/tlb.h>
 #include <asm/fixmap.h>
 
@@ -67,7 +68,7 @@ early_param("initrd", early_initrd);
 
 static int __init parse_tag_initrd(const struct tag *tag)
 {
-        printk(KERN_WARNING "ATAG_INITRD is deprecated; "
+        pr_warn("ATAG_INITRD is deprecated; "
                 "please update your bootloader.\n");
         phys_initrd_start = __virt_to_phys(tag->u.initrd.start);
         phys_initrd_size = tag->u.initrd.size;
@@ -544,7 +545,7 @@ void __init mem_init(void)
 #define MLM(b, t) b, t, ((t) - (b)) >> 20
 #define MLK_ROUNDUP(b, t) b, t, DIV_ROUND_UP(((t) - (b)), SZ_1K)
 
-        printk(KERN_NOTICE "Virtual kernel memory layout:\n"
+        pr_notice("Virtual kernel memory layout:\n"
                         "    vector  : 0x%08lx - 0x%08lx   (%4ld kB)\n"
 #ifdef CONFIG_HAVE_TCM
                         "    DTCM    : 0x%08lx - 0x%08lx   (%4ld kB)\n"
@@ -570,7 +571,7 @@ void __init mem_init(void)
                         MLK(DTCM_OFFSET, (unsigned long) dtcm_end),
                         MLK(ITCM_OFFSET, (unsigned long) itcm_end),
 #endif
-                        MLK(FIXADDR_START, FIXADDR_TOP),
+                        MLK(FIXADDR_START, FIXADDR_END),
                         MLM(VMALLOC_START, VMALLOC_END),
                         MLM(PAGE_OFFSET, (unsigned long)high_memory),
 #ifdef CONFIG_HIGHMEM
@@ -615,7 +616,145 @@ void __init mem_init(void)
         }
 }
 
-void free_initmem(void)
+#ifdef CONFIG_ARM_KERNMEM_PERMS
+struct section_perm {
+        unsigned long start;
+        unsigned long end;
+        pmdval_t mask;
+        pmdval_t prot;
+        pmdval_t clear;
+};
+
+static struct section_perm nx_perms[] = {
+        /* Make pages tables, etc before _stext RW (set NX). */
+        {
+                .start  = PAGE_OFFSET,
+                .end    = (unsigned long)_stext,
+                .mask   = ~PMD_SECT_XN,
+                .prot   = PMD_SECT_XN,
+        },
+        /* Make init RW (set NX). */
+        {
+                .start  = (unsigned long)__init_begin,
+                .end    = (unsigned long)_sdata,
+                .mask   = ~PMD_SECT_XN,
+                .prot   = PMD_SECT_XN,
+        },
+#ifdef CONFIG_DEBUG_RODATA
+        /* Make rodata NX (set RO in ro_perms below). */
+        {
+                .start  = (unsigned long)__start_rodata,
+                .end    = (unsigned long)__init_begin,
+                .mask   = ~PMD_SECT_XN,
+                .prot   = PMD_SECT_XN,
+        },
+#endif
+};
+
+#ifdef CONFIG_DEBUG_RODATA
+static struct section_perm ro_perms[] = {
+        /* Make kernel code and rodata RX (set RO). */
+        {
+                .start  = (unsigned long)_stext,
+                .end    = (unsigned long)__init_begin,
+#ifdef CONFIG_ARM_LPAE
+                .mask   = ~PMD_SECT_RDONLY,
+                .prot   = PMD_SECT_RDONLY,
+#else
+                .mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
+                .prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
+                .clear  = PMD_SECT_AP_WRITE,
+#endif
+        },
+};
+#endif
+
+/*
+ * Updates section permissions only for the current mm (sections are
+ * copied into each mm). During startup, this is the init_mm. Is only
+ * safe to be called with preemption disabled, as under stop_machine().
+ */
+static inline void section_update(unsigned long addr, pmdval_t mask,
+                                  pmdval_t prot)
+{
+        struct mm_struct *mm;
+        pmd_t *pmd;
+
+        mm = current->active_mm;
+        pmd = pmd_offset(pud_offset(pgd_offset(mm, addr), addr), addr);
+
+#ifdef CONFIG_ARM_LPAE
+        pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot);
+#else
+        if (addr & SECTION_SIZE)
+                pmd[1] = __pmd((pmd_val(pmd[1]) & mask) | prot);
+        else
+                pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot);
+#endif
+        flush_pmd_entry(pmd);
+        local_flush_tlb_kernel_range(addr, addr + SECTION_SIZE);
+}
+
+/* Make sure extended page tables are in use. */
+static inline bool arch_has_strict_perms(void)
+{
+        if (cpu_architecture() < CPU_ARCH_ARMv6)
+                return false;
+
+        return !!(get_cr() & CR_XP);
+}
+
+#define set_section_perms(perms, field) {                               \
+        size_t i;                                                       \
+        unsigned long addr;                                             \
+                                                                        \
+        if (!arch_has_strict_perms())                                   \
+                return;                                                 \
+                                                                        \
+        for (i = 0; i < ARRAY_SIZE(perms); i++) {                       \
+                if (!IS_ALIGNED(perms[i].start, SECTION_SIZE) ||        \
+                    !IS_ALIGNED(perms[i].end, SECTION_SIZE)) {          \
+                        pr_err("BUG: section %lx-%lx not aligned to %lx\n", \
+                                perms[i].start, perms[i].end,           \
+                                SECTION_SIZE);                          \
+                        continue;                                       \
+                }                                                       \
+                                                                        \
+                for (addr = perms[i].start;                             \
+                     addr < perms[i].end;                               \
+                     addr += SECTION_SIZE)                              \
+                        section_update(addr, perms[i].mask,             \
+                                       perms[i].field);                 \
+        }                                                               \
+}
+
+static inline void fix_kernmem_perms(void)
+{
+        set_section_perms(nx_perms, prot);
+}
+
+#ifdef CONFIG_DEBUG_RODATA
+void mark_rodata_ro(void)
+{
+        set_section_perms(ro_perms, prot);
+}
+
+void set_kernel_text_rw(void)
+{
+        set_section_perms(ro_perms, clear);
+}
+
+void set_kernel_text_ro(void)
+{
+        set_section_perms(ro_perms, prot);
+}
+#endif /* CONFIG_DEBUG_RODATA */
+
+#else
+static inline void fix_kernmem_perms(void) { }
+#endif /* CONFIG_ARM_KERNMEM_PERMS */
+
+void free_tcmmem(void)
 {
 #ifdef CONFIG_HAVE_TCM
         extern char __tcm_start, __tcm_end;
@@ -623,6 +762,12 @@ void free_initmem(void)
         poison_init_mem(&__tcm_start, &__tcm_end - &__tcm_start);
         free_reserved_area(&__tcm_start, &__tcm_end, -1, "TCM link");
 #endif
+}
+
+void free_initmem(void)
+{
+        fix_kernmem_perms();
+        free_tcmmem();
 
         poison_init_mem(__init_begin, __init_end - __init_begin);
         if (!machine_is_integrator() && !machine_is_cintegrator())
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 9f98cec7fe1e..cda7c40999b6 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -22,6 +22,7 @@
 #include <asm/cputype.h>
 #include <asm/sections.h>
 #include <asm/cachetype.h>
+#include <asm/fixmap.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
 #include <asm/smp_plat.h>
@@ -52,6 +53,8 @@ EXPORT_SYMBOL(empty_zero_page);
  */
 pmd_t *top_pmd;
 
+pmdval_t user_pmd_table = _PAGE_USER_TABLE;
+
 #define CPOLICY_UNCACHED        0
 #define CPOLICY_BUFFERED        1
 #define CPOLICY_WRITETHROUGH    2
@@ -192,7 +195,7 @@ early_param("cachepolicy", early_cachepolicy);
 static int __init early_nocache(char *__unused)
 {
         char *p = "buffered";
-        printk(KERN_WARNING "nocache is deprecated; use cachepolicy=%s\n", p);
+        pr_warn("nocache is deprecated; use cachepolicy=%s\n", p);
         early_cachepolicy(p);
         return 0;
 }
@@ -201,7 +204,7 @@ early_param("nocache", early_nocache);
 static int __init early_nowrite(char *__unused)
 {
         char *p = "uncached";
-        printk(KERN_WARNING "nowb is deprecated; use cachepolicy=%s\n", p);
+        pr_warn("nowb is deprecated; use cachepolicy=%s\n", p);
         early_cachepolicy(p);
         return 0;
 }
@@ -354,43 +357,28 @@ const struct mem_type *get_mem_type(unsigned int type)
 }
 EXPORT_SYMBOL(get_mem_type);
 
-#define PTE_SET_FN(_name, pteop) \
-static int pte_set_##_name(pte_t *ptep, pgtable_t token, unsigned long addr, \
-                        void *data) \
-{ \
-        pte_t pte = pteop(*ptep); \
-\
-        set_pte_ext(ptep, pte, 0); \
-        return 0; \
-} \
-
-#define SET_MEMORY_FN(_name, callback) \
-int set_memory_##_name(unsigned long addr, int numpages) \
-{ \
-        unsigned long start = addr; \
-        unsigned long size = PAGE_SIZE*numpages; \
-        unsigned end = start + size; \
-\
-        if (start < MODULES_VADDR || start >= MODULES_END) \
-                return -EINVAL;\
-\
-        if (end < MODULES_VADDR || end >= MODULES_END) \
-                return -EINVAL; \
-\
-        apply_to_page_range(&init_mm, start, size, callback, NULL); \
-        flush_tlb_kernel_range(start, end); \
-        return 0;\
-}
+/*
+ * To avoid TLB flush broadcasts, this uses local_flush_tlb_kernel_range().
+ * As a result, this can only be called with preemption disabled, as under
+ * stop_machine().
+ */
+void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
+{
+        unsigned long vaddr = __fix_to_virt(idx);
+        pte_t *pte = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
 
-PTE_SET_FN(ro, pte_wrprotect)
-PTE_SET_FN(rw, pte_mkwrite)
-PTE_SET_FN(x, pte_mkexec)
-PTE_SET_FN(nx, pte_mknexec)
+        /* Make sure fixmap region does not exceed available allocation. */
+        BUILD_BUG_ON(FIXADDR_START + (__end_of_fixed_addresses * PAGE_SIZE) >
+                     FIXADDR_END);
+        BUG_ON(idx >= __end_of_fixed_addresses);
 
-SET_MEMORY_FN(ro, pte_set_ro)
-SET_MEMORY_FN(rw, pte_set_rw)
-SET_MEMORY_FN(x, pte_set_x)
-SET_MEMORY_FN(nx, pte_set_nx)
+        if (pgprot_val(prot))
+                set_pte_at(NULL, vaddr, pte,
+                        pfn_pte(phys >> PAGE_SHIFT, prot));
+        else
+                pte_clear(NULL, vaddr, pte);
+        local_flush_tlb_kernel_range(vaddr, vaddr + PAGE_SIZE);
+}
 
 /*
  * Adjust the PMD section entries according to the CPU in use.
@@ -528,14 +516,23 @@ static void __init build_mem_type_table(void)
         hyp_device_pgprot = mem_types[MT_DEVICE].prot_pte;
         s2_device_pgprot = mem_types[MT_DEVICE].prot_pte_s2;
 
+#ifndef CONFIG_ARM_LPAE
         /*
          * We don't use domains on ARMv6 (since this causes problems with
          * v6/v7 kernels), so we must use a separate memory type for user
          * r/o, kernel r/w to map the vectors page.
          */
-#ifndef CONFIG_ARM_LPAE
         if (cpu_arch == CPU_ARCH_ARMv6)
                 vecs_pgprot |= L_PTE_MT_VECTORS;
+
+        /*
+         * Check is it with support for the PXN bit
+         * in the Short-descriptor translation table format descriptors.
+         */
+        if (cpu_arch == CPU_ARCH_ARMv7 &&
+                (read_cpuid_ext(CPUID_EXT_MMFR0) & 0xF) == 4) {
+                user_pmd_table |= PMD_PXNTABLE;
+        }
 #endif
 
         /*
@@ -605,6 +602,11 @@ static void __init build_mem_type_table(void)
         }
         kern_pgprot |= PTE_EXT_AF;
         vecs_pgprot |= PTE_EXT_AF;
+
+        /*
+         * Set PXN for user mappings
+         */
+        user_pgprot |= PTE_EXT_PXN;
 #endif
 
         for (i = 0; i < 16; i++) {
@@ -786,8 +788,7 @@ static void __init create_36bit_mapping(struct map_desc *md,
         length = PAGE_ALIGN(md->length);
 
         if (!(cpu_architecture() >= CPU_ARCH_ARMv6 || cpu_is_xsc3())) {
-                printk(KERN_ERR "MM: CPU does not support supersection "
-                       "mapping for 0x%08llx at 0x%08lx\n",
+                pr_err("MM: CPU does not support supersection mapping for 0x%08llx at 0x%08lx\n",
                        (long long)__pfn_to_phys((u64)md->pfn), addr);
                 return;
         }
@@ -799,15 +800,13 @@ static void __init create_36bit_mapping(struct map_desc *md,
          *      of the actual domain assignments in use.
          */
         if (type->domain) {
-                printk(KERN_ERR "MM: invalid domain in supersection "
-                       "mapping for 0x%08llx at 0x%08lx\n",
+                pr_err("MM: invalid domain in supersection mapping for 0x%08llx at 0x%08lx\n",
                        (long long)__pfn_to_phys((u64)md->pfn), addr);
                 return;
         }
 
         if ((addr | length | __pfn_to_phys(md->pfn)) & ~SUPERSECTION_MASK) {
-                printk(KERN_ERR "MM: cannot create mapping for 0x%08llx"
-                       " at 0x%08lx invalid alignment\n",
+                pr_err("MM: cannot create mapping for 0x%08llx at 0x%08lx invalid alignment\n",
                        (long long)__pfn_to_phys((u64)md->pfn), addr);
                 return;
         }
@@ -850,18 +849,16 @@ static void __init create_mapping(struct map_desc *md)
         pgd_t *pgd;
 
         if (md->virtual != vectors_base() && md->virtual < TASK_SIZE) {
-                printk(KERN_WARNING "BUG: not creating mapping for 0x%08llx"
-                       " at 0x%08lx in user region\n",
-                       (long long)__pfn_to_phys((u64)md->pfn), md->virtual);
+                pr_warn("BUG: not creating mapping for 0x%08llx at 0x%08lx in user region\n",
+                        (long long)__pfn_to_phys((u64)md->pfn), md->virtual);
                 return;
         }
 
         if ((md->type == MT_DEVICE || md->type == MT_ROM) &&
             md->virtual >= PAGE_OFFSET &&
             (md->virtual < VMALLOC_START || md->virtual >= VMALLOC_END)) {
-                printk(KERN_WARNING "BUG: mapping for 0x%08llx"
-                       " at 0x%08lx out of vmalloc space\n",
-                       (long long)__pfn_to_phys((u64)md->pfn), md->virtual);
+                pr_warn("BUG: mapping for 0x%08llx at 0x%08lx out of vmalloc space\n",
+                        (long long)__pfn_to_phys((u64)md->pfn), md->virtual);
         }
 
         type = &mem_types[md->type];
@@ -881,9 +878,8 @@ static void __init create_mapping(struct map_desc *md)
         length = PAGE_ALIGN(md->length + (md->virtual & ~PAGE_MASK));
 
         if (type->prot_l1 == 0 && ((addr | phys | length) & ~SECTION_MASK)) {
-                printk(KERN_WARNING "BUG: map for 0x%08llx at 0x%08lx can not "
-                       "be mapped using pages, ignoring.\n",
-                       (long long)__pfn_to_phys(md->pfn), addr);
+                pr_warn("BUG: map for 0x%08llx at 0x%08lx can not be mapped using pages, ignoring.\n",
+                        (long long)__pfn_to_phys(md->pfn), addr);
                 return;
         }
 
@@ -1053,15 +1049,13 @@ static int __init early_vmalloc(char *arg)
 
         if (vmalloc_reserve < SZ_16M) {
                 vmalloc_reserve = SZ_16M;
-                printk(KERN_WARNING
-                        "vmalloc area too small, limiting to %luMB\n",
+                pr_warn("vmalloc area too small, limiting to %luMB\n",
                         vmalloc_reserve >> 20);
         }
 
         if (vmalloc_reserve > VMALLOC_END - (PAGE_OFFSET + SZ_32M)) {
                 vmalloc_reserve = VMALLOC_END - (PAGE_OFFSET + SZ_32M);
-                printk(KERN_WARNING
-                        "vmalloc area is too big, limiting to %luMB\n",
+                pr_warn("vmalloc area is too big, limiting to %luMB\n",
                         vmalloc_reserve >> 20);
         }
 
@@ -1094,7 +1088,7 @@ void __init sanity_check_meminfo(void)
 
                         if (highmem) {
                                 pr_notice("Ignoring RAM at %pa-%pa (!CONFIG_HIGHMEM)\n",
-                                        &block_start, &block_end);
+                                          &block_start, &block_end);
                                 memblock_remove(reg->base, reg->size);
                                 continue;
                         }
@@ -1103,7 +1097,7 @@ void __init sanity_check_meminfo(void)
                                 phys_addr_t overlap_size = reg->size - size_limit;
 
                                 pr_notice("Truncating RAM at %pa-%pa to -%pa",
-                                      &block_start, &block_end, &vmalloc_limit);
+                                          &block_start, &block_end, &vmalloc_limit);
                                 memblock_remove(vmalloc_limit, overlap_size);
                                 block_end = vmalloc_limit;
                         }
@@ -1326,10 +1320,10 @@ static void __init kmap_init(void)
 #ifdef CONFIG_HIGHMEM
         pkmap_page_table = early_pte_alloc(pmd_off_k(PKMAP_BASE),
                 PKMAP_BASE, _PAGE_KERNEL_TABLE);
-
-        fixmap_page_table = early_pte_alloc(pmd_off_k(FIXADDR_START),
-                FIXADDR_START, _PAGE_KERNEL_TABLE);
 #endif
+
+        early_pte_alloc(pmd_off_k(FIXADDR_START), FIXADDR_START,
+                        _PAGE_KERNEL_TABLE);
 }
 
 static void __init map_lowmem(void)
@@ -1349,13 +1343,20 @@ static void __init map_lowmem(void)
                 if (start >= end)
                         break;
 
-                if (end < kernel_x_start || start >= kernel_x_end) {
+                if (end < kernel_x_start) {
                         map.pfn = __phys_to_pfn(start);
                         map.virtual = __phys_to_virt(start);
                         map.length = end - start;
                         map.type = MT_MEMORY_RWX;
 
                         create_mapping(&map);
+                } else if (start >= kernel_x_end) {
+                        map.pfn = __phys_to_pfn(start);
+                        map.virtual = __phys_to_virt(start);
+                        map.length = end - start;
+                        map.type = MT_MEMORY_RW;
+
+                        create_mapping(&map);
                 } else {
                         /* This better cover the entire kernel */
                         if (start < kernel_x_start) {
diff --git a/arch/arm/mm/pageattr.c b/arch/arm/mm/pageattr.c
new file mode 100644
index 000000000000..004e35cdcfff
--- /dev/null
+++ b/arch/arm/mm/pageattr.c
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/mm.h>
+#include <linux/module.h>
+
+#include <asm/pgtable.h>
+#include <asm/tlbflush.h>
+
+struct page_change_data {
+        pgprot_t set_mask;
+        pgprot_t clear_mask;
+};
+
+static int change_page_range(pte_t *ptep, pgtable_t token, unsigned long addr,
+                        void *data)
+{
+        struct page_change_data *cdata = data;
+        pte_t pte = *ptep;
+
+        pte = clear_pte_bit(pte, cdata->clear_mask);
+        pte = set_pte_bit(pte, cdata->set_mask);
+
+        set_pte_ext(ptep, pte, 0);
+        return 0;
+}
+
+static int change_memory_common(unsigned long addr, int numpages,
+                                pgprot_t set_mask, pgprot_t clear_mask)
+{
+        unsigned long start = addr;
+        unsigned long size = PAGE_SIZE*numpages;
+        unsigned long end = start + size;
+        int ret;
+        struct page_change_data data;
+
+        if (!IS_ALIGNED(addr, PAGE_SIZE)) {
+                start &= PAGE_MASK;
+                end = start + size;
+                WARN_ON_ONCE(1);
+        }
+
+        if (!is_module_address(start) || !is_module_address(end - 1))
+                return -EINVAL;
+
+        data.set_mask = set_mask;
+        data.clear_mask = clear_mask;
+
+        ret = apply_to_page_range(&init_mm, start, size, change_page_range,
+                                        &data);
+
+        flush_tlb_kernel_range(start, end);
+        return ret;
+}
+
+int set_memory_ro(unsigned long addr, int numpages)
+{
+        return change_memory_common(addr, numpages,
+                                        __pgprot(L_PTE_RDONLY),
+                                        __pgprot(0));
+}
+
+int set_memory_rw(unsigned long addr, int numpages)
+{
+        return change_memory_common(addr, numpages,
+                                        __pgprot(0),
+                                        __pgprot(L_PTE_RDONLY));
+}
+
+int set_memory_nx(unsigned long addr, int numpages)
+{
+        return change_memory_common(addr, numpages,
+                                        __pgprot(L_PTE_XN),
+                                        __pgprot(0));
+}
+
+int set_memory_x(unsigned long addr, int numpages)
+{
+        return change_memory_common(addr, numpages,
+                                        __pgprot(0),
+                                        __pgprot(L_PTE_XN));
+}
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 22ac2a6fbfe3..8b4ee5e81c14 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -591,9 +591,10 @@ __krait_proc_info:
         /*
          * Some Krait processors don't indicate support for SDIV and UDIV
          * instructions in the ARM instruction set, even though they actually
-         * do support them.
+         * do support them. They also don't indicate support for fused multiply
+         * instructions even though they actually do support them.
          */
-        __v7_proc __v7_setup, hwcaps = HWCAP_IDIV
+        __v7_proc __v7_setup, hwcaps = HWCAP_IDIV | HWCAP_VFPv4
         .size   __krait_proc_info, . - __krait_proc_info
 
         /*
diff --git a/arch/arm/nwfpe/fpmodule.c b/arch/arm/nwfpe/fpmodule.c
index 4e729f055a81..ec717c190e2c 100644
--- a/arch/arm/nwfpe/fpmodule.c
+++ b/arch/arm/nwfpe/fpmodule.c
@@ -86,20 +86,20 @@ extern void nwfpe_enter(void);
 static int __init fpe_init(void)
 {
         if (sizeof(FPA11) > sizeof(union fp_state)) {
-                printk(KERN_ERR "nwfpe: bad structure size\n");
+                pr_err("nwfpe: bad structure size\n");
                 return -EINVAL;
         }
 
         if (sizeof(FPREG) != 12) {
-                printk(KERN_ERR "nwfpe: bad register size\n");
+                pr_err("nwfpe: bad register size\n");
                 return -EINVAL;
         }
         if (fpe_type[0] && strcmp(fpe_type, "nwfpe"))
                 return 0;
 
         /* Display title, version and copyright information. */
-        printk(KERN_WARNING "NetWinder Floating Point Emulator V0.97 ("
-               NWFPE_BITS " precision)\n");
+        pr_info("NetWinder Floating Point Emulator V0.97 ("
+                NWFPE_BITS " precision)\n");
 
         thread_register_notifier(&nwfpe_notifier_block);
 
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index cda654cbf2c2..f74a8f7e5f84 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -197,6 +197,12 @@ look_for_VFP_exceptions:
         tst     r5, #FPSCR_IXE
         bne     process_exception
 
+        tst     r5, #FPSCR_LENGTH_MASK
+        beq     skip
+        orr     r1, r1, #FPEXC_DEX
+        b       process_exception
+skip:
+
         @ Fall into hand on to next handler - appropriate coproc instr
         @ not recognised by VFP
 
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 2f37e1d6cb45..f6e4d56eda00 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -738,63 +738,73 @@ static int __init vfp_init(void)
         vfp_vector = vfp_null_entry;
 
         pr_info("VFP support v0.3: ");
-        if (VFP_arch)
+        if (VFP_arch) {
                 pr_cont("not present\n");
-        else if (vfpsid & FPSID_NODOUBLE) {
-                pr_cont("no double precision support\n");
-        } else {
-                hotcpu_notifier(vfp_hotplug, 0);
-
-                VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;  /* Extract the architecture version */
-                pr_cont("implementor %02x architecture %d part %02x variant %x rev %x\n",
-                        (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
-                        (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT,
-                        (vfpsid & FPSID_PART_MASK) >> FPSID_PART_BIT,
-                        (vfpsid & FPSID_VARIANT_MASK) >> FPSID_VARIANT_BIT,
-                        (vfpsid & FPSID_REV_MASK) >> FPSID_REV_BIT);
-
-                vfp_vector = vfp_support_entry;
-
-                thread_register_notifier(&vfp_notifier_block);
-                vfp_pm_init();
-
-                /*
-                 * We detected VFP, and the support code is
-                 * in place; report VFP support to userspace.
-                 */
-                elf_hwcap |= HWCAP_VFP;
-#ifdef CONFIG_VFPv3
-                if (VFP_arch >= 2) {
-                        elf_hwcap |= HWCAP_VFPv3;
-
-                        /*
-                         * Check for VFPv3 D16 and VFPv4 D16.  CPUs in
-                         * this configuration only have 16 x 64bit
-                         * registers.
-                         */
-                        if (((fmrx(MVFR0) & MVFR0_A_SIMD_MASK)) == 1)
-                                elf_hwcap |= HWCAP_VFPv3D16; /* also v4-D16 */
-                        else
-                                elf_hwcap |= HWCAP_VFPD32;
-                }
-#endif
+                return 0;
+        /* Extract the architecture on CPUID scheme */
+        } else if ((read_cpuid_id() & 0x000f0000) == 0x000f0000) {
+                VFP_arch = vfpsid & FPSID_CPUID_ARCH_MASK;
+                VFP_arch >>= FPSID_ARCH_BIT;
                 /*
                  * Check for the presence of the Advanced SIMD
                  * load/store instructions, integer and single
                  * precision floating point operations. Only check
                  * for NEON if the hardware has the MVFR registers.
                  */
-                if ((read_cpuid_id() & 0x000f0000) == 0x000f0000) {
-#ifdef CONFIG_NEON
-                        if ((fmrx(MVFR1) & 0x000fff00) == 0x00011100)
-                                elf_hwcap |= HWCAP_NEON;
-#endif
-#ifdef CONFIG_VFPv3
+                if (IS_ENABLED(CONFIG_NEON) &&
+                   (fmrx(MVFR1) & 0x000fff00) == 0x00011100)
+                        elf_hwcap |= HWCAP_NEON;
+
+                if (IS_ENABLED(CONFIG_VFPv3)) {
+                        u32 mvfr0 = fmrx(MVFR0);
+                        if (((mvfr0 & MVFR0_DP_MASK) >> MVFR0_DP_BIT) == 0x2 ||
+                            ((mvfr0 & MVFR0_SP_MASK) >> MVFR0_SP_BIT) == 0x2) {
+                                elf_hwcap |= HWCAP_VFPv3;
+                                /*
+                                 * Check for VFPv3 D16 and VFPv4 D16.  CPUs in
+                                 * this configuration only have 16 x 64bit
+                                 * registers.
+                                 */
+                                if ((mvfr0 & MVFR0_A_SIMD_MASK) == 1)
+                                        /* also v4-D16 */
+                                        elf_hwcap |= HWCAP_VFPv3D16;
+                                else
+                                        elf_hwcap |= HWCAP_VFPD32;
+                        }
+
                         if ((fmrx(MVFR1) & 0xf0000000) == 0x10000000)
                                 elf_hwcap |= HWCAP_VFPv4;
-#endif
                 }
+        /* Extract the architecture version on pre-cpuid scheme */
+        } else {
+                if (vfpsid & FPSID_NODOUBLE) {
+                        pr_cont("no double precision support\n");
+                        return 0;
+                }
+
+                VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;
         }
+
+        hotcpu_notifier(vfp_hotplug, 0);
+
+        vfp_vector = vfp_support_entry;
+
+        thread_register_notifier(&vfp_notifier_block);
+        vfp_pm_init();
+
+        /*
+         * We detected VFP, and the support code is
+         * in place; report VFP support to userspace.
+         */
+        elf_hwcap |= HWCAP_VFP;
+
+        pr_cont("implementor %02x architecture %d part %02x variant %x rev %x\n",
+                (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
+                VFP_arch,
+                (vfpsid & FPSID_PART_MASK) >> FPSID_PART_BIT,
+                (vfpsid & FPSID_VARIANT_MASK) >> FPSID_VARIANT_BIT,
+                (vfpsid & FPSID_REV_MASK) >> FPSID_REV_BIT);
+
         return 0;
 }
 
diff --git a/arch/arm/vfp/vfpsingle.c b/arch/arm/vfp/vfpsingle.c
index 4f96c1617aae..f0465ba0f221 100644
--- a/arch/arm/vfp/vfpsingle.c
+++ b/arch/arm/vfp/vfpsingle.c
@@ -290,7 +290,7 @@ u32 vfp_estimate_sqrt_significand(u32 exponent, u32 significand)
         u32 z, a;
 
         if ((significand & 0xc0000000) != 0x40000000) {
-                printk(KERN_WARNING "VFP: estimate_sqrt: invalid significand\n");
+                pr_warn("VFP: estimate_sqrt: invalid significand\n");
         }
 
         a = significand << 1;
diff --git a/arch/arm/xen/Makefile b/arch/arm/xen/Makefile
index 1f85bfe6b470..12969523414c 100644
--- a/arch/arm/xen/Makefile
+++ b/arch/arm/xen/Makefile
@@ -1 +1 @@
-obj-y           := enlighten.o hypercall.o grant-table.o p2m.o mm.o mm32.o
+obj-y           := enlighten.o hypercall.o grant-table.o p2m.o mm.o
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 0e15f011f9c8..c7ca936ebd99 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -261,11 +261,6 @@ static int __init xen_guest_init(void)
 
         xen_setup_features();
 
-        if (!xen_feature(XENFEAT_grant_map_identity)) {
-                pr_warn("Please upgrade your Xen.\n"
-                                "If your platform has any non-coherent DMA devices, they won't work properly.\n");
-        }
-
         if (xen_feature(XENFEAT_dom0))
                 xen_start_info->flags |= SIF_INITDOMAIN|SIF_PRIVILEGED;
         else
diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c
index b0e77de99148..351b24a979d4 100644
--- a/arch/arm/xen/mm.c
+++ b/arch/arm/xen/mm.c
@@ -1,6 +1,10 @@
+#include <linux/cpu.h>
+#include <linux/dma-mapping.h>
 #include <linux/bootmem.h>
 #include <linux/gfp.h>
+#include <linux/highmem.h>
 #include <linux/export.h>
+#include <linux/of_address.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/dma-mapping.h>
@@ -8,6 +12,7 @@
 #include <linux/swiotlb.h>
 
 #include <xen/xen.h>
+#include <xen/interface/grant_table.h>
 #include <xen/interface/memory.h>
 #include <xen/swiotlb-xen.h>
 
@@ -16,6 +21,114 @@
 #include <asm/xen/hypercall.h>
 #include <asm/xen/interface.h>
 
+enum dma_cache_op {
+       DMA_UNMAP,
+       DMA_MAP,
+};
+static bool hypercall_cflush = false;
+
+/* functions called by SWIOTLB */
+
+static void dma_cache_maint(dma_addr_t handle, unsigned long offset,
+        size_t size, enum dma_data_direction dir, enum dma_cache_op op)
+{
+        struct gnttab_cache_flush cflush;
+        unsigned long pfn;
+        size_t left = size;
+
+        pfn = (handle >> PAGE_SHIFT) + offset / PAGE_SIZE;
+        offset %= PAGE_SIZE;
+
+        do {
+                size_t len = left;
+        
+                /* buffers in highmem or foreign pages cannot cross page
+                 * boundaries */
+                if (len + offset > PAGE_SIZE)
+                        len = PAGE_SIZE - offset;
+
+                cflush.op = 0;
+                cflush.a.dev_bus_addr = pfn << PAGE_SHIFT;
+                cflush.offset = offset;
+                cflush.length = len;
+
+                if (op == DMA_UNMAP && dir != DMA_TO_DEVICE)
+                        cflush.op = GNTTAB_CACHE_INVAL;
+                if (op == DMA_MAP) {
+                        if (dir == DMA_FROM_DEVICE)
+                                cflush.op = GNTTAB_CACHE_INVAL;
+                        else
+                                cflush.op = GNTTAB_CACHE_CLEAN;
+                }
+                if (cflush.op)
+                        HYPERVISOR_grant_table_op(GNTTABOP_cache_flush, &cflush, 1);
+
+                offset = 0;
+                pfn++;
+                left -= len;
+        } while (left);
+}
+
+static void __xen_dma_page_dev_to_cpu(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir)
+{
+        dma_cache_maint(handle & PAGE_MASK, handle & ~PAGE_MASK, size, dir, DMA_UNMAP);
+}
+
+static void __xen_dma_page_cpu_to_dev(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir)
+{
+        dma_cache_maint(handle & PAGE_MASK, handle & ~PAGE_MASK, size, dir, DMA_MAP);
+}
+
+void __xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, struct dma_attrs *attrs)
+{
+        if (is_device_dma_coherent(hwdev))
+                return;
+        if (dma_get_attr(DMA_ATTR_SKIP_CPU_SYNC, attrs))
+                return;
+
+        __xen_dma_page_cpu_to_dev(hwdev, dev_addr, size, dir);
+}
+
+void __xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir,
+                struct dma_attrs *attrs)
+
+{
+        if (is_device_dma_coherent(hwdev))
+                return;
+        if (dma_get_attr(DMA_ATTR_SKIP_CPU_SYNC, attrs))
+                return;
+
+        __xen_dma_page_dev_to_cpu(hwdev, handle, size, dir);
+}
+
+void __xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        if (is_device_dma_coherent(hwdev))
+                return;
+        __xen_dma_page_dev_to_cpu(hwdev, handle, size, dir);
+}
+
+void __xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        if (is_device_dma_coherent(hwdev))
+                return;
+        __xen_dma_page_cpu_to_dev(hwdev, handle, size, dir);
+}
+
+bool xen_arch_need_swiotlb(struct device *dev,
+                           unsigned long pfn,
+                           unsigned long mfn)
+{
+        return (!hypercall_cflush && (pfn != mfn) && !is_device_dma_coherent(dev));
+}
+
 int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
                                  unsigned int address_bits,
                                  dma_addr_t *dma_handle)
@@ -56,10 +169,18 @@ static struct dma_map_ops xen_swiotlb_dma_ops = {
 
 int __init xen_mm_init(void)
 {
+        struct gnttab_cache_flush cflush;
         if (!xen_initial_domain())
                 return 0;
         xen_swiotlb_init(1, false);
         xen_dma_ops = &xen_swiotlb_dma_ops;
+
+        cflush.op = 0;
+        cflush.a.dev_bus_addr = 0;
+        cflush.offset = 0;
+        cflush.length = 0;
+        if (HYPERVISOR_grant_table_op(GNTTABOP_cache_flush, &cflush, 1) != -ENOSYS)
+                hypercall_cflush = true;
         return 0;
 }
 arch_initcall(xen_mm_init);
diff --git a/arch/arm/xen/mm32.c b/arch/arm/xen/mm32.c
deleted file mode 100644
index 3b99860fd7ae..000000000000
--- a/arch/arm/xen/mm32.c
+++ /dev/null
@@ -1,202 +0,0 @@
-#include <linux/cpu.h>
-#include <linux/dma-mapping.h>
-#include <linux/gfp.h>
-#include <linux/highmem.h>
-
-#include <xen/features.h>
-
-static DEFINE_PER_CPU(unsigned long, xen_mm32_scratch_virt);
-static DEFINE_PER_CPU(pte_t *, xen_mm32_scratch_ptep);
-
-static int alloc_xen_mm32_scratch_page(int cpu)
-{
-        struct page *page;
-        unsigned long virt;
-        pmd_t *pmdp;
-        pte_t *ptep;
-
-        if (per_cpu(xen_mm32_scratch_ptep, cpu) != NULL)
-                return 0;
-
-        page = alloc_page(GFP_KERNEL);
-        if (page == NULL) {
-                pr_warn("Failed to allocate xen_mm32_scratch_page for cpu %d\n", cpu);
-                return -ENOMEM;
-        }
-
-        virt = (unsigned long)__va(page_to_phys(page));
-        pmdp = pmd_offset(pud_offset(pgd_offset_k(virt), virt), virt);
-        ptep = pte_offset_kernel(pmdp, virt);
-
-        per_cpu(xen_mm32_scratch_virt, cpu) = virt;
-        per_cpu(xen_mm32_scratch_ptep, cpu) = ptep;
-
-        return 0;
-}
-
-static int xen_mm32_cpu_notify(struct notifier_block *self,
-                                    unsigned long action, void *hcpu)
-{
-        int cpu = (long)hcpu;
-        switch (action) {
-        case CPU_UP_PREPARE:
-                if (alloc_xen_mm32_scratch_page(cpu))
-                        return NOTIFY_BAD;
-                break;
-        default:
-                break;
-        }
-        return NOTIFY_OK;
-}
-
-static struct notifier_block xen_mm32_cpu_notifier = {
-        .notifier_call  = xen_mm32_cpu_notify,
-};
-
-static void* xen_mm32_remap_page(dma_addr_t handle)
-{
-        unsigned long virt = get_cpu_var(xen_mm32_scratch_virt);
-        pte_t *ptep = __get_cpu_var(xen_mm32_scratch_ptep);
-
-        *ptep = pfn_pte(handle >> PAGE_SHIFT, PAGE_KERNEL);
-        local_flush_tlb_kernel_page(virt);
-
-        return (void*)virt;
-}
-
-static void xen_mm32_unmap(void *vaddr)
-{
-        put_cpu_var(xen_mm32_scratch_virt);
-}
-
-
-/* functions called by SWIOTLB */
-
-static void dma_cache_maint(dma_addr_t handle, unsigned long offset,
-        size_t size, enum dma_data_direction dir,
-        void (*op)(const void *, size_t, int))
-{
-        unsigned long pfn;
-        size_t left = size;
-
-        pfn = (handle >> PAGE_SHIFT) + offset / PAGE_SIZE;
-        offset %= PAGE_SIZE;
-
-        do {
-                size_t len = left;
-                void *vaddr;
-        
-                if (!pfn_valid(pfn))
-                {
-                        /* Cannot map the page, we don't know its physical address.
-                         * Return and hope for the best */
-                        if (!xen_feature(XENFEAT_grant_map_identity))
-                                return;
-                        vaddr = xen_mm32_remap_page(handle) + offset;
-                        op(vaddr, len, dir);
-                        xen_mm32_unmap(vaddr - offset);
-                } else {
-                        struct page *page = pfn_to_page(pfn);
-
-                        if (PageHighMem(page)) {
-                                if (len + offset > PAGE_SIZE)
-                                        len = PAGE_SIZE - offset;
-
-                                if (cache_is_vipt_nonaliasing()) {
-                                        vaddr = kmap_atomic(page);
-                                        op(vaddr + offset, len, dir);
-                                        kunmap_atomic(vaddr);
-                                } else {
-                                        vaddr = kmap_high_get(page);
-                                        if (vaddr) {
-                                                op(vaddr + offset, len, dir);
-                                                kunmap_high(page);
-                                        }
-                                }
-                        } else {
-                                vaddr = page_address(page) + offset;
-                                op(vaddr, len, dir);
-                        }
-                }
-
-                offset = 0;
-                pfn++;
-                left -= len;
-        } while (left);
-}
-
-static void __xen_dma_page_dev_to_cpu(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir)
-{
-        /* Cannot use __dma_page_dev_to_cpu because we don't have a
-         * struct page for handle */
-
-        if (dir != DMA_TO_DEVICE)
-                outer_inv_range(handle, handle + size);
-
-        dma_cache_maint(handle & PAGE_MASK, handle & ~PAGE_MASK, size, dir, dmac_unmap_area);
-}
-
-static void __xen_dma_page_cpu_to_dev(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir)
-{
-
-        dma_cache_maint(handle & PAGE_MASK, handle & ~PAGE_MASK, size, dir, dmac_map_area);
-
-        if (dir == DMA_FROM_DEVICE) {
-                outer_inv_range(handle, handle + size);
-        } else {
-                outer_clean_range(handle, handle + size);
-        }
-}
-
-void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir,
-                struct dma_attrs *attrs)
-
-{
-        if (!__generic_dma_ops(hwdev)->unmap_page)
-                return;
-        if (dma_get_attr(DMA_ATTR_SKIP_CPU_SYNC, attrs))
-                return;
-
-        __xen_dma_page_dev_to_cpu(hwdev, handle, size, dir);
-}
-
-void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        if (!__generic_dma_ops(hwdev)->sync_single_for_cpu)
-                return;
-        __xen_dma_page_dev_to_cpu(hwdev, handle, size, dir);
-}
-
-void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        if (!__generic_dma_ops(hwdev)->sync_single_for_device)
-                return;
-        __xen_dma_page_cpu_to_dev(hwdev, handle, size, dir);
-}
-
-int __init xen_mm32_init(void)
-{
-        int cpu;
-
-        if (!xen_initial_domain())
-                return 0;
-
-        register_cpu_notifier(&xen_mm32_cpu_notifier);
-        get_online_cpus();
-        for_each_online_cpu(cpu) {
-                if (alloc_xen_mm32_scratch_page(cpu)) {
-                        put_online_cpus();
-                        unregister_cpu_notifier(&xen_mm32_cpu_notifier);
-                        return -ENOMEM;
-                }
-        }
-        put_online_cpus();
-
-        return 0;
-}
-arch_initcall(xen_mm32_init);
diff --git a/arch/arm64/include/asm/device.h b/arch/arm64/include/asm/device.h
index cf98b362094b..243ef256b8c9 100644
--- a/arch/arm64/include/asm/device.h
+++ b/arch/arm64/include/asm/device.h
@@ -21,6 +21,7 @@ struct dev_archdata {
 #ifdef CONFIG_IOMMU_API
         void *iommu;                    /* private IOMMU data */
 #endif
+        bool dma_coherent;
 };
 
 struct pdev_archdata {
diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
index adeae3f6f0fc..d34189bceff7 100644
--- a/arch/arm64/include/asm/dma-mapping.h
+++ b/arch/arm64/include/asm/dma-mapping.h
@@ -54,11 +54,18 @@ static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
 
 static inline int set_arch_dma_coherent_ops(struct device *dev)
 {
+        dev->archdata.dma_coherent = true;
         set_dma_ops(dev, &coherent_swiotlb_dma_ops);
         return 0;
 }
 #define set_arch_dma_coherent_ops       set_arch_dma_coherent_ops
 
+/* do not use this function in a driver */
+static inline bool is_device_dma_coherent(struct device *dev)
+{
+        return dev->archdata.dma_coherent;
+}
+
 #include <asm-generic/dma-mapping-common.h>
 
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
diff --git a/arch/arm64/include/asm/xen/page-coherent.h b/arch/arm64/include/asm/xen/page-coherent.h
index dde3fc9c49f0..2052102b4e02 100644
--- a/arch/arm64/include/asm/xen/page-coherent.h
+++ b/arch/arm64/include/asm/xen/page-coherent.h
@@ -1,43 +1 @@
-#ifndef _ASM_ARM64_XEN_PAGE_COHERENT_H
-#define _ASM_ARM64_XEN_PAGE_COHERENT_H
-
-#include <asm/page.h>
-#include <linux/dma-attrs.h>
-#include <linux/dma-mapping.h>
-
-static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
-                dma_addr_t *dma_handle, gfp_t flags,
-                struct dma_attrs *attrs)
-{
-        return __generic_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
-}
-
-static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
-                void *cpu_addr, dma_addr_t dma_handle,
-                struct dma_attrs *attrs)
-{
-        __generic_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
-}
-
-static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             unsigned long offset, size_t size, enum dma_data_direction dir,
-             struct dma_attrs *attrs)
-{
-}
-
-static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir,
-                struct dma_attrs *attrs)
-{
-}
-
-static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-}
-
-static inline void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-}
-#endif /* _ASM_ARM64_XEN_PAGE_COHERENT_H */
+#include <../../arm/include/asm/xen/page-coherent.h>
diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 663da771580a..3425f311c49e 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -511,7 +511,7 @@ static int cpu_psci_cpu_kill(unsigned int cpu)
 
 static int psci_suspend_finisher(unsigned long index)
 {
-        struct psci_power_state *state = __get_cpu_var(psci_power_state);
+        struct psci_power_state *state = __this_cpu_read(psci_power_state);
 
         return psci_ops.cpu_suspend(state[index - 1],
                                     virt_to_phys(cpu_resume));
@@ -520,7 +520,7 @@ static int psci_suspend_finisher(unsigned long index)
 static int __maybe_unused cpu_psci_cpu_suspend(unsigned long index)
 {
         int ret;
-        struct psci_power_state *state = __get_cpu_var(psci_power_state);
+        struct psci_power_state *state = __this_cpu_read(psci_power_state);
         /*
          * idle state index 0 corresponds to wfi, should never be called
          * from the cpu_suspend operations
diff --git a/arch/mips/Kbuild.platforms b/arch/mips/Kbuild.platforms
index f5e18bf3275e..e5fc463b36d0 100644
--- a/arch/mips/Kbuild.platforms
+++ b/arch/mips/Kbuild.platforms
@@ -2,7 +2,9 @@
 
 platforms += alchemy
 platforms += ar7
+platforms += ath25
 platforms += ath79
+platforms += bcm3384
 platforms += bcm47xx
 platforms += bcm63xx
 platforms += cavium-octeon
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 9536ef912f59..3289969ee423 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -53,6 +53,7 @@ config MIPS
         select HAVE_CC_STACKPROTECTOR
         select CPU_PM if CPU_IDLE
         select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+        select ARCH_BINFMT_ELF_STATE
 
 menu "Machine selection"
 
@@ -62,7 +63,7 @@ choice
 
 config MIPS_ALCHEMY
         bool "Alchemy processor based machines"
-        select 64BIT_PHYS_ADDR
+        select ARCH_PHYS_ADDR_T_64BIT
         select CEVT_R4K
         select CSRC_R4K
         select IRQ_CPU
@@ -96,6 +97,20 @@ config AR7
           Support for the Texas Instruments AR7 System-on-a-Chip
           family: TNETD7100, 7200 and 7300.
 
+config ATH25
+        bool "Atheros AR231x/AR531x SoC support"
+        select CEVT_R4K
+        select CSRC_R4K
+        select DMA_NONCOHERENT
+        select IRQ_CPU
+        select IRQ_DOMAIN
+        select SYS_HAS_CPU_MIPS32_R1
+        select SYS_SUPPORTS_BIG_ENDIAN
+        select SYS_SUPPORTS_32BIT_KERNEL
+        select SYS_HAS_EARLY_PRINTK
+        help
+          Support for Atheros AR231x and Atheros AR531x based boards
+
 config ATH79
         bool "Atheros AR71XX/AR724X/AR913X based boards"
         select ARCH_REQUIRE_GPIOLIB
@@ -115,6 +130,32 @@ config ATH79
         help
           Support for the Atheros AR71XX/AR724X/AR913X SoCs.
 
+config BCM3384
+        bool "Broadcom BCM3384 based boards"
+        select BOOT_RAW
+        select NO_EXCEPT_FILL
+        select USE_OF
+        select CEVT_R4K
+        select CSRC_R4K
+        select SYNC_R4K
+        select COMMON_CLK
+        select DMA_NONCOHERENT
+        select IRQ_CPU
+        select SYS_SUPPORTS_32BIT_KERNEL
+        select SYS_SUPPORTS_BIG_ENDIAN
+        select SYS_SUPPORTS_HIGHMEM
+        select SYS_HAS_CPU_BMIPS5000
+        select SWAP_IO_SPACE
+        select USB_EHCI_BIG_ENDIAN_DESC
+        select USB_EHCI_BIG_ENDIAN_MMIO
+        select USB_OHCI_BIG_ENDIAN_DESC
+        select USB_OHCI_BIG_ENDIAN_MMIO
+        help
+          Support for BCM3384 based boards.  BCM3384/BCM33843 is a cable modem
+          chipset with a Linux application processor that is often used to
+          provide Samba services, a CUPS print server, and/or advanced routing
+          features.
+
 config BCM47XX
         bool "Broadcom BCM47XX based boards"
         select ARCH_WANT_OPTIONAL_GPIOLIB
@@ -269,6 +310,8 @@ config LANTIQ
         select USE_OF
         select PINCTRL
         select PINCTRL_LANTIQ
+        select ARCH_HAS_RESET_CONTROLLER
+        select RESET_CONTROLLER
 
 config LASAT
         bool "LASAT Networks platforms"
@@ -315,17 +358,18 @@ config MIPS_MALTA
         select BOOT_RAW
         select CEVT_R4K
         select CSRC_R4K
-        select CSRC_GIC
+        select CLKSRC_MIPS_GIC
         select DMA_MAYBE_COHERENT
         select GENERIC_ISA_DMA
         select HAVE_PCSPKR_PLATFORM
         select IRQ_CPU
-        select IRQ_GIC
+        select MIPS_GIC
         select HW_HAS_PCI
         select I8253
         select I8259
         select MIPS_BONITO64
         select MIPS_CPU_SCACHE
+        select MIPS_L1_CACHE_SHIFT_6
         select PCI_GT64XXX_PCI0
         select MIPS_MSC
         select SWAP_IO_SPACE
@@ -340,6 +384,7 @@ config MIPS_MALTA
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_LITTLE_ENDIAN
+        select SYS_SUPPORTS_MICROMIPS
         select SYS_SUPPORTS_MIPS_CMP
         select SYS_SUPPORTS_MIPS_CPS
         select SYS_SUPPORTS_MIPS16
@@ -357,12 +402,12 @@ config MIPS_SEAD3
         select BUILTIN_DTB
         select CEVT_R4K
         select CSRC_R4K
-        select CSRC_GIC
+        select CLKSRC_MIPS_GIC
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_IRQ_EI
         select DMA_NONCOHERENT
         select IRQ_CPU
-        select IRQ_GIC
+        select MIPS_GIC
         select LIBFDT
         select MIPS_MSC
         select SYS_HAS_CPU_MIPS32_R1
@@ -726,7 +771,7 @@ config MIKROTIK_RB532
 config CAVIUM_OCTEON_SOC
         bool "Cavium Networks Octeon SoC based boards"
         select CEVT_R4K
-        select 64BIT_PHYS_ADDR
+        select ARCH_PHYS_ADDR_T_64BIT
         select DMA_COHERENT
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
@@ -768,7 +813,7 @@ config NLM_XLR_BOARD
         select SWAP_IO_SPACE
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_64BIT_KERNEL
-        select 64BIT_PHYS_ADDR
+        select ARCH_PHYS_ADDR_T_64BIT
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_HIGHMEM
         select DMA_COHERENT
@@ -794,7 +839,7 @@ config NLM_XLP_BOARD
         select HW_HAS_PCI
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_64BIT_KERNEL
-        select 64BIT_PHYS_ADDR
+        select ARCH_PHYS_ADDR_T_64BIT
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_LITTLE_ENDIAN
         select SYS_SUPPORTS_HIGHMEM
@@ -835,6 +880,7 @@ config MIPS_PARAVIRT
 endchoice
 
 source "arch/mips/alchemy/Kconfig"
+source "arch/mips/ath25/Kconfig"
 source "arch/mips/ath79/Kconfig"
 source "arch/mips/bcm47xx/Kconfig"
 source "arch/mips/bcm63xx/Kconfig"
@@ -907,10 +953,6 @@ config CEVT_GT641XX
 config CEVT_R4K
         bool
 
-config CEVT_GIC
-        select MIPS_CM
-        bool
-
 config CEVT_SB1250
         bool
 
@@ -926,10 +968,6 @@ config CSRC_IOASIC
 config CSRC_R4K
         bool
 
-config CSRC_GIC
-        select MIPS_CM
-        bool
-
 config CSRC_SB1250
         bool
 
@@ -941,7 +979,7 @@ config FW_CFE
         bool
 
 config ARCH_DMA_ADDR_T_64BIT
-        def_bool (HIGHMEM && 64BIT_PHYS_ADDR) || 64BIT
+        def_bool (HIGHMEM && ARCH_PHYS_ADDR_T_64BIT) || 64BIT
 
 config DMA_MAYBE_COHERENT
         select DMA_NONCOHERENT
@@ -975,6 +1013,7 @@ config SYS_SUPPORTS_HOTPLUG_CPU
 
 config I8259
         bool
+        select IRQ_DOMAIN
 
 config MIPS_BONITO64
         bool
@@ -1055,6 +1094,7 @@ config MIPS_HUGE_TLB_SUPPORT
 
 config IRQ_CPU
         bool
+        select IRQ_DOMAIN
 
 config IRQ_CPU_RM7K
         bool
@@ -1071,10 +1111,6 @@ config IRQ_TXX9
 config IRQ_GT641XX
         bool
 
-config IRQ_GIC
-        select MIPS_CM
-        bool
-
 config PCI_GT64XXX_PCI0
         bool
 
@@ -1574,6 +1610,7 @@ config CPU_LOONGSON1
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
         select CPU_SUPPORTS_HIGHMEM
+        select CPU_SUPPORTS_CPUFREQ
 
 config CPU_BMIPS32_3300
         select SMP_UP if SMP
@@ -1586,12 +1623,14 @@ config CPU_BMIPS4350
 
 config CPU_BMIPS4380
         bool
+        select MIPS_L1_CACHE_SHIFT_6
         select SYS_SUPPORTS_SMP
         select SYS_SUPPORTS_HOTPLUG_CPU
 
 config CPU_BMIPS5000
         bool
         select MIPS_CPU_SCACHE
+        select MIPS_L1_CACHE_SHIFT_7
         select SYS_SUPPORTS_SMP
         select SYS_SUPPORTS_HOTPLUG_CPU
 
@@ -1886,15 +1925,6 @@ config FORCE_MAX_ZONEORDER
           The page size is not necessarily 4KB.  Keep this in mind
           when choosing a value for this option.
 
-config CEVT_GIC
-        bool "Use GIC global counter for clock events"
-        depends on IRQ_GIC && !MIPS_SEAD3
-        help
-          Use the GIC global counter for the clock events. The R4K clock
-          event driver is always present, so if the platform ends up not
-          detecting a GIC, it will fall back to the R4K timer for the
-          generation of clock events.
-
 config BOARD_SCACHE
         bool
 
@@ -1908,7 +1938,6 @@ config IP22_CPU_SCACHE
 config MIPS_CPU_SCACHE
         bool
         select BOARD_SCACHE
-        select MIPS_L1_CACHE_SHIFT_6
 
 config R5000_CPU_SCACHE
         bool
@@ -2095,11 +2124,8 @@ config SB1_PASS_2_1_WORKAROUNDS
         default y
 
 
-config 64BIT_PHYS_ADDR
-        bool
-
 config ARCH_PHYS_ADDR_T_64BIT
-       def_bool 64BIT_PHYS_ADDR
+       bool
 
 choice
         prompt "SmartMIPS or microMIPS ASE support"
@@ -2122,7 +2148,7 @@ config CPU_HAS_SMARTMIPS
           here.
 
 config CPU_MICROMIPS
-        depends on SYS_SUPPORTS_MICROMIPS
+        depends on 32BIT && SYS_SUPPORTS_MICROMIPS
         bool "microMIPS"
         help
           When this option is enabled the kernel will be built using the
diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug
index 3a2b775e8458..88a9f433f6fc 100644
--- a/arch/mips/Kconfig.debug
+++ b/arch/mips/Kconfig.debug
@@ -122,4 +122,17 @@ config SPINLOCK_TEST
         help
           Add several files to the debugfs to test spinlock speed.
 
+config FP32XX_HYBRID_FPRS
+        bool "Run FP32 & FPXX code with hybrid FPRs"
+        depends on MIPS_O32_FP64_SUPPORT
+        help
+          The hybrid FPR scheme is normally used only when a program needs to
+          execute a mix of FP32 & FP64A code, since the trapping & emulation
+          that it entails is expensive. When enabled, this option will lead
+          to the kernel running programs which use the FP32 & FPXX FP ABIs
+          using the hybrid FPR scheme, which can be useful for debugging
+          purposes.
+
+          If unsure, say N.
+
 endmenu
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 58076472bdd8..2563a088d3b8 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -380,6 +380,7 @@ define archhelp
         echo '  vmlinux.ecoff        - ECOFF boot image'
         echo '  vmlinux.bin          - Raw binary boot image'
         echo '  vmlinux.srec         - SREC boot image'
+        echo '  vmlinux.32           - 64-bit boot image wrapped in 32bits (IP22/IP32)'
         echo '  vmlinuz              - Compressed boot(zboot) image'
         echo '  vmlinuz.ecoff        - ECOFF zboot image'
         echo '  vmlinuz.bin          - Raw binary zboot image'
diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
index d7557cde271a..203e4403c366 100644
--- a/arch/mips/alchemy/common/clock.c
+++ b/arch/mips/alchemy/common/clock.c
@@ -37,7 +37,6 @@
 #include <linux/io.h>
 #include <linux/clk-provider.h>
 #include <linux/clkdev.h>
-#include <linux/clk-private.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
@@ -397,10 +396,10 @@ static long alchemy_clk_fgcs_detr(struct clk_hw *hw, unsigned long rate,
                         break;
 
                 /* if this parent is currently unused, remember it.
-                 * XXX: I know it's a layering violation, but it works
-                 * so well.. (if (!clk_has_active_children(pc)) )
+                 * XXX: we would actually want clk_has_active_children()
+                 * but this is a good-enough approximation for now.
                  */
-                if (pc->prepare_count == 0) {
+                if (!__clk_is_prepared(pc)) {
                         if (!free)
                                 free = pc;
                 }
diff --git a/arch/mips/alchemy/common/setup.c b/arch/mips/alchemy/common/setup.c
index ea8f41869e56..4e72daf12c32 100644
--- a/arch/mips/alchemy/common/setup.c
+++ b/arch/mips/alchemy/common/setup.c
@@ -70,9 +70,9 @@ void __init plat_mem_setup(void)
         iomem_resource.end = IOMEM_RESOURCE_END;
 }
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_PCI)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_PCI)
 /* This routine should be valid for all Au1x based boards */
-phys_t __fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+phys_addr_t __fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         unsigned long start = ALCHEMY_PCI_MEMWIN_START;
         unsigned long end = ALCHEMY_PCI_MEMWIN_END;
@@ -83,7 +83,7 @@ phys_t __fixup_bigphys_addr(phys_t phys_addr, phys_t size)
 
         /* Check for PCI memory window */
         if (phys_addr >= start && (phys_addr + size - 1) <= end)
-                return (phys_t)(AU1500_PCI_MEM_PHYS_ADDR + phys_addr);
+                return (phys_addr_t)(AU1500_PCI_MEM_PHYS_ADDR + phys_addr);
 
         /* default nop */
         return phys_addr;
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 7e2356fd5fd6..af2441dbfc12 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -311,8 +311,7 @@ static void __init cpmac_get_mac(int instance, unsigned char *dev_addr)
                                         &dev_addr[0], &dev_addr[1],
                                         &dev_addr[2], &dev_addr[3],
                                         &dev_addr[4], &dev_addr[5]) != 6) {
-                        pr_warning("cannot parse mac address, "
-                                        "using random address\n");
+                        pr_warn("cannot parse mac address, using random address\n");
                         eth_random_addr(dev_addr);
                 }
         } else
@@ -665,7 +664,7 @@ static int __init ar7_register_devices(void)
 
         res = platform_device_register(&physmap_flash);
         if (res)
-                pr_warning("unable to register physmap-flash: %d\n", res);
+                pr_warn("unable to register physmap-flash: %d\n", res);
 
         if (ar7_is_titan())
                 titan_fixup_devices();
@@ -673,13 +672,13 @@ static int __init ar7_register_devices(void)
         ar7_device_disable(vlynq_low_data.reset_bit);
         res = platform_device_register(&vlynq_low);
         if (res)
-                pr_warning("unable to register vlynq-low: %d\n", res);
+                pr_warn("unable to register vlynq-low: %d\n", res);
 
         if (ar7_has_high_vlynq()) {
                 ar7_device_disable(vlynq_high_data.reset_bit);
                 res = platform_device_register(&vlynq_high);
                 if (res)
-                        pr_warning("unable to register vlynq-high: %d\n", res);
+                        pr_warn("unable to register vlynq-high: %d\n", res);
         }
 
         if (ar7_has_high_cpmac()) {
@@ -689,9 +688,10 @@ static int __init ar7_register_devices(void)
 
                         res = platform_device_register(&cpmac_high);
                         if (res)
-                                pr_warning("unable to register cpmac-high: %d\n", res);
+                                pr_warn("unable to register cpmac-high: %d\n",
+                                        res);
                 } else
-                        pr_warning("unable to add cpmac-high phy: %d\n", res);
+                        pr_warn("unable to add cpmac-high phy: %d\n", res);
         } else
                 cpmac_low_data.phy_mask = 0xffffffff;
 
@@ -700,18 +700,18 @@ static int __init ar7_register_devices(void)
                 cpmac_get_mac(0, cpmac_low_data.dev_addr);
                 res = platform_device_register(&cpmac_low);
                 if (res)
-                        pr_warning("unable to register cpmac-low: %d\n", res);
+                        pr_warn("unable to register cpmac-low: %d\n", res);
         } else
-                pr_warning("unable to add cpmac-low phy: %d\n", res);
+                pr_warn("unable to add cpmac-low phy: %d\n", res);
 
         detect_leds();
         res = platform_device_register(&ar7_gpio_leds);
         if (res)
-                pr_warning("unable to register leds: %d\n", res);
+                pr_warn("unable to register leds: %d\n", res);
 
         res = platform_device_register(&ar7_udc);
         if (res)
-                pr_warning("unable to register usb slave: %d\n", res);
+                pr_warn("unable to register usb slave: %d\n", res);
 
         /* Register watchdog only if enabled in hardware */
         bootcr = ioremap_nocache(AR7_REGS_DCL, 4);
@@ -726,7 +726,7 @@ static int __init ar7_register_devices(void)
                 ar7_wdt_res.end = ar7_wdt_res.start + 0x20;
                 res = platform_device_register(&ar7_wdt);
                 if (res)
-                        pr_warning("unable to register watchdog: %d\n", res);
+                        pr_warn("unable to register watchdog: %d\n", res);
         }
 
         return 0;
diff --git a/arch/mips/ath25/Kconfig b/arch/mips/ath25/Kconfig
new file mode 100644
index 000000000000..fc19dd57e42d
--- /dev/null
+++ b/arch/mips/ath25/Kconfig
@@ -0,0 +1,16 @@
+config SOC_AR5312
+        bool "Atheros AR5312/AR2312+ SoC support"
+        depends on ATH25
+        default y
+
+config SOC_AR2315
+        bool "Atheros AR2315+ SoC support"
+        depends on ATH25
+        default y
+
+config PCI_AR2315
+        bool "Atheros AR2315 PCI controller support"
+        depends on SOC_AR2315
+        select HW_HAS_PCI
+        select PCI
+        default y
diff --git a/arch/mips/ath25/Makefile b/arch/mips/ath25/Makefile
new file mode 100644
index 000000000000..eabad7da446a
--- /dev/null
+++ b/arch/mips/ath25/Makefile
@@ -0,0 +1,16 @@
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 2006 FON Technology, SL.
+# Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+# Copyright (C) 2006-2009 Felix Fietkau <nbd@openwrt.org>
+#
+
+obj-y += board.o prom.o devices.o
+
+obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+
+obj-$(CONFIG_SOC_AR5312) += ar5312.o
+obj-$(CONFIG_SOC_AR2315) += ar2315.o
diff --git a/arch/mips/ath25/Platform b/arch/mips/ath25/Platform
new file mode 100644
index 000000000000..ef3f81fa080b
--- /dev/null
+++ b/arch/mips/ath25/Platform
@@ -0,0 +1,6 @@
+#
+# Atheros AR531X/AR231X WiSoC
+#
+platform-$(CONFIG_ATH25)        += ath25/
+cflags-$(CONFIG_ATH25)          += -I$(srctree)/arch/mips/include/asm/mach-ath25
+load-$(CONFIG_ATH25)            += 0xffffffff80041000
diff --git a/arch/mips/ath25/ar2315.c b/arch/mips/ath25/ar2315.c
new file mode 100644
index 000000000000..2befa7d766a6
--- /dev/null
+++ b/arch/mips/ath25/ar2315.c
@@ -0,0 +1,364 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
+ * Copyright (C) 2006 FON Technology, SL.
+ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
+ * Copyright (C) 2012 Alexandros C. Couloumbis <alex@ozo.com>
+ */
+
+/*
+ * Platform devices for Atheros AR2315 SoCs
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+#include <linux/irqdomain.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <asm/bootinfo.h>
+#include <asm/reboot.h>
+#include <asm/time.h>
+
+#include <ath25_platform.h>
+
+#include "devices.h"
+#include "ar2315.h"
+#include "ar2315_regs.h"
+
+static void __iomem *ar2315_rst_base;
+static struct irq_domain *ar2315_misc_irq_domain;
+
+static inline u32 ar2315_rst_reg_read(u32 reg)
+{
+        return __raw_readl(ar2315_rst_base + reg);
+}
+
+static inline void ar2315_rst_reg_write(u32 reg, u32 val)
+{
+        __raw_writel(val, ar2315_rst_base + reg);
+}
+
+static inline void ar2315_rst_reg_mask(u32 reg, u32 mask, u32 val)
+{
+        u32 ret = ar2315_rst_reg_read(reg);
+
+        ret &= ~mask;
+        ret |= val;
+        ar2315_rst_reg_write(reg, ret);
+}
+
+static irqreturn_t ar2315_ahb_err_handler(int cpl, void *dev_id)
+{
+        ar2315_rst_reg_write(AR2315_AHB_ERR0, AR2315_AHB_ERROR_DET);
+        ar2315_rst_reg_read(AR2315_AHB_ERR1);
+
+        pr_emerg("AHB fatal error\n");
+        machine_restart("AHB error"); /* Catastrophic failure */
+
+        return IRQ_HANDLED;
+}
+
+static struct irqaction ar2315_ahb_err_interrupt  = {
+        .handler        = ar2315_ahb_err_handler,
+        .name           = "ar2315-ahb-error",
+};
+
+static void ar2315_misc_irq_handler(unsigned irq, struct irq_desc *desc)
+{
+        u32 pending = ar2315_rst_reg_read(AR2315_ISR) &
+                      ar2315_rst_reg_read(AR2315_IMR);
+        unsigned nr, misc_irq = 0;
+
+        if (pending) {
+                struct irq_domain *domain = irq_get_handler_data(irq);
+
+                nr = __ffs(pending);
+                misc_irq = irq_find_mapping(domain, nr);
+        }
+
+        if (misc_irq) {
+                if (nr == AR2315_MISC_IRQ_GPIO)
+                        ar2315_rst_reg_write(AR2315_ISR, AR2315_ISR_GPIO);
+                else if (nr == AR2315_MISC_IRQ_WATCHDOG)
+                        ar2315_rst_reg_write(AR2315_ISR, AR2315_ISR_WD);
+                generic_handle_irq(misc_irq);
+        } else {
+                spurious_interrupt();
+        }
+}
+
+static void ar2315_misc_irq_unmask(struct irq_data *d)
+{
+        ar2315_rst_reg_mask(AR2315_IMR, 0, BIT(d->hwirq));
+}
+
+static void ar2315_misc_irq_mask(struct irq_data *d)
+{
+        ar2315_rst_reg_mask(AR2315_IMR, BIT(d->hwirq), 0);
+}
+
+static struct irq_chip ar2315_misc_irq_chip = {
+        .name           = "ar2315-misc",
+        .irq_unmask     = ar2315_misc_irq_unmask,
+        .irq_mask       = ar2315_misc_irq_mask,
+};
+
+static int ar2315_misc_irq_map(struct irq_domain *d, unsigned irq,
+                               irq_hw_number_t hw)
+{
+        irq_set_chip_and_handler(irq, &ar2315_misc_irq_chip, handle_level_irq);
+        return 0;
+}
+
+static struct irq_domain_ops ar2315_misc_irq_domain_ops = {
+        .map = ar2315_misc_irq_map,
+};
+
+/*
+ * Called when an interrupt is received, this function
+ * determines exactly which interrupt it was, and it
+ * invokes the appropriate handler.
+ *
+ * Implicitly, we also define interrupt priority by
+ * choosing which to dispatch first.
+ */
+static void ar2315_irq_dispatch(void)
+{
+        u32 pending = read_c0_status() & read_c0_cause();
+
+        if (pending & CAUSEF_IP3)
+                do_IRQ(AR2315_IRQ_WLAN0);
+#ifdef CONFIG_PCI_AR2315
+        else if (pending & CAUSEF_IP5)
+                do_IRQ(AR2315_IRQ_LCBUS_PCI);
+#endif
+        else if (pending & CAUSEF_IP2)
+                do_IRQ(AR2315_IRQ_MISC);
+        else if (pending & CAUSEF_IP7)
+                do_IRQ(ATH25_IRQ_CPU_CLOCK);
+        else
+                spurious_interrupt();
+}
+
+void __init ar2315_arch_init_irq(void)
+{
+        struct irq_domain *domain;
+        unsigned irq;
+
+        ath25_irq_dispatch = ar2315_irq_dispatch;
+
+        domain = irq_domain_add_linear(NULL, AR2315_MISC_IRQ_COUNT,
+                                       &ar2315_misc_irq_domain_ops, NULL);
+        if (!domain)
+                panic("Failed to add IRQ domain");
+
+        irq = irq_create_mapping(domain, AR2315_MISC_IRQ_AHB);
+        setup_irq(irq, &ar2315_ahb_err_interrupt);
+
+        irq_set_chained_handler(AR2315_IRQ_MISC, ar2315_misc_irq_handler);
+        irq_set_handler_data(AR2315_IRQ_MISC, domain);
+
+        ar2315_misc_irq_domain = domain;
+}
+
+void __init ar2315_init_devices(void)
+{
+        /* Find board configuration */
+        ath25_find_config(AR2315_SPI_READ_BASE, AR2315_SPI_READ_SIZE);
+
+        ath25_add_wmac(0, AR2315_WLAN0_BASE, AR2315_IRQ_WLAN0);
+}
+
+static void ar2315_restart(char *command)
+{
+        void (*mips_reset_vec)(void) = (void *)0xbfc00000;
+
+        local_irq_disable();
+
+        /* try reset the system via reset control */
+        ar2315_rst_reg_write(AR2315_COLD_RESET, AR2317_RESET_SYSTEM);
+
+        /* Cold reset does not work on the AR2315/6, use the GPIO reset bits
+         * a workaround. Give it some time to attempt a gpio based hardware
+         * reset (atheros reference design workaround) */
+
+        /* TODO: implement the GPIO reset workaround */
+
+        /* Some boards (e.g. Senao EOC-2610) don't implement the reset logic
+         * workaround. Attempt to jump to the mips reset location -
+         * the boot loader itself might be able to recover the system */
+        mips_reset_vec();
+}
+
+/*
+ * This table is indexed by bits 5..4 of the CLOCKCTL1 register
+ * to determine the predevisor value.
+ */
+static int clockctl1_predivide_table[4] __initdata = { 1, 2, 4, 5 };
+static int pllc_divide_table[5] __initdata = { 2, 3, 4, 6, 3 };
+
+static unsigned __init ar2315_sys_clk(u32 clock_ctl)
+{
+        unsigned int pllc_ctrl, cpu_div;
+        unsigned int pllc_out, refdiv, fdiv, divby2;
+        unsigned int clk_div;
+
+        pllc_ctrl = ar2315_rst_reg_read(AR2315_PLLC_CTL);
+        refdiv = ATH25_REG_MS(pllc_ctrl, AR2315_PLLC_REF_DIV);
+        refdiv = clockctl1_predivide_table[refdiv];
+        fdiv = ATH25_REG_MS(pllc_ctrl, AR2315_PLLC_FDBACK_DIV);
+        divby2 = ATH25_REG_MS(pllc_ctrl, AR2315_PLLC_ADD_FDBACK_DIV) + 1;
+        pllc_out = (40000000 / refdiv) * (2 * divby2) * fdiv;
+
+        /* clkm input selected */
+        switch (clock_ctl & AR2315_CPUCLK_CLK_SEL_M) {
+        case 0:
+        case 1:
+                clk_div = ATH25_REG_MS(pllc_ctrl, AR2315_PLLC_CLKM_DIV);
+                clk_div = pllc_divide_table[clk_div];
+                break;
+        case 2:
+                clk_div = ATH25_REG_MS(pllc_ctrl, AR2315_PLLC_CLKC_DIV);
+                clk_div = pllc_divide_table[clk_div];
+                break;
+        default:
+                pllc_out = 40000000;
+                clk_div = 1;
+                break;
+        }
+
+        cpu_div = ATH25_REG_MS(clock_ctl, AR2315_CPUCLK_CLK_DIV);
+        cpu_div = cpu_div * 2 ?: 1;
+
+        return pllc_out / (clk_div * cpu_div);
+}
+
+static inline unsigned ar2315_cpu_frequency(void)
+{
+        return ar2315_sys_clk(ar2315_rst_reg_read(AR2315_CPUCLK));
+}
+
+static inline unsigned ar2315_apb_frequency(void)
+{
+        return ar2315_sys_clk(ar2315_rst_reg_read(AR2315_AMBACLK));
+}
+
+void __init ar2315_plat_time_init(void)
+{
+        mips_hpt_frequency = ar2315_cpu_frequency() / 2;
+}
+
+void __init ar2315_plat_mem_setup(void)
+{
+        void __iomem *sdram_base;
+        u32 memsize, memcfg;
+        u32 devid;
+        u32 config;
+
+        /* Detect memory size */
+        sdram_base = ioremap_nocache(AR2315_SDRAMCTL_BASE,
+                                     AR2315_SDRAMCTL_SIZE);
+        memcfg = __raw_readl(sdram_base + AR2315_MEM_CFG);
+        memsize   = 1 + ATH25_REG_MS(memcfg, AR2315_MEM_CFG_DATA_WIDTH);
+        memsize <<= 1 + ATH25_REG_MS(memcfg, AR2315_MEM_CFG_COL_WIDTH);
+        memsize <<= 1 + ATH25_REG_MS(memcfg, AR2315_MEM_CFG_ROW_WIDTH);
+        memsize <<= 3;
+        add_memory_region(0, memsize, BOOT_MEM_RAM);
+        iounmap(sdram_base);
+
+        ar2315_rst_base = ioremap_nocache(AR2315_RST_BASE, AR2315_RST_SIZE);
+
+        /* Detect the hardware based on the device ID */
+        devid = ar2315_rst_reg_read(AR2315_SREV) & AR2315_REV_CHIP;
+        switch (devid) {
+        case 0x91:      /* Need to check */
+                ath25_soc = ATH25_SOC_AR2318;
+                break;
+        case 0x90:
+                ath25_soc = ATH25_SOC_AR2317;
+                break;
+        case 0x87:
+                ath25_soc = ATH25_SOC_AR2316;
+                break;
+        case 0x86:
+        default:
+                ath25_soc = ATH25_SOC_AR2315;
+                break;
+        }
+        ath25_board.devid = devid;
+
+        /* Clear any lingering AHB errors */
+        config = read_c0_config();
+        write_c0_config(config & ~0x3);
+        ar2315_rst_reg_write(AR2315_AHB_ERR0, AR2315_AHB_ERROR_DET);
+        ar2315_rst_reg_read(AR2315_AHB_ERR1);
+        ar2315_rst_reg_write(AR2315_WDT_CTRL, AR2315_WDT_CTRL_IGNORE);
+
+        _machine_restart = ar2315_restart;
+}
+
+#ifdef CONFIG_PCI_AR2315
+static struct resource ar2315_pci_res[] = {
+        {
+                .name = "ar2315-pci-ctrl",
+                .flags = IORESOURCE_MEM,
+                .start = AR2315_PCI_BASE,
+                .end = AR2315_PCI_BASE + AR2315_PCI_SIZE - 1,
+        },
+        {
+                .name = "ar2315-pci-ext",
+                .flags = IORESOURCE_MEM,
+                .start = AR2315_PCI_EXT_BASE,
+                .end = AR2315_PCI_EXT_BASE + AR2315_PCI_EXT_SIZE - 1,
+        },
+        {
+                .name = "ar2315-pci",
+                .flags = IORESOURCE_IRQ,
+                .start = AR2315_IRQ_LCBUS_PCI,
+                .end = AR2315_IRQ_LCBUS_PCI,
+        },
+};
+#endif
+
+void __init ar2315_arch_init(void)
+{
+        unsigned irq = irq_create_mapping(ar2315_misc_irq_domain,
+                                          AR2315_MISC_IRQ_UART0);
+
+        ath25_serial_setup(AR2315_UART0_BASE, irq, ar2315_apb_frequency());
+
+#ifdef CONFIG_PCI_AR2315
+        if (ath25_soc == ATH25_SOC_AR2315) {
+                /* Reset PCI DMA logic */
+                ar2315_rst_reg_mask(AR2315_RESET, 0, AR2315_RESET_PCIDMA);
+                msleep(20);
+                ar2315_rst_reg_mask(AR2315_RESET, AR2315_RESET_PCIDMA, 0);
+                msleep(20);
+
+                /* Configure endians */
+                ar2315_rst_reg_mask(AR2315_ENDIAN_CTL, 0, AR2315_CONFIG_PCIAHB |
+                                    AR2315_CONFIG_PCIAHB_BRIDGE);
+
+                /* Configure as PCI host with DMA */
+                ar2315_rst_reg_write(AR2315_PCICLK, AR2315_PCICLK_PLLC_CLKM |
+                                  (AR2315_PCICLK_IN_FREQ_DIV_6 <<
+                                   AR2315_PCICLK_DIV_S));
+                ar2315_rst_reg_mask(AR2315_AHB_ARB_CTL, 0, AR2315_ARB_PCI);
+                ar2315_rst_reg_mask(AR2315_IF_CTL, AR2315_IF_PCI_CLK_MASK |
+                                    AR2315_IF_MASK, AR2315_IF_PCI |
+                                    AR2315_IF_PCI_HOST | AR2315_IF_PCI_INTR |
+                                    (AR2315_IF_PCI_CLK_OUTPUT_CLK <<
+                                     AR2315_IF_PCI_CLK_SHIFT));
+
+                platform_device_register_simple("ar2315-pci", -1,
+                                                ar2315_pci_res,
+                                                ARRAY_SIZE(ar2315_pci_res));
+        }
+#endif
+}
diff --git a/arch/mips/ath25/ar2315.h b/arch/mips/ath25/ar2315.h
new file mode 100644
index 000000000000..877afe63eed5
--- /dev/null
+++ b/arch/mips/ath25/ar2315.h
@@ -0,0 +1,22 @@
+#ifndef __AR2315_H
+#define __AR2315_H
+
+#ifdef CONFIG_SOC_AR2315
+
+void ar2315_arch_init_irq(void);
+void ar2315_init_devices(void);
+void ar2315_plat_time_init(void);
+void ar2315_plat_mem_setup(void);
+void ar2315_arch_init(void);
+
+#else
+
+static inline void ar2315_arch_init_irq(void) {}
+static inline void ar2315_init_devices(void) {}
+static inline void ar2315_plat_time_init(void) {}
+static inline void ar2315_plat_mem_setup(void) {}
+static inline void ar2315_arch_init(void) {}
+
+#endif
+
+#endif  /* __AR2315_H */
diff --git a/arch/mips/ath25/ar2315_regs.h b/arch/mips/ath25/ar2315_regs.h
new file mode 100644
index 000000000000..16e86149cb74
--- /dev/null
+++ b/arch/mips/ath25/ar2315_regs.h
@@ -0,0 +1,410 @@
+/*
+ * Register definitions for AR2315+
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
+ * Copyright (C) 2006 FON Technology, SL.
+ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (C) 2006-2008 Felix Fietkau <nbd@openwrt.org>
+ */
+
+#ifndef __ASM_MACH_ATH25_AR2315_REGS_H
+#define __ASM_MACH_ATH25_AR2315_REGS_H
+
+/*
+ * IRQs
+ */
+#define AR2315_IRQ_MISC         (MIPS_CPU_IRQ_BASE + 2) /* C0_CAUSE: 0x0400 */
+#define AR2315_IRQ_WLAN0        (MIPS_CPU_IRQ_BASE + 3) /* C0_CAUSE: 0x0800 */
+#define AR2315_IRQ_ENET0        (MIPS_CPU_IRQ_BASE + 4) /* C0_CAUSE: 0x1000 */
+#define AR2315_IRQ_LCBUS_PCI    (MIPS_CPU_IRQ_BASE + 5) /* C0_CAUSE: 0x2000 */
+#define AR2315_IRQ_WLAN0_POLL   (MIPS_CPU_IRQ_BASE + 6) /* C0_CAUSE: 0x4000 */
+
+/*
+ * Miscellaneous interrupts, which share IP2.
+ */
+#define AR2315_MISC_IRQ_UART0           0
+#define AR2315_MISC_IRQ_I2C_RSVD        1
+#define AR2315_MISC_IRQ_SPI             2
+#define AR2315_MISC_IRQ_AHB             3
+#define AR2315_MISC_IRQ_APB             4
+#define AR2315_MISC_IRQ_TIMER           5
+#define AR2315_MISC_IRQ_GPIO            6
+#define AR2315_MISC_IRQ_WATCHDOG        7
+#define AR2315_MISC_IRQ_IR_RSVD         8
+#define AR2315_MISC_IRQ_COUNT           9
+
+/*
+ * Address map
+ */
+#define AR2315_SPI_READ_BASE    0x08000000      /* SPI flash */
+#define AR2315_SPI_READ_SIZE    0x01000000
+#define AR2315_WLAN0_BASE       0x10000000      /* Wireless MMR */
+#define AR2315_PCI_BASE         0x10100000      /* PCI MMR */
+#define AR2315_PCI_SIZE         0x00001000
+#define AR2315_SDRAMCTL_BASE    0x10300000      /* SDRAM MMR */
+#define AR2315_SDRAMCTL_SIZE    0x00000020
+#define AR2315_LOCAL_BASE       0x10400000      /* Local bus MMR */
+#define AR2315_ENET0_BASE       0x10500000      /* Ethernet MMR */
+#define AR2315_RST_BASE         0x11000000      /* Reset control MMR */
+#define AR2315_RST_SIZE         0x00000100
+#define AR2315_UART0_BASE       0x11100000      /* UART MMR */
+#define AR2315_SPI_MMR_BASE     0x11300000      /* SPI flash MMR */
+#define AR2315_SPI_MMR_SIZE     0x00000010
+#define AR2315_PCI_EXT_BASE     0x80000000      /* PCI external */
+#define AR2315_PCI_EXT_SIZE     0x40000000
+
+/*
+ * Configuration registers
+ */
+
+/* Cold reset register */
+#define AR2315_COLD_RESET               0x0000
+
+#define AR2315_RESET_COLD_AHB           0x00000001
+#define AR2315_RESET_COLD_APB           0x00000002
+#define AR2315_RESET_COLD_CPU           0x00000004
+#define AR2315_RESET_COLD_CPUWARM       0x00000008
+#define AR2315_RESET_SYSTEM             (RESET_COLD_CPU |\
+                                         RESET_COLD_APB |\
+                                         RESET_COLD_AHB)  /* full system */
+#define AR2317_RESET_SYSTEM             0x00000010
+
+/* Reset register */
+#define AR2315_RESET                    0x0004
+
+#define AR2315_RESET_WARM_WLAN0_MAC     0x00000001  /* warm reset WLAN0 MAC */
+#define AR2315_RESET_WARM_WLAN0_BB      0x00000002  /* warm reset WLAN0 BB */
+#define AR2315_RESET_MPEGTS_RSVD        0x00000004  /* warm reset MPEG-TS */
+#define AR2315_RESET_PCIDMA             0x00000008  /* warm reset PCI ahb/dma */
+#define AR2315_RESET_MEMCTL             0x00000010  /* warm reset mem control */
+#define AR2315_RESET_LOCAL              0x00000020  /* warm reset local bus */
+#define AR2315_RESET_I2C_RSVD           0x00000040  /* warm reset I2C bus */
+#define AR2315_RESET_SPI                0x00000080  /* warm reset SPI iface */
+#define AR2315_RESET_UART0              0x00000100  /* warm reset UART0 */
+#define AR2315_RESET_IR_RSVD            0x00000200  /* warm reset IR iface */
+#define AR2315_RESET_EPHY0              0x00000400  /* cold reset ENET0 phy */
+#define AR2315_RESET_ENET0              0x00000800  /* cold reset ENET0 MAC */
+
+/* AHB master arbitration control */
+#define AR2315_AHB_ARB_CTL              0x0008
+
+#define AR2315_ARB_CPU                  0x00000001  /* CPU, default */
+#define AR2315_ARB_WLAN                 0x00000002  /* WLAN */
+#define AR2315_ARB_MPEGTS_RSVD          0x00000004  /* MPEG-TS */
+#define AR2315_ARB_LOCAL                0x00000008  /* Local bus */
+#define AR2315_ARB_PCI                  0x00000010  /* PCI bus */
+#define AR2315_ARB_ETHERNET             0x00000020  /* Ethernet */
+#define AR2315_ARB_RETRY                0x00000100  /* Retry policy (debug) */
+
+/* Config Register */
+#define AR2315_ENDIAN_CTL               0x000c
+
+#define AR2315_CONFIG_AHB               0x00000001  /* EC-AHB bridge endian */
+#define AR2315_CONFIG_WLAN              0x00000002  /* WLAN byteswap */
+#define AR2315_CONFIG_MPEGTS_RSVD       0x00000004  /* MPEG-TS byteswap */
+#define AR2315_CONFIG_PCI               0x00000008  /* PCI byteswap */
+#define AR2315_CONFIG_MEMCTL            0x00000010  /* Mem controller endian */
+#define AR2315_CONFIG_LOCAL             0x00000020  /* Local bus byteswap */
+#define AR2315_CONFIG_ETHERNET          0x00000040  /* Ethernet byteswap */
+#define AR2315_CONFIG_MERGE             0x00000200  /* CPU write buffer merge */
+#define AR2315_CONFIG_CPU               0x00000400  /* CPU big endian */
+#define AR2315_CONFIG_BIG               0x00000400
+#define AR2315_CONFIG_PCIAHB            0x00000800
+#define AR2315_CONFIG_PCIAHB_BRIDGE     0x00001000
+#define AR2315_CONFIG_SPI               0x00008000  /* SPI byteswap */
+#define AR2315_CONFIG_CPU_DRAM          0x00010000
+#define AR2315_CONFIG_CPU_PCI           0x00020000
+#define AR2315_CONFIG_CPU_MMR           0x00040000
+
+/* NMI control */
+#define AR2315_NMI_CTL                  0x0010
+
+#define AR2315_NMI_EN                   1
+
+/* Revision Register - Initial value is 0x3010 (WMAC 3.0, AR231X 1.0). */
+#define AR2315_SREV                     0x0014
+
+#define AR2315_REV_MAJ                  0x000000f0
+#define AR2315_REV_MAJ_S                4
+#define AR2315_REV_MIN                  0x0000000f
+#define AR2315_REV_MIN_S                0
+#define AR2315_REV_CHIP                 (AR2315_REV_MAJ | AR2315_REV_MIN)
+
+/* Interface Enable */
+#define AR2315_IF_CTL                   0x0018
+
+#define AR2315_IF_MASK                  0x00000007
+#define AR2315_IF_DISABLED              0               /* Disable all */
+#define AR2315_IF_PCI                   1               /* PCI */
+#define AR2315_IF_TS_LOCAL              2               /* Local bus */
+#define AR2315_IF_ALL                   3               /* Emulation only */
+#define AR2315_IF_LOCAL_HOST            0x00000008
+#define AR2315_IF_PCI_HOST              0x00000010
+#define AR2315_IF_PCI_INTR              0x00000020
+#define AR2315_IF_PCI_CLK_MASK          0x00030000
+#define AR2315_IF_PCI_CLK_INPUT         0
+#define AR2315_IF_PCI_CLK_OUTPUT_LOW    1
+#define AR2315_IF_PCI_CLK_OUTPUT_CLK    2
+#define AR2315_IF_PCI_CLK_OUTPUT_HIGH   3
+#define AR2315_IF_PCI_CLK_SHIFT         16
+
+/* APB Interrupt control */
+#define AR2315_ISR                      0x0020
+#define AR2315_IMR                      0x0024
+#define AR2315_GISR                     0x0028
+
+#define AR2315_ISR_UART0        0x00000001      /* high speed UART */
+#define AR2315_ISR_I2C_RSVD     0x00000002      /* I2C bus */
+#define AR2315_ISR_SPI          0x00000004      /* SPI bus */
+#define AR2315_ISR_AHB          0x00000008      /* AHB error */
+#define AR2315_ISR_APB          0x00000010      /* APB error */
+#define AR2315_ISR_TIMER        0x00000020      /* Timer */
+#define AR2315_ISR_GPIO         0x00000040      /* GPIO */
+#define AR2315_ISR_WD           0x00000080      /* Watchdog */
+#define AR2315_ISR_IR_RSVD      0x00000100      /* IR */
+
+#define AR2315_GISR_MISC        0x00000001      /* Misc */
+#define AR2315_GISR_WLAN0       0x00000002      /* WLAN0 */
+#define AR2315_GISR_MPEGTS_RSVD 0x00000004      /* MPEG-TS */
+#define AR2315_GISR_LOCALPCI    0x00000008      /* Local/PCI bus */
+#define AR2315_GISR_WMACPOLL    0x00000010
+#define AR2315_GISR_TIMER       0x00000020
+#define AR2315_GISR_ETHERNET    0x00000040      /* Ethernet */
+
+/* Generic timer */
+#define AR2315_TIMER                    0x0030
+#define AR2315_RELOAD                   0x0034
+
+/* Watchdog timer */
+#define AR2315_WDT_TIMER                0x0038
+#define AR2315_WDT_CTRL                 0x003c
+
+#define AR2315_WDT_CTRL_IGNORE  0x00000000      /* ignore expiration */
+#define AR2315_WDT_CTRL_NMI     0x00000001      /* NMI on watchdog */
+#define AR2315_WDT_CTRL_RESET   0x00000002      /* reset on watchdog */
+
+/* CPU Performance Counters */
+#define AR2315_PERFCNT0                 0x0048
+#define AR2315_PERFCNT1                 0x004c
+
+#define AR2315_PERF0_DATAHIT    0x00000001  /* Count Data Cache Hits */
+#define AR2315_PERF0_DATAMISS   0x00000002  /* Count Data Cache Misses */
+#define AR2315_PERF0_INSTHIT    0x00000004  /* Count Instruction Cache Hits */
+#define AR2315_PERF0_INSTMISS   0x00000008  /* Count Instruction Cache Misses */
+#define AR2315_PERF0_ACTIVE     0x00000010  /* Count Active Processor Cycles */
+#define AR2315_PERF0_WBHIT      0x00000020  /* Count CPU Write Buffer Hits */
+#define AR2315_PERF0_WBMISS     0x00000040  /* Count CPU Write Buffer Misses */
+
+#define AR2315_PERF1_EB_ARDY    0x00000001  /* Count EB_ARdy signal */
+#define AR2315_PERF1_EB_AVALID  0x00000002  /* Count EB_AValid signal */
+#define AR2315_PERF1_EB_WDRDY   0x00000004  /* Count EB_WDRdy signal */
+#define AR2315_PERF1_EB_RDVAL   0x00000008  /* Count EB_RdVal signal */
+#define AR2315_PERF1_VRADDR     0x00000010  /* Count valid read address cycles*/
+#define AR2315_PERF1_VWADDR     0x00000020  /* Count valid write address cycl.*/
+#define AR2315_PERF1_VWDATA     0x00000040  /* Count valid write data cycles */
+
+/* AHB Error Reporting */
+#define AR2315_AHB_ERR0                 0x0050  /* error  */
+#define AR2315_AHB_ERR1                 0x0054  /* haddr  */
+#define AR2315_AHB_ERR2                 0x0058  /* hwdata */
+#define AR2315_AHB_ERR3                 0x005c  /* hrdata */
+#define AR2315_AHB_ERR4                 0x0060  /* status */
+
+#define AR2315_AHB_ERROR_DET    1 /* AHB Error has been detected,          */
+                                  /* write 1 to clear all bits in ERR0     */
+#define AR2315_AHB_ERROR_OVR    2 /* AHB Error overflow has been detected  */
+#define AR2315_AHB_ERROR_WDT    4 /* AHB Error due to wdt instead of hresp */
+
+#define AR2315_PROCERR_HMAST            0x0000000f
+#define AR2315_PROCERR_HMAST_DFLT       0
+#define AR2315_PROCERR_HMAST_WMAC       1
+#define AR2315_PROCERR_HMAST_ENET       2
+#define AR2315_PROCERR_HMAST_PCIENDPT   3
+#define AR2315_PROCERR_HMAST_LOCAL      4
+#define AR2315_PROCERR_HMAST_CPU        5
+#define AR2315_PROCERR_HMAST_PCITGT     6
+#define AR2315_PROCERR_HMAST_S          0
+#define AR2315_PROCERR_HWRITE           0x00000010
+#define AR2315_PROCERR_HSIZE            0x00000060
+#define AR2315_PROCERR_HSIZE_S          5
+#define AR2315_PROCERR_HTRANS           0x00000180
+#define AR2315_PROCERR_HTRANS_S         7
+#define AR2315_PROCERR_HBURST           0x00000e00
+#define AR2315_PROCERR_HBURST_S         9
+
+/* Clock Control */
+#define AR2315_PLLC_CTL                 0x0064
+#define AR2315_PLLV_CTL                 0x0068
+#define AR2315_CPUCLK                   0x006c
+#define AR2315_AMBACLK                  0x0070
+#define AR2315_SYNCCLK                  0x0074
+#define AR2315_DSL_SLEEP_CTL            0x0080
+#define AR2315_DSL_SLEEP_DUR            0x0084
+
+/* PLLc Control fields */
+#define AR2315_PLLC_REF_DIV_M           0x00000003
+#define AR2315_PLLC_REF_DIV_S           0
+#define AR2315_PLLC_FDBACK_DIV_M        0x0000007c
+#define AR2315_PLLC_FDBACK_DIV_S        2
+#define AR2315_PLLC_ADD_FDBACK_DIV_M    0x00000080
+#define AR2315_PLLC_ADD_FDBACK_DIV_S    7
+#define AR2315_PLLC_CLKC_DIV_M          0x0001c000
+#define AR2315_PLLC_CLKC_DIV_S          14
+#define AR2315_PLLC_CLKM_DIV_M          0x00700000
+#define AR2315_PLLC_CLKM_DIV_S          20
+
+/* CPU CLK Control fields */
+#define AR2315_CPUCLK_CLK_SEL_M         0x00000003
+#define AR2315_CPUCLK_CLK_SEL_S         0
+#define AR2315_CPUCLK_CLK_DIV_M         0x0000000c
+#define AR2315_CPUCLK_CLK_DIV_S         2
+
+/* AMBA CLK Control fields */
+#define AR2315_AMBACLK_CLK_SEL_M        0x00000003
+#define AR2315_AMBACLK_CLK_SEL_S        0
+#define AR2315_AMBACLK_CLK_DIV_M        0x0000000c
+#define AR2315_AMBACLK_CLK_DIV_S        2
+
+/* PCI Clock Control */
+#define AR2315_PCICLK                   0x00a4
+
+#define AR2315_PCICLK_INPUT_M           0x00000003
+#define AR2315_PCICLK_INPUT_S           0
+#define AR2315_PCICLK_PLLC_CLKM         0
+#define AR2315_PCICLK_PLLC_CLKM1        1
+#define AR2315_PCICLK_PLLC_CLKC         2
+#define AR2315_PCICLK_REF_CLK           3
+#define AR2315_PCICLK_DIV_M             0x0000000c
+#define AR2315_PCICLK_DIV_S             2
+#define AR2315_PCICLK_IN_FREQ           0
+#define AR2315_PCICLK_IN_FREQ_DIV_6     1
+#define AR2315_PCICLK_IN_FREQ_DIV_8     2
+#define AR2315_PCICLK_IN_FREQ_DIV_10    3
+
+/* Observation Control Register */
+#define AR2315_OCR                      0x00b0
+
+#define AR2315_OCR_GPIO0_IRIN           0x00000040
+#define AR2315_OCR_GPIO1_IROUT          0x00000080
+#define AR2315_OCR_GPIO3_RXCLR          0x00000200
+
+/* General Clock Control */
+#define AR2315_MISCCLK                  0x00b4
+
+#define AR2315_MISCCLK_PLLBYPASS_EN     0x00000001
+#define AR2315_MISCCLK_PROCREFCLK       0x00000002
+
+/*
+ * SDRAM Controller
+ *   - No read or write buffers are included.
+ */
+#define AR2315_MEM_CFG                  0x0000
+#define AR2315_MEM_CTRL                 0x000c
+#define AR2315_MEM_REF                  0x0010
+
+#define AR2315_MEM_CFG_DATA_WIDTH_M     0x00006000
+#define AR2315_MEM_CFG_DATA_WIDTH_S     13
+#define AR2315_MEM_CFG_COL_WIDTH_M      0x00001e00
+#define AR2315_MEM_CFG_COL_WIDTH_S      9
+#define AR2315_MEM_CFG_ROW_WIDTH_M      0x000001e0
+#define AR2315_MEM_CFG_ROW_WIDTH_S      5
+#define AR2315_MEM_CFG_BANKADDR_BITS_M  0x00000018
+#define AR2315_MEM_CFG_BANKADDR_BITS_S  3
+
+/*
+ * Local Bus Interface Registers
+ */
+#define AR2315_LB_CONFIG                0x0000
+
+#define AR2315_LBCONF_OE        0x00000001      /* =1 OE is low-true */
+#define AR2315_LBCONF_CS0       0x00000002      /* =1 first CS is low-true */
+#define AR2315_LBCONF_CS1       0x00000004      /* =1 2nd CS is low-true */
+#define AR2315_LBCONF_RDY       0x00000008      /* =1 RDY is low-true */
+#define AR2315_LBCONF_WE        0x00000010      /* =1 Write En is low-true */
+#define AR2315_LBCONF_WAIT      0x00000020      /* =1 WAIT is low-true */
+#define AR2315_LBCONF_ADS       0x00000040      /* =1 Adr Strobe is low-true */
+#define AR2315_LBCONF_MOT       0x00000080      /* =0 Intel, =1 Motorola */
+#define AR2315_LBCONF_8CS       0x00000100      /* =1 8 bits CS, 0= 16bits */
+#define AR2315_LBCONF_8DS       0x00000200      /* =1 8 bits Data S, 0=16bits */
+#define AR2315_LBCONF_ADS_EN    0x00000400      /* =1 Enable ADS */
+#define AR2315_LBCONF_ADR_OE    0x00000800      /* =1 Adr cap on OE, WE or DS */
+#define AR2315_LBCONF_ADDT_MUX  0x00001000      /* =1 Adr and Data share bus */
+#define AR2315_LBCONF_DATA_OE   0x00002000      /* =1 Data cap on OE, WE, DS */
+#define AR2315_LBCONF_16DATA    0x00004000      /* =1 Data is 16 bits wide */
+#define AR2315_LBCONF_SWAPDT    0x00008000      /* =1 Byte swap data */
+#define AR2315_LBCONF_SYNC      0x00010000      /* =1 Bus synchronous to clk */
+#define AR2315_LBCONF_INT       0x00020000      /* =1 Intr is low true */
+#define AR2315_LBCONF_INT_CTR0  0x00000000      /* GND high-Z, Vdd is high-Z */
+#define AR2315_LBCONF_INT_CTR1  0x00040000      /* GND drive, Vdd is high-Z */
+#define AR2315_LBCONF_INT_CTR2  0x00080000      /* GND high-Z, Vdd drive */
+#define AR2315_LBCONF_INT_CTR3  0x000c0000      /* GND drive, Vdd drive */
+#define AR2315_LBCONF_RDY_WAIT  0x00100000      /* =1 RDY is negative of WAIT */
+#define AR2315_LBCONF_INT_PULSE 0x00200000      /* =1 Interrupt is a pulse */
+#define AR2315_LBCONF_ENABLE    0x00400000      /* =1 Falcon respond to LB */
+
+#define AR2315_LB_CLKSEL                0x0004
+
+#define AR2315_LBCLK_EXT        0x00000001      /* use external clk for lb */
+
+#define AR2315_LB_1MS                   0x0008
+
+#define AR2315_LB1MS_MASK       0x0003ffff      /* # of AHB clk cycles in 1ms */
+
+#define AR2315_LB_MISCCFG               0x000c
+
+#define AR2315_LBM_TXD_EN       0x00000001      /* Enable TXD for fragments */
+#define AR2315_LBM_RX_INTEN     0x00000002      /* Enable LB ints on RX ready */
+#define AR2315_LBM_MBOXWR_INTEN 0x00000004      /* Enable LB ints on mbox wr */
+#define AR2315_LBM_MBOXRD_INTEN 0x00000008      /* Enable LB ints on mbox rd */
+#define AR2315_LMB_DESCSWAP_EN  0x00000010      /* Byte swap desc enable */
+#define AR2315_LBM_TIMEOUT_M    0x00ffff80
+#define AR2315_LBM_TIMEOUT_S    7
+#define AR2315_LBM_PORTMUX      0x07000000
+
+#define AR2315_LB_RXTSOFF               0x0010
+
+#define AR2315_LB_TX_CHAIN_EN           0x0100
+
+#define AR2315_LB_TXEN_0        0x00000001
+#define AR2315_LB_TXEN_1        0x00000002
+#define AR2315_LB_TXEN_2        0x00000004
+#define AR2315_LB_TXEN_3        0x00000008
+
+#define AR2315_LB_TX_CHAIN_DIS          0x0104
+#define AR2315_LB_TX_DESC_PTR           0x0200
+
+#define AR2315_LB_RX_CHAIN_EN           0x0400
+
+#define AR2315_LB_RXEN          0x00000001
+
+#define AR2315_LB_RX_CHAIN_DIS          0x0404
+#define AR2315_LB_RX_DESC_PTR           0x0408
+
+#define AR2315_LB_INT_STATUS            0x0500
+
+#define AR2315_LB_INT_TX_DESC           0x00000001
+#define AR2315_LB_INT_TX_OK             0x00000002
+#define AR2315_LB_INT_TX_ERR            0x00000004
+#define AR2315_LB_INT_TX_EOF            0x00000008
+#define AR2315_LB_INT_RX_DESC           0x00000010
+#define AR2315_LB_INT_RX_OK             0x00000020
+#define AR2315_LB_INT_RX_ERR            0x00000040
+#define AR2315_LB_INT_RX_EOF            0x00000080
+#define AR2315_LB_INT_TX_TRUNC          0x00000100
+#define AR2315_LB_INT_TX_STARVE         0x00000200
+#define AR2315_LB_INT_LB_TIMEOUT        0x00000400
+#define AR2315_LB_INT_LB_ERR            0x00000800
+#define AR2315_LB_INT_MBOX_WR           0x00001000
+#define AR2315_LB_INT_MBOX_RD           0x00002000
+
+/* Bit definitions for INT MASK are the same as INT_STATUS */
+#define AR2315_LB_INT_MASK              0x0504
+
+#define AR2315_LB_INT_EN                0x0508
+#define AR2315_LB_MBOX                  0x0600
+
+#endif /* __ASM_MACH_ATH25_AR2315_REGS_H */
diff --git a/arch/mips/ath25/ar5312.c b/arch/mips/ath25/ar5312.c
new file mode 100644
index 000000000000..b6887f75144c
--- /dev/null
+++ b/arch/mips/ath25/ar5312.c
@@ -0,0 +1,393 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
+ * Copyright (C) 2006 FON Technology, SL.
+ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (C) 2006-2009 Felix Fietkau <nbd@openwrt.org>
+ * Copyright (C) 2012 Alexandros C. Couloumbis <alex@ozo.com>
+ */
+
+/*
+ * Platform devices for Atheros AR5312 SoCs
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+#include <linux/irqdomain.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/physmap.h>
+#include <linux/reboot.h>
+#include <asm/bootinfo.h>
+#include <asm/reboot.h>
+#include <asm/time.h>
+
+#include <ath25_platform.h>
+
+#include "devices.h"
+#include "ar5312.h"
+#include "ar5312_regs.h"
+
+static void __iomem *ar5312_rst_base;
+static struct irq_domain *ar5312_misc_irq_domain;
+
+static inline u32 ar5312_rst_reg_read(u32 reg)
+{
+        return __raw_readl(ar5312_rst_base + reg);
+}
+
+static inline void ar5312_rst_reg_write(u32 reg, u32 val)
+{
+        __raw_writel(val, ar5312_rst_base + reg);
+}
+
+static inline void ar5312_rst_reg_mask(u32 reg, u32 mask, u32 val)
+{
+        u32 ret = ar5312_rst_reg_read(reg);
+
+        ret &= ~mask;
+        ret |= val;
+        ar5312_rst_reg_write(reg, ret);
+}
+
+static irqreturn_t ar5312_ahb_err_handler(int cpl, void *dev_id)
+{
+        u32 proc1 = ar5312_rst_reg_read(AR5312_PROC1);
+        u32 proc_addr = ar5312_rst_reg_read(AR5312_PROCADDR); /* clears error */
+        u32 dma1 = ar5312_rst_reg_read(AR5312_DMA1);
+        u32 dma_addr = ar5312_rst_reg_read(AR5312_DMAADDR);   /* clears error */
+
+        pr_emerg("AHB interrupt: PROCADDR=0x%8.8x PROC1=0x%8.8x DMAADDR=0x%8.8x DMA1=0x%8.8x\n",
+                 proc_addr, proc1, dma_addr, dma1);
+
+        machine_restart("AHB error"); /* Catastrophic failure */
+        return IRQ_HANDLED;
+}
+
+static struct irqaction ar5312_ahb_err_interrupt  = {
+        .handler = ar5312_ahb_err_handler,
+        .name    = "ar5312-ahb-error",
+};
+
+static void ar5312_misc_irq_handler(unsigned irq, struct irq_desc *desc)
+{
+        u32 pending = ar5312_rst_reg_read(AR5312_ISR) &
+                      ar5312_rst_reg_read(AR5312_IMR);
+        unsigned nr, misc_irq = 0;
+
+        if (pending) {
+                struct irq_domain *domain = irq_get_handler_data(irq);
+
+                nr = __ffs(pending);
+                misc_irq = irq_find_mapping(domain, nr);
+        }
+
+        if (misc_irq) {
+                generic_handle_irq(misc_irq);
+                if (nr == AR5312_MISC_IRQ_TIMER)
+                        ar5312_rst_reg_read(AR5312_TIMER);
+        } else {
+                spurious_interrupt();
+        }
+}
+
+/* Enable the specified AR5312_MISC_IRQ interrupt */
+static void ar5312_misc_irq_unmask(struct irq_data *d)
+{
+        ar5312_rst_reg_mask(AR5312_IMR, 0, BIT(d->hwirq));
+}
+
+/* Disable the specified AR5312_MISC_IRQ interrupt */
+static void ar5312_misc_irq_mask(struct irq_data *d)
+{
+        ar5312_rst_reg_mask(AR5312_IMR, BIT(d->hwirq), 0);
+        ar5312_rst_reg_read(AR5312_IMR); /* flush write buffer */
+}
+
+static struct irq_chip ar5312_misc_irq_chip = {
+        .name           = "ar5312-misc",
+        .irq_unmask     = ar5312_misc_irq_unmask,
+        .irq_mask       = ar5312_misc_irq_mask,
+};
+
+static int ar5312_misc_irq_map(struct irq_domain *d, unsigned irq,
+                               irq_hw_number_t hw)
+{
+        irq_set_chip_and_handler(irq, &ar5312_misc_irq_chip, handle_level_irq);
+        return 0;
+}
+
+static struct irq_domain_ops ar5312_misc_irq_domain_ops = {
+        .map = ar5312_misc_irq_map,
+};
+
+static void ar5312_irq_dispatch(void)
+{
+        u32 pending = read_c0_status() & read_c0_cause();
+
+        if (pending & CAUSEF_IP2)
+                do_IRQ(AR5312_IRQ_WLAN0);
+        else if (pending & CAUSEF_IP5)
+                do_IRQ(AR5312_IRQ_WLAN1);
+        else if (pending & CAUSEF_IP6)
+                do_IRQ(AR5312_IRQ_MISC);
+        else if (pending & CAUSEF_IP7)
+                do_IRQ(ATH25_IRQ_CPU_CLOCK);
+        else
+                spurious_interrupt();
+}
+
+void __init ar5312_arch_init_irq(void)
+{
+        struct irq_domain *domain;
+        unsigned irq;
+
+        ath25_irq_dispatch = ar5312_irq_dispatch;
+
+        domain = irq_domain_add_linear(NULL, AR5312_MISC_IRQ_COUNT,
+                                       &ar5312_misc_irq_domain_ops, NULL);
+        if (!domain)
+                panic("Failed to add IRQ domain");
+
+        irq = irq_create_mapping(domain, AR5312_MISC_IRQ_AHB_PROC);
+        setup_irq(irq, &ar5312_ahb_err_interrupt);
+
+        irq_set_chained_handler(AR5312_IRQ_MISC, ar5312_misc_irq_handler);
+        irq_set_handler_data(AR5312_IRQ_MISC, domain);
+
+        ar5312_misc_irq_domain = domain;
+}
+
+static struct physmap_flash_data ar5312_flash_data = {
+        .width = 2,
+};
+
+static struct resource ar5312_flash_resource = {
+        .start = AR5312_FLASH_BASE,
+        .end = AR5312_FLASH_BASE + AR5312_FLASH_SIZE - 1,
+        .flags = IORESOURCE_MEM,
+};
+
+static struct platform_device ar5312_physmap_flash = {
+        .name = "physmap-flash",
+        .id = 0,
+        .dev.platform_data = &ar5312_flash_data,
+        .resource = &ar5312_flash_resource,
+        .num_resources = 1,
+};
+
+static void __init ar5312_flash_init(void)
+{
+        void __iomem *flashctl_base;
+        u32 ctl;
+
+        flashctl_base = ioremap_nocache(AR5312_FLASHCTL_BASE,
+                                        AR5312_FLASHCTL_SIZE);
+
+        ctl = __raw_readl(flashctl_base + AR5312_FLASHCTL0);
+        ctl &= AR5312_FLASHCTL_MW;
+
+        /* fixup flash width */
+        switch (ctl) {
+        case AR5312_FLASHCTL_MW16:
+                ar5312_flash_data.width = 2;
+                break;
+        case AR5312_FLASHCTL_MW8:
+        default:
+                ar5312_flash_data.width = 1;
+                break;
+        }
+
+        /*
+         * Configure flash bank 0.
+         * Assume 8M window size. Flash will be aliased if it's smaller
+         */
+        ctl |= AR5312_FLASHCTL_E | AR5312_FLASHCTL_AC_8M | AR5312_FLASHCTL_RBLE;
+        ctl |= 0x01 << AR5312_FLASHCTL_IDCY_S;
+        ctl |= 0x07 << AR5312_FLASHCTL_WST1_S;
+        ctl |= 0x07 << AR5312_FLASHCTL_WST2_S;
+        __raw_writel(ctl, flashctl_base + AR5312_FLASHCTL0);
+
+        /* Disable other flash banks */
+        ctl = __raw_readl(flashctl_base + AR5312_FLASHCTL1);
+        ctl &= ~(AR5312_FLASHCTL_E | AR5312_FLASHCTL_AC);
+        __raw_writel(ctl, flashctl_base + AR5312_FLASHCTL1);
+        ctl = __raw_readl(flashctl_base + AR5312_FLASHCTL2);
+        ctl &= ~(AR5312_FLASHCTL_E | AR5312_FLASHCTL_AC);
+        __raw_writel(ctl, flashctl_base + AR5312_FLASHCTL2);
+
+        iounmap(flashctl_base);
+}
+
+void __init ar5312_init_devices(void)
+{
+        struct ath25_boarddata *config;
+
+        ar5312_flash_init();
+
+        /* Locate board/radio config data */
+        ath25_find_config(AR5312_FLASH_BASE, AR5312_FLASH_SIZE);
+        config = ath25_board.config;
+
+        /* AR2313 has CPU minor rev. 10 */
+        if ((current_cpu_data.processor_id & 0xff) == 0x0a)
+                ath25_soc = ATH25_SOC_AR2313;
+
+        /* AR2312 shares the same Silicon ID as AR5312 */
+        else if (config->flags & BD_ISCASPER)
+                ath25_soc = ATH25_SOC_AR2312;
+
+        /* Everything else is probably AR5312 or compatible */
+        else
+                ath25_soc = ATH25_SOC_AR5312;
+
+        platform_device_register(&ar5312_physmap_flash);
+
+        switch (ath25_soc) {
+        case ATH25_SOC_AR5312:
+                if (!ath25_board.radio)
+                        return;
+
+                if (!(config->flags & BD_WLAN0))
+                        break;
+
+                ath25_add_wmac(0, AR5312_WLAN0_BASE, AR5312_IRQ_WLAN0);
+                break;
+        case ATH25_SOC_AR2312:
+        case ATH25_SOC_AR2313:
+                if (!ath25_board.radio)
+                        return;
+                break;
+        default:
+                break;
+        }
+
+        if (config->flags & BD_WLAN1)
+                ath25_add_wmac(1, AR5312_WLAN1_BASE, AR5312_IRQ_WLAN1);
+}
+
+static void ar5312_restart(char *command)
+{
+        /* reset the system */
+        local_irq_disable();
+        while (1)
+                ar5312_rst_reg_write(AR5312_RESET, AR5312_RESET_SYSTEM);
+}
+
+/*
+ * This table is indexed by bits 5..4 of the CLOCKCTL1 register
+ * to determine the predevisor value.
+ */
+static unsigned clockctl1_predivide_table[4] __initdata = { 1, 2, 4, 5 };
+
+static unsigned __init ar5312_cpu_frequency(void)
+{
+        u32 scratch, devid, clock_ctl1;
+        u32 predivide_mask, multiplier_mask, doubler_mask;
+        unsigned predivide_shift, multiplier_shift;
+        unsigned predivide_select, predivisor, multiplier;
+
+        /* Trust the bootrom's idea of cpu frequency. */
+        scratch = ar5312_rst_reg_read(AR5312_SCRATCH);
+        if (scratch)
+                return scratch;
+
+        devid = ar5312_rst_reg_read(AR5312_REV);
+        devid = (devid & AR5312_REV_MAJ) >> AR5312_REV_MAJ_S;
+        if (devid == AR5312_REV_MAJ_AR2313) {
+                predivide_mask = AR2313_CLOCKCTL1_PREDIVIDE_MASK;
+                predivide_shift = AR2313_CLOCKCTL1_PREDIVIDE_SHIFT;
+                multiplier_mask = AR2313_CLOCKCTL1_MULTIPLIER_MASK;
+                multiplier_shift = AR2313_CLOCKCTL1_MULTIPLIER_SHIFT;
+                doubler_mask = AR2313_CLOCKCTL1_DOUBLER_MASK;
+        } else { /* AR5312 and AR2312 */
+                predivide_mask = AR5312_CLOCKCTL1_PREDIVIDE_MASK;
+                predivide_shift = AR5312_CLOCKCTL1_PREDIVIDE_SHIFT;
+                multiplier_mask = AR5312_CLOCKCTL1_MULTIPLIER_MASK;
+                multiplier_shift = AR5312_CLOCKCTL1_MULTIPLIER_SHIFT;
+                doubler_mask = AR5312_CLOCKCTL1_DOUBLER_MASK;
+        }
+
+        /*
+         * Clocking is derived from a fixed 40MHz input clock.
+         *
+         *  cpu_freq = input_clock * MULT (where MULT is PLL multiplier)
+         *  sys_freq = cpu_freq / 4       (used for APB clock, serial,
+         *                                 flash, Timer, Watchdog Timer)
+         *
+         *  cnt_freq = cpu_freq / 2       (use for CPU count/compare)
+         *
+         * So, for example, with a PLL multiplier of 5, we have
+         *
+         *  cpu_freq = 200MHz
+         *  sys_freq = 50MHz
+         *  cnt_freq = 100MHz
+         *
+         * We compute the CPU frequency, based on PLL settings.
+         */
+
+        clock_ctl1 = ar5312_rst_reg_read(AR5312_CLOCKCTL1);
+        predivide_select = (clock_ctl1 & predivide_mask) >> predivide_shift;
+        predivisor = clockctl1_predivide_table[predivide_select];
+        multiplier = (clock_ctl1 & multiplier_mask) >> multiplier_shift;
+
+        if (clock_ctl1 & doubler_mask)
+                multiplier <<= 1;
+
+        return (40000000 / predivisor) * multiplier;
+}
+
+static inline unsigned ar5312_sys_frequency(void)
+{
+        return ar5312_cpu_frequency() / 4;
+}
+
+void __init ar5312_plat_time_init(void)
+{
+        mips_hpt_frequency = ar5312_cpu_frequency() / 2;
+}
+
+void __init ar5312_plat_mem_setup(void)
+{
+        void __iomem *sdram_base;
+        u32 memsize, memcfg, bank0_ac, bank1_ac;
+        u32 devid;
+
+        /* Detect memory size */
+        sdram_base = ioremap_nocache(AR5312_SDRAMCTL_BASE,
+                                     AR5312_SDRAMCTL_SIZE);
+        memcfg = __raw_readl(sdram_base + AR5312_MEM_CFG1);
+        bank0_ac = ATH25_REG_MS(memcfg, AR5312_MEM_CFG1_AC0);
+        bank1_ac = ATH25_REG_MS(memcfg, AR5312_MEM_CFG1_AC1);
+        memsize = (bank0_ac ? (1 << (bank0_ac + 1)) : 0) +
+                  (bank1_ac ? (1 << (bank1_ac + 1)) : 0);
+        memsize <<= 20;
+        add_memory_region(0, memsize, BOOT_MEM_RAM);
+        iounmap(sdram_base);
+
+        ar5312_rst_base = ioremap_nocache(AR5312_RST_BASE, AR5312_RST_SIZE);
+
+        devid = ar5312_rst_reg_read(AR5312_REV);
+        devid >>= AR5312_REV_WMAC_MIN_S;
+        devid &= AR5312_REV_CHIP;
+        ath25_board.devid = (u16)devid;
+
+        /* Clear any lingering AHB errors */
+        ar5312_rst_reg_read(AR5312_PROCADDR);
+        ar5312_rst_reg_read(AR5312_DMAADDR);
+        ar5312_rst_reg_write(AR5312_WDT_CTRL, AR5312_WDT_CTRL_IGNORE);
+
+        _machine_restart = ar5312_restart;
+}
+
+void __init ar5312_arch_init(void)
+{
+        unsigned irq = irq_create_mapping(ar5312_misc_irq_domain,
+                                          AR5312_MISC_IRQ_UART0);
+
+        ath25_serial_setup(AR5312_UART0_BASE, irq, ar5312_sys_frequency());
+}
diff --git a/arch/mips/ath25/ar5312.h b/arch/mips/ath25/ar5312.h
new file mode 100644
index 000000000000..470abb0052bd
--- /dev/null
+++ b/arch/mips/ath25/ar5312.h
@@ -0,0 +1,22 @@
+#ifndef __AR5312_H
+#define __AR5312_H
+
+#ifdef CONFIG_SOC_AR5312
+
+void ar5312_arch_init_irq(void);
+void ar5312_init_devices(void);
+void ar5312_plat_time_init(void);
+void ar5312_plat_mem_setup(void);
+void ar5312_arch_init(void);
+
+#else
+
+static inline void ar5312_arch_init_irq(void) {}
+static inline void ar5312_init_devices(void) {}
+static inline void ar5312_plat_time_init(void) {}
+static inline void ar5312_plat_mem_setup(void) {}
+static inline void ar5312_arch_init(void) {}
+
+#endif
+
+#endif  /* __AR5312_H */
diff --git a/arch/mips/ath25/ar5312_regs.h b/arch/mips/ath25/ar5312_regs.h
new file mode 100644
index 000000000000..4b947f967439
--- /dev/null
+++ b/arch/mips/ath25/ar5312_regs.h
@@ -0,0 +1,224 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
+ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
+ */
+
+#ifndef __ASM_MACH_ATH25_AR5312_REGS_H
+#define __ASM_MACH_ATH25_AR5312_REGS_H
+
+/*
+ * IRQs
+ */
+#define AR5312_IRQ_WLAN0        (MIPS_CPU_IRQ_BASE + 2) /* C0_CAUSE: 0x0400 */
+#define AR5312_IRQ_ENET0        (MIPS_CPU_IRQ_BASE + 3) /* C0_CAUSE: 0x0800 */
+#define AR5312_IRQ_ENET1        (MIPS_CPU_IRQ_BASE + 4) /* C0_CAUSE: 0x1000 */
+#define AR5312_IRQ_WLAN1        (MIPS_CPU_IRQ_BASE + 5) /* C0_CAUSE: 0x2000 */
+#define AR5312_IRQ_MISC         (MIPS_CPU_IRQ_BASE + 6) /* C0_CAUSE: 0x4000 */
+
+/*
+ * Miscellaneous interrupts, which share IP6.
+ */
+#define AR5312_MISC_IRQ_TIMER           0
+#define AR5312_MISC_IRQ_AHB_PROC        1
+#define AR5312_MISC_IRQ_AHB_DMA         2
+#define AR5312_MISC_IRQ_GPIO            3
+#define AR5312_MISC_IRQ_UART0           4
+#define AR5312_MISC_IRQ_UART0_DMA       5
+#define AR5312_MISC_IRQ_WATCHDOG        6
+#define AR5312_MISC_IRQ_LOCAL           7
+#define AR5312_MISC_IRQ_SPI             8
+#define AR5312_MISC_IRQ_COUNT           9
+
+/*
+ * Address Map
+ *
+ * The AR5312 supports 2 enet MACS, even though many reference boards only
+ * actually use 1 of them (i.e. Only MAC 0 is actually connected to an enet
+ * PHY or PHY switch. The AR2312 supports 1 enet MAC.
+ */
+#define AR5312_WLAN0_BASE               0x18000000
+#define AR5312_ENET0_BASE               0x18100000
+#define AR5312_ENET1_BASE               0x18200000
+#define AR5312_SDRAMCTL_BASE            0x18300000
+#define AR5312_SDRAMCTL_SIZE            0x00000010
+#define AR5312_FLASHCTL_BASE            0x18400000
+#define AR5312_FLASHCTL_SIZE            0x00000010
+#define AR5312_WLAN1_BASE               0x18500000
+#define AR5312_UART0_BASE               0x1c000000      /* UART MMR */
+#define AR5312_GPIO_BASE                0x1c002000
+#define AR5312_GPIO_SIZE                0x00000010
+#define AR5312_RST_BASE                 0x1c003000
+#define AR5312_RST_SIZE                 0x00000100
+#define AR5312_FLASH_BASE               0x1e000000
+#define AR5312_FLASH_SIZE               0x00800000
+
+/*
+ * Need these defines to determine true number of ethernet MACs
+ */
+#define AR5312_AR5312_REV2      0x0052          /* AR5312 WMAC (AP31) */
+#define AR5312_AR5312_REV7      0x0057          /* AR5312 WMAC (AP30-040) */
+#define AR5312_AR2313_REV8      0x0058          /* AR2313 WMAC (AP43-030) */
+
+/* Reset/Timer Block Address Map */
+#define AR5312_TIMER            0x0000 /* countdown timer */
+#define AR5312_RELOAD           0x0004 /* timer reload value */
+#define AR5312_WDT_CTRL         0x0008 /* watchdog cntrl */
+#define AR5312_WDT_TIMER        0x000c /* watchdog timer */
+#define AR5312_ISR              0x0010 /* Intr Status Reg */
+#define AR5312_IMR              0x0014 /* Intr Mask Reg */
+#define AR5312_RESET            0x0020
+#define AR5312_CLOCKCTL1        0x0064
+#define AR5312_SCRATCH          0x006c
+#define AR5312_PROCADDR         0x0070
+#define AR5312_PROC1            0x0074
+#define AR5312_DMAADDR          0x0078
+#define AR5312_DMA1             0x007c
+#define AR5312_ENABLE           0x0080 /* interface enb */
+#define AR5312_REV              0x0090 /* revision */
+
+/* AR5312_WDT_CTRL register bit field definitions */
+#define AR5312_WDT_CTRL_IGNORE  0x00000000      /* ignore expiration */
+#define AR5312_WDT_CTRL_NMI     0x00000001
+#define AR5312_WDT_CTRL_RESET   0x00000002
+
+/* AR5312_ISR register bit field definitions */
+#define AR5312_ISR_TIMER        0x00000001
+#define AR5312_ISR_AHBPROC      0x00000002
+#define AR5312_ISR_AHBDMA       0x00000004
+#define AR5312_ISR_GPIO         0x00000008
+#define AR5312_ISR_UART0        0x00000010
+#define AR5312_ISR_UART0DMA     0x00000020
+#define AR5312_ISR_WD           0x00000040
+#define AR5312_ISR_LOCAL        0x00000080
+
+/* AR5312_RESET register bit field definitions */
+#define AR5312_RESET_SYSTEM             0x00000001  /* cold reset full system */
+#define AR5312_RESET_PROC               0x00000002  /* cold reset MIPS core */
+#define AR5312_RESET_WLAN0              0x00000004  /* cold reset WLAN MAC/BB */
+#define AR5312_RESET_EPHY0              0x00000008  /* cold reset ENET0 phy */
+#define AR5312_RESET_EPHY1              0x00000010  /* cold reset ENET1 phy */
+#define AR5312_RESET_ENET0              0x00000020  /* cold reset ENET0 MAC */
+#define AR5312_RESET_ENET1              0x00000040  /* cold reset ENET1 MAC */
+#define AR5312_RESET_UART0              0x00000100  /* cold reset UART0 */
+#define AR5312_RESET_WLAN1              0x00000200  /* cold reset WLAN MAC/BB */
+#define AR5312_RESET_APB                0x00000400  /* cold reset APB ar5312 */
+#define AR5312_RESET_WARM_PROC          0x00001000  /* warm reset MIPS core */
+#define AR5312_RESET_WARM_WLAN0_MAC     0x00002000  /* warm reset WLAN0 MAC */
+#define AR5312_RESET_WARM_WLAN0_BB      0x00004000  /* warm reset WLAN0 BB */
+#define AR5312_RESET_NMI                0x00010000  /* send an NMI to the CPU */
+#define AR5312_RESET_WARM_WLAN1_MAC     0x00020000  /* warm reset WLAN1 MAC */
+#define AR5312_RESET_WARM_WLAN1_BB      0x00040000  /* warm reset WLAN1 BB */
+#define AR5312_RESET_LOCAL_BUS          0x00080000  /* reset local bus */
+#define AR5312_RESET_WDOG               0x00100000  /* last reset was a wdt */
+
+#define AR5312_RESET_WMAC0_BITS         (AR5312_RESET_WLAN0 |\
+                                         AR5312_RESET_WARM_WLAN0_MAC |\
+                                         AR5312_RESET_WARM_WLAN0_BB)
+
+#define AR5312_RESET_WMAC1_BITS         (AR5312_RESET_WLAN1 |\
+                                         AR5312_RESET_WARM_WLAN1_MAC |\
+                                         AR5312_RESET_WARM_WLAN1_BB)
+
+/* AR5312_CLOCKCTL1 register bit field definitions */
+#define AR5312_CLOCKCTL1_PREDIVIDE_MASK         0x00000030
+#define AR5312_CLOCKCTL1_PREDIVIDE_SHIFT        4
+#define AR5312_CLOCKCTL1_MULTIPLIER_MASK        0x00001f00
+#define AR5312_CLOCKCTL1_MULTIPLIER_SHIFT       8
+#define AR5312_CLOCKCTL1_DOUBLER_MASK           0x00010000
+
+/* Valid for AR5312 and AR2312 */
+#define AR5312_CLOCKCTL1_PREDIVIDE_MASK         0x00000030
+#define AR5312_CLOCKCTL1_PREDIVIDE_SHIFT        4
+#define AR5312_CLOCKCTL1_MULTIPLIER_MASK        0x00001f00
+#define AR5312_CLOCKCTL1_MULTIPLIER_SHIFT       8
+#define AR5312_CLOCKCTL1_DOUBLER_MASK           0x00010000
+
+/* Valid for AR2313 */
+#define AR2313_CLOCKCTL1_PREDIVIDE_MASK         0x00003000
+#define AR2313_CLOCKCTL1_PREDIVIDE_SHIFT        12
+#define AR2313_CLOCKCTL1_MULTIPLIER_MASK        0x001f0000
+#define AR2313_CLOCKCTL1_MULTIPLIER_SHIFT       16
+#define AR2313_CLOCKCTL1_DOUBLER_MASK           0x00000000
+
+/* AR5312_ENABLE register bit field definitions */
+#define AR5312_ENABLE_WLAN0                     0x00000001
+#define AR5312_ENABLE_ENET0                     0x00000002
+#define AR5312_ENABLE_ENET1                     0x00000004
+#define AR5312_ENABLE_UART_AND_WLAN1_PIO        0x00000008/* UART & WLAN1 PIO */
+#define AR5312_ENABLE_WLAN1_DMA                 0x00000010/* WLAN1 DMAs */
+#define AR5312_ENABLE_WLAN1             (AR5312_ENABLE_UART_AND_WLAN1_PIO |\
+                                         AR5312_ENABLE_WLAN1_DMA)
+
+/* AR5312_REV register bit field definitions */
+#define AR5312_REV_WMAC_MAJ     0x0000f000
+#define AR5312_REV_WMAC_MAJ_S   12
+#define AR5312_REV_WMAC_MIN     0x00000f00
+#define AR5312_REV_WMAC_MIN_S   8
+#define AR5312_REV_MAJ          0x000000f0
+#define AR5312_REV_MAJ_S        4
+#define AR5312_REV_MIN          0x0000000f
+#define AR5312_REV_MIN_S        0
+#define AR5312_REV_CHIP         (AR5312_REV_MAJ|AR5312_REV_MIN)
+
+/* Major revision numbers, bits 7..4 of Revision ID register */
+#define AR5312_REV_MAJ_AR5312           0x4
+#define AR5312_REV_MAJ_AR2313           0x5
+
+/* Minor revision numbers, bits 3..0 of Revision ID register */
+#define AR5312_REV_MIN_DUAL             0x0     /* Dual WLAN version */
+#define AR5312_REV_MIN_SINGLE           0x1     /* Single WLAN version */
+
+/*
+ * ARM Flash Controller -- 3 flash banks with either x8 or x16 devices
+ */
+#define AR5312_FLASHCTL0        0x0000
+#define AR5312_FLASHCTL1        0x0004
+#define AR5312_FLASHCTL2        0x0008
+
+/* AR5312_FLASHCTL register bit field definitions */
+#define AR5312_FLASHCTL_IDCY    0x0000000f      /* Idle cycle turnaround time */
+#define AR5312_FLASHCTL_IDCY_S  0
+#define AR5312_FLASHCTL_WST1    0x000003e0      /* Wait state 1 */
+#define AR5312_FLASHCTL_WST1_S  5
+#define AR5312_FLASHCTL_RBLE    0x00000400      /* Read byte lane enable */
+#define AR5312_FLASHCTL_WST2    0x0000f800      /* Wait state 2 */
+#define AR5312_FLASHCTL_WST2_S  11
+#define AR5312_FLASHCTL_AC      0x00070000      /* Flash addr check (added) */
+#define AR5312_FLASHCTL_AC_S    16
+#define AR5312_FLASHCTL_AC_128K 0x00000000
+#define AR5312_FLASHCTL_AC_256K 0x00010000
+#define AR5312_FLASHCTL_AC_512K 0x00020000
+#define AR5312_FLASHCTL_AC_1M   0x00030000
+#define AR5312_FLASHCTL_AC_2M   0x00040000
+#define AR5312_FLASHCTL_AC_4M   0x00050000
+#define AR5312_FLASHCTL_AC_8M   0x00060000
+#define AR5312_FLASHCTL_AC_RES  0x00070000      /* 16MB is not supported */
+#define AR5312_FLASHCTL_E       0x00080000      /* Flash bank enable (added) */
+#define AR5312_FLASHCTL_BUSERR  0x01000000      /* Bus transfer error flag */
+#define AR5312_FLASHCTL_WPERR   0x02000000      /* Write protect error flag */
+#define AR5312_FLASHCTL_WP      0x04000000      /* Write protect */
+#define AR5312_FLASHCTL_BM      0x08000000      /* Burst mode */
+#define AR5312_FLASHCTL_MW      0x30000000      /* Mem width */
+#define AR5312_FLASHCTL_MW8     0x00000000      /* Mem width x8 */
+#define AR5312_FLASHCTL_MW16    0x10000000      /* Mem width x16 */
+#define AR5312_FLASHCTL_MW32    0x20000000      /* Mem width x32 (not supp) */
+#define AR5312_FLASHCTL_ATNR    0x00000000      /* Access == no retry */
+#define AR5312_FLASHCTL_ATR     0x80000000      /* Access == retry every */
+#define AR5312_FLASHCTL_ATR4    0xc0000000      /* Access == retry every 4 */
+
+/*
+ * ARM SDRAM Controller -- just enough to determine memory size
+ */
+#define AR5312_MEM_CFG1         0x0004
+
+#define AR5312_MEM_CFG1_AC0_M   0x00000700      /* bank 0: SDRAM addr check */
+#define AR5312_MEM_CFG1_AC0_S   8
+#define AR5312_MEM_CFG1_AC1_M   0x00007000      /* bank 1: SDRAM addr check */
+#define AR5312_MEM_CFG1_AC1_S   12
+
+#endif  /* __ASM_MACH_ATH25_AR5312_REGS_H */
diff --git a/arch/mips/ath25/board.c b/arch/mips/ath25/board.c
new file mode 100644
index 000000000000..b8bb78282d6a
--- /dev/null
+++ b/arch/mips/ath25/board.c
@@ -0,0 +1,234 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
+ * Copyright (C) 2006 FON Technology, SL.
+ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (C) 2006-2009 Felix Fietkau <nbd@openwrt.org>
+ */
+
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <asm/irq_cpu.h>
+#include <asm/reboot.h>
+#include <asm/bootinfo.h>
+#include <asm/time.h>
+
+#include <ath25_platform.h>
+#include "devices.h"
+#include "ar5312.h"
+#include "ar2315.h"
+
+void (*ath25_irq_dispatch)(void);
+
+static inline bool check_radio_magic(const void __iomem *addr)
+{
+        addr += 0x7a; /* offset for flash magic */
+        return (__raw_readb(addr) == 0x5a) && (__raw_readb(addr + 1) == 0xa5);
+}
+
+static inline bool check_notempty(const void __iomem *addr)
+{
+        return __raw_readl(addr) != 0xffffffff;
+}
+
+static inline bool check_board_data(const void __iomem *addr, bool broken)
+{
+        /* config magic found */
+        if (__raw_readl(addr) == ATH25_BD_MAGIC)
+                return true;
+
+        if (!broken)
+                return false;
+
+        /* broken board data detected, use radio data to find the
+         * offset, user will fix this */
+
+        if (check_radio_magic(addr + 0x1000))
+                return true;
+        if (check_radio_magic(addr + 0xf8))
+                return true;
+
+        return false;
+}
+
+static const void __iomem * __init find_board_config(const void __iomem *limit,
+                                                     const bool broken)
+{
+        const void __iomem *addr;
+        const void __iomem *begin = limit - 0x1000;
+        const void __iomem *end = limit - 0x30000;
+
+        for (addr = begin; addr >= end; addr -= 0x1000)
+                if (check_board_data(addr, broken))
+                        return addr;
+
+        return NULL;
+}
+
+static const void __iomem * __init find_radio_config(const void __iomem *limit,
+                                                     const void __iomem *bcfg)
+{
+        const void __iomem *rcfg, *begin, *end;
+
+        /*
+         * Now find the start of Radio Configuration data, using heuristics:
+         * Search forward from Board Configuration data by 0x1000 bytes
+         * at a time until we find non-0xffffffff.
+         */
+        begin = bcfg + 0x1000;
+        end = limit;
+        for (rcfg = begin; rcfg < end; rcfg += 0x1000)
+                if (check_notempty(rcfg) && check_radio_magic(rcfg))
+                        return rcfg;
+
+        /* AR2316 relocates radio config to new location */
+        begin = bcfg + 0xf8;
+        end = limit - 0x1000 + 0xf8;
+        for (rcfg = begin; rcfg < end; rcfg += 0x1000)
+                if (check_notempty(rcfg) && check_radio_magic(rcfg))
+                        return rcfg;
+
+        return NULL;
+}
+
+/*
+ * NB: Search region size could be larger than the actual flash size,
+ * but this shouldn't be a problem here, because the flash
+ * will simply be mapped multiple times.
+ */
+int __init ath25_find_config(phys_addr_t base, unsigned long size)
+{
+        const void __iomem *flash_base, *flash_limit;
+        struct ath25_boarddata *config;
+        unsigned int rcfg_size;
+        int broken_boarddata = 0;
+        const void __iomem *bcfg, *rcfg;
+        u8 *board_data;
+        u8 *radio_data;
+        u8 *mac_addr;
+        u32 offset;
+
+        flash_base = ioremap_nocache(base, size);
+        flash_limit = flash_base + size;
+
+        ath25_board.config = NULL;
+        ath25_board.radio = NULL;
+
+        /* Copy the board and radio data to RAM, because accessing the mapped
+         * memory of the flash directly after booting is not safe */
+
+        /* Try to find valid board and radio data */
+        bcfg = find_board_config(flash_limit, false);
+
+        /* If that fails, try to at least find valid radio data */
+        if (!bcfg) {
+                bcfg = find_board_config(flash_limit, true);
+                broken_boarddata = 1;
+        }
+
+        if (!bcfg) {
+                pr_warn("WARNING: No board configuration data found!\n");
+                goto error;
+        }
+
+        board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL);
+        ath25_board.config = (struct ath25_boarddata *)board_data;
+        memcpy_fromio(board_data, bcfg, 0x100);
+        if (broken_boarddata) {
+                pr_warn("WARNING: broken board data detected\n");
+                config = ath25_board.config;
+                if (is_zero_ether_addr(config->enet0_mac)) {
+                        pr_info("Fixing up empty mac addresses\n");
+                        config->reset_config_gpio = 0xffff;
+                        config->sys_led_gpio = 0xffff;
+                        random_ether_addr(config->wlan0_mac);
+                        config->wlan0_mac[0] &= ~0x06;
+                        random_ether_addr(config->enet0_mac);
+                        random_ether_addr(config->enet1_mac);
+                }
+        }
+
+        /* Radio config starts 0x100 bytes after board config, regardless
+         * of what the physical layout on the flash chip looks like */
+
+        rcfg = find_radio_config(flash_limit, bcfg);
+        if (!rcfg) {
+                pr_warn("WARNING: Could not find Radio Configuration data\n");
+                goto error;
+        }
+
+        radio_data = board_data + 0x100 + ((rcfg - bcfg) & 0xfff);
+        ath25_board.radio = radio_data;
+        offset = radio_data - board_data;
+        pr_info("Radio config found at offset 0x%x (0x%x)\n", rcfg - bcfg,
+                offset);
+        rcfg_size = BOARD_CONFIG_BUFSZ - offset;
+        memcpy_fromio(radio_data, rcfg, rcfg_size);
+
+        mac_addr = &radio_data[0x1d * 2];
+        if (is_broadcast_ether_addr(mac_addr)) {
+                pr_info("Radio MAC is blank; using board-data\n");
+                ether_addr_copy(mac_addr, ath25_board.config->wlan0_mac);
+        }
+
+        iounmap(flash_base);
+
+        return 0;
+
+error:
+        iounmap(flash_base);
+        return -ENODEV;
+}
+
+static void ath25_halt(void)
+{
+        local_irq_disable();
+        unreachable();
+}
+
+void __init plat_mem_setup(void)
+{
+        _machine_halt = ath25_halt;
+        pm_power_off = ath25_halt;
+
+        if (is_ar5312())
+                ar5312_plat_mem_setup();
+        else
+                ar2315_plat_mem_setup();
+
+        /* Disable data watchpoints */
+        write_c0_watchlo0(0);
+}
+
+asmlinkage void plat_irq_dispatch(void)
+{
+        ath25_irq_dispatch();
+}
+
+void __init plat_time_init(void)
+{
+        if (is_ar5312())
+                ar5312_plat_time_init();
+        else
+                ar2315_plat_time_init();
+}
+
+unsigned int __cpuinit get_c0_compare_int(void)
+{
+        return CP0_LEGACY_COMPARE_IRQ;
+}
+
+void __init arch_init_irq(void)
+{
+        clear_c0_status(ST0_IM);
+        mips_cpu_irq_init();
+
+        /* Initialize interrupt controllers */
+        if (is_ar5312())
+                ar5312_arch_init_irq();
+        else
+                ar2315_arch_init_irq();
+}
diff --git a/arch/mips/ath25/devices.c b/arch/mips/ath25/devices.c
new file mode 100644
index 000000000000..7a64567d1ac3
--- /dev/null
+++ b/arch/mips/ath25/devices.c
@@ -0,0 +1,125 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/serial_8250.h>
+#include <linux/platform_device.h>
+#include <asm/bootinfo.h>
+
+#include <ath25_platform.h>
+#include "devices.h"
+#include "ar5312.h"
+#include "ar2315.h"
+
+struct ar231x_board_config ath25_board;
+enum ath25_soc_type ath25_soc = ATH25_SOC_UNKNOWN;
+
+static struct resource ath25_wmac0_res[] = {
+        {
+                .name = "wmac0_membase",
+                .flags = IORESOURCE_MEM,
+        },
+        {
+                .name = "wmac0_irq",
+                .flags = IORESOURCE_IRQ,
+        }
+};
+
+static struct resource ath25_wmac1_res[] = {
+        {
+                .name = "wmac1_membase",
+                .flags = IORESOURCE_MEM,
+        },
+        {
+                .name = "wmac1_irq",
+                .flags = IORESOURCE_IRQ,
+        }
+};
+
+static struct platform_device ath25_wmac[] = {
+        {
+                .id = 0,
+                .name = "ar231x-wmac",
+                .resource = ath25_wmac0_res,
+                .num_resources = ARRAY_SIZE(ath25_wmac0_res),
+                .dev.platform_data = &ath25_board,
+        },
+        {
+                .id = 1,
+                .name = "ar231x-wmac",
+                .resource = ath25_wmac1_res,
+                .num_resources = ARRAY_SIZE(ath25_wmac1_res),
+                .dev.platform_data = &ath25_board,
+        },
+};
+
+static const char * const soc_type_strings[] = {
+        [ATH25_SOC_AR5312] = "Atheros AR5312",
+        [ATH25_SOC_AR2312] = "Atheros AR2312",
+        [ATH25_SOC_AR2313] = "Atheros AR2313",
+        [ATH25_SOC_AR2315] = "Atheros AR2315",
+        [ATH25_SOC_AR2316] = "Atheros AR2316",
+        [ATH25_SOC_AR2317] = "Atheros AR2317",
+        [ATH25_SOC_AR2318] = "Atheros AR2318",
+        [ATH25_SOC_UNKNOWN] = "Atheros (unknown)",
+};
+
+const char *get_system_type(void)
+{
+        if ((ath25_soc >= ARRAY_SIZE(soc_type_strings)) ||
+            !soc_type_strings[ath25_soc])
+                return soc_type_strings[ATH25_SOC_UNKNOWN];
+        return soc_type_strings[ath25_soc];
+}
+
+void __init ath25_serial_setup(u32 mapbase, int irq, unsigned int uartclk)
+{
+        struct uart_port s;
+
+        memset(&s, 0, sizeof(s));
+
+        s.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP;
+        s.iotype = UPIO_MEM32;
+        s.irq = irq;
+        s.regshift = 2;
+        s.mapbase = mapbase;
+        s.uartclk = uartclk;
+
+        early_serial_setup(&s);
+}
+
+int __init ath25_add_wmac(int nr, u32 base, int irq)
+{
+        struct resource *res;
+
+        ath25_wmac[nr].dev.platform_data = &ath25_board;
+        res = &ath25_wmac[nr].resource[0];
+        res->start = base;
+        res->end = base + 0x10000 - 1;
+        res++;
+        res->start = irq;
+        res->end = irq;
+        return platform_device_register(&ath25_wmac[nr]);
+}
+
+static int __init ath25_register_devices(void)
+{
+        if (is_ar5312())
+                ar5312_init_devices();
+        else
+                ar2315_init_devices();
+
+        return 0;
+}
+
+device_initcall(ath25_register_devices);
+
+static int __init ath25_arch_init(void)
+{
+        if (is_ar5312())
+                ar5312_arch_init();
+        else
+                ar2315_arch_init();
+
+        return 0;
+}
+
+arch_initcall(ath25_arch_init);
diff --git a/arch/mips/ath25/devices.h b/arch/mips/ath25/devices.h
new file mode 100644
index 000000000000..04d414115356
--- /dev/null
+++ b/arch/mips/ath25/devices.h
@@ -0,0 +1,43 @@
+#ifndef __ATH25_DEVICES_H
+#define __ATH25_DEVICES_H
+
+#include <linux/cpu.h>
+
+#define ATH25_REG_MS(_val, _field)      (((_val) & _field##_M) >> _field##_S)
+
+#define ATH25_IRQ_CPU_CLOCK     (MIPS_CPU_IRQ_BASE + 7) /* C0_CAUSE: 0x8000 */
+
+enum ath25_soc_type {
+        /* handled by ar5312.c */
+        ATH25_SOC_AR2312,
+        ATH25_SOC_AR2313,
+        ATH25_SOC_AR5312,
+
+        /* handled by ar2315.c */
+        ATH25_SOC_AR2315,
+        ATH25_SOC_AR2316,
+        ATH25_SOC_AR2317,
+        ATH25_SOC_AR2318,
+
+        ATH25_SOC_UNKNOWN
+};
+
+extern enum ath25_soc_type ath25_soc;
+extern struct ar231x_board_config ath25_board;
+extern void (*ath25_irq_dispatch)(void);
+
+int ath25_find_config(phys_addr_t offset, unsigned long size);
+void ath25_serial_setup(u32 mapbase, int irq, unsigned int uartclk);
+int ath25_add_wmac(int nr, u32 base, int irq);
+
+static inline bool is_ar2315(void)
+{
+        return (current_cpu_data.cputype == CPU_4KEC);
+}
+
+static inline bool is_ar5312(void)
+{
+        return !is_ar2315();
+}
+
+#endif
diff --git a/arch/mips/ath25/early_printk.c b/arch/mips/ath25/early_printk.c
new file mode 100644
index 000000000000..36035b628161
--- /dev/null
+++ b/arch/mips/ath25/early_printk.c
@@ -0,0 +1,44 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2010 Gabor Juhos <juhosg@openwrt.org>
+ */
+
+#include <linux/mm.h>
+#include <linux/io.h>
+#include <linux/serial_reg.h>
+
+#include "devices.h"
+#include "ar2315_regs.h"
+#include "ar5312_regs.h"
+
+static inline void prom_uart_wr(void __iomem *base, unsigned reg,
+                                unsigned char ch)
+{
+        __raw_writel(ch, base + 4 * reg);
+}
+
+static inline unsigned char prom_uart_rr(void __iomem *base, unsigned reg)
+{
+        return __raw_readl(base + 4 * reg);
+}
+
+void prom_putchar(unsigned char ch)
+{
+        static void __iomem *base;
+
+        if (unlikely(base == NULL)) {
+                if (is_ar2315())
+                        base = (void __iomem *)(KSEG1ADDR(AR2315_UART0_BASE));
+                else
+                        base = (void __iomem *)(KSEG1ADDR(AR5312_UART0_BASE));
+        }
+
+        while ((prom_uart_rr(base, UART_LSR) & UART_LSR_THRE) == 0)
+                ;
+        prom_uart_wr(base, UART_TX, ch);
+        while ((prom_uart_rr(base, UART_LSR) & UART_LSR_THRE) == 0)
+                ;
+}
diff --git a/arch/mips/ath25/prom.c b/arch/mips/ath25/prom.c
new file mode 100644
index 000000000000..edf82be8870d
--- /dev/null
+++ b/arch/mips/ath25/prom.c
@@ -0,0 +1,26 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright MontaVista Software Inc
+ * Copyright (C) 2003 Atheros Communications, Inc.,  All Rights Reserved.
+ * Copyright (C) 2006 FON Technology, SL.
+ * Copyright (C) 2006 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
+ */
+
+/*
+ * Prom setup file for AR5312/AR231x SoCs
+ */
+
+#include <linux/init.h>
+#include <asm/bootinfo.h>
+
+void __init prom_init(void)
+{
+}
+
+void __init prom_free_prom_memory(void)
+{
+}
diff --git a/arch/mips/ath79/irq.c b/arch/mips/ath79/irq.c
index 9c0e1761773f..6adae366f11a 100644
--- a/arch/mips/ath79/irq.c
+++ b/arch/mips/ath79/irq.c
@@ -359,7 +359,6 @@ void __init arch_init_irq(void)
                 BUG();
         }
 
-        cp0_perfcount_irq = ATH79_MISC_IRQ(5);
         mips_cpu_irq_init();
         ath79_misc_irq_init();
 
diff --git a/arch/mips/ath79/prom.c b/arch/mips/ath79/prom.c
index e9cbd7c2918f..e1fe63051136 100644
--- a/arch/mips/ath79/prom.c
+++ b/arch/mips/ath79/prom.c
@@ -13,42 +13,24 @@
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/string.h>
+#include <linux/initrd.h>
 
 #include <asm/bootinfo.h>
 #include <asm/addrspace.h>
+#include <asm/fw/fw.h>
 
 #include "common.h"
 
-static inline int is_valid_ram_addr(void *addr)
-{
-        if (((u32) addr > KSEG0) &&
-            ((u32) addr < (KSEG0 + ATH79_MEM_SIZE_MAX)))
-                return 1;
-
-        if (((u32) addr > KSEG1) &&
-            ((u32) addr < (KSEG1 + ATH79_MEM_SIZE_MAX)))
-                return 1;
-
-        return 0;
-}
-
-static __init void ath79_prom_init_cmdline(int argc, char **argv)
-{
-        int i;
-
-        if (!is_valid_ram_addr(argv))
-                return;
-
-        for (i = 0; i < argc; i++)
-                if (is_valid_ram_addr(argv[i])) {
-                        strlcat(arcs_cmdline, " ", sizeof(arcs_cmdline));
-                        strlcat(arcs_cmdline, argv[i], sizeof(arcs_cmdline));
-                }
-}
-
 void __init prom_init(void)
 {
-        ath79_prom_init_cmdline(fw_arg0, (char **)fw_arg1);
+        fw_init_cmdline();
+
+        /* Read the initrd address from the firmware environment */
+        initrd_start = fw_getenvl("initrd_start");
+        if (initrd_start) {
+                initrd_start = KSEG0ADDR(initrd_start);
+                initrd_end = initrd_start + fw_getenvl("initrd_size");
+        }
 }
 
 void __init prom_free_prom_memory(void)
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
index 64807a4809d0..a73c93c3d44a 100644
--- a/arch/mips/ath79/setup.c
+++ b/arch/mips/ath79/setup.c
@@ -182,6 +182,11 @@ const char *get_system_type(void)
         return ath79_sys_type;
 }
 
+int get_c0_perfcount_int(void)
+{
+        return ATH79_MISC_IRQ(5);
+}
+
 unsigned int get_c0_compare_int(void)
 {
         return CP0_LEGACY_COMPARE_IRQ;
diff --git a/arch/mips/bcm3384/Makefile b/arch/mips/bcm3384/Makefile
new file mode 100644
index 000000000000..a393955cba08
--- /dev/null
+++ b/arch/mips/bcm3384/Makefile
@@ -0,0 +1 @@
+obj-y           += setup.o irq.o dma.o
diff --git a/arch/mips/bcm3384/Platform b/arch/mips/bcm3384/Platform
new file mode 100644
index 000000000000..8e1ca0819e1b
--- /dev/null
+++ b/arch/mips/bcm3384/Platform
@@ -0,0 +1,7 @@
+#
+# Broadcom BCM3384 boards
+#
+platform-$(CONFIG_BCM3384)      += bcm3384/
+cflags-$(CONFIG_BCM3384)        +=                                      \
+                -I$(srctree)/arch/mips/include/asm/mach-bcm3384/
+load-$(CONFIG_BCM3384)          := 0xffffffff80010000
diff --git a/arch/mips/bcm3384/dma.c b/arch/mips/bcm3384/dma.c
new file mode 100644
index 000000000000..ea42012fd4f5
--- /dev/null
+++ b/arch/mips/bcm3384/dma.c
@@ -0,0 +1,81 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2014 Kevin Cernekee <cernekee@gmail.com>
+ */
+
+#include <linux/device.h>
+#include <linux/dma-direction.h>
+#include <linux/dma-mapping.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/of.h>
+#include <linux/pci.h>
+#include <linux/types.h>
+#include <dma-coherence.h>
+
+/*
+ * BCM3384 has configurable address translation windows which allow the
+ * peripherals' DMA addresses to be different from the Zephyr-visible
+ * physical addresses.  e.g. usb_dma_addr = zephyr_pa ^ 0x08000000
+ *
+ * If our DT "memory" node has a "dma-xor-mask" property we will enable this
+ * translation using the provided offset.
+ */
+static u32 bcm3384_dma_xor_mask;
+static u32 bcm3384_dma_xor_limit = 0xffffffff;
+
+/*
+ * PCI collapses the memory hole at 0x10000000 - 0x1fffffff.
+ * On systems with a dma-xor-mask, this range is guaranteed to live above
+ * the dma-xor-limit.
+ */
+#define BCM3384_MEM_HOLE_PA     0x10000000
+#define BCM3384_MEM_HOLE_SIZE   0x10000000
+
+static dma_addr_t bcm3384_phys_to_dma(struct device *dev, phys_addr_t pa)
+{
+        if (dev && dev_is_pci(dev) &&
+            pa >= (BCM3384_MEM_HOLE_PA + BCM3384_MEM_HOLE_SIZE))
+                return pa - BCM3384_MEM_HOLE_SIZE;
+        if (pa <= bcm3384_dma_xor_limit)
+                return pa ^ bcm3384_dma_xor_mask;
+        return pa;
+}
+
+dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+{
+        return bcm3384_phys_to_dma(dev, virt_to_phys(addr));
+}
+
+dma_addr_t plat_map_dma_mem_page(struct device *dev, struct page *page)
+{
+        return bcm3384_phys_to_dma(dev, page_to_phys(page));
+}
+
+unsigned long plat_dma_addr_to_phys(struct device *dev, dma_addr_t dma_addr)
+{
+        if (dev && dev_is_pci(dev) &&
+            dma_addr >= BCM3384_MEM_HOLE_PA)
+                return dma_addr + BCM3384_MEM_HOLE_SIZE;
+        if ((dma_addr ^ bcm3384_dma_xor_mask) <= bcm3384_dma_xor_limit)
+                return dma_addr ^ bcm3384_dma_xor_mask;
+        return dma_addr;
+}
+
+static int __init bcm3384_init_dma_xor(void)
+{
+        struct device_node *np = of_find_node_by_type(NULL, "memory");
+
+        if (!np)
+                return 0;
+
+        of_property_read_u32(np, "dma-xor-mask", &bcm3384_dma_xor_mask);
+        of_property_read_u32(np, "dma-xor-limit", &bcm3384_dma_xor_limit);
+
+        of_node_put(np);
+        return 0;
+}
+arch_initcall(bcm3384_init_dma_xor);
diff --git a/arch/mips/bcm3384/irq.c b/arch/mips/bcm3384/irq.c
new file mode 100644
index 000000000000..0fb5134fb832
--- /dev/null
+++ b/arch/mips/bcm3384/irq.c
@@ -0,0 +1,193 @@
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * Partially based on arch/mips/ralink/irq.c
+ *
+ * Copyright (C) 2009 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (C) 2013 John Crispin <blogic@openwrt.org>
+ * Copyright (C) 2014 Kevin Cernekee <cernekee@gmail.com>
+ */
+
+#include <linux/io.h>
+#include <linux/bitops.h>
+#include <linux/of_platform.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/irqdomain.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+
+#include <asm/bmips.h>
+#include <asm/irq_cpu.h>
+#include <asm/mipsregs.h>
+
+/* INTC register offsets */
+#define INTC_REG_ENABLE         0x00
+#define INTC_REG_STATUS         0x04
+
+#define MAX_WORDS               2
+#define IRQS_PER_WORD           32
+
+struct bcm3384_intc {
+        int                     n_words;
+        void __iomem            *reg[MAX_WORDS];
+        u32                     enable[MAX_WORDS];
+        spinlock_t              lock;
+};
+
+static void bcm3384_intc_irq_unmask(struct irq_data *d)
+{
+        struct bcm3384_intc *priv = d->domain->host_data;
+        unsigned long flags;
+        int idx = d->hwirq / IRQS_PER_WORD;
+        int bit = d->hwirq % IRQS_PER_WORD;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->enable[idx] |= BIT(bit);
+        __raw_writel(priv->enable[idx], priv->reg[idx] + INTC_REG_ENABLE);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static void bcm3384_intc_irq_mask(struct irq_data *d)
+{
+        struct bcm3384_intc *priv = d->domain->host_data;
+        unsigned long flags;
+        int idx = d->hwirq / IRQS_PER_WORD;
+        int bit = d->hwirq % IRQS_PER_WORD;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->enable[idx] &= ~BIT(bit);
+        __raw_writel(priv->enable[idx], priv->reg[idx] + INTC_REG_ENABLE);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static struct irq_chip bcm3384_intc_irq_chip = {
+        .name           = "INTC",
+        .irq_unmask     = bcm3384_intc_irq_unmask,
+        .irq_mask       = bcm3384_intc_irq_mask,
+        .irq_mask_ack   = bcm3384_intc_irq_mask,
+};
+
+unsigned int get_c0_compare_int(void)
+{
+        return CP0_LEGACY_COMPARE_IRQ;
+}
+
+static void bcm3384_intc_irq_handler(unsigned int irq, struct irq_desc *desc)
+{
+        struct irq_domain *domain = irq_get_handler_data(irq);
+        struct bcm3384_intc *priv = domain->host_data;
+        unsigned long flags;
+        unsigned int idx;
+
+        for (idx = 0; idx < priv->n_words; idx++) {
+                unsigned long pending;
+                int hwirq;
+
+                spin_lock_irqsave(&priv->lock, flags);
+                pending = __raw_readl(priv->reg[idx] + INTC_REG_STATUS) &
+                          priv->enable[idx];
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) {
+                        generic_handle_irq(irq_find_mapping(domain,
+                                           hwirq + idx * IRQS_PER_WORD));
+                }
+        }
+}
+
+asmlinkage void plat_irq_dispatch(void)
+{
+        unsigned long pending =
+                (read_c0_status() & read_c0_cause() & ST0_IM) >> STATUSB_IP0;
+        int bit;
+
+        for_each_set_bit(bit, &pending, 8)
+                do_IRQ(MIPS_CPU_IRQ_BASE + bit);
+}
+
+static int intc_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
+{
+        irq_set_chip_and_handler(irq, &bcm3384_intc_irq_chip, handle_level_irq);
+        return 0;
+}
+
+static const struct irq_domain_ops irq_domain_ops = {
+        .xlate = irq_domain_xlate_onecell,
+        .map = intc_map,
+};
+
+static int __init ioremap_one_pair(struct bcm3384_intc *priv,
+                                   struct device_node *node,
+                                   int idx)
+{
+        struct resource res;
+
+        if (of_address_to_resource(node, idx, &res))
+                return 0;
+
+        if (request_mem_region(res.start, resource_size(&res),
+                               res.name) < 0)
+                pr_err("Failed to request INTC register region\n");
+
+        priv->reg[idx] = ioremap_nocache(res.start, resource_size(&res));
+        if (!priv->reg[idx])
+                panic("Failed to ioremap INTC register range");
+
+        /* start up with everything masked before we hook the parent IRQ */
+        __raw_writel(0, priv->reg[idx] + INTC_REG_ENABLE);
+        priv->enable[idx] = 0;
+
+        return IRQS_PER_WORD;
+}
+
+static int __init intc_of_init(struct device_node *node,
+                               struct device_node *parent)
+{
+        struct irq_domain *domain;
+        unsigned int parent_irq, n_irqs = 0;
+        struct bcm3384_intc *priv;
+
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                panic("Failed to allocate bcm3384_intc struct");
+
+        spin_lock_init(&priv->lock);
+
+        parent_irq = irq_of_parse_and_map(node, 0);
+        if (!parent_irq)
+                panic("Failed to get INTC IRQ");
+
+        n_irqs += ioremap_one_pair(priv, node, 0);
+        n_irqs += ioremap_one_pair(priv, node, 1);
+
+        if (!n_irqs)
+                panic("Failed to map INTC registers");
+
+        priv->n_words = n_irqs / IRQS_PER_WORD;
+        domain = irq_domain_add_linear(node, n_irqs, &irq_domain_ops, priv);
+        if (!domain)
+                panic("Failed to add irqdomain");
+
+        irq_set_chained_handler(parent_irq, bcm3384_intc_irq_handler);
+        irq_set_handler_data(parent_irq, domain);
+
+        return 0;
+}
+
+static struct of_device_id of_irq_ids[] __initdata = {
+        { .compatible = "mti,cpu-interrupt-controller",
+          .data = mips_cpu_intc_init },
+        { .compatible = "brcm,bcm3384-intc",
+          .data = intc_of_init },
+        {},
+};
+
+void __init arch_init_irq(void)
+{
+        bmips_tp1_irqs = 0;
+        of_irq_init(of_irq_ids);
+}
diff --git a/arch/mips/bcm3384/setup.c b/arch/mips/bcm3384/setup.c
new file mode 100644
index 000000000000..d84b8400b874
--- /dev/null
+++ b/arch/mips/bcm3384/setup.c
@@ -0,0 +1,97 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ * Copyright (C) 2014 Kevin Cernekee <cernekee@gmail.com>
+ */
+
+#include <linux/init.h>
+#include <linux/bootmem.h>
+#include <linux/clk-provider.h>
+#include <linux/ioport.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/of_platform.h>
+#include <linux/smp.h>
+#include <asm/addrspace.h>
+#include <asm/bmips.h>
+#include <asm/bootinfo.h>
+#include <asm/prom.h>
+#include <asm/smp-ops.h>
+#include <asm/time.h>
+
+void __init prom_init(void)
+{
+        register_bmips_smp_ops();
+}
+
+void __init prom_free_prom_memory(void)
+{
+}
+
+const char *get_system_type(void)
+{
+        return "BCM3384";
+}
+
+void __init plat_time_init(void)
+{
+        struct device_node *np;
+        u32 freq;
+
+        np = of_find_node_by_name(NULL, "cpus");
+        if (!np)
+                panic("missing 'cpus' DT node");
+        if (of_property_read_u32(np, "mips-hpt-frequency", &freq) < 0)
+                panic("missing 'mips-hpt-frequency' property");
+        of_node_put(np);
+
+        mips_hpt_frequency = freq;
+}
+
+void __init plat_mem_setup(void)
+{
+        void *dtb = __dtb_start;
+
+        set_io_port_base(0);
+        ioport_resource.start = 0;
+        ioport_resource.end = ~0;
+
+        /* intended to somewhat resemble ARM; see Documentation/arm/Booting */
+        if (fw_arg0 == 0 && fw_arg1 == 0xffffffff)
+                dtb = phys_to_virt(fw_arg2);
+
+        __dt_setup_arch(dtb);
+
+        strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+}
+
+void __init device_tree_init(void)
+{
+        struct device_node *np;
+
+        unflatten_and_copy_device_tree();
+
+        /* Disable SMP boot unless both CPUs are listed in DT and !disabled */
+        np = of_find_node_by_name(NULL, "cpus");
+        if (np && of_get_available_child_count(np) <= 1)
+                bmips_smp_enabled = 0;
+        of_node_put(np);
+}
+
+int __init plat_of_setup(void)
+{
+        return __dt_register_buses("brcm,bcm3384", "simple-bus");
+}
+
+arch_initcall(plat_of_setup);
+
+static int __init plat_dev_init(void)
+{
+        of_clk_init(NULL);
+        return 0;
+}
+
+device_initcall(plat_dev_init);
diff --git a/arch/mips/bcm47xx/bcm47xx_private.h b/arch/mips/bcm47xx/bcm47xx_private.h
index f1cc9d0495d8..ea909a56a3ee 100644
--- a/arch/mips/bcm47xx/bcm47xx_private.h
+++ b/arch/mips/bcm47xx/bcm47xx_private.h
@@ -6,12 +6,18 @@
 /* prom.c */
 void __init bcm47xx_prom_highmem_init(void);
 
+/* sprom.c */
+void bcm47xx_sprom_register_fallbacks(void);
+
 /* buttons.c */
 int __init bcm47xx_buttons_register(void);
 
 /* leds.c */
 void __init bcm47xx_leds_register(void);
 
+/* setup.c */
+void __init bcm47xx_bus_setup(void);
+
 /* workarounds.c */
 void __init bcm47xx_workarounds(void);
 
diff --git a/arch/mips/bcm47xx/irq.c b/arch/mips/bcm47xx/irq.c
index e0585b76ec19..21b4497f09be 100644
--- a/arch/mips/bcm47xx/irq.c
+++ b/arch/mips/bcm47xx/irq.c
@@ -22,6 +22,8 @@
  *  675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include "bcm47xx_private.h"
+
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
@@ -65,6 +67,12 @@ DEFINE_HWx_IRQDISPATCH(7)
 
 void __init arch_init_irq(void)
 {
+        /*
+         * This is the first arch callback after mm_init (we can use kmalloc),
+         * so let's finish bus initialization now.
+         */
+        bcm47xx_bus_setup();
+
 #ifdef CONFIG_BCM47XX_BCMA
         if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
                 bcma_write32(bcm47xx_bus.bcma.bus.drv_mips.core,
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
index 2bed73a684ae..c5c381c43f17 100644
--- a/arch/mips/bcm47xx/nvram.c
+++ b/arch/mips/bcm47xx/nvram.c
@@ -13,24 +13,35 @@
 
 #include <linux/types.h>
 #include <linux/module.h>
-#include <linux/ssb/ssb.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
-#include <asm/addrspace.h>
+#include <linux/mtd/mtd.h>
 #include <bcm47xx_nvram.h>
-#include <asm/mach-bcm47xx/bcm47xx.h>
+
+#define NVRAM_MAGIC             0x48534C46      /* 'FLSH' */
+#define NVRAM_SPACE             0x8000
+
+#define FLASH_MIN               0x00020000      /* Minimum flash size */
+
+struct nvram_header {
+        u32 magic;
+        u32 len;
+        u32 crc_ver_init;       /* 0:7 crc, 8:15 ver, 16:31 sdram_init */
+        u32 config_refresh;     /* 0:15 sdram_config, 16:31 sdram_refresh */
+        u32 config_ncdl;        /* ncdl values for memc */
+};
 
 static char nvram_buf[NVRAM_SPACE];
 static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
 
-static u32 find_nvram_size(u32 end)
+static u32 find_nvram_size(void __iomem *end)
 {
-        struct nvram_header *header;
+        struct nvram_header __iomem *header;
         int i;
 
         for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
-                header = (struct nvram_header *)KSEG1ADDR(end - nvram_sizes[i]);
-                if (header->magic == NVRAM_HEADER)
+                header = (struct nvram_header *)(end - nvram_sizes[i]);
+                if (header->magic == NVRAM_MAGIC)
                         return nvram_sizes[i];
         }
 
@@ -38,36 +49,40 @@ static u32 find_nvram_size(u32 end)
 }
 
 /* Probe for NVRAM header */
-static int nvram_find_and_copy(u32 base, u32 lim)
+static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
 {
-        struct nvram_header *header;
+        struct nvram_header __iomem *header;
         int i;
         u32 off;
         u32 *src, *dst;
         u32 size;
 
+        if (nvram_buf[0]) {
+                pr_warn("nvram already initialized\n");
+                return -EEXIST;
+        }
+
         /* TODO: when nvram is on nand flash check for bad blocks first. */
         off = FLASH_MIN;
         while (off <= lim) {
                 /* Windowed flash access */
-                size = find_nvram_size(base + off);
+                size = find_nvram_size(iobase + off);
                 if (size) {
-                        header = (struct nvram_header *)KSEG1ADDR(base + off -
-                                                                  size);
+                        header = (struct nvram_header *)(iobase + off - size);
                         goto found;
                 }
                 off <<= 1;
         }
 
         /* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
-        header = (struct nvram_header *) KSEG1ADDR(base + 4096);
-        if (header->magic == NVRAM_HEADER) {
+        header = (struct nvram_header *)(iobase + 4096);
+        if (header->magic == NVRAM_MAGIC) {
                 size = NVRAM_SPACE;
                 goto found;
         }
 
-        header = (struct nvram_header *) KSEG1ADDR(base + 1024);
-        if (header->magic == NVRAM_HEADER) {
+        header = (struct nvram_header *)(iobase + 1024);
+        if (header->magic == NVRAM_MAGIC) {
                 size = NVRAM_SPACE;
                 goto found;
         }
@@ -94,71 +109,73 @@ found:
         return 0;
 }
 
-#ifdef CONFIG_BCM47XX_SSB
-static int nvram_init_ssb(void)
+/*
+ * On bcm47xx we need access to the NVRAM very early, so we can't use mtd
+ * subsystem to access flash. We can't even use platform device / driver to
+ * store memory offset.
+ * To handle this we provide following symbol. It's supposed to be called as
+ * soon as we get info about flash device, before any NVRAM entry is needed.
+ */
+int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
 {
-        struct ssb_mipscore *mcore = &bcm47xx_bus.ssb.mipscore;
-        u32 base;
-        u32 lim;
-
-        if (mcore->pflash.present) {
-                base = mcore->pflash.window;
-                lim = mcore->pflash.window_size;
-        } else {
-                pr_err("Couldn't find supported flash memory\n");
-                return -ENXIO;
-        }
+        void __iomem *iobase;
+        int err;
 
-        return nvram_find_and_copy(base, lim);
-}
-#endif
+        iobase = ioremap_nocache(base, lim);
+        if (!iobase)
+                return -ENOMEM;
 
-#ifdef CONFIG_BCM47XX_BCMA
-static int nvram_init_bcma(void)
-{
-        struct bcma_drv_cc *cc = &bcm47xx_bus.bcma.bus.drv_cc;
-        u32 base;
-        u32 lim;
-
-#ifdef CONFIG_BCMA_NFLASH
-        if (cc->nflash.boot) {
-                base = BCMA_SOC_FLASH1;
-                lim = BCMA_SOC_FLASH1_SZ;
-        } else
-#endif
-        if (cc->pflash.present) {
-                base = cc->pflash.window;
-                lim = cc->pflash.window_size;
-#ifdef CONFIG_BCMA_SFLASH
-        } else if (cc->sflash.present) {
-                base = cc->sflash.window;
-                lim = cc->sflash.size;
-#endif
-        } else {
-                pr_err("Couldn't find supported flash memory\n");
-                return -ENXIO;
-        }
+        err = nvram_find_and_copy(iobase, lim);
+
+        iounmap(iobase);
 
-        return nvram_find_and_copy(base, lim);
+        return err;
 }
-#endif
 
 static int nvram_init(void)
 {
-        switch (bcm47xx_bus_type) {
-#ifdef CONFIG_BCM47XX_SSB
-        case BCM47XX_BUS_TYPE_SSB:
-                return nvram_init_ssb();
-#endif
-#ifdef CONFIG_BCM47XX_BCMA
-        case BCM47XX_BUS_TYPE_BCMA:
-                return nvram_init_bcma();
-#endif
+#ifdef CONFIG_MTD
+        struct mtd_info *mtd;
+        struct nvram_header header;
+        size_t bytes_read;
+        int err, i;
+
+        mtd = get_mtd_device_nm("nvram");
+        if (IS_ERR(mtd))
+                return -ENODEV;
+
+        for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
+                loff_t from = mtd->size - nvram_sizes[i];
+
+                if (from < 0)
+                        continue;
+
+                err = mtd_read(mtd, from, sizeof(header), &bytes_read,
+                               (uint8_t *)&header);
+                if (!err && header.magic == NVRAM_MAGIC) {
+                        u8 *dst = (uint8_t *)nvram_buf;
+                        size_t len = header.len;
+
+                        if (header.len > NVRAM_SPACE) {
+                                pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+                                       header.len, NVRAM_SPACE);
+                                len = NVRAM_SPACE;
+                        }
+
+                        err = mtd_read(mtd, from, len, &bytes_read, dst);
+                        if (err)
+                                return err;
+                        memset(dst + bytes_read, 0x0, NVRAM_SPACE - bytes_read);
+
+                        return 0;
+                }
         }
+#endif
+
         return -ENXIO;
 }
 
-int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len)
+int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
 {
         char *var, *value, *end, *eq;
         int err;
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index c00585d915bc..e43b5046cb30 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -102,23 +102,6 @@ static void bcm47xx_machine_halt(void)
 }
 
 #ifdef CONFIG_BCM47XX_SSB
-static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
-{
-        char prefix[10];
-
-        if (bus->bustype == SSB_BUSTYPE_PCI) {
-                memset(out, 0, sizeof(struct ssb_sprom));
-                snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
-                         bus->host_pci->bus->number + 1,
-                         PCI_SLOT(bus->host_pci->devfn));
-                bcm47xx_fill_sprom(out, prefix, false);
-                return 0;
-        } else {
-                printk(KERN_WARNING "bcm47xx: unable to fill SPROM for given bustype.\n");
-                return -EINVAL;
-        }
-}
-
 static int bcm47xx_get_invariants(struct ssb_bus *bus,
                                   struct ssb_init_invariants *iv)
 {
@@ -144,11 +127,6 @@ static void __init bcm47xx_register_ssb(void)
         char buf[100];
         struct ssb_mipscore *mcore;
 
-        err = ssb_arch_register_fallback_sprom(&bcm47xx_get_sprom_ssb);
-        if (err)
-                printk(KERN_WARNING "bcm47xx: someone else already registered"
-                        " a ssb SPROM callback handler (err %d)\n", err);
-
         err = ssb_bus_ssbbus_register(&(bcm47xx_bus.ssb), SSB_ENUM_BASE,
                                       bcm47xx_get_invariants);
         if (err)
@@ -171,56 +149,21 @@ static void __init bcm47xx_register_ssb(void)
 #endif
 
 #ifdef CONFIG_BCM47XX_BCMA
-static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
-{
-        char prefix[10];
-        struct bcma_device *core;
-
-        switch (bus->hosttype) {
-        case BCMA_HOSTTYPE_PCI:
-                memset(out, 0, sizeof(struct ssb_sprom));
-                snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
-                         bus->host_pci->bus->number + 1,
-                         PCI_SLOT(bus->host_pci->devfn));
-                bcm47xx_fill_sprom(out, prefix, false);
-                return 0;
-        case BCMA_HOSTTYPE_SOC:
-                memset(out, 0, sizeof(struct ssb_sprom));
-                core = bcma_find_core(bus, BCMA_CORE_80211);
-                if (core) {
-                        snprintf(prefix, sizeof(prefix), "sb/%u/",
-                                 core->core_index);
-                        bcm47xx_fill_sprom(out, prefix, true);
-                } else {
-                        bcm47xx_fill_sprom(out, NULL, false);
-                }
-                return 0;
-        default:
-                pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
-                return -EINVAL;
-        }
-}
-
 static void __init bcm47xx_register_bcma(void)
 {
         int err;
 
-        err = bcma_arch_register_fallback_sprom(&bcm47xx_get_sprom_bcma);
-        if (err)
-                pr_warn("bcm47xx: someone else already registered a bcma SPROM callback handler (err %d)\n", err);
-
         err = bcma_host_soc_register(&bcm47xx_bus.bcma);
         if (err)
                 panic("Failed to register BCMA bus (err %d)", err);
-
-        err = bcma_host_soc_init(&bcm47xx_bus.bcma);
-        if (err)
-                panic("Failed to initialize BCMA bus (err %d)", err);
-
-        bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo, NULL);
 }
 #endif
 
+/*
+ * Memory setup is done in the early part of MIPS's arch_mem_init. It's supposed
+ * to detect memory and record it with add_memory_region.
+ * Any extra initializaion performed here must not use kmalloc or bootmem.
+ */
 void __init plat_mem_setup(void)
 {
         struct cpuinfo_mips *c = &current_cpu_data;
@@ -229,6 +172,7 @@ void __init plat_mem_setup(void)
                 printk(KERN_INFO "bcm47xx: using bcma bus\n");
 #ifdef CONFIG_BCM47XX_BCMA
                 bcm47xx_bus_type = BCM47XX_BUS_TYPE_BCMA;
+                bcm47xx_sprom_register_fallbacks();
                 bcm47xx_register_bcma();
                 bcm47xx_set_system_type(bcm47xx_bus.bcma.bus.chipinfo.id);
 #ifdef CONFIG_HIGHMEM
@@ -239,6 +183,7 @@ void __init plat_mem_setup(void)
                 printk(KERN_INFO "bcm47xx: using ssb bus\n");
 #ifdef CONFIG_BCM47XX_SSB
                 bcm47xx_bus_type = BCM47XX_BUS_TYPE_SSB;
+                bcm47xx_sprom_register_fallbacks();
                 bcm47xx_register_ssb();
                 bcm47xx_set_system_type(bcm47xx_bus.ssb.chip_id);
 #endif
@@ -247,6 +192,28 @@ void __init plat_mem_setup(void)
         _machine_restart = bcm47xx_machine_restart;
         _machine_halt = bcm47xx_machine_halt;
         pm_power_off = bcm47xx_machine_halt;
+}
+
+/*
+ * This finishes bus initialization doing things that were not possible without
+ * kmalloc. Make sure to call it late enough (after mm_init).
+ */
+void __init bcm47xx_bus_setup(void)
+{
+#ifdef CONFIG_BCM47XX_BCMA
+        if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
+                int err;
+
+                err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+                if (err)
+                        panic("Failed to initialize BCMA bus (err %d)", err);
+
+                bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo,
+                                            NULL);
+        }
+#endif
+
+        /* With bus initialized we can access NVRAM and detect the board */
         bcm47xx_board_detect();
         mips_set_machine_name(bcm47xx_board_get_name());
 }
diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
index 41226b68de3d..2eff7fe99c6b 100644
--- a/arch/mips/bcm47xx/sprom.c
+++ b/arch/mips/bcm47xx/sprom.c
@@ -136,6 +136,20 @@ static void nvram_read_leddc(const char *prefix, const char *name,
         *leddc_off_time = (val >> 16) & 0xff;
 }
 
+static void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
+{
+        if (strchr(buf, ':'))
+                sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &macaddr[0],
+                        &macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
+                        &macaddr[5]);
+        else if (strchr(buf, '-'))
+                sscanf(buf, "%hhx-%hhx-%hhx-%hhx-%hhx-%hhx", &macaddr[0],
+                        &macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
+                        &macaddr[5]);
+        else
+                pr_warn("Can not parse mac address: %s\n", buf);
+}
+
 static void nvram_read_macaddr(const char *prefix, const char *name,
                                u8 val[6], bool fallback)
 {
@@ -801,3 +815,71 @@ void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
         nvram_read_u16(prefix, NULL, "boardtype", &boardinfo->type, 0, true);
 }
 #endif
+
+#if defined(CONFIG_BCM47XX_SSB)
+static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+{
+        char prefix[10];
+
+        if (bus->bustype == SSB_BUSTYPE_PCI) {
+                memset(out, 0, sizeof(struct ssb_sprom));
+                snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
+                         bus->host_pci->bus->number + 1,
+                         PCI_SLOT(bus->host_pci->devfn));
+                bcm47xx_fill_sprom(out, prefix, false);
+                return 0;
+        } else {
+                pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
+                return -EINVAL;
+        }
+}
+#endif
+
+#if defined(CONFIG_BCM47XX_BCMA)
+static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+{
+        char prefix[10];
+        struct bcma_device *core;
+
+        switch (bus->hosttype) {
+        case BCMA_HOSTTYPE_PCI:
+                memset(out, 0, sizeof(struct ssb_sprom));
+                snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
+                         bus->host_pci->bus->number + 1,
+                         PCI_SLOT(bus->host_pci->devfn));
+                bcm47xx_fill_sprom(out, prefix, false);
+                return 0;
+        case BCMA_HOSTTYPE_SOC:
+                memset(out, 0, sizeof(struct ssb_sprom));
+                core = bcma_find_core(bus, BCMA_CORE_80211);
+                if (core) {
+                        snprintf(prefix, sizeof(prefix), "sb/%u/",
+                                 core->core_index);
+                        bcm47xx_fill_sprom(out, prefix, true);
+                } else {
+                        bcm47xx_fill_sprom(out, NULL, false);
+                }
+                return 0;
+        default:
+                pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
+                return -EINVAL;
+        }
+}
+#endif
+
+/*
+ * On bcm47xx we need to register SPROM fallback handler very early, so we can't
+ * use anything like platform device / driver for this.
+ */
+void bcm47xx_sprom_register_fallbacks(void)
+{
+#if defined(CONFIG_BCM47XX_SSB)
+        if (ssb_arch_register_fallback_sprom(&bcm47xx_get_sprom_ssb))
+                pr_warn("Failed to registered ssb SPROM handler\n");
+#endif
+
+#if defined(CONFIG_BCM47XX_BCMA)
+        if (bcma_arch_register_fallback_sprom(&bcm47xx_get_sprom_bcma))
+                pr_warn("Failed to registered bcma SPROM handler\n");
+#endif
+}
diff --git a/arch/mips/bcm63xx/cpu.c b/arch/mips/bcm63xx/cpu.c
index 536f64443031..307ec8b8e41c 100644
--- a/arch/mips/bcm63xx/cpu.c
+++ b/arch/mips/bcm63xx/cpu.c
@@ -263,7 +263,7 @@ static unsigned int detect_memory_size(void)
 
         if (BCMCPU_IS_6345()) {
                 val = bcm_sdram_readl(SDRAM_MBASE_REG);
-                return (val * 8 * 1024 * 1024);
+                return val * 8 * 1024 * 1024;
         }
 
         if (BCMCPU_IS_6338() || BCMCPU_IS_6348()) {
diff --git a/arch/mips/boot/dts/Makefile b/arch/mips/boot/dts/Makefile
index ca9c90e2cabf..4f49fa477f14 100644
--- a/arch/mips/boot/dts/Makefile
+++ b/arch/mips/boot/dts/Makefile
@@ -1,3 +1,4 @@
+dtb-$(CONFIG_BCM3384)                   += bcm93384wvg.dtb
 dtb-$(CONFIG_CAVIUM_OCTEON_SOC)         += octeon_3xxx.dtb octeon_68xx.dtb
 dtb-$(CONFIG_DT_EASY50712)              += easy50712.dtb
 dtb-$(CONFIG_DT_XLP_EVP)                += xlp_evp.dtb
diff --git a/arch/mips/boot/dts/bcm3384.dtsi b/arch/mips/boot/dts/bcm3384.dtsi
new file mode 100644
index 000000000000..21b074a99c94
--- /dev/null
+++ b/arch/mips/boot/dts/bcm3384.dtsi
@@ -0,0 +1,109 @@
+/ {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        compatible = "brcm,bcm3384", "brcm,bcm33843";
+
+        cpus {
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                /* On BMIPS5000 this is 1/8th of the CPU core clock */
+                mips-hpt-frequency = <100000000>;
+
+                cpu@0 {
+                        compatible = "brcm,bmips5000";
+                        device_type = "cpu";
+                        reg = <0>;
+                };
+
+                cpu@1 {
+                        compatible = "brcm,bmips5000";
+                        device_type = "cpu";
+                        reg = <1>;
+                };
+        };
+
+        clocks {
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                periph_clk: periph_clk@0 {
+                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
+                        clock-frequency = <54000000>;
+                };
+        };
+
+        aliases {
+                uart0 = &uart0;
+        };
+
+        cpu_intc: cpu_intc@0 {
+                #address-cells = <0>;
+                compatible = "mti,cpu-interrupt-controller";
+
+                interrupt-controller;
+                #interrupt-cells = <1>;
+        };
+
+        periph_intc: periph_intc@14e00038 {
+                compatible = "brcm,bcm3384-intc";
+                reg = <0x14e00038 0x8 0x14e00340 0x8>;
+
+                interrupt-controller;
+                #interrupt-cells = <1>;
+
+                interrupt-parent = <&cpu_intc>;
+                interrupts = <4>;
+        };
+
+        zmips_intc: zmips_intc@104b0060 {
+                compatible = "brcm,bcm3384-intc";
+                reg = <0x104b0060 0x8>;
+
+                interrupt-controller;
+                #interrupt-cells = <1>;
+
+                interrupt-parent = <&periph_intc>;
+                interrupts = <29>;
+        };
+
+        iop_intc: iop_intc@14e00058 {
+                compatible = "brcm,bcm3384-intc";
+                reg = <0x14e00058 0x8>;
+
+                interrupt-controller;
+                #interrupt-cells = <1>;
+
+                interrupt-parent = <&cpu_intc>;
+                interrupts = <6>;
+        };
+
+        uart0: serial@14e00520 {
+                compatible = "brcm,bcm6345-uart";
+                reg = <0x14e00520 0x18>;
+                interrupt-parent = <&periph_intc>;
+                interrupts = <2>;
+                clocks = <&periph_clk>;
+                status = "disabled";
+        };
+
+        ehci0: usb@15400300 {
+                compatible = "brcm,bcm3384-ehci", "generic-ehci";
+                reg = <0x15400300 0x100>;
+                big-endian;
+                interrupt-parent = <&periph_intc>;
+                interrupts = <41>;
+                status = "disabled";
+        };
+
+        ohci0: usb@15400400 {
+                compatible = "brcm,bcm3384-ohci", "generic-ohci";
+                reg = <0x15400400 0x100>;
+                big-endian;
+                no-big-frame-no;
+                interrupt-parent = <&periph_intc>;
+                interrupts = <40>;
+                status = "disabled";
+        };
+};
diff --git a/arch/mips/boot/dts/bcm93384wvg.dts b/arch/mips/boot/dts/bcm93384wvg.dts
new file mode 100644
index 000000000000..831741179212
--- /dev/null
+++ b/arch/mips/boot/dts/bcm93384wvg.dts
@@ -0,0 +1,32 @@
+/dts-v1/;
+
+/include/ "bcm3384.dtsi"
+
+/ {
+        compatible = "brcm,bcm93384wvg", "brcm,bcm3384";
+        model = "Broadcom BCM93384WVG";
+
+        chosen {
+                bootargs = "console=ttyS0,115200";
+                stdout-path = &uart0;
+        };
+
+        memory@0 {
+                device_type = "memory";
+                reg = <0x0 0x04000000>;
+                dma-xor-mask = <0x08000000>;
+                dma-xor-limit = <0x0fffffff>;
+        };
+};
+
+&uart0 {
+        status = "okay";
+};
+
+&ehci0 {
+        status = "okay";
+};
+
+&ohci0 {
+        status = "okay";
+};
diff --git a/arch/mips/cavium-octeon/dma-octeon.c b/arch/mips/cavium-octeon/dma-octeon.c
index 02f244475207..3778655c4a37 100644
--- a/arch/mips/cavium-octeon/dma-octeon.c
+++ b/arch/mips/cavium-octeon/dma-octeon.c
@@ -262,8 +262,8 @@ char *octeon_swiotlb;
 void __init plat_swiotlb_setup(void)
 {
         int i;
-        phys_t max_addr;
-        phys_t addr_size;
+        phys_addr_t max_addr;
+        phys_addr_t addr_size;
         size_t swiotlbsize;
         unsigned long swiotlb_nslabs;
 
diff --git a/arch/mips/cavium-octeon/executive/octeon-model.c b/arch/mips/cavium-octeon/executive/octeon-model.c
index f4c1b36fdf65..e15b049b3bd7 100644
--- a/arch/mips/cavium-octeon/executive/octeon-model.c
+++ b/arch/mips/cavium-octeon/executive/octeon-model.c
@@ -28,22 +28,23 @@
 #include <asm/octeon/octeon.h>
 
 /**
- * Given the chip processor ID from COP0, this function returns a
- * string representing the chip model number. The string is of the
- * form CNXXXXpX.X-FREQ-SUFFIX.
- * - XXXX = The chip model number
- * - X.X = Chip pass number
- * - FREQ = Current frequency in Mhz
- * - SUFFIX = NSP, EXP, SCP, SSP, or CP
- *
- * @chip_id: Chip ID
+ * Read a byte of fuse data
+ * @byte_addr:   address to read
  *
- * Returns Model string
+ * Returns fuse value: 0 or 1
  */
-const char *octeon_model_get_string(uint32_t chip_id)
+static uint8_t __init cvmx_fuse_read_byte(int byte_addr)
 {
-        static char buffer[32];
-        return octeon_model_get_string_buffer(chip_id, buffer);
+        union cvmx_mio_fus_rcmd read_cmd;
+
+        read_cmd.u64 = 0;
+        read_cmd.s.addr = byte_addr;
+        read_cmd.s.pend = 1;
+        cvmx_write_csr(CVMX_MIO_FUS_RCMD, read_cmd.u64);
+        while ((read_cmd.u64 = cvmx_read_csr(CVMX_MIO_FUS_RCMD))
+               && read_cmd.s.pend)
+                ;
+        return read_cmd.s.dat;
 }
 
 /*
@@ -51,7 +52,8 @@ const char *octeon_model_get_string(uint32_t chip_id)
  * as running early in u-boot static/global variables don't work when
  * running from flash.
  */
-const char *octeon_model_get_string_buffer(uint32_t chip_id, char *buffer)
+static const char *__init octeon_model_get_string_buffer(uint32_t chip_id,
+                                                         char *buffer)
 {
         const char *family;
         const char *core_model;
@@ -407,3 +409,22 @@ const char *octeon_model_get_string_buffer(uint32_t chip_id, char *buffer)
         sprintf(buffer, "CN%s%sp%s-%d-%s", family, core_model, pass, clock_mhz, suffix);
         return buffer;
 }
+
+/**
+ * Given the chip processor ID from COP0, this function returns a
+ * string representing the chip model number. The string is of the
+ * form CNXXXXpX.X-FREQ-SUFFIX.
+ * - XXXX = The chip model number
+ * - X.X = Chip pass number
+ * - FREQ = Current frequency in Mhz
+ * - SUFFIX = NSP, EXP, SCP, SSP, or CP
+ *
+ * @chip_id: Chip ID
+ *
+ * Returns Model string
+ */
+const char *__init octeon_model_get_string(uint32_t chip_id)
+{
+        static char buffer[32];
+        return octeon_model_get_string_buffer(chip_id, buffer);
+}
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index 5ebdb32d9a2b..94f888d3384e 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -1092,7 +1092,7 @@ static int __init edac_devinit(void)
                 name = edac_device_names[i];
                 dev = platform_device_register_simple(name, -1, NULL, 0);
                 if (IS_ERR(dev)) {
-                        pr_err("Registation of %s failed!\n", name);
+                        pr_err("Registration of %s failed!\n", name);
                         err = PTR_ERR(dev);
                 }
         }
@@ -1103,7 +1103,7 @@ static int __init edac_devinit(void)
                 dev = platform_device_register_simple("octeon_lmc_edac",
                                                       i, NULL, 0);
                 if (IS_ERR(dev)) {
-                        pr_err("Registation of octeon_lmc_edac %d failed!\n", i);
+                        pr_err("Registration of octeon_lmc_edac %d failed!\n", i);
                         err = PTR_ERR(dev);
                 }
         }
diff --git a/arch/mips/configs/bcm3384_defconfig b/arch/mips/configs/bcm3384_defconfig
new file mode 100644
index 000000000000..88711c28ff32
--- /dev/null
+++ b/arch/mips/configs/bcm3384_defconfig
@@ -0,0 +1,78 @@
+CONFIG_BCM3384=y
+CONFIG_HIGHMEM=y
+CONFIG_SMP=y
+CONFIG_NR_CPUS=4
+# CONFIG_SECCOMP is not set
+CONFIG_MIPS_O32_FP64_SUPPORT=y
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_SWAP is not set
+CONFIG_NO_HZ=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_RD_GZIP is not set
+CONFIG_EXPERT=y
+# CONFIG_VM_EVENT_COUNTERS is not set
+# CONFIG_SLUB_DEBUG is not set
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_PACKET_DIAG=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
+# CONFIG_INET_XFRM_MODE_TUNNEL is not set
+# CONFIG_INET_XFRM_MODE_BEET is not set
+# CONFIG_INET_LRO is not set
+# CONFIG_INET_DIAG is not set
+CONFIG_CFG80211=y
+CONFIG_NL80211_TESTMODE=y
+CONFIG_MAC80211=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_MTD=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_PHYSMAP=y
+# CONFIG_BLK_DEV is not set
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+# CONFIG_SCSI_LOWLEVEL is not set
+CONFIG_NETDEVICES=y
+CONFIG_USB_USBNET=y
+# CONFIG_INPUT is not set
+# CONFIG_SERIO is not set
+# CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
+CONFIG_SERIAL_EARLYCON_FORCE=y
+CONFIG_SERIAL_BCM63XX=y
+CONFIG_SERIAL_BCM63XX_CONSOLE=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HWMON is not set
+CONFIG_USB=y
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_STORAGE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+# CONFIG_DNOTIFY is not set
+CONFIG_FUSE_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_NFS_FS=y
+CONFIG_CIFS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_DEBUG_FS=y
+CONFIG_MAGIC_SYSRQ=y
+# CONFIG_CRYPTO_HW is not set
diff --git a/arch/mips/fw/lib/cmdline.c b/arch/mips/fw/lib/cmdline.c
index ffd0345780ae..6ecda64ad184 100644
--- a/arch/mips/fw/lib/cmdline.c
+++ b/arch/mips/fw/lib/cmdline.c
@@ -68,7 +68,7 @@ char *fw_getenv(char *envname)
                                         result = fw_envp(index + 1);
                                         break;
                                 } else if (fw_envp(index)[i] == '=') {
-                                        result = (fw_envp(index + 1) + i);
+                                        result = fw_envp(index) + i + 1;
                                         break;
                                 }
                         }
@@ -88,13 +88,13 @@ unsigned long fw_getenvl(char *envname)
 {
         unsigned long envl = 0UL;
         char *str;
-        long val;
         int tmp;
 
         str = fw_getenv(envname);
         if (str) {
-                tmp = kstrtol(str, 0, &val);
-                envl = (unsigned long)val;
+                tmp = kstrtoul(str, 0, &envl);
+                if (tmp)
+                        envl = 0;
         }
 
         return envl;
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 6dd6bfc607e9..857da84cfc92 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -17,6 +17,7 @@
 #include <linux/irqflags.h>
 #include <linux/types.h>
 #include <asm/barrier.h>
+#include <asm/compiler.h>
 #include <asm/cpu-features.h>
 #include <asm/cmpxchg.h>
 #include <asm/war.h>
@@ -40,95 +41,97 @@
  */
 #define atomic_set(v, i)                ((v)->counter = (i))
 
-#define ATOMIC_OP(op, c_op, asm_op)                                             \
-static __inline__ void atomic_##op(int i, atomic_t * v)                         \
-{                                                                               \
-        if (kernel_uses_llsc && R10000_LLSC_WAR) {                              \
-                int temp;                                                       \
-                                                                                \
-                __asm__ __volatile__(                                           \
-                "       .set    arch=r4000                              \n"     \
-                "1:     ll      %0, %1          # atomic_" #op "        \n"     \
-                "       " #asm_op " %0, %2                              \n"     \
-                "       sc      %0, %1                                  \n"     \
-                "       beqzl   %0, 1b                                  \n"     \
-                "       .set    mips0                                   \n"     \
-                : "=&r" (temp), "+m" (v->counter)                               \
-                : "Ir" (i));                                                    \
-        } else if (kernel_uses_llsc) {                                          \
-                int temp;                                                       \
-                                                                                \
-                do {                                                            \
-                        __asm__ __volatile__(                                   \
-                        "       .set    arch=r4000                      \n"     \
-                        "       ll      %0, %1          # atomic_" #op "\n"     \
-                        "       " #asm_op " %0, %2                      \n"     \
-                        "       sc      %0, %1                          \n"     \
-                        "       .set    mips0                           \n"     \
-                        : "=&r" (temp), "+m" (v->counter)                       \
-                        : "Ir" (i));                                            \
-                } while (unlikely(!temp));                                      \
-        } else {                                                                \
-                unsigned long flags;                                            \
-                                                                                \
-                raw_local_irq_save(flags);                                      \
-                v->counter c_op i;                                              \
-                raw_local_irq_restore(flags);                                   \
-        }                                                                       \
-}                                                                               \
-
-#define ATOMIC_OP_RETURN(op, c_op, asm_op)                                      \
-static __inline__ int atomic_##op##_return(int i, atomic_t * v)                 \
-{                                                                               \
-        int result;                                                             \
-                                                                                \
-        smp_mb__before_llsc();                                                  \
-                                                                                \
-        if (kernel_uses_llsc && R10000_LLSC_WAR) {                              \
-                int temp;                                                       \
-                                                                                \
-                __asm__ __volatile__(                                           \
-                "       .set    arch=r4000                              \n"     \
-                "1:     ll      %1, %2          # atomic_" #op "_return \n"     \
-                "       " #asm_op " %0, %1, %3                          \n"     \
-                "       sc      %0, %2                                  \n"     \
-                "       beqzl   %0, 1b                                  \n"     \
-                "       " #asm_op " %0, %1, %3                          \n"     \
-                "       .set    mips0                                   \n"     \
-                : "=&r" (result), "=&r" (temp), "+m" (v->counter)               \
-                : "Ir" (i));                                                    \
-        } else if (kernel_uses_llsc) {                                          \
-                int temp;                                                       \
-                                                                                \
-                do {                                                            \
-                        __asm__ __volatile__(                                   \
-                        "       .set    arch=r4000                      \n"     \
-                        "       ll      %1, %2  # atomic_" #op "_return \n"     \
-                        "       " #asm_op " %0, %1, %3                  \n"     \
-                        "       sc      %0, %2                          \n"     \
-                        "       .set    mips0                           \n"     \
-                        : "=&r" (result), "=&r" (temp), "+m" (v->counter)       \
-                        : "Ir" (i));                                            \
-                } while (unlikely(!result));                                    \
-                                                                                \
-                result = temp; result c_op i;                                   \
-        } else {                                                                \
-                unsigned long flags;                                            \
-                                                                                \
-                raw_local_irq_save(flags);                                      \
-                result = v->counter;                                            \
-                result c_op i;                                                  \
-                v->counter = result;                                            \
-                raw_local_irq_restore(flags);                                   \
-        }                                                                       \
-                                                                                \
-        smp_llsc_mb();                                                          \
-                                                                                \
-        return result;                                                          \
+#define ATOMIC_OP(op, c_op, asm_op)                                           \
+static __inline__ void atomic_##op(int i, atomic_t * v)                       \
+{                                                                             \
+        if (kernel_uses_llsc && R10000_LLSC_WAR) {                            \
+                int temp;                                                     \
+                                                                              \
+                __asm__ __volatile__(                                         \
+                "       .set    arch=r4000                              \n"   \
+                "1:     ll      %0, %1          # atomic_" #op "        \n"   \
+                "       " #asm_op " %0, %2                              \n"   \
+                "       sc      %0, %1                                  \n"   \
+                "       beqzl   %0, 1b                                  \n"   \
+                "       .set    mips0                                   \n"   \
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (v->counter)              \
+                : "Ir" (i));                                                  \
+        } else if (kernel_uses_llsc) {                                        \
+                int temp;                                                     \
+                                                                              \
+                do {                                                          \
+                        __asm__ __volatile__(                                 \
+                        "       .set    arch=r4000                      \n"   \
+                        "       ll      %0, %1          # atomic_" #op "\n"   \
+                        "       " #asm_op " %0, %2                      \n"   \
+                        "       sc      %0, %1                          \n"   \
+                        "       .set    mips0                           \n"   \
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (v->counter)      \
+                        : "Ir" (i));                                          \
+                } while (unlikely(!temp));                                    \
+        } else {                                                              \
+                unsigned long flags;                                          \
+                                                                              \
+                raw_local_irq_save(flags);                                    \
+                v->counter c_op i;                                            \
+                raw_local_irq_restore(flags);                                 \
+        }                                                                     \
 }
 
-#define ATOMIC_OPS(op, c_op, asm_op)                                            \
-        ATOMIC_OP(op, c_op, asm_op)                                             \
+#define ATOMIC_OP_RETURN(op, c_op, asm_op)                                    \
+static __inline__ int atomic_##op##_return(int i, atomic_t * v)               \
+{                                                                             \
+        int result;                                                           \
+                                                                              \
+        smp_mb__before_llsc();                                                \
+                                                                              \
+        if (kernel_uses_llsc && R10000_LLSC_WAR) {                            \
+                int temp;                                                     \
+                                                                              \
+                __asm__ __volatile__(                                         \
+                "       .set    arch=r4000                              \n"   \
+                "1:     ll      %1, %2          # atomic_" #op "_return \n"   \
+                "       " #asm_op " %0, %1, %3                          \n"   \
+                "       sc      %0, %2                                  \n"   \
+                "       beqzl   %0, 1b                                  \n"   \
+                "       " #asm_op " %0, %1, %3                          \n"   \
+                "       .set    mips0                                   \n"   \
+                : "=&r" (result), "=&r" (temp),                               \
+                  "+" GCC_OFF12_ASM() (v->counter)                            \
+                : "Ir" (i));                                                  \
+        } else if (kernel_uses_llsc) {                                        \
+                int temp;                                                     \
+                                                                              \
+                do {                                                          \
+                        __asm__ __volatile__(                                 \
+                        "       .set    arch=r4000                      \n"   \
+                        "       ll      %1, %2  # atomic_" #op "_return \n"   \
+                        "       " #asm_op " %0, %1, %3                  \n"   \
+                        "       sc      %0, %2                          \n"   \
+                        "       .set    mips0                           \n"   \
+                        : "=&r" (result), "=&r" (temp),                       \
+                          "+" GCC_OFF12_ASM() (v->counter)                    \
+                        : "Ir" (i));                                          \
+                } while (unlikely(!result));                                  \
+                                                                              \
+                result = temp; result c_op i;                                 \
+        } else {                                                              \
+                unsigned long flags;                                          \
+                                                                              \
+                raw_local_irq_save(flags);                                    \
+                result = v->counter;                                          \
+                result c_op i;                                                \
+                v->counter = result;                                          \
+                raw_local_irq_restore(flags);                                 \
+        }                                                                     \
+                                                                              \
+        smp_llsc_mb();                                                        \
+                                                                              \
+        return result;                                                        \
+}
+
+#define ATOMIC_OPS(op, c_op, asm_op)                                          \
+        ATOMIC_OP(op, c_op, asm_op)                                           \
         ATOMIC_OP_RETURN(op, c_op, asm_op)
 
 ATOMIC_OPS(add, +=, addu)
@@ -167,8 +170,9 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
                 "       .set    reorder                                 \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (result), "=&r" (temp), "+m" (v->counter)
-                : "Ir" (i), "m" (v->counter)
+                : "=&r" (result), "=&r" (temp),
+                  "+" GCC_OFF12_ASM() (v->counter)
+                : "Ir" (i), GCC_OFF12_ASM() (v->counter)
                 : "memory");
         } else if (kernel_uses_llsc) {
                 int temp;
@@ -185,7 +189,8 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
                 "       .set    reorder                                 \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (result), "=&r" (temp), "+m" (v->counter)
+                : "=&r" (result), "=&r" (temp),
+                  "+" GCC_OFF12_ASM() (v->counter)
                 : "Ir" (i));
         } else {
                 unsigned long flags;
@@ -315,96 +320,98 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
  */
 #define atomic64_set(v, i)      ((v)->counter = (i))
 
-#define ATOMIC64_OP(op, c_op, asm_op)                                           \
-static __inline__ void atomic64_##op(long i, atomic64_t * v)                    \
-{                                                                               \
-        if (kernel_uses_llsc && R10000_LLSC_WAR) {                              \
-                long temp;                                                      \
-                                                                                \
-                __asm__ __volatile__(                                           \
-                "       .set    arch=r4000                              \n"     \
-                "1:     lld     %0, %1          # atomic64_" #op "      \n"     \
-                "       " #asm_op " %0, %2                              \n"     \
-                "       scd     %0, %1                                  \n"     \
-                "       beqzl   %0, 1b                                  \n"     \
-                "       .set    mips0                                   \n"     \
-                : "=&r" (temp), "+m" (v->counter)                               \
-                : "Ir" (i));                                                    \
-        } else if (kernel_uses_llsc) {                                          \
-                long temp;                                                      \
-                                                                                \
-                do {                                                            \
-                        __asm__ __volatile__(                                   \
-                        "       .set    arch=r4000                      \n"     \
-                        "       lld     %0, %1          # atomic64_" #op "\n"   \
-                        "       " #asm_op " %0, %2                      \n"     \
-                        "       scd     %0, %1                          \n"     \
-                        "       .set    mips0                           \n"     \
-                        : "=&r" (temp), "+m" (v->counter)                       \
-                        : "Ir" (i));                                            \
-                } while (unlikely(!temp));                                      \
-        } else {                                                                \
-                unsigned long flags;                                            \
-                                                                                \
-                raw_local_irq_save(flags);                                      \
-                v->counter c_op i;                                              \
-                raw_local_irq_restore(flags);                                   \
-        }                                                                       \
-}                                                                               \
-
-#define ATOMIC64_OP_RETURN(op, c_op, asm_op)                                    \
-static __inline__ long atomic64_##op##_return(long i, atomic64_t * v)           \
-{                                                                               \
-        long result;                                                            \
-                                                                                \
-        smp_mb__before_llsc();                                                  \
-                                                                                \
-        if (kernel_uses_llsc && R10000_LLSC_WAR) {                              \
-                long temp;                                                      \
-                                                                                \
-                __asm__ __volatile__(                                           \
-                "       .set    arch=r4000                              \n"     \
-                "1:     lld     %1, %2          # atomic64_" #op "_return\n"    \
-                "       " #asm_op " %0, %1, %3                          \n"     \
-                "       scd     %0, %2                                  \n"     \
-                "       beqzl   %0, 1b                                  \n"     \
-                "       " #asm_op " %0, %1, %3                          \n"     \
-                "       .set    mips0                                   \n"     \
-                : "=&r" (result), "=&r" (temp), "+m" (v->counter)               \
-                : "Ir" (i));                                                    \
-        } else if (kernel_uses_llsc) {                                          \
-                long temp;                                                      \
-                                                                                \
-                do {                                                            \
-                        __asm__ __volatile__(                                   \
-                        "       .set    arch=r4000                      \n"     \
-                        "       lld     %1, %2  # atomic64_" #op "_return\n"    \
-                        "       " #asm_op " %0, %1, %3                  \n"     \
-                        "       scd     %0, %2                          \n"     \
-                        "       .set    mips0                           \n"     \
-                        : "=&r" (result), "=&r" (temp), "=m" (v->counter)       \
-                        : "Ir" (i), "m" (v->counter)                            \
-                        : "memory");                                            \
-                } while (unlikely(!result));                                    \
-                                                                                \
-                result = temp; result c_op i;                                   \
-        } else {                                                                \
-                unsigned long flags;                                            \
-                                                                                \
-                raw_local_irq_save(flags);                                      \
-                result = v->counter;                                            \
-                result c_op i;                                                  \
-                v->counter = result;                                            \
-                raw_local_irq_restore(flags);                                   \
-        }                                                                       \
-                                                                                \
-        smp_llsc_mb();                                                          \
-                                                                                \
-        return result;                                                          \
+#define ATOMIC64_OP(op, c_op, asm_op)                                         \
+static __inline__ void atomic64_##op(long i, atomic64_t * v)                  \
+{                                                                             \
+        if (kernel_uses_llsc && R10000_LLSC_WAR) {                            \
+                long temp;                                                    \
+                                                                              \
+                __asm__ __volatile__(                                         \
+                "       .set    arch=r4000                              \n"   \
+                "1:     lld     %0, %1          # atomic64_" #op "      \n"   \
+                "       " #asm_op " %0, %2                              \n"   \
+                "       scd     %0, %1                                  \n"   \
+                "       beqzl   %0, 1b                                  \n"   \
+                "       .set    mips0                                   \n"   \
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (v->counter)              \
+                : "Ir" (i));                                                  \
+        } else if (kernel_uses_llsc) {                                        \
+                long temp;                                                    \
+                                                                              \
+                do {                                                          \
+                        __asm__ __volatile__(                                 \
+                        "       .set    arch=r4000                      \n"   \
+                        "       lld     %0, %1          # atomic64_" #op "\n" \
+                        "       " #asm_op " %0, %2                      \n"   \
+                        "       scd     %0, %1                          \n"   \
+                        "       .set    mips0                           \n"   \
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (v->counter)      \
+                        : "Ir" (i));                                          \
+                } while (unlikely(!temp));                                    \
+        } else {                                                              \
+                unsigned long flags;                                          \
+                                                                              \
+                raw_local_irq_save(flags);                                    \
+                v->counter c_op i;                                            \
+                raw_local_irq_restore(flags);                                 \
+        }                                                                     \
+}
+
+#define ATOMIC64_OP_RETURN(op, c_op, asm_op)                                  \
+static __inline__ long atomic64_##op##_return(long i, atomic64_t * v)         \
+{                                                                             \
+        long result;                                                          \
+                                                                              \
+        smp_mb__before_llsc();                                                \
+                                                                              \
+        if (kernel_uses_llsc && R10000_LLSC_WAR) {                            \
+                long temp;                                                    \
+                                                                              \
+                __asm__ __volatile__(                                         \
+                "       .set    arch=r4000                              \n"   \
+                "1:     lld     %1, %2          # atomic64_" #op "_return\n"  \
+                "       " #asm_op " %0, %1, %3                          \n"   \
+                "       scd     %0, %2                                  \n"   \
+                "       beqzl   %0, 1b                                  \n"   \
+                "       " #asm_op " %0, %1, %3                          \n"   \
+                "       .set    mips0                                   \n"   \
+                : "=&r" (result), "=&r" (temp),                               \
+                  "+" GCC_OFF12_ASM() (v->counter)                            \
+                : "Ir" (i));                                                  \
+        } else if (kernel_uses_llsc) {                                        \
+                long temp;                                                    \
+                                                                              \
+                do {                                                          \
+                        __asm__ __volatile__(                                 \
+                        "       .set    arch=r4000                      \n"   \
+                        "       lld     %1, %2  # atomic64_" #op "_return\n"  \
+                        "       " #asm_op " %0, %1, %3                  \n"   \
+                        "       scd     %0, %2                          \n"   \
+                        "       .set    mips0                           \n"   \
+                        : "=&r" (result), "=&r" (temp),                       \
+                          "=" GCC_OFF12_ASM() (v->counter)                    \
+                        : "Ir" (i), GCC_OFF12_ASM() (v->counter)              \
+                        : "memory");                                          \
+                } while (unlikely(!result));                                  \
+                                                                              \
+                result = temp; result c_op i;                                 \
+        } else {                                                              \
+                unsigned long flags;                                          \
+                                                                              \
+                raw_local_irq_save(flags);                                    \
+                result = v->counter;                                          \
+                result c_op i;                                                \
+                v->counter = result;                                          \
+                raw_local_irq_restore(flags);                                 \
+        }                                                                     \
+                                                                              \
+        smp_llsc_mb();                                                        \
+                                                                              \
+        return result;                                                        \
 }
 
-#define ATOMIC64_OPS(op, c_op, asm_op)                                          \
-        ATOMIC64_OP(op, c_op, asm_op)                                           \
+#define ATOMIC64_OPS(op, c_op, asm_op)                                        \
+        ATOMIC64_OP(op, c_op, asm_op)                                         \
         ATOMIC64_OP_RETURN(op, c_op, asm_op)
 
 ATOMIC64_OPS(add, +=, daddu)
@@ -415,7 +422,8 @@ ATOMIC64_OPS(sub, -=, dsubu)
 #undef ATOMIC64_OP
 
 /*
- * atomic64_sub_if_positive - conditionally subtract integer from atomic variable
+ * atomic64_sub_if_positive - conditionally subtract integer from atomic
+ *                            variable
  * @i: integer value to subtract
  * @v: pointer of type atomic64_t
  *
@@ -443,8 +451,9 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
                 "       .set    reorder                                 \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (result), "=&r" (temp), "=m" (v->counter)
-                : "Ir" (i), "m" (v->counter)
+                : "=&r" (result), "=&r" (temp),
+                  "=" GCC_OFF12_ASM() (v->counter)
+                : "Ir" (i), GCC_OFF12_ASM() (v->counter)
                 : "memory");
         } else if (kernel_uses_llsc) {
                 long temp;
@@ -461,7 +470,8 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
                 "       .set    reorder                                 \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (result), "=&r" (temp), "+m" (v->counter)
+                : "=&r" (result), "=&r" (temp),
+                  "+" GCC_OFF12_ASM() (v->counter)
                 : "Ir" (i));
         } else {
                 unsigned long flags;
diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
index bae6b0fa8ab5..6663bcca9d0c 100644
--- a/arch/mips/include/asm/bitops.h
+++ b/arch/mips/include/asm/bitops.h
@@ -17,6 +17,7 @@
 #include <linux/types.h>
 #include <asm/barrier.h>
 #include <asm/byteorder.h>              /* sigh ... */
+#include <asm/compiler.h>
 #include <asm/cpu-features.h>
 #include <asm/sgidefs.h>
 #include <asm/war.h>
@@ -78,8 +79,8 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                 "       " __SC  "%0, %1                                 \n"
                 "       beqzl   %0, 1b                                  \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (temp), "=m" (*m)
-                : "ir" (1UL << bit), "m" (*m));
+                : "=&r" (temp), "=" GCC_OFF12_ASM() (*m)
+                : "ir" (1UL << bit), GCC_OFF12_ASM() (*m));
 #ifdef CONFIG_CPU_MIPSR2
         } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
                 do {
@@ -87,7 +88,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                         "       " __LL "%0, %1          # set_bit       \n"
                         "       " __INS "%0, %3, %2, 1                  \n"
                         "       " __SC "%0, %1                          \n"
-                        : "=&r" (temp), "+m" (*m)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                         : "ir" (bit), "r" (~0));
                 } while (unlikely(!temp));
 #endif /* CONFIG_CPU_MIPSR2 */
@@ -99,7 +100,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                         "       or      %0, %2                          \n"
                         "       " __SC  "%0, %1                         \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                         : "ir" (1UL << bit));
                 } while (unlikely(!temp));
         } else
@@ -130,7 +131,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                 "       " __SC "%0, %1                                  \n"
                 "       beqzl   %0, 1b                                  \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (temp), "+m" (*m)
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                 : "ir" (~(1UL << bit)));
 #ifdef CONFIG_CPU_MIPSR2
         } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
@@ -139,7 +140,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                         "       " __LL "%0, %1          # clear_bit     \n"
                         "       " __INS "%0, $0, %2, 1                  \n"
                         "       " __SC "%0, %1                          \n"
-                        : "=&r" (temp), "+m" (*m)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                         : "ir" (bit));
                 } while (unlikely(!temp));
 #endif /* CONFIG_CPU_MIPSR2 */
@@ -151,7 +152,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                         "       and     %0, %2                          \n"
                         "       " __SC "%0, %1                          \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                         : "ir" (~(1UL << bit)));
                 } while (unlikely(!temp));
         } else
@@ -196,7 +197,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
                 "       " __SC  "%0, %1                         \n"
                 "       beqzl   %0, 1b                          \n"
                 "       .set    mips0                           \n"
-                : "=&r" (temp), "+m" (*m)
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                 : "ir" (1UL << bit));
         } else if (kernel_uses_llsc) {
                 unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
@@ -209,7 +210,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
                         "       xor     %0, %2                          \n"
                         "       " __SC  "%0, %1                         \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m)
                         : "ir" (1UL << bit));
                 } while (unlikely(!temp));
         } else
@@ -244,7 +245,7 @@ static inline int test_and_set_bit(unsigned long nr,
                 "       beqzl   %2, 1b                                  \n"
                 "       and     %2, %0, %3                              \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (temp), "+m" (*m), "=&r" (res)
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                 : "r" (1UL << bit)
                 : "memory");
         } else if (kernel_uses_llsc) {
@@ -258,7 +259,7 @@ static inline int test_and_set_bit(unsigned long nr,
                         "       or      %2, %0, %3                      \n"
                         "       " __SC  "%2, %1                         \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m), "=&r" (res)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                         : "r" (1UL << bit)
                         : "memory");
                 } while (unlikely(!res));
@@ -312,7 +313,7 @@ static inline int test_and_set_bit_lock(unsigned long nr,
                         "       or      %2, %0, %3                      \n"
                         "       " __SC  "%2, %1                         \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m), "=&r" (res)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                         : "r" (1UL << bit)
                         : "memory");
                 } while (unlikely(!res));
@@ -354,7 +355,7 @@ static inline int test_and_clear_bit(unsigned long nr,
                 "       beqzl   %2, 1b                                  \n"
                 "       and     %2, %0, %3                              \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (temp), "+m" (*m), "=&r" (res)
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                 : "r" (1UL << bit)
                 : "memory");
 #ifdef CONFIG_CPU_MIPSR2
@@ -368,7 +369,7 @@ static inline int test_and_clear_bit(unsigned long nr,
                         "       " __EXT "%2, %0, %3, 1                  \n"
                         "       " __INS "%0, $0, %3, 1                  \n"
                         "       " __SC  "%0, %1                         \n"
-                        : "=&r" (temp), "+m" (*m), "=&r" (res)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                         : "ir" (bit)
                         : "memory");
                 } while (unlikely(!temp));
@@ -385,7 +386,7 @@ static inline int test_and_clear_bit(unsigned long nr,
                         "       xor     %2, %3                          \n"
                         "       " __SC  "%2, %1                         \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m), "=&r" (res)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                         : "r" (1UL << bit)
                         : "memory");
                 } while (unlikely(!res));
@@ -427,7 +428,7 @@ static inline int test_and_change_bit(unsigned long nr,
                 "       beqzl   %2, 1b                                  \n"
                 "       and     %2, %0, %3                              \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (temp), "+m" (*m), "=&r" (res)
+                : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                 : "r" (1UL << bit)
                 : "memory");
         } else if (kernel_uses_llsc) {
@@ -441,7 +442,7 @@ static inline int test_and_change_bit(unsigned long nr,
                         "       xor     %2, %0, %3                      \n"
                         "       " __SC  "\t%2, %1                       \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (temp), "+m" (*m), "=&r" (res)
+                        : "=&r" (temp), "+" GCC_OFF12_ASM() (*m), "=&r" (res)
                         : "r" (1UL << bit)
                         : "memory");
                 } while (unlikely(!res));
diff --git a/arch/mips/include/asm/bmips.h b/arch/mips/include/asm/bmips.h
index cbaccebf5065..30939b02e3ff 100644
--- a/arch/mips/include/asm/bmips.h
+++ b/arch/mips/include/asm/bmips.h
@@ -84,6 +84,7 @@ extern char bmips_smp_int_vec_end;
 extern int bmips_smp_enabled;
 extern int bmips_cpu_offset;
 extern cpumask_t bmips_booted_mask;
+extern unsigned long bmips_tp1_irqs;
 
 extern void bmips_ebase_setup(void);
 extern asmlinkage void plat_wired_tlb_setup(void);
diff --git a/arch/mips/include/asm/bootinfo.h b/arch/mips/include/asm/bootinfo.h
index 1f7ca8b00404..b603804caac5 100644
--- a/arch/mips/include/asm/bootinfo.h
+++ b/arch/mips/include/asm/bootinfo.h
@@ -70,10 +70,7 @@ enum loongson_machine_type {
         MACH_DEXXON_GDIUM2F10,
         MACH_LEMOTE_NAS,
         MACH_LEMOTE_LL2F,
-        MACH_LEMOTE_A1004,
-        MACH_LEMOTE_A1101,
-        MACH_LEMOTE_A1201,
-        MACH_LEMOTE_A1205,
+        MACH_LOONGSON_GENERIC,
         MACH_LOONGSON_END
 };
 
@@ -101,16 +98,16 @@ extern unsigned long mips_machtype;
 struct boot_mem_map {
         int nr_map;
         struct boot_mem_map_entry {
-                phys_t addr;    /* start of memory segment */
-                phys_t size;    /* size of memory segment */
+                phys_addr_t addr;       /* start of memory segment */
+                phys_addr_t size;       /* size of memory segment */
                 long type;              /* type of memory segment */
         } map[BOOT_MEM_MAP_MAX];
 };
 
 extern struct boot_mem_map boot_mem_map;
 
-extern void add_memory_region(phys_t start, phys_t size, long type);
-extern void detect_memory_region(phys_t start, phys_t sz_min,  phys_t sz_max);
+extern void add_memory_region(phys_addr_t start, phys_addr_t size, long type);
+extern void detect_memory_region(phys_addr_t start, phys_addr_t sz_min,  phys_addr_t sz_max);
 
 extern void prom_init(void);
 extern void prom_free_prom_memory(void);
diff --git a/arch/mips/include/asm/clock.h b/arch/mips/include/asm/clock.h
index 778e32d817bc..4809c29a4890 100644
--- a/arch/mips/include/asm/clock.h
+++ b/arch/mips/include/asm/clock.h
@@ -35,9 +35,6 @@ struct clk {
 #define CLK_ALWAYS_ENABLED      (1 << 0)
 #define CLK_RATE_PROPAGATES     (1 << 1)
 
-/* Should be defined by processor-specific code */
-void arch_init_clk_ops(struct clk_ops **, int type);
-
 int clk_init(void);
 
 int __clk_enable(struct clk *);
diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
index eefcaa363a87..28b1edf19501 100644
--- a/arch/mips/include/asm/cmpxchg.h
+++ b/arch/mips/include/asm/cmpxchg.h
@@ -10,6 +10,7 @@
 
 #include <linux/bug.h>
 #include <linux/irqflags.h>
+#include <asm/compiler.h>
 #include <asm/war.h>
 
 static inline unsigned long __xchg_u32(volatile int * m, unsigned int val)
@@ -30,8 +31,8 @@ static inline unsigned long __xchg_u32(volatile int * m, unsigned int val)
                 "       sc      %2, %1                                  \n"
                 "       beqzl   %2, 1b                                  \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (retval), "=m" (*m), "=&r" (dummy)
-                : "R" (*m), "Jr" (val)
+                : "=&r" (retval), "=" GCC_OFF12_ASM() (*m), "=&r" (dummy)
+                : GCC_OFF12_ASM() (*m), "Jr" (val)
                 : "memory");
         } else if (kernel_uses_llsc) {
                 unsigned long dummy;
@@ -45,8 +46,9 @@ static inline unsigned long __xchg_u32(volatile int * m, unsigned int val)
                         "       .set    arch=r4000                      \n"
                         "       sc      %2, %1                          \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (retval), "=m" (*m), "=&r" (dummy)
-                        : "R" (*m), "Jr" (val)
+                        : "=&r" (retval), "=" GCC_OFF12_ASM() (*m),
+                          "=&r" (dummy)
+                        : GCC_OFF12_ASM() (*m), "Jr" (val)
                         : "memory");
                 } while (unlikely(!dummy));
         } else {
@@ -80,8 +82,8 @@ static inline __u64 __xchg_u64(volatile __u64 * m, __u64 val)
                 "       scd     %2, %1                                  \n"
                 "       beqzl   %2, 1b                                  \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (retval), "=m" (*m), "=&r" (dummy)
-                : "R" (*m), "Jr" (val)
+                : "=&r" (retval), "=" GCC_OFF12_ASM() (*m), "=&r" (dummy)
+                : GCC_OFF12_ASM() (*m), "Jr" (val)
                 : "memory");
         } else if (kernel_uses_llsc) {
                 unsigned long dummy;
@@ -93,8 +95,9 @@ static inline __u64 __xchg_u64(volatile __u64 * m, __u64 val)
                         "       move    %2, %z4                         \n"
                         "       scd     %2, %1                          \n"
                         "       .set    mips0                           \n"
-                        : "=&r" (retval), "=m" (*m), "=&r" (dummy)
-                        : "R" (*m), "Jr" (val)
+                        : "=&r" (retval), "=" GCC_OFF12_ASM() (*m),
+                          "=&r" (dummy)
+                        : GCC_OFF12_ASM() (*m), "Jr" (val)
                         : "memory");
                 } while (unlikely(!dummy));
         } else {
@@ -155,8 +158,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
                 "       beqzl   $1, 1b                          \n"     \
                 "2:                                             \n"     \
                 "       .set    pop                             \n"     \
-                : "=&r" (__ret), "=R" (*m)                              \
-                : "R" (*m), "Jr" (old), "Jr" (new)                      \
+                : "=&r" (__ret), "=" GCC_OFF12_ASM() (*m)               \
+                : GCC_OFF12_ASM() (*m), "Jr" (old), "Jr" (new)          \
                 : "memory");                                            \
         } else if (kernel_uses_llsc) {                                  \
                 __asm__ __volatile__(                                   \
@@ -172,8 +175,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
                 "       beqz    $1, 1b                          \n"     \
                 "       .set    pop                             \n"     \
                 "2:                                             \n"     \
-                : "=&r" (__ret), "=R" (*m)                              \
-                : "R" (*m), "Jr" (old), "Jr" (new)                      \
+                : "=&r" (__ret), "=" GCC_OFF12_ASM() (*m)               \
+                : GCC_OFF12_ASM() (*m), "Jr" (old), "Jr" (new)          \
                 : "memory");                                            \
         } else {                                                        \
                 unsigned long __flags;                                  \
diff --git a/arch/mips/include/asm/compiler.h b/arch/mips/include/asm/compiler.h
index 71f5c5cfc58a..c73815e0123a 100644
--- a/arch/mips/include/asm/compiler.h
+++ b/arch/mips/include/asm/compiler.h
@@ -16,4 +16,12 @@
 #define GCC_REG_ACCUM "accum"
 #endif
 
+#ifndef CONFIG_CPU_MICROMIPS
+#define GCC_OFF12_ASM() "R"
+#elif __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 9)
+#define GCC_OFF12_ASM() "ZC"
+#else
+#error "microMIPS compilation unsupported with GCC older than 4.9"
+#endif
+
 #endif /* _ASM_COMPILER_H */
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 3325f3eb248c..2897cfafcaf0 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -344,4 +344,8 @@
 # define cpu_has_msa            0
 #endif
 
+#ifndef cpu_has_fre
+# define cpu_has_fre            (cpu_data[0].options & MIPS_CPU_FRE)
+#endif
+
 #endif /* __ASM_CPU_FEATURES_H */
diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h
index dfdc77ed1839..33866fce4d63 100644
--- a/arch/mips/include/asm/cpu.h
+++ b/arch/mips/include/asm/cpu.h
@@ -142,6 +142,7 @@
 #define PRID_IMP_BMIPS3300_BUG  0x0000
 #define PRID_IMP_BMIPS43XX      0xa000
 #define PRID_IMP_BMIPS5000      0x5a00
+#define PRID_IMP_BMIPS5200      0x5b00
 
 #define PRID_REV_BMIPS4380_LO   0x0040
 #define PRID_REV_BMIPS4380_HI   0x006f
@@ -368,6 +369,7 @@ enum cpu_type_enum {
 #define MIPS_CPU_HTW            0x100000000ull /* CPU support Hardware Page Table Walker */
 #define MIPS_CPU_RIXIEX         0x200000000ull /* CPU has unique exception codes for {Read, Execute}-Inhibit exceptions */
 #define MIPS_CPU_MAAR           0x400000000ull /* MAAR(I) registers are present */
+#define MIPS_CPU_FRE            0x800000000ull /* FRE & UFE bits implemented */
 
 /*
  * CPU ASE encodings
diff --git a/arch/mips/include/asm/edac.h b/arch/mips/include/asm/edac.h
index 4da0c1fe30d9..ae6fedcb0060 100644
--- a/arch/mips/include/asm/edac.h
+++ b/arch/mips/include/asm/edac.h
@@ -1,6 +1,8 @@
 #ifndef ASM_EDAC_H
 #define ASM_EDAC_H
 
+#include <asm/compiler.h>
+
 /* ECC atomic, DMA, SMP and interrupt safe scrub function */
 
 static inline void atomic_scrub(void *va, u32 size)
@@ -24,8 +26,8 @@ static inline void atomic_scrub(void *va, u32 size)
                 "       sc      %0, %1                                  \n"
                 "       beqz    %0, 1b                                  \n"
                 "       .set    mips0                                   \n"
-                : "=&r" (temp), "=m" (*virt_addr)
-                : "m" (*virt_addr));
+                : "=&r" (temp), "=" GCC_OFF12_ASM() (*virt_addr)
+                : GCC_OFF12_ASM() (*virt_addr));
 
                 virt_addr++;
         }
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index 1d38fe0edd2d..eb4d95de619c 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -8,6 +8,8 @@
 #ifndef _ASM_ELF_H
 #define _ASM_ELF_H
 
+#include <linux/fs.h>
+#include <uapi/linux/elf.h>
 
 /* ELF header e_flags defines. */
 /* MIPS architecture level. */
@@ -28,6 +30,7 @@
 #define PT_MIPS_REGINFO         0x70000000
 #define PT_MIPS_RTPROC          0x70000001
 #define PT_MIPS_OPTIONS         0x70000002
+#define PT_MIPS_ABIFLAGS        0x70000003
 
 /* Flags in the e_flags field of the header */
 #define EF_MIPS_NOREORDER       0x00000001
@@ -174,6 +177,30 @@ typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 typedef double elf_fpreg_t;
 typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
 
+struct mips_elf_abiflags_v0 {
+        uint16_t version;       /* Version of flags structure */
+        uint8_t isa_level;      /* The level of the ISA: 1-5, 32, 64 */
+        uint8_t isa_rev;        /* The revision of ISA: 0 for MIPS V and below,
+                                   1-n otherwise */
+        uint8_t gpr_size;       /* The size of general purpose registers */
+        uint8_t cpr1_size;      /* The size of co-processor 1 registers */
+        uint8_t cpr2_size;      /* The size of co-processor 2 registers */
+        uint8_t fp_abi;         /* The floating-point ABI */
+        uint32_t isa_ext;       /* Mask of processor-specific extensions */
+        uint32_t ases;          /* Mask of ASEs used */
+        uint32_t flags1;        /* Mask of general flags */
+        uint32_t flags2;
+};
+
+#define MIPS_ABI_FP_ANY         0       /* FP ABI doesn't matter */
+#define MIPS_ABI_FP_DOUBLE      1       /* -mdouble-float */
+#define MIPS_ABI_FP_SINGLE      2       /* -msingle-float */
+#define MIPS_ABI_FP_SOFT        3       /* -msoft-float */
+#define MIPS_ABI_FP_OLD_64      4       /* -mips32r2 -mfp64 */
+#define MIPS_ABI_FP_XX          5       /* -mfpxx */
+#define MIPS_ABI_FP_64          6       /* -mips32r2 -mfp64 */
+#define MIPS_ABI_FP_64A         7       /* -mips32r2 -mfp64 -mno-odd-spreg */
+
 #ifdef CONFIG_32BIT
 
 /*
@@ -262,16 +289,13 @@ extern struct mips_abi mips_abi_n32;
 
 #ifdef CONFIG_32BIT
 
-#define SET_PERSONALITY(ex)                                             \
+#define SET_PERSONALITY2(ex, state)                                     \
 do {                                                                    \
-        if ((ex).e_flags & EF_MIPS_FP64)                                \
-                clear_thread_flag(TIF_32BIT_FPREGS);                    \
-        else                                                            \
-                set_thread_flag(TIF_32BIT_FPREGS);                      \
-                                                                        \
         if (personality(current->personality) != PER_LINUX)             \
                 set_personality(PER_LINUX);                             \
                                                                         \
+        mips_set_personality_fp(state);                                 \
+                                                                        \
         current->thread.abi = &mips_abi;                                \
 } while (0)
 
@@ -291,44 +315,44 @@ do {									\
 #endif
 
 #ifdef CONFIG_MIPS32_O32
-#define __SET_PERSONALITY32_O32(ex)                                     \
+#define __SET_PERSONALITY32_O32(ex, state)                              \
         do {                                                            \
                 set_thread_flag(TIF_32BIT_REGS);                        \
                 set_thread_flag(TIF_32BIT_ADDR);                        \
                                                                         \
-                if (!((ex).e_flags & EF_MIPS_FP64))                     \
-                        set_thread_flag(TIF_32BIT_FPREGS);              \
+                mips_set_personality_fp(state);                         \
                                                                         \
                 current->thread.abi = &mips_abi_32;                     \
         } while (0)
 #else
-#define __SET_PERSONALITY32_O32(ex)                                     \
+#define __SET_PERSONALITY32_O32(ex, state)                              \
         do { } while (0)
 #endif
 
 #ifdef CONFIG_MIPS32_COMPAT
-#define __SET_PERSONALITY32(ex)                                         \
+#define __SET_PERSONALITY32(ex, state)                                  \
 do {                                                                    \
         if ((((ex).e_flags & EF_MIPS_ABI2) != 0) &&                     \
              ((ex).e_flags & EF_MIPS_ABI) == 0)                         \
                 __SET_PERSONALITY32_N32();                              \
         else                                                            \
-                __SET_PERSONALITY32_O32(ex);                            \
+                __SET_PERSONALITY32_O32(ex, state);                     \
 } while (0)
 #else
-#define __SET_PERSONALITY32(ex) do { } while (0)
+#define __SET_PERSONALITY32(ex, state) do { } while (0)
 #endif
 
-#define SET_PERSONALITY(ex)                                             \
+#define SET_PERSONALITY2(ex, state)                                     \
 do {                                                                    \
         unsigned int p;                                                 \
                                                                         \
         clear_thread_flag(TIF_32BIT_REGS);                              \
         clear_thread_flag(TIF_32BIT_FPREGS);                            \
+        clear_thread_flag(TIF_HYBRID_FPREGS);                           \
         clear_thread_flag(TIF_32BIT_ADDR);                              \
                                                                         \
         if ((ex).e_ident[EI_CLASS] == ELFCLASS32)                       \
-                __SET_PERSONALITY32(ex);                                \
+                __SET_PERSONALITY32(ex, state);                         \
         else                                                            \
                 current->thread.abi = &mips_abi;                        \
                                                                         \
@@ -390,4 +414,24 @@ struct mm_struct;
 extern unsigned long arch_randomize_brk(struct mm_struct *mm);
 #define arch_randomize_brk arch_randomize_brk
 
+struct arch_elf_state {
+        int fp_abi;
+        int interp_fp_abi;
+        int overall_abi;
+};
+
+#define INIT_ARCH_ELF_STATE {                   \
+        .fp_abi = -1,                           \
+        .interp_fp_abi = -1,                    \
+        .overall_abi = -1,                      \
+}
+
+extern int arch_elf_pt_proc(void *ehdr, void *phdr, struct file *elf,
+                            bool is_interp, struct arch_elf_state *state);
+
+extern int arch_check_elf(void *ehdr, bool has_interpreter,
+                          struct arch_elf_state *state);
+
+extern void mips_set_personality_fp(struct arch_elf_state *state);
+
 #endif /* _ASM_ELF_H */
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index dd562414cd5e..994d21939676 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -36,14 +36,16 @@ extern void _restore_fp(struct task_struct *);
 
 /*
  * This enum specifies a mode in which we want the FPU to operate, for cores
- * which implement the Status.FR bit. Note that FPU_32BIT & FPU_64BIT
- * purposefully have the values 0 & 1 respectively, so that an integer value
- * of Status.FR can be trivially casted to the corresponding enum fpu_mode.
+ * which implement the Status.FR bit. Note that the bottom bit of the value
+ * purposefully matches the desired value of the Status.FR bit.
  */
 enum fpu_mode {
         FPU_32BIT = 0,          /* FR = 0 */
-        FPU_64BIT,              /* FR = 1 */
+        FPU_64BIT,              /* FR = 1, FRE = 0 */
         FPU_AS_IS,
+        FPU_HYBRID,             /* FR = 1, FRE = 1 */
+
+#define FPU_FR_MASK             0x1
 };
 
 static inline int __enable_fpu(enum fpu_mode mode)
@@ -57,6 +59,14 @@ static inline int __enable_fpu(enum fpu_mode mode)
                 enable_fpu_hazard();
                 return 0;
 
+        case FPU_HYBRID:
+                if (!cpu_has_fre)
+                        return SIGFPE;
+
+                /* set FRE */
+                write_c0_config5(read_c0_config5() | MIPS_CONF5_FRE);
+                goto fr_common;
+
         case FPU_64BIT:
 #if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_64BIT))
                 /* we only have a 32-bit FPU */
@@ -64,8 +74,11 @@ static inline int __enable_fpu(enum fpu_mode mode)
 #endif
                 /* fall through */
         case FPU_32BIT:
+                /* clear FRE */
+                write_c0_config5(read_c0_config5() & ~MIPS_CONF5_FRE);
+fr_common:
                 /* set CU1 & change FR appropriately */
-                fr = (int)mode;
+                fr = (int)mode & FPU_FR_MASK;
                 change_c0_status(ST0_CU1 | ST0_FR, ST0_CU1 | (fr ? ST0_FR : 0));
                 enable_fpu_hazard();
 
@@ -102,13 +115,17 @@ static inline int __own_fpu(void)
         enum fpu_mode mode;
         int ret;
 
-        mode = !test_thread_flag(TIF_32BIT_FPREGS);
+        if (test_thread_flag(TIF_HYBRID_FPREGS))
+                mode = FPU_HYBRID;
+        else
+                mode = !test_thread_flag(TIF_32BIT_FPREGS);
+
         ret = __enable_fpu(mode);
         if (ret)
                 return ret;
 
         KSTK_STATUS(current) |= ST0_CU1;
-        if (mode == FPU_64BIT)
+        if (mode == FPU_64BIT || mode == FPU_HYBRID)
                 KSTK_STATUS(current) |= ST0_FR;
         else /* mode == FPU_32BIT */
                 KSTK_STATUS(current) &= ~ST0_FR;
@@ -166,8 +183,24 @@ static inline int init_fpu(void)
 
         if (cpu_has_fpu) {
                 ret = __own_fpu();
-                if (!ret)
+                if (!ret) {
+                        unsigned int config5 = read_c0_config5();
+
+                        /*
+                         * Ensure FRE is clear whilst running _init_fpu, since
+                         * single precision FP instructions are used. If FRE
+                         * was set then we'll just end up initialising all 32
+                         * 64b registers.
+                         */
+                        write_c0_config5(config5 & ~MIPS_CONF5_FRE);
+                        enable_fpu_hazard();
+
                         _init_fpu();
+
+                        /* Restore FRE */
+                        write_c0_config5(config5);
+                        enable_fpu_hazard();
+                }
         } else
                 fpu_emulator_init_fpu();
 
diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h
index 194cda0396a3..ef9987a61d88 100644
--- a/arch/mips/include/asm/futex.h
+++ b/arch/mips/include/asm/futex.h
@@ -14,6 +14,7 @@
 #include <linux/uaccess.h>
 #include <asm/asm-eva.h>
 #include <asm/barrier.h>
+#include <asm/compiler.h>
 #include <asm/errno.h>
 #include <asm/war.h>
 
@@ -32,6 +33,7 @@
                 "       beqzl   $1, 1b                          \n"     \
                 __WEAK_LLSC_MB                                          \
                 "3:                                             \n"     \
+                "       .insn                                   \n"     \
                 "       .set    pop                             \n"     \
                 "       .set    mips0                           \n"     \
                 "       .section .fixup,\"ax\"                  \n"     \
@@ -42,8 +44,10 @@
                 "       "__UA_ADDR "\t1b, 4b                    \n"     \
                 "       "__UA_ADDR "\t2b, 4b                    \n"     \
                 "       .previous                               \n"     \
-                : "=r" (ret), "=&r" (oldval), "=R" (*uaddr)             \
-                : "0" (0), "R" (*uaddr), "Jr" (oparg), "i" (-EFAULT)    \
+                : "=r" (ret), "=&r" (oldval),                           \
+                  "=" GCC_OFF12_ASM() (*uaddr)                          \
+                : "0" (0), GCC_OFF12_ASM() (*uaddr), "Jr" (oparg),      \
+                  "i" (-EFAULT)                                         \
                 : "memory");                                            \
         } else if (cpu_has_llsc) {                                      \
                 __asm__ __volatile__(                                   \
@@ -58,6 +62,7 @@
                 "       beqz    $1, 1b                          \n"     \
                 __WEAK_LLSC_MB                                          \
                 "3:                                             \n"     \
+                "       .insn                                   \n"     \
                 "       .set    pop                             \n"     \
                 "       .set    mips0                           \n"     \
                 "       .section .fixup,\"ax\"                  \n"     \
@@ -68,8 +73,10 @@
                 "       "__UA_ADDR "\t1b, 4b                    \n"     \
                 "       "__UA_ADDR "\t2b, 4b                    \n"     \
                 "       .previous                               \n"     \
-                : "=r" (ret), "=&r" (oldval), "=R" (*uaddr)             \
-                : "0" (0), "R" (*uaddr), "Jr" (oparg), "i" (-EFAULT)    \
+                : "=r" (ret), "=&r" (oldval),                           \
+                  "=" GCC_OFF12_ASM() (*uaddr)                          \
+                : "0" (0), GCC_OFF12_ASM() (*uaddr), "Jr" (oparg),      \
+                  "i" (-EFAULT)                                         \
                 : "memory");                                            \
         } else                                                          \
                 ret = -ENOSYS;                                          \
@@ -157,6 +164,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 "       beqzl   $1, 1b                                  \n"
                 __WEAK_LLSC_MB
                 "3:                                                     \n"
+                "       .insn                                           \n"
                 "       .set    pop                                     \n"
                 "       .section .fixup,\"ax\"                          \n"
                 "4:     li      %0, %6                                  \n"
@@ -166,8 +174,9 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 "       "__UA_ADDR "\t1b, 4b                            \n"
                 "       "__UA_ADDR "\t2b, 4b                            \n"
                 "       .previous                                       \n"
-                : "+r" (ret), "=&r" (val), "=R" (*uaddr)
-                : "R" (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT)
+                : "+r" (ret), "=&r" (val), "=" GCC_OFF12_ASM() (*uaddr)
+                : GCC_OFF12_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval),
+                  "i" (-EFAULT)
                 : "memory");
         } else if (cpu_has_llsc) {
                 __asm__ __volatile__(
@@ -184,6 +193,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 "       beqz    $1, 1b                                  \n"
                 __WEAK_LLSC_MB
                 "3:                                                     \n"
+                "       .insn                                           \n"
                 "       .set    pop                                     \n"
                 "       .section .fixup,\"ax\"                          \n"
                 "4:     li      %0, %6                                  \n"
@@ -193,8 +203,9 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 "       "__UA_ADDR "\t1b, 4b                            \n"
                 "       "__UA_ADDR "\t2b, 4b                            \n"
                 "       .previous                                       \n"
-                : "+r" (ret), "=&r" (val), "=R" (*uaddr)
-                : "R" (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT)
+                : "+r" (ret), "=&r" (val), "=" GCC_OFF12_ASM() (*uaddr)
+                : GCC_OFF12_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval),
+                  "i" (-EFAULT)
                 : "memory");
         } else
                 return -ENOSYS;
diff --git a/arch/mips/include/asm/hpet.h b/arch/mips/include/asm/hpet.h
new file mode 100644
index 000000000000..18a8f778bfaa
--- /dev/null
+++ b/arch/mips/include/asm/hpet.h
@@ -0,0 +1,73 @@
+#ifndef _ASM_HPET_H
+#define _ASM_HPET_H
+
+#ifdef CONFIG_RS780_HPET
+
+#define HPET_MMAP_SIZE          1024
+
+#define HPET_ID                 0x000
+#define HPET_PERIOD             0x004
+#define HPET_CFG                0x010
+#define HPET_STATUS             0x020
+#define HPET_COUNTER    0x0f0
+
+#define HPET_Tn_CFG(n)          (0x100 + 0x20 * n)
+#define HPET_Tn_CMP(n)          (0x108 + 0x20 * n)
+#define HPET_Tn_ROUTE(n)        (0x110 + 0x20 * n)
+
+#define HPET_T0_IRS             0x001
+#define HPET_T1_IRS             0x002
+#define HPET_T3_IRS             0x004
+
+#define HPET_T0_CFG             0x100
+#define HPET_T0_CMP             0x108
+#define HPET_T0_ROUTE   0x110
+#define HPET_T1_CFG             0x120
+#define HPET_T1_CMP             0x128
+#define HPET_T1_ROUTE   0x130
+#define HPET_T2_CFG             0x140
+#define HPET_T2_CMP             0x148
+#define HPET_T2_ROUTE   0x150
+
+#define HPET_ID_REV                     0x000000ff
+#define HPET_ID_NUMBER          0x00001f00
+#define HPET_ID_64BIT           0x00002000
+#define HPET_ID_LEGSUP          0x00008000
+#define HPET_ID_VENDOR          0xffff0000
+#define HPET_ID_NUMBER_SHIFT    8
+#define HPET_ID_VENDOR_SHIFT    16
+
+#define HPET_CFG_ENABLE         0x001
+#define HPET_CFG_LEGACY         0x002
+#define HPET_LEGACY_8254                2
+#define HPET_LEGACY_RTC         8
+
+#define HPET_TN_LEVEL           0x0002
+#define HPET_TN_ENABLE          0x0004
+#define HPET_TN_PERIODIC        0x0008
+#define HPET_TN_PERIODIC_CAP    0x0010
+#define HPET_TN_64BIT_CAP       0x0020
+#define HPET_TN_SETVAL          0x0040
+#define HPET_TN_32BIT           0x0100
+#define HPET_TN_ROUTE           0x3e00
+#define HPET_TN_FSB                     0x4000
+#define HPET_TN_FSB_CAP         0x8000
+#define HPET_TN_ROUTE_SHIFT     9
+
+/* Max HPET Period is 10^8 femto sec as in HPET spec */
+#define HPET_MAX_PERIOD         100000000UL
+/*
+ * Min HPET period is 10^5 femto sec just for safety. If it is less than this,
+ * then 32 bit HPET counter wrapsaround in less than 0.5 sec.
+ */
+#define HPET_MIN_PERIOD         100000UL
+
+#define HPET_ADDR               0x20000
+#define HPET_MMIO_ADDR  0x90000e0000020000
+#define HPET_FREQ               14318780
+#define HPET_COMPARE_VAL        ((HPET_FREQ + HZ / 2) / HZ)
+#define HPET_T0_IRQ             0
+
+extern void __init setup_hpet_timer(void);
+#endif /* CONFIG_RS780_HPET */
+#endif /* _ASM_HPET_H */
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index 933b50e125a0..9e777cd42b67 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -167,7 +167,7 @@ static inline void * isa_bus_to_virt(unsigned long address)
  */
 #define page_to_phys(page)      ((dma_addr_t)page_to_pfn(page) << PAGE_SHIFT)
 
-extern void __iomem * __ioremap(phys_t offset, phys_t size, unsigned long flags);
+extern void __iomem * __ioremap(phys_addr_t offset, phys_addr_t size, unsigned long flags);
 extern void __iounmap(const volatile void __iomem *addr);
 
 #ifndef CONFIG_PCI
@@ -175,7 +175,7 @@ struct pci_dev;
 static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) {}
 #endif
 
-static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
+static inline void __iomem * __ioremap_mode(phys_addr_t offset, unsigned long size,
         unsigned long flags)
 {
         void __iomem *addr = plat_ioremap(offset, size, flags);
@@ -183,7 +183,7 @@ static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
         if (addr)
                 return addr;
 
-#define __IS_LOW512(addr) (!((phys_t)(addr) & (phys_t) ~0x1fffffffULL))
+#define __IS_LOW512(addr) (!((phys_addr_t)(addr) & (phys_addr_t) ~0x1fffffffULL))
 
         if (cpu_has_64bit_addresses) {
                 u64 base = UNCAC_BASE;
@@ -197,7 +197,7 @@ static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
                 return (void __iomem *) (unsigned long) (base + offset);
         } else if (__builtin_constant_p(offset) &&
                    __builtin_constant_p(size) && __builtin_constant_p(flags)) {
-                phys_t phys_addr, last_addr;
+                phys_addr_t phys_addr, last_addr;
 
                 phys_addr = fixup_bigphys_addr(offset, size);
 
diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 39f07aec640c..5a4e1bb8fb1b 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -48,4 +48,7 @@ extern int cp0_compare_irq;
 extern int cp0_compare_irq_shift;
 extern int cp0_perfcount_irq;
 
+void arch_trigger_all_cpu_backtrace(bool);
+#define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
+
 #endif /* _ASM_IRQ_H */
diff --git a/arch/mips/include/asm/irq_cpu.h b/arch/mips/include/asm/irq_cpu.h
index 3f11fdb3ed8c..39a160bb41dc 100644
--- a/arch/mips/include/asm/irq_cpu.h
+++ b/arch/mips/include/asm/irq_cpu.h
@@ -19,8 +19,8 @@ extern void rm9k_cpu_irq_init(void);
 
 #ifdef CONFIG_IRQ_DOMAIN
 struct device_node;
-extern int mips_cpu_intc_init(struct device_node *of_node,
-                              struct device_node *parent);
+extern int mips_cpu_irq_of_init(struct device_node *of_node,
+                                struct device_node *parent);
 #endif
 
 #endif /* _ASM_IRQ_CPU_H */
diff --git a/arch/mips/include/asm/mach-ath25/ath25_platform.h b/arch/mips/include/asm/mach-ath25/ath25_platform.h
new file mode 100644
index 000000000000..4f4ee4f9e5ec
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath25/ath25_platform.h
@@ -0,0 +1,73 @@
+#ifndef __ASM_MACH_ATH25_PLATFORM_H
+#define __ASM_MACH_ATH25_PLATFORM_H
+
+#include <linux/etherdevice.h>
+
+/*
+ * This is board-specific data that is stored in a "fixed" location in flash.
+ * It is shared across operating systems, so it should not be changed lightly.
+ * The main reason we need it is in order to extract the ethernet MAC
+ * address(es).
+ */
+struct ath25_boarddata {
+        u32 magic;                   /* board data is valid */
+#define ATH25_BD_MAGIC 0x35333131    /* "5311", for all 531x/231x platforms */
+        u16 cksum;                   /* checksum (starting with BD_REV 2) */
+        u16 rev;                     /* revision of this struct */
+#define BD_REV 4
+        char board_name[64];         /* Name of board */
+        u16 major;                   /* Board major number */
+        u16 minor;                   /* Board minor number */
+        u32 flags;                   /* Board configuration */
+#define BD_ENET0        0x00000001   /* ENET0 is stuffed */
+#define BD_ENET1        0x00000002   /* ENET1 is stuffed */
+#define BD_UART1        0x00000004   /* UART1 is stuffed */
+#define BD_UART0        0x00000008   /* UART0 is stuffed (dma) */
+#define BD_RSTFACTORY   0x00000010   /* Reset factory defaults stuffed */
+#define BD_SYSLED       0x00000020   /* System LED stuffed */
+#define BD_EXTUARTCLK   0x00000040   /* External UART clock */
+#define BD_CPUFREQ      0x00000080   /* cpu freq is valid in nvram */
+#define BD_SYSFREQ      0x00000100   /* sys freq is set in nvram */
+#define BD_WLAN0        0x00000200   /* Enable WLAN0 */
+#define BD_MEMCAP       0x00000400   /* CAP SDRAM @ mem_cap for testing */
+#define BD_DISWATCHDOG  0x00000800   /* disable system watchdog */
+#define BD_WLAN1        0x00001000   /* Enable WLAN1 (ar5212) */
+#define BD_ISCASPER     0x00002000   /* FLAG for AR2312 */
+#define BD_WLAN0_2G_EN  0x00004000   /* FLAG for radio0_2G */
+#define BD_WLAN0_5G_EN  0x00008000   /* FLAG for radio0_2G */
+#define BD_WLAN1_2G_EN  0x00020000   /* FLAG for radio0_2G */
+#define BD_WLAN1_5G_EN  0x00040000   /* FLAG for radio0_2G */
+        u16 reset_config_gpio;       /* Reset factory GPIO pin */
+        u16 sys_led_gpio;            /* System LED GPIO pin */
+
+        u32 cpu_freq;                /* CPU core frequency in Hz */
+        u32 sys_freq;                /* System frequency in Hz */
+        u32 cnt_freq;                /* Calculated C0_COUNT frequency */
+
+        u8  wlan0_mac[ETH_ALEN];
+        u8  enet0_mac[ETH_ALEN];
+        u8  enet1_mac[ETH_ALEN];
+
+        u16 pci_id;                  /* Pseudo PCIID for common code */
+        u16 mem_cap;                 /* cap bank1 in MB */
+
+        /* version 3 */
+        u8  wlan1_mac[ETH_ALEN];     /* (ar5212) */
+};
+
+#define BOARD_CONFIG_BUFSZ              0x1000
+
+/*
+ * Platform device information for the Wireless MAC
+ */
+struct ar231x_board_config {
+        u16 devid;
+
+        /* board config data */
+        struct ath25_boarddata *config;
+
+        /* radio calibration data */
+        const char *radio;
+};
+
+#endif /* __ASM_MACH_ATH25_PLATFORM_H */
diff --git a/arch/mips/include/asm/mach-ath25/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ath25/cpu-feature-overrides.h
new file mode 100644
index 000000000000..ade0356df257
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath25/cpu-feature-overrides.h
@@ -0,0 +1,64 @@
+/*
+ *  Atheros AR231x/AR531x SoC specific CPU feature overrides
+ *
+ *  Copyright (C) 2008 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This file was derived from: include/asm-mips/cpu-features.h
+ *      Copyright (C) 2003, 2004 Ralf Baechle
+ *      Copyright (C) 2004 Maciej W. Rozycki
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+#ifndef __ASM_MACH_ATH25_CPU_FEATURE_OVERRIDES_H
+#define __ASM_MACH_ATH25_CPU_FEATURE_OVERRIDES_H
+
+/*
+ * The Atheros AR531x/AR231x SoCs have MIPS 4Kc/4KEc core.
+ */
+#define cpu_has_tlb                     1
+#define cpu_has_4kex                    1
+#define cpu_has_3k_cache                0
+#define cpu_has_4k_cache                1
+#define cpu_has_tx39_cache              0
+#define cpu_has_sb1_cache               0
+#define cpu_has_fpu                     0
+#define cpu_has_32fpr                   0
+#define cpu_has_counter                 1
+#define cpu_has_ejtag                   1
+
+#if !defined(CONFIG_SOC_AR5312)
+#  define cpu_has_llsc                  1
+#else
+/*
+ * The MIPS 4Kc V0.9 core in the AR5312/AR2312 have problems with the
+ * ll/sc instructions.
+ */
+#  define cpu_has_llsc                  0
+#endif
+
+#define cpu_has_mips16                  0
+#define cpu_has_mdmx                    0
+#define cpu_has_mips3d                  0
+#define cpu_has_smartmips               0
+
+#define cpu_has_mips32r1                1
+
+#if !defined(CONFIG_SOC_AR5312)
+#  define cpu_has_mips32r2              1
+#endif
+
+#define cpu_has_mips64r1                0
+#define cpu_has_mips64r2                0
+
+#define cpu_has_dsp                     0
+#define cpu_has_mipsmt                  0
+
+#define cpu_has_64bits                  0
+#define cpu_has_64bit_zero_reg          0
+#define cpu_has_64bit_gp_regs           0
+#define cpu_has_64bit_addresses         0
+
+#endif /* __ASM_MACH_ATH25_CPU_FEATURE_OVERRIDES_H */
diff --git a/arch/mips/include/asm/mach-ath25/dma-coherence.h b/arch/mips/include/asm/mach-ath25/dma-coherence.h
new file mode 100644
index 000000000000..d8009c93a465
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath25/dma-coherence.h
@@ -0,0 +1,82 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2006  Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) 2007  Felix Fietkau <nbd@openwrt.org>
+ *
+ */
+#ifndef __ASM_MACH_ATH25_DMA_COHERENCE_H
+#define __ASM_MACH_ATH25_DMA_COHERENCE_H
+
+#include <linux/device.h>
+
+/*
+ * We need some arbitrary non-zero value to be programmed to the BAR1 register
+ * of PCI host controller to enable DMA. The same value should be used as the
+ * offset to calculate the physical address of DMA buffer for PCI devices.
+ */
+#define AR2315_PCI_HOST_SDRAM_BASEADDR  0x20000000
+
+static inline dma_addr_t ath25_dev_offset(struct device *dev)
+{
+#ifdef CONFIG_PCI
+        extern struct bus_type pci_bus_type;
+
+        if (dev && dev->bus == &pci_bus_type)
+                return AR2315_PCI_HOST_SDRAM_BASEADDR;
+#endif
+        return 0;
+}
+
+static inline dma_addr_t
+plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+{
+        return virt_to_phys(addr) + ath25_dev_offset(dev);
+}
+
+static inline dma_addr_t
+plat_map_dma_mem_page(struct device *dev, struct page *page)
+{
+        return page_to_phys(page) + ath25_dev_offset(dev);
+}
+
+static inline unsigned long
+plat_dma_addr_to_phys(struct device *dev, dma_addr_t dma_addr)
+{
+        return dma_addr - ath25_dev_offset(dev);
+}
+
+static inline void
+plat_unmap_dma_mem(struct device *dev, dma_addr_t dma_addr, size_t size,
+                   enum dma_data_direction direction)
+{
+}
+
+static inline int plat_dma_supported(struct device *dev, u64 mask)
+{
+        return 1;
+}
+
+static inline void plat_extra_sync_for_device(struct device *dev)
+{
+}
+
+static inline int plat_dma_mapping_error(struct device *dev,
+                                         dma_addr_t dma_addr)
+{
+        return 0;
+}
+
+static inline int plat_device_is_coherent(struct device *dev)
+{
+#ifdef CONFIG_DMA_COHERENT
+        return 1;
+#endif
+#ifdef CONFIG_DMA_NONCOHERENT
+        return 0;
+#endif
+}
+
+#endif /* __ASM_MACH_ATH25_DMA_COHERENCE_H */
diff --git a/arch/mips/include/asm/mach-ath25/gpio.h b/arch/mips/include/asm/mach-ath25/gpio.h
new file mode 100644
index 000000000000..713564b8e8ef
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath25/gpio.h
@@ -0,0 +1,16 @@
+#ifndef __ASM_MACH_ATH25_GPIO_H
+#define __ASM_MACH_ATH25_GPIO_H
+
+#include <asm-generic/gpio.h>
+
+#define gpio_get_value __gpio_get_value
+#define gpio_set_value __gpio_set_value
+#define gpio_cansleep __gpio_cansleep
+#define gpio_to_irq __gpio_to_irq
+
+static inline int irq_to_gpio(unsigned irq)
+{
+        return -EINVAL;
+}
+
+#endif  /* __ASM_MACH_ATH25_GPIO_H */
diff --git a/arch/mips/include/asm/mach-ath25/war.h b/arch/mips/include/asm/mach-ath25/war.h
new file mode 100644
index 000000000000..e3a5250ebd67
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath25/war.h
@@ -0,0 +1,25 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
+ */
+#ifndef __ASM_MACH_ATH25_WAR_H
+#define __ASM_MACH_ATH25_WAR_H
+
+#define R4600_V1_INDEX_ICACHEOP_WAR     0
+#define R4600_V1_HIT_CACHEOP_WAR        0
+#define R4600_V2_HIT_CACHEOP_WAR        0
+#define R5432_CP0_INTERRUPT_WAR         0
+#define BCM1250_M3_WAR                  0
+#define SIBYTE_1956_WAR                 0
+#define MIPS4K_ICACHE_REFILL_WAR        0
+#define MIPS_CACHE_SYNC_WAR             0
+#define TX49XX_ICACHE_INDEX_INV_WAR     0
+#define RM9000_CDEX_SMP_WAR             0
+#define ICACHE_REFILLS_WORKAROUND_WAR   0
+#define R10000_LLSC_WAR                 0
+#define MIPS34K_MISSED_ITLB_WAR         0
+
+#endif /* __ASM_MACH_ATH25_WAR_H */
diff --git a/arch/mips/include/asm/mach-au1x00/ioremap.h b/arch/mips/include/asm/mach-au1x00/ioremap.h
index 75a94ad3ac91..99fea1fbb4f5 100644
--- a/arch/mips/include/asm/mach-au1x00/ioremap.h
+++ b/arch/mips/include/asm/mach-au1x00/ioremap.h
@@ -11,10 +11,10 @@
 
 #include <linux/types.h>
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_PCI)
-extern phys_t __fixup_bigphys_addr(phys_t, phys_t);
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_PCI)
+extern phys_addr_t __fixup_bigphys_addr(phys_addr_t, phys_addr_t);
 #else
-static inline phys_t __fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+static inline phys_addr_t __fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         return phys_addr;
 }
@@ -23,12 +23,12 @@ static inline phys_t __fixup_bigphys_addr(phys_t phys_addr, phys_t size)
 /*
  * Allow physical addresses to be fixed up to help 36-bit peripherals.
  */
-static inline phys_t fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+static inline phys_addr_t fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         return __fixup_bigphys_addr(phys_addr, size);
 }
 
-static inline void __iomem *plat_ioremap(phys_t offset, unsigned long size,
+static inline void __iomem *plat_ioremap(phys_addr_t offset, unsigned long size,
         unsigned long flags)
 {
         return NULL;
diff --git a/arch/mips/include/asm/mach-bcm3384/dma-coherence.h b/arch/mips/include/asm/mach-bcm3384/dma-coherence.h
new file mode 100644
index 000000000000..a3be8e50e1f0
--- /dev/null
+++ b/arch/mips/include/asm/mach-bcm3384/dma-coherence.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2006 Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) 2009 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __ASM_MACH_BCM3384_DMA_COHERENCE_H
+#define __ASM_MACH_BCM3384_DMA_COHERENCE_H
+
+struct device;
+
+extern dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size);
+extern dma_addr_t plat_map_dma_mem_page(struct device *dev, struct page *page);
+extern unsigned long plat_dma_addr_to_phys(struct device *dev,
+        dma_addr_t dma_addr);
+
+static inline void plat_unmap_dma_mem(struct device *dev, dma_addr_t dma_addr,
+        size_t size, enum dma_data_direction direction)
+{
+}
+
+static inline int plat_dma_supported(struct device *dev, u64 mask)
+{
+        /*
+         * we fall back to GFP_DMA when the mask isn't all 1s,
+         * so we can't guarantee allocations that must be
+         * within a tighter range than GFP_DMA..
+         */
+        if (mask < DMA_BIT_MASK(24))
+                return 0;
+
+        return 1;
+}
+
+static inline int plat_device_is_coherent(struct device *dev)
+{
+        return 0;
+}
+
+#endif /* __ASM_MACH_BCM3384_DMA_COHERENCE_H */
diff --git a/arch/mips/include/asm/mach-bcm3384/war.h b/arch/mips/include/asm/mach-bcm3384/war.h
new file mode 100644
index 000000000000..59d7599059b0
--- /dev/null
+++ b/arch/mips/include/asm/mach-bcm3384/war.h
@@ -0,0 +1,24 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2002, 2004, 2007 by Ralf Baechle <ralf@linux-mips.org>
+ */
+#ifndef __ASM_MIPS_MACH_BCM3384_WAR_H
+#define __ASM_MIPS_MACH_BCM3384_WAR_H
+
+#define R4600_V1_INDEX_ICACHEOP_WAR     0
+#define R4600_V1_HIT_CACHEOP_WAR        0
+#define R4600_V2_HIT_CACHEOP_WAR        0
+#define R5432_CP0_INTERRUPT_WAR         0
+#define BCM1250_M3_WAR                  0
+#define SIBYTE_1956_WAR                 0
+#define MIPS4K_ICACHE_REFILL_WAR        0
+#define MIPS_CACHE_SYNC_WAR             0
+#define TX49XX_ICACHE_INDEX_INV_WAR     0
+#define ICACHE_REFILLS_WORKAROUND_WAR   0
+#define R10000_LLSC_WAR                 0
+#define MIPS34K_MISSED_ITLB_WAR         0
+
+#endif /* __ASM_MIPS_MACH_BCM3384_WAR_H */
diff --git a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
index 36a3fc1aa3ae..ee59ffe99922 100644
--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
@@ -14,40 +14,8 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 
-struct nvram_header {
-        u32 magic;
-        u32 len;
-        u32 crc_ver_init;       /* 0:7 crc, 8:15 ver, 16:31 sdram_init */
-        u32 config_refresh;     /* 0:15 sdram_config, 16:31 sdram_refresh */
-        u32 config_ncdl;        /* ncdl values for memc */
-};
-
-#define NVRAM_HEADER            0x48534C46      /* 'FLSH' */
-#define NVRAM_VERSION           1
-#define NVRAM_HEADER_SIZE       20
-#define NVRAM_SPACE             0x8000
-
-#define FLASH_MIN               0x00020000      /* Minimum flash size */
-
-#define NVRAM_MAX_VALUE_LEN 255
-#define NVRAM_MAX_PARAM_LEN 64
-
-extern int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len);
-
-static inline void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
-{
-        if (strchr(buf, ':'))
-                sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &macaddr[0],
-                        &macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
-                        &macaddr[5]);
-        else if (strchr(buf, '-'))
-                sscanf(buf, "%hhx-%hhx-%hhx-%hhx-%hhx-%hhx", &macaddr[0],
-                        &macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
-                        &macaddr[5]);
-        else
-                printk(KERN_WARNING "Can not parse mac address: %s\n", buf);
-}
-
+int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
 int bcm47xx_nvram_gpio_pin(const char *name);
 
 #endif /* __BCM47XX_NVRAM_H */
diff --git a/arch/mips/include/asm/mach-bcm63xx/ioremap.h b/arch/mips/include/asm/mach-bcm63xx/ioremap.h
index ff15e3b14e7a..aea6e64b828f 100644
--- a/arch/mips/include/asm/mach-bcm63xx/ioremap.h
+++ b/arch/mips/include/asm/mach-bcm63xx/ioremap.h
@@ -3,12 +3,12 @@
 
 #include <bcm63xx_cpu.h>
 
-static inline phys_t fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+static inline phys_addr_t fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         return phys_addr;
 }
 
-static inline int is_bcm63xx_internal_registers(phys_t offset)
+static inline int is_bcm63xx_internal_registers(phys_addr_t offset)
 {
         switch (bcm63xx_get_cpu_id()) {
         case BCM3368_CPU_ID:
@@ -32,7 +32,7 @@ static inline int is_bcm63xx_internal_registers(phys_t offset)
         return 0;
 }
 
-static inline void __iomem *plat_ioremap(phys_t offset, unsigned long size,
+static inline void __iomem *plat_ioremap(phys_addr_t offset, unsigned long size,
                                          unsigned long flags)
 {
         if (is_bcm63xx_internal_registers(offset))
diff --git a/arch/mips/include/asm/mach-generic/ioremap.h b/arch/mips/include/asm/mach-generic/ioremap.h
index b379938d47f0..513371f7c39c 100644
--- a/arch/mips/include/asm/mach-generic/ioremap.h
+++ b/arch/mips/include/asm/mach-generic/ioremap.h
@@ -15,12 +15,12 @@
  * Allow physical addresses to be fixed up to help peripherals located
  * outside the low 32-bit range -- generic pass-through version.
  */
-static inline phys_t fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+static inline phys_addr_t fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         return phys_addr;
 }
 
-static inline void __iomem *plat_ioremap(phys_t offset, unsigned long size,
+static inline void __iomem *plat_ioremap(phys_addr_t offset, unsigned long size,
         unsigned long flags)
 {
         return NULL;
diff --git a/arch/mips/include/asm/mach-generic/irq.h b/arch/mips/include/asm/mach-generic/irq.h
index 139cd200e79d..050e18bb1a04 100644
--- a/arch/mips/include/asm/mach-generic/irq.h
+++ b/arch/mips/include/asm/mach-generic/irq.h
@@ -36,4 +36,10 @@
 
 #endif /* CONFIG_IRQ_CPU */
 
+#ifdef CONFIG_MIPS_GIC
+#ifndef MIPS_GIC_IRQ_BASE
+#define MIPS_GIC_IRQ_BASE (MIPS_CPU_IRQ_BASE + 8)
+#endif
+#endif /* CONFIG_MIPS_GIC */
+
 #endif /* __ASM_MACH_GENERIC_IRQ_H */
diff --git a/arch/mips/include/asm/mach-lantiq/lantiq.h b/arch/mips/include/asm/mach-lantiq/lantiq.h
index f196cceb7322..4e5ae6523cb4 100644
--- a/arch/mips/include/asm/mach-lantiq/lantiq.h
+++ b/arch/mips/include/asm/mach-lantiq/lantiq.h
@@ -48,6 +48,8 @@ extern struct clk *clk_get_ppe(void);
 extern unsigned char ltq_boot_select(void);
 /* find out what caused the last cpu reset */
 extern int ltq_reset_cause(void);
+/* find out the soc type */
+extern int ltq_soc_type(void);
 
 #define IOPORT_RESOURCE_START   0x10000000
 #define IOPORT_RESOURCE_END     0xffffffff
diff --git a/arch/mips/include/asm/mach-loongson/boot_param.h b/arch/mips/include/asm/mach-loongson/boot_param.h
index 3388fc53599e..fa802926523f 100644
--- a/arch/mips/include/asm/mach-loongson/boot_param.h
+++ b/arch/mips/include/asm/mach-loongson/boot_param.h
@@ -10,7 +10,8 @@
 #define VIDEO_ROM               7
 #define ADAPTER_ROM             8
 #define ACPI_TABLE              9
-#define MAX_MEMORY_TYPE         10
+#define SMBIOS_TABLE            10
+#define MAX_MEMORY_TYPE         11
 
 #define LOONGSON3_BOOT_MEM_MAP_MAX 128
 struct efi_memory_map_loongson {
@@ -42,15 +43,49 @@ struct efi_cpuinfo_loongson {
         u32 processor_id; /* PRID, e.g. 6305, 6306 */
         u32 cputype;  /* Loongson_3A/3B, etc. */
         u32 total_node;   /* num of total numa nodes */
-        u32 cpu_startup_core_id; /* Core id */
+        u16 cpu_startup_core_id; /* Boot core id */
+        u16 reserved_cores_mask;
         u32 cpu_clock_freq; /* cpu_clock */
         u32 nr_cpus;
 } __packed;
 
+#define MAX_UARTS 64
+struct uart_device {
+        u32 iotype; /* see include/linux/serial_core.h */
+        u32 uartclk;
+        u32 int_offset;
+        u64 uart_base;
+} __packed;
+
+#define MAX_SENSORS 64
+#define SENSOR_TEMPER  0x00000001
+#define SENSOR_VOLTAGE 0x00000002
+#define SENSOR_FAN     0x00000004
+struct sensor_device {
+        char name[32];  /* a formal name */
+        char label[64]; /* a flexible description */
+        u32 type;       /* SENSOR_* */
+        u32 id;         /* instance id of a sensor-class */
+        u32 fan_policy; /* see loongson_hwmon.h */
+        u32 fan_percent;/* only for constant speed policy */
+        u64 base_addr;  /* base address of device registers */
+} __packed;
+
 struct system_loongson {
         u16 vers;     /* version of system_loongson */
         u32 ccnuma_smp; /* 0: no numa; 1: has numa */
         u32 sing_double_channel; /* 1:single; 2:double */
+        u32 nr_uarts;
+        struct uart_device uarts[MAX_UARTS];
+        u32 nr_sensors;
+        struct sensor_device sensors[MAX_SENSORS];
+        char has_ec;
+        char ec_name[32];
+        u64 ec_base_addr;
+        char has_tcm;
+        char tcm_name[32];
+        u64 tcm_base_addr;
+        u64 workarounds; /* see workarounds.h */
 } __packed;
 
 struct irq_source_routing_table {
@@ -149,6 +184,8 @@ struct loongson_system_configuration {
         u32 nr_nodes;
         int cores_per_node;
         int cores_per_package;
+        u16 boot_cpu_id;
+        u16 reserved_cpus_mask;
         enum loongson_cpu_type cputype;
         u64 ht_control_base;
         u64 pci_mem_start_addr;
@@ -159,9 +196,15 @@ struct loongson_system_configuration {
         u64 suspend_addr;
         u64 vgabios_addr;
         u32 dma_mask_bits;
+        char ecname[32];
+        u32 nr_uarts;
+        struct uart_device uarts[MAX_UARTS];
+        u32 nr_sensors;
+        struct sensor_device sensors[MAX_SENSORS];
+        u64 workarounds;
 };
 
 extern struct efi_memory_map_loongson *loongson_memmap;
 extern struct loongson_system_configuration loongson_sysconf;
-extern int cpuhotplug_workaround;
+
 #endif
diff --git a/arch/mips/include/asm/mach-loongson/dma-coherence.h b/arch/mips/include/asm/mach-loongson/dma-coherence.h
index 6a902751cc7f..a90534161bd2 100644
--- a/arch/mips/include/asm/mach-loongson/dma-coherence.h
+++ b/arch/mips/include/asm/mach-loongson/dma-coherence.h
@@ -23,7 +23,7 @@ static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
                                           size_t size)
 {
 #ifdef CONFIG_CPU_LOONGSON3
-        return virt_to_phys(addr);
+        return phys_to_dma(dev, virt_to_phys(addr));
 #else
         return virt_to_phys(addr) | 0x80000000;
 #endif
@@ -33,7 +33,7 @@ static inline dma_addr_t plat_map_dma_mem_page(struct device *dev,
                                                struct page *page)
 {
 #ifdef CONFIG_CPU_LOONGSON3
-        return page_to_phys(page);
+        return phys_to_dma(dev, page_to_phys(page));
 #else
         return page_to_phys(page) | 0x80000000;
 #endif
@@ -43,7 +43,7 @@ static inline unsigned long plat_dma_addr_to_phys(struct device *dev,
         dma_addr_t dma_addr)
 {
 #if defined(CONFIG_CPU_LOONGSON3) && defined(CONFIG_64BIT)
-        return dma_addr;
+        return dma_to_phys(dev, dma_addr);
 #elif defined(CONFIG_CPU_LOONGSON2F) && defined(CONFIG_64BIT)
         return (dma_addr > 0x8fffffff) ? dma_addr : (dma_addr & 0x0fffffff);
 #else
diff --git a/arch/mips/include/asm/mach-loongson/irq.h b/arch/mips/include/asm/mach-loongson/irq.h
index 34560bda6626..a281cca5f2fb 100644
--- a/arch/mips/include/asm/mach-loongson/irq.h
+++ b/arch/mips/include/asm/mach-loongson/irq.h
@@ -32,8 +32,7 @@
 #define LOONGSON_INT_ROUTER_LPC         LOONGSON_INT_ROUTER_ENTRY(0x0a)
 #define LOONGSON_INT_ROUTER_HT1(n)      LOONGSON_INT_ROUTER_ENTRY(n + 0x18)
 
-#define LOONGSON_INT_CORE0_INT0         0x11 /* route to int 0 of core 0 */
-#define LOONGSON_INT_CORE0_INT1         0x21 /* route to int 1 of core 0 */
+#define LOONGSON_INT_COREx_INTy(x, y)   (1<<(x) | 1<<(y+4))     /* route to int y of core x */
 
 #endif
 
diff --git a/arch/mips/include/asm/mach-loongson/loongson.h b/arch/mips/include/asm/mach-loongson/loongson.h
index 92bf76c21441..5459ac09679f 100644
--- a/arch/mips/include/asm/mach-loongson/loongson.h
+++ b/arch/mips/include/asm/mach-loongson/loongson.h
@@ -35,7 +35,7 @@ extern void __init prom_init_cmdline(void);
 extern void __init prom_init_machtype(void);
 extern void __init prom_init_env(void);
 #ifdef CONFIG_LOONGSON_UART_BASE
-extern unsigned long _loongson_uart_base, loongson_uart_base;
+extern unsigned long _loongson_uart_base[], loongson_uart_base[];
 extern void prom_init_loongson_uart_base(void);
 #endif
 
diff --git a/arch/mips/include/asm/mach-loongson/loongson_hwmon.h b/arch/mips/include/asm/mach-loongson/loongson_hwmon.h
new file mode 100644
index 000000000000..4431fc54a36c
--- /dev/null
+++ b/arch/mips/include/asm/mach-loongson/loongson_hwmon.h
@@ -0,0 +1,55 @@
+#ifndef __LOONGSON_HWMON_H_
+#define __LOONGSON_HWMON_H_
+
+#include <linux/types.h>
+
+#define MIN_TEMP        0
+#define MAX_TEMP        255
+#define NOT_VALID_TEMP  999
+
+typedef int (*get_temp_fun)(int);
+extern int loongson3_cpu_temp(int);
+
+/* 0:Max speed, 1:Manual, 2:Auto */
+enum fan_control_mode {
+        FAN_FULL_MODE = 0,
+        FAN_MANUAL_MODE = 1,
+        FAN_AUTO_MODE = 2,
+        FAN_MODE_END
+};
+
+struct temp_range {
+        u8 low;
+        u8 high;
+        u8 level;
+};
+
+#define CONSTANT_SPEED_POLICY   0  /* at constent speed */
+#define STEP_SPEED_POLICY       1  /* use up/down arrays to describe policy */
+#define KERNEL_HELPER_POLICY    2  /* kernel as a helper to fan control */
+
+#define MAX_STEP_NUM    16
+#define MAX_FAN_LEVEL   255
+
+/* loongson_fan_policy works when fan work at FAN_AUTO_MODE */
+struct loongson_fan_policy {
+        u8      type;
+
+        /* percent only used when type is CONSTANT_SPEED_POLICY */
+        u8      percent;
+
+        /* period between two check. (Unit: S) */
+        u8      adjust_period;
+
+        /* fan adjust usually depend on a temprature input */
+        get_temp_fun    depend_temp;
+
+        /* up_step/down_step used when type is STEP_SPEED_POLICY */
+        u8      up_step_num;
+        u8      down_step_num;
+        struct temp_range up_step[MAX_STEP_NUM];
+        struct temp_range down_step[MAX_STEP_NUM];
+        struct delayed_work work;
+};
+
+#endif /* __LOONGSON_HWMON_H_*/
diff --git a/arch/mips/include/asm/mach-loongson/machine.h b/arch/mips/include/asm/mach-loongson/machine.h
index 228e37847a36..cb2b60249cd2 100644
--- a/arch/mips/include/asm/mach-loongson/machine.h
+++ b/arch/mips/include/asm/mach-loongson/machine.h
@@ -26,7 +26,7 @@
 
 #ifdef CONFIG_LOONGSON_MACH3X
 
-#define LOONGSON_MACHTYPE MACH_LEMOTE_A1101
+#define LOONGSON_MACHTYPE MACH_LOONGSON_GENERIC
 
 #endif /* CONFIG_LOONGSON_MACH3X */
 
diff --git a/arch/mips/include/asm/mach-loongson/topology.h b/arch/mips/include/asm/mach-loongson/topology.h
index 5598ba77d2ef..0d8f3b55bdbc 100644
--- a/arch/mips/include/asm/mach-loongson/topology.h
+++ b/arch/mips/include/asm/mach-loongson/topology.h
@@ -3,7 +3,7 @@
 
 #ifdef CONFIG_NUMA
 
-#define cpu_to_node(cpu)        ((cpu) >> 2)
+#define cpu_to_node(cpu)        (cpu_logical_map(cpu) >> 2)
 #define parent_node(node)       (node)
 #define cpumask_of_node(node)   (&__node_data[(node)]->cpumask)
 
diff --git a/arch/mips/include/asm/mach-loongson/workarounds.h b/arch/mips/include/asm/mach-loongson/workarounds.h
new file mode 100644
index 000000000000..e180c1422eae
--- /dev/null
+++ b/arch/mips/include/asm/mach-loongson/workarounds.h
@@ -0,0 +1,7 @@
+#ifndef __ASM_MACH_LOONGSON_WORKAROUNDS_H_
+#define __ASM_MACH_LOONGSON_WORKAROUNDS_H_
+
+#define WORKAROUND_CPUFREQ      0x00000001
+#define WORKAROUND_CPUHOTPLUG   0x00000002
+
+#endif
diff --git a/arch/mips/include/asm/mach-loongson1/cpufreq.h b/arch/mips/include/asm/mach-loongson1/cpufreq.h
new file mode 100644
index 000000000000..e7765ce30bcf
--- /dev/null
+++ b/arch/mips/include/asm/mach-loongson1/cpufreq.h
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2014 Zhang, Keguang <keguang.zhang@gmail.com>
+ *
+ * Loongson 1 CPUFreq platform support.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+
+#ifndef __ASM_MACH_LOONGSON1_CPUFREQ_H
+#define __ASM_MACH_LOONGSON1_CPUFREQ_H
+
+struct plat_ls1x_cpufreq {
+        const char      *clk_name;      /* CPU clk */
+        const char      *osc_clk_name;  /* OSC clk */
+        unsigned int    max_freq;       /* in kHz */
+        unsigned int    min_freq;       /* in kHz */
+};
+
+#endif /* __ASM_MACH_LOONGSON1_CPUFREQ_H */
diff --git a/arch/mips/include/asm/mach-loongson1/loongson1.h b/arch/mips/include/asm/mach-loongson1/loongson1.h
index 5c437c2ba6b3..20e0c2b155dd 100644
--- a/arch/mips/include/asm/mach-loongson1/loongson1.h
+++ b/arch/mips/include/asm/mach-loongson1/loongson1.h
@@ -16,6 +16,7 @@
 #define DEFAULT_MEMSIZE                 256     /* If no memsize provided */
 
 /* Loongson 1 Register Bases */
+#define LS1X_MUX_BASE                   0x1fd00420
 #define LS1X_INTC_BASE                  0x1fd01040
 #define LS1X_EHCI_BASE                  0x1fe00000
 #define LS1X_OHCI_BASE                  0x1fe08000
@@ -31,7 +32,10 @@
 #define LS1X_I2C0_BASE                  0x1fe58000
 #define LS1X_I2C1_BASE                  0x1fe68000
 #define LS1X_I2C2_BASE                  0x1fe70000
-#define LS1X_PWM_BASE                   0x1fe5c000
+#define LS1X_PWM0_BASE                  0x1fe5c000
+#define LS1X_PWM1_BASE                  0x1fe5c010
+#define LS1X_PWM2_BASE                  0x1fe5c020
+#define LS1X_PWM3_BASE                  0x1fe5c030
 #define LS1X_WDT_BASE                   0x1fe5c060
 #define LS1X_RTC_BASE                   0x1fe64000
 #define LS1X_AC97_BASE                  0x1fe74000
@@ -39,6 +43,8 @@
 #define LS1X_CLK_BASE                   0x1fe78030
 
 #include <regs-clk.h>
+#include <regs-mux.h>
+#include <regs-pwm.h>
 #include <regs-wdt.h>
 
 #endif /* __ASM_MACH_LOONGSON1_LOONGSON1_H */
diff --git a/arch/mips/include/asm/mach-loongson1/platform.h b/arch/mips/include/asm/mach-loongson1/platform.h
index 30c13e508fff..47de55e0c835 100644
--- a/arch/mips/include/asm/mach-loongson1/platform.h
+++ b/arch/mips/include/asm/mach-loongson1/platform.h
@@ -13,10 +13,12 @@
 
 #include <linux/platform_device.h>
 
-extern struct platform_device ls1x_uart_device;
-extern struct platform_device ls1x_eth0_device;
-extern struct platform_device ls1x_ehci_device;
-extern struct platform_device ls1x_rtc_device;
+extern struct platform_device ls1x_uart_pdev;
+extern struct platform_device ls1x_cpufreq_pdev;
+extern struct platform_device ls1x_eth0_pdev;
+extern struct platform_device ls1x_eth1_pdev;
+extern struct platform_device ls1x_ehci_pdev;
+extern struct platform_device ls1x_rtc_pdev;
 
 extern void __init ls1x_clk_init(void);
 extern void __init ls1x_serial_setup(struct platform_device *pdev);
diff --git a/arch/mips/include/asm/mach-loongson1/regs-clk.h b/arch/mips/include/asm/mach-loongson1/regs-clk.h
index fb6a3ff9318f..ee2445b10fc3 100644
--- a/arch/mips/include/asm/mach-loongson1/regs-clk.h
+++ b/arch/mips/include/asm/mach-loongson1/regs-clk.h
@@ -20,15 +20,32 @@
 
 /* Clock PLL Divisor Register Bits */
 #define DIV_DC_EN                       (0x1 << 31)
+#define DIV_DC_RST                      (0x1 << 30)
 #define DIV_CPU_EN                      (0x1 << 25)
+#define DIV_CPU_RST                     (0x1 << 24)
 #define DIV_DDR_EN                      (0x1 << 19)
+#define DIV_DDR_RST                     (0x1 << 18)
+#define RST_DC_EN                       (0x1 << 5)
+#define RST_DC                          (0x1 << 4)
+#define RST_DDR_EN                      (0x1 << 3)
+#define RST_DDR                         (0x1 << 2)
+#define RST_CPU_EN                      (0x1 << 1)
+#define RST_CPU                         0x1
 
 #define DIV_DC_SHIFT                    26
 #define DIV_CPU_SHIFT                   20
 #define DIV_DDR_SHIFT                   14
 
-#define DIV_DC_WIDTH                    5
-#define DIV_CPU_WIDTH                   5
-#define DIV_DDR_WIDTH                   5
+#define DIV_DC_WIDTH                    4
+#define DIV_CPU_WIDTH                   4
+#define DIV_DDR_WIDTH                   4
+
+#define BYPASS_DC_SHIFT                 12
+#define BYPASS_DDR_SHIFT                10
+#define BYPASS_CPU_SHIFT                8
+
+#define BYPASS_DC_WIDTH                 1
+#define BYPASS_DDR_WIDTH                1
+#define BYPASS_CPU_WIDTH                1
 
 #endif /* __ASM_MACH_LOONGSON1_REGS_CLK_H */
diff --git a/arch/mips/include/asm/mach-loongson1/regs-mux.h b/arch/mips/include/asm/mach-loongson1/regs-mux.h
new file mode 100644
index 000000000000..fb1e36efaa19
--- /dev/null
+++ b/arch/mips/include/asm/mach-loongson1/regs-mux.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2014 Zhang, Keguang <keguang.zhang@gmail.com>
+ *
+ * Loongson 1 MUX Register Definitions.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#ifndef __ASM_MACH_LOONGSON1_REGS_MUX_H
+#define __ASM_MACH_LOONGSON1_REGS_MUX_H
+
+#define LS1X_MUX_REG(x) \
+                ((void __iomem *)KSEG1ADDR(LS1X_MUX_BASE + (x)))
+
+#define LS1X_MUX_CTRL0                  LS1X_MUX_REG(0x0)
+#define LS1X_MUX_CTRL1                  LS1X_MUX_REG(0x4)
+
+/* MUX CTRL0 Register Bits */
+#define UART0_USE_PWM23                 (0x1 << 28)
+#define UART0_USE_PWM01                 (0x1 << 27)
+#define UART1_USE_LCD0_5_6_11           (0x1 << 26)
+#define I2C2_USE_CAN1                   (0x1 << 25)
+#define I2C1_USE_CAN0                   (0x1 << 24)
+#define NAND3_USE_UART5                 (0x1 << 23)
+#define NAND3_USE_UART4                 (0x1 << 22)
+#define NAND3_USE_UART1_DAT             (0x1 << 21)
+#define NAND3_USE_UART1_CTS             (0x1 << 20)
+#define NAND3_USE_PWM23                 (0x1 << 19)
+#define NAND3_USE_PWM01                 (0x1 << 18)
+#define NAND2_USE_UART5                 (0x1 << 17)
+#define NAND2_USE_UART4                 (0x1 << 16)
+#define NAND2_USE_UART1_DAT             (0x1 << 15)
+#define NAND2_USE_UART1_CTS             (0x1 << 14)
+#define NAND2_USE_PWM23                 (0x1 << 13)
+#define NAND2_USE_PWM01                 (0x1 << 12)
+#define NAND1_USE_UART5                 (0x1 << 11)
+#define NAND1_USE_UART4                 (0x1 << 10)
+#define NAND1_USE_UART1_DAT             (0x1 << 9)
+#define NAND1_USE_UART1_CTS             (0x1 << 8)
+#define NAND1_USE_PWM23                 (0x1 << 7)
+#define NAND1_USE_PWM01                 (0x1 << 6)
+#define GMAC1_USE_UART1                 (0x1 << 4)
+#define GMAC1_USE_UART0                 (0x1 << 3)
+#define LCD_USE_UART0_DAT               (0x1 << 2)
+#define LCD_USE_UART15                  (0x1 << 1)
+#define LCD_USE_UART0                   0x1
+
+/* MUX CTRL1 Register Bits */
+#define USB_RESET                       (0x1 << 31)
+#define SPI1_CS_USE_PWM01               (0x1 << 24)
+#define SPI1_USE_CAN                    (0x1 << 23)
+#define DISABLE_DDR_CONFSPACE           (0x1 << 20)
+#define DDR32TO16EN                     (0x1 << 16)
+#define GMAC1_SHUT                      (0x1 << 13)
+#define GMAC0_SHUT                      (0x1 << 12)
+#define USB_SHUT                        (0x1 << 11)
+#define UART1_3_USE_CAN1                (0x1 << 5)
+#define UART1_2_USE_CAN0                (0x1 << 4)
+#define GMAC1_USE_TXCLK                 (0x1 << 3)
+#define GMAC0_USE_TXCLK                 (0x1 << 2)
+#define GMAC1_USE_PWM23                 (0x1 << 1)
+#define GMAC0_USE_PWM01                 0x1
+
+#endif /* __ASM_MACH_LOONGSON1_REGS_MUX_H */
diff --git a/arch/mips/include/asm/mach-loongson1/regs-pwm.h b/arch/mips/include/asm/mach-loongson1/regs-pwm.h
new file mode 100644
index 000000000000..99f2bcc586f0
--- /dev/null
+++ b/arch/mips/include/asm/mach-loongson1/regs-pwm.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2014 Zhang, Keguang <keguang.zhang@gmail.com>
+ *
+ * Loongson 1 PWM Register Definitions.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#ifndef __ASM_MACH_LOONGSON1_REGS_PWM_H
+#define __ASM_MACH_LOONGSON1_REGS_PWM_H
+
+/* Loongson 1 PWM Timer Register Definitions */
+#define PWM_CNT                 0x0
+#define PWM_HRC                 0x4
+#define PWM_LRC                 0x8
+#define PWM_CTRL                0xc
+
+/* PWM Control Register Bits */
+#define CNT_RST                 (0x1 << 7)
+#define INT_SR                  (0x1 << 6)
+#define INT_EN                  (0x1 << 5)
+#define PWM_SINGLE              (0x1 << 4)
+#define PWM_OE                  (0x1 << 3)
+#define CNT_EN                  0x1
+
+#endif /* __ASM_MACH_LOONGSON1_REGS_PWM_H */
diff --git a/arch/mips/include/asm/mach-loongson1/regs-wdt.h b/arch/mips/include/asm/mach-loongson1/regs-wdt.h
index 6574568c2084..c39ee982ad3b 100644
--- a/arch/mips/include/asm/mach-loongson1/regs-wdt.h
+++ b/arch/mips/include/asm/mach-loongson1/regs-wdt.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2011 Zhang, Keguang <keguang.zhang@gmail.com>
  *
- * Loongson 1 watchdog register definitions.
+ * Loongson 1 Watchdog Register Definitions.
  *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
@@ -12,11 +12,8 @@
 #ifndef __ASM_MACH_LOONGSON1_REGS_WDT_H
 #define __ASM_MACH_LOONGSON1_REGS_WDT_H
 
-#define LS1X_WDT_REG(x) \
-                ((void __iomem *)KSEG1ADDR(LS1X_WDT_BASE + (x)))
-
-#define LS1X_WDT_EN                     LS1X_WDT_REG(0x0)
-#define LS1X_WDT_SET                    LS1X_WDT_REG(0x4)
-#define LS1X_WDT_TIMER                  LS1X_WDT_REG(0x8)
+#define WDT_EN                  0x0
+#define WDT_TIMER               0x4
+#define WDT_SET                 0x8
 
 #endif /* __ASM_MACH_LOONGSON1_REGS_WDT_H */
diff --git a/arch/mips/include/asm/mach-malta/irq.h b/arch/mips/include/asm/mach-malta/irq.h
index f2c13d211abb..47cfe64efbb0 100644
--- a/arch/mips/include/asm/mach-malta/irq.h
+++ b/arch/mips/include/asm/mach-malta/irq.h
@@ -2,7 +2,6 @@
 #define __ASM_MACH_MIPS_IRQ_H
 
 
-#define GIC_NUM_INTRS (24 + NR_CPUS * 2)
 #define NR_IRQS 256
 
 #include_next <irq.h>
diff --git a/arch/mips/include/asm/mach-pmcs-msp71xx/msp_regops.h b/arch/mips/include/asm/mach-pmcs-msp71xx/msp_regops.h
index fc946c835995..2e54b4bff5cf 100644
--- a/arch/mips/include/asm/mach-pmcs-msp71xx/msp_regops.h
+++ b/arch/mips/include/asm/mach-pmcs-msp71xx/msp_regops.h
@@ -49,6 +49,7 @@
 
 #include <linux/types.h>
 
+#include <asm/compiler.h>
 #include <asm/war.h>
 
 #ifndef R10000_LLSC_WAR
@@ -84,8 +85,8 @@ static inline void set_value_reg32(volatile u32 *const addr,
         "       "__beqz"%0, 1b                          \n"
         "       nop                                     \n"
         "       .set    pop                             \n"
-        : "=&r" (temp), "=m" (*addr)
-        : "ir" (~mask), "ir" (value), "m" (*addr));
+        : "=&r" (temp), "=" GCC_OFF12_ASM() (*addr)
+        : "ir" (~mask), "ir" (value), GCC_OFF12_ASM() (*addr));
 }
 
 /*
@@ -105,8 +106,8 @@ static inline void set_reg32(volatile u32 *const addr,
         "       "__beqz"%0, 1b                          \n"
         "       nop                                     \n"
         "       .set    pop                             \n"
-        : "=&r" (temp), "=m" (*addr)
-        : "ir" (mask), "m" (*addr));
+        : "=&r" (temp), "=" GCC_OFF12_ASM() (*addr)
+        : "ir" (mask), GCC_OFF12_ASM() (*addr));
 }
 
 /*
@@ -126,8 +127,8 @@ static inline void clear_reg32(volatile u32 *const addr,
         "       "__beqz"%0, 1b                          \n"
         "       nop                                     \n"
         "       .set    pop                             \n"
-        : "=&r" (temp), "=m" (*addr)
-        : "ir" (~mask), "m" (*addr));
+        : "=&r" (temp), "=" GCC_OFF12_ASM() (*addr)
+        : "ir" (~mask), GCC_OFF12_ASM() (*addr));
 }
 
 /*
@@ -147,8 +148,8 @@ static inline void toggle_reg32(volatile u32 *const addr,
         "       "__beqz"%0, 1b                          \n"
         "       nop                                     \n"
         "       .set    pop                             \n"
-        : "=&r" (temp), "=m" (*addr)
-        : "ir" (mask), "m" (*addr));
+        : "=&r" (temp), "=" GCC_OFF12_ASM() (*addr)
+        : "ir" (mask), GCC_OFF12_ASM() (*addr));
 }
 
 /*
@@ -219,8 +220,8 @@ static inline u32 blocking_read_reg32(volatile u32 *const addr)
         "       .set    arch=r4000                      \n"     \
         "1:     ll      %0, %1  #custom_read_reg32      \n"     \
         "       .set    pop                             \n"     \
-        : "=r" (tmp), "=m" (*address)                           \
-        : "m" (*address))
+        : "=r" (tmp), "=" GCC_OFF12_ASM() (*address)            \
+        : GCC_OFF12_ASM() (*address))
 
 #define custom_write_reg32(address, tmp)                        \
         __asm__ __volatile__(                                   \
@@ -230,7 +231,7 @@ static inline u32 blocking_read_reg32(volatile u32 *const addr)
         "       "__beqz"%0, 1b                          \n"     \
         "       nop                                     \n"     \
         "       .set    pop                             \n"     \
-        : "=&r" (tmp), "=m" (*address)                          \
-        : "0" (tmp), "m" (*address))
+        : "=&r" (tmp), "=" GCC_OFF12_ASM() (*address)           \
+        : "0" (tmp), GCC_OFF12_ASM() (*address))
 
 #endif  /* __ASM_REGOPS_H__ */
diff --git a/arch/mips/include/asm/mach-ralink/mt7620.h b/arch/mips/include/asm/mach-ralink/mt7620.h
index 6f9b24f51157..1976fb815fd1 100644
--- a/arch/mips/include/asm/mach-ralink/mt7620.h
+++ b/arch/mips/include/asm/mach-ralink/mt7620.h
@@ -13,6 +13,13 @@
 #ifndef _MT7620_REGS_H_
 #define _MT7620_REGS_H_
 
+enum mt762x_soc_type {
+        MT762X_SOC_UNKNOWN = 0,
+        MT762X_SOC_MT7620A,
+        MT762X_SOC_MT7620N,
+        MT762X_SOC_MT7628AN,
+};
+
 #define MT7620_SYSC_BASE                0x10000000
 
 #define SYSC_REG_CHIP_NAME0             0x00
@@ -25,11 +32,9 @@
 #define SYSC_REG_CPLL_CONFIG0           0x54
 #define SYSC_REG_CPLL_CONFIG1           0x58
 
-#define MT7620N_CHIP_NAME0              0x33365452
-#define MT7620N_CHIP_NAME1              0x20203235
-
-#define MT7620A_CHIP_NAME0              0x3637544d
-#define MT7620A_CHIP_NAME1              0x20203032
+#define MT7620_CHIP_NAME0               0x3637544d
+#define MT7620_CHIP_NAME1               0x20203032
+#define MT7628_CHIP_NAME1               0x20203832
 
 #define SYSCFG0_XTAL_FREQ_SEL           BIT(6)
 
@@ -74,6 +79,9 @@
 #define SYSCFG0_DRAM_TYPE_DDR1          1
 #define SYSCFG0_DRAM_TYPE_DDR2          2
 
+#define SYSCFG0_DRAM_TYPE_DDR2_MT7628   0
+#define SYSCFG0_DRAM_TYPE_DDR1_MT7628   1
+
 #define MT7620_DRAM_BASE                0x0
 #define MT7620_SDRAM_SIZE_MIN           2
 #define MT7620_SDRAM_SIZE_MAX           64
@@ -82,7 +90,6 @@
 #define MT7620_DDR2_SIZE_MIN            32
 #define MT7620_DDR2_SIZE_MAX            256
 
-#define MT7620_GPIO_MODE_I2C            BIT(0)
 #define MT7620_GPIO_MODE_UART0_SHIFT    2
 #define MT7620_GPIO_MODE_UART0_MASK     0x7
 #define MT7620_GPIO_MODE_UART0(x)       ((x) << MT7620_GPIO_MODE_UART0_SHIFT)
@@ -94,15 +101,40 @@
 #define MT7620_GPIO_MODE_GPIO_UARTF     0x5
 #define MT7620_GPIO_MODE_GPIO_I2S       0x6
 #define MT7620_GPIO_MODE_GPIO           0x7
-#define MT7620_GPIO_MODE_UART1          BIT(5)
-#define MT7620_GPIO_MODE_MDIO           BIT(8)
-#define MT7620_GPIO_MODE_RGMII1         BIT(9)
-#define MT7620_GPIO_MODE_RGMII2         BIT(10)
-#define MT7620_GPIO_MODE_SPI            BIT(11)
-#define MT7620_GPIO_MODE_SPI_REF_CLK    BIT(12)
-#define MT7620_GPIO_MODE_WLED           BIT(13)
-#define MT7620_GPIO_MODE_JTAG           BIT(15)
-#define MT7620_GPIO_MODE_EPHY           BIT(15)
-#define MT7620_GPIO_MODE_WDT            BIT(22)
+
+#define MT7620_GPIO_MODE_NAND           0
+#define MT7620_GPIO_MODE_SD             1
+#define MT7620_GPIO_MODE_ND_SD_GPIO     2
+#define MT7620_GPIO_MODE_ND_SD_MASK     0x3
+#define MT7620_GPIO_MODE_ND_SD_SHIFT    18
+
+#define MT7620_GPIO_MODE_PCIE_RST       0
+#define MT7620_GPIO_MODE_PCIE_REF       1
+#define MT7620_GPIO_MODE_PCIE_GPIO      2
+#define MT7620_GPIO_MODE_PCIE_MASK      0x3
+#define MT7620_GPIO_MODE_PCIE_SHIFT     16
+
+#define MT7620_GPIO_MODE_WDT_RST        0
+#define MT7620_GPIO_MODE_WDT_REF        1
+#define MT7620_GPIO_MODE_WDT_GPIO       2
+#define MT7620_GPIO_MODE_WDT_MASK       0x3
+#define MT7620_GPIO_MODE_WDT_SHIFT      21
+
+#define MT7620_GPIO_MODE_I2C            0
+#define MT7620_GPIO_MODE_UART1          5
+#define MT7620_GPIO_MODE_MDIO           8
+#define MT7620_GPIO_MODE_RGMII1         9
+#define MT7620_GPIO_MODE_RGMII2         10
+#define MT7620_GPIO_MODE_SPI            11
+#define MT7620_GPIO_MODE_SPI_REF_CLK    12
+#define MT7620_GPIO_MODE_WLED           13
+#define MT7620_GPIO_MODE_JTAG           15
+#define MT7620_GPIO_MODE_EPHY           15
+#define MT7620_GPIO_MODE_PA             20
+
+static inline int mt7620_get_eco(void)
+{
+        return rt_sysc_r32(SYSC_REG_CHIP_REV) & CHIP_REV_ECO_MASK;
+}
 
 #endif
diff --git a/arch/mips/include/asm/mach-ralink/pinmux.h b/arch/mips/include/asm/mach-ralink/pinmux.h
new file mode 100644
index 000000000000..be106cb2e26d
--- /dev/null
+++ b/arch/mips/include/asm/mach-ralink/pinmux.h
@@ -0,0 +1,55 @@
+/*
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  publishhed by the Free Software Foundation.
+ *
+ *  Copyright (C) 2012 John Crispin <blogic@openwrt.org>
+ */
+
+#ifndef _RT288X_PINMUX_H__
+#define _RT288X_PINMUX_H__
+
+#define FUNC(name, value, pin_first, pin_count) \
+        { name, value, pin_first, pin_count }
+
+#define GRP(_name, _func, _mask, _shift) \
+        { .name = _name, .mask = _mask, .shift = _shift, \
+          .func = _func, .gpio = _mask, \
+          .func_count = ARRAY_SIZE(_func) }
+
+#define GRP_G(_name, _func, _mask, _gpio, _shift) \
+        { .name = _name, .mask = _mask, .shift = _shift, \
+          .func = _func, .gpio = _gpio, \
+          .func_count = ARRAY_SIZE(_func) }
+
+struct rt2880_pmx_group;
+
+struct rt2880_pmx_func {
+        const char *name;
+        const char value;
+
+        int pin_first;
+        int pin_count;
+        int *pins;
+
+        int *groups;
+        int group_count;
+
+        int enabled;
+};
+
+struct rt2880_pmx_group {
+        const char *name;
+        int enabled;
+
+        const u32 shift;
+        const char mask;
+        const char gpio;
+
+        struct rt2880_pmx_func *func;
+        int func_count;
+};
+
+extern struct rt2880_pmx_group *rt2880_pinmux_data;
+
+#endif
diff --git a/arch/mips/include/asm/mach-ralink/ralink_regs.h b/arch/mips/include/asm/mach-ralink/ralink_regs.h
index 5a508f9f9432..bd93014490df 100644
--- a/arch/mips/include/asm/mach-ralink/ralink_regs.h
+++ b/arch/mips/include/asm/mach-ralink/ralink_regs.h
@@ -26,6 +26,13 @@ static inline u32 rt_sysc_r32(unsigned reg)
         return __raw_readl(rt_sysc_membase + reg);
 }
 
+static inline void rt_sysc_m32(u32 clr, u32 set, unsigned reg)
+{
+        u32 val = rt_sysc_r32(reg) & ~clr;
+
+        __raw_writel(val | set, rt_sysc_membase + reg);
+}
+
 static inline void rt_memc_w32(u32 val, unsigned reg)
 {
         __raw_writel(val, rt_memc_membase + reg);
diff --git a/arch/mips/include/asm/mach-ralink/rt305x.h b/arch/mips/include/asm/mach-ralink/rt305x.h
index 069bf37a6010..96f731bac79a 100644
--- a/arch/mips/include/asm/mach-ralink/rt305x.h
+++ b/arch/mips/include/asm/mach-ralink/rt305x.h
@@ -125,24 +125,29 @@ static inline int soc_is_rt5350(void)
 #define RT305X_GPIO_GE0_TXD0            40
 #define RT305X_GPIO_GE0_RXCLK           51
 
-#define RT305X_GPIO_MODE_I2C            BIT(0)
-#define RT305X_GPIO_MODE_SPI            BIT(1)
 #define RT305X_GPIO_MODE_UART0_SHIFT    2
 #define RT305X_GPIO_MODE_UART0_MASK     0x7
 #define RT305X_GPIO_MODE_UART0(x)       ((x) << RT305X_GPIO_MODE_UART0_SHIFT)
-#define RT305X_GPIO_MODE_UARTF          0x0
-#define RT305X_GPIO_MODE_PCM_UARTF      0x1
-#define RT305X_GPIO_MODE_PCM_I2S        0x2
-#define RT305X_GPIO_MODE_I2S_UARTF      0x3
-#define RT305X_GPIO_MODE_PCM_GPIO       0x4
-#define RT305X_GPIO_MODE_GPIO_UARTF     0x5
-#define RT305X_GPIO_MODE_GPIO_I2S       0x6
-#define RT305X_GPIO_MODE_GPIO           0x7
-#define RT305X_GPIO_MODE_UART1          BIT(5)
-#define RT305X_GPIO_MODE_JTAG           BIT(6)
-#define RT305X_GPIO_MODE_MDIO           BIT(7)
-#define RT305X_GPIO_MODE_SDRAM          BIT(8)
-#define RT305X_GPIO_MODE_RGMII          BIT(9)
+#define RT305X_GPIO_MODE_UARTF          0
+#define RT305X_GPIO_MODE_PCM_UARTF      1
+#define RT305X_GPIO_MODE_PCM_I2S        2
+#define RT305X_GPIO_MODE_I2S_UARTF      3
+#define RT305X_GPIO_MODE_PCM_GPIO       4
+#define RT305X_GPIO_MODE_GPIO_UARTF     5
+#define RT305X_GPIO_MODE_GPIO_I2S       6
+#define RT305X_GPIO_MODE_GPIO           7
+
+#define RT305X_GPIO_MODE_I2C            0
+#define RT305X_GPIO_MODE_SPI            1
+#define RT305X_GPIO_MODE_UART1          5
+#define RT305X_GPIO_MODE_JTAG           6
+#define RT305X_GPIO_MODE_MDIO           7
+#define RT305X_GPIO_MODE_SDRAM          8
+#define RT305X_GPIO_MODE_RGMII          9
+#define RT5350_GPIO_MODE_PHY_LED        14
+#define RT5350_GPIO_MODE_SPI_CS1        21
+#define RT3352_GPIO_MODE_LNA            18
+#define RT3352_GPIO_MODE_PA             20
 
 #define RT3352_SYSC_REG_SYSCFG0         0x010
 #define RT3352_SYSC_REG_SYSCFG1         0x014
diff --git a/arch/mips/include/asm/mach-ralink/rt3883.h b/arch/mips/include/asm/mach-ralink/rt3883.h
index 058382f37f92..0fbe6f9257cd 100644
--- a/arch/mips/include/asm/mach-ralink/rt3883.h
+++ b/arch/mips/include/asm/mach-ralink/rt3883.h
@@ -112,8 +112,6 @@
 #define RT3883_CLKCFG1_PCI_CLK_EN       BIT(19)
 #define RT3883_CLKCFG1_UPHY0_CLK_EN     BIT(18)
 
-#define RT3883_GPIO_MODE_I2C            BIT(0)
-#define RT3883_GPIO_MODE_SPI            BIT(1)
 #define RT3883_GPIO_MODE_UART0_SHIFT    2
 #define RT3883_GPIO_MODE_UART0_MASK     0x7
 #define RT3883_GPIO_MODE_UART0(x)       ((x) << RT3883_GPIO_MODE_UART0_SHIFT)
@@ -125,11 +123,15 @@
 #define RT3883_GPIO_MODE_GPIO_UARTF     0x5
 #define RT3883_GPIO_MODE_GPIO_I2S       0x6
 #define RT3883_GPIO_MODE_GPIO           0x7
-#define RT3883_GPIO_MODE_UART1          BIT(5)
-#define RT3883_GPIO_MODE_JTAG           BIT(6)
-#define RT3883_GPIO_MODE_MDIO           BIT(7)
-#define RT3883_GPIO_MODE_GE1            BIT(9)
-#define RT3883_GPIO_MODE_GE2            BIT(10)
+
+#define RT3883_GPIO_MODE_I2C            0
+#define RT3883_GPIO_MODE_SPI            1
+#define RT3883_GPIO_MODE_UART1          5
+#define RT3883_GPIO_MODE_JTAG           6
+#define RT3883_GPIO_MODE_MDIO           7
+#define RT3883_GPIO_MODE_GE1            9
+#define RT3883_GPIO_MODE_GE2            10
+
 #define RT3883_GPIO_MODE_PCI_SHIFT      11
 #define RT3883_GPIO_MODE_PCI_MASK       0x7
 #define RT3883_GPIO_MODE_PCI            (RT3883_GPIO_MODE_PCI_MASK << RT3883_GPIO_MODE_PCI_SHIFT)
diff --git a/arch/mips/include/asm/mach-sead3/irq.h b/arch/mips/include/asm/mach-sead3/irq.h
index d8106f75b9af..5d154cfbcf4c 100644
--- a/arch/mips/include/asm/mach-sead3/irq.h
+++ b/arch/mips/include/asm/mach-sead3/irq.h
@@ -1,7 +1,6 @@
 #ifndef __ASM_MACH_MIPS_IRQ_H
 #define __ASM_MACH_MIPS_IRQ_H
 
-#define GIC_NUM_INTRS (24 + NR_CPUS * 2)
 #define NR_IRQS 256
 
 
diff --git a/arch/mips/include/asm/mach-tx39xx/ioremap.h b/arch/mips/include/asm/mach-tx39xx/ioremap.h
index 93c6c04ffda3..0874cd2b06d7 100644
--- a/arch/mips/include/asm/mach-tx39xx/ioremap.h
+++ b/arch/mips/include/asm/mach-tx39xx/ioremap.h
@@ -15,12 +15,12 @@
  * Allow physical addresses to be fixed up to help peripherals located
  * outside the low 32-bit range -- generic pass-through version.
  */
-static inline phys_t fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+static inline phys_addr_t fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         return phys_addr;
 }
 
-static inline void __iomem *plat_ioremap(phys_t offset, unsigned long size,
+static inline void __iomem *plat_ioremap(phys_addr_t offset, unsigned long size,
         unsigned long flags)
 {
 #define TXX9_DIRECTMAP_BASE     0xff000000ul
diff --git a/arch/mips/include/asm/mach-tx49xx/ioremap.h b/arch/mips/include/asm/mach-tx49xx/ioremap.h
index 1e7beae72229..4b6a8441b25f 100644
--- a/arch/mips/include/asm/mach-tx49xx/ioremap.h
+++ b/arch/mips/include/asm/mach-tx49xx/ioremap.h
@@ -15,12 +15,12 @@
  * Allow physical addresses to be fixed up to help peripherals located
  * outside the low 32-bit range -- generic pass-through version.
  */
-static inline phys_t fixup_bigphys_addr(phys_t phys_addr, phys_t size)
+static inline phys_addr_t fixup_bigphys_addr(phys_addr_t phys_addr, phys_addr_t size)
 {
         return phys_addr;
 }
 
-static inline void __iomem *plat_ioremap(phys_t offset, unsigned long size,
+static inline void __iomem *plat_ioremap(phys_addr_t offset, unsigned long size,
         unsigned long flags)
 {
 #ifdef CONFIG_64BIT
diff --git a/arch/mips/include/asm/mips-boards/maltaint.h b/arch/mips/include/asm/mips-boards/maltaint.h
index e330732ddf98..987ff580466b 100644
--- a/arch/mips/include/asm/mips-boards/maltaint.h
+++ b/arch/mips/include/asm/mips-boards/maltaint.h
@@ -10,7 +10,7 @@
 #ifndef _MIPS_MALTAINT_H
 #define _MIPS_MALTAINT_H
 
-#define MIPS_GIC_IRQ_BASE       (MIPS_CPU_IRQ_BASE + 8)
+#include <linux/irqchip/mips-gic.h>
 
 /*
  * Interrupts 0..15 are used for Malta ISA compatible interrupts
@@ -22,29 +22,28 @@
 #define MIPSCPU_INT_SW1         1
 #define MIPSCPU_INT_MB0         2
 #define MIPSCPU_INT_I8259A      MIPSCPU_INT_MB0
+#define MIPSCPU_INT_GIC         MIPSCPU_INT_MB0 /* GIC chained interrupt */
 #define MIPSCPU_INT_MB1         3
 #define MIPSCPU_INT_SMI         MIPSCPU_INT_MB1
-#define MIPSCPU_INT_IPI0        MIPSCPU_INT_MB1 /* GIC IPI */
 #define MIPSCPU_INT_MB2         4
-#define MIPSCPU_INT_IPI1        MIPSCPU_INT_MB2 /* GIC IPI */
 #define MIPSCPU_INT_MB3         5
 #define MIPSCPU_INT_COREHI      MIPSCPU_INT_MB3
 #define MIPSCPU_INT_MB4         6
 #define MIPSCPU_INT_CORELO      MIPSCPU_INT_MB4
 
 /*
- * Interrupts 64..127 are used for Soc-it Classic interrupts
+ * Interrupts 96..127 are used for Soc-it Classic interrupts
  */
-#define MSC01C_INT_BASE         64
+#define MSC01C_INT_BASE         96
 
 /* SOC-it Classic interrupt offsets */
 #define MSC01C_INT_TMR          0
 #define MSC01C_INT_PCI          1
 
 /*
- * Interrupts 64..127 are used for Soc-it EIC interrupts
+ * Interrupts 96..127 are used for Soc-it EIC interrupts
  */
-#define MSC01E_INT_BASE         64
+#define MSC01E_INT_BASE         96
 
 /* SOC-it EIC interrupt offsets */
 #define MSC01E_INT_SW0          1
@@ -63,14 +62,7 @@
 #define MSC01E_INT_PERFCTR      10
 #define MSC01E_INT_CPUCTR       11
 
-/* External Interrupts used for IPI */
-#define GIC_IPI_EXT_INTR_RESCHED_VPE0   16
-#define GIC_IPI_EXT_INTR_CALLFNC_VPE0   17
-#define GIC_IPI_EXT_INTR_RESCHED_VPE1   18
-#define GIC_IPI_EXT_INTR_CALLFNC_VPE1   19
-#define GIC_IPI_EXT_INTR_RESCHED_VPE2   20
-#define GIC_IPI_EXT_INTR_CALLFNC_VPE2   21
-#define GIC_IPI_EXT_INTR_RESCHED_VPE3   22
-#define GIC_IPI_EXT_INTR_CALLFNC_VPE3   23
+/* GIC external interrupts */
+#define GIC_INT_I8259A          GIC_SHARED_TO_HWIRQ(3)
 
 #endif /* !(_MIPS_MALTAINT_H) */
diff --git a/arch/mips/include/asm/mips-boards/sead3int.h b/arch/mips/include/asm/mips-boards/sead3int.h
index 6b17aaf7d901..8932c7de0419 100644
--- a/arch/mips/include/asm/mips-boards/sead3int.h
+++ b/arch/mips/include/asm/mips-boards/sead3int.h
@@ -10,10 +10,23 @@
 #ifndef _MIPS_SEAD3INT_H
 #define _MIPS_SEAD3INT_H
 
+#include <linux/irqchip/mips-gic.h>
+
 /* SEAD-3 GIC address space definitions. */
 #define GIC_BASE_ADDR           0x1b1c0000
 #define GIC_ADDRSPACE_SZ        (128 * 1024)
 
-#define MIPS_GIC_IRQ_BASE       (MIPS_CPU_IRQ_BASE + 0)
+/* CPU interrupt offsets */
+#define CPU_INT_GIC             2
+#define CPU_INT_EHCI            2
+#define CPU_INT_UART0           4
+#define CPU_INT_UART1           4
+#define CPU_INT_NET             6
+
+/* GIC interrupt offsets */
+#define GIC_INT_NET             GIC_SHARED_TO_HWIRQ(0)
+#define GIC_INT_UART1           GIC_SHARED_TO_HWIRQ(2)
+#define GIC_INT_UART0           GIC_SHARED_TO_HWIRQ(3)
+#define GIC_INT_EHCI            GIC_SHARED_TO_HWIRQ(5)
 
 #endif /* !(_MIPS_SEAD3INT_H) */
diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
index 6a9d2dd005ca..b95a827d763e 100644
--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@@ -30,7 +30,7 @@ extern void __iomem *mips_cm_l2sync_base;
  * different way by defining a function with the same prototype except for the
  * name mips_cm_phys_base (without underscores).
  */
-extern phys_t __mips_cm_phys_base(void);
+extern phys_addr_t __mips_cm_phys_base(void);
 
 /**
  * mips_cm_probe - probe for a Coherence Manager
diff --git a/arch/mips/include/asm/mips-cpc.h b/arch/mips/include/asm/mips-cpc.h
index e139a534e0fd..1cebe8c79051 100644
--- a/arch/mips/include/asm/mips-cpc.h
+++ b/arch/mips/include/asm/mips-cpc.h
@@ -25,7 +25,7 @@ extern void __iomem *mips_cpc_base;
  * memory mapped registers. This is platform dependant & must therefore be
  * implemented per-platform.
  */
-extern phys_t mips_cpc_default_phys_base(void);
+extern phys_addr_t mips_cpc_default_phys_base(void);
 
 /**
  * mips_cpc_phys_base - retrieve the physical base address of the CPC
@@ -35,7 +35,7 @@ extern phys_t mips_cpc_default_phys_base(void);
  * is present. It may be overriden by individual platforms which determine
  * this address in a different way.
  */
-extern phys_t __weak mips_cpc_phys_base(void);
+extern phys_addr_t __weak mips_cpc_phys_base(void);
 
 /**
  * mips_cpc_probe - probe for a Cluster Power Controller
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 22a135ac91de..5e4aef304b02 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -653,6 +653,9 @@
 #define MIPS_CONF5_NF           (_ULCAST_(1) << 0)
 #define MIPS_CONF5_UFR          (_ULCAST_(1) << 2)
 #define MIPS_CONF5_MRP          (_ULCAST_(1) << 3)
+#define MIPS_CONF5_MVH          (_ULCAST_(1) << 5)
+#define MIPS_CONF5_FRE          (_ULCAST_(1) << 8)
+#define MIPS_CONF5_UFE          (_ULCAST_(1) << 9)
 #define MIPS_CONF5_MSAEN        (_ULCAST_(1) << 27)
 #define MIPS_CONF5_EVA          (_ULCAST_(1) << 28)
 #define MIPS_CONF5_CV           (_ULCAST_(1) << 29)
@@ -694,6 +697,7 @@
 #define MIPS_FPIR_W             (_ULCAST_(1) << 20)
 #define MIPS_FPIR_L             (_ULCAST_(1) << 21)
 #define MIPS_FPIR_F64           (_ULCAST_(1) << 22)
+#define MIPS_FPIR_FREP          (_ULCAST_(1) << 29)
 
 /*
  * Bits in the MIPS32 Memory Segmentation registers.
@@ -994,6 +998,39 @@ do {									\
         local_irq_restore(__flags);                                     \
 } while (0)
 
+#define __readx_32bit_c0_register(source)                               \
+({                                                                      \
+        unsigned int __res;                                             \
+                                                                        \
+        __asm__ __volatile__(                                           \
+        "       .set    push                                    \n"     \
+        "       .set    noat                                    \n"     \
+        "       .set    mips32r2                                \n"     \
+        "       .insn                                           \n"     \
+        "       # mfhc0 $1, %1                                  \n"     \
+        "       .word   (0x40410000 | ((%1 & 0x1f) << 11))      \n"     \
+        "       move    %0, $1                                  \n"     \
+        "       .set    pop                                     \n"     \
+        : "=r" (__res)                                                  \
+        : "i" (source));                                                \
+        __res;                                                          \
+})
+
+#define __writex_32bit_c0_register(register, value)                     \
+do {                                                                    \
+        __asm__ __volatile__(                                           \
+        "       .set    push                                    \n"     \
+        "       .set    noat                                    \n"     \
+        "       .set    mips32r2                                \n"     \
+        "       move    $1, %0                                  \n"     \
+        "       # mthc0 $1, %1                                  \n"     \
+        "       .insn                                           \n"     \
+        "       .word   (0x40c10000 | ((%1 & 0x1f) << 11))      \n"     \
+        "       .set    pop                                     \n"     \
+        :                                                               \
+        : "r" (value), "i" (register));                                 \
+} while (0)
+
 #define read_c0_index()         __read_32bit_c0_register($0, 0)
 #define write_c0_index(val)     __write_32bit_c0_register($0, 0, val)
 
@@ -1003,9 +1040,15 @@ do {									\
 #define read_c0_entrylo0()      __read_ulong_c0_register($2, 0)
 #define write_c0_entrylo0(val)  __write_ulong_c0_register($2, 0, val)
 
+#define readx_c0_entrylo0()     __readx_32bit_c0_register(2)
+#define writex_c0_entrylo0(val) __writex_32bit_c0_register(2, val)
+
 #define read_c0_entrylo1()      __read_ulong_c0_register($3, 0)
 #define write_c0_entrylo1(val)  __write_ulong_c0_register($3, 0, val)
 
+#define readx_c0_entrylo1()     __readx_32bit_c0_register(3)
+#define writex_c0_entrylo1(val) __writex_32bit_c0_register(3, val)
+
 #define read_c0_conf()          __read_32bit_c0_register($3, 0)
 #define write_c0_conf(val)      __write_32bit_c0_register($3, 0, val)
 
diff --git a/arch/mips/include/asm/octeon/cvmx-cmd-queue.h b/arch/mips/include/asm/octeon/cvmx-cmd-queue.h
index 024a71b2bff9..75739c83f07e 100644
--- a/arch/mips/include/asm/octeon/cvmx-cmd-queue.h
+++ b/arch/mips/include/asm/octeon/cvmx-cmd-queue.h
@@ -76,6 +76,8 @@
 
 #include <linux/prefetch.h>
 
+#include <asm/compiler.h>
+
 #include <asm/octeon/cvmx-fpa.h>
 /**
  * By default we disable the max depth support. Most programs
@@ -273,7 +275,7 @@ static inline void __cvmx_cmd_queue_lock(cvmx_cmd_queue_id_t queue_id,
                 " lbu   %[ticket], %[now_serving]\n"
                 "4:\n"
                 ".set pop\n" :
-                [ticket_ptr] "=m"(__cvmx_cmd_queue_state_ptr->ticket[__cvmx_cmd_queue_get_index(queue_id)]),
+                [ticket_ptr] "=" GCC_OFF12_ASM()(__cvmx_cmd_queue_state_ptr->ticket[__cvmx_cmd_queue_get_index(queue_id)]),
                 [now_serving] "=m"(qptr->now_serving), [ticket] "=r"(tmp),
                 [my_ticket] "=r"(my_ticket)
             );
diff --git a/arch/mips/include/asm/octeon/cvmx-pow.h b/arch/mips/include/asm/octeon/cvmx-pow.h
index 4b4d0ecfd9eb..2188e65afb86 100644
--- a/arch/mips/include/asm/octeon/cvmx-pow.h
+++ b/arch/mips/include/asm/octeon/cvmx-pow.h
@@ -1066,7 +1066,7 @@ static inline void __cvmx_pow_warn_if_pending_switch(const char *function)
         uint64_t switch_complete;
         CVMX_MF_CHORD(switch_complete);
         if (!switch_complete)
-                pr_warning("%s called with tag switch in progress\n", function);
+                pr_warn("%s called with tag switch in progress\n", function);
 }
 
 /**
@@ -1084,8 +1084,7 @@ static inline void cvmx_pow_tag_sw_wait(void)
                 if (unlikely(switch_complete))
                         break;
                 if (unlikely(cvmx_get_cycle() > start_cycle + MAX_CYCLES)) {
-                        pr_warning("Tag switch is taking a long time, "
-                                   "possible deadlock\n");
+                        pr_warn("Tag switch is taking a long time, possible deadlock\n");
                         start_cycle = -MAX_CYCLES - 1;
                 }
         }
@@ -1296,19 +1295,16 @@ static inline void cvmx_pow_tag_sw_nocheck(uint32_t tag,
                 __cvmx_pow_warn_if_pending_switch(__func__);
                 current_tag = cvmx_pow_get_current_tag();
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL_NULL)
-                        pr_warning("%s called with NULL_NULL tag\n",
-                                   __func__);
+                        pr_warn("%s called with NULL_NULL tag\n", __func__);
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL)
-                        pr_warning("%s called with NULL tag\n", __func__);
+                        pr_warn("%s called with NULL tag\n", __func__);
                 if ((current_tag.s.type == tag_type)
                    && (current_tag.s.tag == tag))
-                        pr_warning("%s called to perform a tag switch to the "
-                                   "same tag\n",
-                             __func__);
+                        pr_warn("%s called to perform a tag switch to the same tag\n",
+                                __func__);
                 if (tag_type == CVMX_POW_TAG_TYPE_NULL)
-                        pr_warning("%s called to perform a tag switch to "
-                                   "NULL. Use cvmx_pow_tag_sw_null() instead\n",
-                             __func__);
+                        pr_warn("%s called to perform a tag switch to NULL. Use cvmx_pow_tag_sw_null() instead\n",
+                                __func__);
         }
 
         /*
@@ -1407,23 +1403,19 @@ static inline void cvmx_pow_tag_sw_full_nocheck(cvmx_wqe_t *wqp, uint32_t tag,
                 __cvmx_pow_warn_if_pending_switch(__func__);
                 current_tag = cvmx_pow_get_current_tag();
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL_NULL)
-                        pr_warning("%s called with NULL_NULL tag\n",
-                                   __func__);
+                        pr_warn("%s called with NULL_NULL tag\n", __func__);
                 if ((current_tag.s.type == tag_type)
                    && (current_tag.s.tag == tag))
-                        pr_warning("%s called to perform a tag switch to "
-                                   "the same tag\n",
-                             __func__);
+                        pr_warn("%s called to perform a tag switch to the same tag\n",
+                                __func__);
                 if (tag_type == CVMX_POW_TAG_TYPE_NULL)
-                        pr_warning("%s called to perform a tag switch to "
-                                   "NULL. Use cvmx_pow_tag_sw_null() instead\n",
-                             __func__);
+                        pr_warn("%s called to perform a tag switch to NULL. Use cvmx_pow_tag_sw_null() instead\n",
+                                __func__);
                 if (wqp != cvmx_phys_to_ptr(0x80))
                         if (wqp != cvmx_pow_get_current_wqp())
-                                pr_warning("%s passed WQE(%p) doesn't match "
-                                           "the address in the POW(%p)\n",
-                                     __func__, wqp,
-                                     cvmx_pow_get_current_wqp());
+                                pr_warn("%s passed WQE(%p) doesn't match the address in the POW(%p)\n",
+                                        __func__, wqp,
+                                        cvmx_pow_get_current_wqp());
         }
 
         /*
@@ -1507,12 +1499,10 @@ static inline void cvmx_pow_tag_sw_null_nocheck(void)
                 __cvmx_pow_warn_if_pending_switch(__func__);
                 current_tag = cvmx_pow_get_current_tag();
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL_NULL)
-                        pr_warning("%s called with NULL_NULL tag\n",
-                                   __func__);
+                        pr_warn("%s called with NULL_NULL tag\n", __func__);
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL)
-                        pr_warning("%s called when we already have a "
-                                   "NULL tag\n",
-                             __func__);
+                        pr_warn("%s called when we already have a NULL tag\n",
+                                __func__);
         }
 
         tag_req.u64 = 0;
@@ -1725,17 +1715,14 @@ static inline void cvmx_pow_tag_sw_desched_nocheck(
                 __cvmx_pow_warn_if_pending_switch(__func__);
                 current_tag = cvmx_pow_get_current_tag();
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL_NULL)
-                        pr_warning("%s called with NULL_NULL tag\n",
-                                   __func__);
+                        pr_warn("%s called with NULL_NULL tag\n", __func__);
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL)
-                        pr_warning("%s called with NULL tag. Deschedule not "
-                                   "allowed from NULL state\n",
-                             __func__);
+                        pr_warn("%s called with NULL tag. Deschedule not allowed from NULL state\n",
+                                __func__);
                 if ((current_tag.s.type != CVMX_POW_TAG_TYPE_ATOMIC)
                         && (tag_type != CVMX_POW_TAG_TYPE_ATOMIC))
-                        pr_warning("%s called where neither the before or "
-                                   "after tag is ATOMIC\n",
-                             __func__);
+                        pr_warn("%s called where neither the before or after tag is ATOMIC\n",
+                                __func__);
         }
 
         tag_req.u64 = 0;
@@ -1832,12 +1819,10 @@ static inline void cvmx_pow_desched(uint64_t no_sched)
                 __cvmx_pow_warn_if_pending_switch(__func__);
                 current_tag = cvmx_pow_get_current_tag();
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL_NULL)
-                        pr_warning("%s called with NULL_NULL tag\n",
-                                   __func__);
+                        pr_warn("%s called with NULL_NULL tag\n", __func__);
                 if (current_tag.s.type == CVMX_POW_TAG_TYPE_NULL)
-                        pr_warning("%s called with NULL tag. Deschedule not "
-                                   "expected from NULL state\n",
-                             __func__);
+                        pr_warn("%s called with NULL tag. Deschedule not expected from NULL state\n",
+                                __func__);
         }
 
         /* Need to make sure any writes to the work queue entry are complete */
diff --git a/arch/mips/include/asm/octeon/cvmx.h b/arch/mips/include/asm/octeon/cvmx.h
index f991e7701d3d..33db1c806b01 100644
--- a/arch/mips/include/asm/octeon/cvmx.h
+++ b/arch/mips/include/asm/octeon/cvmx.h
@@ -451,67 +451,4 @@ static inline uint32_t cvmx_octeon_num_cores(void)
         return cvmx_pop(ciu_fuse);
 }
 
-/**
- * Read a byte of fuse data
- * @byte_addr:   address to read
- *
- * Returns fuse value: 0 or 1
- */
-static uint8_t cvmx_fuse_read_byte(int byte_addr)
-{
-        union cvmx_mio_fus_rcmd read_cmd;
-
-        read_cmd.u64 = 0;
-        read_cmd.s.addr = byte_addr;
-        read_cmd.s.pend = 1;
-        cvmx_write_csr(CVMX_MIO_FUS_RCMD, read_cmd.u64);
-        while ((read_cmd.u64 = cvmx_read_csr(CVMX_MIO_FUS_RCMD))
-               && read_cmd.s.pend)
-                ;
-        return read_cmd.s.dat;
-}
-
-/**
- * Read a single fuse bit
- *
- * @fuse:   Fuse number (0-1024)
- *
- * Returns fuse value: 0 or 1
- */
-static inline int cvmx_fuse_read(int fuse)
-{
-        return (cvmx_fuse_read_byte(fuse >> 3) >> (fuse & 0x7)) & 1;
-}
-
-static inline int cvmx_octeon_model_CN36XX(void)
-{
-        return OCTEON_IS_MODEL(OCTEON_CN38XX)
-                && !cvmx_octeon_is_pass1()
-                && cvmx_fuse_read(264);
-}
-
-static inline int cvmx_octeon_zip_present(void)
-{
-        return octeon_has_feature(OCTEON_FEATURE_ZIP);
-}
-
-static inline int cvmx_octeon_dfa_present(void)
-{
-        if (!OCTEON_IS_MODEL(OCTEON_CN38XX)
-            && !OCTEON_IS_MODEL(OCTEON_CN31XX)
-            && !OCTEON_IS_MODEL(OCTEON_CN58XX))
-                return 0;
-        else if (OCTEON_IS_MODEL(OCTEON_CN3020))
-                return 0;
-        else if (cvmx_octeon_is_pass1())
-                return 1;
-        else
-                return !cvmx_fuse_read(120);
-}
-
-static inline int cvmx_octeon_crypto_present(void)
-{
-        return octeon_has_feature(OCTEON_FEATURE_CRYPTO);
-}
-
 #endif /*  __CVMX_H__  */
diff --git a/arch/mips/include/asm/octeon/octeon-feature.h b/arch/mips/include/asm/octeon/octeon-feature.h
index 90e05a8d4b15..c4fe81f47f53 100644
--- a/arch/mips/include/asm/octeon/octeon-feature.h
+++ b/arch/mips/include/asm/octeon/octeon-feature.h
@@ -86,8 +86,6 @@ enum octeon_feature {
         OCTEON_MAX_FEATURE
 };
 
-static inline int cvmx_fuse_read(int fuse);
-
 /**
  * Determine if the current Octeon supports a specific feature. These
  * checks have been optimized to be fairly quick, but they should still
@@ -105,33 +103,6 @@ static inline int octeon_has_feature(enum octeon_feature feature)
         case OCTEON_FEATURE_SAAD:
                 return !OCTEON_IS_MODEL(OCTEON_CN3XXX);
 
-        case OCTEON_FEATURE_ZIP:
-                if (OCTEON_IS_MODEL(OCTEON_CN30XX)
-                    || OCTEON_IS_MODEL(OCTEON_CN50XX)
-                    || OCTEON_IS_MODEL(OCTEON_CN52XX))
-                        return 0;
-                else if (OCTEON_IS_MODEL(OCTEON_CN38XX_PASS1))
-                        return 1;
-                else
-                        return !cvmx_fuse_read(121);
-
-        case OCTEON_FEATURE_CRYPTO:
-                if (OCTEON_IS_MODEL(OCTEON_CN6XXX)) {
-                        union cvmx_mio_fus_dat2 fus_2;
-                        fus_2.u64 = cvmx_read_csr(CVMX_MIO_FUS_DAT2);
-                        if (fus_2.s.nocrypto || fus_2.s.nomul) {
-                                return 0;
-                        } else if (!fus_2.s.dorm_crypto) {
-                                return 1;
-                        } else {
-                                union cvmx_rnm_ctl_status st;
-                                st.u64 = cvmx_read_csr(CVMX_RNM_CTL_STATUS);
-                                return st.s.eer_val;
-                        }
-                } else {
-                        return !cvmx_fuse_read(90);
-                }
-
         case OCTEON_FEATURE_DORM_CRYPTO:
                 if (OCTEON_IS_MODEL(OCTEON_CN6XXX)) {
                         union cvmx_mio_fus_dat2 fus_2;
@@ -188,29 +159,6 @@ static inline int octeon_has_feature(enum octeon_feature feature)
                           && !OCTEON_IS_MODEL(OCTEON_CN56XX_PASS1_X)
                           && !OCTEON_IS_MODEL(OCTEON_CN52XX_PASS1_X);
 
-        case OCTEON_FEATURE_DFA:
-                if (!OCTEON_IS_MODEL(OCTEON_CN38XX)
-                    && !OCTEON_IS_MODEL(OCTEON_CN31XX)
-                    && !OCTEON_IS_MODEL(OCTEON_CN58XX))
-                        return 0;
-                else if (OCTEON_IS_MODEL(OCTEON_CN3020))
-                        return 0;
-                else
-                        return !cvmx_fuse_read(120);
-
-        case OCTEON_FEATURE_HFA:
-                if (!OCTEON_IS_MODEL(OCTEON_CN6XXX))
-                        return 0;
-                else
-                        return !cvmx_fuse_read(90);
-
-        case OCTEON_FEATURE_DFM:
-                if (!(OCTEON_IS_MODEL(OCTEON_CN63XX)
-                      || OCTEON_IS_MODEL(OCTEON_CN66XX)))
-                        return 0;
-                else
-                        return !cvmx_fuse_read(90);
-
         case OCTEON_FEATURE_MDIO_CLAUSE_45:
                 return !(OCTEON_IS_MODEL(OCTEON_CN3XXX)
                          || OCTEON_IS_MODEL(OCTEON_CN58XX)
diff --git a/arch/mips/include/asm/octeon/octeon-model.h b/arch/mips/include/asm/octeon/octeon-model.h
index e2c122c6a657..e8a1c2fd52cd 100644
--- a/arch/mips/include/asm/octeon/octeon-model.h
+++ b/arch/mips/include/asm/octeon/octeon-model.h
@@ -326,8 +326,7 @@ static inline int __octeon_is_model_runtime__(uint32_t model)
 #define OCTEON_IS_COMMON_BINARY() 1
 #undef OCTEON_MODEL
 
-const char *octeon_model_get_string(uint32_t chip_id);
-const char *octeon_model_get_string_buffer(uint32_t chip_id, char *buffer);
+const char *__init octeon_model_get_string(uint32_t chip_id);
 
 /*
  * Return the octeon family, i.e., ProcessorID of the PrID register.
diff --git a/arch/mips/include/asm/paccess.h b/arch/mips/include/asm/paccess.h
index 2474fc5d1751..af81ab0da55f 100644
--- a/arch/mips/include/asm/paccess.h
+++ b/arch/mips/include/asm/paccess.h
@@ -56,6 +56,7 @@ struct __large_pstruct { unsigned long buf[100]; };
         "1:\t" insn "\t%1,%2\n\t"                                       \
         "move\t%0,$0\n"                                                 \
         "2:\n\t"                                                        \
+        ".insn\n\t"                                                     \
         ".section\t.fixup,\"ax\"\n"                                     \
         "3:\tli\t%0,%3\n\t"                                             \
         "move\t%1,$0\n\t"                                               \
@@ -94,6 +95,7 @@ extern void __get_dbe_unknown(void);
         "1:\t" insn "\t%1,%2\n\t"                                       \
         "move\t%0,$0\n"                                                 \
         "2:\n\t"                                                        \
+        ".insn\n\t"                                                     \
         ".section\t.fixup,\"ax\"\n"                                     \
         "3:\tli\t%0,%3\n\t"                                             \
         "j\t2b\n\t"                                                     \
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index 3be81803595d..154b70a10483 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -116,7 +116,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
 /*
  * These are used to make use of C type-checking..
  */
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
   #ifdef CONFIG_CPU_MIPS32
     typedef struct { unsigned long pte_low, pte_high; } pte_t;
     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
diff --git a/arch/mips/include/asm/pci.h b/arch/mips/include/asm/pci.h
index 974b0e308963..69529624a005 100644
--- a/arch/mips/include/asm/pci.h
+++ b/arch/mips/include/asm/pci.h
@@ -84,7 +84,7 @@ static inline void pci_resource_to_user(const struct pci_dev *dev, int bar,
                 const struct resource *rsrc, resource_size_t *start,
                 resource_size_t *end)
 {
-        phys_t size = resource_size(rsrc);
+        phys_addr_t size = resource_size(rsrc);
 
         *start = fixup_bigphys_addr(rsrc->start, size);
         *end = rsrc->start + size;
diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
index cd7d6064bcbe..68984b612f9d 100644
--- a/arch/mips/include/asm/pgtable-32.h
+++ b/arch/mips/include/asm/pgtable-32.h
@@ -69,7 +69,7 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 # define VMALLOC_END    (FIXADDR_START-2*PAGE_SIZE)
 #endif
 
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
 #define pte_ERROR(e) \
         printk("%s:%d: bad pte %016Lx.\n", __FILE__, __LINE__, pte_val(e))
 #else
@@ -103,7 +103,7 @@ static inline void pmd_clear(pmd_t *pmdp)
         pmd_val(*pmdp) = ((unsigned long) invalid_pte_table);
 }
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
 #define pte_page(x)             pfn_to_page(pte_pfn(x))
 #define pte_pfn(x)              ((unsigned long)((x).pte_high >> 6))
 static inline pte_t
@@ -126,7 +126,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
 #define pte_pfn(x)              ((unsigned long)((x).pte >> _PFN_SHIFT))
 #define pfn_pte(pfn, prot)      __pte(((unsigned long long)(pfn) << _PFN_SHIFT) | pgprot_val(prot))
 #endif
-#endif /* defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32) */
+#endif /* defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32) */
 
 #define __pgd_offset(address)   pgd_index(address)
 #define __pud_offset(address)   (((address) >> PUD_SHIFT) & (PTRS_PER_PUD-1))
@@ -155,73 +155,75 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
 #if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
 
 /* Swap entries must have VALID bit cleared. */
-#define __swp_type(x)           (((x).val >> 10) & 0x1f)
-#define __swp_offset(x)         ((x).val >> 15)
-#define __swp_entry(type,offset)        \
-        ((swp_entry_t) { ((type) << 10) | ((offset) << 15) })
+#define __swp_type(x)                   (((x).val >> 10) & 0x1f)
+#define __swp_offset(x)                 ((x).val >> 15)
+#define __swp_entry(type,offset)        ((swp_entry_t) { ((type) << 10) | ((offset) << 15) })
+#define __pte_to_swp_entry(pte)         ((swp_entry_t) { pte_val(pte) })
+#define __swp_entry_to_pte(x)           ((pte_t) { (x).val })
 
 /*
- * Bits 0, 4, 8, and 9 are taken, split up 28 bits of offset into this range:
+ * Encode and decode a nonlinear file mapping entry
  */
-#define PTE_FILE_MAX_BITS       28
-
-#define pte_to_pgoff(_pte)      ((((_pte).pte >> 1 ) & 0x07) | \
-                                 (((_pte).pte >> 2 ) & 0x38) | \
-                                 (((_pte).pte >> 10) <<  6 ))
+#define pte_to_pgoff(_pte)              ((((_pte).pte >> 1 ) & 0x07) | \
+                                         (((_pte).pte >> 2 ) & 0x38) | \
+                                         (((_pte).pte >> 10) <<  6 ))
 
-#define pgoff_to_pte(off)       ((pte_t) { (((off) & 0x07) << 1 ) | \
-                                           (((off) & 0x38) << 2 ) | \
-                                           (((off) >>  6 ) << 10) | \
-                                           _PAGE_FILE })
+#define pgoff_to_pte(off)               ((pte_t) { (((off) & 0x07) << 1 ) | \
+                                                   (((off) & 0x38) << 2 ) | \
+                                                   (((off) >>  6 ) << 10) | \
+                                                   _PAGE_FILE })
 
+/*
+ * Bits 0, 4, 8, and 9 are taken, split up 28 bits of offset into this range:
+ */
+#define PTE_FILE_MAX_BITS               28
 #else
 
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
+
 /* Swap entries must have VALID and GLOBAL bits cleared. */
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
-#define __swp_type(x)           (((x).val >> 2) & 0x1f)
-#define __swp_offset(x)          ((x).val >> 7)
-#define __swp_entry(type,offset)        \
-                ((swp_entry_t)  { ((type) << 2) | ((offset) << 7) })
-#else
-#define __swp_type(x)           (((x).val >> 8) & 0x1f)
-#define __swp_offset(x)          ((x).val >> 13)
-#define __swp_entry(type,offset)        \
-                ((swp_entry_t)  { ((type) << 8) | ((offset) << 13) })
-#endif /* defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32) */
+#define __swp_type(x)                   (((x).val >> 2) & 0x1f)
+#define __swp_offset(x)                  ((x).val >> 7)
+#define __swp_entry(type,offset)        ((swp_entry_t)  { ((type) << 2) | ((offset) << 7) })
+#define __pte_to_swp_entry(pte)         ((swp_entry_t) { (pte).pte_high })
+#define __swp_entry_to_pte(x)           ((pte_t) { 0, (x).val })
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
 /*
  * Bits 0 and 1 of pte_high are taken, use the rest for the page offset...
  */
-#define PTE_FILE_MAX_BITS       30
-
-#define pte_to_pgoff(_pte)      ((_pte).pte_high >> 2)
-#define pgoff_to_pte(off)       ((pte_t) { _PAGE_FILE, (off) << 2 })
+#define pte_to_pgoff(_pte)              ((_pte).pte_high >> 2)
+#define pgoff_to_pte(off)               ((pte_t) { _PAGE_FILE, (off) << 2 })
 
+#define PTE_FILE_MAX_BITS               30
 #else
 /*
- * Bits 0, 4, 6, and 7 are taken, split up 28 bits of offset into this range:
+ * Constraints:
+ *      _PAGE_PRESENT at bit 0
+ *      _PAGE_MODIFIED at bit 4
+ *      _PAGE_GLOBAL at bit 6
+ *      _PAGE_VALID at bit 7
  */
-#define PTE_FILE_MAX_BITS       28
+#define __swp_type(x)                   (((x).val >> 8) & 0x1f)
+#define __swp_offset(x)                  ((x).val >> 13)
+#define __swp_entry(type,offset)        ((swp_entry_t)  { ((type) << 8) | ((offset) << 13) })
+#define __pte_to_swp_entry(pte)         ((swp_entry_t) { pte_val(pte) })
+#define __swp_entry_to_pte(x)           ((pte_t) { (x).val })
 
-#define pte_to_pgoff(_pte)      ((((_pte).pte >> 1) & 0x7) | \
-                                 (((_pte).pte >> 2) & 0x8) | \
-                                 (((_pte).pte >> 8) <<  4))
+/*
+ * Encode and decode a nonlinear file mapping entry
+ */
+#define pte_to_pgoff(_pte)              ((((_pte).pte >> 1) & 0x7) | \
+                                         (((_pte).pte >> 2) & 0x8) | \
+                                         (((_pte).pte >> 8) <<  4))
 
-#define pgoff_to_pte(off)       ((pte_t) { (((off) & 0x7) << 1) | \
-                                           (((off) & 0x8) << 2) | \
-                                           (((off) >>  4) << 8) | \
-                                           _PAGE_FILE })
-#endif
+#define pgoff_to_pte(off)               ((pte_t) { (((off) & 0x7) << 1) | \
+                                                   (((off) & 0x8) << 2) | \
+                                                   (((off) >>  4) << 8) | \
+                                                   _PAGE_FILE })
 
-#endif
+#define PTE_FILE_MAX_BITS               28
+#endif /* defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32) */
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
-#define __pte_to_swp_entry(pte) ((swp_entry_t) { (pte).pte_high })
-#define __swp_entry_to_pte(x)   ((pte_t) { 0, (x).val })
-#else
-#define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
-#define __swp_entry_to_pte(x)   ((pte_t) { (x).val })
-#endif
+#endif /* defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX) */
 
 #endif /* _ASM_PGTABLE_32_H */
diff --git a/arch/mips/include/asm/pgtable-bits.h b/arch/mips/include/asm/pgtable-bits.h
index e747bfa0be7e..ca11f14f40a3 100644
--- a/arch/mips/include/asm/pgtable-bits.h
+++ b/arch/mips/include/asm/pgtable-bits.h
@@ -32,39 +32,41 @@
  * unpredictable things.  The code (when it is written) to deal with
  * this problem will be in the update_mmu_cache() code for the r4k.
  */
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
 
 /*
  * The following bits are directly used by the TLB hardware
  */
-#define _PAGE_R4KBUG            (1 << 0)  /* workaround for r4k bug  */
-#define _PAGE_GLOBAL            (1 << 0)
-#define _PAGE_VALID_SHIFT       1
+#define _PAGE_GLOBAL_SHIFT      0
+#define _PAGE_GLOBAL            (1 << _PAGE_GLOBAL_SHIFT)
+#define _PAGE_VALID_SHIFT       (_PAGE_GLOBAL_SHIFT + 1)
 #define _PAGE_VALID             (1 << _PAGE_VALID_SHIFT)
-#define _PAGE_SILENT_READ       (1 << 1)  /* synonym                 */
-#define _PAGE_DIRTY_SHIFT       2
-#define _PAGE_DIRTY             (1 << _PAGE_DIRTY_SHIFT)  /* The MIPS dirty bit      */
-#define _PAGE_SILENT_WRITE      (1 << 2)
-#define _CACHE_SHIFT            3
-#define _CACHE_MASK             (7 << 3)
+#define _PAGE_DIRTY_SHIFT       (_PAGE_VALID_SHIFT + 1)
+#define _PAGE_DIRTY             (1 << _PAGE_DIRTY_SHIFT)
+#define _CACHE_SHIFT            (_PAGE_DIRTY_SHIFT + 1)
+#define _CACHE_MASK             (7 << _CACHE_SHIFT)
 
 /*
  * The following bits are implemented in software
  *
  * _PAGE_FILE semantics: set:pagecache unset:swap
  */
-#define _PAGE_PRESENT_SHIFT     6
+#define _PAGE_PRESENT_SHIFT     (_CACHE_SHIFT + 3)
 #define _PAGE_PRESENT           (1 << _PAGE_PRESENT_SHIFT)
-#define _PAGE_READ_SHIFT        7
+#define _PAGE_READ_SHIFT        (_PAGE_PRESENT_SHIFT + 1)
 #define _PAGE_READ              (1 << _PAGE_READ_SHIFT)
-#define _PAGE_WRITE_SHIFT       8
+#define _PAGE_WRITE_SHIFT       (_PAGE_READ_SHIFT + 1)
 #define _PAGE_WRITE             (1 << _PAGE_WRITE_SHIFT)
-#define _PAGE_ACCESSED_SHIFT    9
+#define _PAGE_ACCESSED_SHIFT    (_PAGE_WRITE_SHIFT + 1)
 #define _PAGE_ACCESSED          (1 << _PAGE_ACCESSED_SHIFT)
-#define _PAGE_MODIFIED_SHIFT    10
+#define _PAGE_MODIFIED_SHIFT    (_PAGE_ACCESSED_SHIFT + 1)
 #define _PAGE_MODIFIED          (1 << _PAGE_MODIFIED_SHIFT)
 
-#define _PAGE_FILE              (1 << 10)
+#define _PAGE_SILENT_READ       _PAGE_VALID
+#define _PAGE_SILENT_WRITE      _PAGE_DIRTY
+#define _PAGE_FILE              _PAGE_MODIFIED
+
+#define _PFN_SHIFT              (PAGE_SHIFT - 12 + _CACHE_SHIFT + 3)
 
 #elif defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
 
@@ -172,7 +174,7 @@
 
 #define _PFN_SHIFT              (PAGE_SHIFT - 12 + _CACHE_SHIFT + 3)
 
-#endif /* defined(CONFIG_64BIT_PHYS_ADDR && defined(CONFIG_CPU_MIPS32) */
+#endif /* defined(CONFIG_PHYS_ADDR_T_64BIT && defined(CONFIG_CPU_MIPS32) */
 
 #ifndef _PFN_SHIFT
 #define _PFN_SHIFT                  PAGE_SHIFT
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index d6d1928539b1..62a6ba383d4f 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -125,7 +125,7 @@ do {									\
 extern void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
         pte_t pteval);
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
 
 #define pte_none(pte)           (!(((pte).pte_low | (pte).pte_high) & ~_PAGE_GLOBAL))
 #define pte_present(pte)        ((pte).pte_low & _PAGE_PRESENT)
@@ -227,7 +227,7 @@ extern pgd_t swapper_pg_dir[];
  * The following only work if pte_present() is true.
  * Undefined behaviour if not..
  */
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
 static inline int pte_write(pte_t pte)  { return pte.pte_low & _PAGE_WRITE; }
 static inline int pte_dirty(pte_t pte)  { return pte.pte_low & _PAGE_MODIFIED; }
 static inline int pte_young(pte_t pte)  { return pte.pte_low & _PAGE_ACCESSED; }
@@ -297,13 +297,13 @@ static inline pte_t pte_wrprotect(pte_t pte)
 
 static inline pte_t pte_mkclean(pte_t pte)
 {
-        pte_val(pte) &= ~(_PAGE_MODIFIED|_PAGE_SILENT_WRITE);
+        pte_val(pte) &= ~(_PAGE_MODIFIED | _PAGE_SILENT_WRITE);
         return pte;
 }
 
 static inline pte_t pte_mkold(pte_t pte)
 {
-        pte_val(pte) &= ~(_PAGE_ACCESSED|_PAGE_SILENT_READ);
+        pte_val(pte) &= ~(_PAGE_ACCESSED | _PAGE_SILENT_READ);
         return pte;
 }
 
@@ -382,13 +382,13 @@ static inline pgprot_t pgprot_writecombine(pgprot_t _prot)
  */
 #define mk_pte(page, pgprot)    pfn_pte(page_to_pfn(page), (pgprot))
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         pte.pte_low  &= _PAGE_CHG_MASK;
-        pte.pte_high &= ~0x3f;
+        pte.pte_high &= (_PFN_MASK | _CACHE_MASK);
         pte.pte_low  |= pgprot_val(newprot);
-        pte.pte_high |= pgprot_val(newprot) & 0x3f;
+        pte.pte_high |= pgprot_val(newprot) & ~(_PFN_MASK | _CACHE_MASK);
         return pte;
 }
 #else
@@ -419,7 +419,7 @@ static inline void update_mmu_cache_pmd(struct vm_area_struct *vma,
 
 #define kern_addr_valid(addr)   (1)
 
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
 extern int remap_pfn_range(struct vm_area_struct *vma, unsigned long from, unsigned long pfn, unsigned long size, pgprot_t prot);
 
 static inline int io_remap_pfn_range(struct vm_area_struct *vma,
@@ -428,7 +428,7 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
                 unsigned long size,
                 pgprot_t prot)
 {
-        phys_t phys_addr_high = fixup_bigphys_addr(pfn << PAGE_SHIFT, size);
+        phys_addr_t phys_addr_high = fixup_bigphys_addr(pfn << PAGE_SHIFT, size);
         return remap_pfn_range(vma, vaddr, phys_addr_high >> PAGE_SHIFT, size, prot);
 }
 #define io_remap_pfn_range io_remap_pfn_range
diff --git a/arch/mips/include/asm/prom.h b/arch/mips/include/asm/prom.h
index a9494c0141fb..eaa26270a5e5 100644
--- a/arch/mips/include/asm/prom.h
+++ b/arch/mips/include/asm/prom.h
@@ -22,6 +22,7 @@ extern void device_tree_init(void);
 struct boot_param_header;
 
 extern void __dt_setup_arch(void *bph);
+extern int __dt_register_buses(const char *bus0, const char *bus1);
 
 #define dt_setup_arch(sym)                                              \
 ({                                                                      \
diff --git a/arch/mips/include/asm/r4kcache.h b/arch/mips/include/asm/r4kcache.h
index cd6e0afc6833..e293a8d89a6d 100644
--- a/arch/mips/include/asm/r4kcache.h
+++ b/arch/mips/include/asm/r4kcache.h
@@ -47,79 +47,20 @@ extern void (*r4k_blast_icache)(void);
 
 #ifdef CONFIG_MIPS_MT
 
-/*
- * Optionally force single-threaded execution during I-cache flushes.
- */
-#define PROTECT_CACHE_FLUSHES 1
-
-#ifdef PROTECT_CACHE_FLUSHES
-
-extern int mt_protiflush;
-extern int mt_protdflush;
-extern void mt_cflush_lockdown(void);
-extern void mt_cflush_release(void);
-
-#define BEGIN_MT_IPROT \
-        unsigned long flags = 0;                        \
-        unsigned long mtflags = 0;                      \
-        if(mt_protiflush) {                             \
-                local_irq_save(flags);                  \
-                ehb();                                  \
-                mtflags = dvpe();                       \
-                mt_cflush_lockdown();                   \
-        }
-
-#define END_MT_IPROT \
-        if(mt_protiflush) {                             \
-                mt_cflush_release();                    \
-                evpe(mtflags);                          \
-                local_irq_restore(flags);               \
-        }
-
-#define BEGIN_MT_DPROT \
-        unsigned long flags = 0;                        \
-        unsigned long mtflags = 0;                      \
-        if(mt_protdflush) {                             \
-                local_irq_save(flags);                  \
-                ehb();                                  \
-                mtflags = dvpe();                       \
-                mt_cflush_lockdown();                   \
-        }
-
-#define END_MT_DPROT \
-        if(mt_protdflush) {                             \
-                mt_cflush_release();                    \
-                evpe(mtflags);                          \
-                local_irq_restore(flags);               \
-        }
-
-#else
-
-#define BEGIN_MT_IPROT
-#define BEGIN_MT_DPROT
-#define END_MT_IPROT
-#define END_MT_DPROT
-
-#endif /* PROTECT_CACHE_FLUSHES */
-
 #define __iflush_prologue                                               \
         unsigned long redundance;                                       \
         extern int mt_n_iflushes;                                       \
-        BEGIN_MT_IPROT                                                  \
         for (redundance = 0; redundance < mt_n_iflushes; redundance++) {
 
 #define __iflush_epilogue                                               \
-        END_MT_IPROT                                                    \
         }
 
 #define __dflush_prologue                                               \
         unsigned long redundance;                                       \
         extern int mt_n_dflushes;                                       \
-        BEGIN_MT_DPROT                                                  \
         for (redundance = 0; redundance < mt_n_dflushes; redundance++) {
 
 #define __dflush_epilogue \
-        END_MT_DPROT     \
         }
 
 #define __inv_dflush_prologue __dflush_prologue
diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h
index 78d201fb6c87..c6d06d383ef9 100644
--- a/arch/mips/include/asm/spinlock.h
+++ b/arch/mips/include/asm/spinlock.h
@@ -12,6 +12,7 @@
 #include <linux/compiler.h>
 
 #include <asm/barrier.h>
+#include <asm/compiler.h>
 #include <asm/war.h>
 
 /*
@@ -88,7 +89,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
                 "        subu   %[ticket], %[ticket], 1                 \n"
                 "       .previous                                       \n"
                 "       .set pop                                        \n"
-                : [ticket_ptr] "+m" (lock->lock),
+                : [ticket_ptr] "+" GCC_OFF12_ASM() (lock->lock),
                   [serving_now_ptr] "+m" (lock->h.serving_now),
                   [ticket] "=&r" (tmp),
                   [my_ticket] "=&r" (my_ticket)
@@ -121,7 +122,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
                 "        subu   %[ticket], %[ticket], 1                 \n"
                 "       .previous                                       \n"
                 "       .set pop                                        \n"
-                : [ticket_ptr] "+m" (lock->lock),
+                : [ticket_ptr] "+" GCC_OFF12_ASM() (lock->lock),
                   [serving_now_ptr] "+m" (lock->h.serving_now),
                   [ticket] "=&r" (tmp),
                   [my_ticket] "=&r" (my_ticket)
@@ -163,7 +164,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
                 "        li     %[ticket], 0                            \n"
                 "       .previous                                       \n"
                 "       .set pop                                        \n"
-                : [ticket_ptr] "+m" (lock->lock),
+                : [ticket_ptr] "+" GCC_OFF12_ASM() (lock->lock),
                   [ticket] "=&r" (tmp),
                   [my_ticket] "=&r" (tmp2),
                   [now_serving] "=&r" (tmp3)
@@ -187,7 +188,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
                 "        li     %[ticket], 0                            \n"
                 "       .previous                                       \n"
                 "       .set pop                                        \n"
-                : [ticket_ptr] "+m" (lock->lock),
+                : [ticket_ptr] "+" GCC_OFF12_ASM() (lock->lock),
                   [ticket] "=&r" (tmp),
                   [my_ticket] "=&r" (tmp2),
                   [now_serving] "=&r" (tmp3)
@@ -234,8 +235,8 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
                 "       beqzl   %1, 1b                                  \n"
                 "        nop                                            \n"
                 "       .set    reorder                                 \n"
-                : "=m" (rw->lock), "=&r" (tmp)
-                : "m" (rw->lock)
+                : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp)
+                : GCC_OFF12_ASM() (rw->lock)
                 : "memory");
         } else {
                 do {
@@ -244,8 +245,8 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
                         "       bltz    %1, 1b                          \n"
                         "        addu   %1, 1                           \n"
                         "2:     sc      %1, %0                          \n"
-                        : "=m" (rw->lock), "=&r" (tmp)
-                        : "m" (rw->lock)
+                        : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp)
+                        : GCC_OFF12_ASM() (rw->lock)
                         : "memory");
                 } while (unlikely(!tmp));
         }
@@ -268,8 +269,8 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
                 "       sub     %1, 1                                   \n"
                 "       sc      %1, %0                                  \n"
                 "       beqzl   %1, 1b                                  \n"
-                : "=m" (rw->lock), "=&r" (tmp)
-                : "m" (rw->lock)
+                : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp)
+                : GCC_OFF12_ASM() (rw->lock)
                 : "memory");
         } else {
                 do {
@@ -277,8 +278,8 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
                         "1:     ll      %1, %2  # arch_read_unlock      \n"
                         "       sub     %1, 1                           \n"
                         "       sc      %1, %0                          \n"
-                        : "=m" (rw->lock), "=&r" (tmp)
-                        : "m" (rw->lock)
+                        : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp)
+                        : GCC_OFF12_ASM() (rw->lock)
                         : "memory");
                 } while (unlikely(!tmp));
         }
@@ -298,8 +299,8 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
                 "       beqzl   %1, 1b                                  \n"
                 "        nop                                            \n"
                 "       .set    reorder                                 \n"
-                : "=m" (rw->lock), "=&r" (tmp)
-                : "m" (rw->lock)
+                : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp)
+                : GCC_OFF12_ASM() (rw->lock)
                 : "memory");
         } else {
                 do {
@@ -308,8 +309,8 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
                         "       bnez    %1, 1b                          \n"
                         "        lui    %1, 0x8000                      \n"
                         "2:     sc      %1, %0                          \n"
-                        : "=m" (rw->lock), "=&r" (tmp)
-                        : "m" (rw->lock)
+                        : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp)
+                        : GCC_OFF12_ASM() (rw->lock)
                         : "memory");
                 } while (unlikely(!tmp));
         }
@@ -348,8 +349,8 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
                 __WEAK_LLSC_MB
                 "       li      %2, 1                                   \n"
                 "2:                                                     \n"
-                : "=m" (rw->lock), "=&r" (tmp), "=&r" (ret)
-                : "m" (rw->lock)
+                : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret)
+                : GCC_OFF12_ASM() (rw->lock)
                 : "memory");
         } else {
                 __asm__ __volatile__(
@@ -365,8 +366,8 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
                 __WEAK_LLSC_MB
                 "       li      %2, 1                                   \n"
                 "2:                                                     \n"
-                : "=m" (rw->lock), "=&r" (tmp), "=&r" (ret)
-                : "m" (rw->lock)
+                : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret)
+                : GCC_OFF12_ASM() (rw->lock)
                 : "memory");
         }
 
@@ -392,8 +393,8 @@ static inline int arch_write_trylock(arch_rwlock_t *rw)
                 "       li      %2, 1                                   \n"
                 "       .set    reorder                                 \n"
                 "2:                                                     \n"
-                : "=m" (rw->lock), "=&r" (tmp), "=&r" (ret)
-                : "m" (rw->lock)
+                : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret)
+                : GCC_OFF12_ASM() (rw->lock)
                 : "memory");
         } else {
                 do {
@@ -405,8 +406,9 @@ static inline int arch_write_trylock(arch_rwlock_t *rw)
                         "       sc      %1, %0                          \n"
                         "       li      %2, 1                           \n"
                         "2:                                             \n"
-                        : "=m" (rw->lock), "=&r" (tmp), "=&r" (ret)
-                        : "m" (rw->lock)
+                        : "=" GCC_OFF12_ASM() (rw->lock), "=&r" (tmp),
+                          "=&r" (ret)
+                        : GCC_OFF12_ASM() (rw->lock)
                         : "memory");
                 } while (unlikely(!tmp));
 
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 7de865805deb..99eea59604e9 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -116,6 +116,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_LOAD_WATCH          25      /* If set, load watch registers */
 #define TIF_SYSCALL_TRACEPOINT  26      /* syscall tracepoint instrumentation */
 #define TIF_32BIT_FPREGS        27      /* 32-bit floating point registers */
+#define TIF_HYBRID_FPREGS       28      /* 64b FP registers, odd singles in bits 63:32 of even doubles */
 #define TIF_USEDMSA             29      /* MSA has been used this quantum */
 #define TIF_MSA_CTX_LIVE        30      /* MSA context must be preserved */
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
@@ -135,6 +136,7 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_FPUBOUND           (1<<TIF_FPUBOUND)
 #define _TIF_LOAD_WATCH         (1<<TIF_LOAD_WATCH)
 #define _TIF_32BIT_FPREGS       (1<<TIF_32BIT_FPREGS)
+#define _TIF_HYBRID_FPREGS      (1<<TIF_HYBRID_FPREGS)
 #define _TIF_USEDMSA            (1<<TIF_USEDMSA)
 #define _TIF_MSA_CTX_LIVE       (1<<TIF_MSA_CTX_LIVE)
 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
diff --git a/arch/mips/include/asm/time.h b/arch/mips/include/asm/time.h
index 8f3047d611ee..8ab2874225c4 100644
--- a/arch/mips/include/asm/time.h
+++ b/arch/mips/include/asm/time.h
@@ -46,19 +46,17 @@ extern unsigned int mips_hpt_frequency;
  * so it lives here.
  */
 extern int (*perf_irq)(void);
+extern int __weak get_c0_perfcount_int(void);
 
 /*
  * Initialize the calling CPU's compare interrupt as clockevent device
  */
 extern unsigned int __weak get_c0_compare_int(void);
 extern int r4k_clockevent_init(void);
-extern int gic_clockevent_init(void);
 
 static inline int mips_clockevent_init(void)
 {
-#if   defined(CONFIG_CEVT_GIC)
-        return (gic_clockevent_init() | r4k_clockevent_init());
-#elif defined(CONFIG_CEVT_R4K)
+#ifdef CONFIG_CEVT_R4K
         return r4k_clockevent_init();
 #else
         return -ENXIO;
diff --git a/arch/mips/include/asm/types.h b/arch/mips/include/asm/types.h
index a845aafedee4..148d42a17f30 100644
--- a/arch/mips/include/asm/types.h
+++ b/arch/mips/include/asm/types.h
@@ -11,23 +11,7 @@
 #ifndef _ASM_TYPES_H
 #define _ASM_TYPES_H
 
-# include <asm-generic/int-ll64.h>
+#include <asm-generic/int-ll64.h>
 #include <uapi/asm/types.h>
 
-/*
- * These aren't exported outside the kernel to avoid name space clashes
- */
-#ifndef __ASSEMBLY__
-
-/*
- * Don't use phys_t.  You've been warned.
- */
-#ifdef CONFIG_64BIT_PHYS_ADDR
-typedef unsigned long long phys_t;
-#else
-typedef unsigned long phys_t;
-#endif
-
-#endif /* __ASSEMBLY__ */
-
 #endif /* _ASM_TYPES_H */
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 22a5624e2fd2..bf8b32450ef6 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -1325,33 +1325,6 @@ strncpy_from_user(char *__to, const char __user *__from, long __len)
         return res;
 }
 
-/* Returns: 0 if bad, string length+1 (memory size) of string if ok */
-static inline long __strlen_user(const char __user *s)
-{
-        long res;
-
-        if (segment_eq(get_fs(), get_ds())) {
-                __asm__ __volatile__(
-                        "move\t$4, %1\n\t"
-                        __MODULE_JAL(__strlen_kernel_nocheck_asm)
-                        "move\t%0, $2"
-                        : "=r" (res)
-                        : "r" (s)
-                        : "$2", "$4", __UA_t0, "$31");
-        } else {
-                might_fault();
-                __asm__ __volatile__(
-                        "move\t$4, %1\n\t"
-                        __MODULE_JAL(__strlen_user_nocheck_asm)
-                        "move\t%0, $2"
-                        : "=r" (res)
-                        : "r" (s)
-                        : "$2", "$4", __UA_t0, "$31");
-        }
-
-        return res;
-}
-
 /*
  * strlen_user: - Get the size of a string in user space.
  * @str: The string to measure.
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index 708c5d414905..fc1cdd25fcda 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -136,9 +136,11 @@ Ip_u1s2(_lui);
 Ip_u2s3u1(_lw);
 Ip_u3u1u2(_lwx);
 Ip_u1u2u3(_mfc0);
+Ip_u1u2u3(_mfhc0);
 Ip_u1(_mfhi);
 Ip_u1(_mflo);
 Ip_u1u2u3(_mtc0);
+Ip_u1u2u3(_mthc0);
 Ip_u3u1u2(_mul);
 Ip_u3u1u2(_or);
 Ip_u2u1u3(_ori);
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index 4bfdb9d4c186..89c22433b1c6 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -108,9 +108,10 @@ enum rt_op {
  */
 enum cop_op {
         mfc_op        = 0x00, dmfc_op       = 0x01,
-        cfc_op        = 0x02, mfhc_op       = 0x03,
-        mtc_op        = 0x04, dmtc_op       = 0x05,
-        ctc_op        = 0x06, mthc_op       = 0x07,
+        cfc_op        = 0x02, mfhc0_op      = 0x02,
+        mfhc_op       = 0x03, mtc_op        = 0x04,
+        dmtc_op       = 0x05, ctc_op        = 0x06,
+        mthc0_op      = 0x06, mthc_op       = 0x07,
         bc_op         = 0x08, cop_op        = 0x10,
         copm_op       = 0x18
 };
diff --git a/arch/mips/jz4740/setup.c b/arch/mips/jz4740/setup.c
index 76eafcb79c89..ef796f97b996 100644
--- a/arch/mips/jz4740/setup.c
+++ b/arch/mips/jz4740/setup.c
@@ -32,7 +32,7 @@ static void __init jz4740_detect_mem(void)
 {
         void __iomem *jz_emc_base;
         u32 ctrl, bus, bank, rows, cols;
-        phys_t size;
+        phys_addr_t size;
 
         jz_emc_base = ioremap(JZ4740_EMC_BASE_ADDR, 0x100);
         ctrl = readl(jz_emc_base + JZ4740_EMC_SDRAM_CTRL);
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index 008a2fed0584..92987d1bbe5f 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -4,9 +4,10 @@
 
 extra-y         := head.o vmlinux.lds
 
-obj-y           += cpu-probe.o branch.o entry.o genex.o idle.o irq.o process.o \
-                   prom.o ptrace.o reset.o setup.o signal.o syscall.o \
-                   time.o topology.o traps.o unaligned.o watch.o vdso.o
+obj-y           += cpu-probe.o branch.o elf.o entry.o genex.o idle.o irq.o \
+                   process.o prom.o ptrace.o reset.o setup.o signal.o \
+                   syscall.o time.o topology.o traps.o unaligned.o watch.o \
+                   vdso.o
 
 ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_ftrace.o = -pg
@@ -18,12 +19,10 @@ endif
 obj-$(CONFIG_CEVT_BCM1480)      += cevt-bcm1480.o
 obj-$(CONFIG_CEVT_R4K)          += cevt-r4k.o
 obj-$(CONFIG_CEVT_DS1287)       += cevt-ds1287.o
-obj-$(CONFIG_CEVT_GIC)          += cevt-gic.o
 obj-$(CONFIG_CEVT_GT641XX)      += cevt-gt641xx.o
 obj-$(CONFIG_CEVT_SB1250)       += cevt-sb1250.o
 obj-$(CONFIG_CEVT_TXX9)         += cevt-txx9.o
 obj-$(CONFIG_CSRC_BCM1480)      += csrc-bcm1480.o
-obj-$(CONFIG_CSRC_GIC)          += csrc-gic.o
 obj-$(CONFIG_CSRC_IOASIC)       += csrc-ioasic.o
 obj-$(CONFIG_CSRC_R4K)          += csrc-r4k.o
 obj-$(CONFIG_CSRC_SB1250)       += csrc-sb1250.o
@@ -68,7 +67,6 @@ obj-$(CONFIG_IRQ_CPU_RM7K)	+= irq-rm7000.o
 obj-$(CONFIG_MIPS_MSC)          += irq-msc01.o
 obj-$(CONFIG_IRQ_TXX9)          += irq_txx9.o
 obj-$(CONFIG_IRQ_GT641XX)       += irq-gt641xx.o
-obj-$(CONFIG_IRQ_GIC)           += irq-gic.o
 
 obj-$(CONFIG_KPROBES)           += kprobes.o
 obj-$(CONFIG_32BIT)             += scall32-o32.o
diff --git a/arch/mips/kernel/cevt-gic.c b/arch/mips/kernel/cevt-gic.c
deleted file mode 100644
index 6093716980b9..000000000000
--- a/arch/mips/kernel/cevt-gic.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2013  Imagination Technologies Ltd.
- */
-#include <linux/clockchips.h>
-#include <linux/interrupt.h>
-#include <linux/percpu.h>
-#include <linux/smp.h>
-#include <linux/irq.h>
-
-#include <asm/time.h>
-#include <asm/gic.h>
-#include <asm/mips-boards/maltaint.h>
-
-DEFINE_PER_CPU(struct clock_event_device, gic_clockevent_device);
-int gic_timer_irq_installed;
-
-
-static int gic_next_event(unsigned long delta, struct clock_event_device *evt)
-{
-        u64 cnt;
-        int res;
-
-        cnt = gic_read_count();
-        cnt += (u64)delta;
-        gic_write_cpu_compare(cnt, cpumask_first(evt->cpumask));
-        res = ((int)(gic_read_count() - cnt) >= 0) ? -ETIME : 0;
-        return res;
-}
-
-void gic_set_clock_mode(enum clock_event_mode mode,
-                                struct clock_event_device *evt)
-{
-        /* Nothing to do ...  */
-}
-
-irqreturn_t gic_compare_interrupt(int irq, void *dev_id)
-{
-        struct clock_event_device *cd;
-        int cpu = smp_processor_id();
-
-        gic_write_compare(gic_read_compare());
-        cd = &per_cpu(gic_clockevent_device, cpu);
-        cd->event_handler(cd);
-        return IRQ_HANDLED;
-}
-
-struct irqaction gic_compare_irqaction = {
-        .handler = gic_compare_interrupt,
-        .flags = IRQF_PERCPU | IRQF_TIMER,
-        .name = "timer",
-};
-
-
-void gic_event_handler(struct clock_event_device *dev)
-{
-}
-
-int gic_clockevent_init(void)
-{
-        unsigned int cpu = smp_processor_id();
-        struct clock_event_device *cd;
-        unsigned int irq;
-
-        if (!cpu_has_counter || !gic_frequency)
-                return -ENXIO;
-
-        irq = MIPS_GIC_IRQ_BASE;
-
-        cd = &per_cpu(gic_clockevent_device, cpu);
-
-        cd->name                = "MIPS GIC";
-        cd->features            = CLOCK_EVT_FEAT_ONESHOT |
-                                  CLOCK_EVT_FEAT_C3STOP;
-
-        clockevent_set_clock(cd, gic_frequency);
-
-        /* Calculate the min / max delta */
-        cd->max_delta_ns        = clockevent_delta2ns(0x7fffffff, cd);
-        cd->min_delta_ns        = clockevent_delta2ns(0x300, cd);
-
-        cd->rating              = 300;
-        cd->irq                 = irq;
-        cd->cpumask             = cpumask_of(cpu);
-        cd->set_next_event      = gic_next_event;
-        cd->set_mode            = gic_set_clock_mode;
-        cd->event_handler       = gic_event_handler;
-
-        clockevents_register_device(cd);
-
-        GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_MAP), 0x80000002);
-        GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_SMASK), GIC_VPE_SMASK_CMP_MSK);
-
-        if (gic_timer_irq_installed)
-                return 0;
-
-        gic_timer_irq_installed = 1;
-
-        setup_irq(irq, &gic_compare_irqaction);
-        irq_set_handler(irq, handle_percpu_irq);
-        return 0;
-}
diff --git a/arch/mips/kernel/cevt-r4k.c b/arch/mips/kernel/cevt-r4k.c
index bc127e22fdab..6acaad0480af 100644
--- a/arch/mips/kernel/cevt-r4k.c
+++ b/arch/mips/kernel/cevt-r4k.c
@@ -11,10 +11,10 @@
 #include <linux/percpu.h>
 #include <linux/smp.h>
 #include <linux/irq.h>
+#include <linux/irqchip/mips-gic.h>
 
 #include <asm/time.h>
 #include <asm/cevt-r4k.h>
-#include <asm/gic.h>
 
 static int mips_next_event(unsigned long delta,
                            struct clock_event_device *evt)
@@ -85,8 +85,8 @@ void mips_event_handler(struct clock_event_device *dev)
  */
 static int c0_compare_int_pending(void)
 {
-#ifdef CONFIG_IRQ_GIC
-        if (cpu_has_veic)
+#ifdef CONFIG_MIPS_GIC
+        if (gic_present)
                 return gic_get_timer_pending();
 #endif
         return (read_c0_cause() >> cp0_compare_irq_shift) & (1ul << CAUSEB_IP);
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index dc49cf30c2db..5342674842f5 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -69,6 +69,63 @@ static int __init htw_disable(char *s)
 
 __setup("nohtw", htw_disable);
 
+static int mips_ftlb_disabled;
+static int mips_has_ftlb_configured;
+
+static void set_ftlb_enable(struct cpuinfo_mips *c, int enable);
+
+static int __init ftlb_disable(char *s)
+{
+        unsigned int config4, mmuextdef;
+
+        /*
+         * If the core hasn't done any FTLB configuration, there is nothing
+         * for us to do here.
+         */
+        if (!mips_has_ftlb_configured)
+                return 1;
+
+        /* Disable it in the boot cpu */
+        set_ftlb_enable(&cpu_data[0], 0);
+
+        back_to_back_c0_hazard();
+
+        config4 = read_c0_config4();
+
+        /* Check that FTLB has been disabled */
+        mmuextdef = config4 & MIPS_CONF4_MMUEXTDEF;
+        /* MMUSIZEEXT == VTLB ON, FTLB OFF */
+        if (mmuextdef == MIPS_CONF4_MMUEXTDEF_FTLBSIZEEXT) {
+                /* This should never happen */
+                pr_warn("FTLB could not be disabled!\n");
+                return 1;
+        }
+
+        mips_ftlb_disabled = 1;
+        mips_has_ftlb_configured = 0;
+
+        /*
+         * noftlb is mainly used for debug purposes so print
+         * an informative message instead of using pr_debug()
+         */
+        pr_info("FTLB has been disabled\n");
+
+        /*
+         * Some of these bits are duplicated in the decode_config4.
+         * MIPS_CONF4_MMUEXTDEF_MMUSIZEEXT is the only possible case
+         * once FTLB has been disabled so undo what decode_config4 did.
+         */
+        cpu_data[0].tlbsize -= cpu_data[0].tlbsizeftlbways *
+                               cpu_data[0].tlbsizeftlbsets;
+        cpu_data[0].tlbsizeftlbsets = 0;
+        cpu_data[0].tlbsizeftlbways = 0;
+
+        return 1;
+}
+
+__setup("noftlb", ftlb_disable);
+
+
 static inline void check_errata(void)
 {
         struct cpuinfo_mips *c = &current_cpu_data;
@@ -140,7 +197,7 @@ static inline unsigned long cpu_get_fpu_id(void)
  */
 static inline int __cpu_has_fpu(void)
 {
-        return ((cpu_get_fpu_id() & FPIR_IMP_MASK) != FPIR_IMP_NONE);
+        return (cpu_get_fpu_id() & FPIR_IMP_MASK) != FPIR_IMP_NONE;
 }
 
 static inline unsigned long cpu_get_msa_id(void)
@@ -399,6 +456,8 @@ static inline unsigned int decode_config4(struct cpuinfo_mips *c)
                         ftlb_page = MIPS_CONF4_VFTLBPAGESIZE;
                         /* fall through */
                 case MIPS_CONF4_MMUEXTDEF_FTLBSIZEEXT:
+                        if (mips_ftlb_disabled)
+                                break;
                         newcf4 = (config4 & ~ftlb_page) |
                                 (page_size_ftlb(mmuextdef) <<
                                  MIPS_CONF4_FTLBPAGESIZE_SHIFT);
@@ -418,6 +477,7 @@ static inline unsigned int decode_config4(struct cpuinfo_mips *c)
                         c->tlbsizeftlbways = ((config4 & MIPS_CONF4_FTLBWAYS) >>
                                               MIPS_CONF4_FTLBWAYS_SHIFT) + 2;
                         c->tlbsize += c->tlbsizeftlbways * c->tlbsizeftlbsets;
+                        mips_has_ftlb_configured = 1;
                         break;
                 }
         }
@@ -432,7 +492,7 @@ static inline unsigned int decode_config5(struct cpuinfo_mips *c)
         unsigned int config5;
 
         config5 = read_c0_config5();
-        config5 &= ~MIPS_CONF5_UFR;
+        config5 &= ~(MIPS_CONF5_UFR | MIPS_CONF5_UFE);
         write_c0_config5(config5);
 
         if (config5 & MIPS_CONF5_EVA)
@@ -453,8 +513,8 @@ static void decode_configs(struct cpuinfo_mips *c)
 
         c->scache.flags = MIPS_CACHE_NOT_PRESENT;
 
-        /* Enable FTLB if present */
-        set_ftlb_enable(c, 1);
+        /* Enable FTLB if present and not disabled */
+        set_ftlb_enable(c, !mips_ftlb_disabled);
 
         ok = decode_config0(c);                 /* Read Config registers.  */
         BUG_ON(!ok);                            /* Arch spec violation!  */
@@ -1058,6 +1118,7 @@ static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu)
                 break;
         }
         case PRID_IMP_BMIPS5000:
+        case PRID_IMP_BMIPS5200:
                 c->cputype = CPU_BMIPS5000;
                 __cpu_name[cpu] = "Broadcom BMIPS5000";
                 set_elf_platform(cpu, "bmips5000");
@@ -1288,6 +1349,8 @@ void cpu_probe(void)
                                     MIPS_CPU_ISA_M64R1 | MIPS_CPU_ISA_M64R2)) {
                         if (c->fpu_id & MIPS_FPIR_3D)
                                 c->ases |= MIPS_ASE_MIPS3D;
+                        if (c->fpu_id & MIPS_FPIR_FREP)
+                                c->options |= MIPS_CPU_FRE;
                 }
         }
 
diff --git a/arch/mips/kernel/crash_dump.c b/arch/mips/kernel/crash_dump.c
index f291cf99b03a..6fe7790e5868 100644
--- a/arch/mips/kernel/crash_dump.c
+++ b/arch/mips/kernel/crash_dump.c
@@ -38,7 +38,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
                 kunmap_atomic(vaddr);
         } else {
                 if (!kdump_buf_page) {
-                        pr_warning("Kdump: Kdump buffer page not allocated\n");
+                        pr_warn("Kdump: Kdump buffer page not allocated\n");
 
                         return -EFAULT;
                 }
@@ -57,7 +57,7 @@ static int __init kdump_buf_page_init(void)
 
         kdump_buf_page = kmalloc(PAGE_SIZE, GFP_KERNEL);
         if (!kdump_buf_page) {
-                pr_warning("Kdump: Failed to allocate kdump buffer page\n");
+                pr_warn("Kdump: Failed to allocate kdump buffer page\n");
                 ret = -ENOMEM;
         }
 
diff --git a/arch/mips/kernel/csrc-gic.c b/arch/mips/kernel/csrc-gic.c
deleted file mode 100644
index e02620901117..000000000000
--- a/arch/mips/kernel/csrc-gic.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
- */
-#include <linux/init.h>
-#include <linux/time.h>
-
-#include <asm/gic.h>
-
-static cycle_t gic_hpt_read(struct clocksource *cs)
-{
-        return gic_read_count();
-}
-
-static struct clocksource gic_clocksource = {
-        .name   = "GIC",
-        .read   = gic_hpt_read,
-        .flags  = CLOCK_SOURCE_IS_CONTINUOUS,
-};
-
-void __init gic_clocksource_init(unsigned int frequency)
-{
-        unsigned int config, bits;
-
-        /* Calculate the clocksource mask. */
-        GICREAD(GIC_REG(SHARED, GIC_SH_CONFIG), config);
-        bits = 32 + ((config & GIC_SH_CONFIG_COUNTBITS_MSK) >>
-                (GIC_SH_CONFIG_COUNTBITS_SHF - 2));
-
-        /* Set clocksource mask. */
-        gic_clocksource.mask = CLOCKSOURCE_MASK(bits);
-
-        /* Calculate a somewhat reasonable rating value. */
-        gic_clocksource.rating = 200 + frequency / 10000000;
-
-        clocksource_register_hz(&gic_clocksource, frequency);
-}
diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
new file mode 100644
index 000000000000..c92b15df6893
--- /dev/null
+++ b/arch/mips/kernel/elf.c
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2014 Imagination Technologies
+ * Author: Paul Burton <paul.burton@imgtec.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/elf.h>
+#include <linux/sched.h>
+
+enum {
+        FP_ERROR = -1,
+        FP_DOUBLE_64A = -2,
+};
+
+int arch_elf_pt_proc(void *_ehdr, void *_phdr, struct file *elf,
+                     bool is_interp, struct arch_elf_state *state)
+{
+        struct elfhdr *ehdr = _ehdr;
+        struct elf_phdr *phdr = _phdr;
+        struct mips_elf_abiflags_v0 abiflags;
+        int ret;
+
+        if (config_enabled(CONFIG_64BIT) &&
+            (ehdr->e_ident[EI_CLASS] != ELFCLASS32))
+                return 0;
+        if (phdr->p_type != PT_MIPS_ABIFLAGS)
+                return 0;
+        if (phdr->p_filesz < sizeof(abiflags))
+                return -EINVAL;
+
+        ret = kernel_read(elf, phdr->p_offset, (char *)&abiflags,
+                          sizeof(abiflags));
+        if (ret < 0)
+                return ret;
+        if (ret != sizeof(abiflags))
+                return -EIO;
+
+        /* Record the required FP ABIs for use by mips_check_elf */
+        if (is_interp)
+                state->interp_fp_abi = abiflags.fp_abi;
+        else
+                state->fp_abi = abiflags.fp_abi;
+
+        return 0;
+}
+
+static inline unsigned get_fp_abi(struct elfhdr *ehdr, int in_abi)
+{
+        /* If the ABI requirement is provided, simply return that */
+        if (in_abi != -1)
+                return in_abi;
+
+        /* If the EF_MIPS_FP64 flag was set, return MIPS_ABI_FP_64 */
+        if (ehdr->e_flags & EF_MIPS_FP64)
+                return MIPS_ABI_FP_64;
+
+        /* Default to MIPS_ABI_FP_DOUBLE */
+        return MIPS_ABI_FP_DOUBLE;
+}
+
+int arch_check_elf(void *_ehdr, bool has_interpreter,
+                   struct arch_elf_state *state)
+{
+        struct elfhdr *ehdr = _ehdr;
+        unsigned fp_abi, interp_fp_abi, abi0, abi1;
+
+        /* Ignore non-O32 binaries */
+        if (config_enabled(CONFIG_64BIT) &&
+            (ehdr->e_ident[EI_CLASS] != ELFCLASS32))
+                return 0;
+
+        fp_abi = get_fp_abi(ehdr, state->fp_abi);
+
+        if (has_interpreter) {
+                interp_fp_abi = get_fp_abi(ehdr, state->interp_fp_abi);
+
+                abi0 = min(fp_abi, interp_fp_abi);
+                abi1 = max(fp_abi, interp_fp_abi);
+        } else {
+                abi0 = abi1 = fp_abi;
+        }
+
+        state->overall_abi = FP_ERROR;
+
+        if (abi0 == abi1) {
+                state->overall_abi = abi0;
+        } else if (abi0 == MIPS_ABI_FP_ANY) {
+                state->overall_abi = abi1;
+        } else if (abi0 == MIPS_ABI_FP_DOUBLE) {
+                switch (abi1) {
+                case MIPS_ABI_FP_XX:
+                        state->overall_abi = MIPS_ABI_FP_DOUBLE;
+                        break;
+
+                case MIPS_ABI_FP_64A:
+                        state->overall_abi = FP_DOUBLE_64A;
+                        break;
+                }
+        } else if (abi0 == MIPS_ABI_FP_SINGLE ||
+                   abi0 == MIPS_ABI_FP_SOFT) {
+                /* Cannot link with other ABIs */
+        } else if (abi0 == MIPS_ABI_FP_OLD_64) {
+                switch (abi1) {
+                case MIPS_ABI_FP_XX:
+                case MIPS_ABI_FP_64:
+                case MIPS_ABI_FP_64A:
+                        state->overall_abi = MIPS_ABI_FP_64;
+                        break;
+                }
+        } else if (abi0 == MIPS_ABI_FP_XX ||
+                   abi0 == MIPS_ABI_FP_64 ||
+                   abi0 == MIPS_ABI_FP_64A) {
+                state->overall_abi = MIPS_ABI_FP_64;
+        }
+
+        switch (state->overall_abi) {
+        case MIPS_ABI_FP_64:
+        case MIPS_ABI_FP_64A:
+        case FP_DOUBLE_64A:
+                if (!config_enabled(CONFIG_MIPS_O32_FP64_SUPPORT))
+                        return -ELIBBAD;
+                break;
+
+        case FP_ERROR:
+                return -ELIBBAD;
+        }
+
+        return 0;
+}
+
+void mips_set_personality_fp(struct arch_elf_state *state)
+{
+        if (config_enabled(CONFIG_FP32XX_HYBRID_FPRS)) {
+                /*
+                 * Use hybrid FPRs for all code which can correctly execute
+                 * with that mode.
+                 */
+                switch (state->overall_abi) {
+                case MIPS_ABI_FP_DOUBLE:
+                case MIPS_ABI_FP_SINGLE:
+                case MIPS_ABI_FP_SOFT:
+                case MIPS_ABI_FP_XX:
+                case MIPS_ABI_FP_ANY:
+                        /* FR=1, FRE=1 */
+                        clear_thread_flag(TIF_32BIT_FPREGS);
+                        set_thread_flag(TIF_HYBRID_FPREGS);
+                        return;
+                }
+        }
+
+        switch (state->overall_abi) {
+        case MIPS_ABI_FP_DOUBLE:
+        case MIPS_ABI_FP_SINGLE:
+        case MIPS_ABI_FP_SOFT:
+                /* FR=0 */
+                set_thread_flag(TIF_32BIT_FPREGS);
+                clear_thread_flag(TIF_HYBRID_FPREGS);
+                break;
+
+        case FP_DOUBLE_64A:
+                /* FR=1, FRE=1 */
+                clear_thread_flag(TIF_32BIT_FPREGS);
+                set_thread_flag(TIF_HYBRID_FPREGS);
+                break;
+
+        case MIPS_ABI_FP_64:
+        case MIPS_ABI_FP_64A:
+                /* FR=1, FRE=0 */
+                clear_thread_flag(TIF_32BIT_FPREGS);
+                clear_thread_flag(TIF_HYBRID_FPREGS);
+                break;
+
+        case MIPS_ABI_FP_XX:
+        case MIPS_ABI_FP_ANY:
+                if (!config_enabled(CONFIG_MIPS_O32_FP64_SUPPORT))
+                        set_thread_flag(TIF_32BIT_FPREGS);
+                else
+                        clear_thread_flag(TIF_32BIT_FPREGS);
+
+                clear_thread_flag(TIF_HYBRID_FPREGS);
+                break;
+
+        default:
+        case FP_ERROR:
+                BUG();
+        }
+}
diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
index 50b364897dda..a74ec3ae557c 100644
--- a/arch/mips/kernel/i8259.c
+++ b/arch/mips/kernel/i8259.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
+#include <linux/irqdomain.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
 #include <linux/syscore_ops.h>
@@ -308,6 +309,19 @@ static struct resource pic2_io_resource = {
         .flags = IORESOURCE_BUSY
 };
 
+static int i8259A_irq_domain_map(struct irq_domain *d, unsigned int virq,
+                                 irq_hw_number_t hw)
+{
+        irq_set_chip_and_handler(virq, &i8259A_chip, handle_level_irq);
+        irq_set_probe(virq);
+        return 0;
+}
+
+static struct irq_domain_ops i8259A_ops = {
+        .map = i8259A_irq_domain_map,
+        .xlate = irq_domain_xlate_onecell,
+};
+
 /*
  * On systems with i8259-style interrupt controllers we assume for
  * driver compatibility reasons interrupts 0 - 15 to be the i8259
@@ -315,17 +329,17 @@ static struct resource pic2_io_resource = {
  */
 void __init init_i8259_irqs(void)
 {
-        int i;
+        struct irq_domain *domain;
 
         insert_resource(&ioport_resource, &pic1_io_resource);
         insert_resource(&ioport_resource, &pic2_io_resource);
 
         init_8259A(0);
 
-        for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++) {
-                irq_set_chip_and_handler(i, &i8259A_chip, handle_level_irq);
-                irq_set_probe(i);
-        }
+        domain = irq_domain_add_legacy(NULL, 16, I8259A_IRQ_BASE, 0,
+                                       &i8259A_ops, NULL);
+        if (!domain)
+                panic("Failed to add i8259 IRQ domain");
 
         setup_irq(I8259A_IRQ_BASE + PIC_CASCADE_IR, &irq2);
 }
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
deleted file mode 100644
index 9e9d8b9a5b97..000000000000
--- a/arch/mips/kernel/irq-gic.c
+++ /dev/null
@@ -1,402 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2008 Ralf Baechle (ralf@linux-mips.org)
- * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
- */
-#include <linux/bitmap.h>
-#include <linux/init.h>
-#include <linux/smp.h>
-#include <linux/irq.h>
-#include <linux/clocksource.h>
-
-#include <asm/io.h>
-#include <asm/gic.h>
-#include <asm/setup.h>
-#include <asm/traps.h>
-#include <linux/hardirq.h>
-#include <asm-generic/bitops/find.h>
-
-unsigned int gic_frequency;
-unsigned int gic_present;
-unsigned long _gic_base;
-unsigned int gic_irq_base;
-unsigned int gic_irq_flags[GIC_NUM_INTRS];
-
-/* The index into this array is the vector # of the interrupt. */
-struct gic_shared_intr_map gic_shared_intr_map[GIC_NUM_INTRS];
-
-struct gic_pcpu_mask {
-        DECLARE_BITMAP(pcpu_mask, GIC_NUM_INTRS);
-};
-
-struct gic_pending_regs {
-        DECLARE_BITMAP(pending, GIC_NUM_INTRS);
-};
-
-struct gic_intrmask_regs {
-        DECLARE_BITMAP(intrmask, GIC_NUM_INTRS);
-};
-
-static struct gic_pcpu_mask pcpu_masks[NR_CPUS];
-static struct gic_pending_regs pending_regs[NR_CPUS];
-static struct gic_intrmask_regs intrmask_regs[NR_CPUS];
-
-#if defined(CONFIG_CSRC_GIC) || defined(CONFIG_CEVT_GIC)
-cycle_t gic_read_count(void)
-{
-        unsigned int hi, hi2, lo;
-
-        do {
-                GICREAD(GIC_REG(SHARED, GIC_SH_COUNTER_63_32), hi);
-                GICREAD(GIC_REG(SHARED, GIC_SH_COUNTER_31_00), lo);
-                GICREAD(GIC_REG(SHARED, GIC_SH_COUNTER_63_32), hi2);
-        } while (hi2 != hi);
-
-        return (((cycle_t) hi) << 32) + lo;
-}
-
-void gic_write_compare(cycle_t cnt)
-{
-        GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_HI),
-                                (int)(cnt >> 32));
-        GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_LO),
-                                (int)(cnt & 0xffffffff));
-}
-
-void gic_write_cpu_compare(cycle_t cnt, int cpu)
-{
-        unsigned long flags;
-
-        local_irq_save(flags);
-
-        GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), cpu);
-        GICWRITE(GIC_REG(VPE_OTHER, GIC_VPE_COMPARE_HI),
-                                (int)(cnt >> 32));
-        GICWRITE(GIC_REG(VPE_OTHER, GIC_VPE_COMPARE_LO),
-                                (int)(cnt & 0xffffffff));
-
-        local_irq_restore(flags);
-}
-
-cycle_t gic_read_compare(void)
-{
-        unsigned int hi, lo;
-
-        GICREAD(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_HI), hi);
-        GICREAD(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_LO), lo);
-
-        return (((cycle_t) hi) << 32) + lo;
-}
-#endif
-
-unsigned int gic_get_timer_pending(void)
-{
-        unsigned int vpe_pending;
-
-        GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), 0);
-        GICREAD(GIC_REG(VPE_OTHER, GIC_VPE_PEND), vpe_pending);
-        return (vpe_pending & GIC_VPE_PEND_TIMER_MSK);
-}
-
-void gic_bind_eic_interrupt(int irq, int set)
-{
-        /* Convert irq vector # to hw int # */
-        irq -= GIC_PIN_TO_VEC_OFFSET;
-
-        /* Set irq to use shadow set */
-        GICWRITE(GIC_REG_ADDR(VPE_LOCAL, GIC_VPE_EIC_SS(irq)), set);
-}
-
-void gic_send_ipi(unsigned int intr)
-{
-        GICWRITE(GIC_REG(SHARED, GIC_SH_WEDGE), 0x80000000 | intr);
-}
-
-static void gic_eic_irq_dispatch(void)
-{
-        unsigned int cause = read_c0_cause();
-        int irq;
-
-        irq = (cause & ST0_IM) >> STATUSB_IP2;
-        if (irq == 0)
-                irq = -1;
-
-        if (irq >= 0)
-                do_IRQ(gic_irq_base + irq);
-        else
-                spurious_interrupt();
-}
-
-static void __init vpe_local_setup(unsigned int numvpes)
-{
-        unsigned long timer_intr = GIC_INT_TMR;
-        unsigned long perf_intr = GIC_INT_PERFCTR;
-        unsigned int vpe_ctl;
-        int i;
-
-        if (cpu_has_veic) {
-                /*
-                 * GIC timer interrupt -> CPU HW Int X (vector X+2) ->
-                 * map to pin X+2-1 (since GIC adds 1)
-                 */
-                timer_intr += (GIC_CPU_TO_VEC_OFFSET - GIC_PIN_TO_VEC_OFFSET);
-                /*
-                 * GIC perfcnt interrupt -> CPU HW Int X (vector X+2) ->
-                 * map to pin X+2-1 (since GIC adds 1)
-                 */
-                perf_intr += (GIC_CPU_TO_VEC_OFFSET - GIC_PIN_TO_VEC_OFFSET);
-        }
-
-        /*
-         * Setup the default performance counter timer interrupts
-         * for all VPEs
-         */
-        for (i = 0; i < numvpes; i++) {
-                GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), i);
-
-                /* Are Interrupts locally routable? */
-                GICREAD(GIC_REG(VPE_OTHER, GIC_VPE_CTL), vpe_ctl);
-                if (vpe_ctl & GIC_VPE_CTL_TIMER_RTBL_MSK)
-                        GICWRITE(GIC_REG(VPE_OTHER, GIC_VPE_TIMER_MAP),
-                                 GIC_MAP_TO_PIN_MSK | timer_intr);
-                if (cpu_has_veic) {
-                        set_vi_handler(timer_intr + GIC_PIN_TO_VEC_OFFSET,
-                                gic_eic_irq_dispatch);
-                        gic_shared_intr_map[timer_intr + GIC_PIN_TO_VEC_OFFSET].local_intr_mask |= GIC_VPE_RMASK_TIMER_MSK;
-                }
-
-                if (vpe_ctl & GIC_VPE_CTL_PERFCNT_RTBL_MSK)
-                        GICWRITE(GIC_REG(VPE_OTHER, GIC_VPE_PERFCTR_MAP),
-                                 GIC_MAP_TO_PIN_MSK | perf_intr);
-                if (cpu_has_veic) {
-                        set_vi_handler(perf_intr + GIC_PIN_TO_VEC_OFFSET, gic_eic_irq_dispatch);
-                        gic_shared_intr_map[perf_intr + GIC_PIN_TO_VEC_OFFSET].local_intr_mask |= GIC_VPE_RMASK_PERFCNT_MSK;
-                }
-        }
-}
-
-unsigned int gic_compare_int(void)
-{
-        unsigned int pending;
-
-        GICREAD(GIC_REG(VPE_LOCAL, GIC_VPE_PEND), pending);
-        if (pending & GIC_VPE_PEND_CMP_MSK)
-                return 1;
-        else
-                return 0;
-}
-
-void gic_get_int_mask(unsigned long *dst, const unsigned long *src)
-{
-        unsigned int i;
-        unsigned long *pending, *intrmask, *pcpu_mask;
-        unsigned long *pending_abs, *intrmask_abs;
-
-        /* Get per-cpu bitmaps */
-        pending = pending_regs[smp_processor_id()].pending;
-        intrmask = intrmask_regs[smp_processor_id()].intrmask;
-        pcpu_mask = pcpu_masks[smp_processor_id()].pcpu_mask;
-
-        pending_abs = (unsigned long *) GIC_REG_ABS_ADDR(SHARED,
-                                                         GIC_SH_PEND_31_0_OFS);
-        intrmask_abs = (unsigned long *) GIC_REG_ABS_ADDR(SHARED,
-                                                          GIC_SH_MASK_31_0_OFS);
-
-        for (i = 0; i < BITS_TO_LONGS(GIC_NUM_INTRS); i++) {
-                GICREAD(*pending_abs, pending[i]);
-                GICREAD(*intrmask_abs, intrmask[i]);
-                pending_abs++;
-                intrmask_abs++;
-        }
-
-        bitmap_and(pending, pending, intrmask, GIC_NUM_INTRS);
-        bitmap_and(pending, pending, pcpu_mask, GIC_NUM_INTRS);
-        bitmap_and(dst, src, pending, GIC_NUM_INTRS);
-}
-
-unsigned int gic_get_int(void)
-{
-        DECLARE_BITMAP(interrupts, GIC_NUM_INTRS);
-
-        bitmap_fill(interrupts, GIC_NUM_INTRS);
-        gic_get_int_mask(interrupts, interrupts);
-
-        return find_first_bit(interrupts, GIC_NUM_INTRS);
-}
-
-static void gic_mask_irq(struct irq_data *d)
-{
-        GIC_CLR_INTR_MASK(d->irq - gic_irq_base);
-}
-
-static void gic_unmask_irq(struct irq_data *d)
-{
-        GIC_SET_INTR_MASK(d->irq - gic_irq_base);
-}
-
-#ifdef CONFIG_SMP
-static DEFINE_SPINLOCK(gic_lock);
-
-static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,
-                            bool force)
-{
-        unsigned int irq = (d->irq - gic_irq_base);
-        cpumask_t       tmp = CPU_MASK_NONE;
-        unsigned long   flags;
-        int             i;
-
-        cpumask_and(&tmp, cpumask, cpu_online_mask);
-        if (cpus_empty(tmp))
-                return -1;
-
-        /* Assumption : cpumask refers to a single CPU */
-        spin_lock_irqsave(&gic_lock, flags);
-
-        /* Re-route this IRQ */
-        GIC_SH_MAP_TO_VPE_SMASK(irq, first_cpu(tmp));
-
-        /* Update the pcpu_masks */
-        for (i = 0; i < NR_CPUS; i++)
-                clear_bit(irq, pcpu_masks[i].pcpu_mask);
-        set_bit(irq, pcpu_masks[first_cpu(tmp)].pcpu_mask);
-
-        cpumask_copy(d->affinity, cpumask);
-        spin_unlock_irqrestore(&gic_lock, flags);
-
-        return IRQ_SET_MASK_OK_NOCOPY;
-}
-#endif
-
-static struct irq_chip gic_irq_controller = {
-        .name                   =       "MIPS GIC",
-        .irq_ack                =       gic_irq_ack,
-        .irq_mask               =       gic_mask_irq,
-        .irq_mask_ack           =       gic_mask_irq,
-        .irq_unmask             =       gic_unmask_irq,
-        .irq_eoi                =       gic_finish_irq,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       =       gic_set_affinity,
-#endif
-};
-
-static void __init gic_setup_intr(unsigned int intr, unsigned int cpu,
-        unsigned int pin, unsigned int polarity, unsigned int trigtype,
-        unsigned int flags)
-{
-        struct gic_shared_intr_map *map_ptr;
-
-        /* Setup Intr to Pin mapping */
-        if (pin & GIC_MAP_TO_NMI_MSK) {
-                int i;
-
-                GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin);
-                /* FIXME: hack to route NMI to all cpu's */
-                for (i = 0; i < NR_CPUS; i += 32) {
-                        GICWRITE(GIC_REG_ADDR(SHARED,
-                                          GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)),
-                                 0xffffffff);
-                }
-        } else {
-                GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)),
-                         GIC_MAP_TO_PIN_MSK | pin);
-                /* Setup Intr to CPU mapping */
-                GIC_SH_MAP_TO_VPE_SMASK(intr, cpu);
-                if (cpu_has_veic) {
-                        set_vi_handler(pin + GIC_PIN_TO_VEC_OFFSET,
-                                gic_eic_irq_dispatch);
-                        map_ptr = &gic_shared_intr_map[pin + GIC_PIN_TO_VEC_OFFSET];
-                        if (map_ptr->num_shared_intr >= GIC_MAX_SHARED_INTR)
-                                BUG();
-                        map_ptr->intr_list[map_ptr->num_shared_intr++] = intr;
-                }
-        }
-
-        /* Setup Intr Polarity */
-        GIC_SET_POLARITY(intr, polarity);
-
-        /* Setup Intr Trigger Type */
-        GIC_SET_TRIGGER(intr, trigtype);
-
-        /* Init Intr Masks */
-        GIC_CLR_INTR_MASK(intr);
-
-        /* Initialise per-cpu Interrupt software masks */
-        set_bit(intr, pcpu_masks[cpu].pcpu_mask);
-
-        if ((flags & GIC_FLAG_TRANSPARENT) && (cpu_has_veic == 0))
-                GIC_SET_INTR_MASK(intr);
-        if (trigtype == GIC_TRIG_EDGE)
-                gic_irq_flags[intr] |= GIC_TRIG_EDGE;
-}
-
-static void __init gic_basic_init(int numintrs, int numvpes,
-                        struct gic_intr_map *intrmap, int mapsize)
-{
-        unsigned int i, cpu;
-        unsigned int pin_offset = 0;
-
-        board_bind_eic_interrupt = &gic_bind_eic_interrupt;
-
-        /* Setup defaults */
-        for (i = 0; i < numintrs; i++) {
-                GIC_SET_POLARITY(i, GIC_POL_POS);
-                GIC_SET_TRIGGER(i, GIC_TRIG_LEVEL);
-                GIC_CLR_INTR_MASK(i);
-                if (i < GIC_NUM_INTRS) {
-                        gic_irq_flags[i] = 0;
-                        gic_shared_intr_map[i].num_shared_intr = 0;
-                        gic_shared_intr_map[i].local_intr_mask = 0;
-                }
-        }
-
-        /*
-         * In EIC mode, the HW_INT# is offset by (2-1). Need to subtract
-         * one because the GIC will add one (since 0=no intr).
-         */
-        if (cpu_has_veic)
-                pin_offset = (GIC_CPU_TO_VEC_OFFSET - GIC_PIN_TO_VEC_OFFSET);
-
-        /* Setup specifics */
-        for (i = 0; i < mapsize; i++) {
-                cpu = intrmap[i].cpunum;
-                if (cpu == GIC_UNUSED)
-                        continue;
-                gic_setup_intr(i,
-                        intrmap[i].cpunum,
-                        intrmap[i].pin + pin_offset,
-                        intrmap[i].polarity,
-                        intrmap[i].trigtype,
-                        intrmap[i].flags);
-        }
-
-        vpe_local_setup(numvpes);
-}
-
-void __init gic_init(unsigned long gic_base_addr,
-                     unsigned long gic_addrspace_size,
-                     struct gic_intr_map *intr_map, unsigned int intr_map_size,
-                     unsigned int irqbase)
-{
-        unsigned int gicconfig;
-        int numvpes, numintrs;
-
-        _gic_base = (unsigned long) ioremap_nocache(gic_base_addr,
-                                                    gic_addrspace_size);
-        gic_irq_base = irqbase;
-
-        GICREAD(GIC_REG(SHARED, GIC_SH_CONFIG), gicconfig);
-        numintrs = (gicconfig & GIC_SH_CONFIG_NUMINTRS_MSK) >>
-                   GIC_SH_CONFIG_NUMINTRS_SHF;
-        numintrs = ((numintrs + 1) * 8);
-
-        numvpes = (gicconfig & GIC_SH_CONFIG_NUMVPES_MSK) >>
-                  GIC_SH_CONFIG_NUMVPES_SHF;
-        numvpes = numvpes + 1;
-
-        gic_basic_init(numintrs, numvpes, intr_map, intr_map_size);
-
-        gic_platform_init(numintrs, &gic_irq_controller);
-}
diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c
index e498f2b3646a..590c2c980fd3 100644
--- a/arch/mips/kernel/irq_cpu.c
+++ b/arch/mips/kernel/irq_cpu.c
@@ -36,6 +36,7 @@
 #include <asm/irq_cpu.h>
 #include <asm/mipsregs.h>
 #include <asm/mipsmtregs.h>
+#include <asm/setup.h>
 
 static inline void unmask_mips_irq(struct irq_data *d)
 {
@@ -94,28 +95,24 @@ static struct irq_chip mips_mt_cpu_irq_controller = {
         .irq_eoi        = unmask_mips_irq,
 };
 
-void __init mips_cpu_irq_init(void)
+asmlinkage void __weak plat_irq_dispatch(void)
 {
-        int irq_base = MIPS_CPU_IRQ_BASE;
-        int i;
+        unsigned long pending = read_c0_cause() & read_c0_status() & ST0_IM;
+        int irq;
 
-        /* Mask interrupts. */
-        clear_c0_status(ST0_IM);
-        clear_c0_cause(CAUSEF_IP);
-
-        /* Software interrupts are used for MT/CMT IPI */
-        for (i = irq_base; i < irq_base + 2; i++)
-                irq_set_chip_and_handler(i, cpu_has_mipsmt ?
-                                         &mips_mt_cpu_irq_controller :
-                                         &mips_cpu_irq_controller,
-                                         handle_percpu_irq);
+        if (!pending) {
+                spurious_interrupt();
+                return;
+        }
 
-        for (i = irq_base + 2; i < irq_base + 8; i++)
-                irq_set_chip_and_handler(i, &mips_cpu_irq_controller,
-                                         handle_percpu_irq);
+        pending >>= CAUSEB_IP;
+        while (pending) {
+                irq = fls(pending) - 1;
+                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
+                pending &= ~BIT(irq);
+        }
 }
 
-#ifdef CONFIG_IRQ_DOMAIN
 static int mips_cpu_intc_map(struct irq_domain *d, unsigned int irq,
                              irq_hw_number_t hw)
 {
@@ -128,6 +125,9 @@ static int mips_cpu_intc_map(struct irq_domain *d, unsigned int irq,
                 chip = &mips_cpu_irq_controller;
         }
 
+        if (cpu_has_vint)
+                set_vi_handler(hw, plat_irq_dispatch);
+
         irq_set_chip_and_handler(irq, chip, handle_percpu_irq);
 
         return 0;
@@ -138,8 +138,7 @@ static const struct irq_domain_ops mips_cpu_intc_irq_domain_ops = {
         .xlate = irq_domain_xlate_onecell,
 };
 
-int __init mips_cpu_intc_init(struct device_node *of_node,
-                              struct device_node *parent)
+static void __init __mips_cpu_irq_init(struct device_node *of_node)
 {
         struct irq_domain *domain;
 
@@ -151,7 +150,16 @@ int __init mips_cpu_intc_init(struct device_node *of_node,
                                        &mips_cpu_intc_irq_domain_ops, NULL);
         if (!domain)
                 panic("Failed to add irqdomain for MIPS CPU");
+}
 
+void __init mips_cpu_irq_init(void)
+{
+        __mips_cpu_irq_init(NULL);
+}
+
+int __init mips_cpu_irq_of_init(struct device_node *of_node,
+                                struct device_node *parent)
+{
+        __mips_cpu_irq_init(of_node);
         return 0;
 }
-#endif /* CONFIG_IRQ_DOMAIN */
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index f76f7a08412d..85bbe9b96759 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -16,7 +16,7 @@
 void __iomem *mips_cm_base;
 void __iomem *mips_cm_l2sync_base;
 
-phys_t __mips_cm_phys_base(void)
+phys_addr_t __mips_cm_phys_base(void)
 {
         u32 config3 = read_c0_config3();
         u32 cmgcr;
@@ -30,10 +30,10 @@ phys_t __mips_cm_phys_base(void)
         return (cmgcr & MIPS_CMGCRF_BASE) << (36 - 32);
 }
 
-phys_t mips_cm_phys_base(void)
+phys_addr_t mips_cm_phys_base(void)
         __attribute__((weak, alias("__mips_cm_phys_base")));
 
-phys_t __mips_cm_l2sync_phys_base(void)
+phys_addr_t __mips_cm_l2sync_phys_base(void)
 {
         u32 base_reg;
 
@@ -49,13 +49,13 @@ phys_t __mips_cm_l2sync_phys_base(void)
         return mips_cm_phys_base() + MIPS_CM_GCR_SIZE;
 }
 
-phys_t mips_cm_l2sync_phys_base(void)
+phys_addr_t mips_cm_l2sync_phys_base(void)
         __attribute__((weak, alias("__mips_cm_l2sync_phys_base")));
 
 static void mips_cm_probe_l2sync(void)
 {
         unsigned major_rev;
-        phys_t addr;
+        phys_addr_t addr;
 
         /* L2-only sync was introduced with CM major revision 6 */
         major_rev = (read_gcr_rev() & CM_GCR_REV_MAJOR_MSK) >>
@@ -78,7 +78,7 @@ static void mips_cm_probe_l2sync(void)
 
 int mips_cm_probe(void)
 {
-        phys_t addr;
+        phys_addr_t addr;
         u32 base_reg;
 
         addr = mips_cm_phys_base();
diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
index ba473608a347..11964501c4b0 100644
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -21,7 +21,7 @@ static DEFINE_PER_CPU_ALIGNED(spinlock_t, cpc_core_lock);
 
 static DEFINE_PER_CPU_ALIGNED(unsigned long, cpc_core_lock_flags);
 
-phys_t __weak mips_cpc_phys_base(void)
+phys_addr_t __weak mips_cpc_phys_base(void)
 {
         u32 cpc_base;
 
@@ -44,7 +44,7 @@ phys_t __weak mips_cpc_phys_base(void)
 
 int mips_cpc_probe(void)
 {
-        phys_t addr;
+        phys_addr_t addr;
         unsigned cpu;
 
         for_each_possible_cpu(cpu)
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index 2607c3a4ff7e..17eaf0cf760c 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -24,9 +24,7 @@ extern long __strncpy_from_user_nocheck_asm(char *__to,
                                             const char *__from, long __len);
 extern long __strncpy_from_user_asm(char *__to, const char *__from,
                                     long __len);
-extern long __strlen_kernel_nocheck_asm(const char *s);
 extern long __strlen_kernel_asm(const char *s);
-extern long __strlen_user_nocheck_asm(const char *s);
 extern long __strlen_user_asm(const char *s);
 extern long __strnlen_kernel_nocheck_asm(const char *s);
 extern long __strnlen_kernel_asm(const char *s);
@@ -62,9 +60,7 @@ EXPORT_SYMBOL(__strncpy_from_kernel_nocheck_asm);
 EXPORT_SYMBOL(__strncpy_from_kernel_asm);
 EXPORT_SYMBOL(__strncpy_from_user_nocheck_asm);
 EXPORT_SYMBOL(__strncpy_from_user_asm);
-EXPORT_SYMBOL(__strlen_kernel_nocheck_asm);
 EXPORT_SYMBOL(__strlen_kernel_asm);
-EXPORT_SYMBOL(__strlen_user_nocheck_asm);
 EXPORT_SYMBOL(__strlen_user_asm);
 EXPORT_SYMBOL(__strnlen_kernel_nocheck_asm);
 EXPORT_SYMBOL(__strnlen_kernel_asm);
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index a8f9cdc6f8b0..9466184d0039 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -561,8 +561,8 @@ static int mipspmu_get_irq(void)
                         IRQF_PERCPU | IRQF_NOBALANCING | IRQF_NO_THREAD,
                         "mips_perf_pmu", NULL);
                 if (err) {
-                        pr_warning("Unable to request IRQ%d for MIPS "
-                           "performance counters!\n", mipspmu.irq);
+                        pr_warn("Unable to request IRQ%d for MIPS performance counters!\n",
+                                mipspmu.irq);
                 }
         } else if (cp0_perfcount_irq < 0) {
                 /*
@@ -572,8 +572,7 @@ static int mipspmu_get_irq(void)
                 perf_irq = mipsxx_pmu_handle_shared_irq;
                 err = 0;
         } else {
-                pr_warning("The platform hasn't properly defined its "
-                        "interrupt controller.\n");
+                pr_warn("The platform hasn't properly defined its interrupt controller\n");
                 err = -ENOENT;
         }
 
@@ -1614,22 +1613,13 @@ init_hw_perf_events(void)
                 counters = counters_total_to_per_cpu(counters);
 #endif
 
-#ifdef MSC01E_INT_BASE
-        if (cpu_has_veic) {
-                /*
-                 * Using platform specific interrupt controller defines.
-                 */
-                irq = MSC01E_INT_BASE + MSC01E_INT_PERFCTR;
-        } else {
-#endif
-                if ((cp0_perfcount_irq >= 0) &&
-                                (cp0_compare_irq != cp0_perfcount_irq))
-                        irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
-                else
-                        irq = -1;
-#ifdef MSC01E_INT_BASE
-        }
-#endif
+        if (get_c0_perfcount_int)
+                irq = get_c0_perfcount_int();
+        else if ((cp0_perfcount_irq >= 0) &&
+                 (cp0_compare_irq != cp0_perfcount_irq))
+                irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
+        else
+                irq = -1;
 
         mipspmu.map_raw_event = mipsxx_pmu_map_raw_event;
 
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 636b0745d7c7..eb76434828e8 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -42,6 +42,7 @@
 #include <asm/isadep.h>
 #include <asm/inst.h>
 #include <asm/stacktrace.h>
+#include <asm/irq_regs.h>
 
 #ifdef CONFIG_HOTPLUG_CPU
 void arch_cpu_idle_dead(void)
@@ -187,21 +188,21 @@ static inline int is_ra_save_ins(union mips_instruction *ip)
          */
         if (mm_insn_16bit(ip->halfword[0])) {
                 mmi.word = (ip->halfword[0] << 16);
-                return ((mmi.mm16_r5_format.opcode == mm_swsp16_op &&
-                         mmi.mm16_r5_format.rt == 31) ||
-                        (mmi.mm16_m_format.opcode == mm_pool16c_op &&
-                         mmi.mm16_m_format.func == mm_swm16_op));
+                return (mmi.mm16_r5_format.opcode == mm_swsp16_op &&
+                        mmi.mm16_r5_format.rt == 31) ||
+                       (mmi.mm16_m_format.opcode == mm_pool16c_op &&
+                        mmi.mm16_m_format.func == mm_swm16_op);
         }
         else {
                 mmi.halfword[0] = ip->halfword[1];
                 mmi.halfword[1] = ip->halfword[0];
-                return ((mmi.mm_m_format.opcode == mm_pool32b_op &&
-                         mmi.mm_m_format.rd > 9 &&
-                         mmi.mm_m_format.base == 29 &&
-                         mmi.mm_m_format.func == mm_swm32_func) ||
-                        (mmi.i_format.opcode == mm_sw32_op &&
-                         mmi.i_format.rs == 29 &&
-                         mmi.i_format.rt == 31));
+                return (mmi.mm_m_format.opcode == mm_pool32b_op &&
+                        mmi.mm_m_format.rd > 9 &&
+                        mmi.mm_m_format.base == 29 &&
+                        mmi.mm_m_format.func == mm_swm32_func) ||
+                       (mmi.i_format.opcode == mm_sw32_op &&
+                        mmi.i_format.rs == 29 &&
+                        mmi.i_format.rt == 31);
         }
 #else
         /* sw / sd $ra, offset($sp) */
@@ -233,7 +234,7 @@ static inline int is_jump_ins(union mips_instruction *ip)
         if (ip->r_format.opcode != mm_pool32a_op ||
                         ip->r_format.func != mm_pool32axf_op)
                 return 0;
-        return (((ip->u_format.uimmediate >> 6) & mm_jalr_op) == mm_jalr_op);
+        return ((ip->u_format.uimmediate >> 6) & mm_jalr_op) == mm_jalr_op;
 #else
         if (ip->j_format.opcode == j_op)
                 return 1;
@@ -260,13 +261,13 @@ static inline int is_sp_move_ins(union mips_instruction *ip)
                 union mips_instruction mmi;
 
                 mmi.word = (ip->halfword[0] << 16);
-                return ((mmi.mm16_r3_format.opcode == mm_pool16d_op &&
-                         mmi.mm16_r3_format.simmediate && mm_addiusp_func) ||
-                        (mmi.mm16_r5_format.opcode == mm_pool16d_op &&
-                         mmi.mm16_r5_format.rt == 29));
+                return (mmi.mm16_r3_format.opcode == mm_pool16d_op &&
+                        mmi.mm16_r3_format.simmediate && mm_addiusp_func) ||
+                       (mmi.mm16_r5_format.opcode == mm_pool16d_op &&
+                        mmi.mm16_r5_format.rt == 29);
         }
-        return (ip->mm_i_format.opcode == mm_addiu32_op &&
-                 ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29);
+        return ip->mm_i_format.opcode == mm_addiu32_op &&
+               ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29;
 #else
         /* addiu/daddiu sp,sp,-imm */
         if (ip->i_format.rs != 29 || ip->i_format.rt != 29)
@@ -532,3 +533,20 @@ unsigned long arch_align_stack(unsigned long sp)
 
         return sp & ALMASK;
 }
+
+static void arch_dump_stack(void *info)
+{
+        struct pt_regs *regs;
+
+        regs = get_irq_regs();
+
+        if (regs)
+                show_regs(regs);
+
+        dump_stack();
+}
+
+void arch_trigger_all_cpu_backtrace(bool include_self)
+{
+        smp_call_function(arch_dump_stack, NULL, 1);
+}
diff --git a/arch/mips/kernel/prom.c b/arch/mips/kernel/prom.c
index 5d39bb85bf35..452d4350ce42 100644
--- a/arch/mips/kernel/prom.c
+++ b/arch/mips/kernel/prom.c
@@ -16,6 +16,7 @@
 #include <linux/debugfs.h>
 #include <linux/of.h>
 #include <linux/of_fdt.h>
+#include <linux/of_platform.h>
 
 #include <asm/page.h>
 #include <asm/prom.h>
@@ -54,4 +55,21 @@ void __init __dt_setup_arch(void *bph)
 
         mips_set_machine_name(of_flat_dt_get_machine_name());
 }
+
+int __init __dt_register_buses(const char *bus0, const char *bus1)
+{
+        static struct of_device_id of_ids[3];
+
+        if (!of_have_populated_dt())
+                panic("device tree not present");
+
+        strlcpy(of_ids[0].compatible, bus0, sizeof(of_ids[0].compatible));
+        strlcpy(of_ids[1].compatible, bus1, sizeof(of_ids[1].compatible));
+
+        if (of_platform_populate(NULL, of_ids, NULL, NULL))
+                panic("failed to populate DT");
+
+        return 0;
+}
+
 #endif
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index f3b635f86c39..058929041368 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -82,14 +82,14 @@ static struct resource data_resource = { .name = "Kernel data", };
 
 static void *detect_magic __initdata = detect_memory_region;
 
-void __init add_memory_region(phys_t start, phys_t size, long type)
+void __init add_memory_region(phys_addr_t start, phys_addr_t size, long type)
 {
         int x = boot_mem_map.nr_map;
         int i;
 
         /* Sanity check */
         if (start + size < start) {
-                pr_warning("Trying to add an invalid memory region, skipped\n");
+                pr_warn("Trying to add an invalid memory region, skipped\n");
                 return;
         }
 
@@ -127,10 +127,10 @@ void __init add_memory_region(phys_t start, phys_t size, long type)
         boot_mem_map.nr_map++;
 }
 
-void __init detect_memory_region(phys_t start, phys_t sz_min, phys_t sz_max)
+void __init detect_memory_region(phys_addr_t start, phys_addr_t sz_min, phys_addr_t sz_max)
 {
         void *dm = &detect_magic;
-        phys_t size;
+        phys_addr_t size;
 
         for (size = sz_min; size < sz_max; size <<= 1) {
                 if (!memcmp(dm, dm + size, sizeof(detect_magic)))
@@ -493,7 +493,7 @@ static int usermem __initdata;
 
 static int __init early_parse_mem(char *p)
 {
-        phys_t start, size;
+        phys_addr_t start, size;
 
         /*
          * If a user specifies memory size, we
@@ -545,9 +545,9 @@ static int __init early_parse_elfcorehdr(char *p)
 early_param("elfcorehdr", early_parse_elfcorehdr);
 #endif
 
-static void __init arch_mem_addpart(phys_t mem, phys_t end, int type)
+static void __init arch_mem_addpart(phys_addr_t mem, phys_addr_t end, int type)
 {
-        phys_t size;
+        phys_addr_t size;
         int i;
 
         size = end - mem;
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 16f1e4f2bf3c..545bf11bd2ed 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -530,7 +530,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
         struct mips_abi *abi = current->thread.abi;
 #ifdef CONFIG_CPU_MICROMIPS
         void *vdso;
-        unsigned int tmp = (unsigned int)current->mm->context.vdso;
+        unsigned long tmp = (unsigned long)current->mm->context.vdso;
 
         set_isa16_mode(tmp);
         vdso = (void *)tmp;
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 06bb5ed6d80a..b8bd9340c9c7 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -35,6 +35,7 @@
 #include <asm/bmips.h>
 #include <asm/traps.h>
 #include <asm/barrier.h>
+#include <asm/cpu-features.h>
 
 static int __maybe_unused max_cpus = 1;
 
@@ -42,6 +43,12 @@ static int __maybe_unused max_cpus = 1;
 int bmips_smp_enabled = 1;
 int bmips_cpu_offset;
 cpumask_t bmips_booted_mask;
+unsigned long bmips_tp1_irqs = IE_IRQ1;
+
+#define RESET_FROM_KSEG0                0x80080800
+#define RESET_FROM_KSEG1                0xa0080800
+
+static void bmips_set_reset_vec(int cpu, u32 val);
 
 #ifdef CONFIG_SMP
 
@@ -194,6 +201,9 @@ static void bmips_boot_secondary(int cpu, struct task_struct *idle)
         pr_info("SMP: Booting CPU%d...\n", cpu);
 
         if (cpumask_test_cpu(cpu, &bmips_booted_mask)) {
+                /* kseg1 might not exist if this CPU enabled XKS01 */
+                bmips_set_reset_vec(cpu, RESET_FROM_KSEG0);
+
                 switch (current_cpu_type()) {
                 case CPU_BMIPS4350:
                 case CPU_BMIPS4380:
@@ -203,8 +213,9 @@ static void bmips_boot_secondary(int cpu, struct task_struct *idle)
                         bmips5000_send_ipi_single(cpu, 0);
                         break;
                 }
-        }
-        else {
+        } else {
+                bmips_set_reset_vec(cpu, RESET_FROM_KSEG1);
+
                 switch (current_cpu_type()) {
                 case CPU_BMIPS4350:
                 case CPU_BMIPS4380:
@@ -213,17 +224,7 @@ static void bmips_boot_secondary(int cpu, struct task_struct *idle)
                                 set_c0_brcm_cmt_ctrl(0x01);
                         break;
                 case CPU_BMIPS5000:
-                        if (cpu & 0x01)
-                                write_c0_brcm_action(ACTION_BOOT_THREAD(cpu));
-                        else {
-                                /*
-                                 * core N thread 0 was already booted; just
-                                 * pulse the NMI line
-                                 */
-                                bmips_write_zscm_reg(0x210, 0xc0000000);
-                                udelay(10);
-                                bmips_write_zscm_reg(0x210, 0x00);
-                        }
+                        write_c0_brcm_action(ACTION_BOOT_THREAD(cpu));
                         break;
                 }
                 cpumask_set_cpu(cpu, &bmips_booted_mask);
@@ -235,31 +236,12 @@ static void bmips_boot_secondary(int cpu, struct task_struct *idle)
  */
 static void bmips_init_secondary(void)
 {
-        /* move NMI vector to kseg0, in case XKS01 is enabled */
-
-        void __iomem *cbr;
-        unsigned long old_vec;
-        unsigned long relo_vector;
-        int boot_cpu;
-
         switch (current_cpu_type()) {
         case CPU_BMIPS4350:
         case CPU_BMIPS4380:
-                cbr = BMIPS_GET_CBR();
-
-                boot_cpu = !!(read_c0_brcm_cmt_local() & (1 << 31));
-                relo_vector = boot_cpu ? BMIPS_RELO_VECTOR_CONTROL_0 :
-                                  BMIPS_RELO_VECTOR_CONTROL_1;
-
-                old_vec = __raw_readl(cbr + relo_vector);
-                __raw_writel(old_vec & ~0x20000000, cbr + relo_vector);
-
                 clear_c0_cause(smp_processor_id() ? C_SW1 : C_SW0);
                 break;
         case CPU_BMIPS5000:
-                write_c0_brcm_bootvec(read_c0_brcm_bootvec() &
-                        (smp_processor_id() & 0x01 ? ~0x20000000 : ~0x2000));
-
                 write_c0_brcm_action(ACTION_CLR_IPI(smp_processor_id(), 0));
                 break;
         }
@@ -276,7 +258,7 @@ static void bmips_smp_finish(void)
         write_c0_compare(read_c0_count() + mips_hpt_frequency / HZ);
 
         irq_enable_hazard();
-        set_c0_status(IE_SW0 | IE_SW1 | IE_IRQ1 | IE_IRQ5 | ST0_IE);
+        set_c0_status(IE_SW0 | IE_SW1 | bmips_tp1_irqs | IE_IRQ5 | ST0_IE);
         irq_enable_hazard();
 }
 
@@ -381,6 +363,7 @@ static int bmips_cpu_disable(void)
 
         set_cpu_online(cpu, false);
         cpu_clear(cpu, cpu_callin_map);
+        clear_c0_status(IE_IRQ5);
 
         local_flush_tlb_all();
         local_flush_icache_range(0, ~0);
@@ -405,7 +388,8 @@ void __ref play_dead(void)
          * IRQ handlers; this clears ST0_IE and returns immediately.
          */
         clear_c0_cause(CAUSEF_IV | C_SW0 | C_SW1);
-        change_c0_status(IE_IRQ5 | IE_IRQ1 | IE_SW0 | IE_SW1 | ST0_IE | ST0_BEV,
+        change_c0_status(
+                IE_IRQ5 | bmips_tp1_irqs | IE_SW0 | IE_SW1 | ST0_IE | ST0_BEV,
                 IE_SW0 | IE_SW1 | ST0_IE | ST0_BEV);
         irq_disable_hazard();
 
@@ -473,10 +457,61 @@ static inline void bmips_nmi_handler_setup(void)
                 &bmips_smp_int_vec_end);
 }
 
+struct reset_vec_info {
+        int cpu;
+        u32 val;
+};
+
+static void bmips_set_reset_vec_remote(void *vinfo)
+{
+        struct reset_vec_info *info = vinfo;
+        int shift = info->cpu & 0x01 ? 16 : 0;
+        u32 mask = ~(0xffff << shift), val = info->val >> 16;
+
+        preempt_disable();
+        if (smp_processor_id() > 0) {
+                smp_call_function_single(0, &bmips_set_reset_vec_remote,
+                                         info, 1);
+        } else {
+                if (info->cpu & 0x02) {
+                        /* BMIPS5200 "should" use mask/shift, but it's buggy */
+                        bmips_write_zscm_reg(0xa0, (val << 16) | val);
+                        bmips_read_zscm_reg(0xa0);
+                } else {
+                        write_c0_brcm_bootvec((read_c0_brcm_bootvec() & mask) |
+                                              (val << shift));
+                }
+        }
+        preempt_enable();
+}
+
+static void bmips_set_reset_vec(int cpu, u32 val)
+{
+        struct reset_vec_info info;
+
+        if (current_cpu_type() == CPU_BMIPS5000) {
+                /* this needs to run from CPU0 (which is always online) */
+                info.cpu = cpu;
+                info.val = val;
+                bmips_set_reset_vec_remote(&info);
+        } else {
+                void __iomem *cbr = BMIPS_GET_CBR();
+
+                if (cpu == 0)
+                        __raw_writel(val, cbr + BMIPS_RELO_VECTOR_CONTROL_0);
+                else {
+                        if (current_cpu_type() != CPU_BMIPS4380)
+                                return;
+                        __raw_writel(val, cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+                }
+        }
+        __sync();
+        back_to_back_c0_hazard();
+}
+
 void bmips_ebase_setup(void)
 {
         unsigned long new_ebase = ebase;
-        void __iomem __maybe_unused *cbr;
 
         BUG_ON(ebase != CKSEG0);
 
@@ -496,15 +531,14 @@ void bmips_ebase_setup(void)
                         &bmips_smp_int_vec, 0x80);
                 __sync();
                 return;
+        case CPU_BMIPS3300:
         case CPU_BMIPS4380:
                 /*
                  * 0x8000_0000: reset/NMI (initially in kseg1)
                  * 0x8000_0400: normal vectors
                  */
                 new_ebase = 0x80000400;
-                cbr = BMIPS_GET_CBR();
-                __raw_writel(0x80080800, cbr + BMIPS_RELO_VECTOR_CONTROL_0);
-                __raw_writel(0xa0080800, cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+                bmips_set_reset_vec(0, RESET_FROM_KSEG0);
                 break;
         case CPU_BMIPS5000:
                 /*
@@ -512,10 +546,8 @@ void bmips_ebase_setup(void)
                  * 0x8000_1000: normal vectors
                  */
                 new_ebase = 0x80001000;
-                write_c0_brcm_bootvec(0xa0088008);
+                bmips_set_reset_vec(0, RESET_FROM_KSEG0);
                 write_c0_ebase(new_ebase);
-                if (max_cpus > 2)
-                        bmips_write_zscm_reg(0xa0, 0xa008a008);
                 break;
         default:
                 return;
diff --git a/arch/mips/kernel/smp-cmp.c b/arch/mips/kernel/smp-cmp.c
index fc8a51553426..1e0a93c5a3e7 100644
--- a/arch/mips/kernel/smp-cmp.c
+++ b/arch/mips/kernel/smp-cmp.c
@@ -24,6 +24,7 @@
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
 #include <linux/compiler.h>
+#include <linux/irqchip/mips-gic.h>
 
 #include <linux/atomic.h>
 #include <asm/cacheflush.h>
@@ -37,7 +38,6 @@
 #include <asm/mipsmtregs.h>
 #include <asm/mips_mt.h>
 #include <asm/amon.h>
-#include <asm/gic.h>
 
 static void cmp_init_secondary(void)
 {
diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
index e6e16a1d4add..bed7590e475f 100644
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -9,13 +9,13 @@
  */
 
 #include <linux/io.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/types.h>
 
 #include <asm/bcache.h>
-#include <asm/gic.h>
 #include <asm/mips-cm.h>
 #include <asm/mips-cpc.h>
 #include <asm/mips_mt.h>
@@ -273,8 +273,8 @@ static void cps_init_secondary(void)
         if (cpu_has_mipsmt)
                 dmt();
 
-        change_c0_status(ST0_IM, STATUSF_IP3 | STATUSF_IP4 |
-                                 STATUSF_IP6 | STATUSF_IP7);
+        change_c0_status(ST0_IM, STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP4 |
+                                 STATUSF_IP5 | STATUSF_IP6 | STATUSF_IP7);
 }
 
 static void cps_smp_finish(void)
diff --git a/arch/mips/kernel/smp-gic.c b/arch/mips/kernel/smp-gic.c
index 3b21a96d1ccb..5f0ab5bcd01e 100644
--- a/arch/mips/kernel/smp-gic.c
+++ b/arch/mips/kernel/smp-gic.c
@@ -12,9 +12,9 @@
  * option) any later version.
  */
 
+#include <linux/irqchip/mips-gic.h>
 #include <linux/printk.h>
 
-#include <asm/gic.h>
 #include <asm/mips-cpc.h>
 #include <asm/smp-ops.h>
 
diff --git a/arch/mips/kernel/smp-mt.c b/arch/mips/kernel/smp-mt.c
index 21f23add04f4..ad86951b73bd 100644
--- a/arch/mips/kernel/smp-mt.c
+++ b/arch/mips/kernel/smp-mt.c
@@ -21,6 +21,7 @@
 #include <linux/sched.h>
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/compiler.h>
 #include <linux/smp.h>
 
@@ -34,7 +35,6 @@
 #include <asm/mipsregs.h>
 #include <asm/mipsmtregs.h>
 #include <asm/mips_mt.h>
-#include <asm/gic.h>
 
 static void __init smvp_copy_vpe_config(void)
 {
@@ -119,7 +119,7 @@ static void vsmp_send_ipi_single(int cpu, unsigned int action)
         unsigned long flags;
         int vpflags;
 
-#ifdef CONFIG_IRQ_GIC
+#ifdef CONFIG_MIPS_GIC
         if (gic_present) {
                 gic_send_ipi_single(cpu, action);
                 return;
@@ -158,7 +158,7 @@ static void vsmp_send_ipi_mask(const struct cpumask *mask, unsigned int action)
 
 static void vsmp_init_secondary(void)
 {
-#ifdef CONFIG_IRQ_GIC
+#ifdef CONFIG_MIPS_GIC
         /* This is Malta specific: IPI,performance and timer interrupts */
         if (gic_present)
                 change_c0_status(ST0_IM, STATUSF_IP3 | STATUSF_IP4 |
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 4a4f9dda5658..604b558809c4 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -117,6 +117,7 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
                 "2:     sc      %[tmp], (%[addr])                       \n"
                 "       beqzl   %[tmp], 1b                              \n"
                 "3:                                                     \n"
+                "       .insn                                           \n"
                 "       .section .fixup,\"ax\"                          \n"
                 "4:     li      %[err], %[efault]                       \n"
                 "       j       3b                                      \n"
@@ -142,6 +143,7 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
                 "2:     sc      %[tmp], (%[addr])                       \n"
                 "       bnez    %[tmp], 4f                              \n"
                 "3:                                                     \n"
+                "       .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "4:     b       1b                                      \n"
                 "       .previous                                       \n"
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 22b19c275044..ad3d2031c327 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -724,6 +724,50 @@ int process_fpemu_return(int sig, void __user *fault_addr)
         }
 }
 
+static int simulate_fp(struct pt_regs *regs, unsigned int opcode,
+                       unsigned long old_epc, unsigned long old_ra)
+{
+        union mips_instruction inst = { .word = opcode };
+        void __user *fault_addr = NULL;
+        int sig;
+
+        /* If it's obviously not an FP instruction, skip it */
+        switch (inst.i_format.opcode) {
+        case cop1_op:
+        case cop1x_op:
+        case lwc1_op:
+        case ldc1_op:
+        case swc1_op:
+        case sdc1_op:
+                break;
+
+        default:
+                return -1;
+        }
+
+        /*
+         * do_ri skipped over the instruction via compute_return_epc, undo
+         * that for the FPU emulator.
+         */
+        regs->cp0_epc = old_epc;
+        regs->regs[31] = old_ra;
+
+        /* Save the FP context to struct thread_struct */
+        lose_fpu(1);
+
+        /* Run the emulator */
+        sig = fpu_emulator_cop1Handler(regs, &current->thread.fpu, 1,
+                                       &fault_addr);
+
+        /* If something went wrong, signal */
+        process_fpemu_return(sig, fault_addr);
+
+        /* Restore the hardware register state */
+        own_fpu(1);
+
+        return 0;
+}
+
 /*
  * XXX Delayed fp exceptions when doing a lazy ctx switch XXX
  */
@@ -1016,6 +1060,9 @@ asmlinkage void do_ri(struct pt_regs *regs)
 
                 if (status < 0)
                         status = simulate_sync(regs, opcode);
+
+                if (status < 0)
+                        status = simulate_fp(regs, opcode, old_epc, old31);
         }
 
         if (status < 0)
@@ -1380,12 +1427,19 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
         show_regs(regs);
 
         if (multi_match) {
-                printk("Index   : %0x\n", read_c0_index());
-                printk("Pagemask: %0x\n", read_c0_pagemask());
-                printk("EntryHi : %0*lx\n", field, read_c0_entryhi());
-                printk("EntryLo0: %0*lx\n", field, read_c0_entrylo0());
-                printk("EntryLo1: %0*lx\n", field, read_c0_entrylo1());
-                printk("\n");
+                pr_err("Index   : %0x\n", read_c0_index());
+                pr_err("Pagemask: %0x\n", read_c0_pagemask());
+                pr_err("EntryHi : %0*lx\n", field, read_c0_entryhi());
+                pr_err("EntryLo0: %0*lx\n", field, read_c0_entrylo0());
+                pr_err("EntryLo1: %0*lx\n", field, read_c0_entrylo1());
+                pr_err("Wired   : %0x\n", read_c0_wired());
+                pr_err("Pagegrain: %0x\n", read_c0_pagegrain());
+                if (cpu_has_htw) {
+                        pr_err("PWField : %0*lx\n", field, read_c0_pwfield());
+                        pr_err("PWSize  : %0*lx\n", field, read_c0_pwsize());
+                        pr_err("PWCtl   : %0x\n", read_c0_pwctl());
+                }
+                pr_err("\n");
                 dump_tlb_all();
         }
 
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index 0f1af58b036a..ed2a278722a9 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -16,9 +16,11 @@
 #include <linux/elf.h>
 #include <linux/vmalloc.h>
 #include <linux/unistd.h>
+#include <linux/random.h>
 
 #include <asm/vdso.h>
 #include <asm/uasm.h>
+#include <asm/processor.h>
 
 /*
  * Including <asm/unistd.h> would give use the 64-bit syscall numbers ...
@@ -67,7 +69,18 @@ subsys_initcall(init_vdso);
 
 static unsigned long vdso_addr(unsigned long start)
 {
-        return STACK_TOP;
+        unsigned long offset = 0UL;
+
+        if (current->flags & PF_RANDOMIZE) {
+                offset = get_random_int();
+                offset <<= PAGE_SHIFT;
+                if (TASK_IS_32BIT_ADDR)
+                        offset &= 0xfffffful;
+                else
+                        offset &= 0xffffffful;
+        }
+
+        return STACK_TOP + offset;
 }
 
 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
diff --git a/arch/mips/lantiq/falcon/sysctrl.c b/arch/mips/lantiq/falcon/sysctrl.c
index 468ffa043607..7edcd4946fc1 100644
--- a/arch/mips/lantiq/falcon/sysctrl.c
+++ b/arch/mips/lantiq/falcon/sysctrl.c
@@ -49,6 +49,7 @@
 
 /* Activation Status Register */
 #define ACTS_ASC0_ACT   0x00001000
+#define ACTS_SSC0       0x00002000
 #define ACTS_ASC1_ACT   0x00000800
 #define ACTS_I2C_ACT    0x00004000
 #define ACTS_P0         0x00010000
@@ -147,12 +148,11 @@ static void falcon_gpe_enable(void)
         if (status & (1 << (GPPC_OFFSET + 1)))
                 return;
 
-        if (status_r32(STATUS_CONFIG) == 0)
+        freq = (status_r32(STATUS_CONFIG) &
+                GPEFREQ_MASK) >>
+                GPEFREQ_OFFSET;
+        if (freq == 0)
                 freq = 1; /* use 625MHz on unfused chip */
-        else
-                freq = (status_r32(STATUS_CONFIG) &
-                        GPEFREQ_MASK) >>
-                        GPEFREQ_OFFSET;
 
         /* apply new frequency */
         sysctl_w32_mask(SYSCTL_SYS1, 7 << (GPPC_OFFSET + 1),
@@ -260,5 +260,6 @@ void __init ltq_soc_init(void)
         clkdev_add_sys("1e800600.pad", SYSCTL_SYS1, ACTS_PADCTRL4);
         clkdev_add_sys("1e100b00.serial", SYSCTL_SYS1, ACTS_ASC1_ACT);
         clkdev_add_sys("1e100c00.serial", SYSCTL_SYS1, ACTS_ASC0_ACT);
+        clkdev_add_sys("1e100d00.spi", SYSCTL_SYS1, ACTS_SSC0);
         clkdev_add_sys("1e200000.i2c", SYSCTL_SYS1, ACTS_I2C_ACT);
 }
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index 030568a70ac4..6ab10573490d 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -70,6 +70,7 @@ static struct resource ltq_eiu_irq[MAX_EIU];
 static void __iomem *ltq_icu_membase[MAX_IM];
 static void __iomem *ltq_eiu_membase;
 static struct irq_domain *ltq_domain;
+static int ltq_perfcount_irq;
 
 int ltq_eiu_get_irq(int exin)
 {
@@ -378,30 +379,6 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
                         panic("Failed to remap icu memory");
         }
 
-        /* the external interrupts are optional and xway only */
-        eiu_node = of_find_compatible_node(NULL, NULL, "lantiq,eiu-xway");
-        if (eiu_node && !of_address_to_resource(eiu_node, 0, &res)) {
-                /* find out how many external irq sources we have */
-                exin_avail = of_irq_count(eiu_node);
-
-                if (exin_avail > MAX_EIU)
-                        exin_avail = MAX_EIU;
-
-                ret = of_irq_to_resource_table(eiu_node,
-                                                ltq_eiu_irq, exin_avail);
-                if (ret != exin_avail)
-                        panic("failed to load external irq resources");
-
-                if (request_mem_region(res.start, resource_size(&res),
-                                                        res.name) < 0)
-                        pr_err("Failed to request eiu memory");
-
-                ltq_eiu_membase = ioremap_nocache(res.start,
-                                                        resource_size(&res));
-                if (!ltq_eiu_membase)
-                        panic("Failed to remap eiu memory");
-        }
-
         /* turn off all irqs by default */
         for (i = 0; i < MAX_IM; i++) {
                 /* make sure all irqs are turned off by default */
@@ -449,7 +426,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
 #endif
 
         /* tell oprofile which irq to use */
-        cp0_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
+        ltq_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
 
         /*
          * if the timer irq is not one of the mips irqs we need to
@@ -458,9 +435,38 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
         if (MIPS_CPU_TIMER_IRQ != 7)
                 irq_create_mapping(ltq_domain, MIPS_CPU_TIMER_IRQ);
 
+        /* the external interrupts are optional and xway only */
+        eiu_node = of_find_compatible_node(NULL, NULL, "lantiq,eiu-xway");
+        if (eiu_node && !of_address_to_resource(eiu_node, 0, &res)) {
+                /* find out how many external irq sources we have */
+                exin_avail = of_irq_count(eiu_node);
+
+                if (exin_avail > MAX_EIU)
+                        exin_avail = MAX_EIU;
+
+                ret = of_irq_to_resource_table(eiu_node,
+                                                ltq_eiu_irq, exin_avail);
+                if (ret != exin_avail)
+                        panic("failed to load external irq resources");
+
+                if (request_mem_region(res.start, resource_size(&res),
+                                                        res.name) < 0)
+                        pr_err("Failed to request eiu memory");
+
+                ltq_eiu_membase = ioremap_nocache(res.start,
+                                                        resource_size(&res));
+                if (!ltq_eiu_membase)
+                        panic("Failed to remap eiu memory");
+        }
+
         return 0;
 }
 
+int get_c0_perfcount_int(void)
+{
+        return ltq_perfcount_irq;
+}
+
 unsigned int get_c0_compare_int(void)
 {
         return MIPS_CPU_TIMER_IRQ;
diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c
index 7447d322d14e..39ab3e786e59 100644
--- a/arch/mips/lantiq/prom.c
+++ b/arch/mips/lantiq/prom.c
@@ -36,6 +36,11 @@ const char *get_system_type(void)
         return soc_info.sys_type;
 }
 
+int ltq_soc_type(void)
+{
+        return soc_info.type;
+}
+
 void prom_free_prom_memory(void)
 {
 }
@@ -72,6 +77,8 @@ void __init plat_mem_setup(void)
          * parsed resulting in our memory appearing
          */
         __dt_setup_arch(__dtb_start);
+
+        strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
 }
 
 void __init device_tree_init(void)
@@ -97,16 +104,7 @@ void __init prom_init(void)
 
 int __init plat_of_setup(void)
 {
-        static struct of_device_id of_ids[3];
-
-        if (!of_have_populated_dt())
-                panic("device tree not present");
-
-        strlcpy(of_ids[0].compatible, soc_info.compatible,
-                sizeof(of_ids[0].compatible));
-        strncpy(of_ids[1].compatible, "simple-bus",
-                sizeof(of_ids[1].compatible));
-        return of_platform_populate(NULL, of_ids, NULL, NULL);
+        return __dt_register_buses(soc_info.compatible, "simple-bus");
 }
 
 arch_initcall(plat_of_setup);
diff --git a/arch/mips/lantiq/xway/Makefile b/arch/mips/lantiq/xway/Makefile
index 087497d97357..a2edc538f477 100644
--- a/arch/mips/lantiq/xway/Makefile
+++ b/arch/mips/lantiq/xway/Makefile
@@ -1,3 +1,5 @@
 obj-y := prom.o sysctrl.o clk.o reset.o dma.o gptu.o dcdc.o
 
+obj-y += vmmc.o
+
 obj-$(CONFIG_XRX200_PHY_FW) += xrx200_phy_fw.o
diff --git a/arch/mips/lantiq/xway/reset.c b/arch/mips/lantiq/xway/reset.c
index 1fa0f175357e..fe68f9ae47c1 100644
--- a/arch/mips/lantiq/xway/reset.c
+++ b/arch/mips/lantiq/xway/reset.c
@@ -14,6 +14,7 @@
 #include <linux/delay.h>
 #include <linux/of_address.h>
 #include <linux/of_platform.h>
+#include <linux/reset-controller.h>
 
 #include <asm/reboot.h>
 
@@ -113,10 +114,77 @@ void ltq_reset_once(unsigned int module, ulong u)
         ltq_rcu_w32(ltq_rcu_r32(RCU_RST_REQ) & ~module, RCU_RST_REQ);
 }
 
+static int ltq_assert_device(struct reset_controller_dev *rcdev,
+                                unsigned long id)
+{
+        u32 val;
+
+        if (id < 8)
+                return -1;
+
+        val = ltq_rcu_r32(RCU_RST_REQ);
+        val |= BIT(id);
+        ltq_rcu_w32(val, RCU_RST_REQ);
+
+        return 0;
+}
+
+static int ltq_deassert_device(struct reset_controller_dev *rcdev,
+                                  unsigned long id)
+{
+        u32 val;
+
+        if (id < 8)
+                return -1;
+
+        val = ltq_rcu_r32(RCU_RST_REQ);
+        val &= ~BIT(id);
+        ltq_rcu_w32(val, RCU_RST_REQ);
+
+        return 0;
+}
+
+static int ltq_reset_device(struct reset_controller_dev *rcdev,
+                               unsigned long id)
+{
+        ltq_assert_device(rcdev, id);
+        return ltq_deassert_device(rcdev, id);
+}
+
+static struct reset_control_ops reset_ops = {
+        .reset = ltq_reset_device,
+        .assert = ltq_assert_device,
+        .deassert = ltq_deassert_device,
+};
+
+static struct reset_controller_dev reset_dev = {
+        .ops                    = &reset_ops,
+        .owner                  = THIS_MODULE,
+        .nr_resets              = 32,
+        .of_reset_n_cells       = 1,
+};
+
+void ltq_rst_init(void)
+{
+        reset_dev.of_node = of_find_compatible_node(NULL, NULL,
+                                                "lantiq,xway-reset");
+        if (!reset_dev.of_node)
+                pr_err("Failed to find reset controller node");
+        else
+                reset_controller_register(&reset_dev);
+}
+
 static void ltq_machine_restart(char *command)
 {
+        u32 val = ltq_rcu_r32(RCU_RST_REQ);
+
+        if (of_device_is_compatible(ltq_rcu_np, "lantiq,rcu-xrx200"))
+                val |= RCU_RD_GPHY1_XRX200 | RCU_RD_GPHY0_XRX200;
+
+        val |= RCU_RD_SRST;
+
         local_irq_disable();
-        ltq_rcu_w32(ltq_rcu_r32(RCU_RST_REQ) | RCU_RD_SRST, RCU_RST_REQ);
+        ltq_rcu_w32(val, RCU_RST_REQ);
         unreachable();
 }
 
diff --git a/arch/mips/lantiq/xway/vmmc.c b/arch/mips/lantiq/xway/vmmc.c
new file mode 100644
index 000000000000..696cd57f6f13
--- /dev/null
+++ b/arch/mips/lantiq/xway/vmmc.c
@@ -0,0 +1,69 @@
+/*
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ *  Copyright (C) 2012 John Crispin <blogic@openwrt.org>
+ */
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/of_gpio.h>
+#include <linux/dma-mapping.h>
+
+#include <lantiq_soc.h>
+
+static unsigned int *cp1_base;
+
+unsigned int *ltq_get_cp1_base(void)
+{
+        if (!cp1_base)
+                panic("no cp1 base was set\n");
+
+        return cp1_base;
+}
+EXPORT_SYMBOL(ltq_get_cp1_base);
+
+static int vmmc_probe(struct platform_device *pdev)
+{
+#define CP1_SIZE       (1 << 20)
+        int gpio_count;
+        dma_addr_t dma;
+
+        cp1_base =
+                (void *) CPHYSADDR(dma_alloc_coherent(NULL, CP1_SIZE,
+                                                    &dma, GFP_ATOMIC));
+
+        gpio_count = of_gpio_count(pdev->dev.of_node);
+        while (gpio_count > 0) {
+                enum of_gpio_flags flags;
+                int gpio = of_get_gpio_flags(pdev->dev.of_node,
+                                             --gpio_count, &flags);
+                if (gpio_request(gpio, "vmmc-relay"))
+                        continue;
+                dev_info(&pdev->dev, "requested GPIO %d\n", gpio);
+                gpio_direction_output(gpio,
+                                      (flags & OF_GPIO_ACTIVE_LOW) ? (0) : (1));
+        }
+
+        dev_info(&pdev->dev, "reserved %dMB at 0x%p", CP1_SIZE >> 20, cp1_base);
+
+        return 0;
+}
+
+static const struct of_device_id vmmc_match[] = {
+        { .compatible = "lantiq,vmmc-xway" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, vmmc_match);
+
+static struct platform_driver vmmc_driver = {
+        .probe = vmmc_probe,
+        .driver = {
+                .name = "lantiq,vmmc",
+                .owner = THIS_MODULE,
+                .of_match_table = vmmc_match,
+        },
+};
+
+module_platform_driver(vmmc_driver);
diff --git a/arch/mips/lantiq/xway/xrx200_phy_fw.c b/arch/mips/lantiq/xway/xrx200_phy_fw.c
index d4d9d31f152e..7c1e54c6a36c 100644
--- a/arch/mips/lantiq/xway/xrx200_phy_fw.c
+++ b/arch/mips/lantiq/xway/xrx200_phy_fw.c
@@ -24,7 +24,28 @@ static dma_addr_t xway_gphy_load(struct platform_device *pdev)
         void *fw_addr;
         size_t size;
 
-        if (of_property_read_string(pdev->dev.of_node, "firmware", &fw_name)) {
+        if (of_get_property(pdev->dev.of_node, "firmware1", NULL) ||
+                of_get_property(pdev->dev.of_node, "firmware2", NULL)) {
+                switch (ltq_soc_type()) {
+                case SOC_TYPE_VR9:
+                        if (of_property_read_string(pdev->dev.of_node,
+                                                    "firmware1", &fw_name)) {
+                                dev_err(&pdev->dev,
+                                        "failed to load firmware filename\n");
+                                return 0;
+                        }
+                        break;
+                case SOC_TYPE_VR9_2:
+                        if (of_property_read_string(pdev->dev.of_node,
+                                                    "firmware2", &fw_name)) {
+                                dev_err(&pdev->dev,
+                                        "failed to load firmware filename\n");
+                                return 0;
+                        }
+                        break;
+                }
+        } else if (of_property_read_string(pdev->dev.of_node,
+                                         "firmware", &fw_name)) {
                 dev_err(&pdev->dev, "failed to load firmware filename\n");
                 return 0;
         }
diff --git a/arch/mips/lib/iomap.c b/arch/mips/lib/iomap.c
index e3acb2dad33a..8e7e378ce51c 100644
--- a/arch/mips/lib/iomap.c
+++ b/arch/mips/lib/iomap.c
@@ -97,14 +97,14 @@ EXPORT_SYMBOL(iowrite32be);
 
 /*
  * These are the "repeat MMIO read/write" functions.
- * Note the "__raw" accesses, since we don't want to
- * convert to CPU byte order. We write in "IO byte
- * order" (we also don't have IO barriers).
+ * Note the "__mem" accesses, since we want to convert
+ * to CPU byte order if the host bus happens to not match the
+ * endianness of PCI/ISA (see mach-generic/mangle-port.h).
  */
 static inline void mmio_insb(void __iomem *addr, u8 *dst, int count)
 {
         while (--count >= 0) {
-                u8 data = __raw_readb(addr);
+                u8 data = __mem_readb(addr);
                 *dst = data;
                 dst++;
         }
@@ -113,7 +113,7 @@ static inline void mmio_insb(void __iomem *addr, u8 *dst, int count)
 static inline void mmio_insw(void __iomem *addr, u16 *dst, int count)
 {
         while (--count >= 0) {
-                u16 data = __raw_readw(addr);
+                u16 data = __mem_readw(addr);
                 *dst = data;
                 dst++;
         }
@@ -122,7 +122,7 @@ static inline void mmio_insw(void __iomem *addr, u16 *dst, int count)
 static inline void mmio_insl(void __iomem *addr, u32 *dst, int count)
 {
         while (--count >= 0) {
-                u32 data = __raw_readl(addr);
+                u32 data = __mem_readl(addr);
                 *dst = data;
                 dst++;
         }
@@ -131,7 +131,7 @@ static inline void mmio_insl(void __iomem *addr, u32 *dst, int count)
 static inline void mmio_outsb(void __iomem *addr, const u8 *src, int count)
 {
         while (--count >= 0) {
-                __raw_writeb(*src, addr);
+                __mem_writeb(*src, addr);
                 src++;
         }
 }
@@ -139,7 +139,7 @@ static inline void mmio_outsb(void __iomem *addr, const u8 *src, int count)
 static inline void mmio_outsw(void __iomem *addr, const u16 *src, int count)
 {
         while (--count >= 0) {
-                __raw_writew(*src, addr);
+                __mem_writew(*src, addr);
                 src++;
         }
 }
@@ -147,7 +147,7 @@ static inline void mmio_outsw(void __iomem *addr, const u16 *src, int count)
 static inline void mmio_outsl(void __iomem *addr, const u32 *src, int count)
 {
         while (--count >= 0) {
-                __raw_writel(*src, addr);
+                __mem_writel(*src, addr);
                 src++;
         }
 }
diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S
index 7b0e5462ca51..c8fe6b1968fb 100644
--- a/arch/mips/lib/memset.S
+++ b/arch/mips/lib/memset.S
@@ -114,8 +114,7 @@
         R10KCBARRIER(0(ra))
 #ifdef __MIPSEB__
         EX(LONG_S_L, a1, (a0), .Lfirst_fixup\@) /* make word/dword aligned */
-#endif
-#ifdef __MIPSEL__
+#else
         EX(LONG_S_R, a1, (a0), .Lfirst_fixup\@) /* make word/dword aligned */
 #endif
         PTR_SUBU        a0, t0                  /* long align ptr */
@@ -164,8 +163,7 @@
         R10KCBARRIER(0(ra))
 #ifdef __MIPSEB__
         EX(LONG_S_R, a1, -1(a0), .Llast_fixup\@)
-#endif
-#ifdef __MIPSEL__
+#else
         EX(LONG_S_L, a1, -1(a0), .Llast_fixup\@)
 #endif
 1:      jr              ra
diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c
index 57bcdaf1f1c8..be777d9a3f85 100644
--- a/arch/mips/lib/mips-atomic.c
+++ b/arch/mips/lib/mips-atomic.c
@@ -42,15 +42,11 @@ notrace void arch_local_irq_disable(void)
         __asm__ __volatile__(
         "       .set    push                                            \n"
         "       .set    noat                                            \n"
-#if   defined(CONFIG_CPU_MIPSR2)
-        /* see irqflags.h for inline function */
-#else
         "       mfc0    $1,$12                                          \n"
         "       ori     $1,0x1f                                         \n"
         "       xori    $1,0x1f                                         \n"
         "       .set    noreorder                                       \n"
         "       mtc0    $1,$12                                          \n"
-#endif
         "       " __stringify(__irq_disable_hazard) "                   \n"
         "       .set    pop                                             \n"
         : /* no outputs */
@@ -72,15 +68,11 @@ notrace unsigned long arch_local_irq_save(void)
         "       .set    push                                            \n"
         "       .set    reorder                                         \n"
         "       .set    noat                                            \n"
-#if   defined(CONFIG_CPU_MIPSR2)
-        /* see irqflags.h for inline function */
-#else
         "       mfc0    %[flags], $12                                   \n"
         "       ori     $1, %[flags], 0x1f                              \n"
         "       xori    $1, 0x1f                                        \n"
         "       .set    noreorder                                       \n"
         "       mtc0    $1, $12                                         \n"
-#endif
         "       " __stringify(__irq_disable_hazard) "                   \n"
         "       .set    pop                                             \n"
         : [flags] "=r" (flags)
@@ -103,18 +95,12 @@ notrace void arch_local_irq_restore(unsigned long flags)
         "       .set    push                                            \n"
         "       .set    noreorder                                       \n"
         "       .set    noat                                            \n"
-#if   defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
-        /* see irqflags.h for inline function */
-#elif defined(CONFIG_CPU_MIPSR2)
-        /* see irqflags.h for inline function */
-#else
         "       mfc0    $1, $12                                         \n"
         "       andi    %[flags], 1                                     \n"
         "       ori     $1, 0x1f                                        \n"
         "       xori    $1, 0x1f                                        \n"
         "       or      %[flags], $1                                    \n"
         "       mtc0    %[flags], $12                                   \n"
-#endif
         "       " __stringify(__irq_disable_hazard) "                   \n"
         "       .set    pop                                             \n"
         : [flags] "=r" (__tmp1)
@@ -136,18 +122,12 @@ notrace void __arch_local_irq_restore(unsigned long flags)
         "       .set    push                                            \n"
         "       .set    noreorder                                       \n"
         "       .set    noat                                            \n"
-#if   defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
-        /* see irqflags.h for inline function */
-#elif defined(CONFIG_CPU_MIPSR2)
-        /* see irqflags.h for inline function */
-#else
         "       mfc0    $1, $12                                         \n"
         "       andi    %[flags], 1                                     \n"
         "       ori     $1, 0x1f                                        \n"
         "       xori    $1, 0x1f                                        \n"
         "       or      %[flags], $1                                    \n"
         "       mtc0    %[flags], $12                                   \n"
-#endif
         "       " __stringify(__irq_disable_hazard) "                   \n"
         "       .set    pop                                             \n"
         : [flags] "=r" (__tmp1)
diff --git a/arch/mips/lib/r3k_dump_tlb.c b/arch/mips/lib/r3k_dump_tlb.c
index 1ef365ab3cd3..975a13855116 100644
--- a/arch/mips/lib/r3k_dump_tlb.c
+++ b/arch/mips/lib/r3k_dump_tlb.c
@@ -9,6 +9,7 @@
 #include <linux/mm.h>
 
 #include <asm/mipsregs.h>
+#include <asm/mmu_context.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/tlbdebug.h>
@@ -21,7 +22,7 @@ static void dump_tlb(int first, int last)
         unsigned int asid;
         unsigned long entryhi, entrylo0;
 
-        asid = read_c0_entryhi() & 0xfc0;
+        asid = read_c0_entryhi() & ASID_MASK;
 
         for (i = first; i <= last; i++) {
                 write_c0_index(i<<8);
@@ -34,8 +35,8 @@ static void dump_tlb(int first, int last)
                 entrylo0 = read_c0_entrylo0();
 
                 /* Unused entries have a virtual address of KSEG0.  */
-                if ((entryhi & 0xfffff000) != 0x80000000
-                    && (entryhi & 0xfc0) == asid) {
+                if ((entryhi & PAGE_MASK) != KSEG0
+                    && (entryhi & ASID_MASK) == asid) {
                         /*
                          * Only print entries in use
                          */
@@ -43,8 +44,8 @@ static void dump_tlb(int first, int last)
 
                         printk("va=%08lx asid=%08lx"
                                "  [pa=%06lx n=%d d=%d v=%d g=%d]",
-                               (entryhi & 0xfffff000),
-                               entryhi & 0xfc0,
+                               entryhi & PAGE_MASK,
+                               entryhi & ASID_MASK,
                                entrylo0 & PAGE_MASK,
                                (entrylo0 & (1 << 11)) ? 1 : 0,
                                (entrylo0 & (1 << 10)) ? 1 : 0,
diff --git a/arch/mips/lib/strlen_user.S b/arch/mips/lib/strlen_user.S
index bef65c98df59..929bbacd697e 100644
--- a/arch/mips/lib/strlen_user.S
+++ b/arch/mips/lib/strlen_user.S
@@ -28,7 +28,6 @@ LEAF(__strlen_\func\()_asm)
         and             v0, a0
         bnez            v0, .Lfault\@
 
-FEXPORT(__strlen_\func\()_nocheck_asm)
         move            v0, a0
 .ifeqs "\func", "kernel"
 1:      EX(lbu, v1, (v0), .Lfault\@)
@@ -48,9 +47,7 @@ FEXPORT(__strlen_\func\()_nocheck_asm)
 #ifndef CONFIG_EVA
         /* Set aliases */
         .global __strlen_user_asm
-        .global __strlen_user_nocheck_asm
         .set __strlen_user_asm, __strlen_kernel_asm
-        .set __strlen_user_nocheck_asm, __strlen_kernel_nocheck_asm
 #endif
 
 __BUILD_STRLEN_ASM kernel
diff --git a/arch/mips/loongson/Kconfig b/arch/mips/loongson/Kconfig
index 1b91fc6a921b..156de85b82cd 100644
--- a/arch/mips/loongson/Kconfig
+++ b/arch/mips/loongson/Kconfig
@@ -86,6 +86,7 @@ config LOONGSON_MACH3X
         select LOONGSON_MC146818
         select ZONE_DMA32
         select LEFI_FIRMWARE_INTERFACE
+        select PHYS48_TO_HT40
         help
                 Generic Loongson 3 family machines utilize the 3A/3B revision
                 of Loongson processor and RS780/SBX00 chipset.
@@ -107,6 +108,18 @@ config CS5536_MFGPT
 
           If unsure, say Yes.
 
+config RS780_HPET
+        bool "RS780/SBX00 HPET Timer"
+        depends on LOONGSON_MACH3X
+        select MIPS_EXTERNAL_TIMER
+        help
+          This option enables the hpet timer of AMD RS780/SBX00.
+
+          If you want to enable the Loongson3 CPUFreq Driver, Please enable
+          this option at first, otherwise, You will get wrong system time.
+
+          If unsure, say Yes.
+
 config LOONGSON_SUSPEND
         bool
         default y
@@ -131,6 +144,10 @@ config SWIOTLB
         select NEED_SG_DMA_LENGTH
         select NEED_DMA_MAP_STATE
 
+config PHYS48_TO_HT40
+        bool
+        default y if CPU_LOONGSON3
+
 config LOONGSON_MC146818
         bool
         default n
diff --git a/arch/mips/loongson/common/cs5536/cs5536_pci.c b/arch/mips/loongson/common/cs5536/cs5536_pci.c
index 81bed9d18061..b739723205f8 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_pci.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_pci.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/types.h>
+#include <cs5536/cs5536_pci.h>
 #include <cs5536/cs5536_vsm.h>
 
 enum {
@@ -35,21 +36,21 @@ enum {
 };
 
 static const cs5536_pci_vsm_write vsm_conf_write[] = {
-        [CS5536_ISA_FUNC]       pci_isa_write_reg,
-        [reserved_func]         NULL,
-        [CS5536_IDE_FUNC]       pci_ide_write_reg,
-        [CS5536_ACC_FUNC]       pci_acc_write_reg,
-        [CS5536_OHCI_FUNC]      pci_ohci_write_reg,
-        [CS5536_EHCI_FUNC]      pci_ehci_write_reg,
+        [CS5536_ISA_FUNC]       = pci_isa_write_reg,
+        [reserved_func]         = NULL,
+        [CS5536_IDE_FUNC]       = pci_ide_write_reg,
+        [CS5536_ACC_FUNC]       = pci_acc_write_reg,
+        [CS5536_OHCI_FUNC]      = pci_ohci_write_reg,
+        [CS5536_EHCI_FUNC]      = pci_ehci_write_reg,
 };
 
 static const cs5536_pci_vsm_read vsm_conf_read[] = {
-        [CS5536_ISA_FUNC]       pci_isa_read_reg,
-        [reserved_func]         NULL,
-        [CS5536_IDE_FUNC]       pci_ide_read_reg,
-        [CS5536_ACC_FUNC]       pci_acc_read_reg,
-        [CS5536_OHCI_FUNC]      pci_ohci_read_reg,
-        [CS5536_EHCI_FUNC]      pci_ehci_read_reg,
+        [CS5536_ISA_FUNC]       = pci_isa_read_reg,
+        [reserved_func]         = NULL,
+        [CS5536_IDE_FUNC]       = pci_ide_read_reg,
+        [CS5536_ACC_FUNC]       = pci_acc_read_reg,
+        [CS5536_OHCI_FUNC]      = pci_ohci_read_reg,
+        [CS5536_EHCI_FUNC]      = pci_ehci_read_reg,
 };
 
 /*
diff --git a/arch/mips/loongson/common/dma-swiotlb.c b/arch/mips/loongson/common/dma-swiotlb.c
index c2be01f91575..2c6b989c1bc4 100644
--- a/arch/mips/loongson/common/dma-swiotlb.c
+++ b/arch/mips/loongson/common/dma-swiotlb.c
@@ -105,11 +105,25 @@ static int loongson_dma_set_mask(struct device *dev, u64 mask)
 
 dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
 {
+        long nid;
+#ifdef CONFIG_PHYS48_TO_HT40
+        /* We extract 2bit node id (bit 44~47, only bit 44~45 used now) from
+         * Loongson-3's 48bit address space and embed it into 40bit */
+        nid = (paddr >> 44) & 0x3;
+        paddr = ((nid << 44) ^ paddr) | (nid << 37);
+#endif
         return paddr;
 }
 
 phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr)
 {
+        long nid;
+#ifdef CONFIG_PHYS48_TO_HT40
+        /* We extract 2bit node id (bit 44~47, only bit 44~45 used now) from
+         * Loongson-3's 48bit address space and embed it into 40bit */
+        nid = (daddr >> 37) & 0x3;
+        daddr = ((nid << 37) ^ daddr) | (nid << 44);
+#endif
         return daddr;
 }
 
diff --git a/arch/mips/loongson/common/early_printk.c b/arch/mips/loongson/common/early_printk.c
index ced461b39069..6ca632e529dc 100644
--- a/arch/mips/loongson/common/early_printk.c
+++ b/arch/mips/loongson/common/early_printk.c
@@ -30,7 +30,7 @@ void prom_putchar(char c)
         int timeout;
         unsigned char *uart_base;
 
-        uart_base = (unsigned char *)_loongson_uart_base;
+        uart_base = (unsigned char *)_loongson_uart_base[0];
         timeout = 1024;
 
         while (((serial_in(uart_base, UART_LSR) & UART_LSR_THRE) == 0) &&
diff --git a/arch/mips/loongson/common/env.c b/arch/mips/loongson/common/env.c
index f15228550a22..045ea3d47c87 100644
--- a/arch/mips/loongson/common/env.c
+++ b/arch/mips/loongson/common/env.c
@@ -21,6 +21,7 @@
 #include <asm/bootinfo.h>
 #include <loongson.h>
 #include <boot_param.h>
+#include <workarounds.h>
 
 u32 cpu_clock_freq;
 EXPORT_SYMBOL(cpu_clock_freq);
@@ -31,7 +32,6 @@ u64 loongson_chipcfg[MAX_PACKAGES] = {0xffffffffbfc00180};
 u64 loongson_freqctrl[MAX_PACKAGES];
 
 unsigned long long smp_group[4];
-int cpuhotplug_workaround = 0;
 
 #define parse_even_earlier(res, option, p)                              \
 do {                                                                    \
@@ -67,6 +67,7 @@ void __init prom_init_env(void)
 #else
         struct boot_params *boot_p;
         struct loongson_params *loongson_p;
+        struct system_loongson *esys;
         struct efi_cpuinfo_loongson *ecpu;
         struct irq_source_routing_table *eirq_source;
 
@@ -74,6 +75,8 @@ void __init prom_init_env(void)
         boot_p = (struct boot_params *)fw_arg2;
         loongson_p = &(boot_p->efi.smbios.lp);
 
+        esys = (struct system_loongson *)
+                ((u64)loongson_p + loongson_p->system_offset);
         ecpu = (struct efi_cpuinfo_loongson *)
                 ((u64)loongson_p + loongson_p->cpu_offset);
         eirq_source = (struct irq_source_routing_table *)
@@ -95,6 +98,7 @@ void __init prom_init_env(void)
                 loongson_chipcfg[2] = 0x900020001fe00180;
                 loongson_chipcfg[3] = 0x900030001fe00180;
                 loongson_sysconf.ht_control_base = 0x90000EFDFB000000;
+                loongson_sysconf.workarounds = WORKAROUND_CPUFREQ;
         } else if (ecpu->cputype == Loongson_3B) {
                 loongson_sysconf.cores_per_node = 4; /* One chip has 2 nodes */
                 loongson_sysconf.cores_per_package = 8;
@@ -111,7 +115,7 @@ void __init prom_init_env(void)
                 loongson_freqctrl[2] = 0x900040001fe001d0;
                 loongson_freqctrl[3] = 0x900060001fe001d0;
                 loongson_sysconf.ht_control_base = 0x90001EFDFB000000;
-                cpuhotplug_workaround = 1;
+                loongson_sysconf.workarounds = WORKAROUND_CPUHOTPLUG;
         } else {
                 loongson_sysconf.cores_per_node = 1;
                 loongson_sysconf.cores_per_package = 1;
@@ -119,6 +123,8 @@ void __init prom_init_env(void)
         }
 
         loongson_sysconf.nr_cpus = ecpu->nr_cpus;
+        loongson_sysconf.boot_cpu_id = ecpu->cpu_startup_core_id;
+        loongson_sysconf.reserved_cpus_mask = ecpu->reserved_cores_mask;
         if (ecpu->nr_cpus > NR_CPUS || ecpu->nr_cpus == 0)
                 loongson_sysconf.nr_cpus = NR_CPUS;
         loongson_sysconf.nr_nodes = (loongson_sysconf.nr_cpus +
@@ -141,6 +147,24 @@ void __init prom_init_env(void)
         pr_debug("Shutdown Addr: %llx, Restart Addr: %llx, VBIOS Addr: %llx\n",
                 loongson_sysconf.poweroff_addr, loongson_sysconf.restart_addr,
                 loongson_sysconf.vgabios_addr);
+
+        memset(loongson_sysconf.ecname, 0, 32);
+        if (esys->has_ec)
+                memcpy(loongson_sysconf.ecname, esys->ec_name, 32);
+        loongson_sysconf.workarounds |= esys->workarounds;
+
+        loongson_sysconf.nr_uarts = esys->nr_uarts;
+        if (esys->nr_uarts < 1 || esys->nr_uarts > MAX_UARTS)
+                loongson_sysconf.nr_uarts = 1;
+        memcpy(loongson_sysconf.uarts, esys->uarts,
+                sizeof(struct uart_device) * loongson_sysconf.nr_uarts);
+
+        loongson_sysconf.nr_sensors = esys->nr_sensors;
+        if (loongson_sysconf.nr_sensors > MAX_SENSORS)
+                loongson_sysconf.nr_sensors = 0;
+        if (loongson_sysconf.nr_sensors)
+                memcpy(loongson_sysconf.sensors, esys->sensors,
+                        sizeof(struct sensor_device) * loongson_sysconf.nr_sensors);
 #endif
         if (cpu_clock_freq == 0) {
                 processor_id = (&current_cpu_data)->processor_id;
diff --git a/arch/mips/loongson/common/gpio.c b/arch/mips/loongson/common/gpio.c
index 21869908aaa4..29dbaa253061 100644
--- a/arch/mips/loongson/common/gpio.c
+++ b/arch/mips/loongson/common/gpio.c
@@ -37,7 +37,7 @@ int gpio_get_value(unsigned gpio)
         val = LOONGSON_GPIODATA;
         spin_unlock(&gpio_lock);
 
-        return ((val & mask) != 0);
+        return (val & mask) != 0;
 }
 EXPORT_SYMBOL(gpio_get_value);
 
diff --git a/arch/mips/loongson/common/init.c b/arch/mips/loongson/common/init.c
index f6af3aba4c86..9b987fe98b5b 100644
--- a/arch/mips/loongson/common/init.c
+++ b/arch/mips/loongson/common/init.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/bootmem.h>
+#include <asm/bootinfo.h>
 #include <asm/smp-ops.h>
 
 #include <loongson.h>
diff --git a/arch/mips/loongson/common/machtype.c b/arch/mips/loongson/common/machtype.c
index 1a4797984b8d..f2807bc662a3 100644
--- a/arch/mips/loongson/common/machtype.c
+++ b/arch/mips/loongson/common/machtype.c
@@ -19,19 +19,16 @@
 #define MACHTYPE_LEN 50
 
 static const char *system_types[] = {
-        [MACH_LOONGSON_UNKNOWN]         "unknown loongson machine",
-        [MACH_LEMOTE_FL2E]              "lemote-fuloong-2e-box",
-        [MACH_LEMOTE_FL2F]              "lemote-fuloong-2f-box",
-        [MACH_LEMOTE_ML2F7]             "lemote-mengloong-2f-7inches",
-        [MACH_LEMOTE_YL2F89]            "lemote-yeeloong-2f-8.9inches",
-        [MACH_DEXXON_GDIUM2F10]         "dexxon-gdium-2f",
-        [MACH_LEMOTE_NAS]               "lemote-nas-2f",
-        [MACH_LEMOTE_LL2F]              "lemote-lynloong-2f",
-        [MACH_LEMOTE_A1004]             "lemote-3a-notebook-a1004",
-        [MACH_LEMOTE_A1101]             "lemote-3a-itx-a1101",
-        [MACH_LEMOTE_A1201]             "lemote-2gq-notebook-a1201",
-        [MACH_LEMOTE_A1205]             "lemote-2gq-aio-a1205",
-        [MACH_LOONGSON_END]             NULL,
+        [MACH_LOONGSON_UNKNOWN] = "unknown loongson machine",
+        [MACH_LEMOTE_FL2E]      = "lemote-fuloong-2e-box",
+        [MACH_LEMOTE_FL2F]      = "lemote-fuloong-2f-box",
+        [MACH_LEMOTE_ML2F7]     = "lemote-mengloong-2f-7inches",
+        [MACH_LEMOTE_YL2F89]    = "lemote-yeeloong-2f-8.9inches",
+        [MACH_DEXXON_GDIUM2F10] = "dexxon-gdium-2f",
+        [MACH_LEMOTE_NAS]       = "lemote-nas-2f",
+        [MACH_LEMOTE_LL2F]      = "lemote-lynloong-2f",
+        [MACH_LOONGSON_GENERIC] = "generic-loongson-machine",
+        [MACH_LOONGSON_END]     = NULL,
 };
 
 const char *get_system_type(void)
diff --git a/arch/mips/loongson/common/rtc.c b/arch/mips/loongson/common/rtc.c
index a90d87c01555..b5709af09f7f 100644
--- a/arch/mips/loongson/common/rtc.c
+++ b/arch/mips/loongson/common/rtc.c
@@ -14,7 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/mc146818rtc.h>
 
-struct resource loongson_rtc_resources[] = {
+static struct resource loongson_rtc_resources[] = {
         {
                 .start  = RTC_PORT(0),
                 .end    = RTC_PORT(1),
diff --git a/arch/mips/loongson/common/serial.c b/arch/mips/loongson/common/serial.c
index bd2b7095b6dc..c23fa1373729 100644
--- a/arch/mips/loongson/common/serial.c
+++ b/arch/mips/loongson/common/serial.c
@@ -38,20 +38,17 @@
         .regshift       = 0,                                    \
 }
 
-static struct plat_serial8250_port uart8250_data[][2] = {
-        [MACH_LOONGSON_UNKNOWN]         {},
-        [MACH_LEMOTE_FL2E]              {PORT(4, 1843200), {} },
-        [MACH_LEMOTE_FL2F]              {PORT(3, 1843200), {} },
-        [MACH_LEMOTE_ML2F7]             {PORT_M(3, 3686400), {} },
-        [MACH_LEMOTE_YL2F89]            {PORT_M(3, 3686400), {} },
-        [MACH_DEXXON_GDIUM2F10]         {PORT_M(3, 3686400), {} },
-        [MACH_LEMOTE_NAS]               {PORT_M(3, 3686400), {} },
-        [MACH_LEMOTE_LL2F]              {PORT(3, 1843200), {} },
-        [MACH_LEMOTE_A1004]             {PORT_M(2, 33177600), {} },
-        [MACH_LEMOTE_A1101]             {PORT_M(2, 25000000), {} },
-        [MACH_LEMOTE_A1201]             {PORT_M(2, 25000000), {} },
-        [MACH_LEMOTE_A1205]             {PORT_M(2, 25000000), {} },
-        [MACH_LOONGSON_END]             {},
+static struct plat_serial8250_port uart8250_data[][MAX_UARTS + 1] = {
+        [MACH_LOONGSON_UNKNOWN] = {},
+        [MACH_LEMOTE_FL2E]      = {PORT(4, 1843200), {} },
+        [MACH_LEMOTE_FL2F]      = {PORT(3, 1843200), {} },
+        [MACH_LEMOTE_ML2F7]     = {PORT_M(3, 3686400), {} },
+        [MACH_LEMOTE_YL2F89]    = {PORT_M(3, 3686400), {} },
+        [MACH_DEXXON_GDIUM2F10] = {PORT_M(3, 3686400), {} },
+        [MACH_LEMOTE_NAS]       = {PORT_M(3, 3686400), {} },
+        [MACH_LEMOTE_LL2F]      = {PORT(3, 1843200), {} },
+        [MACH_LOONGSON_GENERIC] = {PORT_M(2, 25000000), {} },
+        [MACH_LOONGSON_END]     = {},
 };
 
 static struct platform_device uart8250_device = {
@@ -61,17 +58,52 @@ static struct platform_device uart8250_device = {
 
 static int __init serial_init(void)
 {
+        int i;
         unsigned char iotype;
 
         iotype = uart8250_data[mips_machtype][0].iotype;
 
-        if (UPIO_MEM == iotype)
+        if (UPIO_MEM == iotype) {
+                uart8250_data[mips_machtype][0].mapbase =
+                        loongson_uart_base[0];
                 uart8250_data[mips_machtype][0].membase =
-                        (void __iomem *)_loongson_uart_base;
+                        (void __iomem *)_loongson_uart_base[0];
+        }
         else if (UPIO_PORT == iotype)
                 uart8250_data[mips_machtype][0].iobase =
-                    loongson_uart_base - LOONGSON_PCIIO_BASE;
+                        loongson_uart_base[0] - LOONGSON_PCIIO_BASE;
 
+        if (loongson_sysconf.uarts[0].uartclk)
+                uart8250_data[mips_machtype][0].uartclk =
+                        loongson_sysconf.uarts[0].uartclk;
+
+        for (i = 1; i < loongson_sysconf.nr_uarts; i++) {
+                iotype = loongson_sysconf.uarts[i].iotype;
+                uart8250_data[mips_machtype][i].iotype = iotype;
+                loongson_uart_base[i] = loongson_sysconf.uarts[i].uart_base;
+
+                if (UPIO_MEM == iotype) {
+                        uart8250_data[mips_machtype][i].irq =
+                                MIPS_CPU_IRQ_BASE + loongson_sysconf.uarts[i].int_offset;
+                        uart8250_data[mips_machtype][i].mapbase =
+                                loongson_uart_base[i];
+                        uart8250_data[mips_machtype][i].membase =
+                                ioremap_nocache(loongson_uart_base[i], 8);
+                } else if (UPIO_PORT == iotype) {
+                        uart8250_data[mips_machtype][i].irq =
+                                loongson_sysconf.uarts[i].int_offset;
+                        uart8250_data[mips_machtype][i].iobase =
+                                loongson_uart_base[i] - LOONGSON_PCIIO_BASE;
+                }
+
+                uart8250_data[mips_machtype][i].uartclk =
+                        loongson_sysconf.uarts[i].uartclk;
+                uart8250_data[mips_machtype][i].flags =
+                        UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
+        }
+
+        memset(&uart8250_data[mips_machtype][loongson_sysconf.nr_uarts],
+                        0, sizeof(struct plat_serial8250_port));
         uart8250_device.dev.platform_data = uart8250_data[mips_machtype];
 
         return platform_device_register(&uart8250_device);
diff --git a/arch/mips/loongson/common/setup.c b/arch/mips/loongson/common/setup.c
index bb4ac922e47a..d477dd6bb326 100644
--- a/arch/mips/loongson/common/setup.c
+++ b/arch/mips/loongson/common/setup.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 
 #include <asm/wbflush.h>
+#include <asm/bootinfo.h>
 
 #include <loongson.h>
 
diff --git a/arch/mips/loongson/common/time.c b/arch/mips/loongson/common/time.c
index 262a1f65b05e..e1a5382ad47e 100644
--- a/arch/mips/loongson/common/time.c
+++ b/arch/mips/loongson/common/time.c
@@ -12,6 +12,7 @@
  */
 #include <asm/mc146818-time.h>
 #include <asm/time.h>
+#include <asm/hpet.h>
 
 #include <loongson.h>
 #include <cs5536/cs5536_mfgpt.h>
@@ -21,7 +22,11 @@ void __init plat_time_init(void)
         /* setup mips r4k timer */
         mips_hpt_frequency = cpu_clock_freq / 2;
 
+#ifdef CONFIG_RS780_HPET
+        setup_hpet_timer();
+#else
         setup_mfgpt0_timer();
+#endif
 }
 
 void read_persistent_clock(struct timespec *ts)
diff --git a/arch/mips/loongson/common/uart_base.c b/arch/mips/loongson/common/uart_base.c
index 1e1eeea73fde..9de559d58e1f 100644
--- a/arch/mips/loongson/common/uart_base.c
+++ b/arch/mips/loongson/common/uart_base.c
@@ -13,22 +13,27 @@
 
 #include <loongson.h>
 
-/* ioremapped */
-unsigned long _loongson_uart_base;
-EXPORT_SYMBOL(_loongson_uart_base);
 /* raw */
-unsigned long loongson_uart_base;
+unsigned long loongson_uart_base[MAX_UARTS] = {};
+/* ioremapped */
+unsigned long _loongson_uart_base[MAX_UARTS] = {};
+
 EXPORT_SYMBOL(loongson_uart_base);
+EXPORT_SYMBOL(_loongson_uart_base);
 
 void prom_init_loongson_uart_base(void)
 {
         switch (mips_machtype) {
+        case MACH_LOONGSON_GENERIC:
+                /* The CPU provided serial port (CPU) */
+                loongson_uart_base[0] = LOONGSON_REG_BASE + 0x1e0;
+                break;
         case MACH_LEMOTE_FL2E:
-                loongson_uart_base = LOONGSON_PCIIO_BASE + 0x3f8;
+                loongson_uart_base[0] = LOONGSON_PCIIO_BASE + 0x3f8;
                 break;
         case MACH_LEMOTE_FL2F:
         case MACH_LEMOTE_LL2F:
-                loongson_uart_base = LOONGSON_PCIIO_BASE + 0x2f8;
+                loongson_uart_base[0] = LOONGSON_PCIIO_BASE + 0x2f8;
                 break;
         case MACH_LEMOTE_ML2F7:
         case MACH_LEMOTE_YL2F89:
@@ -36,17 +41,10 @@ void prom_init_loongson_uart_base(void)
         case MACH_LEMOTE_NAS:
         default:
                 /* The CPU provided serial port (LPC) */
-                loongson_uart_base = LOONGSON_LIO1_BASE + 0x3f8;
-                break;
-        case MACH_LEMOTE_A1004:
-        case MACH_LEMOTE_A1101:
-        case MACH_LEMOTE_A1201:
-        case MACH_LEMOTE_A1205:
-                /* The CPU provided serial port (CPU) */
-                loongson_uart_base = LOONGSON_REG_BASE + 0x1e0;
+                loongson_uart_base[0] = LOONGSON_LIO1_BASE + 0x3f8;
                 break;
         }
 
-        _loongson_uart_base =
-                (unsigned long)ioremap_nocache(loongson_uart_base, 8);
+        _loongson_uart_base[0] =
+                (unsigned long)ioremap_nocache(loongson_uart_base[0], 8);
 }
diff --git a/arch/mips/loongson/lemote-2f/irq.c b/arch/mips/loongson/lemote-2f/irq.c
index 6f8682e44483..cab5f43e0e29 100644
--- a/arch/mips/loongson/lemote-2f/irq.c
+++ b/arch/mips/loongson/lemote-2f/irq.c
@@ -93,13 +93,13 @@ static irqreturn_t ip6_action(int cpl, void *dev_id)
         return IRQ_HANDLED;
 }
 
-struct irqaction ip6_irqaction = {
+static struct irqaction ip6_irqaction = {
         .handler = ip6_action,
         .name = "cascade",
         .flags = IRQF_SHARED | IRQF_NO_THREAD,
 };
 
-struct irqaction cascade_irqaction = {
+static struct irqaction cascade_irqaction = {
         .handler = no_action,
         .name = "cascade",
         .flags = IRQF_NO_THREAD,
diff --git a/arch/mips/loongson/lemote-2f/reset.c b/arch/mips/loongson/lemote-2f/reset.c
index 79ac694fe744..a26ca7fcd7e0 100644
--- a/arch/mips/loongson/lemote-2f/reset.c
+++ b/arch/mips/loongson/lemote-2f/reset.c
@@ -76,7 +76,7 @@ static void fl2f_shutdown(void)
 
 /* reset support for yeeloong2f and mengloong2f notebook */
 
-void ml2f_reboot(void)
+static void ml2f_reboot(void)
 {
         reset_cpu();
 
diff --git a/arch/mips/loongson/loongson-3/Makefile b/arch/mips/loongson/loongson-3/Makefile
index b4df775b9f30..622fead5ebc9 100644
--- a/arch/mips/loongson/loongson-3/Makefile
+++ b/arch/mips/loongson/loongson-3/Makefile
@@ -1,8 +1,10 @@
 #
 # Makefile for Loongson-3 family machines
 #
-obj-y                   += irq.o cop2-ex.o
+obj-y                   += irq.o cop2-ex.o platform.o
 
 obj-$(CONFIG_SMP)       += smp.o
 
 obj-$(CONFIG_NUMA)      += numa.o
+
+obj-$(CONFIG_RS780_HPET) += hpet.o
diff --git a/arch/mips/loongson/loongson-3/hpet.c b/arch/mips/loongson/loongson-3/hpet.c
new file mode 100644
index 000000000000..e898d68668a9
--- /dev/null
+++ b/arch/mips/loongson/loongson-3/hpet.c
@@ -0,0 +1,257 @@
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/percpu.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+
+#include <asm/hpet.h>
+#include <asm/time.h>
+
+#define SMBUS_CFG_BASE          (loongson_sysconf.ht_control_base + 0x0300a000)
+#define SMBUS_PCI_REG40         0x40
+#define SMBUS_PCI_REG64         0x64
+#define SMBUS_PCI_REGB4         0xb4
+
+static DEFINE_SPINLOCK(hpet_lock);
+DEFINE_PER_CPU(struct clock_event_device, hpet_clockevent_device);
+
+static unsigned int smbus_read(int offset)
+{
+        return *(volatile unsigned int *)(SMBUS_CFG_BASE + offset);
+}
+
+static void smbus_write(int offset, int data)
+{
+        *(volatile unsigned int *)(SMBUS_CFG_BASE + offset) = data;
+}
+
+static void smbus_enable(int offset, int bit)
+{
+        unsigned int cfg = smbus_read(offset);
+
+        cfg |= bit;
+        smbus_write(offset, cfg);
+}
+
+static int hpet_read(int offset)
+{
+        return *(volatile unsigned int *)(HPET_MMIO_ADDR + offset);
+}
+
+static void hpet_write(int offset, int data)
+{
+        *(volatile unsigned int *)(HPET_MMIO_ADDR + offset) = data;
+}
+
+static void hpet_start_counter(void)
+{
+        unsigned int cfg = hpet_read(HPET_CFG);
+
+        cfg |= HPET_CFG_ENABLE;
+        hpet_write(HPET_CFG, cfg);
+}
+
+static void hpet_stop_counter(void)
+{
+        unsigned int cfg = hpet_read(HPET_CFG);
+
+        cfg &= ~HPET_CFG_ENABLE;
+        hpet_write(HPET_CFG, cfg);
+}
+
+static void hpet_reset_counter(void)
+{
+        hpet_write(HPET_COUNTER, 0);
+        hpet_write(HPET_COUNTER + 4, 0);
+}
+
+static void hpet_restart_counter(void)
+{
+        hpet_stop_counter();
+        hpet_reset_counter();
+        hpet_start_counter();
+}
+
+static void hpet_enable_legacy_int(void)
+{
+        /* Do nothing on Loongson-3 */
+}
+
+static void hpet_set_mode(enum clock_event_mode mode,
+                                struct clock_event_device *evt)
+{
+        int cfg = 0;
+
+        spin_lock(&hpet_lock);
+        switch (mode) {
+        case CLOCK_EVT_MODE_PERIODIC:
+                pr_info("set clock event to periodic mode!\n");
+                /* stop counter */
+                hpet_stop_counter();
+
+                /* enables the timer0 to generate a periodic interrupt */
+                cfg = hpet_read(HPET_T0_CFG);
+                cfg &= ~HPET_TN_LEVEL;
+                cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC |
+                                HPET_TN_SETVAL | HPET_TN_32BIT;
+                hpet_write(HPET_T0_CFG, cfg);
+
+                /* set the comparator */
+                hpet_write(HPET_T0_CMP, HPET_COMPARE_VAL);
+                udelay(1);
+                hpet_write(HPET_T0_CMP, HPET_COMPARE_VAL);
+
+                /* start counter */
+                hpet_start_counter();
+                break;
+        case CLOCK_EVT_MODE_SHUTDOWN:
+        case CLOCK_EVT_MODE_UNUSED:
+                cfg = hpet_read(HPET_T0_CFG);
+                cfg &= ~HPET_TN_ENABLE;
+                hpet_write(HPET_T0_CFG, cfg);
+                break;
+        case CLOCK_EVT_MODE_ONESHOT:
+                pr_info("set clock event to one shot mode!\n");
+                cfg = hpet_read(HPET_T0_CFG);
+                /* set timer0 type
+                 * 1 : periodic interrupt
+                 * 0 : non-periodic(oneshot) interrupt
+                 */
+                cfg &= ~HPET_TN_PERIODIC;
+                cfg |= HPET_TN_ENABLE | HPET_TN_32BIT;
+                hpet_write(HPET_T0_CFG, cfg);
+                break;
+        case CLOCK_EVT_MODE_RESUME:
+                hpet_enable_legacy_int();
+                break;
+        }
+        spin_unlock(&hpet_lock);
+}
+
+static int hpet_next_event(unsigned long delta,
+                struct clock_event_device *evt)
+{
+        unsigned int cnt;
+        int res;
+
+        cnt = hpet_read(HPET_COUNTER);
+        cnt += delta;
+        hpet_write(HPET_T0_CMP, cnt);
+
+        res = ((int)(hpet_read(HPET_COUNTER) - cnt) > 0) ? -ETIME : 0;
+        return res;
+}
+
+static irqreturn_t hpet_irq_handler(int irq, void *data)
+{
+        int is_irq;
+        struct clock_event_device *cd;
+        unsigned int cpu = smp_processor_id();
+
+        is_irq = hpet_read(HPET_STATUS);
+        if (is_irq & HPET_T0_IRS) {
+                /* clear the TIMER0 irq status register */
+                hpet_write(HPET_STATUS, HPET_T0_IRS);
+                cd = &per_cpu(hpet_clockevent_device, cpu);
+                cd->event_handler(cd);
+                return IRQ_HANDLED;
+        }
+        return IRQ_NONE;
+}
+
+static struct irqaction hpet_irq = {
+        .handler = hpet_irq_handler,
+        .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER,
+        .name = "hpet",
+};
+
+/*
+ * hpet address assignation and irq setting should be done in bios.
+ * but pmon don't do this, we just setup here directly.
+ * The operation under is normal. unfortunately, hpet_setup process
+ * is before pci initialize.
+ *
+ * {
+ *      struct pci_dev *pdev;
+ *
+ *      pdev = pci_get_device(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS, NULL);
+ *      pci_write_config_word(pdev, SMBUS_PCI_REGB4, HPET_ADDR);
+ *
+ *      ...
+ * }
+ */
+static void hpet_setup(void)
+{
+        /* set hpet base address */
+        smbus_write(SMBUS_PCI_REGB4, HPET_ADDR);
+
+        /* enable decodeing of access to HPET MMIO*/
+        smbus_enable(SMBUS_PCI_REG40, (1 << 28));
+
+        /* HPET irq enable */
+        smbus_enable(SMBUS_PCI_REG64, (1 << 10));
+
+        hpet_enable_legacy_int();
+}
+
+void __init setup_hpet_timer(void)
+{
+        unsigned int cpu = smp_processor_id();
+        struct clock_event_device *cd;
+
+        hpet_setup();
+
+        cd = &per_cpu(hpet_clockevent_device, cpu);
+        cd->name = "hpet";
+        cd->rating = 320;
+        cd->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+        cd->set_mode = hpet_set_mode;
+        cd->set_next_event = hpet_next_event;
+        cd->irq = HPET_T0_IRQ;
+        cd->cpumask = cpumask_of(cpu);
+        clockevent_set_clock(cd, HPET_FREQ);
+        cd->max_delta_ns = clockevent_delta2ns(0x7fffffff, cd);
+        cd->min_delta_ns = 5000;
+
+        clockevents_register_device(cd);
+        setup_irq(HPET_T0_IRQ, &hpet_irq);
+        pr_info("hpet clock event device register\n");
+}
+
+static cycle_t hpet_read_counter(struct clocksource *cs)
+{
+        return (cycle_t)hpet_read(HPET_COUNTER);
+}
+
+static void hpet_suspend(struct clocksource *cs)
+{
+}
+
+static void hpet_resume(struct clocksource *cs)
+{
+        hpet_setup();
+        hpet_restart_counter();
+}
+
+static struct clocksource csrc_hpet = {
+        .name = "hpet",
+        /* mips clocksource rating is less than 300, so hpet is better. */
+        .rating = 300,
+        .read = hpet_read_counter,
+        .mask = CLOCKSOURCE_MASK(32),
+        /* oneshot mode work normal with this flag */
+        .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+        .suspend = hpet_suspend,
+        .resume = hpet_resume,
+        .mult = 0,
+        .shift = 10,
+};
+
+int __init init_hpet_clocksource(void)
+{
+        csrc_hpet.mult = clocksource_hz2mult(HPET_FREQ, csrc_hpet.shift);
+        return clocksource_register_hz(&csrc_hpet, HPET_FREQ);
+}
+
+arch_initcall(init_hpet_clocksource);
diff --git a/arch/mips/loongson/loongson-3/irq.c b/arch/mips/loongson/loongson-3/irq.c
index ca1c62af5188..21221edda7a9 100644
--- a/arch/mips/loongson/loongson-3/irq.c
+++ b/arch/mips/loongson/loongson-3/irq.c
@@ -9,7 +9,7 @@
 
 #include "smp.h"
 
-unsigned int ht_irq[] = {1, 3, 4, 5, 6, 7, 8, 12, 14, 15};
+unsigned int ht_irq[] = {0, 1, 3, 4, 5, 6, 7, 8, 12, 14, 15};
 
 static void ht_irqdispatch(void)
 {
@@ -55,8 +55,8 @@ static inline void mask_loongson_irq(struct irq_data *d)
         /* Workaround: UART IRQ may deliver to any core */
         if (d->irq == LOONGSON_UART_IRQ) {
                 int cpu = smp_processor_id();
-                int node_id = cpu / loongson_sysconf.cores_per_node;
-                int core_id = cpu % loongson_sysconf.cores_per_node;
+                int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+                int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
                 u64 intenclr_addr = smp_group[node_id] |
                         (u64)(&LOONGSON_INT_ROUTER_INTENCLR);
                 u64 introuter_lpc_addr = smp_group[node_id] |
@@ -72,8 +72,8 @@ static inline void unmask_loongson_irq(struct irq_data *d)
         /* Workaround: UART IRQ may deliver to any core */
         if (d->irq == LOONGSON_UART_IRQ) {
                 int cpu = smp_processor_id();
-                int node_id = cpu / loongson_sysconf.cores_per_node;
-                int core_id = cpu % loongson_sysconf.cores_per_node;
+                int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+                int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
                 u64 intenset_addr = smp_group[node_id] |
                         (u64)(&LOONGSON_INT_ROUTER_INTENSET);
                 u64 introuter_lpc_addr = smp_group[node_id] |
@@ -102,10 +102,12 @@ void irq_router_init(void)
         int i;
 
         /* route LPC int to cpu core0 int 0 */
-        LOONGSON_INT_ROUTER_LPC = LOONGSON_INT_CORE0_INT0;
+        LOONGSON_INT_ROUTER_LPC =
+                LOONGSON_INT_COREx_INTy(loongson_sysconf.boot_cpu_id, 0);
         /* route HT1 int0 ~ int7 to cpu core0 INT1*/
         for (i = 0; i < 8; i++)
-                LOONGSON_INT_ROUTER_HT1(i) = LOONGSON_INT_CORE0_INT1;
+                LOONGSON_INT_ROUTER_HT1(i) =
+                        LOONGSON_INT_COREx_INTy(loongson_sysconf.boot_cpu_id, 1);
         /* enable HT1 interrupt */
         LOONGSON_HT1_INTN_EN(0) = 0xffffffff;
         /* enable router interrupt intenset */
diff --git a/arch/mips/loongson/loongson-3/numa.c b/arch/mips/loongson/loongson-3/numa.c
index 42323bcc5d28..6cae0e75de27 100644
--- a/arch/mips/loongson/loongson-3/numa.c
+++ b/arch/mips/loongson/loongson-3/numa.c
@@ -224,7 +224,7 @@ static void __init node_mem_init(unsigned int node)
 
 static __init void prom_meminit(void)
 {
-        unsigned int node, cpu;
+        unsigned int node, cpu, active_cpu = 0;
 
         cpu_node_probe();
         init_topology_matrix();
@@ -240,8 +240,14 @@ static __init void prom_meminit(void)
                 node = cpu / loongson_sysconf.cores_per_node;
                 if (node >= num_online_nodes())
                         node = 0;
-                pr_info("NUMA: set cpumask cpu %d on node %d\n", cpu, node);
-                cpu_set(cpu, __node_data[(node)]->cpumask);
+
+                if (loongson_sysconf.reserved_cpus_mask & (1<<cpu))
+                        continue;
+
+                cpu_set(active_cpu, __node_data[(node)]->cpumask);
+                pr_info("NUMA: set cpumask cpu %d on node %d\n", active_cpu, node);
+
+                active_cpu++;
         }
 }
 
diff --git a/arch/mips/loongson/loongson-3/platform.c b/arch/mips/loongson/loongson-3/platform.c
new file mode 100644
index 000000000000..25a97cc0ee33
--- /dev/null
+++ b/arch/mips/loongson/loongson-3/platform.c
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Lemote Inc.
+ * Author: Wu Zhangjin, wuzhangjin@gmail.com
+ *         Xiang Yu, xiangy@lemote.com
+ *         Chen Huacai, chenhc@lemote.com
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <asm/bootinfo.h>
+#include <boot_param.h>
+#include <loongson_hwmon.h>
+#include <workarounds.h>
+
+static int __init loongson3_platform_init(void)
+{
+        int i;
+        struct platform_device *pdev;
+
+        if (loongson_sysconf.ecname[0] != '\0')
+                platform_device_register_simple(loongson_sysconf.ecname, -1, NULL, 0);
+
+        for (i = 0; i < loongson_sysconf.nr_sensors; i++) {
+                if (loongson_sysconf.sensors[i].type > SENSOR_FAN)
+                        continue;
+
+                pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
+                pdev->name = loongson_sysconf.sensors[i].name;
+                pdev->id = loongson_sysconf.sensors[i].id;
+                pdev->dev.platform_data = &loongson_sysconf.sensors[i];
+                platform_device_register(pdev);
+        }
+
+        return 0;
+}
+
+arch_initcall(loongson3_platform_init);
diff --git a/arch/mips/loongson/loongson-3/smp.c b/arch/mips/loongson/loongson-3/smp.c
index d8c63af6c7cc..e2eb688b5434 100644
--- a/arch/mips/loongson/loongson-3/smp.c
+++ b/arch/mips/loongson/loongson-3/smp.c
@@ -25,6 +25,7 @@
 #include <asm/tlbflush.h>
 #include <asm/cacheflush.h>
 #include <loongson.h>
+#include <workarounds.h>
 
 #include "smp.h"
 
@@ -239,7 +240,7 @@ static void ipi_mailbox_buf_init(void)
  */
 static void loongson3_send_ipi_single(int cpu, unsigned int action)
 {
-        loongson3_ipi_write32((u32)action, ipi_set0_regs[cpu]);
+        loongson3_ipi_write32((u32)action, ipi_set0_regs[cpu_logical_map(cpu)]);
 }
 
 static void
@@ -248,7 +249,7 @@ loongson3_send_ipi_mask(const struct cpumask *mask, unsigned int action)
         unsigned int i;
 
         for_each_cpu(i, mask)
-                loongson3_ipi_write32((u32)action, ipi_set0_regs[i]);
+                loongson3_ipi_write32((u32)action, ipi_set0_regs[cpu_logical_map(i)]);
 }
 
 void loongson3_ipi_interrupt(struct pt_regs *regs)
@@ -257,10 +258,10 @@ void loongson3_ipi_interrupt(struct pt_regs *regs)
         unsigned int action, c0count;
 
         /* Load the ipi register to figure out what we're supposed to do */
-        action = loongson3_ipi_read32(ipi_status0_regs[cpu]);
+        action = loongson3_ipi_read32(ipi_status0_regs[cpu_logical_map(cpu)]);
 
         /* Clear the ipi register to clear the interrupt */
-        loongson3_ipi_write32((u32)action, ipi_clear0_regs[cpu]);
+        loongson3_ipi_write32((u32)action, ipi_clear0_regs[cpu_logical_map(cpu)]);
 
         if (action & SMP_RESCHEDULE_YOURSELF)
                 scheduler_ipi();
@@ -291,12 +292,14 @@ static void loongson3_init_secondary(void)
         /* Set interrupt mask, but don't enable */
         change_c0_status(ST0_IM, imask);
 
-        for (i = 0; i < loongson_sysconf.nr_cpus; i++)
-                loongson3_ipi_write32(0xffffffff, ipi_en0_regs[i]);
+        for (i = 0; i < num_possible_cpus(); i++)
+                loongson3_ipi_write32(0xffffffff, ipi_en0_regs[cpu_logical_map(i)]);
 
-        cpu_data[cpu].package = cpu / loongson_sysconf.cores_per_package;
-        cpu_data[cpu].core = cpu % loongson_sysconf.cores_per_package;
         per_cpu(cpu_state, cpu) = CPU_ONLINE;
+        cpu_data[cpu].core =
+                cpu_logical_map(cpu) % loongson_sysconf.cores_per_package;
+        cpu_data[cpu].package =
+                cpu_logical_map(cpu) / loongson_sysconf.cores_per_package;
 
         i = 0;
         __this_cpu_write(core0_c0count, 0);
@@ -314,37 +317,50 @@ static void loongson3_init_secondary(void)
 
 static void loongson3_smp_finish(void)
 {
+        int cpu = smp_processor_id();
+
         write_c0_compare(read_c0_count() + mips_hpt_frequency/HZ);
         local_irq_enable();
         loongson3_ipi_write64(0,
-                        (void *)(ipi_mailbox_buf[smp_processor_id()]+0x0));
+                        (void *)(ipi_mailbox_buf[cpu_logical_map(cpu)]+0x0));
         pr_info("CPU#%d finished, CP0_ST=%x\n",
                         smp_processor_id(), read_c0_status());
 }
 
 static void __init loongson3_smp_setup(void)
 {
-        int i, num;
+        int i = 0, num = 0; /* i: physical id, num: logical id */
 
         init_cpu_possible(cpu_none_mask);
-        set_cpu_possible(0, true);
-
-        __cpu_number_map[0] = 0;
-        __cpu_logical_map[0] = 0;
 
         /* For unified kernel, NR_CPUS is the maximum possible value,
          * loongson_sysconf.nr_cpus is the really present value */
-        for (i = 1, num = 0; i < loongson_sysconf.nr_cpus; i++) {
-                set_cpu_possible(i, true);
-                __cpu_number_map[i] = ++num;
-                __cpu_logical_map[num] = i;
+        while (i < loongson_sysconf.nr_cpus) {
+                if (loongson_sysconf.reserved_cpus_mask & (1<<i)) {
+                        /* Reserved physical CPU cores */
+                        __cpu_number_map[i] = -1;
+                } else {
+                        __cpu_number_map[i] = num;
+                        __cpu_logical_map[num] = i;
+                        set_cpu_possible(num, true);
+                        num++;
+                }
+                i++;
         }
+        pr_info("Detected %i available CPU(s)\n", num);
+
+        while (num < loongson_sysconf.nr_cpus) {
+                __cpu_logical_map[num] = -1;
+                num++;
+        }
+
         ipi_set0_regs_init();
         ipi_clear0_regs_init();
         ipi_status0_regs_init();
         ipi_en0_regs_init();
         ipi_mailbox_buf_init();
-        pr_info("Detected %i available secondary CPU(s)\n", num);
+        cpu_data[0].core = cpu_logical_map(0) % loongson_sysconf.cores_per_package;
+        cpu_data[0].package = cpu_logical_map(0) / loongson_sysconf.cores_per_package;
 }
 
 static void __init loongson3_prepare_cpus(unsigned int max_cpus)
@@ -371,10 +387,14 @@ static void loongson3_boot_secondary(int cpu, struct task_struct *idle)
         pr_debug("CPU#%d, func_pc=%lx, sp=%lx, gp=%lx\n",
                         cpu, startargs[0], startargs[1], startargs[2]);
 
-        loongson3_ipi_write64(startargs[3], (void *)(ipi_mailbox_buf[cpu]+0x18));
-        loongson3_ipi_write64(startargs[2], (void *)(ipi_mailbox_buf[cpu]+0x10));
-        loongson3_ipi_write64(startargs[1], (void *)(ipi_mailbox_buf[cpu]+0x8));
-        loongson3_ipi_write64(startargs[0], (void *)(ipi_mailbox_buf[cpu]+0x0));
+        loongson3_ipi_write64(startargs[3],
+                        (void *)(ipi_mailbox_buf[cpu_logical_map(cpu)]+0x18));
+        loongson3_ipi_write64(startargs[2],
+                        (void *)(ipi_mailbox_buf[cpu_logical_map(cpu)]+0x10));
+        loongson3_ipi_write64(startargs[1],
+                        (void *)(ipi_mailbox_buf[cpu_logical_map(cpu)]+0x8));
+        loongson3_ipi_write64(startargs[0],
+                        (void *)(ipi_mailbox_buf[cpu_logical_map(cpu)]+0x0));
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -568,7 +588,7 @@ void loongson3_disable_clock(int cpu)
         if (loongson_sysconf.cputype == Loongson_3A) {
                 LOONGSON_CHIPCFG(package_id) &= ~(1 << (12 + core_id));
         } else if (loongson_sysconf.cputype == Loongson_3B) {
-                if (!cpuhotplug_workaround)
+                if (!(loongson_sysconf.workarounds & WORKAROUND_CPUHOTPLUG))
                         LOONGSON_FREQCTRL(package_id) &= ~(1 << (core_id * 4 + 3));
         }
 }
@@ -581,7 +601,7 @@ void loongson3_enable_clock(int cpu)
         if (loongson_sysconf.cputype == Loongson_3A) {
                 LOONGSON_CHIPCFG(package_id) |= 1 << (12 + core_id);
         } else if (loongson_sysconf.cputype == Loongson_3B) {
-                if (!cpuhotplug_workaround)
+                if (!(loongson_sysconf.workarounds & WORKAROUND_CPUHOTPLUG))
                         LOONGSON_FREQCTRL(package_id) |= 1 << (core_id * 4 + 3);
         }
 }
diff --git a/arch/mips/loongson1/Kconfig b/arch/mips/loongson1/Kconfig
index e23c25d09963..a2b796eaf3c3 100644
--- a/arch/mips/loongson1/Kconfig
+++ b/arch/mips/loongson1/Kconfig
@@ -5,8 +5,8 @@ choice
 
 config LOONGSON1_LS1B
         bool "Loongson LS1B board"
-        select CEVT_R4K
-        select CSRC_R4K
+        select CEVT_R4K if !MIPS_EXTERNAL_TIMER
+        select CSRC_R4K if !MIPS_EXTERNAL_TIMER
         select SYS_HAS_CPU_LOONGSON1B
         select DMA_NONCOHERENT
         select BOOT_ELF32
@@ -16,8 +16,46 @@ config LOONGSON1_LS1B
         select SYS_SUPPORTS_HIGHMEM
         select SYS_SUPPORTS_MIPS16
         select SYS_HAS_EARLY_PRINTK
+        select USE_GENERIC_EARLY_PRINTK_8250
         select COMMON_CLK
 
 endchoice
 
+menuconfig CEVT_CSRC_LS1X
+        bool "Use PWM Timer for clockevent/clocksource"
+        select MIPS_EXTERNAL_TIMER
+        depends on CPU_LOONGSON1
+        help
+          This option changes the default clockevent/clocksource to PWM Timer,
+          and is required by Loongson1 CPUFreq support.
+
+          If unsure, say N.
+
+choice
+        prompt  "Select clockevent/clocksource"
+        depends on CEVT_CSRC_LS1X
+        default TIMER_USE_PWM0
+
+config TIMER_USE_PWM0
+        bool "Use PWM Timer 0"
+        help
+          Use PWM Timer 0 as the default clockevent/clocksourcer.
+
+config TIMER_USE_PWM1
+        bool "Use PWM Timer 1"
+        help
+          Use PWM Timer 1 as the default clockevent/clocksourcer.
+
+config TIMER_USE_PWM2
+        bool "Use PWM Timer 2"
+        help
+          Use PWM Timer 2 as the default clockevent/clocksourcer.
+
+config TIMER_USE_PWM3
+        bool "Use PWM Timer 3"
+        help
+          Use PWM Timer 3 as the default clockevent/clocksourcer.
+
+endchoice
+
 endif # MACH_LOONGSON1
diff --git a/arch/mips/loongson1/common/Makefile b/arch/mips/loongson1/common/Makefile
index b2797709ef5b..723b4ce3b8f0 100644
--- a/arch/mips/loongson1/common/Makefile
+++ b/arch/mips/loongson1/common/Makefile
@@ -2,4 +2,4 @@
 # Makefile for common code of loongson1 based machines.
 #
 
-obj-y   += clock.o irq.o platform.o prom.o reset.o setup.o
+obj-y   += time.o irq.o platform.o prom.o reset.o setup.o
diff --git a/arch/mips/loongson1/common/clock.c b/arch/mips/loongson1/common/clock.c
deleted file mode 100644
index b4437f19c3d9..000000000000
--- a/arch/mips/loongson1/common/clock.c
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright (c) 2011 Zhang, Keguang <keguang.zhang@gmail.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-
-#include <linux/clk.h>
-#include <linux/err.h>
-#include <asm/time.h>
-#include <platform.h>
-
-void __init plat_time_init(void)
-{
-        struct clk *clk;
-
-        /* Initialize LS1X clocks */
-        ls1x_clk_init();
-
-        /* setup mips r4k timer */
-        clk = clk_get(NULL, "cpu");
-        if (IS_ERR(clk))
-                panic("unable to get cpu clock, err=%ld", PTR_ERR(clk));
-
-        mips_hpt_frequency = clk_get_rate(clk) / 2;
-}
diff --git a/arch/mips/loongson1/common/platform.c b/arch/mips/loongson1/common/platform.c
index fdf8cb5987a4..ddf1d4cbf31e 100644
--- a/arch/mips/loongson1/common/platform.c
+++ b/arch/mips/loongson1/common/platform.c
@@ -16,8 +16,10 @@
 #include <linux/usb/ehci_pdriver.h>
 #include <asm-generic/sizes.h>
 
+#include <cpufreq.h>
 #include <loongson1.h>
 
+/* 8250/16550 compatible UART */
 #define LS1X_UART(_id)                                          \
         {                                                       \
                 .mapbase        = LS1X_UART ## _id ## _BASE,    \
@@ -27,7 +29,7 @@
                 .type           = PORT_16550A,                  \
         }
 
-static struct plat_serial8250_port ls1x_serial8250_port[] = {
+static struct plat_serial8250_port ls1x_serial8250_pdata[] = {
         LS1X_UART(0),
         LS1X_UART(1),
         LS1X_UART(2),
@@ -35,11 +37,11 @@ static struct plat_serial8250_port ls1x_serial8250_port[] = {
         {},
 };
 
-struct platform_device ls1x_uart_device = {
+struct platform_device ls1x_uart_pdev = {
         .name           = "serial8250",
         .id             = PLAT8250_DEV_PLATFORM,
         .dev            = {
-                .platform_data = ls1x_serial8250_port,
+                .platform_data = ls1x_serial8250_pdata,
         },
 };
 
@@ -48,16 +50,97 @@ void __init ls1x_serial_setup(struct platform_device *pdev)
         struct clk *clk;
         struct plat_serial8250_port *p;
 
-        clk = clk_get(NULL, pdev->name);
-        if (IS_ERR(clk))
-                panic("unable to get %s clock, err=%ld",
-                        pdev->name, PTR_ERR(clk));
+        clk = clk_get(&pdev->dev, pdev->name);
+        if (IS_ERR(clk)) {
+                pr_err("unable to get %s clock, err=%ld",
+                       pdev->name, PTR_ERR(clk));
+                return;
+        }
+        clk_prepare_enable(clk);
 
         for (p = pdev->dev.platform_data; p->flags != 0; ++p)
                 p->uartclk = clk_get_rate(clk);
 }
 
+/* CPUFreq */
+static struct plat_ls1x_cpufreq ls1x_cpufreq_pdata = {
+        .clk_name       = "cpu_clk",
+        .osc_clk_name   = "osc_33m_clk",
+        .max_freq       = 266 * 1000,
+        .min_freq       = 33 * 1000,
+};
+
+struct platform_device ls1x_cpufreq_pdev = {
+        .name           = "ls1x-cpufreq",
+        .dev            = {
+                .platform_data = &ls1x_cpufreq_pdata,
+        },
+};
+
 /* Synopsys Ethernet GMAC */
+static struct stmmac_mdio_bus_data ls1x_mdio_bus_data = {
+        .phy_mask       = 0,
+};
+
+static struct stmmac_dma_cfg ls1x_eth_dma_cfg = {
+        .pbl            = 1,
+};
+
+int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
+{
+        struct plat_stmmacenet_data *plat_dat = NULL;
+        u32 val;
+
+        val = __raw_readl(LS1X_MUX_CTRL1);
+
+        plat_dat = dev_get_platdata(&pdev->dev);
+        if (plat_dat->bus_id) {
+                __raw_writel(__raw_readl(LS1X_MUX_CTRL0) | GMAC1_USE_UART1 |
+                             GMAC1_USE_UART0, LS1X_MUX_CTRL0);
+                switch (plat_dat->interface) {
+                case PHY_INTERFACE_MODE_RGMII:
+                        val &= ~(GMAC1_USE_TXCLK | GMAC1_USE_PWM23);
+                        break;
+                case PHY_INTERFACE_MODE_MII:
+                        val |= (GMAC1_USE_TXCLK | GMAC1_USE_PWM23);
+                        break;
+                default:
+                        pr_err("unsupported mii mode %d\n",
+                               plat_dat->interface);
+                        return -ENOTSUPP;
+                }
+                val &= ~GMAC1_SHUT;
+        } else {
+                switch (plat_dat->interface) {
+                case PHY_INTERFACE_MODE_RGMII:
+                        val &= ~(GMAC0_USE_TXCLK | GMAC0_USE_PWM01);
+                        break;
+                case PHY_INTERFACE_MODE_MII:
+                        val |= (GMAC0_USE_TXCLK | GMAC0_USE_PWM01);
+                        break;
+                default:
+                        pr_err("unsupported mii mode %d\n",
+                               plat_dat->interface);
+                        return -ENOTSUPP;
+                }
+                val &= ~GMAC0_SHUT;
+        }
+        __raw_writel(val, LS1X_MUX_CTRL1);
+
+        return 0;
+}
+
+static struct plat_stmmacenet_data ls1x_eth0_pdata = {
+        .bus_id         = 0,
+        .phy_addr       = -1,
+        .interface      = PHY_INTERFACE_MODE_MII,
+        .mdio_bus_data  = &ls1x_mdio_bus_data,
+        .dma_cfg        = &ls1x_eth_dma_cfg,
+        .has_gmac       = 1,
+        .tx_coe         = 1,
+        .init           = ls1x_eth_mux_init,
+};
+
 static struct resource ls1x_eth0_resources[] = {
         [0] = {
                 .start  = LS1X_GMAC0_BASE,
@@ -71,25 +154,47 @@ static struct resource ls1x_eth0_resources[] = {
         },
 };
 
-static struct stmmac_mdio_bus_data ls1x_mdio_bus_data = {
-        .phy_mask       = 0,
+struct platform_device ls1x_eth0_pdev = {
+        .name           = "stmmaceth",
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(ls1x_eth0_resources),
+        .resource       = ls1x_eth0_resources,
+        .dev            = {
+                .platform_data = &ls1x_eth0_pdata,
+        },
 };
 
-static struct plat_stmmacenet_data ls1x_eth_data = {
-        .bus_id         = 0,
+static struct plat_stmmacenet_data ls1x_eth1_pdata = {
+        .bus_id         = 1,
         .phy_addr       = -1,
+        .interface      = PHY_INTERFACE_MODE_MII,
         .mdio_bus_data  = &ls1x_mdio_bus_data,
+        .dma_cfg        = &ls1x_eth_dma_cfg,
         .has_gmac       = 1,
         .tx_coe         = 1,
+        .init           = ls1x_eth_mux_init,
 };
 
-struct platform_device ls1x_eth0_device = {
+static struct resource ls1x_eth1_resources[] = {
+        [0] = {
+                .start  = LS1X_GMAC1_BASE,
+                .end    = LS1X_GMAC1_BASE + SZ_64K - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .name   = "macirq",
+                .start  = LS1X_GMAC1_IRQ,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+struct platform_device ls1x_eth1_pdev = {
         .name           = "stmmaceth",
-        .id             = 0,
-        .num_resources  = ARRAY_SIZE(ls1x_eth0_resources),
-        .resource       = ls1x_eth0_resources,
+        .id             = 1,
+        .num_resources  = ARRAY_SIZE(ls1x_eth1_resources),
+        .resource       = ls1x_eth1_resources,
         .dev            = {
-                .platform_data = &ls1x_eth_data,
+                .platform_data = &ls1x_eth1_pdata,
         },
 };
 
@@ -111,7 +216,7 @@ static struct resource ls1x_ehci_resources[] = {
 static struct usb_ehci_pdata ls1x_ehci_pdata = {
 };
 
-struct platform_device ls1x_ehci_device = {
+struct platform_device ls1x_ehci_pdev = {
         .name           = "ehci-platform",
         .id             = -1,
         .num_resources  = ARRAY_SIZE(ls1x_ehci_resources),
@@ -123,7 +228,7 @@ struct platform_device ls1x_ehci_device = {
 };
 
 /* Real Time Clock */
-struct platform_device ls1x_rtc_device = {
+struct platform_device ls1x_rtc_pdev = {
         .name           = "ls1x-rtc",
         .id             = -1,
 };
diff --git a/arch/mips/loongson1/common/prom.c b/arch/mips/loongson1/common/prom.c
index 2a47af5a55c3..68600980ea49 100644
--- a/arch/mips/loongson1/common/prom.c
+++ b/arch/mips/loongson1/common/prom.c
@@ -27,7 +27,7 @@ char *prom_getenv(char *envname)
         i = strlen(envname);
 
         while (*env) {
-                if (strncmp(envname, *env, i) == 0 && *(*env+i) == '=')
+                if (strncmp(envname, *env, i) == 0 && *(*env + i) == '=')
                         return *env + i + 1;
                 env++;
         }
@@ -49,7 +49,7 @@ void __init prom_init_cmdline(void)
         for (i = 1; i < prom_argc; i++) {
                 strcpy(c, prom_argv[i]);
                 c += strlen(prom_argv[i]);
-                if (i < prom_argc-1)
+                if (i < prom_argc - 1)
                         *c++ = ' ';
         }
         *c = 0;
@@ -57,6 +57,7 @@ void __init prom_init_cmdline(void)
 
 void __init prom_init(void)
 {
+        void __iomem *uart_base;
         prom_argc = fw_arg0;
         prom_argv = (char **)fw_arg1;
         prom_envp = (char **)fw_arg2;
@@ -65,23 +66,18 @@ void __init prom_init(void)
 
         memsize = env_or_default("memsize", DEFAULT_MEMSIZE);
         highmemsize = env_or_default("highmemsize", 0x0);
-}
 
-void __init prom_free_prom_memory(void)
-{
+        if (strstr(arcs_cmdline, "console=ttyS3"))
+                uart_base = ioremap_nocache(LS1X_UART3_BASE, 0x0f);
+        else if (strstr(arcs_cmdline, "console=ttyS2"))
+                uart_base = ioremap_nocache(LS1X_UART2_BASE, 0x0f);
+        else if (strstr(arcs_cmdline, "console=ttyS1"))
+                uart_base = ioremap_nocache(LS1X_UART1_BASE, 0x0f);
+        else
+                uart_base = ioremap_nocache(LS1X_UART0_BASE, 0x0f);
+        setup_8250_early_printk_port((unsigned long)uart_base, 0, 0);
 }
 
-#define PORT(offset)    (u8 *)(KSEG1ADDR(LS1X_UART0_BASE + offset))
-
-void prom_putchar(char c)
+void __init prom_free_prom_memory(void)
 {
-        int timeout;
-
-        timeout = 1024;
-
-        while (((readb(PORT(UART_LSR)) & UART_LSR_THRE) == 0)
-                        && (timeout-- > 0))
-                ;
-
-        writeb(c, PORT(UART_TX));
 }
diff --git a/arch/mips/loongson1/common/reset.c b/arch/mips/loongson1/common/reset.c
index 547f34b69e4c..c41e4ca56ab4 100644
--- a/arch/mips/loongson1/common/reset.c
+++ b/arch/mips/loongson1/common/reset.c
@@ -14,12 +14,7 @@
 
 #include <loongson1.h>
 
-static void ls1x_restart(char *command)
-{
-        __raw_writel(0x1, LS1X_WDT_EN);
-        __raw_writel(0x5000000, LS1X_WDT_TIMER);
-        __raw_writel(0x1, LS1X_WDT_SET);
-}
+static void __iomem *wdt_base;
 
 static void ls1x_halt(void)
 {
@@ -29,6 +24,15 @@ static void ls1x_halt(void)
         }
 }
 
+static void ls1x_restart(char *command)
+{
+        __raw_writel(0x1, wdt_base + WDT_EN);
+        __raw_writel(0x1, wdt_base + WDT_TIMER);
+        __raw_writel(0x1, wdt_base + WDT_SET);
+
+        ls1x_halt();
+}
+
 static void ls1x_power_off(void)
 {
         ls1x_halt();
@@ -36,6 +40,10 @@ static void ls1x_power_off(void)
 
 static int __init ls1x_reboot_setup(void)
 {
+        wdt_base = ioremap_nocache(LS1X_WDT_BASE, 0x0f);
+        if (!wdt_base)
+                panic("Failed to remap watchdog registers");
+
         _machine_restart = ls1x_restart;
         _machine_halt = ls1x_halt;
         pm_power_off = ls1x_power_off;
diff --git a/arch/mips/loongson1/common/time.c b/arch/mips/loongson1/common/time.c
new file mode 100644
index 000000000000..df0f850d6a5f
--- /dev/null
+++ b/arch/mips/loongson1/common/time.c
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2014 Zhang, Keguang <keguang.zhang@gmail.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/clk.h>
+#include <linux/interrupt.h>
+#include <asm/time.h>
+
+#include <loongson1.h>
+#include <platform.h>
+
+#ifdef CONFIG_CEVT_CSRC_LS1X
+
+#if defined(CONFIG_TIMER_USE_PWM1)
+#define LS1X_TIMER_BASE LS1X_PWM1_BASE
+#define LS1X_TIMER_IRQ  LS1X_PWM1_IRQ
+
+#elif defined(CONFIG_TIMER_USE_PWM2)
+#define LS1X_TIMER_BASE LS1X_PWM2_BASE
+#define LS1X_TIMER_IRQ  LS1X_PWM2_IRQ
+
+#elif defined(CONFIG_TIMER_USE_PWM3)
+#define LS1X_TIMER_BASE LS1X_PWM3_BASE
+#define LS1X_TIMER_IRQ  LS1X_PWM3_IRQ
+
+#else
+#define LS1X_TIMER_BASE LS1X_PWM0_BASE
+#define LS1X_TIMER_IRQ  LS1X_PWM0_IRQ
+#endif
+
+DEFINE_RAW_SPINLOCK(ls1x_timer_lock);
+
+static void __iomem *timer_base;
+static uint32_t ls1x_jiffies_per_tick;
+
+static inline void ls1x_pwmtimer_set_period(uint32_t period)
+{
+        __raw_writel(period, timer_base + PWM_HRC);
+        __raw_writel(period, timer_base + PWM_LRC);
+}
+
+static inline void ls1x_pwmtimer_restart(void)
+{
+        __raw_writel(0x0, timer_base + PWM_CNT);
+        __raw_writel(INT_EN | CNT_EN, timer_base + PWM_CTRL);
+}
+
+void __init ls1x_pwmtimer_init(void)
+{
+        timer_base = ioremap(LS1X_TIMER_BASE, 0xf);
+        if (!timer_base)
+                panic("Failed to remap timer registers");
+
+        ls1x_jiffies_per_tick = DIV_ROUND_CLOSEST(mips_hpt_frequency, HZ);
+
+        ls1x_pwmtimer_set_period(ls1x_jiffies_per_tick);
+        ls1x_pwmtimer_restart();
+}
+
+static cycle_t ls1x_clocksource_read(struct clocksource *cs)
+{
+        unsigned long flags;
+        int count;
+        u32 jifs;
+        static int old_count;
+        static u32 old_jifs;
+
+        raw_spin_lock_irqsave(&ls1x_timer_lock, flags);
+        /*
+         * Although our caller may have the read side of xtime_lock,
+         * this is now a seqlock, and we are cheating in this routine
+         * by having side effects on state that we cannot undo if
+         * there is a collision on the seqlock and our caller has to
+         * retry.  (Namely, old_jifs and old_count.)  So we must treat
+         * jiffies as volatile despite the lock.  We read jiffies
+         * before latching the timer count to guarantee that although
+         * the jiffies value might be older than the count (that is,
+         * the counter may underflow between the last point where
+         * jiffies was incremented and the point where we latch the
+         * count), it cannot be newer.
+         */
+        jifs = jiffies;
+        /* read the count */
+        count = __raw_readl(timer_base + PWM_CNT);
+
+        /*
+         * It's possible for count to appear to go the wrong way for this
+         * reason:
+         *
+         *  The timer counter underflows, but we haven't handled the resulting
+         *  interrupt and incremented jiffies yet.
+         *
+         * Previous attempts to handle these cases intelligently were buggy, so
+         * we just do the simple thing now.
+         */
+        if (count < old_count && jifs == old_jifs)
+                count = old_count;
+
+        old_count = count;
+        old_jifs = jifs;
+
+        raw_spin_unlock_irqrestore(&ls1x_timer_lock, flags);
+
+        return (cycle_t) (jifs * ls1x_jiffies_per_tick) + count;
+}
+
+static struct clocksource ls1x_clocksource = {
+        .name           = "ls1x-pwmtimer",
+        .read           = ls1x_clocksource_read,
+        .mask           = CLOCKSOURCE_MASK(24),
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+};
+
+static irqreturn_t ls1x_clockevent_isr(int irq, void *devid)
+{
+        struct clock_event_device *cd = devid;
+
+        ls1x_pwmtimer_restart();
+        cd->event_handler(cd);
+
+        return IRQ_HANDLED;
+}
+
+static void ls1x_clockevent_set_mode(enum clock_event_mode mode,
+                                     struct clock_event_device *cd)
+{
+        raw_spin_lock(&ls1x_timer_lock);
+        switch (mode) {
+        case CLOCK_EVT_MODE_PERIODIC:
+                ls1x_pwmtimer_set_period(ls1x_jiffies_per_tick);
+                ls1x_pwmtimer_restart();
+        case CLOCK_EVT_MODE_RESUME:
+                __raw_writel(INT_EN | CNT_EN, timer_base + PWM_CTRL);
+                break;
+        case CLOCK_EVT_MODE_ONESHOT:
+        case CLOCK_EVT_MODE_SHUTDOWN:
+                __raw_writel(__raw_readl(timer_base + PWM_CTRL) & ~CNT_EN,
+                             timer_base + PWM_CTRL);
+                break;
+        default:
+                break;
+        }
+        raw_spin_unlock(&ls1x_timer_lock);
+}
+
+static int ls1x_clockevent_set_next(unsigned long evt,
+                                    struct clock_event_device *cd)
+{
+        raw_spin_lock(&ls1x_timer_lock);
+        ls1x_pwmtimer_set_period(evt);
+        ls1x_pwmtimer_restart();
+        raw_spin_unlock(&ls1x_timer_lock);
+
+        return 0;
+}
+
+static struct clock_event_device ls1x_clockevent = {
+        .name           = "ls1x-pwmtimer",
+        .features       = CLOCK_EVT_FEAT_PERIODIC,
+        .rating         = 300,
+        .irq            = LS1X_TIMER_IRQ,
+        .set_next_event = ls1x_clockevent_set_next,
+        .set_mode       = ls1x_clockevent_set_mode,
+};
+
+static struct irqaction ls1x_pwmtimer_irqaction = {
+        .name           = "ls1x-pwmtimer",
+        .handler        = ls1x_clockevent_isr,
+        .dev_id         = &ls1x_clockevent,
+        .flags          = IRQF_PERCPU | IRQF_TIMER,
+};
+
+static void __init ls1x_time_init(void)
+{
+        struct clock_event_device *cd = &ls1x_clockevent;
+        int ret;
+
+        if (!mips_hpt_frequency)
+                panic("Invalid timer clock rate");
+
+        ls1x_pwmtimer_init();
+
+        clockevent_set_clock(cd, mips_hpt_frequency);
+        cd->max_delta_ns = clockevent_delta2ns(0xffffff, cd);
+        cd->min_delta_ns = clockevent_delta2ns(0x000300, cd);
+        cd->cpumask = cpumask_of(smp_processor_id());
+        clockevents_register_device(cd);
+
+        ls1x_clocksource.rating = 200 + mips_hpt_frequency / 10000000;
+        ret = clocksource_register_hz(&ls1x_clocksource, mips_hpt_frequency);
+        if (ret)
+                panic(KERN_ERR "Failed to register clocksource: %d\n", ret);
+
+        setup_irq(LS1X_TIMER_IRQ, &ls1x_pwmtimer_irqaction);
+}
+#endif /* CONFIG_CEVT_CSRC_LS1X */
+
+void __init plat_time_init(void)
+{
+        struct clk *clk = NULL;
+
+        /* initialize LS1X clocks */
+        ls1x_clk_init();
+
+#ifdef CONFIG_CEVT_CSRC_LS1X
+        /* setup LS1X PWM timer */
+        clk = clk_get(NULL, "ls1x_pwmtimer");
+        if (IS_ERR(clk))
+                panic("unable to get timer clock, err=%ld", PTR_ERR(clk));
+
+        mips_hpt_frequency = clk_get_rate(clk);
+        ls1x_time_init();
+#else
+        /* setup mips r4k timer */
+        clk = clk_get(NULL, "cpu_clk");
+        if (IS_ERR(clk))
+                panic("unable to get cpu clock, err=%ld", PTR_ERR(clk));
+
+        mips_hpt_frequency = clk_get_rate(clk) / 2;
+#endif /* CONFIG_CEVT_CSRC_LS1X */
+}
diff --git a/arch/mips/loongson1/ls1b/board.c b/arch/mips/loongson1/ls1b/board.c
index b26b10dac70a..58daeea25739 100644
--- a/arch/mips/loongson1/ls1b/board.c
+++ b/arch/mips/loongson1/ls1b/board.c
@@ -10,17 +10,19 @@
 #include <platform.h>
 
 static struct platform_device *ls1b_platform_devices[] __initdata = {
-        &ls1x_uart_device,
-        &ls1x_eth0_device,
-        &ls1x_ehci_device,
-        &ls1x_rtc_device,
+        &ls1x_uart_pdev,
+        &ls1x_cpufreq_pdev,
+        &ls1x_eth0_pdev,
+        &ls1x_eth1_pdev,
+        &ls1x_ehci_pdev,
+        &ls1x_rtc_pdev,
 };
 
 static int __init ls1b_platform_init(void)
 {
         int err;
 
-        ls1x_serial_setup(&ls1x_uart_device);
+        ls1x_serial_setup(&ls1x_uart_pdev);
 
         err = platform_add_devices(ls1b_platform_devices,
                                    ARRAY_SIZE(ls1b_platform_devices));
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index cac529a405b8..9dfcd7fc1bc3 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -643,9 +643,14 @@ static inline int cop1_64bit(struct pt_regs *xcp)
         return !test_thread_flag(TIF_32BIT_FPREGS);
 }
 
+static inline bool hybrid_fprs(void)
+{
+        return test_thread_flag(TIF_HYBRID_FPREGS);
+}
+
 #define SIFROMREG(si, x)                                                \
 do {                                                                    \
-        if (cop1_64bit(xcp))                                            \
+        if (cop1_64bit(xcp) && !hybrid_fprs())                          \
                 (si) = (int)get_fpr32(&ctx->fpr[x], 0);                 \
         else                                                            \
                 (si) = (int)get_fpr32(&ctx->fpr[(x) & ~1], (x) & 1);    \
@@ -653,7 +658,7 @@ do {									\
 
 #define SITOREG(si, x)                                                  \
 do {                                                                    \
-        if (cop1_64bit(xcp)) {                                          \
+        if (cop1_64bit(xcp) && !hybrid_fprs()) {                        \
                 unsigned i;                                             \
                 set_fpr32(&ctx->fpr[x], 0, si);                         \
                 for (i = 1; i < ARRAY_SIZE(ctx->fpr[x].val32); i++)     \
diff --git a/arch/mips/math-emu/ieee754dp.c b/arch/mips/math-emu/ieee754dp.c
index fd134675fc2e..068f45a415fc 100644
--- a/arch/mips/math-emu/ieee754dp.c
+++ b/arch/mips/math-emu/ieee754dp.c
@@ -38,7 +38,7 @@ int ieee754dp_isnan(union ieee754dp x)
 static inline int ieee754dp_issnan(union ieee754dp x)
 {
         assert(ieee754dp_isnan(x));
-        return ((DPMANT(x) & DP_MBIT(DP_FBITS-1)) == DP_MBIT(DP_FBITS-1));
+        return (DPMANT(x) & DP_MBIT(DP_FBITS - 1)) == DP_MBIT(DP_FBITS - 1);
 }
 
 
diff --git a/arch/mips/math-emu/ieee754sp.c b/arch/mips/math-emu/ieee754sp.c
index d348efe91445..ba88301579c2 100644
--- a/arch/mips/math-emu/ieee754sp.c
+++ b/arch/mips/math-emu/ieee754sp.c
@@ -38,7 +38,7 @@ int ieee754sp_isnan(union ieee754sp x)
 static inline int ieee754sp_issnan(union ieee754sp x)
 {
         assert(ieee754sp_isnan(x));
-        return (SPMANT(x) & SP_MBIT(SP_FBITS-1));
+        return SPMANT(x) & SP_MBIT(SP_FBITS - 1);
 }
 
 
diff --git a/arch/mips/mm/Makefile b/arch/mips/mm/Makefile
index 7f4f93ab22b7..67ede4ef9b8d 100644
--- a/arch/mips/mm/Makefile
+++ b/arch/mips/mm/Makefile
@@ -4,7 +4,13 @@
 
 obj-y                           += cache.o dma-default.o extable.o fault.o \
                                    gup.o init.o mmap.o page.o page-funcs.o \
-                                   tlbex.o tlbex-fault.o tlb-funcs.o uasm-mips.o
+                                   tlbex.o tlbex-fault.o tlb-funcs.o
+
+ifdef CONFIG_CPU_MICROMIPS
+obj-y                           += uasm-micromips.o
+else
+obj-y                           += uasm-mips.o
+endif
 
 obj-$(CONFIG_32BIT)             += ioremap.o pgtable-32.o
 obj-$(CONFIG_64BIT)             += pgtable-64.o
@@ -22,5 +28,3 @@ obj-$(CONFIG_IP22_CPU_SCACHE)	+= sc-ip22.o
 obj-$(CONFIG_R5000_CPU_SCACHE)  += sc-r5k.o
 obj-$(CONFIG_RM7000_CPU_SCACHE) += sc-rm7k.o
 obj-$(CONFIG_MIPS_CPU_SCACHE)   += sc-mips.o
-
-obj-$(CONFIG_SYS_SUPPORTS_MICROMIPS) += uasm-micromips.o
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index fbcd8674ff1d..dd261df005c2 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -917,6 +917,18 @@ static inline void alias_74k_erratum(struct cpuinfo_mips *c)
         }
 }
 
+static void b5k_instruction_hazard(void)
+{
+        __sync();
+        __sync();
+        __asm__ __volatile__(
+        "       nop; nop; nop; nop; nop; nop; nop; nop\n"
+        "       nop; nop; nop; nop; nop; nop; nop; nop\n"
+        "       nop; nop; nop; nop; nop; nop; nop; nop\n"
+        "       nop; nop; nop; nop; nop; nop; nop; nop\n"
+        : : : "memory");
+}
+
 static char *way_string[] = { NULL, "direct mapped", "2-way",
         "3-way", "4-way", "5-way", "6-way", "7-way", "8-way"
 };
@@ -1683,6 +1695,37 @@ void r4k_cache_init(void)
 
         coherency_setup();
         board_cache_error_setup = r4k_cache_error_setup;
+
+        /*
+         * Per-CPU overrides
+         */
+        switch (current_cpu_type()) {
+        case CPU_BMIPS4350:
+        case CPU_BMIPS4380:
+                /* No IPI is needed because all CPUs share the same D$ */
+                flush_data_cache_page = r4k_blast_dcache_page;
+                break;
+        case CPU_BMIPS5000:
+                /* We lose our superpowers if L2 is disabled */
+                if (c->scache.flags & MIPS_CACHE_NOT_PRESENT)
+                        break;
+
+                /* I$ fills from D$ just by emptying the write buffers */
+                flush_cache_page = (void *)b5k_instruction_hazard;
+                flush_cache_range = (void *)b5k_instruction_hazard;
+                flush_cache_sigtramp = (void *)b5k_instruction_hazard;
+                local_flush_data_cache_page = (void *)b5k_instruction_hazard;
+                flush_data_cache_page = (void *)b5k_instruction_hazard;
+                flush_icache_range = (void *)b5k_instruction_hazard;
+                local_flush_icache_range = (void *)b5k_instruction_hazard;
+
+                /* Cache aliases are handled in hardware; allow HIGHMEM */
+                current_cpu_data.dcache.flags &= ~MIPS_CACHE_ALIASES;
+
+                /* Optimization: an L2 flush implicitly flushes the L1 */
+                current_cpu_data.options |= MIPS_CPU_INCLUSIVE_CACHES;
+                break;
+        }
 }
 
 static int r4k_cache_pm_notifier(struct notifier_block *self, unsigned long cmd,
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index 33ba3c558fe4..af5f046e627e 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -61,6 +61,11 @@ static inline struct page *dma_addr_to_page(struct device *dev,
  * Warning on the terminology - Linux calls an uncached area coherent;
  * MIPS terminology calls memory areas with hardware maintained coherency
  * coherent.
+ *
+ * Note that the R14000 and R16000 should also be checked for in this
+ * condition.  However this function is only called on non-I/O-coherent
+ * systems and only the R10000 and R12000 are used in such systems, the
+ * SGI IP28 Indigo² rsp. SGI IP32 aka O2.
  */
 static inline int cpu_needs_post_dma_flush(struct device *dev)
 {
diff --git a/arch/mips/mm/gup.c b/arch/mips/mm/gup.c
index 06ce17c2a905..7cba480568c8 100644
--- a/arch/mips/mm/gup.c
+++ b/arch/mips/mm/gup.c
@@ -17,7 +17,7 @@
 
 static inline pte_t gup_get_pte(pte_t *ptep)
 {
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
         pte_t pte;
 
 retry:
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index f42e35e42790..448cde372af0 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -95,7 +95,7 @@ static void *__kmap_pgprot(struct page *page, unsigned long addr, pgprot_t prot)
         idx += in_interrupt() ? FIX_N_COLOURS : 0;
         vaddr = __fix_to_virt(FIX_CMAP_END - idx);
         pte = mk_pte(page, prot);
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
         entrylo = pte.pte_high;
 #else
         entrylo = pte_to_entrylo(pte_val(pte));
diff --git a/arch/mips/mm/ioremap.c b/arch/mips/mm/ioremap.c
index 7f840bc08abf..8d5008cbdc0f 100644
--- a/arch/mips/mm/ioremap.c
+++ b/arch/mips/mm/ioremap.c
@@ -17,9 +17,9 @@
 #include <asm/tlbflush.h>
 
 static inline void remap_area_pte(pte_t * pte, unsigned long address,
-        phys_t size, phys_t phys_addr, unsigned long flags)
+        phys_addr_t size, phys_addr_t phys_addr, unsigned long flags)
 {
-        phys_t end;
+        phys_addr_t end;
         unsigned long pfn;
         pgprot_t pgprot = __pgprot(_PAGE_GLOBAL | _PAGE_PRESENT | __READABLE
                                    | __WRITEABLE | flags);
@@ -43,9 +43,9 @@ static inline void remap_area_pte(pte_t * pte, unsigned long address,
 }
 
 static inline int remap_area_pmd(pmd_t * pmd, unsigned long address,
-        phys_t size, phys_t phys_addr, unsigned long flags)
+        phys_addr_t size, phys_addr_t phys_addr, unsigned long flags)
 {
-        phys_t end;
+        phys_addr_t end;
 
         address &= ~PGDIR_MASK;
         end = address + size;
@@ -64,8 +64,8 @@ static inline int remap_area_pmd(pmd_t * pmd, unsigned long address,
         return 0;
 }
 
-static int remap_area_pages(unsigned long address, phys_t phys_addr,
-        phys_t size, unsigned long flags)
+static int remap_area_pages(unsigned long address, phys_addr_t phys_addr,
+        phys_addr_t size, unsigned long flags)
 {
         int error;
         pgd_t * dir;
@@ -111,13 +111,13 @@ static int remap_area_pages(unsigned long address, phys_t phys_addr,
  * caller shouldn't need to know that small detail.
  */
 
-#define IS_LOW512(addr) (!((phys_t)(addr) & (phys_t) ~0x1fffffffULL))
+#define IS_LOW512(addr) (!((phys_addr_t)(addr) & (phys_addr_t) ~0x1fffffffULL))
 
-void __iomem * __ioremap(phys_t phys_addr, phys_t size, unsigned long flags)
+void __iomem * __ioremap(phys_addr_t phys_addr, phys_addr_t size, unsigned long flags)
 {
         struct vm_struct * area;
         unsigned long offset;
-        phys_t last_addr;
+        phys_addr_t last_addr;
         void * addr;
 
         phys_addr = fixup_bigphys_addr(phys_addr, size);
diff --git a/arch/mips/mm/sc-r5k.c b/arch/mips/mm/sc-r5k.c
index 0216ed6eaa2a..751b5cd18bf2 100644
--- a/arch/mips/mm/sc-r5k.c
+++ b/arch/mips/mm/sc-r5k.c
@@ -81,7 +81,7 @@ static inline int __init r5k_sc_probe(void)
         unsigned long config = read_c0_config();
 
         if (config & CONF_SC)
-                return(0);
+                return 0;
 
         scache_size = (512 * 1024) << ((config & R5K_CONF_SS) >> 20);
 
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index c3917e251f59..e90b2e899291 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -332,7 +332,7 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
         {
                 ptep = pte_offset_map(pmdp, address);
 
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#if defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
                 write_c0_entrylo0(ptep->pte_high);
                 ptep++;
                 write_c0_entrylo1(ptep->pte_high);
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index e3328a96e809..3978a3d81366 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -637,7 +637,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
         if (cpu_has_rixi) {
                 UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
         } else {
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
                 uasm_i_dsrl_safe(p, reg, reg, ilog2(_PAGE_GLOBAL));
 #else
                 UASM_i_SRL(p, reg, reg, ilog2(_PAGE_GLOBAL));
@@ -1009,7 +1009,7 @@ static void build_update_entries(u32 **p, unsigned int tmp, unsigned int ptep)
          * 64bit address support (36bit on a 32bit CPU) in a 32bit
          * Kernel is a special case. Only a few CPUs use it.
          */
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits) {
                 uasm_i_ld(p, tmp, 0, ptep); /* get even pte */
                 uasm_i_ld(p, ptep, sizeof(pte_t), ptep); /* get odd pte */
@@ -1510,14 +1510,14 @@ static void
 iPTE_LW(u32 **p, unsigned int pte, unsigned int ptr)
 {
 #ifdef CONFIG_SMP
-# ifdef CONFIG_64BIT_PHYS_ADDR
+# ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits)
                 uasm_i_lld(p, pte, 0, ptr);
         else
 # endif
                 UASM_i_LL(p, pte, 0, ptr);
 #else
-# ifdef CONFIG_64BIT_PHYS_ADDR
+# ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits)
                 uasm_i_ld(p, pte, 0, ptr);
         else
@@ -1530,13 +1530,13 @@ static void
 iPTE_SW(u32 **p, struct uasm_reloc **r, unsigned int pte, unsigned int ptr,
         unsigned int mode)
 {
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
         unsigned int hwmode = mode & (_PAGE_VALID | _PAGE_DIRTY);
 #endif
 
         uasm_i_ori(p, pte, pte, mode);
 #ifdef CONFIG_SMP
-# ifdef CONFIG_64BIT_PHYS_ADDR
+# ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits)
                 uasm_i_scd(p, pte, 0, ptr);
         else
@@ -1548,7 +1548,7 @@ iPTE_SW(u32 **p, struct uasm_reloc **r, unsigned int pte, unsigned int ptr,
         else
                 uasm_il_beqz(p, r, pte, label_smp_pgtable_change);
 
-# ifdef CONFIG_64BIT_PHYS_ADDR
+# ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (!cpu_has_64bits) {
                 /* no uasm_i_nop needed */
                 uasm_i_ll(p, pte, sizeof(pte_t) / 2, ptr);
@@ -1563,14 +1563,14 @@ iPTE_SW(u32 **p, struct uasm_reloc **r, unsigned int pte, unsigned int ptr,
         uasm_i_nop(p);
 # endif
 #else
-# ifdef CONFIG_64BIT_PHYS_ADDR
+# ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits)
                 uasm_i_sd(p, pte, 0, ptr);
         else
 # endif
                 UASM_i_SW(p, pte, 0, ptr);
 
-# ifdef CONFIG_64BIT_PHYS_ADDR
+# ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (!cpu_has_64bits) {
                 uasm_i_lw(p, pte, sizeof(pte_t) / 2, ptr);
                 uasm_i_ori(p, pte, pte, hwmode);
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index 6708a2dbf934..8e02291cfc0c 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -96,9 +96,11 @@ static struct insn insn_table[] = {
         { insn_lw,  M(lw_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_lwx, M(spec3_op, 0, 0, 0, lwx_op, lx_op), RS | RT | RD },
         { insn_mfc0,  M(cop0_op, mfc_op, 0, 0, 0, 0),  RT | RD | SET},
+        { insn_mfhc0,  M(cop0_op, mfhc0_op, 0, 0, 0, 0),  RT | RD | SET},
         { insn_mfhi,  M(spec_op, 0, 0, 0, 0, mfhi_op), RD },
         { insn_mflo,  M(spec_op, 0, 0, 0, 0, mflo_op), RD },
         { insn_mtc0,  M(cop0_op, mtc_op, 0, 0, 0, 0),  RT | RD | SET},
+        { insn_mthc0,  M(cop0_op, mthc0_op, 0, 0, 0, 0),  RT | RD | SET},
         { insn_mul, M(spec2_op, 0, 0, 0, 0, mul_op), RS | RT | RD},
         { insn_ori,  M(ori_op, 0, 0, 0, 0, 0),  RS | RT | UIMM },
         { insn_or,  M(spec_op, 0, 0, 0, 0, or_op),  RS | RT | RD },
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index a01b0d6cedd2..4adf30284813 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -51,12 +51,12 @@ enum opcode {
         insn_dsll32, insn_dsra, insn_dsrl, insn_dsrl32, insn_dsubu, insn_eret,
         insn_ext, insn_ins, insn_j, insn_jal, insn_jalr, insn_jr, insn_lb,
         insn_ld, insn_ldx, insn_lh, insn_ll, insn_lld, insn_lui, insn_lw,
-        insn_lwx, insn_mfc0, insn_mfhi, insn_mflo, insn_mtc0, insn_mul,
-        insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sc, insn_scd,
-        insn_sd, insn_sll, insn_sllv, insn_slt, insn_sltiu, insn_sltu, insn_sra,
-        insn_srl, insn_srlv, insn_subu, insn_sw, insn_sync, insn_syscall,
-        insn_tlbp, insn_tlbr, insn_tlbwi, insn_tlbwr, insn_wait, insn_wsbh,
-        insn_xor, insn_xori, insn_yield,
+        insn_lwx, insn_mfc0, insn_mfhc0, insn_mfhi, insn_mflo, insn_mtc0,
+        insn_mthc0, insn_mul, insn_or, insn_ori, insn_pref, insn_rfe,
+        insn_rotr, insn_sc, insn_scd, insn_sd, insn_sll, insn_sllv, insn_slt,
+        insn_sltiu, insn_sltu, insn_sra, insn_srl, insn_srlv, insn_subu,
+        insn_sw, insn_sync, insn_syscall, insn_tlbp, insn_tlbr, insn_tlbwi,
+        insn_tlbwr, insn_wait, insn_wsbh, insn_xor, insn_xori, insn_yield,
 };
 
 struct insn {
@@ -284,9 +284,11 @@ I_u2s3u1(_lld)
 I_u1s2(_lui)
 I_u2s3u1(_lw)
 I_u1u2u3(_mfc0)
+I_u1u2u3(_mfhc0)
 I_u1(_mfhi)
 I_u1(_mflo)
 I_u1u2u3(_mtc0)
+I_u1u2u3(_mthc0)
 I_u3u1u2(_mul)
 I_u2u1u3(_ori)
 I_u3u1u2(_or)
diff --git a/arch/mips/mti-malta/malta-init.c b/arch/mips/mti-malta/malta-init.c
index 0f60256d3784..6849f533154f 100644
--- a/arch/mips/mti-malta/malta-init.c
+++ b/arch/mips/mti-malta/malta-init.c
@@ -111,7 +111,7 @@ static void __init mips_ejtag_setup(void)
         flush_icache_range((unsigned long)base, (unsigned long)base + 0x80);
 }
 
-phys_t mips_cpc_default_phys_base(void)
+phys_addr_t mips_cpc_default_phys_base(void)
 {
         return CPC_BASE_ADDR;
 }
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index e4f43baa8f67..d1392f8f5811 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -18,6 +18,7 @@
 #include <linux/smp.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/kernel_stat.h>
 #include <linux/kernel.h>
 #include <linux/random.h>
@@ -33,19 +34,13 @@
 #include <asm/mips-boards/generic.h>
 #include <asm/mips-boards/msc01_pci.h>
 #include <asm/msc01_ic.h>
-#include <asm/gic.h>
 #include <asm/setup.h>
 #include <asm/rtlx.h>
 
-static unsigned long _msc01_biu_base;
-static unsigned int ipi_map[NR_CPUS];
+static void __iomem *_msc01_biu_base;
 
 static DEFINE_RAW_SPINLOCK(mips_irq_lock);
 
-#ifdef CONFIG_MIPS_GIC_IPI
-DECLARE_BITMAP(ipi_ints, GIC_NUM_INTRS);
-#endif
-
 static inline int mips_pcibios_iack(void)
 {
         int irq;
@@ -127,24 +122,10 @@ static void malta_hw0_irqdispatch(void)
 #endif
 }
 
-static void malta_ipi_irqdispatch(void)
+static irqreturn_t i8259_handler(int irq, void *dev_id)
 {
-#ifdef CONFIG_MIPS_GIC_IPI
-        unsigned long irq;
-        DECLARE_BITMAP(pending, GIC_NUM_INTRS);
-
-        gic_get_int_mask(pending, ipi_ints);
-
-        irq = find_first_bit(pending, GIC_NUM_INTRS);
-
-        while (irq < GIC_NUM_INTRS) {
-                do_IRQ(MIPS_GIC_IRQ_BASE + irq);
-
-                irq = find_next_bit(pending, GIC_NUM_INTRS, irq + 1);
-        }
-#endif
-        if (gic_compare_int())
-                do_IRQ(MIPS_GIC_IRQ_BASE);
+        malta_hw0_irqdispatch();
+        return IRQ_HANDLED;
 }
 
 static void corehi_irqdispatch(void)
@@ -203,95 +184,10 @@ static void corehi_irqdispatch(void)
         die("CoreHi interrupt", regs);
 }
 
-static inline int clz(unsigned long x)
-{
-        __asm__(
-        "       .set    push                                    \n"
-        "       .set    mips32                                  \n"
-        "       clz     %0, %1                                  \n"
-        "       .set    pop                                     \n"
-        : "=r" (x)
-        : "r" (x));
-
-        return x;
-}
-
-/*
- * Version of ffs that only looks at bits 12..15.
- */
-static inline unsigned int irq_ffs(unsigned int pending)
-{
-#if defined(CONFIG_CPU_MIPS32) || defined(CONFIG_CPU_MIPS64)
-        return -clz(pending) + 31 - CAUSEB_IP;
-#else
-        unsigned int a0 = 7;
-        unsigned int t0;
-
-        t0 = pending & 0xf000;
-        t0 = t0 < 1;
-        t0 = t0 << 2;
-        a0 = a0 - t0;
-        pending = pending << t0;
-
-        t0 = pending & 0xc000;
-        t0 = t0 < 1;
-        t0 = t0 << 1;
-        a0 = a0 - t0;
-        pending = pending << t0;
-
-        t0 = pending & 0x8000;
-        t0 = t0 < 1;
-        /* t0 = t0 << 2; */
-        a0 = a0 - t0;
-        /* pending = pending << t0; */
-
-        return a0;
-#endif
-}
-
-/*
- * IRQs on the Malta board look basically (barring software IRQs which we
- * don't use at all and all external interrupt sources are combined together
- * on hardware interrupt 0 (MIPS IRQ 2)) like:
- *
- *      MIPS IRQ        Source
- *      --------        ------
- *             0        Software (ignored)
- *             1        Software (ignored)
- *             2        Combined hardware interrupt (hw0)
- *             3        Hardware (ignored)
- *             4        Hardware (ignored)
- *             5        Hardware (ignored)
- *             6        Hardware (ignored)
- *             7        R4k timer (what we use)
- *
- * We handle the IRQ according to _our_ priority which is:
- *
- * Highest ----     R4k Timer
- * Lowest  ----     Combined hardware interrupt
- *
- * then we just return, if multiple IRQs are pending then we will just take
- * another exception, big deal.
- */
-
-asmlinkage void plat_irq_dispatch(void)
+static irqreturn_t corehi_handler(int irq, void *dev_id)
 {
-        unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
-        int irq;
-
-        if (unlikely(!pending)) {
-                spurious_interrupt();
-                return;
-        }
-
-        irq = irq_ffs(pending);
-
-        if (irq == MIPSCPU_INT_I8259A)
-                malta_hw0_irqdispatch();
-        else if (gic_present && ((1 << irq) & ipi_map[smp_processor_id()]))
-                malta_ipi_irqdispatch();
-        else
-                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
+        corehi_irqdispatch();
+        return IRQ_HANDLED;
 }
 
 #ifdef CONFIG_MIPS_MT_SMP
@@ -312,13 +208,6 @@ static void ipi_call_dispatch(void)
         do_IRQ(MIPS_CPU_IRQ_BASE + MIPS_CPU_IPI_CALL_IRQ);
 }
 
-#endif /* CONFIG_MIPS_MT_SMP */
-
-#ifdef CONFIG_MIPS_GIC_IPI
-
-#define GIC_MIPS_CPU_IPI_RESCHED_IRQ    3
-#define GIC_MIPS_CPU_IPI_CALL_IRQ       4
-
 static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 {
 #ifdef CONFIG_MIPS_VPE_APSP_API_CMP
@@ -349,31 +238,16 @@ static struct irqaction irq_call = {
         .flags          = IRQF_PERCPU,
         .name           = "IPI_call"
 };
-#endif /* CONFIG_MIPS_GIC_IPI */
-
-static int gic_resched_int_base;
-static int gic_call_int_base;
-#define GIC_RESCHED_INT(cpu) (gic_resched_int_base+(cpu))
-#define GIC_CALL_INT(cpu) (gic_call_int_base+(cpu))
-
-unsigned int plat_ipi_call_int_xlate(unsigned int cpu)
-{
-        return GIC_CALL_INT(cpu);
-}
-
-unsigned int plat_ipi_resched_int_xlate(unsigned int cpu)
-{
-        return GIC_RESCHED_INT(cpu);
-}
+#endif /* CONFIG_MIPS_MT_SMP */
 
 static struct irqaction i8259irq = {
-        .handler = no_action,
+        .handler = i8259_handler,
         .name = "XT-PIC cascade",
         .flags = IRQF_NO_THREAD,
 };
 
 static struct irqaction corehi_irqaction = {
-        .handler = no_action,
+        .handler = corehi_handler,
         .name = "CoreHi",
         .flags = IRQF_NO_THREAD,
 };
@@ -399,60 +273,6 @@ static msc_irqmap_t msc_eicirqmap[] __initdata = {
 
 static int msc_nr_eicirqs __initdata = ARRAY_SIZE(msc_eicirqmap);
 
-/*
- * This GIC specific tabular array defines the association between External
- * Interrupts and CPUs/Core Interrupts. The nature of the External
- * Interrupts is also defined here - polarity/trigger.
- */
-
-#define GIC_CPU_NMI GIC_MAP_TO_NMI_MSK
-#define X GIC_UNUSED
-
-static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
-        { X, X,            X,           X,              0 },
-        { X, X,            X,           X,              0 },
-        { X, X,            X,           X,              0 },
-        { 0, GIC_CPU_INT0, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT1, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT2, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT3, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT4, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT3, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT3, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { X, X,            X,           X,              0 },
-        { X, X,            X,           X,              0 },
-        { 0, GIC_CPU_INT3, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_NMI,  GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_NMI,  GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { X, X,            X,           X,              0 },
-        /* The remainder of this table is initialised by fill_ipi_map */
-};
-#undef X
-
-#ifdef CONFIG_MIPS_GIC_IPI
-static void __init fill_ipi_map1(int baseintr, int cpu, int cpupin)
-{
-        int intr = baseintr + cpu;
-        gic_intr_map[intr].cpunum = cpu;
-        gic_intr_map[intr].pin = cpupin;
-        gic_intr_map[intr].polarity = GIC_POL_POS;
-        gic_intr_map[intr].trigtype = GIC_TRIG_EDGE;
-        gic_intr_map[intr].flags = 0;
-        ipi_map[cpu] |= (1 << (cpupin + 2));
-        bitmap_set(ipi_ints, intr, 1);
-}
-
-static void __init fill_ipi_map(void)
-{
-        int cpu;
-
-        for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-                fill_ipi_map1(gic_resched_int_base, cpu, GIC_CPU_INT1);
-                fill_ipi_map1(gic_call_int_base, cpu, GIC_CPU_INT2);
-        }
-}
-#endif
-
 void __init arch_init_ipiirq(int irq, struct irqaction *action)
 {
         setup_irq(irq, action);
@@ -461,6 +281,8 @@ void __init arch_init_ipiirq(int irq, struct irqaction *action)
 
 void __init arch_init_irq(void)
 {
+        int corehi_irq, i8259_irq;
+
         init_i8259_irqs();
 
         if (!cpu_has_veic)
@@ -471,12 +293,12 @@ void __init arch_init_irq(void)
                 gic_present = 1;
         } else {
                 if (mips_revision_sconid == MIPS_REVISION_SCON_ROCIT) {
-                        _msc01_biu_base = (unsigned long)
-                                        ioremap_nocache(MSC01_BIU_REG_BASE,
+                        _msc01_biu_base = ioremap_nocache(MSC01_BIU_REG_BASE,
                                                 MSC01_BIU_ADDRSPACE_SZ);
-                        gic_present = (REG(_msc01_biu_base, MSC01_SC_CFG) &
-                                        MSC01_SC_CFG_GICPRES_MSK) >>
-                                        MSC01_SC_CFG_GICPRES_SHF;
+                        gic_present =
+                          (__raw_readl(_msc01_biu_base + MSC01_SC_CFG_OFS) &
+                           MSC01_SC_CFG_GICPRES_MSK) >>
+                          MSC01_SC_CFG_GICPRES_SHF;
                 }
         }
         if (gic_present)
@@ -507,63 +329,20 @@ void __init arch_init_irq(void)
                                         msc_nr_irqs);
         }
 
-        if (cpu_has_veic) {
-                set_vi_handler(MSC01E_INT_I8259A, malta_hw0_irqdispatch);
-                set_vi_handler(MSC01E_INT_COREHI, corehi_irqdispatch);
-                setup_irq(MSC01E_INT_BASE+MSC01E_INT_I8259A, &i8259irq);
-                setup_irq(MSC01E_INT_BASE+MSC01E_INT_COREHI, &corehi_irqaction);
-        } else if (cpu_has_vint) {
-                set_vi_handler(MIPSCPU_INT_I8259A, malta_hw0_irqdispatch);
-                set_vi_handler(MIPSCPU_INT_COREHI, corehi_irqdispatch);
-                setup_irq(MIPS_CPU_IRQ_BASE+MIPSCPU_INT_I8259A, &i8259irq);
-                setup_irq(MIPS_CPU_IRQ_BASE+MIPSCPU_INT_COREHI,
-                                                &corehi_irqaction);
-        } else {
-                setup_irq(MIPS_CPU_IRQ_BASE+MIPSCPU_INT_I8259A, &i8259irq);
-                setup_irq(MIPS_CPU_IRQ_BASE+MIPSCPU_INT_COREHI,
-                                                &corehi_irqaction);
-        }
-
         if (gic_present) {
-                /* FIXME */
                 int i;
-#if defined(CONFIG_MIPS_GIC_IPI)
-                gic_call_int_base = GIC_NUM_INTRS -
-                        (NR_CPUS - nr_cpu_ids) * 2 - nr_cpu_ids;
-                gic_resched_int_base = gic_call_int_base - nr_cpu_ids;
-                fill_ipi_map();
-#endif
-                gic_init(GIC_BASE_ADDR, GIC_ADDRSPACE_SZ, gic_intr_map,
-                                ARRAY_SIZE(gic_intr_map), MIPS_GIC_IRQ_BASE);
+
+                gic_init(GIC_BASE_ADDR, GIC_ADDRSPACE_SZ, MIPSCPU_INT_GIC,
+                         MIPS_GIC_IRQ_BASE);
                 if (!mips_cm_present()) {
                         /* Enable the GIC */
-                        i = REG(_msc01_biu_base, MSC01_SC_CFG);
-                        REG(_msc01_biu_base, MSC01_SC_CFG) =
-                                (i | (0x1 << MSC01_SC_CFG_GICENA_SHF));
+                        i = __raw_readl(_msc01_biu_base + MSC01_SC_CFG_OFS);
+                        __raw_writel(i | (0x1 << MSC01_SC_CFG_GICENA_SHF),
+                                 _msc01_biu_base + MSC01_SC_CFG_OFS);
                         pr_debug("GIC Enabled\n");
                 }
-#if defined(CONFIG_MIPS_GIC_IPI)
-                /* set up ipi interrupts */
-                if (cpu_has_vint) {
-                        set_vi_handler(MIPSCPU_INT_IPI0, malta_ipi_irqdispatch);
-                        set_vi_handler(MIPSCPU_INT_IPI1, malta_ipi_irqdispatch);
-                }
-                /* Argh.. this really needs sorting out.. */
-                pr_info("CPU%d: status register was %08x\n",
-                        smp_processor_id(), read_c0_status());
-                write_c0_status(read_c0_status() | STATUSF_IP3 | STATUSF_IP4);
-                pr_info("CPU%d: status register now %08x\n",
-                        smp_processor_id(), read_c0_status());
-                write_c0_status(0x1100dc00);
-                pr_info("CPU%d: status register frc %08x\n",
-                        smp_processor_id(), read_c0_status());
-                for (i = 0; i < nr_cpu_ids; i++) {
-                        arch_init_ipiirq(MIPS_GIC_IRQ_BASE +
-                                         GIC_RESCHED_INT(i), &irq_resched);
-                        arch_init_ipiirq(MIPS_GIC_IRQ_BASE +
-                                         GIC_CALL_INT(i), &irq_call);
-                }
-#endif
+                i8259_irq = MIPS_GIC_IRQ_BASE + GIC_INT_I8259A;
+                corehi_irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_COREHI;
         } else {
 #if defined(CONFIG_MIPS_MT_SMP)
                 /* set up ipi interrupts */
@@ -573,12 +352,6 @@ void __init arch_init_irq(void)
                         cpu_ipi_resched_irq = MSC01E_INT_SW0;
                         cpu_ipi_call_irq = MSC01E_INT_SW1;
                 } else {
-                        if (cpu_has_vint) {
-                                set_vi_handler (MIPS_CPU_IPI_RESCHED_IRQ,
-                                        ipi_resched_dispatch);
-                                set_vi_handler (MIPS_CPU_IPI_CALL_IRQ,
-                                        ipi_call_dispatch);
-                        }
                         cpu_ipi_resched_irq = MIPS_CPU_IRQ_BASE +
                                 MIPS_CPU_IPI_RESCHED_IRQ;
                         cpu_ipi_call_irq = MIPS_CPU_IRQ_BASE +
@@ -587,7 +360,21 @@ void __init arch_init_irq(void)
                 arch_init_ipiirq(cpu_ipi_resched_irq, &irq_resched);
                 arch_init_ipiirq(cpu_ipi_call_irq, &irq_call);
 #endif
+                if (cpu_has_veic) {
+                        set_vi_handler(MSC01E_INT_I8259A,
+                                       malta_hw0_irqdispatch);
+                        set_vi_handler(MSC01E_INT_COREHI,
+                                       corehi_irqdispatch);
+                        i8259_irq = MSC01E_INT_BASE + MSC01E_INT_I8259A;
+                        corehi_irq = MSC01E_INT_BASE + MSC01E_INT_COREHI;
+                } else {
+                        i8259_irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_I8259A;
+                        corehi_irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_COREHI;
+                }
         }
+
+        setup_irq(i8259_irq, &i8259irq);
+        setup_irq(corehi_irq, &corehi_irqaction);
 }
 
 void malta_be_init(void)
@@ -714,37 +501,3 @@ int malta_be_handler(struct pt_regs *regs, int is_fixup)
 
         return retval;
 }
-
-void gic_enable_interrupt(int irq_vec)
-{
-        GIC_SET_INTR_MASK(irq_vec);
-}
-
-void gic_disable_interrupt(int irq_vec)
-{
-        GIC_CLR_INTR_MASK(irq_vec);
-}
-
-void gic_irq_ack(struct irq_data *d)
-{
-        int irq = (d->irq - gic_irq_base);
-
-        GIC_CLR_INTR_MASK(irq);
-
-        if (gic_irq_flags[irq] & GIC_TRIG_EDGE)
-                GICWRITE(GIC_REG(SHARED, GIC_SH_WEDGE), irq);
-}
-
-void gic_finish_irq(struct irq_data *d)
-{
-        /* Enable interrupts. */
-        GIC_SET_INTR_MASK(d->irq - gic_irq_base);
-}
-
-void __init gic_platform_init(int irqs, struct irq_chip *irq_controller)
-{
-        int i;
-
-        for (i = gic_irq_base; i < (gic_irq_base + irqs); i++)
-                irq_set_chip(i, irq_controller);
-}
diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c
index 3778a359f3ad..ce02dbdedc62 100644
--- a/arch/mips/mti-malta/malta-time.c
+++ b/arch/mips/mti-malta/malta-time.c
@@ -24,6 +24,7 @@
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/timex.h>
 #include <linux/mc146818rtc.h>
 
@@ -37,7 +38,6 @@
 #include <asm/time.h>
 #include <asm/mc146818-time.h>
 #include <asm/msc01_ic.h>
-#include <asm/gic.h>
 
 #include <asm/mips-boards/generic.h>
 #include <asm/mips-boards/maltaint.h>
@@ -46,6 +46,8 @@ static int mips_cpu_timer_irq;
 static int mips_cpu_perf_irq;
 extern int cp0_perfcount_irq;
 
+static unsigned int gic_frequency;
+
 static void mips_timer_dispatch(void)
 {
         do_IRQ(mips_cpu_timer_irq);
@@ -70,9 +72,7 @@ static void __init estimate_frequencies(void)
 {
         unsigned long flags;
         unsigned int count, start;
-#ifdef CONFIG_IRQ_GIC
-        unsigned int giccount = 0, gicstart = 0;
-#endif
+        cycle_t giccount = 0, gicstart = 0;
 
 #if defined(CONFIG_KVM_GUEST) && CONFIG_KVM_GUEST_TIMER_FREQ
         mips_hpt_frequency = CONFIG_KVM_GUEST_TIMER_FREQ * 1000000;
@@ -87,32 +87,26 @@ static void __init estimate_frequencies(void)
 
         /* Initialize counters. */
         start = read_c0_count();
-#ifdef CONFIG_IRQ_GIC
         if (gic_present)
-                GICREAD(GIC_REG(SHARED, GIC_SH_COUNTER_31_00), gicstart);
-#endif
+                gicstart = gic_read_count();
 
         /* Read counter exactly on falling edge of update flag. */
         while (CMOS_READ(RTC_REG_A) & RTC_UIP);
         while (!(CMOS_READ(RTC_REG_A) & RTC_UIP));
 
         count = read_c0_count();
-#ifdef CONFIG_IRQ_GIC
         if (gic_present)
-                GICREAD(GIC_REG(SHARED, GIC_SH_COUNTER_31_00), giccount);
-#endif
+                giccount = gic_read_count();
 
         local_irq_restore(flags);
 
         count -= start;
         mips_hpt_frequency = count;
 
-#ifdef CONFIG_IRQ_GIC
         if (gic_present) {
                 giccount -= gicstart;
                 gic_frequency = giccount;
         }
-#endif
 }
 
 void read_persistent_clock(struct timespec *ts)
@@ -121,35 +115,30 @@ void read_persistent_clock(struct timespec *ts)
         ts->tv_nsec = 0;
 }
 
-static void __init plat_perf_setup(void)
+int get_c0_perfcount_int(void)
 {
-#ifdef MSC01E_INT_BASE
         if (cpu_has_veic) {
                 set_vi_handler(MSC01E_INT_PERFCTR, mips_perf_dispatch);
                 mips_cpu_perf_irq = MSC01E_INT_BASE + MSC01E_INT_PERFCTR;
-        } else
-#endif
-        if (cp0_perfcount_irq >= 0) {
-                if (cpu_has_vint)
-                        set_vi_handler(cp0_perfcount_irq, mips_perf_dispatch);
+        } else if (gic_present) {
+                mips_cpu_perf_irq = gic_get_c0_perfcount_int();
+        } else if (cp0_perfcount_irq >= 0) {
                 mips_cpu_perf_irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
-#ifdef CONFIG_SMP
-                irq_set_handler(mips_cpu_perf_irq, handle_percpu_irq);
-#endif
+        } else {
+                mips_cpu_perf_irq = -1;
         }
+
+        return mips_cpu_perf_irq;
 }
 
 unsigned int get_c0_compare_int(void)
 {
-#ifdef MSC01E_INT_BASE
         if (cpu_has_veic) {
                 set_vi_handler(MSC01E_INT_CPUCTR, mips_timer_dispatch);
                 mips_cpu_timer_irq = MSC01E_INT_BASE + MSC01E_INT_CPUCTR;
-        } else
-#endif
-        {
-                if (cpu_has_vint)
-                        set_vi_handler(cp0_compare_irq, mips_timer_dispatch);
+        } else if (gic_present) {
+                mips_cpu_timer_irq = gic_get_c0_compare_int();
+        } else {
                 mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
         }
 
@@ -191,16 +180,14 @@ void __init plat_time_init(void)
         setup_pit_timer();
 #endif
 
-#ifdef CONFIG_IRQ_GIC
+#ifdef CONFIG_MIPS_GIC
         if (gic_present) {
                 freq = freqround(gic_frequency, 5000);
                 printk("GIC frequency %d.%02d MHz\n", freq/1000000,
                        (freq%1000000)*100/1000000);
-#ifdef CONFIG_CSRC_GIC
+#ifdef CONFIG_CLKSRC_MIPS_GIC
                 gic_clocksource_init(gic_frequency);
 #endif
         }
 #endif
-
-        plat_perf_setup();
 }
diff --git a/arch/mips/mti-sead3/sead3-ehci.c b/arch/mips/mti-sead3/sead3-ehci.c
index 772fc056a92d..014dd7ba4d68 100644
--- a/arch/mips/mti-sead3/sead3-ehci.c
+++ b/arch/mips/mti-sead3/sead3-ehci.c
@@ -9,6 +9,9 @@
 #include <linux/irq.h>
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
+#include <linux/irqchip/mips-gic.h>
+
+#include <asm/mips-boards/sead3int.h>
 
 struct resource ehci_resources[] = {
         {
@@ -17,7 +20,6 @@ struct resource ehci_resources[] = {
                 .flags                  = IORESOURCE_MEM
         },
         {
-                .start                  = MIPS_CPU_IRQ_BASE + 2,
                 .flags                  = IORESOURCE_IRQ
         }
 };
@@ -37,6 +39,10 @@ static struct platform_device ehci_device = {
 
 static int __init ehci_init(void)
 {
+        if (gic_present)
+                ehci_resources[1].start = MIPS_GIC_IRQ_BASE + GIC_INT_EHCI;
+        else
+                ehci_resources[1].start = MIPS_CPU_IRQ_BASE + CPU_INT_EHCI;
         return platform_device_register(&ehci_device);
 }
 
diff --git a/arch/mips/mti-sead3/sead3-int.c b/arch/mips/mti-sead3/sead3-int.c
index 6a560ac03def..e31e17f81eef 100644
--- a/arch/mips/mti-sead3/sead3-int.c
+++ b/arch/mips/mti-sead3/sead3-int.c
@@ -7,9 +7,9 @@
  */
 #include <linux/init.h>
 #include <linux/irq.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/io.h>
 
-#include <asm/gic.h>
 #include <asm/irq_cpu.h>
 #include <asm/setup.h>
 
@@ -20,138 +20,23 @@
 #define SEAD_CONFIG_BASE                0x1b100110
 #define SEAD_CONFIG_SIZE                4
 
-static unsigned long sead3_config_reg;
-
-/*
- * This table defines the setup for each external GIC interrupt. It is
- * indexed by interrupt number.
- */
-#define GIC_CPU_NMI GIC_MAP_TO_NMI_MSK
-static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
-        { 0, GIC_CPU_INT4, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT3, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT2, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT2, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT1, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT0, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT0, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT0, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { 0, GIC_CPU_INT0, GIC_POL_POS, GIC_TRIG_LEVEL, GIC_FLAG_TRANSPARENT },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-        { GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED, GIC_UNUSED },
-};
-
-asmlinkage void plat_irq_dispatch(void)
-{
-        unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
-        int irq;
-
-        irq = (fls(pending) - CAUSEB_IP - 1);
-        if (irq >= 0)
-                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
-        else
-                spurious_interrupt();
-}
+static void __iomem *sead3_config_reg;
 
 void __init arch_init_irq(void)
 {
-        int i;
-
-        if (!cpu_has_veic) {
+        if (!cpu_has_veic)
                 mips_cpu_irq_init();
 
-                if (cpu_has_vint) {
-                        /* install generic handler */
-                        for (i = 0; i < 8; i++)
-                                set_vi_handler(i, plat_irq_dispatch);
-                }
-        }
-
-        sead3_config_reg = (unsigned long)ioremap_nocache(SEAD_CONFIG_BASE,
-                SEAD_CONFIG_SIZE);
-        gic_present = (REG32(sead3_config_reg) & SEAD_CONFIG_GIC_PRESENT_MSK) >>
+        sead3_config_reg = ioremap_nocache(SEAD_CONFIG_BASE, SEAD_CONFIG_SIZE);
+        gic_present = (__raw_readl(sead3_config_reg) &
+                       SEAD_CONFIG_GIC_PRESENT_MSK) >>
                 SEAD_CONFIG_GIC_PRESENT_SHF;
         pr_info("GIC: %spresent\n", (gic_present) ? "" : "not ");
         pr_info("EIC: %s\n",
                 (current_cpu_data.options & MIPS_CPU_VEIC) ?  "on" : "off");
 
         if (gic_present)
-                gic_init(GIC_BASE_ADDR, GIC_ADDRSPACE_SZ, gic_intr_map,
-                        ARRAY_SIZE(gic_intr_map), MIPS_GIC_IRQ_BASE);
-}
-
-void gic_enable_interrupt(int irq_vec)
-{
-        unsigned int i, irq_source;
-
-        /* enable all the interrupts associated with this vector */
-        for (i = 0; i < gic_shared_intr_map[irq_vec].num_shared_intr; i++) {
-                irq_source = gic_shared_intr_map[irq_vec].intr_list[i];
-                GIC_SET_INTR_MASK(irq_source);
-        }
-        /* enable all local interrupts associated with this vector */
-        if (gic_shared_intr_map[irq_vec].local_intr_mask) {
-                GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), 0);
-                GICWRITE(GIC_REG(VPE_OTHER, GIC_VPE_SMASK),
-                        gic_shared_intr_map[irq_vec].local_intr_mask);
-        }
+                gic_init(GIC_BASE_ADDR, GIC_ADDRSPACE_SZ, CPU_INT_GIC,
+                         MIPS_GIC_IRQ_BASE);
 }
 
-void gic_disable_interrupt(int irq_vec)
-{
-        unsigned int i, irq_source;
-
-        /* disable all the interrupts associated with this vector */
-        for (i = 0; i < gic_shared_intr_map[irq_vec].num_shared_intr; i++) {
-                irq_source = gic_shared_intr_map[irq_vec].intr_list[i];
-                GIC_CLR_INTR_MASK(irq_source);
-        }
-        /* disable all local interrupts associated with this vector */
-        if (gic_shared_intr_map[irq_vec].local_intr_mask) {
-                GICWRITE(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), 0);
-                GICWRITE(GIC_REG(VPE_OTHER, GIC_VPE_RMASK),
-                        gic_shared_intr_map[irq_vec].local_intr_mask);
-        }
-}
-
-void gic_irq_ack(struct irq_data *d)
-{
-        GIC_CLR_INTR_MASK(d->irq - gic_irq_base);
-}
-
-void gic_finish_irq(struct irq_data *d)
-{
-        unsigned int irq = (d->irq - gic_irq_base);
-        unsigned int i, irq_source;
-
-        /* Clear edge detectors. */
-        for (i = 0; i < gic_shared_intr_map[irq].num_shared_intr; i++) {
-                irq_source = gic_shared_intr_map[irq].intr_list[i];
-                if (gic_irq_flags[irq_source] & GIC_TRIG_EDGE)
-                        GICWRITE(GIC_REG(SHARED, GIC_SH_WEDGE), irq_source);
-        }
-
-        /* Enable interrupts. */
-        GIC_SET_INTR_MASK(irq);
-}
-
-void __init gic_platform_init(int irqs, struct irq_chip *irq_controller)
-{
-        int i;
-
-        /*
-         * For non-EIC mode, we want to setup the GIC in pass-through
-         * mode, as if the GIC didn't exist. Do not map any interrupts
-         * for an external interrupt controller.
-         */
-        if (!cpu_has_veic)
-                return;
-
-        for (i = gic_irq_base; i < (gic_irq_base + irqs); i++)
-                irq_set_chip_and_handler(i, irq_controller, handle_percpu_irq);
-}
diff --git a/arch/mips/mti-sead3/sead3-net.c b/arch/mips/mti-sead3/sead3-net.c
index dd11e7eb771c..46176b804576 100644
--- a/arch/mips/mti-sead3/sead3-net.c
+++ b/arch/mips/mti-sead3/sead3-net.c
@@ -7,9 +7,12 @@
  */
 #include <linux/module.h>
 #include <linux/irq.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/platform_device.h>
 #include <linux/smsc911x.h>
 
+#include <asm/mips-boards/sead3int.h>
+
 static struct smsc911x_platform_config sead3_smsc911x_data = {
         .irq_polarity = SMSC911X_IRQ_POLARITY_ACTIVE_LOW,
         .irq_type = SMSC911X_IRQ_TYPE_PUSH_PULL,
@@ -17,14 +20,13 @@ static struct smsc911x_platform_config sead3_smsc911x_data = {
         .phy_interface = PHY_INTERFACE_MODE_MII,
 };
 
-struct resource sead3_net_resourcess[] = {
+struct resource sead3_net_resources[] = {
         {
                 .start                  = 0x1f010000,
                 .end                    = 0x1f01ffff,
                 .flags                  = IORESOURCE_MEM
         },
         {
-                .start                  = MIPS_CPU_IRQ_BASE + 6,
                 .flags                  = IORESOURCE_IRQ
         }
 };
@@ -35,12 +37,16 @@ static struct platform_device sead3_net_device = {
         .dev                    = {
                 .platform_data  = &sead3_smsc911x_data,
         },
-        .num_resources          = ARRAY_SIZE(sead3_net_resourcess),
-        .resource               = sead3_net_resourcess
+        .num_resources          = ARRAY_SIZE(sead3_net_resources),
+        .resource               = sead3_net_resources
 };
 
 static int __init sead3_net_init(void)
 {
+        if (gic_present)
+                sead3_net_resources[1].start = MIPS_GIC_IRQ_BASE + GIC_INT_NET;
+        else
+                sead3_net_resources[1].start = MIPS_CPU_IRQ_BASE + CPU_INT_NET;
         return platform_device_register(&sead3_net_device);
 }
 
diff --git a/arch/mips/mti-sead3/sead3-platform.c b/arch/mips/mti-sead3/sead3-platform.c
index 6c3b33dbed18..53ee6f1f018d 100644
--- a/arch/mips/mti-sead3/sead3-platform.c
+++ b/arch/mips/mti-sead3/sead3-platform.c
@@ -7,12 +7,15 @@
  */
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/irqchip/mips-gic.h>
 #include <linux/serial_8250.h>
 
-#define UART(base, int)                                                 \
+#include <asm/mips-boards/sead3int.h>
+
+#define UART(base)                                                      \
 {                                                                       \
         .mapbase        = base,                                         \
-        .irq            = int,                                          \
+        .irq            = -1,                                           \
         .uartclk        = 14745600,                                     \
         .iotype         = UPIO_MEM32,                                   \
         .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP, \
@@ -20,8 +23,8 @@
 }
 
 static struct plat_serial8250_port uart8250_data[] = {
-        UART(0x1f000900, MIPS_CPU_IRQ_BASE + 4),   /* ttyS0 = USB   */
-        UART(0x1f000800, MIPS_CPU_IRQ_BASE + 4),   /* ttyS1 = RS232 */
+        UART(0x1f000900),   /* ttyS0 = USB   */
+        UART(0x1f000800),   /* ttyS1 = RS232 */
         { },
 };
 
@@ -35,6 +38,13 @@ static struct platform_device uart8250_device = {
 
 static int __init uart8250_init(void)
 {
+        if (gic_present) {
+                uart8250_data[0].irq = MIPS_GIC_IRQ_BASE + GIC_INT_UART0;
+                uart8250_data[1].irq = MIPS_GIC_IRQ_BASE + GIC_INT_UART1;
+        } else {
+                uart8250_data[0].irq = MIPS_CPU_IRQ_BASE + CPU_INT_UART0;
+                uart8250_data[1].irq = MIPS_CPU_IRQ_BASE + CPU_INT_UART1;
+        }
         return platform_device_register(&uart8250_device);
 }
 
diff --git a/arch/mips/mti-sead3/sead3-serial.c b/arch/mips/mti-sead3/sead3-serial.c
deleted file mode 100644
index bc52705bbee4..000000000000
--- a/arch/mips/mti-sead3/sead3-serial.c
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
- */
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/serial_8250.h>
-
-#define UART(base, int)                                                 \
-{                                                                       \
-        .mapbase        = base,                                         \
-        .irq            = int,                                          \
-        .uartclk        = 14745600,                                     \
-        .iotype         = UPIO_MEM32,                                   \
-        .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP, \
-        .regshift       = 2,                                            \
-}
-
-static struct plat_serial8250_port uart8250_data[] = {
-        UART(0x1f000900, MIPS_CPU_IRQ_BASE + 4),   /* ttyS0 = USB   */
-        UART(0x1f000800, MIPS_CPU_IRQ_BASE + 4),   /* ttyS1 = RS232 */
-        { },
-};
-
-static struct platform_device uart8250_device = {
-        .name                   = "serial8250",
-        .id                     = PLAT8250_DEV_PLATFORM,
-        .dev                    = {
-                .platform_data  = uart8250_data,
-        },
-};
-
-static int __init uart8250_init(void)
-{
-        return platform_device_register(&uart8250_device);
-}
-
-module_init(uart8250_init);
-
-MODULE_AUTHOR("Chris Dearman <chris@mips.com>");
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("8250 UART probe driver for the SEAD-3 platform");
diff --git a/arch/mips/mti-sead3/sead3-time.c b/arch/mips/mti-sead3/sead3-time.c
index 678d03d53c60..ec1dd2491f96 100644
--- a/arch/mips/mti-sead3/sead3-time.c
+++ b/arch/mips/mti-sead3/sead3-time.c
@@ -6,6 +6,7 @@
  * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
  */
 #include <linux/init.h>
+#include <linux/irqchip/mips-gic.h>
 
 #include <asm/cpu.h>
 #include <asm/setup.h>
@@ -13,19 +14,6 @@
 #include <asm/irq.h>
 #include <asm/mips-boards/generic.h>
 
-static int mips_cpu_timer_irq;
-static int mips_cpu_perf_irq;
-
-static void mips_timer_dispatch(void)
-{
-        do_IRQ(mips_cpu_timer_irq);
-}
-
-static void mips_perf_dispatch(void)
-{
-        do_IRQ(mips_cpu_perf_irq);
-}
-
 static void __iomem *status_reg = (void __iomem *)0xbf000410;
 
 /*
@@ -81,21 +69,20 @@ void read_persistent_clock(struct timespec *ts)
         ts->tv_nsec = 0;
 }
 
-static void __init plat_perf_setup(void)
+int get_c0_perfcount_int(void)
 {
-        if (cp0_perfcount_irq >= 0) {
-                if (cpu_has_vint)
-                        set_vi_handler(cp0_perfcount_irq, mips_perf_dispatch);
-                mips_cpu_perf_irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
-        }
+        if (gic_present)
+                return gic_get_c0_compare_int();
+        if (cp0_perfcount_irq >= 0)
+                return MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
+        return -1;
 }
 
 unsigned int get_c0_compare_int(void)
 {
-        if (cpu_has_vint)
-                set_vi_handler(cp0_compare_irq, mips_timer_dispatch);
-        mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
-        return mips_cpu_timer_irq;
+        if (gic_present)
+                return gic_get_c0_compare_int();
+        return MIPS_CPU_IRQ_BASE + cp0_compare_irq;
 }
 
 void __init plat_time_init(void)
@@ -108,6 +95,4 @@ void __init plat_time_init(void)
                 (est_freq % 1000000) * 100 / 1000000);
 
         mips_scroll_message();
-
-        plat_perf_setup();
 }
diff --git a/arch/mips/oprofile/Makefile b/arch/mips/oprofile/Makefile
index 9c0a6782c091..070afdb297df 100644
--- a/arch/mips/oprofile/Makefile
+++ b/arch/mips/oprofile/Makefile
@@ -14,3 +14,4 @@ oprofile-$(CONFIG_CPU_R10000)		+= op_model_mipsxx.o
 oprofile-$(CONFIG_CPU_SB1)              += op_model_mipsxx.o
 oprofile-$(CONFIG_CPU_XLR)              += op_model_mipsxx.o
 oprofile-$(CONFIG_CPU_LOONGSON2)        += op_model_loongson2.o
+oprofile-$(CONFIG_CPU_LOONGSON3)        += op_model_loongson3.o
diff --git a/arch/mips/oprofile/backtrace.c b/arch/mips/oprofile/backtrace.c
index 83a1dfd8f0e3..5e645c9a3162 100644
--- a/arch/mips/oprofile/backtrace.c
+++ b/arch/mips/oprofile/backtrace.c
@@ -65,7 +65,7 @@ static inline int is_end_of_function_marker(union mips_instruction *ip)
  * - handle cases where the stack is adjusted inside a function
  *     (generally doesn't happen)
  * - find optimal value for max_instr_check
- * - try to find a way to handle leaf functions
+ * - try to find a better way to handle leaf functions
  */
 
 static inline int unwind_user_frame(struct stackframe *old_frame,
@@ -104,7 +104,7 @@ static inline int unwind_user_frame(struct stackframe *old_frame,
         }
 
         if (!ra_offset || !stack_size)
-                return -1;
+                goto done;
 
         if (ra_offset) {
                 new_frame.ra = old_frame->sp + ra_offset;
@@ -121,6 +121,7 @@ static inline int unwind_user_frame(struct stackframe *old_frame,
         if (new_frame.sp > old_frame->sp)
                 return -2;
 
+done:
         new_frame.pc = old_frame->ra;
         *old_frame = new_frame;
 
diff --git a/arch/mips/oprofile/common.c b/arch/mips/oprofile/common.c
index e74732449478..a26cbe372e06 100644
--- a/arch/mips/oprofile/common.c
+++ b/arch/mips/oprofile/common.c
@@ -18,6 +18,7 @@
 
 extern struct op_mips_model op_model_mipsxx_ops __weak;
 extern struct op_mips_model op_model_loongson2_ops __weak;
+extern struct op_mips_model op_model_loongson3_ops __weak;
 
 static struct op_mips_model *model;
 
@@ -104,8 +105,17 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         case CPU_LOONGSON2:
                 lmodel = &op_model_loongson2_ops;
                 break;
+        case CPU_LOONGSON3:
+                lmodel = &op_model_loongson3_ops;
+                break;
         };
 
+        /*
+         * Always set the backtrace. This allows unsupported CPU types to still
+         * use timer-based oprofile.
+         */
+        ops->backtrace = op_mips_backtrace;
+
         if (!lmodel)
                 return -ENODEV;
 
@@ -121,7 +131,6 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         ops->start              = op_mips_start;
         ops->stop               = op_mips_stop;
         ops->cpu_type           = lmodel->cpu_type;
-        ops->backtrace          = op_mips_backtrace;
 
         printk(KERN_INFO "oprofile: using %s performance monitoring.\n",
                lmodel->cpu_type);
diff --git a/arch/mips/oprofile/op_model_loongson3.c b/arch/mips/oprofile/op_model_loongson3.c
new file mode 100644
index 000000000000..8bcf7fc40f0d
--- /dev/null
+++ b/arch/mips/oprofile/op_model_loongson3.c
@@ -0,0 +1,220 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ */
+#include <linux/init.h>
+#include <linux/cpu.h>
+#include <linux/smp.h>
+#include <linux/proc_fs.h>
+#include <linux/oprofile.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <asm/uaccess.h>
+#include <irq.h>
+#include <loongson.h>
+#include "op_impl.h"
+
+#define LOONGSON3_PERFCNT_OVERFLOW      (1ULL << 63)
+
+#define LOONGSON3_PERFCTRL_EXL          (1UL << 0)
+#define LOONGSON3_PERFCTRL_KERNEL       (1UL << 1)
+#define LOONGSON3_PERFCTRL_SUPERVISOR   (1UL << 2)
+#define LOONGSON3_PERFCTRL_USER         (1UL << 3)
+#define LOONGSON3_PERFCTRL_ENABLE       (1UL << 4)
+#define LOONGSON3_PERFCTRL_W            (1UL << 30)
+#define LOONGSON3_PERFCTRL_M            (1UL << 31)
+#define LOONGSON3_PERFCTRL_EVENT(idx, event) \
+        (((event) & (idx ? 0x0f : 0x3f)) << 5)
+
+/* Loongson-3 PerfCount performance counter1 register */
+#define read_c0_perflo1() __read_64bit_c0_register($25, 0)
+#define write_c0_perflo1(val) __write_64bit_c0_register($25, 0, val)
+#define read_c0_perfhi1() __read_64bit_c0_register($25, 1)
+#define write_c0_perfhi1(val) __write_64bit_c0_register($25, 1, val)
+
+/* Loongson-3 PerfCount performance counter2 register */
+#define read_c0_perflo2() __read_64bit_c0_register($25, 2)
+#define write_c0_perflo2(val) __write_64bit_c0_register($25, 2, val)
+#define read_c0_perfhi2() __read_64bit_c0_register($25, 3)
+#define write_c0_perfhi2(val) __write_64bit_c0_register($25, 3, val)
+
+static int (*save_perf_irq)(void);
+
+static struct loongson3_register_config {
+        unsigned int control1;
+        unsigned int control2;
+        unsigned long long reset_counter1;
+        unsigned long long reset_counter2;
+        int ctr1_enable, ctr2_enable;
+} reg;
+
+static void reset_counters(void *arg)
+{
+        write_c0_perfhi1(0);
+        write_c0_perfhi2(0);
+        write_c0_perflo1(0xc0000000);
+        write_c0_perflo2(0x40000000);
+}
+
+/* Compute all of the registers in preparation for enabling profiling. */
+static void loongson3_reg_setup(struct op_counter_config *ctr)
+{
+        unsigned int control1 = 0;
+        unsigned int control2 = 0;
+
+        reg.reset_counter1 = 0;
+        reg.reset_counter2 = 0;
+        /* Compute the performance counter control word. */
+        /* For now count kernel and user mode */
+        if (ctr[0].enabled) {
+                control1 |= LOONGSON3_PERFCTRL_EVENT(0, ctr[0].event) |
+                                        LOONGSON3_PERFCTRL_ENABLE;
+                if (ctr[0].kernel)
+                        control1 |= LOONGSON3_PERFCTRL_KERNEL;
+                if (ctr[0].user)
+                        control1 |= LOONGSON3_PERFCTRL_USER;
+                reg.reset_counter1 = 0x8000000000000000ULL - ctr[0].count;
+        }
+
+        if (ctr[1].enabled) {
+                control2 |= LOONGSON3_PERFCTRL_EVENT(1, ctr[1].event) |
+                                        LOONGSON3_PERFCTRL_ENABLE;
+                if (ctr[1].kernel)
+                        control2 |= LOONGSON3_PERFCTRL_KERNEL;
+                if (ctr[1].user)
+                        control2 |= LOONGSON3_PERFCTRL_USER;
+                reg.reset_counter2 = 0x8000000000000000ULL - ctr[1].count;
+        }
+
+        if (ctr[0].enabled)
+                control1 |= LOONGSON3_PERFCTRL_EXL;
+        if (ctr[1].enabled)
+                control2 |= LOONGSON3_PERFCTRL_EXL;
+
+        reg.control1 = control1;
+        reg.control2 = control2;
+        reg.ctr1_enable = ctr[0].enabled;
+        reg.ctr2_enable = ctr[1].enabled;
+}
+
+/* Program all of the registers in preparation for enabling profiling. */
+static void loongson3_cpu_setup(void *args)
+{
+        uint64_t perfcount1, perfcount2;
+
+        perfcount1 = reg.reset_counter1;
+        perfcount2 = reg.reset_counter2;
+        write_c0_perfhi1(perfcount1);
+        write_c0_perfhi2(perfcount2);
+}
+
+static void loongson3_cpu_start(void *args)
+{
+        /* Start all counters on current CPU */
+        reg.control1 |= (LOONGSON3_PERFCTRL_W|LOONGSON3_PERFCTRL_M);
+        reg.control2 |= (LOONGSON3_PERFCTRL_W|LOONGSON3_PERFCTRL_M);
+
+        if (reg.ctr1_enable)
+                write_c0_perflo1(reg.control1);
+        if (reg.ctr2_enable)
+                write_c0_perflo2(reg.control2);
+}
+
+static void loongson3_cpu_stop(void *args)
+{
+        /* Stop all counters on current CPU */
+        write_c0_perflo1(0xc0000000);
+        write_c0_perflo2(0x40000000);
+        memset(&reg, 0, sizeof(reg));
+}
+
+static int loongson3_perfcount_handler(void)
+{
+        unsigned long flags;
+        uint64_t counter1, counter2;
+        uint32_t cause, handled = IRQ_NONE;
+        struct pt_regs *regs = get_irq_regs();
+
+        cause = read_c0_cause();
+        if (!(cause & CAUSEF_PCI))
+                return handled;
+
+        counter1 = read_c0_perfhi1();
+        counter2 = read_c0_perfhi2();
+
+        local_irq_save(flags);
+
+        if (counter1 & LOONGSON3_PERFCNT_OVERFLOW) {
+                if (reg.ctr1_enable)
+                        oprofile_add_sample(regs, 0);
+                counter1 = reg.reset_counter1;
+        }
+        if (counter2 & LOONGSON3_PERFCNT_OVERFLOW) {
+                if (reg.ctr2_enable)
+                        oprofile_add_sample(regs, 1);
+                counter2 = reg.reset_counter2;
+        }
+
+        local_irq_restore(flags);
+
+        write_c0_perfhi1(counter1);
+        write_c0_perfhi2(counter2);
+
+        if (!(cause & CAUSEF_TI))
+                handled = IRQ_HANDLED;
+
+        return handled;
+}
+
+static int loongson3_cpu_callback(struct notifier_block *nfb,
+        unsigned long action, void *hcpu)
+{
+        switch (action) {
+        case CPU_STARTING:
+        case CPU_STARTING_FROZEN:
+                write_c0_perflo1(reg.control1);
+                write_c0_perflo2(reg.control2);
+                break;
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                write_c0_perflo1(0xc0000000);
+                write_c0_perflo2(0x40000000);
+                break;
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block loongson3_notifier_block = {
+        .notifier_call = loongson3_cpu_callback
+};
+
+static int __init loongson3_init(void)
+{
+        on_each_cpu(reset_counters, NULL, 1);
+        register_hotcpu_notifier(&loongson3_notifier_block);
+        save_perf_irq = perf_irq;
+        perf_irq = loongson3_perfcount_handler;
+
+        return 0;
+}
+
+static void loongson3_exit(void)
+{
+        on_each_cpu(reset_counters, NULL, 1);
+        unregister_hotcpu_notifier(&loongson3_notifier_block);
+        perf_irq = save_perf_irq;
+}
+
+struct op_mips_model op_model_loongson3_ops = {
+        .reg_setup      = loongson3_reg_setup,
+        .cpu_setup      = loongson3_cpu_setup,
+        .init           = loongson3_init,
+        .exit           = loongson3_exit,
+        .cpu_start      = loongson3_cpu_start,
+        .cpu_stop       = loongson3_cpu_stop,
+        .cpu_type       = "mips/loongson3",
+        .num_counters   = 2
+};
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index 42821ae2d77e..01f721a85c5b 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -11,6 +11,7 @@
 #include <linux/interrupt.h>
 #include <linux/smp.h>
 #include <asm/irq_regs.h>
+#include <asm/time.h>
 
 #include "op_impl.h"
 
@@ -35,6 +36,7 @@
 #define M_PERFCTL_COUNT_ALL_THREADS     (1UL      << 13)
 
 static int (*save_perf_irq)(void);
+static int perfcount_irq;
 
 /*
  * XLR has only one set of counters per core. Designate the
@@ -431,8 +433,16 @@ static int __init mipsxx_init(void)
         save_perf_irq = perf_irq;
         perf_irq = mipsxx_perfcount_handler;
 
-        if ((cp0_perfcount_irq >= 0) && (cp0_compare_irq != cp0_perfcount_irq))
-                return request_irq(cp0_perfcount_irq, mipsxx_perfcount_int,
+        if (get_c0_perfcount_int)
+                perfcount_irq = get_c0_perfcount_int();
+        else if ((cp0_perfcount_irq >= 0) &&
+                 (cp0_compare_irq != cp0_perfcount_irq))
+                perfcount_irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
+        else
+                perfcount_irq = -1;
+
+        if (perfcount_irq >= 0)
+                return request_irq(perfcount_irq, mipsxx_perfcount_int,
                         0, "Perfcounter", save_perf_irq);
 
         return 0;
@@ -442,8 +452,8 @@ static void mipsxx_exit(void)
 {
         int counters = op_model_mipsxx_ops.num_counters;
 
-        if ((cp0_perfcount_irq >= 0) && (cp0_compare_irq != cp0_perfcount_irq))
-                free_irq(cp0_perfcount_irq, save_perf_irq);
+        if (perfcount_irq >= 0)
+                free_irq(perfcount_irq, save_perf_irq);
 
         counters = counters_per_cpu_to_total(counters);
         on_each_cpu(reset_counters, (void *)(long)counters, 1);
diff --git a/arch/mips/pci/Makefile b/arch/mips/pci/Makefile
index 6523d558ff5a..300591c6278d 100644
--- a/arch/mips/pci/Makefile
+++ b/arch/mips/pci/Makefile
@@ -19,6 +19,7 @@ obj-$(CONFIG_BCM47XX)		+= pci-bcm47xx.o
 obj-$(CONFIG_BCM63XX)           += pci-bcm63xx.o fixup-bcm63xx.o \
                                         ops-bcm63xx.o
 obj-$(CONFIG_MIPS_ALCHEMY)      += pci-alchemy.o
+obj-$(CONFIG_PCI_AR2315)        += pci-ar2315.o
 obj-$(CONFIG_SOC_AR71XX)        += pci-ar71xx.o
 obj-$(CONFIG_PCI_AR724X)        += pci-ar724x.o
 obj-$(CONFIG_MIPS_PCI_VIRTIO)   += pci-virtio-guest.o
@@ -42,6 +43,7 @@ obj-$(CONFIG_SIBYTE_BCM1x80)	+= pci-bcm1480.o pci-bcm1480ht.o
 obj-$(CONFIG_SNI_RM)            += fixup-sni.o ops-sni.o
 obj-$(CONFIG_LANTIQ)            += fixup-lantiq.o
 obj-$(CONFIG_PCI_LANTIQ)        += pci-lantiq.o ops-lantiq.o
+obj-$(CONFIG_SOC_RT2880)        += pci-rt2880.o
 obj-$(CONFIG_SOC_RT3883)        += pci-rt3883.o
 obj-$(CONFIG_TANBAC_TB0219)     += fixup-tb0219.o
 obj-$(CONFIG_TANBAC_TB0226)     += fixup-tb0226.o
diff --git a/arch/mips/pci/ops-bcm63xx.c b/arch/mips/pci/ops-bcm63xx.c
index 13eea696bbe7..d02eb9d16b55 100644
--- a/arch/mips/pci/ops-bcm63xx.c
+++ b/arch/mips/pci/ops-bcm63xx.c
@@ -469,7 +469,7 @@ static int bcm63xx_pcie_can_access(struct pci_bus *bus, int devfn)
 {
         switch (bus->number) {
         case PCIE_BUS_BRIDGE:
-                return (PCI_SLOT(devfn) == 0);
+                return PCI_SLOT(devfn) == 0;
         case PCIE_BUS_DEVICE:
                 if (PCI_SLOT(devfn) == 0)
                         return bcm_pcie_readl(PCIE_DLSTATUS_REG)
diff --git a/arch/mips/pci/ops-nile4.c b/arch/mips/pci/ops-nile4.c
index a1a7c9f4096e..b9d1fd0ff7e2 100644
--- a/arch/mips/pci/ops-nile4.c
+++ b/arch/mips/pci/ops-nile4.c
@@ -13,8 +13,6 @@
 
 volatile unsigned long *const vrc_pciregs = (void *) Vrc5074_BASE;
 
-static DEFINE_SPINLOCK(nile4_pci_lock);
-
 static int nile4_pcibios_config_access(unsigned char access_type,
         struct pci_bus *bus, unsigned int devfn, int where, u32 *val)
 {
@@ -76,7 +74,6 @@ static int nile4_pcibios_config_access(unsigned char access_type,
 static int nile4_pcibios_read(struct pci_bus *bus, unsigned int devfn,
         int where, int size, u32 *val)
 {
-        unsigned long flags;
         u32 data = 0;
         int err;
 
@@ -85,11 +82,8 @@ static int nile4_pcibios_read(struct pci_bus *bus, unsigned int devfn,
         else if ((size == 4) && (where & 3))
                 return PCIBIOS_BAD_REGISTER_NUMBER;
 
-        spin_lock_irqsave(&nile4_pci_lock, flags);
         err = nile4_pcibios_config_access(PCI_ACCESS_READ, bus, devfn, where,
-                                        &data);
-        spin_unlock_irqrestore(&nile4_pci_lock, flags);
-
+                                          &data);
         if (err)
                 return err;
 
@@ -106,7 +100,6 @@ static int nile4_pcibios_read(struct pci_bus *bus, unsigned int devfn,
 static int nile4_pcibios_write(struct pci_bus *bus, unsigned int devfn,
         int where, int size, u32 val)
 {
-        unsigned long flags;
         u32 data = 0;
         int err;
 
@@ -115,11 +108,8 @@ static int nile4_pcibios_write(struct pci_bus *bus, unsigned int devfn,
         else if ((size == 4) && (where & 3))
                 return PCIBIOS_BAD_REGISTER_NUMBER;
 
-        spin_lock_irqsave(&nile4_pci_lock, flags);
         err = nile4_pcibios_config_access(PCI_ACCESS_READ, bus, devfn, where,
                                           &data);
-        spin_unlock_irqrestore(&nile4_pci_lock, flags);
-
         if (err)
                 return err;
 
diff --git a/arch/mips/pci/ops-pmcmsp.c b/arch/mips/pci/ops-pmcmsp.c
index 50034f985be1..dd2d9f7e9412 100644
--- a/arch/mips/pci/ops-pmcmsp.c
+++ b/arch/mips/pci/ops-pmcmsp.c
@@ -193,8 +193,6 @@ static void pci_proc_init(void)
 }
 #endif /* CONFIG_PROC_FS && PCI_COUNTERS */
 
-static DEFINE_SPINLOCK(bpci_lock);
-
 /*****************************************************************************
  *
  *  STRUCT: pci_io_resource
@@ -368,7 +366,6 @@ int msp_pcibios_config_access(unsigned char access_type,
         struct msp_pci_regs *preg = (void *)PCI_BASE_REG;
         unsigned char bus_num = bus->number;
         unsigned char dev_fn = (unsigned char)devfn;
-        unsigned long flags;
         unsigned long intr;
         unsigned long value;
         static char pciirqflag;
@@ -401,10 +398,7 @@ int msp_pcibios_config_access(unsigned char access_type,
         }
 
 #if defined(CONFIG_PMC_MSP7120_GW) || defined(CONFIG_PMC_MSP7120_EVAL)
-        local_irq_save(flags);
         vpe_status = dvpe();
-#else
-        spin_lock_irqsave(&bpci_lock, flags);
 #endif
 
         /*
@@ -457,9 +451,6 @@ int msp_pcibios_config_access(unsigned char access_type,
 
 #if defined(CONFIG_PMC_MSP7120_GW) || defined(CONFIG_PMC_MSP7120_EVAL)
                 evpe(vpe_status);
-                local_irq_restore(flags);
-#else
-                spin_unlock_irqrestore(&bpci_lock, flags);
 #endif
 
                 return -1;
@@ -467,9 +458,6 @@ int msp_pcibios_config_access(unsigned char access_type,
 
 #if defined(CONFIG_PMC_MSP7120_GW) || defined(CONFIG_PMC_MSP7120_EVAL)
         evpe(vpe_status);
-        local_irq_restore(flags);
-#else
-        spin_unlock_irqrestore(&bpci_lock, flags);
 #endif
 
         return PCIBIOS_SUCCESSFUL;
diff --git a/arch/mips/pci/pci-ar2315.c b/arch/mips/pci/pci-ar2315.c
new file mode 100644
index 000000000000..bd2b3b60da83
--- /dev/null
+++ b/arch/mips/pci/pci-ar2315.c
@@ -0,0 +1,511 @@
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Both AR2315 and AR2316 chips have PCI interface unit, which supports DMA
+ * and interrupt. PCI interface supports MMIO access method, but does not
+ * seem to support I/O ports.
+ *
+ * Read/write operation in the region 0x80000000-0xBFFFFFFF causes
+ * a memory read/write command on the PCI bus. 30 LSBs of address on
+ * the bus are taken from memory read/write request and 2 MSBs are
+ * determined by PCI unit configuration.
+ *
+ * To work with the configuration space instead of memory is necessary set
+ * the CFG_SEL bit in the PCI_MISC_CONFIG register.
+ *
+ * Devices on the bus can perform DMA requests via chip BAR1. PCI host
+ * controller BARs are programmend as if an external device is programmed.
+ * Which means that during configuration, IDSEL pin of the chip should be
+ * asserted.
+ *
+ * We know (and support) only one board that uses the PCI interface -
+ * Fonera 2.0g (FON2202). It has a USB EHCI controller connected to the
+ * AR2315 PCI bus. IDSEL pin of USB controller is connected to AD[13] line
+ * and IDSEL pin of AR2315 is connected to AD[16] line.
+ */
+
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+#include <linux/bitops.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
+#include <linux/io.h>
+#include <asm/paccess.h>
+
+/*
+ * PCI Bus Interface Registers
+ */
+#define AR2315_PCI_1MS_REG              0x0008
+
+#define AR2315_PCI_1MS_MASK             0x3FFFF /* # of AHB clk cycles in 1ms */
+
+#define AR2315_PCI_MISC_CONFIG          0x000c
+
+#define AR2315_PCIMISC_TXD_EN   0x00000001      /* Enable TXD for fragments */
+#define AR2315_PCIMISC_CFG_SEL  0x00000002      /* Mem or Config cycles */
+#define AR2315_PCIMISC_GIG_MASK 0x0000000C      /* bits 31-30 for pci req */
+#define AR2315_PCIMISC_RST_MODE 0x00000030
+#define AR2315_PCIRST_INPUT     0x00000000      /* 4:5=0 rst is input */
+#define AR2315_PCIRST_LOW       0x00000010      /* 4:5=1 rst to GND */
+#define AR2315_PCIRST_HIGH      0x00000020      /* 4:5=2 rst to VDD */
+#define AR2315_PCIGRANT_EN      0x00000000      /* 6:7=0 early grant en */
+#define AR2315_PCIGRANT_FRAME   0x00000040      /* 6:7=1 grant waits 4 frame */
+#define AR2315_PCIGRANT_IDLE    0x00000080      /* 6:7=2 grant waits 4 idle */
+#define AR2315_PCIGRANT_GAP     0x00000000      /* 6:7=2 grant waits 4 idle */
+#define AR2315_PCICACHE_DIS     0x00001000      /* PCI external access cache
+                                                 * disable */
+
+#define AR2315_PCI_OUT_TSTAMP           0x0010
+
+#define AR2315_PCI_UNCACHE_CFG          0x0014
+
+#define AR2315_PCI_IN_EN                0x0100
+
+#define AR2315_PCI_IN_EN0       0x01    /* Enable chain 0 */
+#define AR2315_PCI_IN_EN1       0x02    /* Enable chain 1 */
+#define AR2315_PCI_IN_EN2       0x04    /* Enable chain 2 */
+#define AR2315_PCI_IN_EN3       0x08    /* Enable chain 3 */
+
+#define AR2315_PCI_IN_DIS               0x0104
+
+#define AR2315_PCI_IN_DIS0      0x01    /* Disable chain 0 */
+#define AR2315_PCI_IN_DIS1      0x02    /* Disable chain 1 */
+#define AR2315_PCI_IN_DIS2      0x04    /* Disable chain 2 */
+#define AR2315_PCI_IN_DIS3      0x08    /* Disable chain 3 */
+
+#define AR2315_PCI_IN_PTR               0x0200
+
+#define AR2315_PCI_OUT_EN               0x0400
+
+#define AR2315_PCI_OUT_EN0      0x01    /* Enable chain 0 */
+
+#define AR2315_PCI_OUT_DIS              0x0404
+
+#define AR2315_PCI_OUT_DIS0     0x01    /* Disable chain 0 */
+
+#define AR2315_PCI_OUT_PTR              0x0408
+
+/* PCI interrupt status (write one to clear) */
+#define AR2315_PCI_ISR                  0x0500
+
+#define AR2315_PCI_INT_TX       0x00000001      /* Desc In Completed */
+#define AR2315_PCI_INT_TXOK     0x00000002      /* Desc In OK */
+#define AR2315_PCI_INT_TXERR    0x00000004      /* Desc In ERR */
+#define AR2315_PCI_INT_TXEOL    0x00000008      /* Desc In End-of-List */
+#define AR2315_PCI_INT_RX       0x00000010      /* Desc Out Completed */
+#define AR2315_PCI_INT_RXOK     0x00000020      /* Desc Out OK */
+#define AR2315_PCI_INT_RXERR    0x00000040      /* Desc Out ERR */
+#define AR2315_PCI_INT_RXEOL    0x00000080      /* Desc Out EOL */
+#define AR2315_PCI_INT_TXOOD    0x00000200      /* Desc In Out-of-Desc */
+#define AR2315_PCI_INT_DESCMASK 0x0000FFFF      /* Desc Mask */
+#define AR2315_PCI_INT_EXT      0x02000000      /* Extern PCI INTA */
+#define AR2315_PCI_INT_ABORT    0x04000000      /* PCI bus abort event */
+
+/* PCI interrupt mask */
+#define AR2315_PCI_IMR                  0x0504
+
+/* Global PCI interrupt enable */
+#define AR2315_PCI_IER                  0x0508
+
+#define AR2315_PCI_IER_DISABLE          0x00    /* disable pci interrupts */
+#define AR2315_PCI_IER_ENABLE           0x01    /* enable pci interrupts */
+
+#define AR2315_PCI_HOST_IN_EN           0x0800
+#define AR2315_PCI_HOST_IN_DIS          0x0804
+#define AR2315_PCI_HOST_IN_PTR          0x0810
+#define AR2315_PCI_HOST_OUT_EN          0x0900
+#define AR2315_PCI_HOST_OUT_DIS         0x0904
+#define AR2315_PCI_HOST_OUT_PTR         0x0908
+
+/*
+ * PCI interrupts, which share IP5
+ * Keep ordered according to AR2315_PCI_INT_XXX bits
+ */
+#define AR2315_PCI_IRQ_EXT              25
+#define AR2315_PCI_IRQ_ABORT            26
+#define AR2315_PCI_IRQ_COUNT            27
+
+/* Arbitrary size of memory region to access the configuration space */
+#define AR2315_PCI_CFG_SIZE     0x00100000
+
+#define AR2315_PCI_HOST_SLOT    3
+#define AR2315_PCI_HOST_DEVID   ((0xff18 << 16) | PCI_VENDOR_ID_ATHEROS)
+
+/* ??? access BAR */
+#define AR2315_PCI_HOST_MBAR0           0x10000000
+/* RAM access BAR */
+#define AR2315_PCI_HOST_MBAR1           AR2315_PCI_HOST_SDRAM_BASEADDR
+/* ??? access BAR */
+#define AR2315_PCI_HOST_MBAR2           0x30000000
+
+struct ar2315_pci_ctrl {
+        void __iomem *cfg_mem;
+        void __iomem *mmr_mem;
+        unsigned irq;
+        unsigned irq_ext;
+        struct irq_domain *domain;
+        struct pci_controller pci_ctrl;
+        struct resource mem_res;
+        struct resource io_res;
+};
+
+static inline struct ar2315_pci_ctrl *ar2315_pci_bus_to_apc(struct pci_bus *bus)
+{
+        struct pci_controller *hose = bus->sysdata;
+
+        return container_of(hose, struct ar2315_pci_ctrl, pci_ctrl);
+}
+
+static inline u32 ar2315_pci_reg_read(struct ar2315_pci_ctrl *apc, u32 reg)
+{
+        return __raw_readl(apc->mmr_mem + reg);
+}
+
+static inline void ar2315_pci_reg_write(struct ar2315_pci_ctrl *apc, u32 reg,
+                                        u32 val)
+{
+        __raw_writel(val, apc->mmr_mem + reg);
+}
+
+static inline void ar2315_pci_reg_mask(struct ar2315_pci_ctrl *apc, u32 reg,
+                                       u32 mask, u32 val)
+{
+        u32 ret = ar2315_pci_reg_read(apc, reg);
+
+        ret &= ~mask;
+        ret |= val;
+        ar2315_pci_reg_write(apc, reg, ret);
+}
+
+static int ar2315_pci_cfg_access(struct ar2315_pci_ctrl *apc, unsigned devfn,
+                                 int where, int size, u32 *ptr, bool write)
+{
+        int func = PCI_FUNC(devfn);
+        int dev = PCI_SLOT(devfn);
+        u32 addr = (1 << (13 + dev)) | (func << 8) | (where & ~3);
+        u32 mask = 0xffffffff >> 8 * (4 - size);
+        u32 sh = (where & 3) * 8;
+        u32 value, isr;
+
+        /* Prevent access past the remapped area */
+        if (addr >= AR2315_PCI_CFG_SIZE || dev > 18)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+
+        /* Clear pending errors */
+        ar2315_pci_reg_write(apc, AR2315_PCI_ISR, AR2315_PCI_INT_ABORT);
+        /* Select Configuration access */
+        ar2315_pci_reg_mask(apc, AR2315_PCI_MISC_CONFIG, 0,
+                            AR2315_PCIMISC_CFG_SEL);
+
+        mb();   /* PCI must see space change before we begin */
+
+        value = __raw_readl(apc->cfg_mem + addr);
+
+        isr = ar2315_pci_reg_read(apc, AR2315_PCI_ISR);
+
+        if (isr & AR2315_PCI_INT_ABORT)
+                goto exit_err;
+
+        if (write) {
+                value = (value & ~(mask << sh)) | *ptr << sh;
+                __raw_writel(value, apc->cfg_mem + addr);
+                isr = ar2315_pci_reg_read(apc, AR2315_PCI_ISR);
+                if (isr & AR2315_PCI_INT_ABORT)
+                        goto exit_err;
+        } else {
+                *ptr = (value >> sh) & mask;
+        }
+
+        goto exit;
+
+exit_err:
+        ar2315_pci_reg_write(apc, AR2315_PCI_ISR, AR2315_PCI_INT_ABORT);
+        if (!write)
+                *ptr = 0xffffffff;
+
+exit:
+        /* Select Memory access */
+        ar2315_pci_reg_mask(apc, AR2315_PCI_MISC_CONFIG, AR2315_PCIMISC_CFG_SEL,
+                            0);
+
+        return isr & AR2315_PCI_INT_ABORT ? PCIBIOS_DEVICE_NOT_FOUND :
+                                            PCIBIOS_SUCCESSFUL;
+}
+
+static inline int ar2315_pci_local_cfg_rd(struct ar2315_pci_ctrl *apc,
+                                          unsigned devfn, int where, u32 *val)
+{
+        return ar2315_pci_cfg_access(apc, devfn, where, sizeof(u32), val,
+                                     false);
+}
+
+static inline int ar2315_pci_local_cfg_wr(struct ar2315_pci_ctrl *apc,
+                                          unsigned devfn, int where, u32 val)
+{
+        return ar2315_pci_cfg_access(apc, devfn, where, sizeof(u32), &val,
+                                     true);
+}
+
+static int ar2315_pci_cfg_read(struct pci_bus *bus, unsigned devfn, int where,
+                               int size, u32 *value)
+{
+        struct ar2315_pci_ctrl *apc = ar2315_pci_bus_to_apc(bus);
+
+        if (PCI_SLOT(devfn) == AR2315_PCI_HOST_SLOT)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+
+        return ar2315_pci_cfg_access(apc, devfn, where, size, value, false);
+}
+
+static int ar2315_pci_cfg_write(struct pci_bus *bus, unsigned devfn, int where,
+                                int size, u32 value)
+{
+        struct ar2315_pci_ctrl *apc = ar2315_pci_bus_to_apc(bus);
+
+        if (PCI_SLOT(devfn) == AR2315_PCI_HOST_SLOT)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+
+        return ar2315_pci_cfg_access(apc, devfn, where, size, &value, true);
+}
+
+static struct pci_ops ar2315_pci_ops = {
+        .read   = ar2315_pci_cfg_read,
+        .write  = ar2315_pci_cfg_write,
+};
+
+static int ar2315_pci_host_setup(struct ar2315_pci_ctrl *apc)
+{
+        unsigned devfn = PCI_DEVFN(AR2315_PCI_HOST_SLOT, 0);
+        int res;
+        u32 id;
+
+        res = ar2315_pci_local_cfg_rd(apc, devfn, PCI_VENDOR_ID, &id);
+        if (res != PCIBIOS_SUCCESSFUL || id != AR2315_PCI_HOST_DEVID)
+                return -ENODEV;
+
+        /* Program MBARs */
+        ar2315_pci_local_cfg_wr(apc, devfn, PCI_BASE_ADDRESS_0,
+                                AR2315_PCI_HOST_MBAR0);
+        ar2315_pci_local_cfg_wr(apc, devfn, PCI_BASE_ADDRESS_1,
+                                AR2315_PCI_HOST_MBAR1);
+        ar2315_pci_local_cfg_wr(apc, devfn, PCI_BASE_ADDRESS_2,
+                                AR2315_PCI_HOST_MBAR2);
+
+        /* Run */
+        ar2315_pci_local_cfg_wr(apc, devfn, PCI_COMMAND, PCI_COMMAND_MEMORY |
+                                PCI_COMMAND_MASTER | PCI_COMMAND_SPECIAL |
+                                PCI_COMMAND_INVALIDATE | PCI_COMMAND_PARITY |
+                                PCI_COMMAND_SERR | PCI_COMMAND_FAST_BACK);
+
+        return 0;
+}
+
+static void ar2315_pci_irq_handler(unsigned irq, struct irq_desc *desc)
+{
+        struct ar2315_pci_ctrl *apc = irq_get_handler_data(irq);
+        u32 pending = ar2315_pci_reg_read(apc, AR2315_PCI_ISR) &
+                      ar2315_pci_reg_read(apc, AR2315_PCI_IMR);
+        unsigned pci_irq = 0;
+
+        if (pending)
+                pci_irq = irq_find_mapping(apc->domain, __ffs(pending));
+
+        if (pci_irq)
+                generic_handle_irq(pci_irq);
+        else
+                spurious_interrupt();
+}
+
+static void ar2315_pci_irq_mask(struct irq_data *d)
+{
+        struct ar2315_pci_ctrl *apc = irq_data_get_irq_chip_data(d);
+
+        ar2315_pci_reg_mask(apc, AR2315_PCI_IMR, BIT(d->hwirq), 0);
+}
+
+static void ar2315_pci_irq_mask_ack(struct irq_data *d)
+{
+        struct ar2315_pci_ctrl *apc = irq_data_get_irq_chip_data(d);
+        u32 m = BIT(d->hwirq);
+
+        ar2315_pci_reg_mask(apc, AR2315_PCI_IMR, m, 0);
+        ar2315_pci_reg_write(apc, AR2315_PCI_ISR, m);
+}
+
+static void ar2315_pci_irq_unmask(struct irq_data *d)
+{
+        struct ar2315_pci_ctrl *apc = irq_data_get_irq_chip_data(d);
+
+        ar2315_pci_reg_mask(apc, AR2315_PCI_IMR, 0, BIT(d->hwirq));
+}
+
+static struct irq_chip ar2315_pci_irq_chip = {
+        .name = "AR2315-PCI",
+        .irq_mask = ar2315_pci_irq_mask,
+        .irq_mask_ack = ar2315_pci_irq_mask_ack,
+        .irq_unmask = ar2315_pci_irq_unmask,
+};
+
+static int ar2315_pci_irq_map(struct irq_domain *d, unsigned irq,
+                              irq_hw_number_t hw)
+{
+        irq_set_chip_and_handler(irq, &ar2315_pci_irq_chip, handle_level_irq);
+        irq_set_chip_data(irq, d->host_data);
+        return 0;
+}
+
+static struct irq_domain_ops ar2315_pci_irq_domain_ops = {
+        .map = ar2315_pci_irq_map,
+};
+
+static void ar2315_pci_irq_init(struct ar2315_pci_ctrl *apc)
+{
+        ar2315_pci_reg_mask(apc, AR2315_PCI_IER, AR2315_PCI_IER_ENABLE, 0);
+        ar2315_pci_reg_mask(apc, AR2315_PCI_IMR, (AR2315_PCI_INT_ABORT |
+                            AR2315_PCI_INT_EXT), 0);
+
+        apc->irq_ext = irq_create_mapping(apc->domain, AR2315_PCI_IRQ_EXT);
+
+        irq_set_chained_handler(apc->irq, ar2315_pci_irq_handler);
+        irq_set_handler_data(apc->irq, apc);
+
+        /* Clear any pending Abort or external Interrupts
+         * and enable interrupt processing */
+        ar2315_pci_reg_write(apc, AR2315_PCI_ISR, AR2315_PCI_INT_ABORT |
+                                                  AR2315_PCI_INT_EXT);
+        ar2315_pci_reg_mask(apc, AR2315_PCI_IER, 0, AR2315_PCI_IER_ENABLE);
+}
+
+static int ar2315_pci_probe(struct platform_device *pdev)
+{
+        struct ar2315_pci_ctrl *apc;
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        int irq, err;
+
+        apc = devm_kzalloc(dev, sizeof(*apc), GFP_KERNEL);
+        if (!apc)
+                return -ENOMEM;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0)
+                return -EINVAL;
+        apc->irq = irq;
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+                                           "ar2315-pci-ctrl");
+        apc->mmr_mem = devm_ioremap_resource(dev, res);
+        if (IS_ERR(apc->mmr_mem))
+                return PTR_ERR(apc->mmr_mem);
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+                                           "ar2315-pci-ext");
+        if (!res)
+                return -EINVAL;
+
+        apc->mem_res.name = "AR2315 PCI mem space";
+        apc->mem_res.parent = res;
+        apc->mem_res.start = res->start;
+        apc->mem_res.end = res->end;
+        apc->mem_res.flags = IORESOURCE_MEM;
+
+        /* Remap PCI config space */
+        apc->cfg_mem = devm_ioremap_nocache(dev, res->start,
+                                            AR2315_PCI_CFG_SIZE);
+        if (!apc->cfg_mem) {
+                dev_err(dev, "failed to remap PCI config space\n");
+                return -ENOMEM;
+        }
+
+        /* Reset the PCI bus by setting bits 5-4 in PCI_MCFG */
+        ar2315_pci_reg_mask(apc, AR2315_PCI_MISC_CONFIG,
+                            AR2315_PCIMISC_RST_MODE,
+                            AR2315_PCIRST_LOW);
+        msleep(100);
+
+        /* Bring the PCI out of reset */
+        ar2315_pci_reg_mask(apc, AR2315_PCI_MISC_CONFIG,
+                            AR2315_PCIMISC_RST_MODE,
+                            AR2315_PCIRST_HIGH | AR2315_PCICACHE_DIS | 0x8);
+
+        ar2315_pci_reg_write(apc, AR2315_PCI_UNCACHE_CFG,
+                             0x1E | /* 1GB uncached */
+                             (1 << 5) | /* Enable uncached */
+                             (0x2 << 30) /* Base: 0x80000000 */);
+        ar2315_pci_reg_read(apc, AR2315_PCI_UNCACHE_CFG);
+
+        msleep(500);
+
+        err = ar2315_pci_host_setup(apc);
+        if (err)
+                return err;
+
+        apc->domain = irq_domain_add_linear(NULL, AR2315_PCI_IRQ_COUNT,
+                                            &ar2315_pci_irq_domain_ops, apc);
+        if (!apc->domain) {
+                dev_err(dev, "failed to add IRQ domain\n");
+                return -ENOMEM;
+        }
+
+        ar2315_pci_irq_init(apc);
+
+        /* PCI controller does not support I/O ports */
+        apc->io_res.name = "AR2315 IO space";
+        apc->io_res.start = 0;
+        apc->io_res.end = 0;
+        apc->io_res.flags = IORESOURCE_IO,
+
+        apc->pci_ctrl.pci_ops = &ar2315_pci_ops;
+        apc->pci_ctrl.mem_resource = &apc->mem_res,
+        apc->pci_ctrl.io_resource = &apc->io_res,
+
+        register_pci_controller(&apc->pci_ctrl);
+
+        dev_info(dev, "register PCI controller\n");
+
+        return 0;
+}
+
+static struct platform_driver ar2315_pci_driver = {
+        .probe = ar2315_pci_probe,
+        .driver = {
+                .name = "ar2315-pci",
+                .owner = THIS_MODULE,
+        },
+};
+
+static int __init ar2315_pci_init(void)
+{
+        return platform_driver_register(&ar2315_pci_driver);
+}
+arch_initcall(ar2315_pci_init);
+
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+{
+        struct ar2315_pci_ctrl *apc = ar2315_pci_bus_to_apc(dev->bus);
+
+        return slot ? 0 : apc->irq_ext;
+}
+
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+        return 0;
+}
diff --git a/arch/mips/pci/pci-ar71xx.c b/arch/mips/pci/pci-ar71xx.c
index d471a26dd5f8..2b534aea20e4 100644
--- a/arch/mips/pci/pci-ar71xx.c
+++ b/arch/mips/pci/pci-ar71xx.c
@@ -50,7 +50,6 @@
 
 struct ar71xx_pci_controller {
         void __iomem *cfg_base;
-        spinlock_t lock;
         int irq;
         int irq_base;
         struct pci_controller pci_ctrl;
@@ -182,7 +181,6 @@ static int ar71xx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
 {
         struct ar71xx_pci_controller *apc = pci_bus_to_ar71xx_controller(bus);
         void __iomem *base = apc->cfg_base;
-        unsigned long flags;
         u32 data;
         int err;
         int ret;
@@ -190,8 +188,6 @@ static int ar71xx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
         ret = PCIBIOS_SUCCESSFUL;
         data = ~0;
 
-        spin_lock_irqsave(&apc->lock, flags);
-
         err = ar71xx_pci_set_cfgaddr(bus, devfn, where, size,
                                      AR71XX_PCI_CFG_CMD_READ);
         if (err)
@@ -199,8 +195,6 @@ static int ar71xx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
         else
                 data = __raw_readl(base + AR71XX_PCI_REG_CFG_RDDATA);
 
-        spin_unlock_irqrestore(&apc->lock, flags);
-
         *value = (data >> (8 * (where & 3))) & ar71xx_pci_read_mask[size & 7];
 
         return ret;
@@ -211,15 +205,12 @@ static int ar71xx_pci_write_config(struct pci_bus *bus, unsigned int devfn,
 {
         struct ar71xx_pci_controller *apc = pci_bus_to_ar71xx_controller(bus);
         void __iomem *base = apc->cfg_base;
-        unsigned long flags;
         int err;
         int ret;
 
         value = value << (8 * (where & 3));
         ret = PCIBIOS_SUCCESSFUL;
 
-        spin_lock_irqsave(&apc->lock, flags);
-
         err = ar71xx_pci_set_cfgaddr(bus, devfn, where, size,
                                      AR71XX_PCI_CFG_CMD_WRITE);
         if (err)
@@ -227,8 +218,6 @@ static int ar71xx_pci_write_config(struct pci_bus *bus, unsigned int devfn,
         else
                 __raw_writel(value, base + AR71XX_PCI_REG_CFG_WRDATA);
 
-        spin_unlock_irqrestore(&apc->lock, flags);
-
         return ret;
 }
 
@@ -360,8 +349,6 @@ static int ar71xx_pci_probe(struct platform_device *pdev)
         if (!apc)
                 return -ENOMEM;
 
-        spin_lock_init(&apc->lock);
-
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cfg_base");
         apc->cfg_base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(apc->cfg_base))
diff --git a/arch/mips/pci/pci-ar724x.c b/arch/mips/pci/pci-ar724x.c
index 785b2659b519..b7a6fcbb8852 100644
--- a/arch/mips/pci/pci-ar724x.c
+++ b/arch/mips/pci/pci-ar724x.c
@@ -9,7 +9,6 @@
  *  by the Free Software Foundation.
  */
 
-#include <linux/spinlock.h>
 #include <linux/irq.h>
 #include <linux/pci.h>
 #include <linux/module.h>
@@ -48,8 +47,6 @@ struct ar724x_pci_controller {
         bool bar0_is_cached;
         u32  bar0_value;
 
-        spinlock_t lock;
-
         struct pci_controller pci_controller;
         struct resource io_res;
         struct resource mem_res;
@@ -75,7 +72,6 @@ pci_bus_to_ar724x_controller(struct pci_bus *bus)
 static int ar724x_pci_local_write(struct ar724x_pci_controller *apc,
                                   int where, int size, u32 value)
 {
-        unsigned long flags;
         void __iomem *base;
         u32 data;
         int s;
@@ -86,8 +82,6 @@ static int ar724x_pci_local_write(struct ar724x_pci_controller *apc,
                 return PCIBIOS_DEVICE_NOT_FOUND;
 
         base = apc->crp_base;
-
-        spin_lock_irqsave(&apc->lock, flags);
         data = __raw_readl(base + (where & ~3));
 
         switch (size) {
@@ -105,14 +99,12 @@ static int ar724x_pci_local_write(struct ar724x_pci_controller *apc,
                 data = value;
                 break;
         default:
-                spin_unlock_irqrestore(&apc->lock, flags);
                 return PCIBIOS_BAD_REGISTER_NUMBER;
         }
 
         __raw_writel(data, base + (where & ~3));
         /* flush write */
         __raw_readl(base + (where & ~3));
-        spin_unlock_irqrestore(&apc->lock, flags);
 
         return PCIBIOS_SUCCESSFUL;
 }
@@ -121,7 +113,6 @@ static int ar724x_pci_read(struct pci_bus *bus, unsigned int devfn, int where,
                             int size, uint32_t *value)
 {
         struct ar724x_pci_controller *apc;
-        unsigned long flags;
         void __iomem *base;
         u32 data;
 
@@ -133,8 +124,6 @@ static int ar724x_pci_read(struct pci_bus *bus, unsigned int devfn, int where,
                 return PCIBIOS_DEVICE_NOT_FOUND;
 
         base = apc->devcfg_base;
-
-        spin_lock_irqsave(&apc->lock, flags);
         data = __raw_readl(base + (where & ~3));
 
         switch (size) {
@@ -153,13 +142,9 @@ static int ar724x_pci_read(struct pci_bus *bus, unsigned int devfn, int where,
         case 4:
                 break;
         default:
-                spin_unlock_irqrestore(&apc->lock, flags);
-
                 return PCIBIOS_BAD_REGISTER_NUMBER;
         }
 
-        spin_unlock_irqrestore(&apc->lock, flags);
-
         if (where == PCI_BASE_ADDRESS_0 && size == 4 &&
             apc->bar0_is_cached) {
                 /* use the cached value */
@@ -175,7 +160,6 @@ static int ar724x_pci_write(struct pci_bus *bus, unsigned int devfn, int where,
                              int size, uint32_t value)
 {
         struct ar724x_pci_controller *apc;
-        unsigned long flags;
         void __iomem *base;
         u32 data;
         int s;
@@ -209,8 +193,6 @@ static int ar724x_pci_write(struct pci_bus *bus, unsigned int devfn, int where,
         }
 
         base = apc->devcfg_base;
-
-        spin_lock_irqsave(&apc->lock, flags);
         data = __raw_readl(base + (where & ~3));
 
         switch (size) {
@@ -228,15 +210,12 @@ static int ar724x_pci_write(struct pci_bus *bus, unsigned int devfn, int where,
                 data = value;
                 break;
         default:
-                spin_unlock_irqrestore(&apc->lock, flags);
-
                 return PCIBIOS_BAD_REGISTER_NUMBER;
         }
 
         __raw_writel(data, base + (where & ~3));
         /* flush write */
         __raw_readl(base + (where & ~3));
-        spin_unlock_irqrestore(&apc->lock, flags);
 
         return PCIBIOS_SUCCESSFUL;
 }
@@ -380,8 +359,6 @@ static int ar724x_pci_probe(struct platform_device *pdev)
         if (apc->irq < 0)
                 return -EINVAL;
 
-        spin_lock_init(&apc->lock);
-
         res = platform_get_resource_byname(pdev, IORESOURCE_IO, "io_base");
         if (!res)
                 return -EINVAL;
diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
index 59cccd95688b..d07e04121cc6 100644
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
@@ -708,7 +708,7 @@ static int __init octeon_pci_setup(void)
 
         if (IS_ERR(platform_device_register_simple("octeon_pci_edac",
                                                    -1, NULL, 0)))
-                pr_err("Registation of co_pci_edac failed!\n");
+                pr_err("Registration of co_pci_edac failed!\n");
 
         octeon_pci_dma_init();
 
diff --git a/arch/mips/pci/pci-rt2880.c b/arch/mips/pci/pci-rt2880.c
new file mode 100644
index 000000000000..a4574947e698
--- /dev/null
+++ b/arch/mips/pci/pci-rt2880.c
@@ -0,0 +1,285 @@
+/*
+ *  Ralink RT288x SoC PCI register definitions
+ *
+ *  Copyright (C) 2009 John Crispin <blogic@openwrt.org>
+ *  Copyright (C) 2009 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  Parts of this file are based on Ralink's 2.6.21 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/io.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/of_irq.h>
+#include <linux/of_pci.h>
+
+#include <asm/mach-ralink/rt288x.h>
+
+#define RT2880_PCI_BASE         0x00440000
+#define RT288X_CPU_IRQ_PCI      4
+
+#define RT2880_PCI_MEM_BASE     0x20000000
+#define RT2880_PCI_MEM_SIZE     0x10000000
+#define RT2880_PCI_IO_BASE      0x00460000
+#define RT2880_PCI_IO_SIZE      0x00010000
+
+#define RT2880_PCI_REG_PCICFG_ADDR      0x00
+#define RT2880_PCI_REG_PCIMSK_ADDR      0x0c
+#define RT2880_PCI_REG_BAR0SETUP_ADDR   0x10
+#define RT2880_PCI_REG_IMBASEBAR0_ADDR  0x18
+#define RT2880_PCI_REG_CONFIG_ADDR      0x20
+#define RT2880_PCI_REG_CONFIG_DATA      0x24
+#define RT2880_PCI_REG_MEMBASE          0x28
+#define RT2880_PCI_REG_IOBASE           0x2c
+#define RT2880_PCI_REG_ID               0x30
+#define RT2880_PCI_REG_CLASS            0x34
+#define RT2880_PCI_REG_SUBID            0x38
+#define RT2880_PCI_REG_ARBCTL           0x80
+
+static void __iomem *rt2880_pci_base;
+static DEFINE_SPINLOCK(rt2880_pci_lock);
+
+static u32 rt2880_pci_reg_read(u32 reg)
+{
+        return readl(rt2880_pci_base + reg);
+}
+
+static void rt2880_pci_reg_write(u32 val, u32 reg)
+{
+        writel(val, rt2880_pci_base + reg);
+}
+
+static inline u32 rt2880_pci_get_cfgaddr(unsigned int bus, unsigned int slot,
+                                         unsigned int func, unsigned int where)
+{
+        return ((bus << 16) | (slot << 11) | (func << 8) | (where & 0xfc) |
+                0x80000000);
+}
+
+static int rt2880_pci_config_read(struct pci_bus *bus, unsigned int devfn,
+                                  int where, int size, u32 *val)
+{
+        unsigned long flags;
+        u32 address;
+        u32 data;
+
+        address = rt2880_pci_get_cfgaddr(bus->number, PCI_SLOT(devfn),
+                                         PCI_FUNC(devfn), where);
+
+        spin_lock_irqsave(&rt2880_pci_lock, flags);
+        rt2880_pci_reg_write(address, RT2880_PCI_REG_CONFIG_ADDR);
+        data = rt2880_pci_reg_read(RT2880_PCI_REG_CONFIG_DATA);
+        spin_unlock_irqrestore(&rt2880_pci_lock, flags);
+
+        switch (size) {
+        case 1:
+                *val = (data >> ((where & 3) << 3)) & 0xff;
+                break;
+        case 2:
+                *val = (data >> ((where & 3) << 3)) & 0xffff;
+                break;
+        case 4:
+                *val = data;
+                break;
+        }
+
+        return PCIBIOS_SUCCESSFUL;
+}
+
+static int rt2880_pci_config_write(struct pci_bus *bus, unsigned int devfn,
+                                   int where, int size, u32 val)
+{
+        unsigned long flags;
+        u32 address;
+        u32 data;
+
+        address = rt2880_pci_get_cfgaddr(bus->number, PCI_SLOT(devfn),
+                                         PCI_FUNC(devfn), where);
+
+        spin_lock_irqsave(&rt2880_pci_lock, flags);
+        rt2880_pci_reg_write(address, RT2880_PCI_REG_CONFIG_ADDR);
+        data = rt2880_pci_reg_read(RT2880_PCI_REG_CONFIG_DATA);
+
+        switch (size) {
+        case 1:
+                data = (data & ~(0xff << ((where & 3) << 3))) |
+                       (val << ((where & 3) << 3));
+                break;
+        case 2:
+                data = (data & ~(0xffff << ((where & 3) << 3))) |
+                       (val << ((where & 3) << 3));
+                break;
+        case 4:
+                data = val;
+                break;
+        }
+
+        rt2880_pci_reg_write(data, RT2880_PCI_REG_CONFIG_DATA);
+        spin_unlock_irqrestore(&rt2880_pci_lock, flags);
+
+        return PCIBIOS_SUCCESSFUL;
+}
+
+static struct pci_ops rt2880_pci_ops = {
+        .read   = rt2880_pci_config_read,
+        .write  = rt2880_pci_config_write,
+};
+
+static struct resource rt2880_pci_mem_resource = {
+        .name   = "PCI MEM space",
+        .start  = RT2880_PCI_MEM_BASE,
+        .end    = RT2880_PCI_MEM_BASE + RT2880_PCI_MEM_SIZE - 1,
+        .flags  = IORESOURCE_MEM,
+};
+
+static struct resource rt2880_pci_io_resource = {
+        .name   = "PCI IO space",
+        .start  = RT2880_PCI_IO_BASE,
+        .end    = RT2880_PCI_IO_BASE + RT2880_PCI_IO_SIZE - 1,
+        .flags  = IORESOURCE_IO,
+};
+
+static struct pci_controller rt2880_pci_controller = {
+        .pci_ops        = &rt2880_pci_ops,
+        .mem_resource   = &rt2880_pci_mem_resource,
+        .io_resource    = &rt2880_pci_io_resource,
+};
+
+static inline u32 rt2880_pci_read_u32(unsigned long reg)
+{
+        unsigned long flags;
+        u32 address;
+        u32 ret;
+
+        address = rt2880_pci_get_cfgaddr(0, 0, 0, reg);
+
+        spin_lock_irqsave(&rt2880_pci_lock, flags);
+        rt2880_pci_reg_write(address, RT2880_PCI_REG_CONFIG_ADDR);
+        ret = rt2880_pci_reg_read(RT2880_PCI_REG_CONFIG_DATA);
+        spin_unlock_irqrestore(&rt2880_pci_lock, flags);
+
+        return ret;
+}
+
+static inline void rt2880_pci_write_u32(unsigned long reg, u32 val)
+{
+        unsigned long flags;
+        u32 address;
+
+        address = rt2880_pci_get_cfgaddr(0, 0, 0, reg);
+
+        spin_lock_irqsave(&rt2880_pci_lock, flags);
+        rt2880_pci_reg_write(address, RT2880_PCI_REG_CONFIG_ADDR);
+        rt2880_pci_reg_write(val, RT2880_PCI_REG_CONFIG_DATA);
+        spin_unlock_irqrestore(&rt2880_pci_lock, flags);
+}
+
+int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+{
+        u16 cmd;
+        int irq = -1;
+
+        if (dev->bus->number != 0)
+                return irq;
+
+        switch (PCI_SLOT(dev->devfn)) {
+        case 0x00:
+                rt2880_pci_write_u32(PCI_BASE_ADDRESS_0, 0x08000000);
+                (void) rt2880_pci_read_u32(PCI_BASE_ADDRESS_0);
+                break;
+        case 0x11:
+                irq = RT288X_CPU_IRQ_PCI;
+                break;
+        default:
+                pr_err("%s:%s[%d] trying to alloc unknown pci irq\n",
+                       __FILE__, __func__, __LINE__);
+                BUG();
+                break;
+        }
+
+        pci_write_config_byte((struct pci_dev *) dev,
+                PCI_CACHE_LINE_SIZE, 0x14);
+        pci_write_config_byte((struct pci_dev *) dev, PCI_LATENCY_TIMER, 0xFF);
+        pci_read_config_word((struct pci_dev *) dev, PCI_COMMAND, &cmd);
+        cmd |= PCI_COMMAND_MASTER | PCI_COMMAND_IO | PCI_COMMAND_MEMORY |
+                PCI_COMMAND_INVALIDATE | PCI_COMMAND_FAST_BACK |
+                PCI_COMMAND_SERR | PCI_COMMAND_WAIT | PCI_COMMAND_PARITY;
+        pci_write_config_word((struct pci_dev *) dev, PCI_COMMAND, cmd);
+        pci_write_config_byte((struct pci_dev *) dev, PCI_INTERRUPT_LINE,
+                              dev->irq);
+        return irq;
+}
+
+static int rt288x_pci_probe(struct platform_device *pdev)
+{
+        void __iomem *io_map_base;
+        int i;
+
+        rt2880_pci_base = ioremap_nocache(RT2880_PCI_BASE, PAGE_SIZE);
+
+        io_map_base = ioremap(RT2880_PCI_IO_BASE, RT2880_PCI_IO_SIZE);
+        rt2880_pci_controller.io_map_base = (unsigned long) io_map_base;
+        set_io_port_base((unsigned long) io_map_base);
+
+        ioport_resource.start = RT2880_PCI_IO_BASE;
+        ioport_resource.end = RT2880_PCI_IO_BASE + RT2880_PCI_IO_SIZE - 1;
+
+        rt2880_pci_reg_write(0, RT2880_PCI_REG_PCICFG_ADDR);
+        for (i = 0; i < 0xfffff; i++)
+                ;
+
+        rt2880_pci_reg_write(0x79, RT2880_PCI_REG_ARBCTL);
+        rt2880_pci_reg_write(0x07FF0001, RT2880_PCI_REG_BAR0SETUP_ADDR);
+        rt2880_pci_reg_write(RT2880_PCI_MEM_BASE, RT2880_PCI_REG_MEMBASE);
+        rt2880_pci_reg_write(RT2880_PCI_IO_BASE, RT2880_PCI_REG_IOBASE);
+        rt2880_pci_reg_write(0x08000000, RT2880_PCI_REG_IMBASEBAR0_ADDR);
+        rt2880_pci_reg_write(0x08021814, RT2880_PCI_REG_ID);
+        rt2880_pci_reg_write(0x00800001, RT2880_PCI_REG_CLASS);
+        rt2880_pci_reg_write(0x28801814, RT2880_PCI_REG_SUBID);
+        rt2880_pci_reg_write(0x000c0000, RT2880_PCI_REG_PCIMSK_ADDR);
+
+        rt2880_pci_write_u32(PCI_BASE_ADDRESS_0, 0x08000000);
+        (void) rt2880_pci_read_u32(PCI_BASE_ADDRESS_0);
+
+        register_pci_controller(&rt2880_pci_controller);
+        return 0;
+}
+
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+        return 0;
+}
+
+static const struct of_device_id rt288x_pci_match[] = {
+        { .compatible = "ralink,rt288x-pci" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, rt288x_pci_match);
+
+static struct platform_driver rt288x_pci_driver = {
+        .probe = rt288x_pci_probe,
+        .driver = {
+                .name = "rt288x-pci",
+                .owner = THIS_MODULE,
+                .of_match_table = rt288x_pci_match,
+        },
+};
+
+int __init pcibios_init(void)
+{
+        int ret = platform_driver_register(&rt288x_pci_driver);
+
+        if (ret)
+                pr_info("rt288x-pci: Error registering platform driver!");
+
+        return ret;
+}
+
+arch_initcall(pcibios_init);
diff --git a/arch/mips/pci/pci-rt3883.c b/arch/mips/pci/pci-rt3883.c
index 72919aeef42b..0bcc0b1cfddc 100644
--- a/arch/mips/pci/pci-rt3883.c
+++ b/arch/mips/pci/pci-rt3883.c
@@ -61,7 +61,6 @@
 
 struct rt3883_pci_controller {
         void __iomem *base;
-        spinlock_t lock;
 
         struct device_node *intc_of_node;
         struct irq_domain *irq_domain;
@@ -111,10 +110,8 @@ static u32 rt3883_pci_read_cfg32(struct rt3883_pci_controller *rpc,
 
         address = rt3883_pci_get_cfgaddr(bus, slot, func, reg);
 
-        spin_lock_irqsave(&rpc->lock, flags);
         rt3883_pci_w32(rpc, address, RT3883_PCI_REG_CFGADDR);
         ret = rt3883_pci_r32(rpc, RT3883_PCI_REG_CFGDATA);
-        spin_unlock_irqrestore(&rpc->lock, flags);
 
         return ret;
 }
@@ -128,10 +125,8 @@ static void rt3883_pci_write_cfg32(struct rt3883_pci_controller *rpc,
 
         address = rt3883_pci_get_cfgaddr(bus, slot, func, reg);
 
-        spin_lock_irqsave(&rpc->lock, flags);
         rt3883_pci_w32(rpc, address, RT3883_PCI_REG_CFGADDR);
         rt3883_pci_w32(rpc, val, RT3883_PCI_REG_CFGDATA);
-        spin_unlock_irqrestore(&rpc->lock, flags);
 }
 
 static void rt3883_pci_irq_handler(unsigned int irq, struct irq_desc *desc)
@@ -252,10 +247,8 @@ static int rt3883_pci_config_read(struct pci_bus *bus, unsigned int devfn,
         address = rt3883_pci_get_cfgaddr(bus->number, PCI_SLOT(devfn),
                                          PCI_FUNC(devfn), where);
 
-        spin_lock_irqsave(&rpc->lock, flags);
         rt3883_pci_w32(rpc, address, RT3883_PCI_REG_CFGADDR);
         data = rt3883_pci_r32(rpc, RT3883_PCI_REG_CFGDATA);
-        spin_unlock_irqrestore(&rpc->lock, flags);
 
         switch (size) {
         case 1:
@@ -288,7 +281,6 @@ static int rt3883_pci_config_write(struct pci_bus *bus, unsigned int devfn,
         address = rt3883_pci_get_cfgaddr(bus->number, PCI_SLOT(devfn),
                                          PCI_FUNC(devfn), where);
 
-        spin_lock_irqsave(&rpc->lock, flags);
         rt3883_pci_w32(rpc, address, RT3883_PCI_REG_CFGADDR);
         data = rt3883_pci_r32(rpc, RT3883_PCI_REG_CFGDATA);
 
@@ -307,7 +299,6 @@ static int rt3883_pci_config_write(struct pci_bus *bus, unsigned int devfn,
         }
 
         rt3883_pci_w32(rpc, data, RT3883_PCI_REG_CFGDATA);
-        spin_unlock_irqrestore(&rpc->lock, flags);
 
         return PCIBIOS_SUCCESSFUL;
 }
diff --git a/arch/mips/pci/pci-tx4939.c b/arch/mips/pci/pci-tx4939.c
index c10fbf2a19dc..cd8ed09c4f53 100644
--- a/arch/mips/pci/pci-tx4939.c
+++ b/arch/mips/pci/pci-tx4939.c
@@ -103,5 +103,5 @@ void __init tx4939_setup_pcierr_irq(void)
                         tx4927_pcierr_interrupt,
                         0, "PCI error",
                         (void *)TX4939_PCIC_REG))
-                pr_warning("Failed to request irq for PCIERR\n");
+                pr_warn("Failed to request irq for PCIERR\n");
 }
diff --git a/arch/mips/pmcs-msp71xx/msp_prom.c b/arch/mips/pmcs-msp71xx/msp_prom.c
index 1c9897531660..ef620a4c82a5 100644
--- a/arch/mips/pmcs-msp71xx/msp_prom.c
+++ b/arch/mips/pmcs-msp71xx/msp_prom.c
@@ -295,7 +295,7 @@ char *prom_getenv(char *env_name)
 
         while (*var) {
                 if (strncmp(env_name, *var, i) == 0) {
-                        return (*var + strlen(env_name) + 1);
+                        return *var + strlen(env_name) + 1;
                 }
                 var++;
         }
diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig
index 77e8a9620e18..b1c52ca580f9 100644
--- a/arch/mips/ralink/Kconfig
+++ b/arch/mips/ralink/Kconfig
@@ -16,6 +16,7 @@ choice
         config SOC_RT288X
                 bool "RT288x"
                 select MIPS_L1_CACHE_SHIFT_4
+                select HW_HAS_PCI
 
         config SOC_RT305X
                 bool "RT305x"
@@ -26,7 +27,7 @@ choice
                 select HW_HAS_PCI
 
         config SOC_MT7620
-                bool "MT7620"
+                bool "MT7620/8"
 
 endchoice
 
diff --git a/arch/mips/ralink/Makefile b/arch/mips/ralink/Makefile
index 2c09c8aa0ae2..a6c9d0061326 100644
--- a/arch/mips/ralink/Makefile
+++ b/arch/mips/ralink/Makefile
@@ -10,9 +10,13 @@ obj-y := prom.o of.o reset.o clk.o irq.o timer.o
 
 obj-$(CONFIG_CLKEVT_RT3352) += cevt-rt3352.o
 
+obj-$(CONFIG_RALINK_ILL_ACC) += ill_acc.o
+
 obj-$(CONFIG_SOC_RT288X) += rt288x.o
 obj-$(CONFIG_SOC_RT305X) += rt305x.o
 obj-$(CONFIG_SOC_RT3883) += rt3883.o
 obj-$(CONFIG_SOC_MT7620) += mt7620.o
 
 obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+
+obj-$(CONFIG_DEBUG_FS) += bootrom.o
diff --git a/arch/mips/ralink/bootrom.c b/arch/mips/ralink/bootrom.c
new file mode 100644
index 000000000000..5403468394fb
--- /dev/null
+++ b/arch/mips/ralink/bootrom.c
@@ -0,0 +1,48 @@
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * Copyright (C) 2013 John Crispin <blogic@openwrt.org>
+ */
+
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+#define BOOTROM_OFFSET  0x10118000
+#define BOOTROM_SIZE    0x8000
+
+static void __iomem *membase = (void __iomem *) KSEG1ADDR(BOOTROM_OFFSET);
+
+static int bootrom_show(struct seq_file *s, void *unused)
+{
+        seq_write(s, membase, BOOTROM_SIZE);
+
+        return 0;
+}
+
+static int bootrom_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, bootrom_show, NULL);
+}
+
+static const struct file_operations bootrom_file_ops = {
+        .open           = bootrom_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int bootrom_setup(void)
+{
+        if (!debugfs_create_file("bootrom", 0444,
+                        NULL, NULL, &bootrom_file_ops)) {
+                pr_err("Failed to create bootrom debugfs file\n");
+
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+postcore_initcall(bootrom_setup);
diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
index 5d0983d47161..feb5a9bf98b4 100644
--- a/arch/mips/ralink/clk.c
+++ b/arch/mips/ralink/clk.c
@@ -56,6 +56,12 @@ unsigned long clk_get_rate(struct clk *clk)
 }
 EXPORT_SYMBOL_GPL(clk_get_rate);
 
+int clk_set_rate(struct clk *clk, unsigned long rate)
+{
+        return -1;
+}
+EXPORT_SYMBOL_GPL(clk_set_rate);
+
 void __init plat_time_init(void)
 {
         struct clk *clk;
diff --git a/arch/mips/ralink/common.h b/arch/mips/ralink/common.h
index 42dfd6100a2d..8e7d8e618fb9 100644
--- a/arch/mips/ralink/common.h
+++ b/arch/mips/ralink/common.h
@@ -11,25 +11,6 @@
 
 #define RAMIPS_SYS_TYPE_LEN     32
 
-struct ralink_pinmux_grp {
-        const char *name;
-        u32 mask;
-        int gpio_first;
-        int gpio_last;
-};
-
-struct ralink_pinmux {
-        struct ralink_pinmux_grp *mode;
-        struct ralink_pinmux_grp *uart;
-        int uart_shift;
-        u32 uart_mask;
-        void (*wdt_reset)(void);
-        struct ralink_pinmux_grp *pci;
-        int pci_shift;
-        u32 pci_mask;
-};
-extern struct ralink_pinmux rt_gpio_pinmux;
-
 struct ralink_soc_info {
         unsigned char sys_type[RAMIPS_SYS_TYPE_LEN];
         unsigned char *compatible;
diff --git a/arch/mips/ralink/early_printk.c b/arch/mips/ralink/early_printk.c
index b46d0419d09b..255d695ec8c6 100644
--- a/arch/mips/ralink/early_printk.c
+++ b/arch/mips/ralink/early_printk.c
@@ -12,21 +12,24 @@
 #include <asm/addrspace.h>
 
 #ifdef CONFIG_SOC_RT288X
-#define EARLY_UART_BASE         0x300c00
+#define EARLY_UART_BASE         0x300c00
+#define CHIPID_BASE             0x300004
+#elif defined(CONFIG_SOC_MT7621)
+#define EARLY_UART_BASE         0x1E000c00
+#define CHIPID_BASE             0x1E000004
 #else
-#define EARLY_UART_BASE         0x10000c00
+#define EARLY_UART_BASE         0x10000c00
+#define CHIPID_BASE             0x10000004
 #endif
 
-#define UART_REG_RX             0x00
-#define UART_REG_TX             0x04
-#define UART_REG_IER            0x08
-#define UART_REG_IIR            0x0c
-#define UART_REG_FCR            0x10
-#define UART_REG_LCR            0x14
-#define UART_REG_MCR            0x18
-#define UART_REG_LSR            0x1c
+#define MT7628_CHIP_NAME1       0x20203832
+
+#define UART_REG_TX             0x04
+#define UART_REG_LSR            0x14
+#define UART_REG_LSR_RT2880     0x1c
 
 static __iomem void *uart_membase = (__iomem void *) KSEG1ADDR(EARLY_UART_BASE);
+static __iomem void *chipid_membase = (__iomem void *) KSEG1ADDR(CHIPID_BASE);
 
 static inline void uart_w32(u32 val, unsigned reg)
 {
@@ -38,11 +41,23 @@ static inline u32 uart_r32(unsigned reg)
         return __raw_readl(uart_membase + reg);
 }
 
+static inline int soc_is_mt7628(void)
+{
+        return IS_ENABLED(CONFIG_SOC_MT7620) &&
+                (__raw_readl(chipid_membase) == MT7628_CHIP_NAME1);
+}
+
 void prom_putchar(unsigned char ch)
 {
-        while ((uart_r32(UART_REG_LSR) & UART_LSR_THRE) == 0)
-                ;
-        uart_w32(ch, UART_REG_TX);
-        while ((uart_r32(UART_REG_LSR) & UART_LSR_THRE) == 0)
-                ;
+        if (IS_ENABLED(CONFIG_SOC_MT7621) || soc_is_mt7628()) {
+                uart_w32(ch, UART_TX);
+                while ((uart_r32(UART_REG_LSR) & UART_LSR_THRE) == 0)
+                        ;
+        } else {
+                while ((uart_r32(UART_REG_LSR_RT2880) & UART_LSR_THRE) == 0)
+                        ;
+                uart_w32(ch, UART_REG_TX);
+                while ((uart_r32(UART_REG_LSR_RT2880) & UART_LSR_THRE) == 0)
+                        ;
+        }
 }
diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c
new file mode 100644
index 000000000000..e20b02e3ae28
--- /dev/null
+++ b/arch/mips/ralink/ill_acc.c
@@ -0,0 +1,87 @@
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * Copyright (C) 2013 John Crispin <blogic@openwrt.org>
+ */
+
+#include <linux/interrupt.h>
+#include <linux/of_platform.h>
+#include <linux/of_irq.h>
+
+#include <asm/mach-ralink/ralink_regs.h>
+
+#define REG_ILL_ACC_ADDR        0x10
+#define REG_ILL_ACC_TYPE        0x14
+
+#define ILL_INT_STATUS          BIT(31)
+#define ILL_ACC_WRITE           BIT(30)
+#define ILL_ACC_LEN_M           0xff
+#define ILL_ACC_OFF_M           0xf
+#define ILL_ACC_OFF_S           16
+#define ILL_ACC_ID_M            0x7
+#define ILL_ACC_ID_S            8
+
+#define DRV_NAME                "ill_acc"
+
+static const char * const ill_acc_ids[] = {
+        "cpu", "dma", "ppe", "pdma rx", "pdma tx", "pci/e", "wmac", "usb",
+};
+
+static irqreturn_t ill_acc_irq_handler(int irq, void *_priv)
+{
+        struct device *dev = (struct device *) _priv;
+        u32 addr = rt_memc_r32(REG_ILL_ACC_ADDR);
+        u32 type = rt_memc_r32(REG_ILL_ACC_TYPE);
+
+        dev_err(dev, "illegal %s access from %s - addr:0x%08x offset:%d len:%d\n",
+                (type & ILL_ACC_WRITE) ? ("write") : ("read"),
+                ill_acc_ids[(type >> ILL_ACC_ID_S) & ILL_ACC_ID_M],
+                addr, (type >> ILL_ACC_OFF_S) & ILL_ACC_OFF_M,
+                type & ILL_ACC_LEN_M);
+
+        rt_memc_w32(REG_ILL_ACC_TYPE, REG_ILL_ACC_TYPE);
+
+        return IRQ_HANDLED;
+}
+
+static int __init ill_acc_of_setup(void)
+{
+        struct platform_device *pdev;
+        struct device_node *np;
+        int irq;
+
+        /* somehow this driver breaks on RT5350 */
+        if (of_machine_is_compatible("ralink,rt5350-soc"))
+                return -EINVAL;
+
+        np = of_find_compatible_node(NULL, NULL, "ralink,rt3050-memc");
+        if (!np)
+                return -EINVAL;
+
+        pdev = of_find_device_by_node(np);
+        if (!pdev) {
+                pr_err("%s: failed to lookup pdev\n", np->name);
+                return -EINVAL;
+        }
+
+        irq = irq_of_parse_and_map(np, 0);
+        if (!irq) {
+                dev_err(&pdev->dev, "failed to get irq\n");
+                return -EINVAL;
+        }
+
+        if (request_irq(irq, ill_acc_irq_handler, 0, "ill_acc", &pdev->dev)) {
+                dev_err(&pdev->dev, "failed to request irq\n");
+                return -EINVAL;
+        }
+
+        rt_memc_w32(ILL_INT_STATUS, REG_ILL_ACC_TYPE);
+
+        dev_info(&pdev->dev, "irq registered\n");
+
+        return 0;
+}
+
+arch_initcall(ill_acc_of_setup);
diff --git a/arch/mips/ralink/irq.c b/arch/mips/ralink/irq.c
index 781b3d14a489..7cf91b92e9d1 100644
--- a/arch/mips/ralink/irq.c
+++ b/arch/mips/ralink/irq.c
@@ -20,14 +20,6 @@
 
 #include "common.h"
 
-/* INTC register offsets */
-#define INTC_REG_STATUS0        0x00
-#define INTC_REG_STATUS1        0x04
-#define INTC_REG_TYPE           0x20
-#define INTC_REG_RAW_STATUS     0x30
-#define INTC_REG_ENABLE         0x34
-#define INTC_REG_DISABLE        0x38
-
 #define INTC_INT_GLOBAL         BIT(31)
 
 #define RALINK_CPU_IRQ_INTC     (MIPS_CPU_IRQ_BASE + 2)
@@ -44,16 +36,36 @@
 
 #define RALINK_INTC_IRQ_PERFC   (RALINK_INTC_IRQ_BASE + 9)
 
+enum rt_intc_regs_enum {
+        INTC_REG_STATUS0 = 0,
+        INTC_REG_STATUS1,
+        INTC_REG_TYPE,
+        INTC_REG_RAW_STATUS,
+        INTC_REG_ENABLE,
+        INTC_REG_DISABLE,
+};
+
+static u32 rt_intc_regs[] = {
+        [INTC_REG_STATUS0] = 0x00,
+        [INTC_REG_STATUS1] = 0x04,
+        [INTC_REG_TYPE] = 0x20,
+        [INTC_REG_RAW_STATUS] = 0x30,
+        [INTC_REG_ENABLE] = 0x34,
+        [INTC_REG_DISABLE] = 0x38,
+};
+
 static void __iomem *rt_intc_membase;
 
+static int rt_perfcount_irq;
+
 static inline void rt_intc_w32(u32 val, unsigned reg)
 {
-        __raw_writel(val, rt_intc_membase + reg);
+        __raw_writel(val, rt_intc_membase + rt_intc_regs[reg]);
 }
 
 static inline u32 rt_intc_r32(unsigned reg)
 {
-        return __raw_readl(rt_intc_membase + reg);
+        return __raw_readl(rt_intc_membase + rt_intc_regs[reg]);
 }
 
 static void ralink_intc_irq_unmask(struct irq_data *d)
@@ -73,6 +85,11 @@ static struct irq_chip ralink_intc_irq_chip = {
         .irq_mask_ack   = ralink_intc_irq_mask,
 };
 
+int get_c0_perfcount_int(void)
+{
+        return rt_perfcount_irq;
+}
+
 unsigned int get_c0_compare_int(void)
 {
         return CP0_LEGACY_COMPARE_IRQ;
@@ -134,6 +151,10 @@ static int __init intc_of_init(struct device_node *node,
         struct irq_domain *domain;
         int irq;
 
+        if (!of_property_read_u32_array(node, "ralink,intc-registers",
+                                        rt_intc_regs, 6))
+                pr_info("intc: using register map from devicetree\n");
+
         irq = irq_of_parse_and_map(node, 0);
         if (!irq)
                 panic("Failed to get INTC IRQ");
@@ -167,13 +188,13 @@ static int __init intc_of_init(struct device_node *node,
         irq_set_handler_data(irq, domain);
 
         /* tell the kernel which irq is used for performance monitoring */
-        cp0_perfcount_irq = irq_create_mapping(domain, 9);
+        rt_perfcount_irq = irq_create_mapping(domain, 9);
 
         return 0;
 }
 
 static struct of_device_id __initdata of_irq_ids[] = {
-        { .compatible = "mti,cpu-interrupt-controller", .data = mips_cpu_intc_init },
+        { .compatible = "mti,cpu-interrupt-controller", .data = mips_cpu_irq_of_init },
         { .compatible = "ralink,rt2880-intc", .data = intc_of_init },
         {},
 };
diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
index a3ad56c2372d..2ea5ff6dc22e 100644
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -17,124 +17,214 @@
 #include <asm/mipsregs.h>
 #include <asm/mach-ralink/ralink_regs.h>
 #include <asm/mach-ralink/mt7620.h>
+#include <asm/mach-ralink/pinmux.h>
 
 #include "common.h"
 
+/* analog */
+#define PMU0_CFG                0x88
+#define PMU_SW_SET              BIT(28)
+#define A_DCDC_EN               BIT(24)
+#define A_SSC_PERI              BIT(19)
+#define A_SSC_GEN               BIT(18)
+#define A_SSC_M                 0x3
+#define A_SSC_S                 16
+#define A_DLY_M                 0x7
+#define A_DLY_S                 8
+#define A_VTUNE_M               0xff
+
+/* digital */
+#define PMU1_CFG                0x8C
+#define DIG_SW_SEL              BIT(25)
+
+/* is this a MT7620 or a MT7628 */
+enum mt762x_soc_type mt762x_soc;
+
 /* does the board have sdram or ddram */
 static int dram_type;
 
-static struct ralink_pinmux_grp mode_mux[] = {
-        {
-                .name = "i2c",
-                .mask = MT7620_GPIO_MODE_I2C,
-                .gpio_first = 1,
-                .gpio_last = 2,
-        }, {
-                .name = "spi",
-                .mask = MT7620_GPIO_MODE_SPI,
-                .gpio_first = 3,
-                .gpio_last = 6,
-        }, {
-                .name = "uartlite",
-                .mask = MT7620_GPIO_MODE_UART1,
-                .gpio_first = 15,
-                .gpio_last = 16,
-        }, {
-                .name = "wdt",
-                .mask = MT7620_GPIO_MODE_WDT,
-                .gpio_first = 17,
-                .gpio_last = 17,
-        }, {
-                .name = "mdio",
-                .mask = MT7620_GPIO_MODE_MDIO,
-                .gpio_first = 22,
-                .gpio_last = 23,
-        }, {
-                .name = "rgmii1",
-                .mask = MT7620_GPIO_MODE_RGMII1,
-                .gpio_first = 24,
-                .gpio_last = 35,
-        }, {
-                .name = "spi refclk",
-                .mask = MT7620_GPIO_MODE_SPI_REF_CLK,
-                .gpio_first = 37,
-                .gpio_last = 39,
-        }, {
-                .name = "jtag",
-                .mask = MT7620_GPIO_MODE_JTAG,
-                .gpio_first = 40,
-                .gpio_last = 44,
-        }, {
-                /* shared lines with jtag */
-                .name = "ephy",
-                .mask = MT7620_GPIO_MODE_EPHY,
-                .gpio_first = 40,
-                .gpio_last = 44,
-        }, {
-                .name = "nand",
-                .mask = MT7620_GPIO_MODE_JTAG,
-                .gpio_first = 45,
-                .gpio_last = 59,
-        }, {
-                .name = "rgmii2",
-                .mask = MT7620_GPIO_MODE_RGMII2,
-                .gpio_first = 60,
-                .gpio_last = 71,
-        }, {
-                .name = "wled",
-                .mask = MT7620_GPIO_MODE_WLED,
-                .gpio_first = 72,
-                .gpio_last = 72,
-        }, {0}
+static struct rt2880_pmx_func i2c_grp[] =  { FUNC("i2c", 0, 1, 2) };
+static struct rt2880_pmx_func spi_grp[] = { FUNC("spi", 0, 3, 4) };
+static struct rt2880_pmx_func uartlite_grp[] = { FUNC("uartlite", 0, 15, 2) };
+static struct rt2880_pmx_func mdio_grp[] = { FUNC("mdio", 0, 22, 2) };
+static struct rt2880_pmx_func rgmii1_grp[] = { FUNC("rgmii1", 0, 24, 12) };
+static struct rt2880_pmx_func refclk_grp[] = { FUNC("spi refclk", 0, 37, 3) };
+static struct rt2880_pmx_func ephy_grp[] = { FUNC("ephy", 0, 40, 5) };
+static struct rt2880_pmx_func rgmii2_grp[] = { FUNC("rgmii2", 0, 60, 12) };
+static struct rt2880_pmx_func wled_grp[] = { FUNC("wled", 0, 72, 1) };
+static struct rt2880_pmx_func pa_grp[] = { FUNC("pa", 0, 18, 4) };
+static struct rt2880_pmx_func uartf_grp[] = {
+        FUNC("uartf", MT7620_GPIO_MODE_UARTF, 7, 8),
+        FUNC("pcm uartf", MT7620_GPIO_MODE_PCM_UARTF, 7, 8),
+        FUNC("pcm i2s", MT7620_GPIO_MODE_PCM_I2S, 7, 8),
+        FUNC("i2s uartf", MT7620_GPIO_MODE_I2S_UARTF, 7, 8),
+        FUNC("pcm gpio", MT7620_GPIO_MODE_PCM_GPIO, 11, 4),
+        FUNC("gpio uartf", MT7620_GPIO_MODE_GPIO_UARTF, 7, 4),
+        FUNC("gpio i2s", MT7620_GPIO_MODE_GPIO_I2S, 7, 4),
+};
+static struct rt2880_pmx_func wdt_grp[] = {
+        FUNC("wdt rst", 0, 17, 1),
+        FUNC("wdt refclk", 0, 17, 1),
+        };
+static struct rt2880_pmx_func pcie_rst_grp[] = {
+        FUNC("pcie rst", MT7620_GPIO_MODE_PCIE_RST, 36, 1),
+        FUNC("pcie refclk", MT7620_GPIO_MODE_PCIE_REF, 36, 1)
+};
+static struct rt2880_pmx_func nd_sd_grp[] = {
+        FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15),
+        FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15)
+};
+
+static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
+        GRP("i2c", i2c_grp, 1, MT7620_GPIO_MODE_I2C),
+        GRP("uartf", uartf_grp, MT7620_GPIO_MODE_UART0_MASK,
+                MT7620_GPIO_MODE_UART0_SHIFT),
+        GRP("spi", spi_grp, 1, MT7620_GPIO_MODE_SPI),
+        GRP("uartlite", uartlite_grp, 1, MT7620_GPIO_MODE_UART1),
+        GRP_G("wdt", wdt_grp, MT7620_GPIO_MODE_WDT_MASK,
+                MT7620_GPIO_MODE_WDT_GPIO, MT7620_GPIO_MODE_WDT_SHIFT),
+        GRP("mdio", mdio_grp, 1, MT7620_GPIO_MODE_MDIO),
+        GRP("rgmii1", rgmii1_grp, 1, MT7620_GPIO_MODE_RGMII1),
+        GRP("spi refclk", refclk_grp, 1, MT7620_GPIO_MODE_SPI_REF_CLK),
+        GRP_G("pcie", pcie_rst_grp, MT7620_GPIO_MODE_PCIE_MASK,
+                MT7620_GPIO_MODE_PCIE_GPIO, MT7620_GPIO_MODE_PCIE_SHIFT),
+        GRP_G("nd_sd", nd_sd_grp, MT7620_GPIO_MODE_ND_SD_MASK,
+                MT7620_GPIO_MODE_ND_SD_GPIO, MT7620_GPIO_MODE_ND_SD_SHIFT),
+        GRP("rgmii2", rgmii2_grp, 1, MT7620_GPIO_MODE_RGMII2),
+        GRP("wled", wled_grp, 1, MT7620_GPIO_MODE_WLED),
+        GRP("ephy", ephy_grp, 1, MT7620_GPIO_MODE_EPHY),
+        GRP("pa", pa_grp, 1, MT7620_GPIO_MODE_PA),
+        { 0 }
+};
+
+static struct rt2880_pmx_func pwm1_grp_mt7628[] = {
+        FUNC("sdcx", 3, 19, 1),
+        FUNC("utif", 2, 19, 1),
+        FUNC("gpio", 1, 19, 1),
+        FUNC("pwm", 0, 19, 1),
+};
+
+static struct rt2880_pmx_func pwm0_grp_mt7628[] = {
+        FUNC("sdcx", 3, 18, 1),
+        FUNC("utif", 2, 18, 1),
+        FUNC("gpio", 1, 18, 1),
+        FUNC("pwm", 0, 18, 1),
+};
+
+static struct rt2880_pmx_func uart2_grp_mt7628[] = {
+        FUNC("sdcx", 3, 20, 2),
+        FUNC("pwm", 2, 20, 2),
+        FUNC("gpio", 1, 20, 2),
+        FUNC("uart", 0, 20, 2),
+};
+
+static struct rt2880_pmx_func uart1_grp_mt7628[] = {
+        FUNC("sdcx", 3, 45, 2),
+        FUNC("pwm", 2, 45, 2),
+        FUNC("gpio", 1, 45, 2),
+        FUNC("uart", 0, 45, 2),
+};
+
+static struct rt2880_pmx_func i2c_grp_mt7628[] = {
+        FUNC("-", 3, 4, 2),
+        FUNC("debug", 2, 4, 2),
+        FUNC("gpio", 1, 4, 2),
+        FUNC("i2c", 0, 4, 2),
+};
+
+static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) };
+static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) };
+static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 15, 38) };
+static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
+
+static struct rt2880_pmx_func sd_mode_grp_mt7628[] = {
+        FUNC("jtag", 3, 22, 8),
+        FUNC("utif", 2, 22, 8),
+        FUNC("gpio", 1, 22, 8),
+        FUNC("sdcx", 0, 22, 8),
+};
+
+static struct rt2880_pmx_func uart0_grp_mt7628[] = {
+        FUNC("-", 3, 12, 2),
+        FUNC("-", 2, 12, 2),
+        FUNC("gpio", 1, 12, 2),
+        FUNC("uart", 0, 12, 2),
+};
+
+static struct rt2880_pmx_func i2s_grp_mt7628[] = {
+        FUNC("antenna", 3, 0, 4),
+        FUNC("pcm", 2, 0, 4),
+        FUNC("gpio", 1, 0, 4),
+        FUNC("i2s", 0, 0, 4),
+};
+
+static struct rt2880_pmx_func spi_cs1_grp_mt7628[] = {
+        FUNC("-", 3, 6, 1),
+        FUNC("refclk", 2, 6, 1),
+        FUNC("gpio", 1, 6, 1),
+        FUNC("spi", 0, 6, 1),
+};
+
+static struct rt2880_pmx_func spis_grp_mt7628[] = {
+        FUNC("pwm", 3, 14, 4),
+        FUNC("util", 2, 14, 4),
+        FUNC("gpio", 1, 14, 4),
+        FUNC("spis", 0, 14, 4),
 };
 
-static struct ralink_pinmux_grp uart_mux[] = {
-        {
-                .name = "uartf",
-                .mask = MT7620_GPIO_MODE_UARTF,
-                .gpio_first = 7,
-                .gpio_last = 14,
-        }, {
-                .name = "pcm uartf",
-                .mask = MT7620_GPIO_MODE_PCM_UARTF,
-                .gpio_first = 7,
-                .gpio_last = 14,
-        }, {
-                .name = "pcm i2s",
-                .mask = MT7620_GPIO_MODE_PCM_I2S,
-                .gpio_first = 7,
-                .gpio_last = 14,
-        }, {
-                .name = "i2s uartf",
-                .mask = MT7620_GPIO_MODE_I2S_UARTF,
-                .gpio_first = 7,
-                .gpio_last = 14,
-        }, {
-                .name = "pcm gpio",
-                .mask = MT7620_GPIO_MODE_PCM_GPIO,
-                .gpio_first = 11,
-                .gpio_last = 14,
-        }, {
-                .name = "gpio uartf",
-                .mask = MT7620_GPIO_MODE_GPIO_UARTF,
-                .gpio_first = 7,
-                .gpio_last = 10,
-        }, {
-                .name = "gpio i2s",
-                .mask = MT7620_GPIO_MODE_GPIO_I2S,
-                .gpio_first = 7,
-                .gpio_last = 10,
-        }, {
-                .name = "gpio",
-                .mask = MT7620_GPIO_MODE_GPIO,
-        }, {0}
+static struct rt2880_pmx_func gpio_grp_mt7628[] = {
+        FUNC("pcie", 3, 11, 1),
+        FUNC("refclk", 2, 11, 1),
+        FUNC("gpio", 1, 11, 1),
+        FUNC("gpio", 0, 11, 1),
 };
 
-struct ralink_pinmux rt_gpio_pinmux = {
-        .mode = mode_mux,
-        .uart = uart_mux,
-        .uart_shift = MT7620_GPIO_MODE_UART0_SHIFT,
-        .uart_mask = MT7620_GPIO_MODE_UART0_MASK,
+#define MT7628_GPIO_MODE_MASK   0x3
+
+#define MT7628_GPIO_MODE_PWM1   30
+#define MT7628_GPIO_MODE_PWM0   28
+#define MT7628_GPIO_MODE_UART2  26
+#define MT7628_GPIO_MODE_UART1  24
+#define MT7628_GPIO_MODE_I2C    20
+#define MT7628_GPIO_MODE_REFCLK 18
+#define MT7628_GPIO_MODE_PERST  16
+#define MT7628_GPIO_MODE_WDT    14
+#define MT7628_GPIO_MODE_SPI    12
+#define MT7628_GPIO_MODE_SDMODE 10
+#define MT7628_GPIO_MODE_UART0  8
+#define MT7628_GPIO_MODE_I2S    6
+#define MT7628_GPIO_MODE_CS1    4
+#define MT7628_GPIO_MODE_SPIS   2
+#define MT7628_GPIO_MODE_GPIO   0
+
+static struct rt2880_pmx_group mt7628an_pinmux_data[] = {
+        GRP_G("pmw1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_PWM1),
+        GRP_G("pmw1", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_PWM0),
+        GRP_G("uart2", uart2_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_UART2),
+        GRP_G("uart1", uart1_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_UART1),
+        GRP_G("i2c", i2c_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_I2C),
+        GRP("refclk", refclk_grp_mt7628, 1, MT7628_GPIO_MODE_REFCLK),
+        GRP("perst", perst_grp_mt7628, 1, MT7628_GPIO_MODE_PERST),
+        GRP("wdt", wdt_grp_mt7628, 1, MT7628_GPIO_MODE_WDT),
+        GRP("spi", spi_grp_mt7628, 1, MT7628_GPIO_MODE_SPI),
+        GRP_G("sdmode", sd_mode_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_SDMODE),
+        GRP_G("uart0", uart0_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_UART0),
+        GRP_G("i2s", i2s_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_I2S),
+        GRP_G("spi cs1", spi_cs1_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_CS1),
+        GRP_G("spis", spis_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_SPIS),
+        GRP_G("gpio", gpio_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_GPIO),
+        { 0 }
 };
 
 static __init u32
@@ -287,29 +377,42 @@ void __init ralink_clk_init(void)
 
         xtal_rate = mt7620_get_xtal_rate();
 
-        cpu_pll_rate = mt7620_get_cpu_pll_rate(xtal_rate);
-        pll_rate = mt7620_get_pll_rate(xtal_rate, cpu_pll_rate);
-
-        cpu_rate = mt7620_get_cpu_rate(pll_rate);
-        dram_rate = mt7620_get_dram_rate(pll_rate);
-        sys_rate = mt7620_get_sys_rate(cpu_rate);
-        periph_rate = mt7620_get_periph_rate(xtal_rate);
-
 #define RFMT(label)     label ":%lu.%03luMHz "
 #define RINT(x)         ((x) / 1000000)
 #define RFRAC(x)        (((x) / 1000) % 1000)
 
-        pr_debug(RFMT("XTAL") RFMT("CPU_PLL") RFMT("PLL"),
-                 RINT(xtal_rate), RFRAC(xtal_rate),
-                 RINT(cpu_pll_rate), RFRAC(cpu_pll_rate),
-                 RINT(pll_rate), RFRAC(pll_rate));
+        if (mt762x_soc == MT762X_SOC_MT7628AN) {
+                if (xtal_rate == MHZ(40))
+                        cpu_rate = MHZ(580);
+                else
+                        cpu_rate = MHZ(575);
+                dram_rate = sys_rate = cpu_rate / 3;
+                periph_rate = MHZ(40);
+
+                ralink_clk_add("10000d00.uartlite", periph_rate);
+                ralink_clk_add("10000e00.uartlite", periph_rate);
+        } else {
+                cpu_pll_rate = mt7620_get_cpu_pll_rate(xtal_rate);
+                pll_rate = mt7620_get_pll_rate(xtal_rate, cpu_pll_rate);
+
+                cpu_rate = mt7620_get_cpu_rate(pll_rate);
+                dram_rate = mt7620_get_dram_rate(pll_rate);
+                sys_rate = mt7620_get_sys_rate(cpu_rate);
+                periph_rate = mt7620_get_periph_rate(xtal_rate);
+
+                pr_debug(RFMT("XTAL") RFMT("CPU_PLL") RFMT("PLL"),
+                         RINT(xtal_rate), RFRAC(xtal_rate),
+                         RINT(cpu_pll_rate), RFRAC(cpu_pll_rate),
+                         RINT(pll_rate), RFRAC(pll_rate));
+
+                ralink_clk_add("10000500.uart", periph_rate);
+        }
 
         pr_debug(RFMT("CPU") RFMT("DRAM") RFMT("SYS") RFMT("PERIPH"),
                  RINT(cpu_rate), RFRAC(cpu_rate),
                  RINT(dram_rate), RFRAC(dram_rate),
                  RINT(sys_rate), RFRAC(sys_rate),
                  RINT(periph_rate), RFRAC(periph_rate));
-
 #undef RFRAC
 #undef RINT
 #undef RFMT
@@ -317,9 +420,9 @@ void __init ralink_clk_init(void)
         ralink_clk_add("cpu", cpu_rate);
         ralink_clk_add("10000100.timer", periph_rate);
         ralink_clk_add("10000120.watchdog", periph_rate);
-        ralink_clk_add("10000500.uart", periph_rate);
         ralink_clk_add("10000b00.spi", sys_rate);
         ralink_clk_add("10000c00.uartlite", periph_rate);
+        ralink_clk_add("10180000.wmac", xtal_rate);
 }
 
 void __init ralink_of_remap(void)
@@ -331,6 +434,52 @@ void __init ralink_of_remap(void)
                 panic("Failed to remap core resources");
 }
 
+static __init void
+mt7620_dram_init(struct ralink_soc_info *soc_info)
+{
+        switch (dram_type) {
+        case SYSCFG0_DRAM_TYPE_SDRAM:
+                pr_info("Board has SDRAM\n");
+                soc_info->mem_size_min = MT7620_SDRAM_SIZE_MIN;
+                soc_info->mem_size_max = MT7620_SDRAM_SIZE_MAX;
+                break;
+
+        case SYSCFG0_DRAM_TYPE_DDR1:
+                pr_info("Board has DDR1\n");
+                soc_info->mem_size_min = MT7620_DDR1_SIZE_MIN;
+                soc_info->mem_size_max = MT7620_DDR1_SIZE_MAX;
+                break;
+
+        case SYSCFG0_DRAM_TYPE_DDR2:
+                pr_info("Board has DDR2\n");
+                soc_info->mem_size_min = MT7620_DDR2_SIZE_MIN;
+                soc_info->mem_size_max = MT7620_DDR2_SIZE_MAX;
+                break;
+        default:
+                BUG();
+        }
+}
+
+static __init void
+mt7628_dram_init(struct ralink_soc_info *soc_info)
+{
+        switch (dram_type) {
+        case SYSCFG0_DRAM_TYPE_DDR1_MT7628:
+                pr_info("Board has DDR1\n");
+                soc_info->mem_size_min = MT7620_DDR1_SIZE_MIN;
+                soc_info->mem_size_max = MT7620_DDR1_SIZE_MAX;
+                break;
+
+        case SYSCFG0_DRAM_TYPE_DDR2_MT7628:
+                pr_info("Board has DDR2\n");
+                soc_info->mem_size_min = MT7620_DDR2_SIZE_MIN;
+                soc_info->mem_size_max = MT7620_DDR2_SIZE_MAX;
+                break;
+        default:
+                BUG();
+        }
+}
+
 void prom_soc_init(struct ralink_soc_info *soc_info)
 {
         void __iomem *sysc = (void __iomem *) KSEG1ADDR(MT7620_SYSC_BASE);
@@ -339,22 +488,36 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         u32 n1;
         u32 rev;
         u32 cfg0;
+        u32 pmu0;
+        u32 pmu1;
+        u32 bga;
 
         n0 = __raw_readl(sysc + SYSC_REG_CHIP_NAME0);
         n1 = __raw_readl(sysc + SYSC_REG_CHIP_NAME1);
-
-        if (n0 == MT7620N_CHIP_NAME0 && n1 == MT7620N_CHIP_NAME1) {
-                name = "MT7620N";
-                soc_info->compatible = "ralink,mt7620n-soc";
-        } else if (n0 == MT7620A_CHIP_NAME0 && n1 == MT7620A_CHIP_NAME1) {
-                name = "MT7620A";
-                soc_info->compatible = "ralink,mt7620a-soc";
+        rev = __raw_readl(sysc + SYSC_REG_CHIP_REV);
+        bga = (rev >> CHIP_REV_PKG_SHIFT) & CHIP_REV_PKG_MASK;
+
+        if (n0 == MT7620_CHIP_NAME0 && n1 == MT7620_CHIP_NAME1) {
+                if (bga) {
+                        mt762x_soc = MT762X_SOC_MT7620A;
+                        name = "MT7620A";
+                        soc_info->compatible = "ralink,mt7620a-soc";
+                } else {
+                        mt762x_soc = MT762X_SOC_MT7620N;
+                        name = "MT7620N";
+                        soc_info->compatible = "ralink,mt7620n-soc";
+#ifdef CONFIG_PCI
+                        panic("mt7620n is only supported for non pci kernels");
+#endif
+                }
+        } else if (n0 == MT7620_CHIP_NAME0 && n1 == MT7628_CHIP_NAME1) {
+                mt762x_soc = MT762X_SOC_MT7628AN;
+                name = "MT7628AN";
+                soc_info->compatible = "ralink,mt7628an-soc";
         } else {
-                panic("mt7620: unknown SoC, n0:%08x n1:%08x", n0, n1);
+                panic("mt762x: unknown SoC, n0:%08x n1:%08x\n", n0, n1);
         }
 
-        rev = __raw_readl(sysc + SYSC_REG_CHIP_REV);
-
         snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
                 "Ralink %s ver:%u eco:%u",
                 name,
@@ -364,26 +527,22 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         cfg0 = __raw_readl(sysc + SYSC_REG_SYSTEM_CONFIG0);
         dram_type = (cfg0 >> SYSCFG0_DRAM_TYPE_SHIFT) & SYSCFG0_DRAM_TYPE_MASK;
 
-        switch (dram_type) {
-        case SYSCFG0_DRAM_TYPE_SDRAM:
-                pr_info("Board has SDRAM\n");
-                soc_info->mem_size_min = MT7620_SDRAM_SIZE_MIN;
-                soc_info->mem_size_max = MT7620_SDRAM_SIZE_MAX;
-                break;
-
-        case SYSCFG0_DRAM_TYPE_DDR1:
-                pr_info("Board has DDR1\n");
-                soc_info->mem_size_min = MT7620_DDR1_SIZE_MIN;
-                soc_info->mem_size_max = MT7620_DDR1_SIZE_MAX;
-                break;
-
-        case SYSCFG0_DRAM_TYPE_DDR2:
-                pr_info("Board has DDR2\n");
-                soc_info->mem_size_min = MT7620_DDR2_SIZE_MIN;
-                soc_info->mem_size_max = MT7620_DDR2_SIZE_MAX;
-                break;
-        default:
-                BUG();
-        }
         soc_info->mem_base = MT7620_DRAM_BASE;
+        if (mt762x_soc == MT762X_SOC_MT7628AN)
+                mt7628_dram_init(soc_info);
+        else
+                mt7620_dram_init(soc_info);
+
+        pmu0 = __raw_readl(sysc + PMU0_CFG);
+        pmu1 = __raw_readl(sysc + PMU1_CFG);
+
+        pr_info("Analog PMU set to %s control\n",
+                (pmu0 & PMU_SW_SET) ? ("sw") : ("hw"));
+        pr_info("Digital PMU set to %s control\n",
+                (pmu1 & DIG_SW_SEL) ? ("sw") : ("hw"));
+
+        if (mt762x_soc == MT762X_SOC_MT7628AN)
+                rt2880_pinmux_data = mt7628an_pinmux_data;
+        else
+                rt2880_pinmux_data = mt7620a_pinmux_data;
 }
diff --git a/arch/mips/ralink/of.c b/arch/mips/ralink/of.c
index 7c4598cb6de8..0d30dcd63246 100644
--- a/arch/mips/ralink/of.c
+++ b/arch/mips/ralink/of.c
@@ -53,6 +53,17 @@ void __init device_tree_init(void)
         unflatten_and_copy_device_tree();
 }
 
+static int memory_dtb;
+
+static int __init early_init_dt_find_memory(unsigned long node,
+                                const char *uname, int depth, void *data)
+{
+        if (depth == 1 && !strcmp(uname, "memory@0"))
+                memory_dtb = 1;
+
+        return 0;
+}
+
 void __init plat_mem_setup(void)
 {
         set_io_port_base(KSEG1);
@@ -63,7 +74,12 @@ void __init plat_mem_setup(void)
          */
         __dt_setup_arch(__dtb_start);
 
-        if (soc_info.mem_size)
+        strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+
+        of_scan_flat_dt(early_init_dt_find_memory, NULL);
+        if (memory_dtb)
+                of_scan_flat_dt(early_init_dt_scan_memory, NULL);
+        else if (soc_info.mem_size)
                 add_memory_region(soc_info.mem_base, soc_info.mem_size * SZ_1M,
                                   BOOT_MEM_RAM);
         else
@@ -74,19 +90,9 @@ void __init plat_mem_setup(void)
 
 static int __init plat_of_setup(void)
 {
-        static struct of_device_id of_ids[3];
-        int len = sizeof(of_ids[0].compatible);
-
-        if (!of_have_populated_dt())
-                panic("device tree not present");
-
-        strlcpy(of_ids[0].compatible, soc_info.compatible, len);
-        strlcpy(of_ids[1].compatible, "palmbus", len);
-
-        if (of_platform_populate(NULL, of_ids, NULL, NULL))
-                panic("failed to populate DT");
+        __dt_register_buses(soc_info.compatible, "palmbus");
 
-        /* make sure ithat the reset controller is setup early */
+        /* make sure that the reset controller is setup early */
         ralink_rst_init();
 
         return 0;
diff --git a/arch/mips/ralink/prom.c b/arch/mips/ralink/prom.c
index 9c64f029d047..09419f67da39 100644
--- a/arch/mips/ralink/prom.c
+++ b/arch/mips/ralink/prom.c
@@ -18,6 +18,7 @@
 #include "common.h"
 
 struct ralink_soc_info soc_info;
+struct rt2880_pmx_group *rt2880_pinmux_data = NULL;
 
 const char *get_system_type(void)
 {
diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c
index f87de1ab2198..738cec865f41 100644
--- a/arch/mips/ralink/rt288x.c
+++ b/arch/mips/ralink/rt288x.c
@@ -17,46 +17,27 @@
 #include <asm/mipsregs.h>
 #include <asm/mach-ralink/ralink_regs.h>
 #include <asm/mach-ralink/rt288x.h>
+#include <asm/mach-ralink/pinmux.h>
 
 #include "common.h"
 
-static struct ralink_pinmux_grp mode_mux[] = {
-        {
-                .name = "i2c",
-                .mask = RT2880_GPIO_MODE_I2C,
-                .gpio_first = 1,
-                .gpio_last = 2,
-        }, {
-                .name = "spi",
-                .mask = RT2880_GPIO_MODE_SPI,
-                .gpio_first = 3,
-                .gpio_last = 6,
-        }, {
-                .name = "uartlite",
-                .mask = RT2880_GPIO_MODE_UART0,
-                .gpio_first = 7,
-                .gpio_last = 14,
-        }, {
-                .name = "jtag",
-                .mask = RT2880_GPIO_MODE_JTAG,
-                .gpio_first = 17,
-                .gpio_last = 21,
-        }, {
-                .name = "mdio",
-                .mask = RT2880_GPIO_MODE_MDIO,
-                .gpio_first = 22,
-                .gpio_last = 23,
-        }, {
-                .name = "sdram",
-                .mask = RT2880_GPIO_MODE_SDRAM,
-                .gpio_first = 24,
-                .gpio_last = 39,
-        }, {
-                .name = "pci",
-                .mask = RT2880_GPIO_MODE_PCI,
-                .gpio_first = 40,
-                .gpio_last = 71,
-        }, {0}
+static struct rt2880_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) };
+static struct rt2880_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) };
+static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 7, 8) };
+static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
+static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
+static struct rt2880_pmx_func sdram_func[] = { FUNC("sdram", 0, 24, 16) };
+static struct rt2880_pmx_func pci_func[] = { FUNC("pci", 0, 40, 32) };
+
+static struct rt2880_pmx_group rt2880_pinmux_data_act[] = {
+        GRP("i2c", i2c_func, 1, RT2880_GPIO_MODE_I2C),
+        GRP("spi", spi_func, 1, RT2880_GPIO_MODE_SPI),
+        GRP("uartlite", uartlite_func, 1, RT2880_GPIO_MODE_UART0),
+        GRP("jtag", jtag_func, 1, RT2880_GPIO_MODE_JTAG),
+        GRP("mdio", mdio_func, 1, RT2880_GPIO_MODE_MDIO),
+        GRP("sdram", sdram_func, 1, RT2880_GPIO_MODE_SDRAM),
+        GRP("pci", pci_func, 1, RT2880_GPIO_MODE_PCI),
+        { 0 }
 };
 
 static void rt288x_wdt_reset(void)
@@ -69,14 +50,9 @@ static void rt288x_wdt_reset(void)
         rt_sysc_w32(t, SYSC_REG_CLKCFG);
 }
 
-struct ralink_pinmux rt_gpio_pinmux = {
-        .mode = mode_mux,
-        .wdt_reset = rt288x_wdt_reset,
-};
-
 void __init ralink_clk_init(void)
 {
-        unsigned long cpu_rate;
+        unsigned long cpu_rate, wmac_rate = 40000000;
         u32 t = rt_sysc_r32(SYSC_REG_SYSTEM_CONFIG);
         t = ((t >> SYSTEM_CONFIG_CPUCLK_SHIFT) & SYSTEM_CONFIG_CPUCLK_MASK);
 
@@ -101,6 +77,7 @@ void __init ralink_clk_init(void)
         ralink_clk_add("300500.uart", cpu_rate / 2);
         ralink_clk_add("300c00.uartlite", cpu_rate / 2);
         ralink_clk_add("400000.ethernet", cpu_rate / 2);
+        ralink_clk_add("480000.wmac", wmac_rate);
 }
 
 void __init ralink_of_remap(void)
@@ -140,4 +117,6 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         soc_info->mem_base = RT2880_SDRAM_BASE;
         soc_info->mem_size_min = RT2880_MEM_SIZE_MIN;
         soc_info->mem_size_max = RT2880_MEM_SIZE_MAX;
+
+        rt2880_pinmux_data = rt2880_pinmux_data_act;
 }
diff --git a/arch/mips/ralink/rt305x.c b/arch/mips/ralink/rt305x.c
index bb82a82da9e7..c40776ab67db 100644
--- a/arch/mips/ralink/rt305x.c
+++ b/arch/mips/ralink/rt305x.c
@@ -17,90 +17,78 @@
 #include <asm/mipsregs.h>
 #include <asm/mach-ralink/ralink_regs.h>
 #include <asm/mach-ralink/rt305x.h>
+#include <asm/mach-ralink/pinmux.h>
 
 #include "common.h"
 
 enum rt305x_soc_type rt305x_soc;
 
-static struct ralink_pinmux_grp mode_mux[] = {
-        {
-                .name = "i2c",
-                .mask = RT305X_GPIO_MODE_I2C,
-                .gpio_first = RT305X_GPIO_I2C_SD,
-                .gpio_last = RT305X_GPIO_I2C_SCLK,
-        }, {
-                .name = "spi",
-                .mask = RT305X_GPIO_MODE_SPI,
-                .gpio_first = RT305X_GPIO_SPI_EN,
-                .gpio_last = RT305X_GPIO_SPI_CLK,
-        }, {
-                .name = "uartlite",
-                .mask = RT305X_GPIO_MODE_UART1,
-                .gpio_first = RT305X_GPIO_UART1_TXD,
-                .gpio_last = RT305X_GPIO_UART1_RXD,
-        }, {
-                .name = "jtag",
-                .mask = RT305X_GPIO_MODE_JTAG,
-                .gpio_first = RT305X_GPIO_JTAG_TDO,
-                .gpio_last = RT305X_GPIO_JTAG_TDI,
-        }, {
-                .name = "mdio",
-                .mask = RT305X_GPIO_MODE_MDIO,
-                .gpio_first = RT305X_GPIO_MDIO_MDC,
-                .gpio_last = RT305X_GPIO_MDIO_MDIO,
-        }, {
-                .name = "sdram",
-                .mask = RT305X_GPIO_MODE_SDRAM,
-                .gpio_first = RT305X_GPIO_SDRAM_MD16,
-                .gpio_last = RT305X_GPIO_SDRAM_MD31,
-        }, {
-                .name = "rgmii",
-                .mask = RT305X_GPIO_MODE_RGMII,
-                .gpio_first = RT305X_GPIO_GE0_TXD0,
-                .gpio_last = RT305X_GPIO_GE0_RXCLK,
-        }, {0}
+static struct rt2880_pmx_func i2c_func[] =  { FUNC("i2c", 0, 1, 2) };
+static struct rt2880_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) };
+static struct rt2880_pmx_func uartf_func[] = {
+        FUNC("uartf", RT305X_GPIO_MODE_UARTF, 7, 8),
+        FUNC("pcm uartf", RT305X_GPIO_MODE_PCM_UARTF, 7, 8),
+        FUNC("pcm i2s", RT305X_GPIO_MODE_PCM_I2S, 7, 8),
+        FUNC("i2s uartf", RT305X_GPIO_MODE_I2S_UARTF, 7, 8),
+        FUNC("pcm gpio", RT305X_GPIO_MODE_PCM_GPIO, 11, 4),
+        FUNC("gpio uartf", RT305X_GPIO_MODE_GPIO_UARTF, 7, 4),
+        FUNC("gpio i2s", RT305X_GPIO_MODE_GPIO_I2S, 7, 4),
+};
+static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) };
+static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
+static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
+static struct rt2880_pmx_func rt5350_led_func[] = { FUNC("led", 0, 22, 5) };
+static struct rt2880_pmx_func rt5350_cs1_func[] = {
+        FUNC("spi_cs1", 0, 27, 1),
+        FUNC("wdg_cs1", 1, 27, 1),
+};
+static struct rt2880_pmx_func sdram_func[] = { FUNC("sdram", 0, 24, 16) };
+static struct rt2880_pmx_func rt3352_rgmii_func[] = {
+        FUNC("rgmii", 0, 24, 12)
+};
+static struct rt2880_pmx_func rgmii_func[] = { FUNC("rgmii", 0, 40, 12) };
+static struct rt2880_pmx_func rt3352_lna_func[] = { FUNC("lna", 0, 36, 2) };
+static struct rt2880_pmx_func rt3352_pa_func[] = { FUNC("pa", 0, 38, 2) };
+static struct rt2880_pmx_func rt3352_led_func[] = { FUNC("led", 0, 40, 5) };
+
+static struct rt2880_pmx_group rt3050_pinmux_data[] = {
+        GRP("i2c", i2c_func, 1, RT305X_GPIO_MODE_I2C),
+        GRP("spi", spi_func, 1, RT305X_GPIO_MODE_SPI),
+        GRP("uartf", uartf_func, RT305X_GPIO_MODE_UART0_MASK,
+                RT305X_GPIO_MODE_UART0_SHIFT),
+        GRP("uartlite", uartlite_func, 1, RT305X_GPIO_MODE_UART1),
+        GRP("jtag", jtag_func, 1, RT305X_GPIO_MODE_JTAG),
+        GRP("mdio", mdio_func, 1, RT305X_GPIO_MODE_MDIO),
+        GRP("rgmii", rgmii_func, 1, RT305X_GPIO_MODE_RGMII),
+        GRP("sdram", sdram_func, 1, RT305X_GPIO_MODE_SDRAM),
+        { 0 }
 };
 
-static struct ralink_pinmux_grp uart_mux[] = {
-        {
-                .name = "uartf",
-                .mask = RT305X_GPIO_MODE_UARTF,
-                .gpio_first = RT305X_GPIO_7,
-                .gpio_last = RT305X_GPIO_14,
-        }, {
-                .name = "pcm uartf",
-                .mask = RT305X_GPIO_MODE_PCM_UARTF,
-                .gpio_first = RT305X_GPIO_7,
-                .gpio_last = RT305X_GPIO_14,
-        }, {
-                .name = "pcm i2s",
-                .mask = RT305X_GPIO_MODE_PCM_I2S,
-                .gpio_first = RT305X_GPIO_7,
-                .gpio_last = RT305X_GPIO_14,
-        }, {
-                .name = "i2s uartf",
-                .mask = RT305X_GPIO_MODE_I2S_UARTF,
-                .gpio_first = RT305X_GPIO_7,
-                .gpio_last = RT305X_GPIO_14,
-        }, {
-                .name = "pcm gpio",
-                .mask = RT305X_GPIO_MODE_PCM_GPIO,
-                .gpio_first = RT305X_GPIO_10,
-                .gpio_last = RT305X_GPIO_14,
-        }, {
-                .name = "gpio uartf",
-                .mask = RT305X_GPIO_MODE_GPIO_UARTF,
-                .gpio_first = RT305X_GPIO_7,
-                .gpio_last = RT305X_GPIO_10,
-        }, {
-                .name = "gpio i2s",
-                .mask = RT305X_GPIO_MODE_GPIO_I2S,
-                .gpio_first = RT305X_GPIO_7,
-                .gpio_last = RT305X_GPIO_10,
-        }, {
-                .name = "gpio",
-                .mask = RT305X_GPIO_MODE_GPIO,
-        }, {0}
+static struct rt2880_pmx_group rt3352_pinmux_data[] = {
+        GRP("i2c", i2c_func, 1, RT305X_GPIO_MODE_I2C),
+        GRP("spi", spi_func, 1, RT305X_GPIO_MODE_SPI),
+        GRP("uartf", uartf_func, RT305X_GPIO_MODE_UART0_MASK,
+                RT305X_GPIO_MODE_UART0_SHIFT),
+        GRP("uartlite", uartlite_func, 1, RT305X_GPIO_MODE_UART1),
+        GRP("jtag", jtag_func, 1, RT305X_GPIO_MODE_JTAG),
+        GRP("mdio", mdio_func, 1, RT305X_GPIO_MODE_MDIO),
+        GRP("rgmii", rt3352_rgmii_func, 1, RT305X_GPIO_MODE_RGMII),
+        GRP("lna", rt3352_lna_func, 1, RT3352_GPIO_MODE_LNA),
+        GRP("pa", rt3352_pa_func, 1, RT3352_GPIO_MODE_PA),
+        GRP("led", rt3352_led_func, 1, RT5350_GPIO_MODE_PHY_LED),
+        { 0 }
+};
+
+static struct rt2880_pmx_group rt5350_pinmux_data[] = {
+        GRP("i2c", i2c_func, 1, RT305X_GPIO_MODE_I2C),
+        GRP("spi", spi_func, 1, RT305X_GPIO_MODE_SPI),
+        GRP("uartf", uartf_func, RT305X_GPIO_MODE_UART0_MASK,
+                RT305X_GPIO_MODE_UART0_SHIFT),
+        GRP("uartlite", uartlite_func, 1, RT305X_GPIO_MODE_UART1),
+        GRP("jtag", jtag_func, 1, RT305X_GPIO_MODE_JTAG),
+        GRP("led", rt5350_led_func, 1, RT5350_GPIO_MODE_PHY_LED),
+        GRP("spi_cs1", rt5350_cs1_func, 2, RT5350_GPIO_MODE_SPI_CS1),
+        { 0 }
 };
 
 static void rt305x_wdt_reset(void)
@@ -114,14 +102,6 @@ static void rt305x_wdt_reset(void)
         rt_sysc_w32(t, SYSC_REG_SYSTEM_CONFIG);
 }
 
-struct ralink_pinmux rt_gpio_pinmux = {
-        .mode = mode_mux,
-        .uart = uart_mux,
-        .uart_shift = RT305X_GPIO_MODE_UART0_SHIFT,
-        .uart_mask = RT305X_GPIO_MODE_UART0_MASK,
-        .wdt_reset = rt305x_wdt_reset,
-};
-
 static unsigned long rt5350_get_mem_size(void)
 {
         void __iomem *sysc = (void __iomem *) KSEG1ADDR(RT305X_SYSC_BASE);
@@ -290,11 +270,14 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         soc_info->mem_base = RT305X_SDRAM_BASE;
         if (soc_is_rt5350()) {
                 soc_info->mem_size = rt5350_get_mem_size();
+                rt2880_pinmux_data = rt5350_pinmux_data;
         } else if (soc_is_rt305x() || soc_is_rt3350()) {
                 soc_info->mem_size_min = RT305X_MEM_SIZE_MIN;
                 soc_info->mem_size_max = RT305X_MEM_SIZE_MAX;
+                rt2880_pinmux_data = rt3050_pinmux_data;
         } else if (soc_is_rt3352()) {
                 soc_info->mem_size_min = RT3352_MEM_SIZE_MIN;
                 soc_info->mem_size_max = RT3352_MEM_SIZE_MAX;
+                rt2880_pinmux_data = rt3352_pinmux_data;
         }
 }
diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c
index b474ac284b83..86a535c770d8 100644
--- a/arch/mips/ralink/rt3883.c
+++ b/arch/mips/ralink/rt3883.c
@@ -17,132 +17,50 @@
 #include <asm/mipsregs.h>
 #include <asm/mach-ralink/ralink_regs.h>
 #include <asm/mach-ralink/rt3883.h>
+#include <asm/mach-ralink/pinmux.h>
 
 #include "common.h"
 
-static struct ralink_pinmux_grp mode_mux[] = {
-        {
-                .name = "i2c",
-                .mask = RT3883_GPIO_MODE_I2C,
-                .gpio_first = RT3883_GPIO_I2C_SD,
-                .gpio_last = RT3883_GPIO_I2C_SCLK,
-        }, {
-                .name = "spi",
-                .mask = RT3883_GPIO_MODE_SPI,
-                .gpio_first = RT3883_GPIO_SPI_CS0,
-                .gpio_last = RT3883_GPIO_SPI_MISO,
-        }, {
-                .name = "uartlite",
-                .mask = RT3883_GPIO_MODE_UART1,
-                .gpio_first = RT3883_GPIO_UART1_TXD,
-                .gpio_last = RT3883_GPIO_UART1_RXD,
-        }, {
-                .name = "jtag",
-                .mask = RT3883_GPIO_MODE_JTAG,
-                .gpio_first = RT3883_GPIO_JTAG_TDO,
-                .gpio_last = RT3883_GPIO_JTAG_TCLK,
-        }, {
-                .name = "mdio",
-                .mask = RT3883_GPIO_MODE_MDIO,
-                .gpio_first = RT3883_GPIO_MDIO_MDC,
-                .gpio_last = RT3883_GPIO_MDIO_MDIO,
-        }, {
-                .name = "ge1",
-                .mask = RT3883_GPIO_MODE_GE1,
-                .gpio_first = RT3883_GPIO_GE1_TXD0,
-                .gpio_last = RT3883_GPIO_GE1_RXCLK,
-        }, {
-                .name = "ge2",
-                .mask = RT3883_GPIO_MODE_GE2,
-                .gpio_first = RT3883_GPIO_GE2_TXD0,
-                .gpio_last = RT3883_GPIO_GE2_RXCLK,
-        }, {
-                .name = "pci",
-                .mask = RT3883_GPIO_MODE_PCI,
-                .gpio_first = RT3883_GPIO_PCI_AD0,
-                .gpio_last = RT3883_GPIO_PCI_AD31,
-        }, {
-                .name = "lna a",
-                .mask = RT3883_GPIO_MODE_LNA_A,
-                .gpio_first = RT3883_GPIO_LNA_PE_A0,
-                .gpio_last = RT3883_GPIO_LNA_PE_A2,
-        }, {
-                .name = "lna g",
-                .mask = RT3883_GPIO_MODE_LNA_G,
-                .gpio_first = RT3883_GPIO_LNA_PE_G0,
-                .gpio_last = RT3883_GPIO_LNA_PE_G2,
-        }, {0}
+static struct rt2880_pmx_func i2c_func[] =  { FUNC("i2c", 0, 1, 2) };
+static struct rt2880_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) };
+static struct rt2880_pmx_func uartf_func[] = {
+        FUNC("uartf", RT3883_GPIO_MODE_UARTF, 7, 8),
+        FUNC("pcm uartf", RT3883_GPIO_MODE_PCM_UARTF, 7, 8),
+        FUNC("pcm i2s", RT3883_GPIO_MODE_PCM_I2S, 7, 8),
+        FUNC("i2s uartf", RT3883_GPIO_MODE_I2S_UARTF, 7, 8),
+        FUNC("pcm gpio", RT3883_GPIO_MODE_PCM_GPIO, 11, 4),
+        FUNC("gpio uartf", RT3883_GPIO_MODE_GPIO_UARTF, 7, 4),
+        FUNC("gpio i2s", RT3883_GPIO_MODE_GPIO_I2S, 7, 4),
 };
-
-static struct ralink_pinmux_grp uart_mux[] = {
-        {
-                .name = "uartf",
-                .mask = RT3883_GPIO_MODE_UARTF,
-                .gpio_first = RT3883_GPIO_7,
-                .gpio_last = RT3883_GPIO_14,
-        }, {
-                .name = "pcm uartf",
-                .mask = RT3883_GPIO_MODE_PCM_UARTF,
-                .gpio_first = RT3883_GPIO_7,
-                .gpio_last = RT3883_GPIO_14,
-        }, {
-                .name = "pcm i2s",
-                .mask = RT3883_GPIO_MODE_PCM_I2S,
-                .gpio_first = RT3883_GPIO_7,
-                .gpio_last = RT3883_GPIO_14,
-        }, {
-                .name = "i2s uartf",
-                .mask = RT3883_GPIO_MODE_I2S_UARTF,
-                .gpio_first = RT3883_GPIO_7,
-                .gpio_last = RT3883_GPIO_14,
-        }, {
-                .name = "pcm gpio",
-                .mask = RT3883_GPIO_MODE_PCM_GPIO,
-                .gpio_first = RT3883_GPIO_11,
-                .gpio_last = RT3883_GPIO_14,
-        }, {
-                .name = "gpio uartf",
-                .mask = RT3883_GPIO_MODE_GPIO_UARTF,
-                .gpio_first = RT3883_GPIO_7,
-                .gpio_last = RT3883_GPIO_10,
-        }, {
-                .name = "gpio i2s",
-                .mask = RT3883_GPIO_MODE_GPIO_I2S,
-                .gpio_first = RT3883_GPIO_7,
-                .gpio_last = RT3883_GPIO_10,
-        }, {
-                .name = "gpio",
-                .mask = RT3883_GPIO_MODE_GPIO,
-        }, {0}
+static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) };
+static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
+static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
+static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) };
+static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna a", 0, 35, 3) };
+static struct rt2880_pmx_func pci_func[] = {
+        FUNC("pci-dev", 0, 40, 32),
+        FUNC("pci-host2", 1, 40, 32),
+        FUNC("pci-host1", 2, 40, 32),
+        FUNC("pci-fnc", 3, 40, 32)
 };
-
-static struct ralink_pinmux_grp pci_mux[] = {
-        {
-                .name = "pci-dev",
-                .mask = 0,
-                .gpio_first = RT3883_GPIO_PCI_AD0,
-                .gpio_last = RT3883_GPIO_PCI_AD31,
-        }, {
-                .name = "pci-host2",
-                .mask = 1,
-                .gpio_first = RT3883_GPIO_PCI_AD0,
-                .gpio_last = RT3883_GPIO_PCI_AD31,
-        }, {
-                .name = "pci-host1",
-                .mask = 2,
-                .gpio_first = RT3883_GPIO_PCI_AD0,
-                .gpio_last = RT3883_GPIO_PCI_AD31,
-        }, {
-                .name = "pci-fnc",
-                .mask = 3,
-                .gpio_first = RT3883_GPIO_PCI_AD0,
-                .gpio_last = RT3883_GPIO_PCI_AD31,
-        }, {
-                .name = "pci-gpio",
-                .mask = 7,
-                .gpio_first = RT3883_GPIO_PCI_AD0,
-                .gpio_last = RT3883_GPIO_PCI_AD31,
-        }, {0}
+static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) };
+static struct rt2880_pmx_func ge2_func[] = { FUNC("ge1", 0, 84, 12) };
+
+static struct rt2880_pmx_group rt3883_pinmux_data[] = {
+        GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C),
+        GRP("spi", spi_func, 1, RT3883_GPIO_MODE_SPI),
+        GRP("uartf", uartf_func, RT3883_GPIO_MODE_UART0_MASK,
+                RT3883_GPIO_MODE_UART0_SHIFT),
+        GRP("uartlite", uartlite_func, 1, RT3883_GPIO_MODE_UART1),
+        GRP("jtag", jtag_func, 1, RT3883_GPIO_MODE_JTAG),
+        GRP("mdio", mdio_func, 1, RT3883_GPIO_MODE_MDIO),
+        GRP("lna a", lna_a_func, 1, RT3883_GPIO_MODE_LNA_A),
+        GRP("lna g", lna_g_func, 1, RT3883_GPIO_MODE_LNA_G),
+        GRP("pci", pci_func, RT3883_GPIO_MODE_PCI_MASK,
+                RT3883_GPIO_MODE_PCI_SHIFT),
+        GRP("ge1", ge1_func, 1, RT3883_GPIO_MODE_GE1),
+        GRP("ge2", ge2_func, 1, RT3883_GPIO_MODE_GE2),
+        { 0 }
 };
 
 static void rt3883_wdt_reset(void)
@@ -155,17 +73,6 @@ static void rt3883_wdt_reset(void)
         rt_sysc_w32(t, RT3883_SYSC_REG_SYSCFG1);
 }
 
-struct ralink_pinmux rt_gpio_pinmux = {
-        .mode = mode_mux,
-        .uart = uart_mux,
-        .uart_shift = RT3883_GPIO_MODE_UART0_SHIFT,
-        .uart_mask = RT3883_GPIO_MODE_UART0_MASK,
-        .wdt_reset = rt3883_wdt_reset,
-        .pci = pci_mux,
-        .pci_shift = RT3883_GPIO_MODE_PCI_SHIFT,
-        .pci_mask = RT3883_GPIO_MODE_PCI_MASK,
-};
-
 void __init ralink_clk_init(void)
 {
         unsigned long cpu_rate, sys_rate;
@@ -204,6 +111,7 @@ void __init ralink_clk_init(void)
         ralink_clk_add("10000b00.spi", sys_rate);
         ralink_clk_add("10000c00.uartlite", 40000000);
         ralink_clk_add("10100000.ethernet", sys_rate);
+        ralink_clk_add("10180000.wmac", 40000000);
 }
 
 void __init ralink_of_remap(void)
@@ -243,4 +151,6 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         soc_info->mem_base = RT3883_SDRAM_BASE;
         soc_info->mem_size_min = RT3883_MEM_SIZE_MIN;
         soc_info->mem_size_max = RT3883_MEM_SIZE_MAX;
+
+        rt2880_pinmux_data = rt3883_pinmux_data;
 }
diff --git a/arch/mips/rb532/gpio.c b/arch/mips/rb532/gpio.c
index a18007613c30..5aa3df853082 100644
--- a/arch/mips/rb532/gpio.c
+++ b/arch/mips/rb532/gpio.c
@@ -79,7 +79,7 @@ static inline void rb532_set_bit(unsigned bitval,
  */
 static inline int rb532_get_bit(unsigned offset, void __iomem *ioaddr)
 {
-        return (readl(ioaddr) & (1 << offset));
+        return readl(ioaddr) & (1 << offset);
 }
 
 /*
diff --git a/arch/mips/rb532/prom.c b/arch/mips/rb532/prom.c
index a757ded437cd..657210e767c2 100644
--- a/arch/mips/rb532/prom.c
+++ b/arch/mips/rb532/prom.c
@@ -122,8 +122,8 @@ void __init prom_setup_cmdline(void)
 void __init prom_init(void)
 {
         struct ddr_ram __iomem *ddr;
-        phys_t memsize;
-        phys_t ddrbase;
+        phys_addr_t memsize;
+        phys_addr_t ddrbase;
 
         ddr = ioremap_nocache(ddr_reg[0].start,
                         ddr_reg[0].end - ddr_reg[0].start);
@@ -133,8 +133,8 @@ void __init prom_init(void)
                 return;
         }
 
-        ddrbase = (phys_t)&ddr->ddrbase;
-        memsize = (phys_t)&ddr->ddrmask;
+        ddrbase = (phys_addr_t)&ddr->ddrbase;
+        memsize = (phys_addr_t)&ddr->ddrmask;
         memsize = 0 - memsize;
 
         prom_setup_cmdline();
diff --git a/arch/mips/sgi-ip22/ip22-mc.c b/arch/mips/sgi-ip22/ip22-mc.c
index 7cec0a4e527d..6b009c45abed 100644
--- a/arch/mips/sgi-ip22/ip22-mc.c
+++ b/arch/mips/sgi-ip22/ip22-mc.c
@@ -24,14 +24,12 @@ EXPORT_SYMBOL(sgimc);
 
 static inline unsigned long get_bank_addr(unsigned int memconfig)
 {
-        return ((memconfig & SGIMC_MCONFIG_BASEADDR) <<
-                ((sgimc->systemid & SGIMC_SYSID_MASKREV) >= 5 ? 24 : 22));
+        return (memconfig & SGIMC_MCONFIG_BASEADDR) << ((sgimc->systemid & SGIMC_SYSID_MASKREV) >= 5 ? 24 : 22);
 }
 
 static inline unsigned long get_bank_size(unsigned int memconfig)
 {
-        return ((memconfig & SGIMC_MCONFIG_RMASK) + 0x0100) <<
-                ((sgimc->systemid & SGIMC_SYSID_MASKREV) >= 5 ? 16 : 14);
+        return ((memconfig & SGIMC_MCONFIG_RMASK) + 0x0100) << ((sgimc->systemid & SGIMC_SYSID_MASKREV) >= 5 ? 16 : 14);
 }
 
 static inline unsigned int get_bank_config(int bank)
diff --git a/arch/mips/sgi-ip22/ip28-berr.c b/arch/mips/sgi-ip22/ip28-berr.c
index 3f47346608d7..712cc0f6a58d 100644
--- a/arch/mips/sgi-ip22/ip28-berr.c
+++ b/arch/mips/sgi-ip22/ip28-berr.c
@@ -338,7 +338,7 @@ static int check_microtlb(u32 hi, u32 lo, unsigned long vaddr)
                                                 PHYS_TO_XKSEG_UNCACHED(pte);
                                 a = (a & 0x3f) << 6; /* PFN */
                                 a += vaddr & ((1 << pgsz) - 1);
-                                return (cpu_err_addr == a);
+                                return cpu_err_addr == a;
                         }
                 }
         }
@@ -351,7 +351,7 @@ static int check_vdma_memaddr(void)
                 u32 a = sgimc->maddronly;
 
                 if (!(sgimc->dma_ctrl & 0x100)) /* Xlate-bit clear ? */
-                        return (cpu_err_addr == a);
+                        return cpu_err_addr == a;
 
                 if (check_microtlb(sgimc->dtlb_hi0, sgimc->dtlb_lo0, a) ||
                     check_microtlb(sgimc->dtlb_hi1, sgimc->dtlb_lo1, a) ||
@@ -367,7 +367,7 @@ static int check_vdma_gioaddr(void)
         if (gio_err_stat & GIO_ERRMASK) {
                 u32 a = sgimc->gio_dma_trans;
                 a = (sgimc->gmaddronly & ~a) | (sgimc->gio_dma_sbits & a);
-                return (gio_err_addr == a);
+                return gio_err_addr == a;
         }
         return 0;
 }
diff --git a/arch/mips/sgi-ip27/ip27-klnuma.c b/arch/mips/sgi-ip27/ip27-klnuma.c
index 7a53b1e28a93..ecbb62f339c5 100644
--- a/arch/mips/sgi-ip27/ip27-klnuma.c
+++ b/arch/mips/sgi-ip27/ip27-klnuma.c
@@ -125,8 +125,7 @@ unsigned long node_getfirstfree(cnodeid_t cnode)
 #endif
         offset = PAGE_ALIGN((unsigned long)(&_end)) - loadbase;
         if ((cnode == 0) || (cpu_isset(cnode, ktext_repmask)))
-                return (TO_NODE(nasid, offset) >> PAGE_SHIFT);
+                return TO_NODE(nasid, offset) >> PAGE_SHIFT;
         else
-                return (KDM_TO_PHYS(PAGE_ALIGN(SYMMON_STK_ADDR(nasid, 0))) >>
-                                                                PAGE_SHIFT);
+                return KDM_TO_PHYS(PAGE_ALIGN(SYMMON_STK_ADDR(nasid, 0))) >> PAGE_SHIFT;
 }
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index a304bcc37e4f..0b68469e063f 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -42,8 +42,7 @@ static int fine_mode;
 
 static int is_fine_dirmode(void)
 {
-        return (((LOCAL_HUB_L(NI_STATUS_REV_ID) & NSRI_REGIONSIZE_MASK)
-                >> NSRI_REGIONSIZE_SHFT) & REGIONSIZE_FINE);
+        return ((LOCAL_HUB_L(NI_STATUS_REV_ID) & NSRI_REGIONSIZE_MASK) >> NSRI_REGIONSIZE_SHFT) & REGIONSIZE_FINE;
 }
 
 static hubreg_t get_region(cnodeid_t cnode)
@@ -288,7 +287,7 @@ static unsigned long __init slot_psize_compute(cnodeid_t node, int slot)
         if (size <= 128) {
                 if (slot % 4 == 0) {
                         size <<= 20;            /* size in bytes */
-                        return(size >> PAGE_SHIFT);
+                        return size >> PAGE_SHIFT;
                 } else
                         return 0;
         } else {
diff --git a/arch/mips/sibyte/common/cfe.c b/arch/mips/sibyte/common/cfe.c
index 588e1806a1a3..c1a11a11db7f 100644
--- a/arch/mips/sibyte/common/cfe.c
+++ b/arch/mips/sibyte/common/cfe.c
@@ -38,7 +38,7 @@
 #define MAX_RAM_SIZE (~0ULL)
 #else
 #ifdef CONFIG_HIGHMEM
-#ifdef CONFIG_64BIT_PHYS_ADDR
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
 #define MAX_RAM_SIZE (~0ULL)
 #else
 #define MAX_RAM_SIZE (0xffffffffULL)
@@ -49,8 +49,8 @@
 #endif
 
 #define SIBYTE_MAX_MEM_REGIONS 8
-phys_t board_mem_region_addrs[SIBYTE_MAX_MEM_REGIONS];
-phys_t board_mem_region_sizes[SIBYTE_MAX_MEM_REGIONS];
+phys_addr_t board_mem_region_addrs[SIBYTE_MAX_MEM_REGIONS];
+phys_addr_t board_mem_region_sizes[SIBYTE_MAX_MEM_REGIONS];
 unsigned int board_mem_region_count;
 
 int cfe_cons_handle;
@@ -96,7 +96,7 @@ static void __noreturn cfe_linux_halt(void)
 
 static __init void prom_meminit(void)
 {
-        u64 addr, size, type; /* regardless of 64BIT_PHYS_ADDR */
+        u64 addr, size, type; /* regardless of PHYS_ADDR_T_64BIT */
         int mem_flags = 0;
         unsigned int idx;
         int rd_flag;
diff --git a/arch/mips/sibyte/swarm/platform.c b/arch/mips/sibyte/swarm/platform.c
index 9480c14ec66a..1cecdcf85cf1 100644
--- a/arch/mips/sibyte/swarm/platform.c
+++ b/arch/mips/sibyte/swarm/platform.c
@@ -50,7 +50,7 @@ static struct platform_device swarm_pata_device = {
 static int __init swarm_pata_init(void)
 {
         u8 __iomem *base;
-        phys_t offset, size;
+        phys_addr_t offset, size;
         struct resource *r;
 
         if (!SIBYTE_HAVE_IDE)
diff --git a/arch/mips/sibyte/swarm/rtc_m41t81.c b/arch/mips/sibyte/swarm/rtc_m41t81.c
index b732600b47f5..e62466445f08 100644
--- a/arch/mips/sibyte/swarm/rtc_m41t81.c
+++ b/arch/mips/sibyte/swarm/rtc_m41t81.c
@@ -109,7 +109,7 @@ static int m41t81_read(uint8_t addr)
                 return -1;
         }
 
-        return (__raw_readq(SMB_CSR(R_SMB_DATA)) & 0xff);
+        return __raw_readq(SMB_CSR(R_SMB_DATA)) & 0xff;
 }
 
 static int m41t81_write(uint8_t addr, int b)
@@ -229,5 +229,5 @@ int m41t81_probe(void)
         tmp = m41t81_read(M41T81REG_SC);
         m41t81_write(M41T81REG_SC, tmp & 0x7f);
 
-        return (m41t81_read(M41T81REG_SC) != -1);
+        return m41t81_read(M41T81REG_SC) != -1;
 }
diff --git a/arch/mips/sibyte/swarm/rtc_xicor1241.c b/arch/mips/sibyte/swarm/rtc_xicor1241.c
index 178a824b28d4..50a82c495427 100644
--- a/arch/mips/sibyte/swarm/rtc_xicor1241.c
+++ b/arch/mips/sibyte/swarm/rtc_xicor1241.c
@@ -84,7 +84,7 @@ static int xicor_read(uint8_t addr)
                 return -1;
         }
 
-        return (__raw_readq(SMB_CSR(R_SMB_DATA)) & 0xff);
+        return __raw_readq(SMB_CSR(R_SMB_DATA)) & 0xff;
 }
 
 static int xicor_write(uint8_t addr, int b)
@@ -206,5 +206,5 @@ unsigned long xicor_get_time(void)
 
 int xicor_probe(void)
 {
-        return (xicor_read(X1241REG_SC) != -1);
+        return xicor_read(X1241REG_SC) != -1;
 }
diff --git a/arch/mips/sibyte/swarm/setup.c b/arch/mips/sibyte/swarm/setup.c
index 3462c831d0ea..494fb0a475ac 100644
--- a/arch/mips/sibyte/swarm/setup.c
+++ b/arch/mips/sibyte/swarm/setup.c
@@ -76,7 +76,7 @@ int swarm_be_handler(struct pt_regs *regs, int is_fixup)
                 printk("DBE physical address: %010Lx\n",
                        __read_64bit_c0_register($26, 1));
         }
-        return (is_fixup ? MIPS_BE_FIXUP : MIPS_BE_FATAL);
+        return is_fixup ? MIPS_BE_FIXUP : MIPS_BE_FATAL;
 }
 
 enum swarm_rtc_type {
diff --git a/arch/mips/txx9/generic/setup_tx4927.c b/arch/mips/txx9/generic/setup_tx4927.c
index e714d6ce9a82..a4664cb6c1e1 100644
--- a/arch/mips/txx9/generic/setup_tx4927.c
+++ b/arch/mips/txx9/generic/setup_tx4927.c
@@ -29,8 +29,8 @@ static void __init tx4927_wdr_init(void)
 {
         /* report watchdog reset status */
         if (____raw_readq(&tx4927_ccfgptr->ccfg) & TX4927_CCFG_WDRST)
-                pr_warning("Watchdog reset detected at 0x%lx\n",
-                           read_c0_errorepc());
+                pr_warn("Watchdog reset detected at 0x%lx\n",
+                        read_c0_errorepc());
         /* clear WatchDogReset (W1C) */
         tx4927_ccfg_set(TX4927_CCFG_WDRST);
         /* do reset on watchdog */
diff --git a/arch/mips/txx9/generic/setup_tx4938.c b/arch/mips/txx9/generic/setup_tx4938.c
index 0a3bf2dfaba1..58cdb2aba5e1 100644
--- a/arch/mips/txx9/generic/setup_tx4938.c
+++ b/arch/mips/txx9/generic/setup_tx4938.c
@@ -31,8 +31,8 @@ static void __init tx4938_wdr_init(void)
 {
         /* report watchdog reset status */
         if (____raw_readq(&tx4938_ccfgptr->ccfg) & TX4938_CCFG_WDRST)
-                pr_warning("Watchdog reset detected at 0x%lx\n",
-                           read_c0_errorepc());
+                pr_warn("Watchdog reset detected at 0x%lx\n",
+                        read_c0_errorepc());
         /* clear WatchDogReset (W1C) */
         tx4938_ccfg_set(TX4938_CCFG_WDRST);
         /* do reset on watchdog */
diff --git a/arch/mips/txx9/generic/setup_tx4939.c b/arch/mips/txx9/generic/setup_tx4939.c
index b7eccbd17bf7..e3733cde50d6 100644
--- a/arch/mips/txx9/generic/setup_tx4939.c
+++ b/arch/mips/txx9/generic/setup_tx4939.c
@@ -35,8 +35,8 @@ static void __init tx4939_wdr_init(void)
 {
         /* report watchdog reset status */
         if (____raw_readq(&tx4939_ccfgptr->ccfg) & TX4939_CCFG_WDRST)
-                pr_warning("Watchdog reset detected at 0x%lx\n",
-                           read_c0_errorepc());
+                pr_warn("Watchdog reset detected at 0x%lx\n",
+                        read_c0_errorepc());
         /* clear WatchDogReset (W1C) */
         tx4939_ccfg_set(TX4939_CCFG_WDRST);
         /* do reset on watchdog */
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 88eace4e28c3..af696874248b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -88,6 +88,7 @@ config PPC
         select ARCH_MIGHT_HAVE_PC_PARPORT
         select ARCH_MIGHT_HAVE_PC_SERIO
         select BINFMT_ELF
+        select ARCH_BINFMT_ELF_RANDOMIZE_PIE
         select OF
         select OF_EARLY_FLATTREE
         select OF_RESERVED_MEM
@@ -148,6 +149,8 @@ config PPC
         select HAVE_ARCH_AUDITSYSCALL
         select ARCH_SUPPORTS_ATOMIC_RMW
         select DCACHE_WORD_ACCESS if PPC64 && CPU_LITTLE_ENDIAN
+        select NO_BOOTMEM
+        select HAVE_GENERIC_RCU_GUP
 
 config GENERIC_CSUM
         def_bool CPU_LITTLE_ENDIAN
@@ -549,7 +552,7 @@ config PPC_4K_PAGES
         bool "4k page size"
 
 config PPC_16K_PAGES
-        bool "16k page size" if 44x
+        bool "16k page size" if 44x || PPC_8xx
 
 config PPC_64K_PAGES
         bool "64k page size" if 44x || PPC_STD_MMU_64 || PPC_BOOK3E_64
diff --git a/arch/powerpc/boot/dts/b4860emu.dts b/arch/powerpc/boot/dts/b4860emu.dts
index 85646b4f96e1..2aa5cd318ce8 100644
--- a/arch/powerpc/boot/dts/b4860emu.dts
+++ b/arch/powerpc/boot/dts/b4860emu.dts
@@ -193,9 +193,9 @@
                 fsl,liodn-bits = <12>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "fsl/qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,b4-clockgen", "fsl,qoriq-clockgen-2.0";
-                reg = <0xe1000 0x1000>;
         };
 
 /include/ "fsl/qoriq-dma-0.dtsi"
diff --git a/arch/powerpc/boot/dts/b4qds.dtsi b/arch/powerpc/boot/dts/b4qds.dtsi
index 8b47edcfabf0..e5bde0b85135 100644
--- a/arch/powerpc/boot/dts/b4qds.dtsi
+++ b/arch/powerpc/boot/dts/b4qds.dtsi
@@ -152,6 +152,29 @@
                                                 reg = <0x68>;
                                         };
                                 };
+
+                                i2c@2 {
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        reg = <0x2>;
+
+                                        ina220@40 {
+                                                compatible = "ti,ina220";
+                                                reg = <0x40>;
+                                                shunt-resistor = <1000>;
+                                        };
+                                };
+
+                                i2c@3 {
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        reg = <0x3>;
+
+                                        adt7461@4c {
+                                                compatible = "adi,adt7461";
+                                                reg = <0x4c>;
+                                        };
+                                };
                         };
                 };
 
diff --git a/arch/powerpc/boot/dts/bsc9131rdb.dtsi b/arch/powerpc/boot/dts/bsc9131rdb.dtsi
index 9e6c01339ccc..45efcbadb23c 100644
--- a/arch/powerpc/boot/dts/bsc9131rdb.dtsi
+++ b/arch/powerpc/boot/dts/bsc9131rdb.dtsi
@@ -40,31 +40,6 @@
                 compatible = "fsl,ifc-nand";
                 reg = <0x0 0x0 0x4000>;
 
-                partition@0 {
-                        /* This location must not be altered  */
-                        /* 3MB for u-boot Bootloader Image */
-                        reg = <0x0 0x00300000>;
-                        label = "NAND U-Boot Image";
-                        read-only;
-                };
-
-                partition@300000 {
-                        /* 1MB for DTB Image */
-                        reg = <0x00300000 0x00100000>;
-                        label = "NAND DTB Image";
-                };
-
-                partition@400000 {
-                        /* 8MB for Linux Kernel Image */
-                        reg = <0x00400000 0x00800000>;
-                        label = "NAND Linux Kernel Image";
-                };
-
-                partition@c00000 {
-                        /* Rest space for Root file System Image */
-                        reg = <0x00c00000 0x07400000>;
-                        label = "NAND RFS Image";
-                };
         };
 };
 
@@ -82,31 +57,6 @@
                         reg = <0>;
                         spi-max-frequency = <50000000>;
 
-                        /* 512KB for u-boot Bootloader Image */
-                        partition@0 {
-                                reg = <0x0 0x00080000>;
-                                label = "SPI Flash U-Boot Image";
-                                read-only;
-                        };
-
-                        /* 512KB for DTB Image */
-                        partition@80000 {
-                                reg = <0x00080000 0x00080000>;
-                                label = "SPI Flash DTB Image";
-                        };
-
-                        /* 4MB for Linux Kernel Image */
-                        partition@100000 {
-                                reg = <0x00100000 0x00400000>;
-                                label = "SPI Flash Kernel Image";
-                        };
-
-                        /*11MB for RFS Image */
-                        partition@500000 {
-                                reg = <0x00500000 0x00B00000>;
-                                label = "SPI Flash RFS Image";
-                        };
-
                 };
         };
 
diff --git a/arch/powerpc/boot/dts/fsl/b4420si-post.dtsi b/arch/powerpc/boot/dts/fsl/b4420si-post.dtsi
index d67894459ac8..86161ae6c966 100644
--- a/arch/powerpc/boot/dts/fsl/b4420si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/b4420si-post.dtsi
@@ -80,33 +80,9 @@
                 compatible = "fsl,b4420-device-config", "fsl,qoriq-device-config-2.0";
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,b4420-clockgen", "fsl,qoriq-clockgen-2.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-2.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2", "pll0-div4";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2", "pll1-div4";
-                };
 
                 mux0: mux0@0 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/b4860si-post.dtsi b/arch/powerpc/boot/dts/fsl/b4860si-post.dtsi
index 582381dba1d7..65100b9636b7 100644
--- a/arch/powerpc/boot/dts/fsl/b4860si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/b4860si-post.dtsi
@@ -124,33 +124,9 @@
                 compatible = "fsl,b4860-device-config", "fsl,qoriq-device-config-2.0";
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,b4860-clockgen", "fsl,qoriq-clockgen-2.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-2.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2", "pll0-div4";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2", "pll1-div4";
-                };
 
                 mux0: mux0@0 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
index 69ce1026c948..efd74db4f9b0 100644
--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
@@ -305,53 +305,9 @@
                 #sleep-cells = <2>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen1.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,p2041-clockgen", "fsl,qoriq-clockgen-1.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                clock-frequency = <0>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-1.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2";
-                };
-
-                mux0: mux0@0 {
-                        #clock-cells = <0>;
-                        reg = <0x0 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux0";
-                };
-
-                mux1: mux1@20 {
-                        #clock-cells = <0>;
-                        reg = <0x20 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux1";
-                };
 
                 mux2: mux2@40 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/p3041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p3041si-post.dtsi
index cd63cb1b1042..d7425ef1ae41 100644
--- a/arch/powerpc/boot/dts/fsl/p3041si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p3041si-post.dtsi
@@ -332,53 +332,9 @@
                 #sleep-cells = <2>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen1.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,p3041-clockgen", "fsl,qoriq-clockgen-1.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                clock-frequency = <0>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-1.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2";
-                };
-
-                mux0: mux0@0 {
-                        #clock-cells = <0>;
-                        reg = <0x0 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux0";
-                };
-
-                mux1: mux1@20 {
-                        #clock-cells = <0>;
-                        reg = <0x20 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux1";
-                };
 
                 mux2: mux2@40 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi b/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi
index 12947ccddf25..7005a4a4cef0 100644
--- a/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi
@@ -352,35 +352,9 @@
                 #sleep-cells = <2>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen1.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,p4080-clockgen", "fsl,qoriq-clockgen-1.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                clock-frequency = <0>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-1.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2";
-                };
 
                 pll2: pll2@840 {
                         #clock-cells = <1>;
@@ -398,24 +372,6 @@
                         clock-output-names = "pll3", "pll3-div2";
                 };
 
-                mux0: mux0@0 {
-                        #clock-cells = <0>;
-                        reg = <0x0 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux0";
-                };
-
-                mux1: mux1@20 {
-                        #clock-cells = <0>;
-                        reg = <0x20 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux1";
-                };
-
                 mux2: mux2@40 {
                         #clock-cells = <0>;
                         reg = <0x40 0x4>;
diff --git a/arch/powerpc/boot/dts/fsl/p5020si-post.dtsi b/arch/powerpc/boot/dts/fsl/p5020si-post.dtsi
index 4c4a2b0436b2..55834211bd28 100644
--- a/arch/powerpc/boot/dts/fsl/p5020si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p5020si-post.dtsi
@@ -337,53 +337,9 @@
                 #sleep-cells = <2>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen1.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,p5020-clockgen", "fsl,qoriq-clockgen-1.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                clock-frequency = <0>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-1.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2";
-                };
-
-                mux0: mux0@0 {
-                        #clock-cells = <0>;
-                        reg = <0x0 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux0";
-                };
-
-                mux1: mux1@20 {
-                        #clock-cells = <0>;
-                        reg = <0x20 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux1";
-                };
         };
 
         rcpm: global-utilities@e2000 {
diff --git a/arch/powerpc/boot/dts/fsl/p5040si-post.dtsi b/arch/powerpc/boot/dts/fsl/p5040si-post.dtsi
index 67296fdd9698..6e4cd6ce363c 100644
--- a/arch/powerpc/boot/dts/fsl/p5040si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p5040si-post.dtsi
@@ -297,53 +297,9 @@
                 #sleep-cells = <2>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen1.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,p5040-clockgen", "fsl,qoriq-clockgen-1.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                clock-frequency = <0>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-1.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-1.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2";
-                };
-
-                mux0: mux0@0 {
-                        #clock-cells = <0>;
-                        reg = <0x0 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux0";
-                };
-
-                mux1: mux1@20 {
-                        #clock-cells = <0>;
-                        reg = <0x20 0x4>;
-                        compatible = "fsl,qoriq-core-mux-1.0";
-                        clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
-                        clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
-                        clock-output-names = "cmux1";
-                };
 
                 mux2: mux2@40 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/qoriq-clockgen1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-clockgen1.dtsi
new file mode 100644
index 000000000000..4ece1edbff63
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/qoriq-clockgen1.dtsi
@@ -0,0 +1,85 @@
+/*
+ * QorIQ clock control device tree stub [ controller @ offset 0xe1000 ]
+ *
+ * Copyright 2014 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+global-utilities@e1000 {
+        compatible = "fsl,qoriq-clockgen-1.0";
+        ranges = <0x0 0xe1000 0x1000>;
+        reg = <0xe1000 0x1000>;
+        clock-frequency = <0>;
+        #address-cells = <1>;
+        #size-cells = <1>;
+
+        sysclk: sysclk {
+                #clock-cells = <0>;
+                compatible = "fsl,qoriq-sysclk-1.0", "fixed-clock";
+                clock-output-names = "sysclk";
+        };
+        pll0: pll0@800 {
+                #clock-cells = <1>;
+                reg = <0x800 0x4>;
+                compatible = "fsl,qoriq-core-pll-1.0";
+                clocks = <&sysclk>;
+                clock-output-names = "pll0", "pll0-div2";
+        };
+        pll1: pll1@820 {
+                #clock-cells = <1>;
+                reg = <0x820 0x4>;
+                compatible = "fsl,qoriq-core-pll-1.0";
+                clocks = <&sysclk>;
+                clock-output-names = "pll1", "pll1-div2";
+        };
+        mux0: mux0@0 {
+                #clock-cells = <0>;
+                reg = <0x0 0x4>;
+                compatible = "fsl,qoriq-core-mux-1.0";
+                clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
+                clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
+                clock-output-names = "cmux0";
+        };
+        mux1: mux1@20 {
+                #clock-cells = <0>;
+                reg = <0x20 0x4>;
+                compatible = "fsl,qoriq-core-mux-1.0";
+                clocks = <&pll0 0>, <&pll0 1>, <&pll1 0>, <&pll1 1>;
+                clock-names = "pll0", "pll0-div2", "pll1", "pll1-div2";
+                clock-output-names = "cmux1";
+        };
+        platform_pll: platform-pll@c00 {
+                #clock-cells = <1>;
+                reg = <0xc00 0x4>;
+                compatible = "fsl,qoriq-platform-pll-1.0";
+                clocks = <&sysclk>;
+                clock-output-names = "platform-pll", "platform-pll-div2";
+        };
+};
diff --git a/arch/powerpc/boot/dts/fsl/qoriq-clockgen2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-clockgen2.dtsi
new file mode 100644
index 000000000000..48e0b6e4ce33
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/qoriq-clockgen2.dtsi
@@ -0,0 +1,68 @@
+/*
+ * QorIQ clock control device tree stub [ controller @ offset 0xe1000 ]
+ *
+ * Copyright 2014 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+global-utilities@e1000 {
+        compatible = "fsl,qoriq-clockgen-2.0";
+        ranges = <0x0 0xe1000 0x1000>;
+        reg = <0xe1000 0x1000>;
+        #address-cells = <1>;
+        #size-cells = <1>;
+
+        sysclk: sysclk {
+                #clock-cells = <0>;
+                compatible = "fsl,qoriq-sysclk-2.0", "fixed-clock";
+                clock-output-names = "sysclk";
+        };
+        pll0: pll0@800 {
+                #clock-cells = <1>;
+                reg = <0x800 0x4>;
+                compatible = "fsl,qoriq-core-pll-2.0";
+                clocks = <&sysclk>;
+                clock-output-names = "pll0", "pll0-div2", "pll0-div4";
+        };
+        pll1: pll1@820 {
+                #clock-cells = <1>;
+                reg = <0x820 0x4>;
+                compatible = "fsl,qoriq-core-pll-2.0";
+                clocks = <&sysclk>;
+                clock-output-names = "pll1", "pll1-div2", "pll1-div4";
+        };
+        platform_pll: platform-pll@c00 {
+                #clock-cells = <1>;
+                reg = <0xc00 0x4>;
+                compatible = "fsl,qoriq-platform-pll-2.0";
+                clocks = <&sysclk>;
+                clock-output-names = "platform-pll", "platform-pll-div2";
+        };
+};
diff --git a/arch/powerpc/boot/dts/fsl/t1040si-post.dtsi b/arch/powerpc/boot/dts/fsl/t1040si-post.dtsi
index 12e597eea3c8..15ae462e758f 100644
--- a/arch/powerpc/boot/dts/fsl/t1040si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/t1040si-post.dtsi
@@ -281,35 +281,9 @@
                 fsl,liodn-bits = <12>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,t1040-clockgen", "fsl,qoriq-clockgen-2.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-2.0";
-                        clock-output-names = "sysclk", "fixed-clock";
-                };
-
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2", "pll0-div4";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2", "pll1-div4";
-                };
 
                 mux0: mux0@0 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi
index aecee9690a88..1ce91e3485a9 100644
--- a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi
@@ -305,34 +305,9 @@
                 fsl,liodn-bits = <12>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,t2080-clockgen", "fsl,qoriq-clockgen-2.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-2.0";
-                        clock-output-names = "sysclk", "fixed-clock";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2", "pll0-div4";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2", "pll1-div4";
-                };
 
                 mux0: mux0@0 {
                         #clock-cells = <0>;
diff --git a/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi b/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
index 7e2fc7cdce48..0e96fcabe812 100644
--- a/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
@@ -368,34 +368,9 @@
                 fsl,liodn-bits = <12>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,t4240-clockgen", "fsl,qoriq-clockgen-2.0";
-                ranges = <0x0 0xe1000 0x1000>;
-                reg = <0xe1000 0x1000>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                sysclk: sysclk {
-                        #clock-cells = <0>;
-                        compatible = "fsl,qoriq-sysclk-2.0";
-                        clock-output-names = "sysclk";
-                };
-
-                pll0: pll0@800 {
-                        #clock-cells = <1>;
-                        reg = <0x800 0x4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll0", "pll0-div2", "pll0-div4";
-                };
-
-                pll1: pll1@820 {
-                        #clock-cells = <1>;
-                        reg = <0x820 0x4>;
-                        compatible = "fsl,qoriq-core-pll-2.0";
-                        clocks = <&sysclk>;
-                        clock-output-names = "pll1", "pll1-div2", "pll1-div4";
-                };
 
                 pll2: pll2@840 {
                         #clock-cells = <1>;
diff --git a/arch/powerpc/boot/dts/p3041ds.dts b/arch/powerpc/boot/dts/p3041ds.dts
index 2fed3bc0b990..394ea9c943c9 100644
--- a/arch/powerpc/boot/dts/p3041ds.dts
+++ b/arch/powerpc/boot/dts/p3041ds.dts
@@ -98,6 +98,26 @@
                                 reg = <0x68>;
                                 interrupts = <0x1 0x1 0 0>;
                         };
+                        ina220@40 {
+                                compatible = "ti,ina220";
+                                reg = <0x40>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@41 {
+                                compatible = "ti,ina220";
+                                reg = <0x41>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@44 {
+                                compatible = "ti,ina220";
+                                reg = <0x44>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@45 {
+                                compatible = "ti,ina220";
+                                reg = <0x45>;
+                                shunt-resistor = <1000>;
+                        };
                         adt7461@4c {
                                 compatible = "adi,adt7461";
                                 reg = <0x4c>;
diff --git a/arch/powerpc/boot/dts/p5020ds.dts b/arch/powerpc/boot/dts/p5020ds.dts
index 2869fea717dd..b7f3057cd894 100644
--- a/arch/powerpc/boot/dts/p5020ds.dts
+++ b/arch/powerpc/boot/dts/p5020ds.dts
@@ -98,6 +98,26 @@
                                 reg = <0x68>;
                                 interrupts = <0x1 0x1 0 0>;
                         };
+                        ina220@40 {
+                                compatible = "ti,ina220";
+                                reg = <0x40>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@41 {
+                                compatible = "ti,ina220";
+                                reg = <0x41>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@44 {
+                                compatible = "ti,ina220";
+                                reg = <0x44>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@45 {
+                                compatible = "ti,ina220";
+                                reg = <0x45>;
+                                shunt-resistor = <1000>;
+                        };
                         adt7461@4c {
                                 compatible = "adi,adt7461";
                                 reg = <0x4c>;
diff --git a/arch/powerpc/boot/dts/p5040ds.dts b/arch/powerpc/boot/dts/p5040ds.dts
index 860b5ccf76c0..7e04bf487c04 100644
--- a/arch/powerpc/boot/dts/p5040ds.dts
+++ b/arch/powerpc/boot/dts/p5040ds.dts
@@ -95,6 +95,26 @@
                                 reg = <0x68>;
                                 interrupts = <0x1 0x1 0 0>;
                         };
+                        ina220@40 {
+                                compatible = "ti,ina220";
+                                reg = <0x40>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@41 {
+                                compatible = "ti,ina220";
+                                reg = <0x41>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@44 {
+                                compatible = "ti,ina220";
+                                reg = <0x44>;
+                                shunt-resistor = <1000>;
+                        };
+                        ina220@45 {
+                                compatible = "ti,ina220";
+                                reg = <0x45>;
+                                shunt-resistor = <1000>;
+                        };
                         adt7461@4c {
                                 compatible = "adi,adt7461";
                                 reg = <0x4c>;
diff --git a/arch/powerpc/boot/dts/t104xrdb.dtsi b/arch/powerpc/boot/dts/t104xrdb.dtsi
index 1cf0f3c5f7e5..187add885cae 100644
--- a/arch/powerpc/boot/dts/t104xrdb.dtsi
+++ b/arch/powerpc/boot/dts/t104xrdb.dtsi
@@ -83,6 +83,13 @@
                         };
                 };
 
+                i2c@118000 {
+                        adt7461@4c {
+                                compatible = "adi,adt7461";
+                                reg = <0x4c>;
+                        };
+                };
+
                 i2c@118100 {
                         pca9546@77 {
                                 compatible = "nxp,pca9546";
diff --git a/arch/powerpc/boot/dts/t208xqds.dtsi b/arch/powerpc/boot/dts/t208xqds.dtsi
index 555dc6e03d89..59061834d54e 100644
--- a/arch/powerpc/boot/dts/t208xqds.dtsi
+++ b/arch/powerpc/boot/dts/t208xqds.dtsi
@@ -169,6 +169,17 @@
                                                 shunt-resistor = <1000>;
                                         };
                                 };
+
+                                i2c@3 {
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        reg = <0x3>;
+
+                                        adt7461@4c {
+                                                compatible = "adi,adt7461";
+                                                reg = <0x4c>;
+                                        };
+                                };
                         };
                 };
 
diff --git a/arch/powerpc/boot/dts/t4240emu.dts b/arch/powerpc/boot/dts/t4240emu.dts
index bc12127a03fb..decaf357db9c 100644
--- a/arch/powerpc/boot/dts/t4240emu.dts
+++ b/arch/powerpc/boot/dts/t4240emu.dts
@@ -250,9 +250,9 @@
                 fsl,liodn-bits = <12>;
         };
 
-        clockgen: global-utilities@e1000 {
+/include/ "fsl/qoriq-clockgen2.dtsi"
+        global-utilities@e1000 {
                 compatible = "fsl,t4240-clockgen", "fsl,qoriq-clockgen-2.0";
-                reg = <0xe1000 0x1000>;
         };
 
 /include/ "fsl/qoriq-dma-0.dtsi"
diff --git a/arch/powerpc/boot/main.c b/arch/powerpc/boot/main.c
index d367a0aece2a..d80161b633f4 100644
--- a/arch/powerpc/boot/main.c
+++ b/arch/powerpc/boot/main.c
@@ -144,13 +144,24 @@ static char cmdline[BOOT_COMMAND_LINE_SIZE]
 
 static void prep_cmdline(void *chosen)
 {
+        unsigned int getline_timeout = 5000;
+        int v;
+        int n;
+
+        /* Wait-for-input time */
+        n = getprop(chosen, "linux,cmdline-timeout", &v, sizeof(v));
+        if (n == sizeof(v))
+                getline_timeout = v;
+
         if (cmdline[0] == '\0')
                 getprop(chosen, "bootargs", cmdline, BOOT_COMMAND_LINE_SIZE-1);
 
         printf("\n\rLinux/PowerPC load: %s", cmdline);
+
         /* If possible, edit the command line */
-        if (console_ops.edit_cmdline)
-                console_ops.edit_cmdline(cmdline, BOOT_COMMAND_LINE_SIZE);
+        if (console_ops.edit_cmdline && getline_timeout)
+                console_ops.edit_cmdline(cmdline, BOOT_COMMAND_LINE_SIZE, getline_timeout);
+
         printf("\n\r");
 
         /* Put the command line back into the devtree for the kernel */
diff --git a/arch/powerpc/boot/ops.h b/arch/powerpc/boot/ops.h
index 8aad3c55aeda..5e75e1c5518e 100644
--- a/arch/powerpc/boot/ops.h
+++ b/arch/powerpc/boot/ops.h
@@ -58,7 +58,7 @@ extern struct dt_ops dt_ops;
 struct console_ops {
         int     (*open)(void);
         void    (*write)(const char *buf, int len);
-        void    (*edit_cmdline)(char *buf, int len);
+        void    (*edit_cmdline)(char *buf, int len, unsigned int getline_timeout);
         void    (*close)(void);
         void    *data;
 };
diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c
index f2156f07571f..167ee9433de6 100644
--- a/arch/powerpc/boot/serial.c
+++ b/arch/powerpc/boot/serial.c
@@ -33,7 +33,7 @@ static void serial_write(const char *buf, int len)
                 scdp->putc(*buf++);
 }
 
-static void serial_edit_cmdline(char *buf, int len)
+static void serial_edit_cmdline(char *buf, int len, unsigned int timeout)
 {
         int timer = 0, count;
         char ch, *cp;
@@ -44,7 +44,7 @@ static void serial_edit_cmdline(char *buf, int len)
         cp = &buf[count];
         count++;
 
-        while (timer++ < 5*1000) {
+        do {
                 if (scdp->tstc()) {
                         while (((ch = scdp->getc()) != '\n') && (ch != '\r')) {
                                 /* Test for backspace/delete */
@@ -70,7 +70,7 @@ static void serial_edit_cmdline(char *buf, int len)
                         break;  /* Exit 'timer' loop */
                 }
                 udelay(1000);  /* 1 msec */
-        }
+        } while (timer++ < timeout);
         *cp = 0;
 }
 
diff --git a/arch/powerpc/configs/corenet32_smp_defconfig b/arch/powerpc/configs/corenet32_smp_defconfig
index 688e9e4d29a1..611efe99faeb 100644
--- a/arch/powerpc/configs/corenet32_smp_defconfig
+++ b/arch/powerpc/configs/corenet32_smp_defconfig
@@ -144,6 +144,7 @@ CONFIG_RTC_DRV_DS1374=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_UIO=y
 CONFIG_STAGING=y
+CONFIG_MEMORY=y
 CONFIG_VIRT_DRIVERS=y
 CONFIG_FSL_HV_MANAGER=y
 CONFIG_EXT2_FS=y
diff --git a/arch/powerpc/configs/corenet64_smp_defconfig b/arch/powerpc/configs/corenet64_smp_defconfig
index 6db97e4414b2..be24a18c0d96 100644
--- a/arch/powerpc/configs/corenet64_smp_defconfig
+++ b/arch/powerpc/configs/corenet64_smp_defconfig
@@ -118,6 +118,7 @@ CONFIG_FSL_DMA=y
 CONFIG_VIRT_DRIVERS=y
 CONFIG_FSL_HV_MANAGER=y
 CONFIG_FSL_CORENET_CF=y
+CONFIG_MEMORY=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_ISO9660_FS=m
diff --git a/arch/powerpc/configs/mpc85xx_defconfig b/arch/powerpc/configs/mpc85xx_defconfig
index d2c415489f72..02395fab19bd 100644
--- a/arch/powerpc/configs/mpc85xx_defconfig
+++ b/arch/powerpc/configs/mpc85xx_defconfig
@@ -215,6 +215,7 @@ CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_CMOS=y
 CONFIG_DMADEVICES=y
 CONFIG_FSL_DMA=y
+CONFIG_MEMORY=y
 # CONFIG_NET_DMA is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
diff --git a/arch/powerpc/configs/mpc85xx_smp_defconfig b/arch/powerpc/configs/mpc85xx_smp_defconfig
index 87460083dbc7..b5d1b82a1b43 100644
--- a/arch/powerpc/configs/mpc85xx_smp_defconfig
+++ b/arch/powerpc/configs/mpc85xx_smp_defconfig
@@ -216,6 +216,7 @@ CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_CMOS=y
 CONFIG_DMADEVICES=y
 CONFIG_FSL_DMA=y
+CONFIG_MEMORY=y
 # CONFIG_NET_DMA is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
index bd3bd573d0ae..59abc620f8e8 100644
--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -14,9 +14,9 @@
  *
  * The bitop functions are defined to work on unsigned longs, so for a
  * ppc64 system the bits end up numbered:
- *   |63..............0|127............64|191...........128|255...........196|
+ *   |63..............0|127............64|191...........128|255...........192|
  * and on ppc32:
- *   |31.....0|63....31|95....64|127...96|159..128|191..160|223..192|255..224|
+ *   |31.....0|63....32|95....64|127...96|159..128|191..160|223..192|255..224|
  *
  * There are a few little-endian macros used mostly for filesystem
  * bitmaps, these work on similar bit arrays layouts, but
@@ -213,7 +213,7 @@ static __inline__ unsigned long ffz(unsigned long x)
         return __ilog2(x & -x);
 }
 
-static __inline__ int __ffs(unsigned long x)
+static __inline__ unsigned long __ffs(unsigned long x)
 {
         return __ilog2(x & -x);
 }
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index daa5af91163c..22d5a7da9e68 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -448,13 +448,9 @@ extern const char *powerpc_base_platform;
             CPU_FTR_PURR | CPU_FTR_REAL_LE | CPU_FTR_DABRX)
 #define CPU_FTRS_COMPATIBLE     (CPU_FTR_USE_TB | CPU_FTR_PPCAS_ARCH_V2)
 
-#define CPU_FTRS_A2 (CPU_FTR_USE_TB | CPU_FTR_SMT | CPU_FTR_DBELL | \
-                     CPU_FTR_NOEXECUTE | CPU_FTR_NODSISRALIGN | \
-                     CPU_FTR_ICSWX | CPU_FTR_DABRX )
-
 #ifdef __powerpc64__
 #ifdef CONFIG_PPC_BOOK3E
-#define CPU_FTRS_POSSIBLE       (CPU_FTRS_E6500 | CPU_FTRS_E5500 | CPU_FTRS_A2)
+#define CPU_FTRS_POSSIBLE       (CPU_FTRS_E6500 | CPU_FTRS_E5500)
 #else
 #define CPU_FTRS_POSSIBLE       \
             (CPU_FTRS_POWER4 | CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | \
@@ -505,13 +501,13 @@ enum {
 
 #ifdef __powerpc64__
 #ifdef CONFIG_PPC_BOOK3E
-#define CPU_FTRS_ALWAYS         (CPU_FTRS_E6500 & CPU_FTRS_E5500 & CPU_FTRS_A2)
+#define CPU_FTRS_ALWAYS         (CPU_FTRS_E6500 & CPU_FTRS_E5500)
 #else
 #define CPU_FTRS_ALWAYS         \
             (CPU_FTRS_POWER4 & CPU_FTRS_PPC970 & CPU_FTRS_POWER5 & \
              CPU_FTRS_POWER6 & CPU_FTRS_POWER7 & CPU_FTRS_CELL & \
              CPU_FTRS_PA6T & CPU_FTRS_POWER8 & CPU_FTRS_POWER8E & \
-             CPU_FTRS_POWER8_DD1 & CPU_FTRS_POSSIBLE)
+             CPU_FTRS_POWER8_DD1 & ~CPU_FTR_HVMODE & CPU_FTRS_POSSIBLE)
 #endif
 #else
 enum {
diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h
index ca07f9c27335..0652ebe117af 100644
--- a/arch/powerpc/include/asm/eeh.h
+++ b/arch/powerpc/include/asm/eeh.h
@@ -39,6 +39,7 @@ struct device_node;
 #define EEH_PROBE_MODE_DEV      0x04    /* From PCI device      */
 #define EEH_PROBE_MODE_DEVTREE  0x08    /* From device tree     */
 #define EEH_ENABLE_IO_FOR_LOG   0x10    /* Enable IO for log    */
+#define EEH_EARLY_DUMP_LOG      0x20    /* Dump log immediately */
 
 /*
  * Delay for PE reset, all in ms
@@ -72,6 +73,7 @@ struct device_node;
 #define EEH_PE_ISOLATED         (1 << 0)        /* Isolated PE          */
 #define EEH_PE_RECOVERING       (1 << 1)        /* Recovering PE        */
 #define EEH_PE_CFG_BLOCKED      (1 << 2)        /* Block config access  */
+#define EEH_PE_RESET            (1 << 3)        /* PE reset in progress */
 
 #define EEH_PE_KEEP             (1 << 8)        /* Keep PE on hotplug   */
 #define EEH_PE_CFG_RESTRICTED   (1 << 9)        /* Block config on error */
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 888d8f3f2524..57d289acb803 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -28,8 +28,7 @@
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-extern unsigned long randomize_et_dyn(unsigned long base);
-#define ELF_ET_DYN_BASE         (randomize_et_dyn(0x20000000))
+#define ELF_ET_DYN_BASE 0x20000000
 
 #define ELF_CORE_EFLAGS (is_elf2_task() ? 2 : 0)
 
diff --git a/arch/powerpc/include/asm/fsl_guts.h b/arch/powerpc/include/asm/fsl_guts.h
index 77ced0b3d81d..43b6bb1a4a9c 100644
--- a/arch/powerpc/include/asm/fsl_guts.h
+++ b/arch/powerpc/include/asm/fsl_guts.h
@@ -68,7 +68,10 @@ struct ccsr_guts {
         u8      res0b4[0xc0 - 0xb4];
         __be32  iovselsr;       /* 0x.00c0 - I/O voltage select status register
                                              Called 'elbcvselcr' on 86xx SOCs */
-        u8      res0c4[0x224 - 0xc4];
+        u8      res0c4[0x100 - 0xc4];
+        __be32  rcwsr[16];      /* 0x.0100 - Reset Control Word Status registers
+                                             There are 16 registers */
+        u8      res140[0x224 - 0x140];
         __be32  iodelay1;       /* 0x.0224 - IO delay control register 1 */
         __be32  iodelay2;       /* 0x.0228 - IO delay control register 2 */
         u8      res22c[0x604 - 0x22c];
diff --git a/arch/powerpc/include/asm/hardirq.h b/arch/powerpc/include/asm/hardirq.h
index 1bbb3013d6aa..8add8b861e8d 100644
--- a/arch/powerpc/include/asm/hardirq.h
+++ b/arch/powerpc/include/asm/hardirq.h
@@ -21,7 +21,12 @@ DECLARE_PER_CPU_SHARED_ALIGNED(irq_cpustat_t, irq_stat);
 
 #define __ARCH_IRQ_STAT
 
-#define local_softirq_pending() __get_cpu_var(irq_stat).__softirq_pending
+#define local_softirq_pending() __this_cpu_read(irq_stat.__softirq_pending)
+
+#define __ARCH_SET_SOFTIRQ_PENDING
+
+#define set_softirq_pending(x) __this_cpu_write(irq_stat.__softirq_pending, (x))
+#define or_softirq_pending(x) __this_cpu_or(irq_stat.__softirq_pending, (x))
 
 static inline void ack_bad_irq(unsigned int irq)
 {
diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
index 766b77d527ac..1d53a65b4ec1 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -48,7 +48,7 @@ static inline unsigned int hugepd_shift(hugepd_t hpd)
 #endif /* CONFIG_PPC_BOOK3S_64 */
 
 
-static inline pte_t *hugepte_offset(hugepd_t *hpdp, unsigned long addr,
+static inline pte_t *hugepte_offset(hugepd_t hpd, unsigned long addr,
                                     unsigned pdshift)
 {
         /*
@@ -58,9 +58,9 @@ static inline pte_t *hugepte_offset(hugepd_t *hpdp, unsigned long addr,
          */
         unsigned long idx = 0;
 
-        pte_t *dir = hugepd_page(*hpdp);
+        pte_t *dir = hugepd_page(hpd);
 #ifndef CONFIG_PPC_FSL_BOOK3E
-        idx = (addr & ((1UL << pdshift) - 1)) >> hugepd_shift(*hpdp);
+        idx = (addr & ((1UL << pdshift) - 1)) >> hugepd_shift(hpd);
 #endif
 
         return dir + idx;
@@ -193,7 +193,7 @@ static inline void flush_hugetlb_page(struct vm_area_struct *vma,
 }
 
 #define hugepd_shift(x) 0
-static inline pte_t *hugepte_offset(hugepd_t *hpdp, unsigned long addr,
+static inline pte_t *hugepte_offset(hugepd_t hpd, unsigned long addr,
                                     unsigned pdshift)
 {
         return 0;
diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
index 9eaf301ac952..a8d2ef30d473 100644
--- a/arch/powerpc/include/asm/io.h
+++ b/arch/powerpc/include/asm/io.h
@@ -855,9 +855,6 @@ static inline void * bus_to_virt(unsigned long address)
 
 #define clrsetbits_8(addr, clear, set) clrsetbits(8, addr, clear, set)
 
-void __iomem *devm_ioremap_prot(struct device *dev, resource_size_t offset,
-                                size_t size, unsigned long flags);
-
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_POWERPC_IO_H */
diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
index 307347f8ddbd..c8175a3fe560 100644
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -42,7 +42,7 @@ struct machdep_calls {
                                          unsigned long newpp, 
                                          unsigned long vpn,
                                          int bpsize, int apsize,
-                                         int ssize, int local);
+                                         int ssize, unsigned long flags);
         void            (*hpte_updateboltedpp)(unsigned long newpp, 
                                                unsigned long ea,
                                                int psize, int ssize);
@@ -60,7 +60,7 @@ struct machdep_calls {
         void            (*hugepage_invalidate)(unsigned long vsid,
                                                unsigned long addr,
                                                unsigned char *hpte_slot_array,
-                                               int psize, int ssize);
+                                               int psize, int ssize, int local);
         /* special for kexec, to be called in real mode, linear mapping is
          * destroyed as well */
         void            (*hpte_clear_all)(void);
@@ -142,7 +142,6 @@ struct machdep_calls {
 #endif
 
         void            (*restart)(char *cmd);
-        void            (*power_off)(void);
         void            (*halt)(void);
         void            (*panic)(char *str);
         void            (*cpu_die)(void);
@@ -292,10 +291,6 @@ struct machdep_calls {
 #ifdef CONFIG_ARCH_RANDOM
         int (*get_random_long)(unsigned long *v);
 #endif
-
-#ifdef CONFIG_MEMORY_HOTREMOVE
-        int (*remove_memory)(u64, u64);
-#endif
 };
 
 extern void e500_idle(void);
@@ -343,16 +338,6 @@ extern sys_ctrler_t sys_ctrler;
 
 #endif /* CONFIG_PPC_PMAC */
 
-
-/* Functions to produce codes on the leds.
- * The SRC code should be unique for the message category and should
- * be limited to the lower 24 bits (the upper 8 are set by these funcs),
- * and (for boot & dump) should be sorted numerically in the order
- * the events occur.
- */
-/* Print a boot progress message. */
-void ppc64_boot_msg(unsigned int src, const char *msg);
-
 static inline void log_error(char *buf, unsigned int err_type, int fatal)
 {
         if (ppc_md.log_error)
diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h
index 3d11d3ce79ec..986b9e1e1044 100644
--- a/arch/powerpc/include/asm/mmu-8xx.h
+++ b/arch/powerpc/include/asm/mmu-8xx.h
@@ -56,6 +56,7 @@
  * additional information from the MI_EPN, and MI_TWC registers.
  */
 #define SPRN_MI_RPN     790
+#define MI_SPS16K       0x00000008      /* Small page size (0 = 4k, 1 = 16k) */
 
 /* Define an RPN value for mapping kernel memory to large virtual
  * pages for boot initialization.  This has real page number of 0,
@@ -129,6 +130,7 @@
  * additional information from the MD_EPN, and MD_TWC registers.
  */
 #define SPRN_MD_RPN     798
+#define MD_SPS16K       0x00000008      /* Small page size (0 = 4k, 1 = 16k) */
 
 /* This is a temporary storage register that could be used to save
  * a processor working register during a tablewalk.
diff --git a/arch/powerpc/include/asm/mmu-hash64.h b/arch/powerpc/include/asm/mmu-hash64.h
index aeebc94b2bce..4f13c3ed7acf 100644
--- a/arch/powerpc/include/asm/mmu-hash64.h
+++ b/arch/powerpc/include/asm/mmu-hash64.h
@@ -316,27 +316,33 @@ static inline unsigned long hpt_hash(unsigned long vpn,
         return hash & 0x7fffffffffUL;
 }
 
+#define HPTE_LOCAL_UPDATE       0x1
+#define HPTE_NOHPTE_UPDATE      0x2
+
 extern int __hash_page_4K(unsigned long ea, unsigned long access,
                           unsigned long vsid, pte_t *ptep, unsigned long trap,
-                          unsigned int local, int ssize, int subpage_prot);
+                          unsigned long flags, int ssize, int subpage_prot);
 extern int __hash_page_64K(unsigned long ea, unsigned long access,
                            unsigned long vsid, pte_t *ptep, unsigned long trap,
-                           unsigned int local, int ssize);
+                           unsigned long flags, int ssize);
 struct mm_struct;
 unsigned int hash_page_do_lazy_icache(unsigned int pp, pte_t pte, int trap);
-extern int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, unsigned long trap);
-extern int hash_page(unsigned long ea, unsigned long access, unsigned long trap);
+extern int hash_page_mm(struct mm_struct *mm, unsigned long ea,
+                        unsigned long access, unsigned long trap,
+                        unsigned long flags);
+extern int hash_page(unsigned long ea, unsigned long access, unsigned long trap,
+                     unsigned long dsisr);
 int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
-                     pte_t *ptep, unsigned long trap, int local, int ssize,
-                     unsigned int shift, unsigned int mmu_psize);
+                     pte_t *ptep, unsigned long trap, unsigned long flags,
+                     int ssize, unsigned int shift, unsigned int mmu_psize);
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 extern int __hash_page_thp(unsigned long ea, unsigned long access,
                            unsigned long vsid, pmd_t *pmdp, unsigned long trap,
-                           int local, int ssize, unsigned int psize);
+                           unsigned long flags, int ssize, unsigned int psize);
 #else
 static inline int __hash_page_thp(unsigned long ea, unsigned long access,
                                   unsigned long vsid, pmd_t *pmdp,
-                                  unsigned long trap, int local,
+                                  unsigned long trap, unsigned long flags,
                                   int ssize, unsigned int psize)
 {
         BUG();
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index 9124b0ede1fc..5cd8d2fddba9 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -154,6 +154,10 @@ struct opal_sg_list {
 #define OPAL_HANDLE_HMI                         98
 #define OPAL_REGISTER_DUMP_REGION               101
 #define OPAL_UNREGISTER_DUMP_REGION             102
+#define OPAL_WRITE_TPO                          103
+#define OPAL_READ_TPO                           104
+#define OPAL_IPMI_SEND                          107
+#define OPAL_IPMI_RECV                          108
 
 #ifndef __ASSEMBLY__
 
@@ -284,62 +288,6 @@ enum OpalMessageType {
         OPAL_MSG_TYPE_MAX,
 };
 
-/* Machine check related definitions */
-enum OpalMCE_Version {
-        OpalMCE_V1 = 1,
-};
-
-enum OpalMCE_Severity {
-        OpalMCE_SEV_NO_ERROR = 0,
-        OpalMCE_SEV_WARNING = 1,
-        OpalMCE_SEV_ERROR_SYNC = 2,
-        OpalMCE_SEV_FATAL = 3,
-};
-
-enum OpalMCE_Disposition {
-        OpalMCE_DISPOSITION_RECOVERED = 0,
-        OpalMCE_DISPOSITION_NOT_RECOVERED = 1,
-};
-
-enum OpalMCE_Initiator {
-        OpalMCE_INITIATOR_UNKNOWN = 0,
-        OpalMCE_INITIATOR_CPU = 1,
-};
-
-enum OpalMCE_ErrorType {
-        OpalMCE_ERROR_TYPE_UNKNOWN = 0,
-        OpalMCE_ERROR_TYPE_UE = 1,
-        OpalMCE_ERROR_TYPE_SLB = 2,
-        OpalMCE_ERROR_TYPE_ERAT = 3,
-        OpalMCE_ERROR_TYPE_TLB = 4,
-};
-
-enum OpalMCE_UeErrorType {
-        OpalMCE_UE_ERROR_INDETERMINATE = 0,
-        OpalMCE_UE_ERROR_IFETCH = 1,
-        OpalMCE_UE_ERROR_PAGE_TABLE_WALK_IFETCH = 2,
-        OpalMCE_UE_ERROR_LOAD_STORE = 3,
-        OpalMCE_UE_ERROR_PAGE_TABLE_WALK_LOAD_STORE = 4,
-};
-
-enum OpalMCE_SlbErrorType {
-        OpalMCE_SLB_ERROR_INDETERMINATE = 0,
-        OpalMCE_SLB_ERROR_PARITY = 1,
-        OpalMCE_SLB_ERROR_MULTIHIT = 2,
-};
-
-enum OpalMCE_EratErrorType {
-        OpalMCE_ERAT_ERROR_INDETERMINATE = 0,
-        OpalMCE_ERAT_ERROR_PARITY = 1,
-        OpalMCE_ERAT_ERROR_MULTIHIT = 2,
-};
-
-enum OpalMCE_TlbErrorType {
-        OpalMCE_TLB_ERROR_INDETERMINATE = 0,
-        OpalMCE_TLB_ERROR_PARITY = 1,
-        OpalMCE_TLB_ERROR_MULTIHIT = 2,
-};
-
 enum OpalThreadStatus {
         OPAL_THREAD_INACTIVE = 0x0,
         OPAL_THREAD_STARTED = 0x1,
@@ -452,52 +400,15 @@ struct opal_msg {
         __be64 params[8];
 };
 
-struct opal_machine_check_event {
-        enum OpalMCE_Version    version:8;      /* 0x00 */
-        uint8_t                 in_use;         /* 0x01 */
-        enum OpalMCE_Severity   severity:8;     /* 0x02 */
-        enum OpalMCE_Initiator  initiator:8;    /* 0x03 */
-        enum OpalMCE_ErrorType  error_type:8;   /* 0x04 */
-        enum OpalMCE_Disposition disposition:8; /* 0x05 */
-        uint8_t                 reserved_1[2];  /* 0x06 */
-        uint64_t                gpr3;           /* 0x08 */
-        uint64_t                srr0;           /* 0x10 */
-        uint64_t                srr1;           /* 0x18 */
-        union {                                 /* 0x20 */
-                struct {
-                        enum OpalMCE_UeErrorType ue_error_type:8;
-                        uint8_t         effective_address_provided;
-                        uint8_t         physical_address_provided;
-                        uint8_t         reserved_1[5];
-                        uint64_t        effective_address;
-                        uint64_t        physical_address;
-                        uint8_t         reserved_2[8];
-                } ue_error;
-
-                struct {
-                        enum OpalMCE_SlbErrorType slb_error_type:8;
-                        uint8_t         effective_address_provided;
-                        uint8_t         reserved_1[6];
-                        uint64_t        effective_address;
-                        uint8_t         reserved_2[16];
-                } slb_error;
-
-                struct {
-                        enum OpalMCE_EratErrorType erat_error_type:8;
-                        uint8_t         effective_address_provided;
-                        uint8_t         reserved_1[6];
-                        uint64_t        effective_address;
-                        uint8_t         reserved_2[16];
-                } erat_error;
+enum {
+        OPAL_IPMI_MSG_FORMAT_VERSION_1 = 1,
+};
 
-                struct {
-                        enum OpalMCE_TlbErrorType tlb_error_type:8;
-                        uint8_t         effective_address_provided;
-                        uint8_t         reserved_1[6];
-                        uint64_t        effective_address;
-                        uint8_t         reserved_2[16];
-                } tlb_error;
-        } u;
+struct opal_ipmi_msg {
+        uint8_t         version;
+        uint8_t         netfn;
+        uint8_t         cmd;
+        uint8_t         data[];
 };
 
 /* FSP memory errors handling */
@@ -819,6 +730,9 @@ int64_t opal_rtc_read(__be32 *year_month_day,
                       __be64 *hour_minute_second_millisecond);
 int64_t opal_rtc_write(uint32_t year_month_day,
                        uint64_t hour_minute_second_millisecond);
+int64_t opal_tpo_read(uint64_t token, __be32 *year_mon_day, __be32 *hour_min);
+int64_t opal_tpo_write(uint64_t token, uint32_t year_mon_day,
+                       uint32_t hour_min);
 int64_t opal_cec_power_down(uint64_t request);
 int64_t opal_cec_reboot(void);
 int64_t opal_read_nvram(uint64_t buffer, uint64_t size, uint64_t offset);
@@ -963,6 +877,10 @@ int64_t opal_handle_hmi(void);
 int64_t opal_register_dump_region(uint32_t id, uint64_t start, uint64_t end);
 int64_t opal_unregister_dump_region(uint32_t id);
 int64_t opal_pci_set_phb_cxl_mode(uint64_t phb_id, uint64_t mode, uint64_t pe_number);
+int64_t opal_ipmi_send(uint64_t interface, struct opal_ipmi_msg *msg,
+                uint64_t msg_len);
+int64_t opal_ipmi_recv(uint64_t interface, struct opal_ipmi_msg *msg,
+                uint64_t *msg_len);
 
 /* Internal functions */
 extern int early_init_dt_scan_opal(unsigned long node, const char *uname,
@@ -992,8 +910,6 @@ extern int opal_async_wait_response(uint64_t token, struct opal_msg *msg);
 extern int opal_get_sensor_data(u32 sensor_hndl, u32 *sensor_data);
 
 struct rtc_time;
-extern int opal_set_rtc_time(struct rtc_time *tm);
-extern void opal_get_rtc_time(struct rtc_time *tm);
 extern unsigned long opal_get_boot_time(void);
 extern void opal_nvram_init(void);
 extern void opal_flash_init(void);
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index a5139ea6910b..24a386cbb928 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -42,7 +42,6 @@ extern unsigned int debug_smp_processor_id(void); /* from linux/smp.h */
 #define get_slb_shadow()        (get_paca()->slb_shadow_ptr)
 
 struct task_struct;
-struct opal_machine_check_event;
 
 /*
  * Defines the layout of the paca.
@@ -153,12 +152,6 @@ struct paca_struct {
         u64 tm_scratch;                 /* TM scratch area for reclaim */
 #endif
 
-#ifdef CONFIG_PPC_POWERNV
-        /* Pointer to OPAL machine check event structure set by the
-         * early exception handler for use by high level C handler
-         */
-        struct opal_machine_check_event *opal_mc_evt;
-#endif
 #ifdef CONFIG_PPC_BOOK3S_64
         /* Exclusive emergency stack pointer for machine check exception. */
         void *mc_emergency_sp;
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 26fe1ae15212..69c059887a2c 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -379,12 +379,14 @@ static inline int hugepd_ok(hugepd_t hpd)
 }
 #endif
 
-#define is_hugepd(pdep)               (hugepd_ok(*((hugepd_t *)(pdep))))
+#define is_hugepd(hpd)               (hugepd_ok(hpd))
+#define pgd_huge pgd_huge
 int pgd_huge(pgd_t pgd);
 #else /* CONFIG_HUGETLB_PAGE */
 #define is_hugepd(pdep)                 0
 #define pgd_huge(pgd)                   0
 #endif /* CONFIG_HUGETLB_PAGE */
+#define __hugepd(x) ((hugepd_t) { (x) })
 
 struct page;
 extern void clear_user_page(void *page, unsigned long vaddr, struct page *pg);
diff --git a/arch/powerpc/include/asm/pgtable-ppc32.h b/arch/powerpc/include/asm/pgtable-ppc32.h
index 945e47adf7db..234e07c47803 100644
--- a/arch/powerpc/include/asm/pgtable-ppc32.h
+++ b/arch/powerpc/include/asm/pgtable-ppc32.h
@@ -170,6 +170,25 @@ static inline unsigned long pte_update(pte_t *p,
 #ifdef PTE_ATOMIC_UPDATES
         unsigned long old, tmp;
 
+#ifdef CONFIG_PPC_8xx
+        unsigned long tmp2;
+
+        __asm__ __volatile__("\
+1:      lwarx   %0,0,%4\n\
+        andc    %1,%0,%5\n\
+        or      %1,%1,%6\n\
+        /* 0x200 == Extended encoding, bit 22 */ \
+        /* Bit 22 has to be 1 if neither _PAGE_USER nor _PAGE_RW are set */ \
+        rlwimi  %1,%1,32-2,0x200\n /* get _PAGE_USER */ \
+        rlwinm  %3,%1,32-1,0x200\n /* get _PAGE_RW */ \
+        or      %1,%3,%1\n\
+        xori    %1,%1,0x200\n"
+"       stwcx.  %1,0,%4\n\
+        bne-    1b"
+        : "=&r" (old), "=&r" (tmp), "=m" (*p), "=&r" (tmp2)
+        : "r" (p), "r" (clr), "r" (set), "m" (*p)
+        : "cc" );
+#else /* CONFIG_PPC_8xx */
         __asm__ __volatile__("\
 1:      lwarx   %0,0,%3\n\
         andc    %1,%0,%4\n\
@@ -180,6 +199,7 @@ static inline unsigned long pte_update(pte_t *p,
         : "=&r" (old), "=&r" (tmp), "=m" (*p)
         : "r" (p), "r" (clr), "r" (set), "m" (*p)
         : "cc" );
+#endif /* CONFIG_PPC_8xx */
 #else /* PTE_ATOMIC_UPDATES */
         unsigned long old = pte_val(*p);
         *p = __pte((old & ~clr) | set);
diff --git a/arch/powerpc/include/asm/pgtable-ppc64-4k.h b/arch/powerpc/include/asm/pgtable-ppc64-4k.h
index 7b935683f268..132ee1d482c2 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64-4k.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64-4k.h
@@ -57,7 +57,21 @@
 #define pgd_present(pgd)        (pgd_val(pgd) != 0)
 #define pgd_clear(pgdp)         (pgd_val(*(pgdp)) = 0)
 #define pgd_page_vaddr(pgd)     (pgd_val(pgd) & ~PGD_MASKED_BITS)
-#define pgd_page(pgd)           virt_to_page(pgd_page_vaddr(pgd))
+
+#ifndef __ASSEMBLY__
+
+static inline pte_t pgd_pte(pgd_t pgd)
+{
+        return __pte(pgd_val(pgd));
+}
+
+static inline pgd_t pte_pgd(pte_t pte)
+{
+        return __pgd(pte_val(pte));
+}
+extern struct page *pgd_page(pgd_t pgd);
+
+#endif /* !__ASSEMBLY__ */
 
 #define pud_offset(pgdp, addr)  \
   (((pud_t *) pgd_page_vaddr(*(pgdp))) + \
diff --git a/arch/powerpc/include/asm/pgtable-ppc64-64k.h b/arch/powerpc/include/asm/pgtable-ppc64-64k.h
index a56b82fb0609..1de35bbd02a6 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64-64k.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64-64k.h
@@ -38,4 +38,7 @@
 /* Bits to mask out from a PGD/PUD to get to the PMD page */
 #define PUD_MASKED_BITS         0x1ff
 
+#define pgd_pte(pgd)    (pud_pte(((pud_t){ pgd })))
+#define pte_pgd(pte)    ((pgd_t)pte_pud(pte))
+
 #endif /* _ASM_POWERPC_PGTABLE_PPC64_64K_H */
diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
index 9b4b1904efae..b9dcc936e2d1 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -152,7 +152,7 @@
 #define pmd_none(pmd)           (!pmd_val(pmd))
 #define pmd_bad(pmd)            (!is_kernel_addr(pmd_val(pmd)) \
                                  || (pmd_val(pmd) & PMD_BAD_BITS))
-#define pmd_present(pmd)        (pmd_val(pmd) != 0)
+#define pmd_present(pmd)        (!pmd_none(pmd))
 #define pmd_clear(pmdp)         (pmd_val(*(pmdp)) = 0)
 #define pmd_page_vaddr(pmd)     (pmd_val(pmd) & ~PMD_MASKED_BITS)
 extern struct page *pmd_page(pmd_t pmd);
@@ -164,9 +164,21 @@ extern struct page *pmd_page(pmd_t pmd);
 #define pud_present(pud)        (pud_val(pud) != 0)
 #define pud_clear(pudp)         (pud_val(*(pudp)) = 0)
 #define pud_page_vaddr(pud)     (pud_val(pud) & ~PUD_MASKED_BITS)
-#define pud_page(pud)           virt_to_page(pud_page_vaddr(pud))
 
+extern struct page *pud_page(pud_t pud);
+
+static inline pte_t pud_pte(pud_t pud)
+{
+        return __pte(pud_val(pud));
+}
+
+static inline pud_t pte_pud(pte_t pte)
+{
+        return __pud(pte_val(pte));
+}
+#define pud_write(pud)          pte_write(pud_pte(pud))
 #define pgd_set(pgdp, pudp)     ({pgd_val(*(pgdp)) = (unsigned long)(pudp);})
+#define pgd_write(pgd)          pte_write(pgd_pte(pgd))
 
 /*
  * Find an entry in a page-table-directory.  We combine the address region
@@ -422,7 +434,22 @@ extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                        pmd_t *pmdp, pmd_t pmd);
 extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
                                  pmd_t *pmd);
-
+/*
+ *
+ * For core kernel code by design pmd_trans_huge is never run on any hugetlbfs
+ * page. The hugetlbfs page table walking and mangling paths are totally
+ * separated form the core VM paths and they're differentiated by
+ *  VM_HUGETLB being set on vm_flags well before any pmd_trans_huge could run.
+ *
+ * pmd_trans_huge() is defined as false at build time if
+ * CONFIG_TRANSPARENT_HUGEPAGE=n to optimize away code blocks at build
+ * time in such case.
+ *
+ * For ppc64 we need to differntiate from explicit hugepages from THP, because
+ * for THP we also track the subpage details at the pmd level. We don't do
+ * that for explicit huge pages.
+ *
+ */
 static inline int pmd_trans_huge(pmd_t pmd)
 {
         /*
@@ -431,16 +458,6 @@ static inline int pmd_trans_huge(pmd_t pmd)
         return (pmd_val(pmd) & 0x3) && (pmd_val(pmd) & _PAGE_THP_HUGE);
 }
 
-static inline int pmd_large(pmd_t pmd)
-{
-        /*
-         * leaf pte for huge page, bottom two bits != 00
-         */
-        if (pmd_trans_huge(pmd))
-                return pmd_val(pmd) & _PAGE_PRESENT;
-        return 0;
-}
-
 static inline int pmd_trans_splitting(pmd_t pmd)
 {
         if (pmd_trans_huge(pmd))
@@ -451,6 +468,14 @@ static inline int pmd_trans_splitting(pmd_t pmd)
 extern int has_transparent_hugepage(void);
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
+static inline int pmd_large(pmd_t pmd)
+{
+        /*
+         * leaf pte for huge page, bottom two bits != 00
+         */
+        return ((pmd_val(pmd) & 0x3) != 0x0);
+}
+
 static inline pte_t pmd_pte(pmd_t pmd)
 {
         return __pte(pmd_val(pmd));
@@ -576,6 +601,5 @@ static inline int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
          */
         return true;
 }
-
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_POWERPC_PGTABLE_PPC64_H_ */
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index 316f9a5da173..a8805fee0df9 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -274,11 +274,9 @@ extern void paging_init(void);
  */
 extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
 
-extern int gup_hugepd(hugepd_t *hugepd, unsigned pdshift, unsigned long addr,
-                      unsigned long end, int write, struct page **pages, int *nr);
-
 extern int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
-                       unsigned long end, int write, struct page **pages, int *nr);
+                       unsigned long end, int write,
+                       struct page **pages, int *nr);
 #ifndef CONFIG_TRANSPARENT_HUGEPAGE
 #define pmd_large(pmd)          0
 #define has_transparent_hugepage() 0
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index dda7ac4c80bd..29c3798cf800 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -451,7 +451,7 @@ extern unsigned long cpuidle_disable;
 enum idle_boot_override {IDLE_NO_OVERRIDE = 0, IDLE_POWERSAVE_OFF};
 
 extern int powersave_nap;       /* set if nap mode can be used in idle loop */
-extern void power7_nap(int check_irq);
+extern unsigned long power7_nap(int check_irq);
 extern void power7_sleep(void);
 extern void flush_instruction_cache(void);
 extern void hard_reset_now(void);
diff --git a/arch/powerpc/include/asm/pte-8xx.h b/arch/powerpc/include/asm/pte-8xx.h
index d44826e4ff97..daa4616e61c4 100644
--- a/arch/powerpc/include/asm/pte-8xx.h
+++ b/arch/powerpc/include/asm/pte-8xx.h
@@ -48,19 +48,22 @@
  */
 #define _PAGE_RW        0x0400  /* lsb PP bits, inverted in HW */
 #define _PAGE_USER      0x0800  /* msb PP bits */
+/* set when neither _PAGE_USER nor _PAGE_RW are set */
+#define _PAGE_KNLRO     0x0200
 
 #define _PMD_PRESENT    0x0001
 #define _PMD_BAD        0x0ff0
 #define _PMD_PAGE_MASK  0x000c
 #define _PMD_PAGE_8M    0x000c
 
-#define _PTE_NONE_MASK _PAGE_ACCESSED
+#define _PTE_NONE_MASK _PAGE_KNLRO
 
 /* Until my rework is finished, 8xx still needs atomic PTE updates */
 #define PTE_ATOMIC_UPDATES      1
 
 /* We need to add _PAGE_SHARED to kernel pages */
-#define _PAGE_KERNEL_RO (_PAGE_SHARED)
+#define _PAGE_KERNEL_RO (_PAGE_SHARED | _PAGE_KNLRO)
+#define _PAGE_KERNEL_ROX        (_PAGE_EXEC | _PAGE_KNLRO)
 #define _PAGE_KERNEL_RW (_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE)
 
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
index 11ba86e17631..fbdf18cf954c 100644
--- a/arch/powerpc/include/asm/setup.h
+++ b/arch/powerpc/include/asm/setup.h
@@ -8,7 +8,6 @@ extern void ppc_printk_progress(char *s, unsigned short hex);
 
 extern unsigned int rtas_data;
 extern int mem_init_done;       /* set on boot once kmalloc can be called */
-extern int init_bootmem_done;   /* set once bootmem is available */
 extern unsigned long long memory_limit;
 extern unsigned long klimit;
 extern void *zalloc_maybe_bootmem(size_t size, gfp_t mask);
@@ -24,7 +23,7 @@ extern void reloc_got2(unsigned long);
 #define PTRRELOC(x)     ((typeof(x)) add_reloc_offset((unsigned long)(x)))
 
 void check_for_initrd(void);
-void do_init_bootmem(void);
+void initmem_init(void);
 void setup_panic(void);
 #define ARCH_PANIC_TIMEOUT 180
 
diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
index b034ecdb7c74..ebc4f165690a 100644
--- a/arch/powerpc/include/asm/thread_info.h
+++ b/arch/powerpc/include/asm/thread_info.h
@@ -71,13 +71,12 @@ struct thread_info {
 #define THREAD_SIZE_ORDER       (THREAD_SHIFT - PAGE_SHIFT)
 
 /* how to get the thread information struct from C */
+register unsigned long __current_r1 asm("r1");
 static inline struct thread_info *current_thread_info(void)
 {
-        register unsigned long sp asm("r1");
-
         /* gcc4, at least, is smart enough to turn this into a single
          * rlwinm for ppc32 and clrrdi for ppc64 */
-        return (struct thread_info *)(sp & ~(THREAD_SIZE-1));
+        return (struct thread_info *)(__current_r1 & ~(THREAD_SIZE-1));
 }
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/powerpc/include/asm/tlbflush.h b/arch/powerpc/include/asm/tlbflush.h
index 2def01ed0cb2..23d351ca0303 100644
--- a/arch/powerpc/include/asm/tlbflush.h
+++ b/arch/powerpc/include/asm/tlbflush.h
@@ -107,14 +107,14 @@ extern void __flush_tlb_pending(struct ppc64_tlb_batch *batch);
 
 static inline void arch_enter_lazy_mmu_mode(void)
 {
-        struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
+        struct ppc64_tlb_batch *batch = this_cpu_ptr(&ppc64_tlb_batch);
 
         batch->active = 1;
 }
 
 static inline void arch_leave_lazy_mmu_mode(void)
 {
-        struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
+        struct ppc64_tlb_batch *batch = this_cpu_ptr(&ppc64_tlb_batch);
 
         if (batch->index)
                 __flush_tlb_pending(batch);
@@ -125,9 +125,11 @@ static inline void arch_leave_lazy_mmu_mode(void)
 
 
 extern void flush_hash_page(unsigned long vpn, real_pte_t pte, int psize,
-                            int ssize, int local);
+                            int ssize, unsigned long flags);
 extern void flush_hash_range(unsigned long number, int local);
-
+extern void flush_hash_hugepage(unsigned long vsid, unsigned long addr,
+                                pmd_t *pmdp, unsigned int psize, int ssize,
+                                unsigned long flags);
 
 static inline void local_flush_tlb_mm(struct mm_struct *mm)
 {
diff --git a/arch/powerpc/include/asm/vga.h b/arch/powerpc/include/asm/vga.h
index a2eac409c1ec..e5f8dd366212 100644
--- a/arch/powerpc/include/asm/vga.h
+++ b/arch/powerpc/include/asm/vga.h
@@ -38,12 +38,10 @@ static inline u16 scr_readw(volatile const u16 *addr)
 
 #endif /* !CONFIG_VGA_CONSOLE && !CONFIG_MDA_CONSOLE */
 
-extern unsigned long vgacon_remap_base;
-
 #ifdef __powerpc64__
 #define VGA_MAP_MEM(x,s) ((unsigned long) ioremap((x), s))
 #else
-#define VGA_MAP_MEM(x,s) (x + vgacon_remap_base)
+#define VGA_MAP_MEM(x,s) (x)
 #endif
 
 #define vga_readb(x) (*(x))
diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
index 0d050ea37a04..6997f4a271df 100644
--- a/arch/powerpc/include/asm/xics.h
+++ b/arch/powerpc/include/asm/xics.h
@@ -98,7 +98,7 @@ DECLARE_PER_CPU(struct xics_cppr, xics_cppr);
 
 static inline void xics_push_cppr(unsigned int vec)
 {
-        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
+        struct xics_cppr *os_cppr = this_cpu_ptr(&xics_cppr);
 
         if (WARN_ON(os_cppr->index >= MAX_NUM_PRIORITIES - 1))
                 return;
@@ -111,7 +111,7 @@ static inline void xics_push_cppr(unsigned int vec)
 
 static inline unsigned char xics_pop_cppr(void)
 {
-        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
+        struct xics_cppr *os_cppr = this_cpu_ptr(&xics_cppr);
 
         if (WARN_ON(os_cppr->index < 1))
                 return LOWEST_PRIORITY;
@@ -121,7 +121,7 @@ static inline unsigned char xics_pop_cppr(void)
 
 static inline void xics_set_base_cppr(unsigned char cppr)
 {
-        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
+        struct xics_cppr *os_cppr = this_cpu_ptr(&xics_cppr);
 
         /* we only really want to set the priority when there's
          * just one cppr value on the stack
@@ -133,7 +133,7 @@ static inline void xics_set_base_cppr(unsigned char cppr)
 
 static inline unsigned char xics_cppr_top(void)
 {
-        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
+        struct xics_cppr *os_cppr = this_cpu_ptr(&xics_cppr);
         
         return os_cppr->stack[os_cppr->index];
 }
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index 34f55524d456..86150fbb42c3 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -908,7 +908,7 @@ int fix_alignment(struct pt_regs *regs)
                 flush_fp_to_thread(current);
         }
 
-        if ((nb == 16)) {
+        if (nb == 16) {
                 if (flags & F) {
                         /* Special case for 16-byte FP loads and stores */
                         PPC_WARN_ALIGNMENT(fp_pair, regs);
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 9d7dede2847c..c161ef3f28a1 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -726,12 +726,5 @@ int main(void)
                                         arch.timing_last_enter.tv32.tbl));
 #endif
 
-#ifdef CONFIG_PPC_POWERNV
-        DEFINE(OPAL_MC_GPR3, offsetof(struct opal_machine_check_event, gpr3));
-        DEFINE(OPAL_MC_SRR0, offsetof(struct opal_machine_check_event, srr0));
-        DEFINE(OPAL_MC_SRR1, offsetof(struct opal_machine_check_event, srr1));
-        DEFINE(PACA_OPAL_MC_EVT, offsetof(struct paca_struct, opal_mc_evt));
-#endif
-
         return 0;
 }
diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
index c78e6dac4d7d..cfa0f81a5bb0 100644
--- a/arch/powerpc/kernel/crash_dump.c
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -12,7 +12,6 @@
 #undef DEBUG
 
 #include <linux/crash_dump.h>
-#include <linux/bootmem.h>
 #include <linux/io.h>
 #include <linux/memblock.h>
 #include <asm/code-patching.h>
diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
index d55c76c571f3..f4217819cc31 100644
--- a/arch/powerpc/kernel/dbell.c
+++ b/arch/powerpc/kernel/dbell.c
@@ -41,7 +41,7 @@ void doorbell_exception(struct pt_regs *regs)
 
         may_hard_irq_enable();
 
-        __get_cpu_var(irq_stat).doorbell_irqs++;
+        __this_cpu_inc(irq_stat.doorbell_irqs);
 
         smp_ipi_demux();
 
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 2248a1999c64..e1b6d8e17289 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -143,6 +143,8 @@ static int __init eeh_setup(char *str)
 {
         if (!strcmp(str, "off"))
                 eeh_add_flag(EEH_FORCE_DISABLED);
+        else if (!strcmp(str, "early_log"))
+                eeh_add_flag(EEH_EARLY_DUMP_LOG);
 
         return 1;
 }
@@ -758,30 +760,41 @@ static void eeh_reset_pe_once(struct eeh_pe *pe)
 int eeh_reset_pe(struct eeh_pe *pe)
 {
         int flags = (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE);
-        int i, rc;
+        int i, state, ret;
+
+        /* Mark as reset and block config space */
+        eeh_pe_state_mark(pe, EEH_PE_RESET | EEH_PE_CFG_BLOCKED);
 
         /* Take three shots at resetting the bus */
-        for (i=0; i<3; i++) {
+        for (i = 0; i < 3; i++) {
                 eeh_reset_pe_once(pe);
 
                 /*
                  * EEH_PE_ISOLATED is expected to be removed after
                  * BAR restore.
                  */
-                rc = eeh_ops->wait_state(pe, PCI_BUS_RESET_WAIT_MSEC);
-                if ((rc & flags) == flags)
-                        return 0;
+                state = eeh_ops->wait_state(pe, PCI_BUS_RESET_WAIT_MSEC);
+                if ((state & flags) == flags) {
+                        ret = 0;
+                        goto out;
+                }
 
-                if (rc < 0) {
-                        pr_err("%s: Unrecoverable slot failure on PHB#%d-PE#%x",
+                if (state < 0) {
+                        pr_warn("%s: Unrecoverable slot failure on PHB#%d-PE#%x",
                                 __func__, pe->phb->global_number, pe->addr);
-                        return -1;
+                        ret = -ENOTRECOVERABLE;
+                        goto out;
                 }
-                pr_err("EEH: bus reset %d failed on PHB#%d-PE#%x, rc=%d\n",
-                        i+1, pe->phb->global_number, pe->addr, rc);
+
+                /* We might run out of credits */
+                ret = -EIO;
+                pr_warn("%s: Failure %d resetting PHB#%x-PE#%x\n (%d)\n",
+                        __func__, state, pe->phb->global_number, pe->addr, (i + 1));
         }
 
-        return -1;
+out:
+        eeh_pe_state_clear(pe, EEH_PE_RESET | EEH_PE_CFG_BLOCKED);
+        return ret;
 }
 
 /**
@@ -920,11 +933,8 @@ int eeh_init(void)
                 pr_warn("%s: Platform EEH operation not found\n",
                         __func__);
                 return -EEXIST;
-        } else if ((ret = eeh_ops->init())) {
-                pr_warn("%s: Failed to call platform init function (%d)\n",
-                        __func__, ret);
+        } else if ((ret = eeh_ops->init()))
                 return ret;
-        }
 
         /* Initialize EEH event */
         ret = eeh_event_init();
@@ -1209,6 +1219,7 @@ int eeh_unfreeze_pe(struct eeh_pe *pe, bool sw_state)
 static struct pci_device_id eeh_reset_ids[] = {
         { PCI_DEVICE(0x19a2, 0x0710) }, /* Emulex, BE     */
         { PCI_DEVICE(0x10df, 0xe220) }, /* Emulex, Lancer */
+        { PCI_DEVICE(0x14e4, 0x1657) }, /* Broadcom BCM5719 */
         { 0 }
 };
 
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 6535936bdf27..b17e793ba67e 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -528,13 +528,11 @@ int eeh_pe_reset_and_recover(struct eeh_pe *pe)
         eeh_pe_dev_traverse(pe, eeh_report_error, &result);
 
         /* Issue reset */
-        eeh_pe_state_mark(pe, EEH_PE_CFG_BLOCKED);
         ret = eeh_reset_pe(pe);
         if (ret) {
-                eeh_pe_state_clear(pe, EEH_PE_RECOVERING | EEH_PE_CFG_BLOCKED);
+                eeh_pe_state_clear(pe, EEH_PE_RECOVERING);
                 return ret;
         }
-        eeh_pe_state_clear(pe, EEH_PE_CFG_BLOCKED);
 
         /* Unfreeze the PE */
         ret = eeh_clear_pe_frozen_state(pe, true);
@@ -601,19 +599,15 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
          * config accesses. So we prefer to block them. However, controlled
          * PCI config accesses initiated from EEH itself are allowed.
          */
-        eeh_pe_state_mark(pe, EEH_PE_CFG_BLOCKED);
         rc = eeh_reset_pe(pe);
-        if (rc) {
-                eeh_pe_state_clear(pe, EEH_PE_CFG_BLOCKED);
+        if (rc)
                 return rc;
-        }
 
         pci_lock_rescan_remove();
 
         /* Restore PE */
         eeh_ops->configure_bridge(pe);
         eeh_pe_restore_bars(pe);
-        eeh_pe_state_clear(pe, EEH_PE_CFG_BLOCKED);
 
         /* Clear frozen state */
         rc = eeh_clear_pe_frozen_state(pe, false);
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 22b45a4955cd..10a093579191 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -1424,12 +1424,18 @@ _GLOBAL(ftrace_graph_caller)
         lwz     r4, 44(r1)
         subi    r4, r4, MCOUNT_INSN_SIZE
 
-        /* get the parent address */
-        addi    r3, r1, 52
+        /* Grab the LR out of the caller stack frame */
+        lwz     r3,52(r1)
 
         bl      prepare_ftrace_return
         nop
 
+        /*
+         * prepare_ftrace_return gives us the address we divert to.
+         * Change the LR in the callers stack frame to this.
+         */
+        stw     r3,52(r1)
+
         MCOUNT_RESTORE_FRAME
         /* old link register ends up in ctr reg */
         bctr
@@ -1457,4 +1463,4 @@ _GLOBAL(return_to_handler)
         blr
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
-#endif /* CONFIG_MCOUNT */
+#endif /* CONFIG_FUNCTION_TRACER */
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 0905c8da90f1..194e46dcf08d 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -1227,13 +1227,20 @@ _GLOBAL(ftrace_graph_caller)
         ld      r4, 128(r1)
         subi    r4, r4, MCOUNT_INSN_SIZE
 
-        /* get the parent address */
+        /* Grab the LR out of the caller stack frame */
         ld      r11, 112(r1)
-        addi    r3, r11, 16
+        ld      r3, 16(r11)
 
         bl      prepare_ftrace_return
         nop
 
+        /*
+         * prepare_ftrace_return gives us the address we divert to.
+         * Change the LR in the callers stack frame to this.
+         */
+        ld      r11, 112(r1)
+        std     r3, 16(r11)
+
         ld      r0, 128(r1)
         mtlr    r0
         addi    r1, r1, 112
@@ -1241,28 +1248,6 @@ _GLOBAL(ftrace_graph_caller)
 
 _GLOBAL(return_to_handler)
         /* need to save return values */
-        std     r4,  -24(r1)
-        std     r3,  -16(r1)
-        std     r31, -8(r1)
-        mr      r31, r1
-        stdu    r1, -112(r1)
-
-        bl      ftrace_return_to_handler
-        nop
-
-        /* return value has real return address */
-        mtlr    r3
-
-        ld      r1, 0(r1)
-        ld      r4,  -24(r1)
-        ld      r3,  -16(r1)
-        ld      r31, -8(r1)
-
-        /* Jump back to real return address */
-        blr
-
-_GLOBAL(mod_return_to_handler)
-        /* need to save return values */
         std     r4,  -32(r1)
         std     r3,  -24(r1)
         /* save TOC */
@@ -1272,7 +1257,7 @@ _GLOBAL(mod_return_to_handler)
         stdu    r1, -112(r1)
 
         /*
-         * We are in a module using the module's TOC.
+         * We might be called from a module.
          * Switch to our TOC to run inside the core kernel.
          */
         ld      r2, PACATOC(r13)
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 72e783ea0681..db08382e19f1 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -131,6 +131,8 @@ BEGIN_FTR_SECTION
 1:
 #endif
 
+        /* Return SRR1 from power7_nap() */
+        mfspr   r3,SPRN_SRR1
         beq     cr1,2f
         b       power7_wakeup_noloss
 2:      b       power7_wakeup_loss
@@ -292,15 +294,26 @@ decrementer_pSeries:
         . = 0xc00
         .globl  system_call_pSeries
 system_call_pSeries:
-        HMT_MEDIUM
+         /*
+          * If CONFIG_KVM_BOOK3S_64_HANDLER is set, save the PPR (on systems
+          * that support it) before changing to HMT_MEDIUM. That allows the KVM
+          * code to save that value into the guest state (it is the guest's PPR
+          * value). Otherwise just change to HMT_MEDIUM as userspace has
+          * already saved the PPR.
+          */
 #ifdef CONFIG_KVM_BOOK3S_64_HANDLER
         SET_SCRATCH0(r13)
         GET_PACA(r13)
         std     r9,PACA_EXGEN+EX_R9(r13)
+        OPT_GET_SPR(r9, SPRN_PPR, CPU_FTR_HAS_PPR);
+        HMT_MEDIUM;
         std     r10,PACA_EXGEN+EX_R10(r13)
+        OPT_SAVE_REG_TO_PACA(PACA_EXGEN+EX_PPR, r9, CPU_FTR_HAS_PPR);
         mfcr    r9
         KVMTEST(0xc00)
         GET_SCRATCH0(r13)
+#else
+        HMT_MEDIUM;
 #endif
         SYSCALL_PSERIES_1
         SYSCALL_PSERIES_2_RFID
@@ -1301,23 +1314,6 @@ hmi_exception_after_realmode:
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       hmi_exception_hv
 
-#ifdef CONFIG_PPC_POWERNV
-_GLOBAL(opal_mc_secondary_handler)
-        HMT_MEDIUM_PPR_DISCARD
-        SET_SCRATCH0(r13)
-        GET_PACA(r13)
-        clrldi  r3,r3,2
-        tovirt(r3,r3)
-        std     r3,PACA_OPAL_MC_EVT(r13)
-        ld      r13,OPAL_MC_SRR0(r3)
-        mtspr   SPRN_SRR0,r13
-        ld      r13,OPAL_MC_SRR1(r3)
-        mtspr   SPRN_SRR1,r13
-        ld      r3,OPAL_MC_GPR3(r3)
-        GET_SCRATCH0(r13)
-        b       machine_check_pSeries
-#endif /* CONFIG_PPC_POWERNV */
-
 
 #define MACHINE_CHECK_HANDLER_WINDUP                    \
         /* Clear MSR_RI before setting SRR0 and SRR1. */\
@@ -1571,9 +1567,11 @@ do_hash_page:
          * r3 contains the faulting address
          * r4 contains the required access permissions
          * r5 contains the trap number
+         * r6 contains dsisr
          *
          * at return r3 = 0 for success, 1 for page fault, negative for error
          */
+        ld      r6,_DSISR(r1)
         bl      hash_page               /* build HPTE if possible */
         cmpdi   r3,0                    /* see if hash_page succeeded */
 
diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
index e66af6d265e8..44d4d8eb3c85 100644
--- a/arch/powerpc/kernel/ftrace.c
+++ b/arch/powerpc/kernel/ftrace.c
@@ -510,79 +510,36 @@ int ftrace_disable_ftrace_graph_caller(void)
 }
 #endif /* CONFIG_DYNAMIC_FTRACE */
 
-#ifdef CONFIG_PPC64
-extern void mod_return_to_handler(void);
-#endif
-
 /*
  * Hook the return address and push it in the stack of return addrs
- * in current thread info.
+ * in current thread info. Return the address we want to divert to.
  */
-void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
+unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 {
-        unsigned long old;
-        int faulted;
         struct ftrace_graph_ent trace;
-        unsigned long return_hooker = (unsigned long)&return_to_handler;
+        unsigned long return_hooker;
 
         if (unlikely(ftrace_graph_is_dead()))
-                return;
+                goto out;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
-                return;
-
-#ifdef CONFIG_PPC64
-        /* non core kernel code needs to save and restore the TOC */
-        if (REGION_ID(self_addr) != KERNEL_REGION_ID)
-                return_hooker = (unsigned long)&mod_return_to_handler;
-#endif
-
-        return_hooker = ppc_function_entry((void *)return_hooker);
+                goto out;
 
-        /*
-         * Protect against fault, even if it shouldn't
-         * happen. This tool is too much intrusive to
-         * ignore such a protection.
-         */
-        asm volatile(
-                "1: " PPC_LL "%[old], 0(%[parent])\n"
-                "2: " PPC_STL "%[return_hooker], 0(%[parent])\n"
-                "   li %[faulted], 0\n"
-                "3:\n"
-
-                ".section .fixup, \"ax\"\n"
-                "4: li %[faulted], 1\n"
-                "   b 3b\n"
-                ".previous\n"
-
-                ".section __ex_table,\"a\"\n"
-                        PPC_LONG_ALIGN "\n"
-                        PPC_LONG "1b,4b\n"
-                        PPC_LONG "2b,4b\n"
-                ".previous"
-
-                : [old] "=&r" (old), [faulted] "=r" (faulted)
-                : [parent] "r" (parent), [return_hooker] "r" (return_hooker)
-                : "memory"
-        );
-
-        if (unlikely(faulted)) {
-                ftrace_graph_stop();
-                WARN_ON(1);
-                return;
-        }
+        return_hooker = ppc_function_entry(return_to_handler);
 
-        trace.func = self_addr;
+        trace.func = ip;
         trace.depth = current->curr_ret_stack + 1;
 
         /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                *parent = old;
-                return;
-        }
+        if (!ftrace_graph_entry(&trace))
+                goto out;
+
+        if (ftrace_push_return_trace(parent, ip, &trace.depth, 0) == -EBUSY)
+                goto out;
 
-        if (ftrace_push_return_trace(old, self_addr, &trace.depth, 0) == -EBUSY)
-                *parent = old;
+        parent = return_hooker;
+out:
+        return parent;
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index fafff8dbd5d9..d99aac0d69f1 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -33,13 +33,31 @@
 
 /* Macro to make the code more readable. */
 #ifdef CONFIG_8xx_CPU6
-#define DO_8xx_CPU6(val, reg)   \
-        li      reg, val;       \
-        stw     reg, 12(r0);    \
-        lwz     reg, 12(r0);
+#define SPRN_MI_TWC_ADDR        0x2b80
+#define SPRN_MI_RPN_ADDR        0x2d80
+#define SPRN_MD_TWC_ADDR        0x3b80
+#define SPRN_MD_RPN_ADDR        0x3d80
+
+#define MTSPR_CPU6(spr, reg, treg)      \
+        li      treg, spr##_ADDR;       \
+        stw     treg, 12(r0);           \
+        lwz     treg, 12(r0);           \
+        mtspr   spr, reg
 #else
-#define DO_8xx_CPU6(val, reg)
+#define MTSPR_CPU6(spr, reg, treg)      \
+        mtspr   spr, reg
 #endif
+
+/*
+ * Value for the bits that have fixed value in RPN entries.
+ * Also used for tagging DAR for DTLBerror.
+ */
+#ifdef CONFIG_PPC_16K_PAGES
+#define RPN_PATTERN     (0x00f0 | MD_SPS16K)
+#else
+#define RPN_PATTERN     0x00f0
+#endif
+
         __HEAD
 _ENTRY(_stext);
 _ENTRY(_start);
@@ -65,13 +83,6 @@ _ENTRY(_start);
  * 8M 1:1.  I also mapped an additional I/O space 1:1 so we can get to
  * the "internal" processor registers before MMU_init is called.
  *
- * The TLB code currently contains a major hack.  Since I use the condition
- * code register, I have to save and restore it.  I am out of registers, so
- * I just store it in memory location 0 (the TLB handlers are not reentrant).
- * To avoid making any decisions, I need to use the "segment" valid bit
- * in the first level table, but that would require many changes to the
- * Linux page directory/table functions that I don't want to do right now.
- *
  *      -- Dan
  */
         .globl  __start
@@ -211,7 +222,7 @@ MachineCheck:
         EXCEPTION_PROLOG
         mfspr r4,SPRN_DAR
         stw r4,_DAR(r11)
-        li r5,0x00f0
+        li r5,RPN_PATTERN
         mtspr SPRN_DAR,r5       /* Tag DAR, to be used in DTLB Error */
         mfspr r5,SPRN_DSISR
         stw r5,_DSISR(r11)
@@ -219,30 +230,16 @@ MachineCheck:
         EXC_XFER_STD(0x200, machine_check_exception)
 
 /* Data access exception.
- * This is "never generated" by the MPC8xx.  We jump to it for other
- * translation errors.
+ * This is "never generated" by the MPC8xx.
  */
         . = 0x300
 DataAccess:
-        EXCEPTION_PROLOG
-        mfspr   r10,SPRN_DSISR
-        stw     r10,_DSISR(r11)
-        mr      r5,r10
-        mfspr   r4,SPRN_DAR
-        li      r10,0x00f0
-        mtspr   SPRN_DAR,r10    /* Tag DAR, to be used in DTLB Error */
-        EXC_XFER_LITE(0x300, handle_page_fault)
 
 /* Instruction access exception.
- * This is "never generated" by the MPC8xx.  We jump to it for other
- * translation errors.
+ * This is "never generated" by the MPC8xx.
  */
         . = 0x400
 InstructionAccess:
-        EXCEPTION_PROLOG
-        mr      r4,r12
-        mr      r5,r9
-        EXC_XFER_LITE(0x400, handle_page_fault)
 
 /* External interrupt */
         EXCEPTION(0x500, HardwareInterrupt, do_IRQ, EXC_XFER_LITE)
@@ -253,7 +250,7 @@ Alignment:
         EXCEPTION_PROLOG
         mfspr   r4,SPRN_DAR
         stw     r4,_DAR(r11)
-        li      r5,0x00f0
+        li      r5,RPN_PATTERN
         mtspr   SPRN_DAR,r5     /* Tag DAR, to be used in DTLB Error */
         mfspr   r5,SPRN_DSISR
         stw     r5,_DSISR(r11)
@@ -292,8 +289,8 @@ SystemCall:
         . = 0x1100
 /*
  * For the MPC8xx, this is a software tablewalk to load the instruction
- * TLB.  It is modelled after the example in the Motorola manual.  The task
- * switch loads the M_TWB register with the pointer to the first level table.
+ * TLB.  The task switch loads the M_TW register with the pointer to the first
+ * level table.
  * If we discover there is no second level table (value is zero) or if there
  * is an invalid pte, we load that into the TLB, which causes another fault
  * into the TLB Error interrupt where we can handle such problems.
@@ -302,20 +299,17 @@ SystemCall:
  */
 InstructionTLBMiss:
 #ifdef CONFIG_8xx_CPU6
-        stw     r3, 8(r0)
+        mtspr   SPRN_DAR, r3
 #endif
         EXCEPTION_PROLOG_0
         mtspr   SPRN_SPRG_SCRATCH2, r10
         mfspr   r10, SPRN_SRR0  /* Get effective address of fault */
 #ifdef CONFIG_8xx_CPU15
-        addi    r11, r10, 0x1000
+        addi    r11, r10, PAGE_SIZE
         tlbie   r11
-        addi    r11, r10, -0x1000
+        addi    r11, r10, -PAGE_SIZE
         tlbie   r11
 #endif
-        DO_8xx_CPU6(0x3780, r3)
-        mtspr   SPRN_MD_EPN, r10        /* Have to use MD_EPN for walk, MI_EPN can't */
-        mfspr   r10, SPRN_M_TWB /* Get level 1 table entry address */
 
         /* If we are faulting a kernel address, we have to use the
          * kernel page tables.
@@ -323,32 +317,37 @@ InstructionTLBMiss:
 #ifdef CONFIG_MODULES
         /* Only modules will cause ITLB Misses as we always
          * pin the first 8MB of kernel memory */
-        andi.   r11, r10, 0x0800        /* Address >= 0x80000000 */
+        andis.  r11, r10, 0x8000        /* Address >= 0x80000000 */
+#endif
+        mfspr   r11, SPRN_M_TW  /* Get level 1 table base address */
+#ifdef CONFIG_MODULES
         beq     3f
-        lis     r11, swapper_pg_dir@h
-        ori     r11, r11, swapper_pg_dir@l
-        rlwimi  r10, r11, 0, 2, 19
+        lis     r11, (swapper_pg_dir-PAGE_OFFSET)@h
+        ori     r11, r11, (swapper_pg_dir-PAGE_OFFSET)@l
 3:
 #endif
-        lwz     r11, 0(r10)     /* Get the level 1 entry */
+        /* Extract level 1 index */
+        rlwinm  r10, r10, 32 - ((PAGE_SHIFT - 2) << 1), (PAGE_SHIFT - 2) << 1, 29
+        lwzx    r11, r10, r11   /* Get the level 1 entry */
         rlwinm. r10, r11,0,0,19 /* Extract page descriptor page address */
         beq     2f              /* If zero, don't try to find a pte */
 
         /* We have a pte table, so load the MI_TWC with the attributes
          * for this "segment."
          */
-        ori     r11,r11,1               /* Set valid bit */
-        DO_8xx_CPU6(0x2b80, r3)
-        mtspr   SPRN_MI_TWC, r11        /* Set segment attributes */
-        DO_8xx_CPU6(0x3b80, r3)
-        mtspr   SPRN_MD_TWC, r11        /* Load pte table base address */
-        mfspr   r11, SPRN_MD_TWC        /* ....and get the pte address */
-        lwz     r10, 0(r11)     /* Get the pte */
+        MTSPR_CPU6(SPRN_MI_TWC, r11, r3)        /* Set segment attributes */
+        mfspr   r11, SPRN_SRR0  /* Get effective address of fault */
+        /* Extract level 2 index */
+        rlwinm  r11, r11, 32 - (PAGE_SHIFT - 2), 32 - PAGE_SHIFT, 29
+        lwzx    r10, r10, r11   /* Get the pte */
 
 #ifdef CONFIG_SWAP
         andi.   r11, r10, _PAGE_ACCESSED | _PAGE_PRESENT
         cmpwi   cr0, r11, _PAGE_ACCESSED | _PAGE_PRESENT
+        li      r11, RPN_PATTERN
         bne-    cr0, 2f
+#else
+        li      r11, RPN_PATTERN
 #endif
         /* The Linux PTE won't go exactly into the MMU TLB.
          * Software indicator bits 21 and 28 must be clear.
@@ -356,62 +355,63 @@ InstructionTLBMiss:
          * set.  All other Linux PTE bits control the behavior
          * of the MMU.
          */
-        li      r11, 0x00f0
         rlwimi  r10, r11, 0, 0x07f8     /* Set 24-27, clear 21-23,28 */
-        DO_8xx_CPU6(0x2d80, r3)
-        mtspr   SPRN_MI_RPN, r10        /* Update TLB entry */
+        MTSPR_CPU6(SPRN_MI_RPN, r10, r3)        /* Update TLB entry */
 
         /* Restore registers */
 #ifdef CONFIG_8xx_CPU6
-        lwz     r3, 8(r0)
+        mfspr   r3, SPRN_DAR
+        mtspr   SPRN_DAR, r11   /* Tag DAR */
 #endif
         mfspr   r10, SPRN_SPRG_SCRATCH2
         EXCEPTION_EPILOG_0
         rfi
 2:
-        mfspr   r11, SPRN_SRR1
+        mfspr   r10, SPRN_SRR1
         /* clear all error bits as TLB Miss
          * sets a few unconditionally
         */
-        rlwinm  r11, r11, 0, 0xffff
-        mtspr   SPRN_SRR1, r11
+        rlwinm  r10, r10, 0, 0xffff
+        mtspr   SPRN_SRR1, r10
 
         /* Restore registers */
 #ifdef CONFIG_8xx_CPU6
-        lwz     r3, 8(r0)
+        mfspr   r3, SPRN_DAR
+        mtspr   SPRN_DAR, r11   /* Tag DAR */
 #endif
         mfspr   r10, SPRN_SPRG_SCRATCH2
-        EXCEPTION_EPILOG_0
-        b       InstructionAccess
+        b       InstructionTLBError1
 
         . = 0x1200
 DataStoreTLBMiss:
 #ifdef CONFIG_8xx_CPU6
-        stw     r3, 8(r0)
+        mtspr   SPRN_DAR, r3
 #endif
         EXCEPTION_PROLOG_0
         mtspr   SPRN_SPRG_SCRATCH2, r10
-        mfspr   r10, SPRN_M_TWB /* Get level 1 table entry address */
+        mfspr   r10, SPRN_MD_EPN
 
         /* If we are faulting a kernel address, we have to use the
          * kernel page tables.
          */
-        andi.   r11, r10, 0x0800
+        andis.  r11, r10, 0x8000
+        mfspr   r11, SPRN_M_TW  /* Get level 1 table base address */
         beq     3f
-        lis     r11, swapper_pg_dir@h
-        ori     r11, r11, swapper_pg_dir@l
-        rlwimi  r10, r11, 0, 2, 19
+        lis     r11, (swapper_pg_dir-PAGE_OFFSET)@h
+        ori     r11, r11, (swapper_pg_dir-PAGE_OFFSET)@l
 3:
-        lwz     r11, 0(r10)     /* Get the level 1 entry */
+        /* Extract level 1 index */
+        rlwinm  r10, r10, 32 - ((PAGE_SHIFT - 2) << 1), (PAGE_SHIFT - 2) << 1, 29
+        lwzx    r11, r10, r11   /* Get the level 1 entry */
         rlwinm. r10, r11,0,0,19 /* Extract page descriptor page address */
         beq     2f              /* If zero, don't try to find a pte */
 
         /* We have a pte table, so load fetch the pte from the table.
          */
-        ori     r11, r11, 1     /* Set valid bit in physical L2 page */
-        DO_8xx_CPU6(0x3b80, r3)
-        mtspr   SPRN_MD_TWC, r11        /* Load pte table base address */
-        mfspr   r10, SPRN_MD_TWC        /* ....and get the pte address */
+        mfspr   r10, SPRN_MD_EPN        /* Get address of fault */
+        /* Extract level 2 index */
+        rlwinm  r10, r10, 32 - (PAGE_SHIFT - 2), 32 - PAGE_SHIFT, 29
+        rlwimi  r10, r11, 0, 0, 32 - PAGE_SHIFT - 1     /* Add level 2 base */
         lwz     r10, 0(r10)     /* Get the pte */
 
         /* Insert the Guarded flag into the TWC from the Linux PTE.
@@ -425,8 +425,7 @@ DataStoreTLBMiss:
          * It is bit 25 in the Linux PTE and bit 30 in the TWC
          */
         rlwimi  r11, r10, 32-5, 30, 30
-        DO_8xx_CPU6(0x3b80, r3)
-        mtspr   SPRN_MD_TWC, r11
+        MTSPR_CPU6(SPRN_MD_TWC, r11, r3)
 
         /* Both _PAGE_ACCESSED and _PAGE_PRESENT has to be set.
          * We also need to know if the insn is a load/store, so:
@@ -442,14 +441,8 @@ DataStoreTLBMiss:
         and     r11, r11, r10
         rlwimi  r10, r11, 0, _PAGE_PRESENT
 #endif
-        /* Honour kernel RO, User NA */
-        /* 0x200 == Extended encoding, bit 22 */
-        rlwimi  r10, r10, 32-2, 0x200 /* Copy USER to bit 22, 0x200 */
-        /* r11 =  (r10 & _PAGE_RW) >> 1 */
-        rlwinm  r11, r10, 32-1, 0x200
-        or      r10, r11, r10
-        /* invert RW and 0x200 bits */
-        xori    r10, r10, _PAGE_RW | 0x200
+        /* invert RW */
+        xori    r10, r10, _PAGE_RW
 
         /* The Linux PTE won't go exactly into the MMU TLB.
          * Software indicator bits 22 and 28 must be clear.
@@ -457,14 +450,13 @@ DataStoreTLBMiss:
          * set.  All other Linux PTE bits control the behavior
          * of the MMU.
          */
-2:      li      r11, 0x00f0
+2:      li      r11, RPN_PATTERN
         rlwimi  r10, r11, 0, 24, 28     /* Set 24-27, clear 28 */
-        DO_8xx_CPU6(0x3d80, r3)
-        mtspr   SPRN_MD_RPN, r10        /* Update TLB entry */
+        MTSPR_CPU6(SPRN_MD_RPN, r10, r3)        /* Update TLB entry */
 
         /* Restore registers */
 #ifdef CONFIG_8xx_CPU6
-        lwz     r3, 8(r0)
+        mfspr   r3, SPRN_DAR
 #endif
         mtspr   SPRN_DAR, r11   /* Tag DAR */
         mfspr   r10, SPRN_SPRG_SCRATCH2
@@ -477,7 +469,17 @@ DataStoreTLBMiss:
  */
         . = 0x1300
 InstructionTLBError:
-        b       InstructionAccess
+        EXCEPTION_PROLOG_0
+InstructionTLBError1:
+        EXCEPTION_PROLOG_1
+        EXCEPTION_PROLOG_2
+        mr      r4,r12
+        mr      r5,r9
+        andis.  r10,r5,0x4000
+        beq+    1f
+        tlbie   r4
+        /* 0x400 is InstructionAccess exception, needed by bad_page_fault() */
+1:      EXC_XFER_LITE(0x400, handle_page_fault)
 
 /* This is the data TLB error on the MPC8xx.  This could be due to
  * many reasons, including a dirty update to a pte.  We bail out to
@@ -488,11 +490,21 @@ DataTLBError:
         EXCEPTION_PROLOG_0
 
         mfspr   r11, SPRN_DAR
-        cmpwi   cr0, r11, 0x00f0
+        cmpwi   cr0, r11, RPN_PATTERN
         beq-    FixupDAR        /* must be a buggy dcbX, icbi insn. */
 DARFixed:/* Return from dcbx instruction bug workaround */
-        EXCEPTION_EPILOG_0
-        b       DataAccess
+        EXCEPTION_PROLOG_1
+        EXCEPTION_PROLOG_2
+        mfspr   r5,SPRN_DSISR
+        stw     r5,_DSISR(r11)
+        mfspr   r4,SPRN_DAR
+        andis.  r10,r5,0x4000
+        beq+    1f
+        tlbie   r4
+1:      li      r10,RPN_PATTERN
+        mtspr   SPRN_DAR,r10    /* Tag DAR, to be used in DTLB Error */
+        /* 0x300 is DataAccess exception, needed by bad_page_fault() */
+        EXC_XFER_LITE(0x300, handle_page_fault)
 
         EXCEPTION(0x1500, Trap_15, unknown_exception, EXC_XFER_EE)
         EXCEPTION(0x1600, Trap_16, unknown_exception, EXC_XFER_EE)
@@ -521,29 +533,30 @@ DARFixed:/* Return from dcbx instruction bug workaround */
 #define NO_SELF_MODIFYING_CODE
 FixupDAR:/* Entry point for dcbx workaround. */
 #ifdef CONFIG_8xx_CPU6
-        stw     r3, 8(r0)
+        mtspr   SPRN_DAR, r3
 #endif
         mtspr   SPRN_SPRG_SCRATCH2, r10
         /* fetch instruction from memory. */
         mfspr   r10, SPRN_SRR0
         andis.  r11, r10, 0x8000        /* Address >= 0x80000000 */
-        DO_8xx_CPU6(0x3780, r3)
-        mtspr   SPRN_MD_EPN, r10
-        mfspr   r11, SPRN_M_TWB /* Get level 1 table entry address */
+        mfspr   r11, SPRN_M_TW  /* Get level 1 table base address */
         beq-    3f              /* Branch if user space */
         lis     r11, (swapper_pg_dir-PAGE_OFFSET)@h
         ori     r11, r11, (swapper_pg_dir-PAGE_OFFSET)@l
-        rlwimi  r11, r10, 32-20, 0xffc /* r11 = r11&~0xffc|(r10>>20)&0xffc */
-3:      lwz     r11, 0(r11)     /* Get the level 1 entry */
-        DO_8xx_CPU6(0x3b80, r3)
-        mtspr   SPRN_MD_TWC, r11        /* Load pte table base address */
-        mfspr   r11, SPRN_MD_TWC        /* ....and get the pte address */
-        lwz     r11, 0(r11)     /* Get the pte */
+        /* Extract level 1 index */
+3:      rlwinm  r10, r10, 32 - ((PAGE_SHIFT - 2) << 1), (PAGE_SHIFT - 2) << 1, 29
+        lwzx    r11, r10, r11   /* Get the level 1 entry */
+        rlwinm  r10, r11,0,0,19 /* Extract page descriptor page address */
+        mfspr   r11, SPRN_SRR0  /* Get effective address of fault */
+        /* Extract level 2 index */
+        rlwinm  r11, r11, 32 - (PAGE_SHIFT - 2), 32 - PAGE_SHIFT, 29
+        lwzx    r11, r10, r11   /* Get the pte */
 #ifdef CONFIG_8xx_CPU6
-        lwz     r3, 8(r0)       /* restore r3 from memory */
+        mfspr   r3, SPRN_DAR
 #endif
         /* concat physical page address(r11) and page offset(r10) */
-        rlwimi  r11, r10, 0, 20, 31
+        mfspr   r10, SPRN_SRR0
+        rlwimi  r11, r10, 0, 32 - PAGE_SHIFT, 31
         lwz     r11,0(r11)
 /* Check if it really is a dcbx instruction. */
 /* dcbt and dcbtst does not generate DTLB Misses/Errors,
@@ -698,11 +711,11 @@ start_here:
 #ifdef CONFIG_8xx_CPU6
         lis     r4, cpu6_errata_word@h
         ori     r4, r4, cpu6_errata_word@l
-        li      r3, 0x3980
+        li      r3, 0x3f80
         stw     r3, 12(r4)
         lwz     r3, 12(r4)
 #endif
-        mtspr   SPRN_M_TWB, r6
+        mtspr   SPRN_M_TW, r6
         lis     r4,2f@h
         ori     r4,r4,2f@l
         tophys(r4,r4)
@@ -876,10 +889,10 @@ _GLOBAL(set_context)
         lis     r6, cpu6_errata_word@h
         ori     r6, r6, cpu6_errata_word@l
         tophys  (r4, r4)
-        li      r7, 0x3980
+        li      r7, 0x3f80
         stw     r7, 12(r6)
         lwz     r7, 12(r6)
-        mtspr   SPRN_M_TWB, r4               /* Update MMU base address */
+        mtspr   SPRN_M_TW, r4               /* Update MMU base address */
         li      r7, 0x3380
         stw     r7, 12(r6)
         lwz     r7, 12(r6)
@@ -887,7 +900,7 @@ _GLOBAL(set_context)
 #else
         mtspr   SPRN_M_CASID,r3         /* Update context */
         tophys  (r4, r4)
-        mtspr   SPRN_M_TWB, r4          /* and pgd */
+        mtspr   SPRN_M_TW, r4           /* and pgd */
 #endif
         SYNC
         blr
@@ -919,12 +932,13 @@ set_dec_cpu6:
         .globl  sdata
 sdata:
         .globl  empty_zero_page
+        .align  PAGE_SHIFT
 empty_zero_page:
-        .space  4096
+        .space  PAGE_SIZE
 
         .globl  swapper_pg_dir
 swapper_pg_dir:
-        .space  4096
+        .space  PGD_TABLE_SIZE
 
 /* Room for two PTE table poiners, usually the kernel and current user
  * pointer to their respective root page table (pgdir).
diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
index 1f7d84e2e8b2..05e804cdecaa 100644
--- a/arch/powerpc/kernel/hw_breakpoint.c
+++ b/arch/powerpc/kernel/hw_breakpoint.c
@@ -63,7 +63,7 @@ int hw_breakpoint_slots(int type)
 int arch_install_hw_breakpoint(struct perf_event *bp)
 {
         struct arch_hw_breakpoint *info = counter_arch_bp(bp);
-        struct perf_event **slot = &__get_cpu_var(bp_per_reg);
+        struct perf_event **slot = this_cpu_ptr(&bp_per_reg);
 
         *slot = bp;
 
@@ -88,7 +88,7 @@ int arch_install_hw_breakpoint(struct perf_event *bp)
  */
 void arch_uninstall_hw_breakpoint(struct perf_event *bp)
 {
-        struct perf_event **slot = &__get_cpu_var(bp_per_reg);
+        struct perf_event **slot = this_cpu_ptr(&bp_per_reg);
 
         if (*slot != bp) {
                 WARN_ONCE(1, "Can't find the breakpoint");
@@ -226,7 +226,7 @@ int __kprobes hw_breakpoint_handler(struct die_args *args)
          */
         rcu_read_lock();
 
-        bp = __get_cpu_var(bp_per_reg);
+        bp = __this_cpu_read(bp_per_reg);
         if (!bp)
                 goto out;
         info = counter_arch_bp(bp);
diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
index c0754bbf8118..18c0687e5ab3 100644
--- a/arch/powerpc/kernel/idle_power7.S
+++ b/arch/powerpc/kernel/idle_power7.S
@@ -212,6 +212,10 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
         mtspr   SPRN_SRR0,r5
         rfid
 
+/*
+ * R3 here contains the value that will be returned to the caller
+ * of power7_nap.
+ */
 _GLOBAL(power7_wakeup_loss)
         ld      r1,PACAR1(r13)
 BEGIN_FTR_SECTION
@@ -219,15 +223,19 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
         REST_NVGPRS(r1)
         REST_GPR(2, r1)
-        ld      r3,_CCR(r1)
+        ld      r6,_CCR(r1)
         ld      r4,_MSR(r1)
         ld      r5,_NIP(r1)
         addi    r1,r1,INT_FRAME_SIZE
-        mtcr    r3
+        mtcr    r6
         mtspr   SPRN_SRR1,r4
         mtspr   SPRN_SRR0,r5
         rfid
 
+/*
+ * R3 here contains the value that will be returned to the caller
+ * of power7_nap.
+ */
 _GLOBAL(power7_wakeup_noloss)
         lbz     r0,PACA_NAPSTATELOST(r13)
         cmpwi   r0,0
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index a83cf5ef6488..5d3968c4d799 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -208,7 +208,7 @@ static unsigned long iommu_range_alloc(struct device *dev,
          * We don't need to disable preemption here because any CPU can
          * safely use any IOMMU pool.
          */
-        pool_nr = __raw_get_cpu_var(iommu_pool_hash) & (tbl->nr_pools - 1);
+        pool_nr = __this_cpu_read(iommu_pool_hash) & (tbl->nr_pools - 1);
 
         if (largealloc)
                 pool = &(tbl->large_pool);
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index c14383575fe8..45096033d37b 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -50,7 +50,6 @@
 #include <linux/list.h>
 #include <linux/radix-tree.h>
 #include <linux/mutex.h>
-#include <linux/bootmem.h>
 #include <linux/pci.h>
 #include <linux/debugfs.h>
 #include <linux/of.h>
@@ -114,7 +113,7 @@ static inline notrace void set_soft_enabled(unsigned long enable)
 static inline notrace int decrementer_check_overflow(void)
 {
         u64 now = get_tb_or_rtc();
-        u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
+        u64 *next_tb = this_cpu_ptr(&decrementers_next_tb);
  
         return now >= *next_tb;
 }
@@ -499,7 +498,7 @@ void __do_irq(struct pt_regs *regs)
 
         /* And finally process it */
         if (unlikely(irq == NO_IRQ))
-                __get_cpu_var(irq_stat).spurious_irqs++;
+                __this_cpu_inc(irq_stat.spurious_irqs);
         else
                 generic_handle_irq(irq);
 
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index 8504657379f1..e77c3ccf8dcf 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -155,7 +155,7 @@ static int kgdb_singlestep(struct pt_regs *regs)
 {
         struct thread_info *thread_info, *exception_thread_info;
         struct thread_info *backup_current_thread_info =
-                &__get_cpu_var(kgdb_thread_info);
+                this_cpu_ptr(&kgdb_thread_info);
 
         if (user_mode(regs))
                 return 0;
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 2f72af82513c..7c053f281406 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -119,7 +119,7 @@ static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
 
 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
-        __get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
+        __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
         kcb->kprobe_status = kcb->prev_kprobe.status;
         kcb->kprobe_saved_msr = kcb->prev_kprobe.saved_msr;
 }
@@ -127,7 +127,7 @@ static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
                                 struct kprobe_ctlblk *kcb)
 {
-        __get_cpu_var(current_kprobe) = p;
+        __this_cpu_write(current_kprobe, p);
         kcb->kprobe_saved_msr = regs->msr;
 }
 
@@ -192,7 +192,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                                 ret = 1;
                                 goto no_kprobe;
                         }
-                        p = __get_cpu_var(current_kprobe);
+                        p = __this_cpu_read(current_kprobe);
                         if (p->break_handler && p->break_handler(p, regs)) {
                                 goto ss_probe;
                         }
diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c
index a7fd4cb78b78..15c99b649b04 100644
--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -73,8 +73,8 @@ void save_mce_event(struct pt_regs *regs, long handled,
                     uint64_t nip, uint64_t addr)
 {
         uint64_t srr1;
-        int index = __get_cpu_var(mce_nest_count)++;
-        struct machine_check_event *mce = &__get_cpu_var(mce_event[index]);
+        int index = __this_cpu_inc_return(mce_nest_count);
+        struct machine_check_event *mce = this_cpu_ptr(&mce_event[index]);
 
         /*
          * Return if we don't have enough space to log mce event.
@@ -143,7 +143,7 @@ void save_mce_event(struct pt_regs *regs, long handled,
  */
 int get_mce_event(struct machine_check_event *mce, bool release)
 {
-        int index = __get_cpu_var(mce_nest_count) - 1;
+        int index = __this_cpu_read(mce_nest_count) - 1;
         struct machine_check_event *mc_evt;
         int ret = 0;
 
@@ -153,7 +153,7 @@ int get_mce_event(struct machine_check_event *mce, bool release)
 
         /* Check if we have MCE info to process. */
         if (index < MAX_MC_EVT) {
-                mc_evt = &__get_cpu_var(mce_event[index]);
+                mc_evt = this_cpu_ptr(&mce_event[index]);
                 /* Copy the event structure and release the original */
                 if (mce)
                         *mce = *mc_evt;
@@ -163,7 +163,7 @@ int get_mce_event(struct machine_check_event *mce, bool release)
         }
         /* Decrement the count to free the slot. */
         if (release)
-                __get_cpu_var(mce_nest_count)--;
+                __this_cpu_dec(mce_nest_count);
 
         return ret;
 }
@@ -184,13 +184,13 @@ void machine_check_queue_event(void)
         if (!get_mce_event(&evt, MCE_EVENT_RELEASE))
                 return;
 
-        index = __get_cpu_var(mce_queue_count)++;
+        index = __this_cpu_inc_return(mce_queue_count);
         /* If queue is full, just return for now. */
         if (index >= MAX_MC_EVT) {
-                __get_cpu_var(mce_queue_count)--;
+                __this_cpu_dec(mce_queue_count);
                 return;
         }
-        __get_cpu_var(mce_event_queue[index]) = evt;
+        memcpy(this_cpu_ptr(&mce_event_queue[index]), &evt, sizeof(evt));
 
         /* Queue irq work to process this event later. */
         irq_work_queue(&mce_event_process_work);
@@ -208,11 +208,11 @@ static void machine_check_process_queued_event(struct irq_work *work)
          * For now just print it to console.
          * TODO: log this error event to FSP or nvram.
          */
-        while (__get_cpu_var(mce_queue_count) > 0) {
-                index = __get_cpu_var(mce_queue_count) - 1;
+        while (__this_cpu_read(mce_queue_count) > 0) {
+                index = __this_cpu_read(mce_queue_count) - 1;
                 machine_check_print_event_info(
-                                &__get_cpu_var(mce_event_queue[index]));
-                __get_cpu_var(mce_queue_count)--;
+                                this_cpu_ptr(&mce_event_queue[index]));
+                __this_cpu_dec(mce_queue_count);
         }
 }
 
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index aa9aff3d6ad3..b6f123ab90ed 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -79,7 +79,7 @@ static long mce_handle_derror(uint64_t dsisr, uint64_t slb_error_bits)
         }
         if (dsisr & P7_DSISR_MC_TLB_MULTIHIT_MFTLB) {
                 if (cur_cpu_spec && cur_cpu_spec->flush_tlb)
-                        cur_cpu_spec->flush_tlb(TLBIEL_INVAL_PAGE);
+                        cur_cpu_spec->flush_tlb(TLBIEL_INVAL_SET);
                 /* reset error bits */
                 dsisr &= ~P7_DSISR_MC_TLB_MULTIHIT_MFTLB;
         }
@@ -110,7 +110,7 @@ static long mce_handle_common_ierror(uint64_t srr1)
                 break;
         case P7_SRR1_MC_IFETCH_TLB_MULTIHIT:
                 if (cur_cpu_spec && cur_cpu_spec->flush_tlb) {
-                        cur_cpu_spec->flush_tlb(TLBIEL_INVAL_PAGE);
+                        cur_cpu_spec->flush_tlb(TLBIEL_INVAL_SET);
                         handled = 1;
                 }
                 break;
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index e5dad9a9edc0..37d512d35943 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -20,7 +20,6 @@
 #include <linux/pci.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/delay.h>
 #include <linux/export.h>
 #include <linux/of_address.h>
@@ -1464,7 +1463,7 @@ static void pcibios_setup_phb_resources(struct pci_controller *hose,
         res = &hose->io_resource;
 
         if (!res->flags) {
-                printk(KERN_WARNING "PCI: I/O resource not set for host"
+                pr_info("PCI: I/O resource not set for host"
                        " bridge %s (domain %d)\n",
                        hose->dn->full_name, hose->global_number);
         } else {
diff --git a/arch/powerpc/kernel/pci_32.c b/arch/powerpc/kernel/pci_32.c
index 432459c817fa..1f7930037cb7 100644
--- a/arch/powerpc/kernel/pci_32.c
+++ b/arch/powerpc/kernel/pci_32.c
@@ -199,9 +199,7 @@ pci_create_OF_bus_map(void)
         struct property* of_prop;
         struct device_node *dn;
 
-        of_prop = (struct property*) alloc_bootmem(sizeof(struct property) + 256);
-        if (!of_prop)
-                return;
+        of_prop = memblock_virt_alloc(sizeof(struct property) + 256, 0);
         dn = of_find_node_by_path("/");
         if (dn) {
                 memset(of_prop, -1, sizeof(struct property) + 256);
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index b15194e2c5fc..60bb187cb46a 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -17,7 +17,6 @@
 #include <linux/pci.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/export.h>
 #include <linux/mm.h>
 #include <linux/list.h>
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 923cd2daba89..b4cc7bef6b16 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -37,9 +37,9 @@
 #include <linux/personality.h>
 #include <linux/random.h>
 #include <linux/hw_breakpoint.h>
+#include <linux/uaccess.h>
 
 #include <asm/pgtable.h>
-#include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/mmu.h>
@@ -499,7 +499,7 @@ static inline int set_dawr(struct arch_hw_breakpoint *brk)
 
 void __set_breakpoint(struct arch_hw_breakpoint *brk)
 {
-        __get_cpu_var(current_brk) = *brk;
+        memcpy(this_cpu_ptr(&current_brk), brk, sizeof(*brk));
 
         if (cpu_has_feature(CPU_FTR_DAWR))
                 set_dawr(brk);
@@ -842,7 +842,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
  * schedule DABR
  */
 #ifndef CONFIG_HAVE_HW_BREAKPOINT
-        if (unlikely(!hw_brk_match(&__get_cpu_var(current_brk), &new->thread.hw_brk)))
+        if (unlikely(!hw_brk_match(this_cpu_ptr(&current_brk), &new->thread.hw_brk)))
                 __set_breakpoint(&new->thread.hw_brk);
 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
 #endif
@@ -856,7 +856,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
          * Collect processor utilization data per process
          */
         if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
-                struct cpu_usage *cu = &__get_cpu_var(cpu_usage_array);
+                struct cpu_usage *cu = this_cpu_ptr(&cpu_usage_array);
                 long unsigned start_tb, current_tb;
                 start_tb = old_thread->start_tb;
                 cu->current_tb = current_tb = mfspr(SPRN_PURR);
@@ -866,7 +866,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
 #endif /* CONFIG_PPC64 */
 
 #ifdef CONFIG_PPC_BOOK3S_64
-        batch = &__get_cpu_var(ppc64_tlb_batch);
+        batch = this_cpu_ptr(&ppc64_tlb_batch);
         if (batch->active) {
                 current_thread_info()->local_flags |= _TLF_LAZY_MMU;
                 if (batch->index)
@@ -889,7 +889,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
 #ifdef CONFIG_PPC_BOOK3S_64
         if (current_thread_info()->local_flags & _TLF_LAZY_MMU) {
                 current_thread_info()->local_flags &= ~_TLF_LAZY_MMU;
-                batch = &__get_cpu_var(ppc64_tlb_batch);
+                batch = this_cpu_ptr(&ppc64_tlb_batch);
                 batch->active = 1;
         }
 #endif /* CONFIG_PPC_BOOK3S_64 */
@@ -921,12 +921,8 @@ static void show_instructions(struct pt_regs *regs)
                         pc = (unsigned long)phys_to_virt(pc);
 #endif
 
-                /* We use __get_user here *only* to avoid an OOPS on a
-                 * bad address because the pc *should* only be a
-                 * kernel address.
-                 */
                 if (!__kernel_text_address(pc) ||
-                     __get_user(instr, (unsigned int __user *)pc)) {
+                     probe_kernel_address((unsigned int __user *)pc, instr)) {
                         printk(KERN_CONT "XXXXXXXX ");
                 } else {
                         if (regs->nip == pc)
@@ -1531,13 +1527,6 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
         int curr_frame = current->curr_ret_stack;
         extern void return_to_handler(void);
         unsigned long rth = (unsigned long)return_to_handler;
-        unsigned long mrth = -1;
-#ifdef CONFIG_PPC64
-        extern void mod_return_to_handler(void);
-        rth = *(unsigned long *)rth;
-        mrth = (unsigned long)mod_return_to_handler;
-        mrth = *(unsigned long *)mrth;
-#endif
 #endif
 
         sp = (unsigned long) stack;
@@ -1562,7 +1551,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
                 if (!firstframe || ip != lr) {
                         printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-                        if ((ip == rth || ip == mrth) && curr_frame >= 0) {
+                        if ((ip == rth) && curr_frame >= 0) {
                                 printk(" (%pS)",
                                        (void *)current->ret_stack[curr_frame].ret);
                                 curr_frame--;
@@ -1665,12 +1654,3 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
         return ret;
 }
 
-unsigned long randomize_et_dyn(unsigned long base)
-{
-        unsigned long ret = PAGE_ALIGN(base + brk_rnd());
-
-        if (ret < base)
-                return base;
-
-        return ret;
-}
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 099f27e6d1b0..6a799b3cc6b4 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -160,6 +160,12 @@ static struct ibm_pa_feature {
         {CPU_FTR_NODSISRALIGN, 0, 0,    1, 1, 1},
         {0, MMU_FTR_CI_LARGE_PAGE, 0,   1, 2, 0},
         {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0},
+        /*
+         * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n),
+         * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP
+         * which is 0 if the kernel doesn't support TM.
+         */
+        {CPU_FTR_TM_COMP, 0, 0,         22, 0, 0},
 };
 
 static void __init scan_features(unsigned long node, const unsigned char *ftrs,
@@ -696,10 +702,7 @@ void __init early_init_devtree(void *params)
                 reserve_crashkernel();
         early_reserve_mem();
 
-        /*
-         * Ensure that total memory size is page-aligned, because otherwise
-         * mark_bootmem() gets upset.
-         */
+        /* Ensure that total memory size is page-aligned. */
         limit = ALIGN(memory_limit ?: memblock_phys_mem_size(), PAGE_SIZE);
         memblock_enforce_memory_limit(limit);
 
diff --git a/arch/powerpc/kernel/rtas-proc.c b/arch/powerpc/kernel/rtas-proc.c
index 8777fb02349f..fb2fb3ea85e5 100644
--- a/arch/powerpc/kernel/rtas-proc.c
+++ b/arch/powerpc/kernel/rtas-proc.c
@@ -113,17 +113,6 @@
 #define SENSOR_PREFIX           "ibm,sensor-"
 #define cel_to_fahr(x)          ((x*9/5)+32)
 
-
-/* Globals */
-static struct rtas_sensors sensors;
-static struct device_node *rtas_node = NULL;
-static unsigned long power_on_time = 0; /* Save the time the user set */
-static char progress_led[MAX_LINELENGTH];
-
-static unsigned long rtas_tone_frequency = 1000;
-static unsigned long rtas_tone_volume = 0;
-
-/* ****************STRUCTS******************************************* */
 struct individual_sensor {
         unsigned int token;
         unsigned int quant;
@@ -134,6 +123,15 @@ struct rtas_sensors {
         unsigned int quant;
 };
 
+/* Globals */
+static struct rtas_sensors sensors;
+static struct device_node *rtas_node = NULL;
+static unsigned long power_on_time = 0; /* Save the time the user set */
+static char progress_led[MAX_LINELENGTH];
+
+static unsigned long rtas_tone_frequency = 1000;
+static unsigned long rtas_tone_volume = 0;
+
 /* ****************************************************************** */
 /* Declarations */
 static int ppc_rtas_sensors_show(struct seq_file *m, void *v);
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 8b4c857c1421..4af905e81ab0 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1091,8 +1091,8 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
 }
 
 /*
- * Call early during boot, before mem init or bootmem, to retrieve the RTAS
- * informations from the device-tree and allocate the RMO buffer for userland
+ * Call early during boot, before mem init, to retrieve the RTAS
+ * information from the device-tree and allocate the RMO buffer for userland
  * accesses.
  */
 void __init rtas_initialize(void)
diff --git a/arch/powerpc/kernel/rtas_pci.c b/arch/powerpc/kernel/rtas_pci.c
index 7c55b86206b3..ce230da2c015 100644
--- a/arch/powerpc/kernel/rtas_pci.c
+++ b/arch/powerpc/kernel/rtas_pci.c
@@ -26,7 +26,6 @@
 #include <linux/pci.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 
 #include <asm/io.h>
 #include <asm/pgtable.h>
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 1362cd62b3fa..44c8d03558ac 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -139,8 +139,8 @@ void machine_restart(char *cmd)
 void machine_power_off(void)
 {
         machine_shutdown();
-        if (ppc_md.power_off)
-                ppc_md.power_off();
+        if (pm_power_off)
+                pm_power_off();
 #ifdef CONFIG_SMP
         smp_send_stop();
 #endif
@@ -151,7 +151,7 @@ void machine_power_off(void)
 /* Used by the G5 thermal driver */
 EXPORT_SYMBOL_GPL(machine_power_off);
 
-void (*pm_power_off)(void) = machine_power_off;
+void (*pm_power_off)(void);
 EXPORT_SYMBOL_GPL(pm_power_off);
 
 void machine_halt(void)
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index 07831ed0d9ef..bb02e9f6944e 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -11,7 +11,6 @@
 #include <linux/delay.h>
 #include <linux/initrd.h>
 #include <linux/tty.h>
-#include <linux/bootmem.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/cpu.h>
@@ -53,11 +52,6 @@ unsigned long ISA_DMA_THRESHOLD;
 unsigned int DMA_MODE_READ;
 unsigned int DMA_MODE_WRITE;
 
-#ifdef CONFIG_VGA_CONSOLE
-unsigned long vgacon_remap_base;
-EXPORT_SYMBOL(vgacon_remap_base);
-#endif
-
 /*
  * These are used in binfmt_elf.c to put aux entries on the stack
  * for each elf executable being started.
@@ -311,9 +305,8 @@ void __init setup_arch(char **cmdline_p)
 
         irqstack_early_init();
 
-        /* set up the bootmem stuff with available memory */
-        do_init_bootmem();
-        if ( ppc_md.progress ) ppc_md.progress("setup_arch: bootmem", 0x3eab);
+        initmem_init();
+        if ( ppc_md.progress ) ppc_md.progress("setup_arch: initmem", 0x3eab);
 
 #ifdef CONFIG_DUMMY_CONSOLE
         conswitchp = &dummy_con;
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 4f3cfe1b6a33..49f553bbb360 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -660,13 +660,11 @@ static void __init emergency_stack_init(void)
 }
 
 /*
- * Called into from start_kernel this initializes bootmem, which is used
+ * Called into from start_kernel this initializes memblock, which is used
  * to manage page allocation until mem_init is called.
  */
 void __init setup_arch(char **cmdline_p)
 {
-        ppc64_boot_msg(0x12, "Setup Arch");
-
         *cmdline_p = boot_command_line;
 
         /*
@@ -691,9 +689,7 @@ void __init setup_arch(char **cmdline_p)
         exc_lvl_early_init();
         emergency_stack_init();
 
-        /* set up the bootmem stuff with available memory */
-        do_init_bootmem();
-        sparse_init();
+        initmem_init();
 
 #ifdef CONFIG_DUMMY_CONSOLE
         conswitchp = &dummy_con;
@@ -711,33 +707,6 @@ void __init setup_arch(char **cmdline_p)
         if ((unsigned long)_stext & 0xffff)
                 panic("Kernelbase not 64K-aligned (0x%lx)!\n",
                       (unsigned long)_stext);
-
-        ppc64_boot_msg(0x15, "Setup Done");
-}
-
-
-/* ToDo: do something useful if ppc_md is not yet setup. */
-#define PPC64_LINUX_FUNCTION 0x0f000000
-#define PPC64_IPL_MESSAGE 0xc0000000
-#define PPC64_TERM_MESSAGE 0xb0000000
-
-static void ppc64_do_msg(unsigned int src, const char *msg)
-{
-        if (ppc_md.progress) {
-                char buf[128];
-
-                sprintf(buf, "%08X\n", src);
-                ppc_md.progress(buf, 0);
-                snprintf(buf, 128, "%s", msg);
-                ppc_md.progress(buf, 0);
-        }
-}
-
-/* Print a boot progress message. */
-void ppc64_boot_msg(unsigned int src, const char *msg)
-{
-        ppc64_do_msg(PPC64_LINUX_FUNCTION|PPC64_IPL_MESSAGE|src, msg);
-        printk("[boot]%04x %s\n", src, msg);
 }
 
 #ifdef CONFIG_SMP
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 71e186d5f331..8b2d2dc8ef10 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -243,7 +243,7 @@ void smp_muxed_ipi_message_pass(int cpu, int msg)
 
 irqreturn_t smp_ipi_demux(void)
 {
-        struct cpu_messages *info = &__get_cpu_var(ipi_message);
+        struct cpu_messages *info = this_cpu_ptr(&ipi_message);
         unsigned int all;
 
         mb();   /* order any irq clear */
@@ -442,9 +442,9 @@ void generic_mach_cpu_die(void)
         idle_task_exit();
         cpu = smp_processor_id();
         printk(KERN_DEBUG "CPU%d offline\n", cpu);
-        __get_cpu_var(cpu_state) = CPU_DEAD;
+        __this_cpu_write(cpu_state, CPU_DEAD);
         smp_wmb();
-        while (__get_cpu_var(cpu_state) != CPU_UP_PREPARE)
+        while (__this_cpu_read(cpu_state) != CPU_UP_PREPARE)
                 cpu_relax();
 }
 
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 67fd2fd2620a..fa1fd8a0c867 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -394,10 +394,10 @@ void ppc_enable_pmcs(void)
         ppc_set_pmu_inuse(1);
 
         /* Only need to enable them once */
-        if (__get_cpu_var(pmcs_enabled))
+        if (__this_cpu_read(pmcs_enabled))
                 return;
 
-        __get_cpu_var(pmcs_enabled) = 1;
+        __this_cpu_write(pmcs_enabled, 1);
 
         if (ppc_md.enable_pmcs)
                 ppc_md.enable_pmcs();
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 7505599c2593..fa7c4f12104f 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -458,9 +458,9 @@ static inline void clear_irq_work_pending(void)
 
 DEFINE_PER_CPU(u8, irq_work_pending);
 
-#define set_irq_work_pending_flag()     __get_cpu_var(irq_work_pending) = 1
-#define test_irq_work_pending()         __get_cpu_var(irq_work_pending)
-#define clear_irq_work_pending()        __get_cpu_var(irq_work_pending) = 0
+#define set_irq_work_pending_flag()     __this_cpu_write(irq_work_pending, 1)
+#define test_irq_work_pending()         __this_cpu_read(irq_work_pending)
+#define clear_irq_work_pending()        __this_cpu_write(irq_work_pending, 0)
 
 #endif /* 32 vs 64 bit */
 
@@ -482,8 +482,8 @@ void arch_irq_work_raise(void)
 static void __timer_interrupt(void)
 {
         struct pt_regs *regs = get_irq_regs();
-        u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
-        struct clock_event_device *evt = &__get_cpu_var(decrementers);
+        u64 *next_tb = this_cpu_ptr(&decrementers_next_tb);
+        struct clock_event_device *evt = this_cpu_ptr(&decrementers);
         u64 now;
 
         trace_timer_interrupt_entry(regs);
@@ -498,7 +498,7 @@ static void __timer_interrupt(void)
                 *next_tb = ~(u64)0;
                 if (evt->event_handler)
                         evt->event_handler(evt);
-                __get_cpu_var(irq_stat).timer_irqs_event++;
+                __this_cpu_inc(irq_stat.timer_irqs_event);
         } else {
                 now = *next_tb - now;
                 if (now <= DECREMENTER_MAX)
@@ -506,13 +506,13 @@ static void __timer_interrupt(void)
                 /* We may have raced with new irq work */
                 if (test_irq_work_pending())
                         set_dec(1);
-                __get_cpu_var(irq_stat).timer_irqs_others++;
+                __this_cpu_inc(irq_stat.timer_irqs_others);
         }
 
 #ifdef CONFIG_PPC64
         /* collect purr register values often, for accurate calculations */
         if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
-                struct cpu_usage *cu = &__get_cpu_var(cpu_usage_array);
+                struct cpu_usage *cu = this_cpu_ptr(&cpu_usage_array);
                 cu->current_tb = mfspr(SPRN_PURR);
         }
 #endif
@@ -527,7 +527,7 @@ static void __timer_interrupt(void)
 void timer_interrupt(struct pt_regs * regs)
 {
         struct pt_regs *old_regs;
-        u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
+        u64 *next_tb = this_cpu_ptr(&decrementers_next_tb);
 
         /* Ensure a positive value is written to the decrementer, or else
          * some CPUs will continue to take decrementer exceptions.
@@ -813,7 +813,7 @@ static void __init clocksource_init(void)
 static int decrementer_set_next_event(unsigned long evt,
                                       struct clock_event_device *dev)
 {
-        __get_cpu_var(decrementers_next_tb) = get_tb_or_rtc() + evt;
+        __this_cpu_write(decrementers_next_tb, get_tb_or_rtc() + evt);
         set_dec(evt);
 
         /* We may have raced with new irq work */
@@ -833,7 +833,7 @@ static void decrementer_set_mode(enum clock_event_mode mode,
 /* Interrupt handler for the timer broadcast IPI */
 void tick_broadcast_ipi_handler(void)
 {
-        u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
+        u64 *next_tb = this_cpu_ptr(&decrementers_next_tb);
 
         *next_tb = get_tb_or_rtc();
         __timer_interrupt();
@@ -989,6 +989,7 @@ void GregorianDay(struct rtc_time * tm)
 
         tm->tm_wday = day % 7;
 }
+EXPORT_SYMBOL_GPL(GregorianDay);
 
 void to_tm(int tim, struct rtc_time * tm)
 {
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 0dc43f9932cf..e6595b72269b 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -295,7 +295,7 @@ long machine_check_early(struct pt_regs *regs)
 {
         long handled = 0;
 
-        __get_cpu_var(irq_stat).mce_exceptions++;
+        __this_cpu_inc(irq_stat.mce_exceptions);
 
         if (cur_cpu_spec && cur_cpu_spec->machine_check_early)
                 handled = cur_cpu_spec->machine_check_early(regs);
@@ -304,7 +304,7 @@ long machine_check_early(struct pt_regs *regs)
 
 long hmi_exception_realmode(struct pt_regs *regs)
 {
-        __get_cpu_var(irq_stat).hmi_exceptions++;
+        __this_cpu_inc(irq_stat.hmi_exceptions);
 
         if (ppc_md.hmi_exception_early)
                 ppc_md.hmi_exception_early(regs);
@@ -700,7 +700,7 @@ void machine_check_exception(struct pt_regs *regs)
         enum ctx_state prev_state = exception_enter();
         int recover = 0;
 
-        __get_cpu_var(irq_stat).mce_exceptions++;
+        __this_cpu_inc(irq_stat.mce_exceptions);
 
         /* See if any machine dependent calls. In theory, we would want
          * to call the CPU first, and call the ppc_md. one if the CPU
@@ -1519,7 +1519,7 @@ void vsx_unavailable_tm(struct pt_regs *regs)
 
 void performance_monitor_exception(struct pt_regs *regs)
 {
-        __get_cpu_var(irq_stat).pmu_irqs++;
+        __this_cpu_inc(irq_stat.pmu_irqs);
 
         perf_irq(regs);
 }
diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
index 6e7c4923b5ea..411116c38da4 100644
--- a/arch/powerpc/kernel/udbg_16550.c
+++ b/arch/powerpc/kernel/udbg_16550.c
@@ -69,8 +69,12 @@ static void udbg_uart_putc(char c)
 
 static int udbg_uart_getc_poll(void)
 {
-        if (!udbg_uart_in || !(udbg_uart_in(UART_LSR) & LSR_DR))
+        if (!udbg_uart_in)
+                return -1;
+
+        if (!(udbg_uart_in(UART_LSR) & LSR_DR))
                 return udbg_uart_in(UART_RBR);
+
         return -1;
 }
 
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index f174351842cf..305eb0d9b768 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -20,7 +20,6 @@
 #include <linux/user.h>
 #include <linux/elf.h>
 #include <linux/security.h>
-#include <linux/bootmem.h>
 #include <linux/memblock.h>
 
 #include <asm/pgtable.h>
diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
index 4fdc27c80f4c..3f1bb5a36c27 100644
--- a/arch/powerpc/kvm/book3s_hv_builtin.c
+++ b/arch/powerpc/kvm/book3s_hv_builtin.c
@@ -12,7 +12,6 @@
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
-#include <linux/bootmem.h>
 #include <linux/init.h>
 #include <linux/memblock.h>
 #include <linux/sizes.h>
@@ -154,7 +153,7 @@ EXPORT_SYMBOL_GPL(kvm_release_hpt);
  * kvm_cma_reserve() - reserve area for kvm hash pagetable
  *
  * This function reserves memory from early allocator. It should be
- * called by arch specific code once the early allocator (memblock or bootmem)
+ * called by arch specific code once the memblock allocator
  * has been activated and all other subsystems have already allocated/reserved
  * memory.
  */
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index edb2ccdbb2ba..65c105b17a25 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -201,8 +201,6 @@ kvmppc_primary_no_guest:
         bge     kvm_novcpu_exit /* another thread already exiting */
         li      r3, NAPPING_NOVCPU
         stb     r3, HSTATE_NAPPING(r13)
-        li      r3, 1
-        stb     r3, HSTATE_HWTHREAD_REQ(r13)
 
         b       kvm_do_nap
 
@@ -293,6 +291,8 @@ kvm_start_guest:
         /* if we have no vcpu to run, go back to sleep */
         beq     kvm_no_guest
 
+kvm_secondary_got_guest:
+
         /* Set HSTATE_DSCR(r13) to something sensible */
         ld      r6, PACA_DSCR(r13)
         std     r6, HSTATE_DSCR(r13)
@@ -318,27 +318,46 @@ kvm_start_guest:
         stwcx.  r3, 0, r4
         bne     51b
 
+/*
+ * At this point we have finished executing in the guest.
+ * We need to wait for hwthread_req to become zero, since
+ * we may not turn on the MMU while hwthread_req is non-zero.
+ * While waiting we also need to check if we get given a vcpu to run.
+ */
 kvm_no_guest:
-        li      r0, KVM_HWTHREAD_IN_NAP
+        lbz     r3, HSTATE_HWTHREAD_REQ(r13)
+        cmpwi   r3, 0
+        bne     53f
+        HMT_MEDIUM
+        li      r0, KVM_HWTHREAD_IN_KERNEL
         stb     r0, HSTATE_HWTHREAD_STATE(r13)
-kvm_do_nap:
-        /* Clear the runlatch bit before napping */
-        mfspr   r2, SPRN_CTRLF
-        clrrdi  r2, r2, 1
-        mtspr   SPRN_CTRLT, r2
-
+        /* need to recheck hwthread_req after a barrier, to avoid race */
+        sync
+        lbz     r3, HSTATE_HWTHREAD_REQ(r13)
+        cmpwi   r3, 0
+        bne     54f
+/*
+ * We jump to power7_wakeup_loss, which will return to the caller
+ * of power7_nap in the powernv cpu offline loop.  The value we
+ * put in r3 becomes the return value for power7_nap.
+ */
         li      r3, LPCR_PECE0
         mfspr   r4, SPRN_LPCR
         rlwimi  r4, r3, 0, LPCR_PECE0 | LPCR_PECE1
         mtspr   SPRN_LPCR, r4
-        isync
-        std     r0, HSTATE_SCRATCH0(r13)
-        ptesync
-        ld      r0, HSTATE_SCRATCH0(r13)
-1:      cmpd    r0, r0
-        bne     1b
-        nap
-        b       .
+        li      r3, 0
+        b       power7_wakeup_loss
+
+53:     HMT_LOW
+        ld      r4, HSTATE_KVM_VCPU(r13)
+        cmpdi   r4, 0
+        beq     kvm_no_guest
+        HMT_MEDIUM
+        b       kvm_secondary_got_guest
+
+54:     li      r0, KVM_HWTHREAD_IN_KVM
+        stb     r0, HSTATE_HWTHREAD_STATE(r13)
+        b       kvm_no_guest
 
 /******************************************************************************
  *                                                                            *
@@ -2172,6 +2191,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_206)
          * occurs, with PECE1, PECE0 and PECEDP set in LPCR. Also clear the
          * runlatch bit before napping.
          */
+kvm_do_nap:
         mfspr   r2, SPRN_CTRLF
         clrrdi  r2, r2, 1
         mtspr   SPRN_CTRLT, r2
diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c
index 2e02ed849f36..16095841afe1 100644
--- a/arch/powerpc/kvm/e500.c
+++ b/arch/powerpc/kvm/e500.c
@@ -76,11 +76,11 @@ static inline int local_sid_setup_one(struct id *entry)
         unsigned long sid;
         int ret = -1;
 
-        sid = ++(__get_cpu_var(pcpu_last_used_sid));
+        sid = __this_cpu_inc_return(pcpu_last_used_sid);
         if (sid < NUM_TIDS) {
-                __get_cpu_var(pcpu_sids).entry[sid] = entry;
+                __this_cpu_write(pcpu_sids)entry[sid], entry);
                 entry->val = sid;
-                entry->pentry = &__get_cpu_var(pcpu_sids).entry[sid];
+                entry->pentry = this_cpu_ptr(&pcpu_sids.entry[sid]);
                 ret = sid;
         }
 
@@ -108,8 +108,8 @@ static inline int local_sid_setup_one(struct id *entry)
 static inline int local_sid_lookup(struct id *entry)
 {
         if (entry && entry->val != 0 &&
-            __get_cpu_var(pcpu_sids).entry[entry->val] == entry &&
-            entry->pentry == &__get_cpu_var(pcpu_sids).entry[entry->val])
+            __this_cpu_read(pcpu_sids.entry[entry->val]) == entry &&
+            entry->pentry == this_cpu_ptr(&pcpu_sids.entry[entry->val]))
                 return entry->val;
         return -1;
 }
@@ -117,8 +117,8 @@ static inline int local_sid_lookup(struct id *entry)
 /* Invalidate all id mappings on local core -- call with preempt disabled */
 static inline void local_sid_destroy_all(void)
 {
-        __get_cpu_var(pcpu_last_used_sid) = 0;
-        memset(&__get_cpu_var(pcpu_sids), 0, sizeof(__get_cpu_var(pcpu_sids)));
+        __this_cpu_write(pcpu_last_used_sid, 0);
+        memset(this_cpu_ptr(&pcpu_sids), 0, sizeof(pcpu_sids));
 }
 
 static void *kvmppc_e500_id_table_alloc(struct kvmppc_vcpu_e500 *vcpu_e500)
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index 769778f855b0..cc536d4a75ef 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -661,7 +661,7 @@ int kvmppc_load_last_inst(struct kvm_vcpu *vcpu, enum instruction_type type,
         if (unlikely((pr && !(mas3 & MAS3_UX)) ||
                      (!pr && !(mas3 & MAS3_SX)))) {
                 pr_err_ratelimited(
-                        "%s: Instuction emulation from guest addres %08lx without execute permission\n",
+                        "%s: Instruction emulation from guest address %08lx without execute permission\n",
                         __func__, geaddr);
                 return EMULATE_AGAIN;
         }
@@ -673,7 +673,7 @@ int kvmppc_load_last_inst(struct kvm_vcpu *vcpu, enum instruction_type type,
         if (has_feature(vcpu, VCPU_FTR_MMU_V2) &&
             unlikely((mas2 & MAS2_I) || (mas2 & MAS2_W) || !(mas2 & MAS2_M))) {
                 pr_err_ratelimited(
-                        "%s: Instuction emulation from guest addres %08lx mismatches storage attributes\n",
+                        "%s: Instruction emulation from guest address %08lx mismatches storage attributes\n",
                         __func__, geaddr);
                 return EMULATE_AGAIN;
         }
@@ -686,7 +686,7 @@ int kvmppc_load_last_inst(struct kvm_vcpu *vcpu, enum instruction_type type,
 
         /* Guard against emulation from devices area */
         if (unlikely(!page_is_ram(pfn))) {
-                pr_err_ratelimited("%s: Instruction emulation from non-RAM host addres %08llx is not supported\n",
+                pr_err_ratelimited("%s: Instruction emulation from non-RAM host address %08llx is not supported\n",
                          __func__, addr);
                 return EMULATE_AGAIN;
         }
diff --git a/arch/powerpc/kvm/e500mc.c b/arch/powerpc/kvm/e500mc.c
index 2fdc8722e324..cda695de8aa7 100644
--- a/arch/powerpc/kvm/e500mc.c
+++ b/arch/powerpc/kvm/e500mc.c
@@ -144,9 +144,9 @@ static void kvmppc_core_vcpu_load_e500mc(struct kvm_vcpu *vcpu, int cpu)
         mtspr(SPRN_GESR, vcpu->arch.shared->esr);
 
         if (vcpu->arch.oldpir != mfspr(SPRN_PIR) ||
-            __get_cpu_var(last_vcpu_of_lpid)[get_lpid(vcpu)] != vcpu) {
+            __this_cpu_read(last_vcpu_of_lpid[get_lpid(vcpu)]) != vcpu) {
                 kvmppc_e500_tlbil_all(vcpu_e500);
-                __get_cpu_var(last_vcpu_of_lpid)[get_lpid(vcpu)] = vcpu;
+                __this_cpu_write(last_vcpu_of_lpid[get_lpid(vcpu)], vcpu);
         }
 }
 
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 9f342f134ae4..597562f69b2d 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -12,7 +12,6 @@ CFLAGS_REMOVE_feature-fixups.o = -pg
 obj-y                   := string.o alloc.o \
                            crtsavres.o ppc_ksyms.o
 obj-$(CONFIG_PPC32)     += div64.o copy_32.o
-obj-$(CONFIG_HAS_IOMEM) += devres.o
 
 obj-$(CONFIG_PPC64)     += copypage_64.o copyuser_64.o \
                            usercopy_64.o mem_64.o string.o \
diff --git a/arch/powerpc/lib/alloc.c b/arch/powerpc/lib/alloc.c
index da22c84a8fed..4a6c2cf890d9 100644
--- a/arch/powerpc/lib/alloc.c
+++ b/arch/powerpc/lib/alloc.c
@@ -13,9 +13,7 @@ void * __init_refok zalloc_maybe_bootmem(size_t size, gfp_t mask)
         if (mem_init_done)
                 p = kzalloc(size, mask);
         else {
-                p = alloc_bootmem(size);
-                if (p)
-                        memset(p, 0, size);
+                p = memblock_virt_alloc(size, 0);
         }
         return p;
 }
diff --git a/arch/powerpc/lib/copyuser_power7.S b/arch/powerpc/lib/copyuser_power7.S
index c46c876ac96a..92ee840529bc 100644
--- a/arch/powerpc/lib/copyuser_power7.S
+++ b/arch/powerpc/lib/copyuser_power7.S
@@ -718,4 +718,4 @@ err3;	stb	r0,0(r3)
 
 15:     addi    r1,r1,STACKFRAMESIZE
         b       exit_vmx_usercopy       /* tail call optimise */
-#endif /* CONFiG_ALTIVEC */
+#endif /* CONFIG_ALTIVEC */
diff --git a/arch/powerpc/lib/devres.c b/arch/powerpc/lib/devres.c
deleted file mode 100644
index 8df55fc3aad6..000000000000
--- a/arch/powerpc/lib/devres.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2008 Freescale Semiconductor, Inc.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/device.h>       /* devres_*(), devm_ioremap_release() */
-#include <linux/gfp.h>
-#include <linux/io.h>           /* ioremap_prot() */
-#include <linux/export.h>       /* EXPORT_SYMBOL() */
-
-/**
- * devm_ioremap_prot - Managed ioremap_prot()
- * @dev: Generic device to remap IO address for
- * @offset: BUS offset to map
- * @size: Size of map
- * @flags: Page flags
- *
- * Managed ioremap_prot().  Map is automatically unmapped on driver
- * detach.
- */
-void __iomem *devm_ioremap_prot(struct device *dev, resource_size_t offset,
-                                 size_t size, unsigned long flags)
-{
-        void __iomem **ptr, *addr;
-
-        ptr = devres_alloc(devm_ioremap_release, sizeof(*ptr), GFP_KERNEL);
-        if (!ptr)
-                return NULL;
-
-        addr = ioremap_prot(offset, size, flags);
-        if (addr) {
-                *ptr = addr;
-                devres_add(dev, ptr);
-        } else
-                devres_free(ptr);
-
-        return addr;
-}
-EXPORT_SYMBOL(devm_ioremap_prot);
diff --git a/arch/powerpc/lib/memcpy_power7.S b/arch/powerpc/lib/memcpy_power7.S
index 2ff5c142f87b..0830587df16e 100644
--- a/arch/powerpc/lib/memcpy_power7.S
+++ b/arch/powerpc/lib/memcpy_power7.S
@@ -653,4 +653,4 @@ _GLOBAL(memcpy_power7)
 15:     addi    r1,r1,STACKFRAMESIZE
         ld      r3,-STACKFRAMESIZE+STK_REG(R31)(r1)
         b       exit_vmx_copy           /* tail call optimise */
-#endif /* CONFiG_ALTIVEC */
+#endif /* CONFIG_ALTIVEC */
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 54651fc2d412..dc885b30f7a6 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1865,6 +1865,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 }
                 goto ldst_done;
 
+#ifdef CONFIG_PPC_FPU
         case LOAD_FP:
                 if (regs->msr & MSR_LE)
                         return 0;
@@ -1873,7 +1874,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 else
                         err = do_fp_load(op.reg, do_lfd, op.ea, size, regs);
                 goto ldst_done;
-
+#endif
 #ifdef CONFIG_ALTIVEC
         case LOAD_VMX:
                 if (regs->msr & MSR_LE)
@@ -1919,6 +1920,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 err = write_mem(op.val, op.ea, size, regs);
                 goto ldst_done;
 
+#ifdef CONFIG_PPC_FPU
         case STORE_FP:
                 if (regs->msr & MSR_LE)
                         return 0;
@@ -1927,7 +1929,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 else
                         err = do_fp_store(op.reg, do_stfd, op.ea, size, regs);
                 goto ldst_done;
-
+#endif
 #ifdef CONFIG_ALTIVEC
         case STORE_VMX:
                 if (regs->msr & MSR_LE)
diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
index 325e861616a1..438dcd3fd0d1 100644
--- a/arch/powerpc/mm/Makefile
+++ b/arch/powerpc/mm/Makefile
@@ -6,7 +6,7 @@ subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
 
 ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC)
 
-obj-y                           := fault.o mem.o pgtable.o gup.o mmap.o \
+obj-y                           := fault.o mem.o pgtable.o mmap.o \
                                    init_$(CONFIG_WORD_SIZE).o \
                                    pgtable_$(CONFIG_WORD_SIZE).o
 obj-$(CONFIG_PPC_MMU_NOHASH)    += mmu_context_nohash.o tlb_nohash.o \
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 08d659a9fcdb..eb79907f34fa 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -43,7 +43,6 @@
 #include <asm/tlbflush.h>
 #include <asm/siginfo.h>
 #include <asm/debug.h>
-#include <mm/mmu_decl.h>
 
 #include "icswx.h"
 
@@ -380,12 +379,6 @@ good_area:
                 goto bad_area;
 #endif /* CONFIG_6xx */
 #if defined(CONFIG_8xx)
-        /* 8xx sometimes need to load a invalid/non-present TLBs.
-         * These must be invalidated separately as linux mm don't.
-         */
-        if (error_code & 0x40000000) /* no translation? */
-                _tlbil_va(address, 0, 0, 0);
-
         /* The MPC8xx seems to always set 0x80000000, which is
          * "undefined".  Of those that can be set, this is the only
          * one which seems bad.
diff --git a/arch/powerpc/mm/gup.c b/arch/powerpc/mm/gup.c
deleted file mode 100644
index d8746684f606..000000000000
--- a/arch/powerpc/mm/gup.c
+++ /dev/null
@@ -1,235 +0,0 @@
-/*
- * Lockless get_user_pages_fast for powerpc
- *
- * Copyright (C) 2008 Nick Piggin
- * Copyright (C) 2008 Novell Inc.
- */
-#undef DEBUG
-
-#include <linux/sched.h>
-#include <linux/mm.h>
-#include <linux/hugetlb.h>
-#include <linux/vmstat.h>
-#include <linux/pagemap.h>
-#include <linux/rwsem.h>
-#include <asm/pgtable.h>
-
-#ifdef __HAVE_ARCH_PTE_SPECIAL
-
-/*
- * The performance critical leaf functions are made noinline otherwise gcc
- * inlines everything into a single function which results in too much
- * register pressure.
- */
-static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
-                unsigned long end, int write, struct page **pages, int *nr)
-{
-        unsigned long mask, result;
-        pte_t *ptep;
-
-        result = _PAGE_PRESENT|_PAGE_USER;
-        if (write)
-                result |= _PAGE_RW;
-        mask = result | _PAGE_SPECIAL;
-
-        ptep = pte_offset_kernel(&pmd, addr);
-        do {
-                pte_t pte = ACCESS_ONCE(*ptep);
-                struct page *page;
-                /*
-                 * Similar to the PMD case, NUMA hinting must take slow path
-                 */
-                if (pte_numa(pte))
-                        return 0;
-
-                if ((pte_val(pte) & mask) != result)
-                        return 0;
-                VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
-                page = pte_page(pte);
-                if (!page_cache_get_speculative(page))
-                        return 0;
-                if (unlikely(pte_val(pte) != pte_val(*ptep))) {
-                        put_page(page);
-                        return 0;
-                }
-                pages[*nr] = page;
-                (*nr)++;
-
-        } while (ptep++, addr += PAGE_SIZE, addr != end);
-
-        return 1;
-}
-
-static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
-                int write, struct page **pages, int *nr)
-{
-        unsigned long next;
-        pmd_t *pmdp;
-
-        pmdp = pmd_offset(&pud, addr);
-        do {
-                pmd_t pmd = ACCESS_ONCE(*pmdp);
-
-                next = pmd_addr_end(addr, end);
-                /*
-                 * If we find a splitting transparent hugepage we
-                 * return zero. That will result in taking the slow
-                 * path which will call wait_split_huge_page()
-                 * if the pmd is still in splitting state
-                 */
-                if (pmd_none(pmd) || pmd_trans_splitting(pmd))
-                        return 0;
-                if (pmd_huge(pmd) || pmd_large(pmd)) {
-                        /*
-                         * NUMA hinting faults need to be handled in the GUP
-                         * slowpath for accounting purposes and so that they
-                         * can be serialised against THP migration.
-                         */
-                        if (pmd_numa(pmd))
-                                return 0;
-
-                        if (!gup_hugepte((pte_t *)pmdp, PMD_SIZE, addr, next,
-                                         write, pages, nr))
-                                return 0;
-                } else if (is_hugepd(pmdp)) {
-                        if (!gup_hugepd((hugepd_t *)pmdp, PMD_SHIFT,
-                                        addr, next, write, pages, nr))
-                                return 0;
-                } else if (!gup_pte_range(pmd, addr, next, write, pages, nr))
-                        return 0;
-        } while (pmdp++, addr = next, addr != end);
-
-        return 1;
-}
-
-static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
-                int write, struct page **pages, int *nr)
-{
-        unsigned long next;
-        pud_t *pudp;
-
-        pudp = pud_offset(&pgd, addr);
-        do {
-                pud_t pud = ACCESS_ONCE(*pudp);
-
-                next = pud_addr_end(addr, end);
-                if (pud_none(pud))
-                        return 0;
-                if (pud_huge(pud)) {
-                        if (!gup_hugepte((pte_t *)pudp, PUD_SIZE, addr, next,
-                                         write, pages, nr))
-                                return 0;
-                } else if (is_hugepd(pudp)) {
-                        if (!gup_hugepd((hugepd_t *)pudp, PUD_SHIFT,
-                                        addr, next, write, pages, nr))
-                                return 0;
-                } else if (!gup_pmd_range(pud, addr, next, write, pages, nr))
-                        return 0;
-        } while (pudp++, addr = next, addr != end);
-
-        return 1;
-}
-
-int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
-                          struct page **pages)
-{
-        struct mm_struct *mm = current->mm;
-        unsigned long addr, len, end;
-        unsigned long next;
-        unsigned long flags;
-        pgd_t *pgdp;
-        int nr = 0;
-
-        pr_devel("%s(%lx,%x,%s)\n", __func__, start, nr_pages, write ? "write" : "read");
-
-        start &= PAGE_MASK;
-        addr = start;
-        len = (unsigned long) nr_pages << PAGE_SHIFT;
-        end = start + len;
-
-        if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-                                        start, len)))
-                return 0;
-
-        pr_devel("  aligned: %lx .. %lx\n", start, end);
-
-        /*
-         * XXX: batch / limit 'nr', to avoid large irq off latency
-         * needs some instrumenting to determine the common sizes used by
-         * important workloads (eg. DB2), and whether limiting the batch size
-         * will decrease performance.
-         *
-         * It seems like we're in the clear for the moment. Direct-IO is
-         * the main guy that batches up lots of get_user_pages, and even
-         * they are limited to 64-at-a-time which is not so many.
-         */
-        /*
-         * This doesn't prevent pagetable teardown, but does prevent
-         * the pagetables from being freed on powerpc.
-         *
-         * So long as we atomically load page table pointers versus teardown,
-         * we can follow the address down to the the page and take a ref on it.
-         */
-        local_irq_save(flags);
-
-        pgdp = pgd_offset(mm, addr);
-        do {
-                pgd_t pgd = ACCESS_ONCE(*pgdp);
-
-                pr_devel("  %016lx: normal pgd %p\n", addr,
-                         (void *)pgd_val(pgd));
-                next = pgd_addr_end(addr, end);
-                if (pgd_none(pgd))
-                        break;
-                if (pgd_huge(pgd)) {
-                        if (!gup_hugepte((pte_t *)pgdp, PGDIR_SIZE, addr, next,
-                                         write, pages, &nr))
-                                break;
-                } else if (is_hugepd(pgdp)) {
-                        if (!gup_hugepd((hugepd_t *)pgdp, PGDIR_SHIFT,
-                                        addr, next, write, pages, &nr))
-                                break;
-                } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
-                        break;
-        } while (pgdp++, addr = next, addr != end);
-
-        local_irq_restore(flags);
-
-        return nr;
-}
-
-int get_user_pages_fast(unsigned long start, int nr_pages, int write,
-                        struct page **pages)
-{
-        struct mm_struct *mm = current->mm;
-        int nr, ret;
-
-        start &= PAGE_MASK;
-        nr = __get_user_pages_fast(start, nr_pages, write, pages);
-        ret = nr;
-
-        if (nr < nr_pages) {
-                pr_devel("  slow path ! nr = %d\n", nr);
-
-                /* Try to get the remaining pages with get_user_pages */
-                start += nr << PAGE_SHIFT;
-                pages += nr;
-
-                down_read(&mm->mmap_sem);
-                ret = get_user_pages(current, mm, start,
-                                     nr_pages - nr, write, 0, pages, NULL);
-                up_read(&mm->mmap_sem);
-
-                /* Have to be a bit careful with return values */
-                if (nr > 0) {
-                        if (ret < 0)
-                                ret = nr;
-                        else
-                                ret += nr;
-                }
-        }
-
-        return ret;
-}
-
-#endif /* __HAVE_ARCH_PTE_SPECIAL */
diff --git a/arch/powerpc/mm/hash_low_64.S b/arch/powerpc/mm/hash_low_64.S
index 057cbbb4c576..463174a4a647 100644
--- a/arch/powerpc/mm/hash_low_64.S
+++ b/arch/powerpc/mm/hash_low_64.S
@@ -46,7 +46,8 @@
 
 /*
  * _hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
- *               pte_t *ptep, unsigned long trap, int local, int ssize)
+ *               pte_t *ptep, unsigned long trap, unsigned long flags,
+ *               int ssize)
  *
  * Adds a 4K page to the hash table in a segment of 4K pages only
  */
@@ -298,7 +299,7 @@ htab_modify_pte:
         li      r6,MMU_PAGE_4K          /* base page size */
         li      r7,MMU_PAGE_4K          /* actual page size */
         ld      r8,STK_PARAM(R9)(r1)    /* segment size */
-        ld      r9,STK_PARAM(R8)(r1)    /* get "local" param */
+        ld      r9,STK_PARAM(R8)(r1)    /* get "flags" param */
 .globl htab_call_hpte_updatepp
 htab_call_hpte_updatepp:
         bl      .                       /* Patched by htab_finish_init() */
@@ -338,8 +339,8 @@ htab_pte_insert_failure:
  *****************************************************************************/
 
 /* _hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
- *               pte_t *ptep, unsigned long trap, int local, int ssize,
- *               int subpg_prot)
+ *               pte_t *ptep, unsigned long trap, unsigned local flags,
+ *               int ssize, int subpg_prot)
  */
 
 /*
@@ -514,7 +515,7 @@ htab_insert_pte:
         andis.  r0,r31,_PAGE_4K_PFN@h
         srdi    r5,r31,PTE_RPN_SHIFT
         bne-    htab_special_pfn
-        sldi    r5,r5,PAGE_SHIFT-HW_PAGE_SHIFT
+        sldi    r5,r5,PAGE_FACTOR
         add     r5,r5,r25
 htab_special_pfn:
         sldi    r5,r5,HW_PAGE_SHIFT
@@ -544,7 +545,7 @@ htab_call_hpte_insert1:
         andis.  r0,r31,_PAGE_4K_PFN@h
         srdi    r5,r31,PTE_RPN_SHIFT
         bne-    3f
-        sldi    r5,r5,PAGE_SHIFT-HW_PAGE_SHIFT
+        sldi    r5,r5,PAGE_FACTOR
         add     r5,r5,r25
 3:      sldi    r5,r5,HW_PAGE_SHIFT
 
@@ -594,7 +595,7 @@ htab_inval_old_hpte:
         li      r5,0                    /* PTE.hidx */
         li      r6,MMU_PAGE_64K         /* psize */
         ld      r7,STK_PARAM(R9)(r1)    /* ssize */
-        ld      r8,STK_PARAM(R8)(r1)    /* local */
+        ld      r8,STK_PARAM(R8)(r1)    /* flags */
         bl      flush_hash_page
         /* Clear out _PAGE_HPTE_SUB bits in the new linux PTE */
         lis     r0,_PAGE_HPTE_SUB@h
@@ -666,7 +667,7 @@ htab_modify_pte:
         li      r6,MMU_PAGE_4K          /* base page size */
         li      r7,MMU_PAGE_4K          /* actual page size */
         ld      r8,STK_PARAM(R9)(r1)    /* segment size */
-        ld      r9,STK_PARAM(R8)(r1)    /* get "local" param */
+        ld      r9,STK_PARAM(R8)(r1)    /* get "flags" param */
 .globl htab_call_hpte_updatepp
 htab_call_hpte_updatepp:
         bl      .                       /* patched by htab_finish_init() */
@@ -962,7 +963,7 @@ ht64_modify_pte:
         li      r6,MMU_PAGE_64K         /* base page size */
         li      r7,MMU_PAGE_64K         /* actual page size */
         ld      r8,STK_PARAM(R9)(r1)    /* segment size */
-        ld      r9,STK_PARAM(R8)(r1)    /* get "local" param */
+        ld      r9,STK_PARAM(R8)(r1)    /* get "flags" param */
 .globl ht64_call_hpte_updatepp
 ht64_call_hpte_updatepp:
         bl      .                       /* patched by htab_finish_init() */
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index ae4962a06476..9c4880ddecd6 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -283,19 +283,17 @@ static long native_hpte_remove(unsigned long hpte_group)
 
 static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
                                  unsigned long vpn, int bpsize,
-                                 int apsize, int ssize, int local)
+                                 int apsize, int ssize, unsigned long flags)
 {
         struct hash_pte *hptep = htab_address + slot;
         unsigned long hpte_v, want_v;
-        int ret = 0;
+        int ret = 0, local = 0;
 
         want_v = hpte_encode_avpn(vpn, bpsize, ssize);
 
         DBG_LOW("    update(vpn=%016lx, avpnv=%016lx, group=%lx, newpp=%lx)",
                 vpn, want_v & HPTE_V_AVPN, slot, newpp);
 
-        native_lock_hpte(hptep);
-
         hpte_v = be64_to_cpu(hptep->v);
         /*
          * We need to invalidate the TLB always because hpte_remove doesn't do
@@ -308,15 +306,30 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
                 DBG_LOW(" -> miss\n");
                 ret = -1;
         } else {
-                DBG_LOW(" -> hit\n");
-                /* Update the HPTE */
-                hptep->r = cpu_to_be64((be64_to_cpu(hptep->r) & ~(HPTE_R_PP | HPTE_R_N)) |
-                        (newpp & (HPTE_R_PP | HPTE_R_N | HPTE_R_C)));
+                native_lock_hpte(hptep);
+                /* recheck with locks held */
+                hpte_v = be64_to_cpu(hptep->v);
+                if (unlikely(!HPTE_V_COMPARE(hpte_v, want_v) ||
+                             !(hpte_v & HPTE_V_VALID))) {
+                        ret = -1;
+                } else {
+                        DBG_LOW(" -> hit\n");
+                        /* Update the HPTE */
+                        hptep->r = cpu_to_be64((be64_to_cpu(hptep->r) &
+                                                ~(HPTE_R_PP | HPTE_R_N)) |
+                                               (newpp & (HPTE_R_PP | HPTE_R_N |
+                                                         HPTE_R_C)));
+                }
+                native_unlock_hpte(hptep);
         }
-        native_unlock_hpte(hptep);
 
-        /* Ensure it is out of the tlb too. */
-        tlbie(vpn, bpsize, apsize, ssize, local);
+        if (flags & HPTE_LOCAL_UPDATE)
+                local = 1;
+        /*
+         * Ensure it is out of the tlb too if it is not a nohpte fault
+         */
+        if (!(flags & HPTE_NOHPTE_UPDATE))
+                tlbie(vpn, bpsize, apsize, ssize, local);
 
         return ret;
 }
@@ -419,7 +432,7 @@ static void native_hpte_invalidate(unsigned long slot, unsigned long vpn,
 static void native_hugepage_invalidate(unsigned long vsid,
                                        unsigned long addr,
                                        unsigned char *hpte_slot_array,
-                                       int psize, int ssize)
+                                       int psize, int ssize, int local)
 {
         int i;
         struct hash_pte *hptep;
@@ -465,7 +478,7 @@ static void native_hugepage_invalidate(unsigned long vsid,
                  * instruction compares entry_VA in tlb with the VA specified
                  * here
                  */
-                tlbie(vpn, psize, actual_psize, ssize, 0);
+                tlbie(vpn, psize, actual_psize, ssize, local);
         }
         local_irq_restore(flags);
 }
@@ -629,7 +642,7 @@ static void native_flush_hash_range(unsigned long number, int local)
         unsigned long want_v;
         unsigned long flags;
         real_pte_t pte;
-        struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
+        struct ppc64_tlb_batch *batch = this_cpu_ptr(&ppc64_tlb_batch);
         unsigned long psize = batch->psize;
         int ssize = batch->ssize;
         int i;
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index d5339a3b9945..e56a307bc676 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -989,7 +989,9 @@ static void check_paca_psize(unsigned long ea, struct mm_struct *mm,
  * -1 - critical hash insertion error
  * -2 - access not permitted by subpage protection mechanism
  */
-int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, unsigned long trap)
+int hash_page_mm(struct mm_struct *mm, unsigned long ea,
+                 unsigned long access, unsigned long trap,
+                 unsigned long flags)
 {
         enum ctx_state prev_state = exception_enter();
         pgd_t *pgdir;
@@ -997,7 +999,7 @@ int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, u
         pte_t *ptep;
         unsigned hugeshift;
         const struct cpumask *tmp;
-        int rc, user_region = 0, local = 0;
+        int rc, user_region = 0;
         int psize, ssize;
 
         DBG_LOW("hash_page(ea=%016lx, access=%lx, trap=%lx\n",
@@ -1049,7 +1051,7 @@ int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, u
         /* Check CPU locality */
         tmp = cpumask_of(smp_processor_id());
         if (user_region && cpumask_equal(mm_cpumask(mm), tmp))
-                local = 1;
+                flags |= HPTE_LOCAL_UPDATE;
 
 #ifndef CONFIG_PPC_64K_PAGES
         /* If we use 4K pages and our psize is not 4K, then we might
@@ -1086,11 +1088,11 @@ int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, u
         if (hugeshift) {
                 if (pmd_trans_huge(*(pmd_t *)ptep))
                         rc = __hash_page_thp(ea, access, vsid, (pmd_t *)ptep,
-                                             trap, local, ssize, psize);
+                                             trap, flags, ssize, psize);
 #ifdef CONFIG_HUGETLB_PAGE
                 else
                         rc = __hash_page_huge(ea, access, vsid, ptep, trap,
-                                              local, ssize, hugeshift, psize);
+                                              flags, ssize, hugeshift, psize);
 #else
                 else {
                         /*
@@ -1149,7 +1151,8 @@ int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, u
 
 #ifdef CONFIG_PPC_HAS_HASH_64K
         if (psize == MMU_PAGE_64K)
-                rc = __hash_page_64K(ea, access, vsid, ptep, trap, local, ssize);
+                rc = __hash_page_64K(ea, access, vsid, ptep, trap,
+                                     flags, ssize);
         else
 #endif /* CONFIG_PPC_HAS_HASH_64K */
         {
@@ -1158,7 +1161,7 @@ int hash_page_mm(struct mm_struct *mm, unsigned long ea, unsigned long access, u
                         rc = -2;
                 else
                         rc = __hash_page_4K(ea, access, vsid, ptep, trap,
-                                            local, ssize, spp);
+                                            flags, ssize, spp);
         }
 
         /* Dump some info in case of hash insertion failure, they should
@@ -1181,14 +1184,19 @@ bail:
 }
 EXPORT_SYMBOL_GPL(hash_page_mm);
 
-int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
+int hash_page(unsigned long ea, unsigned long access, unsigned long trap,
+              unsigned long dsisr)
 {
+        unsigned long flags = 0;
         struct mm_struct *mm = current->mm;
 
         if (REGION_ID(ea) == VMALLOC_REGION_ID)
                 mm = &init_mm;
 
-        return hash_page_mm(mm, ea, access, trap);
+        if (dsisr & DSISR_NOHPTE)
+                flags |= HPTE_NOHPTE_UPDATE;
+
+        return hash_page_mm(mm, ea, access, trap, flags);
 }
 EXPORT_SYMBOL_GPL(hash_page);
 
@@ -1200,7 +1208,7 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
         pgd_t *pgdir;
         pte_t *ptep;
         unsigned long flags;
-        int rc, ssize, local = 0;
+        int rc, ssize, update_flags = 0;
 
         BUG_ON(REGION_ID(ea) != USER_REGION_ID);
 
@@ -1251,16 +1259,17 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
 
         /* Is that local to this CPU ? */
         if (cpumask_equal(mm_cpumask(mm), cpumask_of(smp_processor_id())))
-                local = 1;
+                update_flags |= HPTE_LOCAL_UPDATE;
 
         /* Hash it in */
 #ifdef CONFIG_PPC_HAS_HASH_64K
         if (mm->context.user_psize == MMU_PAGE_64K)
-                rc = __hash_page_64K(ea, access, vsid, ptep, trap, local, ssize);
+                rc = __hash_page_64K(ea, access, vsid, ptep, trap,
+                                     update_flags, ssize);
         else
 #endif /* CONFIG_PPC_HAS_HASH_64K */
-                rc = __hash_page_4K(ea, access, vsid, ptep, trap, local, ssize,
-                                    subpage_protection(mm, ea));
+                rc = __hash_page_4K(ea, access, vsid, ptep, trap, update_flags,
+                                    ssize, subpage_protection(mm, ea));
 
         /* Dump some info in case of hash insertion failure, they should
          * never happen so it is really useful to know if/when they do
@@ -1278,9 +1287,10 @@ out_exit:
  *          do not forget to update the assembly call site !
  */
 void flush_hash_page(unsigned long vpn, real_pte_t pte, int psize, int ssize,
-                     int local)
+                     unsigned long flags)
 {
         unsigned long hash, index, shift, hidx, slot;
+        int local = flags & HPTE_LOCAL_UPDATE;
 
         DBG_LOW("flush_hash_page(vpn=%016lx)\n", vpn);
         pte_iterate_hashed_subpages(pte, psize, vpn, index, shift) {
@@ -1315,6 +1325,78 @@ void flush_hash_page(unsigned long vpn, real_pte_t pte, int psize, int ssize,
 #endif
 }
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+void flush_hash_hugepage(unsigned long vsid, unsigned long addr,
+                         pmd_t *pmdp, unsigned int psize, int ssize,
+                         unsigned long flags)
+{
+        int i, max_hpte_count, valid;
+        unsigned long s_addr;
+        unsigned char *hpte_slot_array;
+        unsigned long hidx, shift, vpn, hash, slot;
+        int local = flags & HPTE_LOCAL_UPDATE;
+
+        s_addr = addr & HPAGE_PMD_MASK;
+        hpte_slot_array = get_hpte_slot_array(pmdp);
+        /*
+         * IF we try to do a HUGE PTE update after a withdraw is done.
+         * we will find the below NULL. This happens when we do
+         * split_huge_page_pmd
+         */
+        if (!hpte_slot_array)
+                return;
+
+        if (ppc_md.hugepage_invalidate) {
+                ppc_md.hugepage_invalidate(vsid, s_addr, hpte_slot_array,
+                                           psize, ssize, local);
+                goto tm_abort;
+        }
+        /*
+         * No bluk hpte removal support, invalidate each entry
+         */
+        shift = mmu_psize_defs[psize].shift;
+        max_hpte_count = HPAGE_PMD_SIZE >> shift;
+        for (i = 0; i < max_hpte_count; i++) {
+                /*
+                 * 8 bits per each hpte entries
+                 * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit]
+                 */
+                valid = hpte_valid(hpte_slot_array, i);
+                if (!valid)
+                        continue;
+                hidx =  hpte_hash_index(hpte_slot_array, i);
+
+                /* get the vpn */
+                addr = s_addr + (i * (1ul << shift));
+                vpn = hpt_vpn(addr, vsid, ssize);
+                hash = hpt_hash(vpn, shift, ssize);
+                if (hidx & _PTEIDX_SECONDARY)
+                        hash = ~hash;
+
+                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+                slot += hidx & _PTEIDX_GROUP_IX;
+                ppc_md.hpte_invalidate(slot, vpn, psize,
+                                       MMU_PAGE_16M, ssize, local);
+        }
+tm_abort:
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /* Transactions are not aborted by tlbiel, only tlbie.
+         * Without, syncing a page back to a block device w/ PIO could pick up
+         * transactional data (bad!) so we force an abort here.  Before the
+         * sync the page will be made read-only, which will flush_hash_page.
+         * BIG ISSUE here: if the kernel uses a page from userspace without
+         * unmapping it first, it may see the speculated version.
+         */
+        if (local && cpu_has_feature(CPU_FTR_TM) &&
+            current->thread.regs &&
+            MSR_TM_ACTIVE(current->thread.regs->msr)) {
+                tm_enable();
+                tm_abort(TM_CAUSE_TLBI);
+        }
+#endif
+}
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
 void flush_hash_range(unsigned long number, int local)
 {
         if (ppc_md.flush_hash_range)
@@ -1322,7 +1404,7 @@ void flush_hash_range(unsigned long number, int local)
         else {
                 int i;
                 struct ppc64_tlb_batch *batch =
-                        &__get_cpu_var(ppc64_tlb_batch);
+                        this_cpu_ptr(&ppc64_tlb_batch);
 
                 for (i = 0; i < number; i++)
                         flush_hash_page(batch->vpn[i], batch->pte[i],
diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
index 5f5e6328c21c..86686514ae13 100644
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -18,60 +18,9 @@
 #include <linux/mm.h>
 #include <asm/machdep.h>
 
-static void invalidate_old_hpte(unsigned long vsid, unsigned long addr,
-                                pmd_t *pmdp, unsigned int psize, int ssize)
-{
-        int i, max_hpte_count, valid;
-        unsigned long s_addr;
-        unsigned char *hpte_slot_array;
-        unsigned long hidx, shift, vpn, hash, slot;
-
-        s_addr = addr & HPAGE_PMD_MASK;
-        hpte_slot_array = get_hpte_slot_array(pmdp);
-        /*
-         * IF we try to do a HUGE PTE update after a withdraw is done.
-         * we will find the below NULL. This happens when we do
-         * split_huge_page_pmd
-         */
-        if (!hpte_slot_array)
-                return;
-
-        if (ppc_md.hugepage_invalidate)
-                return ppc_md.hugepage_invalidate(vsid, s_addr, hpte_slot_array,
-                                                  psize, ssize);
-        /*
-         * No bluk hpte removal support, invalidate each entry
-         */
-        shift = mmu_psize_defs[psize].shift;
-        max_hpte_count = HPAGE_PMD_SIZE >> shift;
-        for (i = 0; i < max_hpte_count; i++) {
-                /*
-                 * 8 bits per each hpte entries
-                 * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit]
-                 */
-                valid = hpte_valid(hpte_slot_array, i);
-                if (!valid)
-                        continue;
-                hidx =  hpte_hash_index(hpte_slot_array, i);
-
-                /* get the vpn */
-                addr = s_addr + (i * (1ul << shift));
-                vpn = hpt_vpn(addr, vsid, ssize);
-                hash = hpt_hash(vpn, shift, ssize);
-                if (hidx & _PTEIDX_SECONDARY)
-                        hash = ~hash;
-
-                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
-                slot += hidx & _PTEIDX_GROUP_IX;
-                ppc_md.hpte_invalidate(slot, vpn, psize,
-                                       MMU_PAGE_16M, ssize, 0);
-        }
-}
-
-
 int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
-                    pmd_t *pmdp, unsigned long trap, int local, int ssize,
-                    unsigned int psize)
+                    pmd_t *pmdp, unsigned long trap, unsigned long flags,
+                    int ssize, unsigned int psize)
 {
         unsigned int index, valid;
         unsigned char *hpte_slot_array;
@@ -145,7 +94,8 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
                  * hash page table entries.
                  */
                 if ((old_pmd & _PAGE_HASHPTE) && !(old_pmd & _PAGE_COMBO))
-                        invalidate_old_hpte(vsid, ea, pmdp, MMU_PAGE_64K, ssize);
+                        flush_hash_hugepage(vsid, ea, pmdp, MMU_PAGE_64K,
+                                            ssize, flags);
         }
 
         valid = hpte_valid(hpte_slot_array, index);
@@ -158,7 +108,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
                 slot += hidx & _PTEIDX_GROUP_IX;
 
                 ret = ppc_md.hpte_updatepp(slot, rflags, vpn,
-                                           psize, lpsize, ssize, local);
+                                           psize, lpsize, ssize, flags);
                 /*
                  * We failed to update, try to insert a new entry.
                  */
diff --git a/arch/powerpc/mm/hugetlbpage-book3e.c b/arch/powerpc/mm/hugetlbpage-book3e.c
index 5e4ee2573903..ba47aaf33a4b 100644
--- a/arch/powerpc/mm/hugetlbpage-book3e.c
+++ b/arch/powerpc/mm/hugetlbpage-book3e.c
@@ -33,13 +33,13 @@ static inline int tlb1_next(void)
 
         ncams = mfspr(SPRN_TLB1CFG) & TLBnCFG_N_ENTRY;
 
-        index = __get_cpu_var(next_tlbcam_idx);
+        index = this_cpu_read(next_tlbcam_idx);
 
         /* Just round-robin the entries and wrap when we hit the end */
         if (unlikely(index == ncams - 1))
-                __get_cpu_var(next_tlbcam_idx) = tlbcam_index;
+                __this_cpu_write(next_tlbcam_idx, tlbcam_index);
         else
-                __get_cpu_var(next_tlbcam_idx)++;
+                __this_cpu_inc(next_tlbcam_idx);
 
         return index;
 }
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index a5bcf9301196..d94b1af53a93 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -19,8 +19,8 @@ extern long hpte_insert_repeating(unsigned long hash, unsigned long vpn,
                                   unsigned long vflags, int psize, int ssize);
 
 int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
-                     pte_t *ptep, unsigned long trap, int local, int ssize,
-                     unsigned int shift, unsigned int mmu_psize)
+                     pte_t *ptep, unsigned long trap, unsigned long flags,
+                     int ssize, unsigned int shift, unsigned int mmu_psize)
 {
         unsigned long vpn;
         unsigned long old_pte, new_pte;
@@ -81,7 +81,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                 slot += (old_pte & _PAGE_F_GIX) >> 12;
 
                 if (ppc_md.hpte_updatepp(slot, rflags, vpn, mmu_psize,
-                                         mmu_psize, ssize, local) == -1)
+                                         mmu_psize, ssize, flags) == -1)
                         old_pte &= ~_PAGE_HPTEFLAGS;
         }
 
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 6a4a5fcb9730..5ff4e07d920a 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -62,6 +62,9 @@ static unsigned nr_gpages;
 /*
  * We have PGD_INDEX_SIZ = 12 and PTE_INDEX_SIZE = 8, so that we can have
  * 16GB hugepage pte in PGD and 16MB hugepage pte at PMD;
+ *
+ * Defined in such a way that we can optimize away code block at build time
+ * if CONFIG_HUGETLB_PAGE=n.
  */
 int pmd_huge(pmd_t pmd)
 {
@@ -230,7 +233,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
         if (hugepd_none(*hpdp) && __hugepte_alloc(mm, hpdp, addr, pdshift, pshift))
                 return NULL;
 
-        return hugepte_offset(hpdp, addr, pdshift);
+        return hugepte_offset(*hpdp, addr, pdshift);
 }
 
 #else
@@ -270,13 +273,13 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
         if (hugepd_none(*hpdp) && __hugepte_alloc(mm, hpdp, addr, pdshift, pshift))
                 return NULL;
 
-        return hugepte_offset(hpdp, addr, pdshift);
+        return hugepte_offset(*hpdp, addr, pdshift);
 }
 #endif
 
 #ifdef CONFIG_PPC_FSL_BOOK3E
 /* Build list of addresses of gigantic pages.  This function is used in early
- * boot before the buddy or bootmem allocator is setup.
+ * boot before the buddy allocator is setup.
  */
 void add_gpage(u64 addr, u64 page_size, unsigned long number_of_pages)
 {
@@ -312,7 +315,7 @@ int alloc_bootmem_huge_page(struct hstate *hstate)
          * If gpages can be in highmem we can't use the trick of storing the
          * data structure in the page; allocate space for this
          */
-        m = alloc_bootmem(sizeof(struct huge_bootmem_page));
+        m = memblock_virt_alloc(sizeof(struct huge_bootmem_page), 0);
         m->phys = gpage_freearray[idx].gpage_list[--nr_gpages];
 #else
         m = phys_to_virt(gpage_freearray[idx].gpage_list[--nr_gpages]);
@@ -352,6 +355,13 @@ static int __init do_gpage_early_setup(char *param, char *val,
                 if (size != 0) {
                         if (sscanf(val, "%lu", &npages) <= 0)
                                 npages = 0;
+                        if (npages > MAX_NUMBER_GPAGES) {
+                                pr_warn("MMU: %lu pages requested for page "
+                                        "size %llu KB, limiting to "
+                                        __stringify(MAX_NUMBER_GPAGES) "\n",
+                                        npages, size / 1024);
+                                npages = MAX_NUMBER_GPAGES;
+                        }
                         gpage_npages[shift_to_mmu_psize(__ffs(size))] = npages;
                         size = 0;
                 }
@@ -399,7 +409,7 @@ void __init reserve_hugetlb_gpages(void)
 #else /* !PPC_FSL_BOOK3E */
 
 /* Build list of addresses of gigantic pages.  This function is used in early
- * boot before the buddy or bootmem allocator is setup.
+ * boot before the buddy allocator is setup.
  */
 void add_gpage(u64 addr, u64 page_size, unsigned long number_of_pages)
 {
@@ -462,7 +472,7 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte)
 {
         struct hugepd_freelist **batchp;
 
-        batchp = &get_cpu_var(hugepd_freelist_cur);
+        batchp = this_cpu_ptr(&hugepd_freelist_cur);
 
         if (atomic_read(&tlb->mm->mm_users) < 2 ||
             cpumask_equal(mm_cpumask(tlb->mm),
@@ -536,7 +546,7 @@ static void hugetlb_free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
         do {
                 pmd = pmd_offset(pud, addr);
                 next = pmd_addr_end(addr, end);
-                if (!is_hugepd(pmd)) {
+                if (!is_hugepd(__hugepd(pmd_val(*pmd)))) {
                         /*
                          * if it is not hugepd pointer, we should already find
                          * it cleared.
@@ -585,7 +595,7 @@ static void hugetlb_free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
         do {
                 pud = pud_offset(pgd, addr);
                 next = pud_addr_end(addr, end);
-                if (!is_hugepd(pud)) {
+                if (!is_hugepd(__hugepd(pud_val(*pud)))) {
                         if (pud_none_or_clear_bad(pud))
                                 continue;
                         hugetlb_free_pmd_range(tlb, pud, addr, next, floor,
@@ -651,7 +661,7 @@ void hugetlb_free_pgd_range(struct mmu_gather *tlb,
         do {
                 next = pgd_addr_end(addr, end);
                 pgd = pgd_offset(tlb->mm, addr);
-                if (!is_hugepd(pgd)) {
+                if (!is_hugepd(__hugepd(pgd_val(*pgd)))) {
                         if (pgd_none_or_clear_bad(pgd))
                                 continue;
                         hugetlb_free_pud_range(tlb, pgd, addr, next, floor, ceiling);
@@ -711,12 +721,11 @@ static unsigned long hugepte_addr_end(unsigned long addr, unsigned long end,
         return (__boundary - 1 < end - 1) ? __boundary : end;
 }
 
-int gup_hugepd(hugepd_t *hugepd, unsigned pdshift,
-               unsigned long addr, unsigned long end,
-               int write, struct page **pages, int *nr)
+int gup_huge_pd(hugepd_t hugepd, unsigned long addr, unsigned pdshift,
+                unsigned long end, int write, struct page **pages, int *nr)
 {
         pte_t *ptep;
-        unsigned long sz = 1UL << hugepd_shift(*hugepd);
+        unsigned long sz = 1UL << hugepd_shift(hugepd);
         unsigned long next;
 
         ptep = hugepte_offset(hugepd, addr, pdshift);
@@ -959,7 +968,7 @@ pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea, unsigned *shift
         else if (pgd_huge(pgd)) {
                 ret_pte = (pte_t *) pgdp;
                 goto out;
-        } else if (is_hugepd(&pgd))
+        } else if (is_hugepd(__hugepd(pgd_val(pgd))))
                 hpdp = (hugepd_t *)&pgd;
         else {
                 /*
@@ -976,7 +985,7 @@ pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea, unsigned *shift
                 else if (pud_huge(pud)) {
                         ret_pte = (pte_t *) pudp;
                         goto out;
-                } else if (is_hugepd(&pud))
+                } else if (is_hugepd(__hugepd(pud_val(pud))))
                         hpdp = (hugepd_t *)&pud;
                 else {
                         pdshift = PMD_SHIFT;
@@ -997,7 +1006,7 @@ pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea, unsigned *shift
                         if (pmd_huge(pmd) || pmd_large(pmd)) {
                                 ret_pte = (pte_t *) pmdp;
                                 goto out;
-                        } else if (is_hugepd(&pmd))
+                        } else if (is_hugepd(__hugepd(pmd_val(pmd))))
                                 hpdp = (hugepd_t *)&pmd;
                         else
                                 return pte_offset_kernel(&pmd, ea);
@@ -1006,7 +1015,7 @@ pte_t *find_linux_pte_or_hugepte(pgd_t *pgdir, unsigned long ea, unsigned *shift
         if (!hpdp)
                 return NULL;
 
-        ret_pte = hugepte_offset(hpdp, ea, pdshift);
+        ret_pte = hugepte_offset(*hpdp, ea, pdshift);
         pdshift = hugepd_shift(*hpdp);
 out:
         if (shift)
@@ -1036,14 +1045,6 @@ int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
         if ((pte_val(pte) & mask) != mask)
                 return 0;
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-        /*
-         * check for splitting here
-         */
-        if (pmd_trans_splitting(pte_pmd(pte)))
-                return 0;
-#endif
-
         /* hugepages are never "special" */
         VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
 
diff --git a/arch/powerpc/mm/init_32.c b/arch/powerpc/mm/init_32.c
index 415a51b028b9..a10be665b645 100644
--- a/arch/powerpc/mm/init_32.c
+++ b/arch/powerpc/mm/init_32.c
@@ -26,7 +26,6 @@
 #include <linux/mm.h>
 #include <linux/stddef.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/highmem.h>
 #include <linux/initrd.h>
 #include <linux/pagemap.h>
@@ -195,15 +194,6 @@ void __init MMU_init(void)
         memblock_set_current_limit(lowmem_end_addr);
 }
 
-/* This is only called until mem_init is done. */
-void __init *early_get_page(void)
-{
-        if (init_bootmem_done)
-                return alloc_bootmem_pages(PAGE_SIZE);
-        else
-                return __va(memblock_alloc(PAGE_SIZE, PAGE_SIZE));
-}
-
 #ifdef CONFIG_8xx /* No 8xx specific .c file to put that in ... */
 void setup_initial_memory_limit(phys_addr_t first_memblock_base,
                                 phys_addr_t first_memblock_size)
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index 3481556a1880..10471f9bb63f 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -34,7 +34,6 @@
 #include <linux/vmalloc.h>
 #include <linux/init.h>
 #include <linux/delay.h>
-#include <linux/bootmem.h>
 #include <linux/highmem.h>
 #include <linux/idr.h>
 #include <linux/nodemask.h>
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 8ebaac75c940..b7285a5870f8 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -35,6 +35,7 @@
 #include <linux/memblock.h>
 #include <linux/hugetlb.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 
 #include <asm/pgalloc.h>
 #include <asm/prom.h>
@@ -60,7 +61,6 @@
 #define CPU_FTR_NOEXECUTE       0
 #endif
 
-int init_bootmem_done;
 int mem_init_done;
 unsigned long long memory_limit;
 
@@ -144,8 +144,17 @@ int arch_remove_memory(u64 start, u64 size)
 
         zone = page_zone(pfn_to_page(start_pfn));
         ret = __remove_pages(zone, start_pfn, nr_pages);
-        if (!ret && (ppc_md.remove_memory))
-                ret = ppc_md.remove_memory(start, size);
+        if (ret)
+                return ret;
+
+        /* Remove htab bolted mappings for this section of memory */
+        start = (unsigned long)__va(start);
+        ret = remove_section_mapping(start, start + size);
+
+        /* Ensure all vmalloc mappings are flushed in case they also
+         * hit that section of memory
+         */
+        vm_unmap_aliases();
 
         return ret;
 }
@@ -180,70 +189,23 @@ walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
 }
 EXPORT_SYMBOL_GPL(walk_system_ram_range);
 
-/*
- * Initialize the bootmem system and give it all the memory we
- * have available.  If we are using highmem, we only put the
- * lowmem into the bootmem system.
- */
 #ifndef CONFIG_NEED_MULTIPLE_NODES
-void __init do_init_bootmem(void)
+void __init initmem_init(void)
 {
-        unsigned long start, bootmap_pages;
-        unsigned long total_pages;
-        struct memblock_region *reg;
-        int boot_mapsize;
-
         max_low_pfn = max_pfn = memblock_end_of_DRAM() >> PAGE_SHIFT;
-        total_pages = (memblock_end_of_DRAM() - memstart_addr) >> PAGE_SHIFT;
+        min_low_pfn = MEMORY_START >> PAGE_SHIFT;
 #ifdef CONFIG_HIGHMEM
-        total_pages = total_lowmem >> PAGE_SHIFT;
         max_low_pfn = lowmem_end_addr >> PAGE_SHIFT;
 #endif
 
-        /*
-         * Find an area to use for the bootmem bitmap.  Calculate the size of
-         * bitmap required as (Total Memory) / PAGE_SIZE / BITS_PER_BYTE.
-         * Add 1 additional page in case the address isn't page-aligned.
-         */
-        bootmap_pages = bootmem_bootmap_pages(total_pages);
-
-        start = memblock_alloc(bootmap_pages << PAGE_SHIFT, PAGE_SIZE);
-
-        min_low_pfn = MEMORY_START >> PAGE_SHIFT;
-        boot_mapsize = init_bootmem_node(NODE_DATA(0), start >> PAGE_SHIFT, min_low_pfn, max_low_pfn);
-
         /* Place all memblock_regions in the same node and merge contiguous
          * memblock_regions
          */
         memblock_set_node(0, (phys_addr_t)ULLONG_MAX, &memblock.memory, 0);
 
-        /* Add all physical memory to the bootmem map, mark each area
-         * present.
-         */
-#ifdef CONFIG_HIGHMEM
-        free_bootmem_with_active_regions(0, lowmem_end_addr >> PAGE_SHIFT);
-
-        /* reserve the sections we're already using */
-        for_each_memblock(reserved, reg) {
-                unsigned long top = reg->base + reg->size - 1;
-                if (top < lowmem_end_addr)
-                        reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
-                else if (reg->base < lowmem_end_addr) {
-                        unsigned long trunc_size = lowmem_end_addr - reg->base;
-                        reserve_bootmem(reg->base, trunc_size, BOOTMEM_DEFAULT);
-                }
-        }
-#else
-        free_bootmem_with_active_regions(0, max_pfn);
-
-        /* reserve the sections we're already using */
-        for_each_memblock(reserved, reg)
-                reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
-#endif
         /* XXX need to clip this if using highmem? */
         sparse_memory_present_with_active_regions(0);
-
-        init_bootmem_done = 1;
+        sparse_init();
 }
 
 /* mark pages that don't exist as nosave */
@@ -359,14 +321,6 @@ void __init paging_init(void)
         mark_nonram_nosave();
 }
 
-static void __init register_page_bootmem_info(void)
-{
-        int i;
-
-        for_each_online_node(i)
-                register_page_bootmem_info_node(NODE_DATA(i));
-}
-
 void __init mem_init(void)
 {
         /*
@@ -379,7 +333,6 @@ void __init mem_init(void)
         swiotlb_init(0);
 #endif
 
-        register_page_bootmem_info();
         high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
         set_max_mapnr(max_pfn);
         free_all_bootmem();
diff --git a/arch/powerpc/mm/mmu_context_nohash.c b/arch/powerpc/mm/mmu_context_nohash.c
index 928ebe79668b..9cba6cba2e50 100644
--- a/arch/powerpc/mm/mmu_context_nohash.c
+++ b/arch/powerpc/mm/mmu_context_nohash.c
@@ -421,12 +421,12 @@ void __init mmu_context_init(void)
         /*
          * Allocate the maps used by context management
          */
-        context_map = alloc_bootmem(CTX_MAP_SIZE);
-        context_mm = alloc_bootmem(sizeof(void *) * (last_context + 1));
+        context_map = memblock_virt_alloc(CTX_MAP_SIZE, 0);
+        context_mm = memblock_virt_alloc(sizeof(void *) * (last_context + 1), 0);
 #ifndef CONFIG_SMP
-        stale_map[0] = alloc_bootmem(CTX_MAP_SIZE);
+        stale_map[0] = memblock_virt_alloc(CTX_MAP_SIZE, 0);
 #else
-        stale_map[boot_cpuid] = alloc_bootmem(CTX_MAP_SIZE);
+        stale_map[boot_cpuid] = memblock_virt_alloc(CTX_MAP_SIZE, 0);
 
         register_cpu_notifier(&mmu_context_cpu_nb);
 #endif
diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h
index 9615d82919b8..78c45f392f5b 100644
--- a/arch/powerpc/mm/mmu_decl.h
+++ b/arch/powerpc/mm/mmu_decl.h
@@ -67,7 +67,7 @@ static inline void _tlbil_va(unsigned long address, unsigned int pid,
 {
         __tlbil_va(address, pid);
 }
-#endif /* CONIFG_8xx */
+#endif /* CONFIG_8xx */
 
 #if defined(CONFIG_PPC_BOOK3E) || defined(CONFIG_PPC_47x)
 extern void _tlbivax_bcast(unsigned long address, unsigned int pid,
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 9fe6002c1d5a..0257a7d659ef 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -134,28 +134,6 @@ static int __init fake_numa_create_new_node(unsigned long end_pfn,
         return 0;
 }
 
-/*
- * get_node_active_region - Return active region containing pfn
- * Active range returned is empty if none found.
- * @pfn: The page to return the region for
- * @node_ar: Returned set to the active region containing @pfn
- */
-static void __init get_node_active_region(unsigned long pfn,
-                                          struct node_active_region *node_ar)
-{
-        unsigned long start_pfn, end_pfn;
-        int i, nid;
-
-        for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn, &nid) {
-                if (pfn >= start_pfn && pfn < end_pfn) {
-                        node_ar->nid = nid;
-                        node_ar->start_pfn = start_pfn;
-                        node_ar->end_pfn = end_pfn;
-                        break;
-                }
-        }
-}
-
 static void reset_numa_cpu_lookup_table(void)
 {
         unsigned int cpu;
@@ -928,134 +906,48 @@ static void __init dump_numa_memory_topology(void)
         }
 }
 
-/*
- * Allocate some memory, satisfying the memblock or bootmem allocator where
- * required. nid is the preferred node and end is the physical address of
- * the highest address in the node.
- *
- * Returns the virtual address of the memory.
- */
-static void __init *careful_zallocation(int nid, unsigned long size,
-                                       unsigned long align,
-                                       unsigned long end_pfn)
-{
-        void *ret;
-        int new_nid;
-        unsigned long ret_paddr;
-
-        ret_paddr = __memblock_alloc_base(size, align, end_pfn << PAGE_SHIFT);
-
-        /* retry over all memory */
-        if (!ret_paddr)
-                ret_paddr = __memblock_alloc_base(size, align, memblock_end_of_DRAM());
-
-        if (!ret_paddr)
-                panic("numa.c: cannot allocate %lu bytes for node %d",
-                      size, nid);
-
-        ret = __va(ret_paddr);
-
-        /*
-         * We initialize the nodes in numeric order: 0, 1, 2...
-         * and hand over control from the MEMBLOCK allocator to the
-         * bootmem allocator.  If this function is called for
-         * node 5, then we know that all nodes <5 are using the
-         * bootmem allocator instead of the MEMBLOCK allocator.
-         *
-         * So, check the nid from which this allocation came
-         * and double check to see if we need to use bootmem
-         * instead of the MEMBLOCK.  We don't free the MEMBLOCK memory
-         * since it would be useless.
-         */
-        new_nid = early_pfn_to_nid(ret_paddr >> PAGE_SHIFT);
-        if (new_nid < nid) {
-                ret = __alloc_bootmem_node(NODE_DATA(new_nid),
-                                size, align, 0);
-
-                dbg("alloc_bootmem %p %lx\n", ret, size);
-        }
-
-        memset(ret, 0, size);
-        return ret;
-}
-
 static struct notifier_block ppc64_numa_nb = {
         .notifier_call = cpu_numa_callback,
         .priority = 1 /* Must run before sched domains notifier. */
 };
 
-static void __init mark_reserved_regions_for_nid(int nid)
+/* Initialize NODE_DATA for a node on the local memory */
+static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
 {
-        struct pglist_data *node = NODE_DATA(nid);
-        struct memblock_region *reg;
-
-        for_each_memblock(reserved, reg) {
-                unsigned long physbase = reg->base;
-                unsigned long size = reg->size;
-                unsigned long start_pfn = physbase >> PAGE_SHIFT;
-                unsigned long end_pfn = PFN_UP(physbase + size);
-                struct node_active_region node_ar;
-                unsigned long node_end_pfn = pgdat_end_pfn(node);
-
-                /*
-                 * Check to make sure that this memblock.reserved area is
-                 * within the bounds of the node that we care about.
-                 * Checking the nid of the start and end points is not
-                 * sufficient because the reserved area could span the
-                 * entire node.
-                 */
-                if (end_pfn <= node->node_start_pfn ||
-                    start_pfn >= node_end_pfn)
-                        continue;
-
-                get_node_active_region(start_pfn, &node_ar);
-                while (start_pfn < end_pfn &&
-                        node_ar.start_pfn < node_ar.end_pfn) {
-                        unsigned long reserve_size = size;
-                        /*
-                         * if reserved region extends past active region
-                         * then trim size to active region
-                         */
-                        if (end_pfn > node_ar.end_pfn)
-                                reserve_size = (node_ar.end_pfn << PAGE_SHIFT)
-                                        - physbase;
-                        /*
-                         * Only worry about *this* node, others may not
-                         * yet have valid NODE_DATA().
-                         */
-                        if (node_ar.nid == nid) {
-                                dbg("reserve_bootmem %lx %lx nid=%d\n",
-                                        physbase, reserve_size, node_ar.nid);
-                                reserve_bootmem_node(NODE_DATA(node_ar.nid),
-                                                physbase, reserve_size,
-                                                BOOTMEM_DEFAULT);
-                        }
-                        /*
-                         * if reserved region is contained in the active region
-                         * then done.
-                         */
-                        if (end_pfn <= node_ar.end_pfn)
-                                break;
-
-                        /*
-                         * reserved region extends past the active region
-                         *   get next active region that contains this
-                         *   reserved region
-                         */
-                        start_pfn = node_ar.end_pfn;
-                        physbase = start_pfn << PAGE_SHIFT;
-                        size = size - reserve_size;
-                        get_node_active_region(start_pfn, &node_ar);
-                }
-        }
+        u64 spanned_pages = end_pfn - start_pfn;
+        const size_t nd_size = roundup(sizeof(pg_data_t), SMP_CACHE_BYTES);
+        u64 nd_pa;
+        void *nd;
+        int tnid;
+
+        if (spanned_pages)
+                pr_info("Initmem setup node %d [mem %#010Lx-%#010Lx]\n",
+                        nid, start_pfn << PAGE_SHIFT,
+                        (end_pfn << PAGE_SHIFT) - 1);
+        else
+                pr_info("Initmem setup node %d\n", nid);
+
+        nd_pa = memblock_alloc_try_nid(nd_size, SMP_CACHE_BYTES, nid);
+        nd = __va(nd_pa);
+
+        /* report and initialize */
+        pr_info("  NODE_DATA [mem %#010Lx-%#010Lx]\n",
+                nd_pa, nd_pa + nd_size - 1);
+        tnid = early_pfn_to_nid(nd_pa >> PAGE_SHIFT);
+        if (tnid != nid)
+                pr_info("    NODE_DATA(%d) on node %d\n", nid, tnid);
+
+        node_data[nid] = nd;
+        memset(NODE_DATA(nid), 0, sizeof(pg_data_t));
+        NODE_DATA(nid)->node_id = nid;
+        NODE_DATA(nid)->node_start_pfn = start_pfn;
+        NODE_DATA(nid)->node_spanned_pages = spanned_pages;
 }
 
-
-void __init do_init_bootmem(void)
+void __init initmem_init(void)
 {
         int nid, cpu;
 
-        min_low_pfn = 0;
         max_low_pfn = memblock_end_of_DRAM() >> PAGE_SHIFT;
         max_pfn = max_low_pfn;
 
@@ -1064,64 +956,18 @@ void __init do_init_bootmem(void)
         else
                 dump_numa_memory_topology();
 
+        memblock_dump_all();
+
         for_each_online_node(nid) {
                 unsigned long start_pfn, end_pfn;
-                void *bootmem_vaddr;
-                unsigned long bootmap_pages;
 
                 get_pfn_range_for_nid(nid, &start_pfn, &end_pfn);
-
-                /*
-                 * Allocate the node structure node local if possible
-                 *
-                 * Be careful moving this around, as it relies on all
-                 * previous nodes' bootmem to be initialized and have
-                 * all reserved areas marked.
-                 */
-                NODE_DATA(nid) = careful_zallocation(nid,
-                                        sizeof(struct pglist_data),
-                                        SMP_CACHE_BYTES, end_pfn);
-
-                dbg("node %d\n", nid);
-                dbg("NODE_DATA() = %p\n", NODE_DATA(nid));
-
-                NODE_DATA(nid)->bdata = &bootmem_node_data[nid];
-                NODE_DATA(nid)->node_start_pfn = start_pfn;
-                NODE_DATA(nid)->node_spanned_pages = end_pfn - start_pfn;
-
-                if (NODE_DATA(nid)->node_spanned_pages == 0)
-                        continue;
-
-                dbg("start_paddr = %lx\n", start_pfn << PAGE_SHIFT);
-                dbg("end_paddr = %lx\n", end_pfn << PAGE_SHIFT);
-
-                bootmap_pages = bootmem_bootmap_pages(end_pfn - start_pfn);
-                bootmem_vaddr = careful_zallocation(nid,
-                                        bootmap_pages << PAGE_SHIFT,
-                                        PAGE_SIZE, end_pfn);
-
-                dbg("bootmap_vaddr = %p\n", bootmem_vaddr);
-
-                init_bootmem_node(NODE_DATA(nid),
-                                  __pa(bootmem_vaddr) >> PAGE_SHIFT,
-                                  start_pfn, end_pfn);
-
-                free_bootmem_with_active_regions(nid, end_pfn);
-                /*
-                 * Be very careful about moving this around.  Future
-                 * calls to careful_zallocation() depend on this getting
-                 * done correctly.
-                 */
-                mark_reserved_regions_for_nid(nid);
+                setup_node_data(nid, start_pfn, end_pfn);
                 sparse_memory_present_with_active_regions(nid);
         }
 
-        init_bootmem_done = 1;
+        sparse_init();
 
-        /*
-         * Now bootmem is initialised we can create the node to cpumask
-         * lookup tables and setup the cpu callback to populate them.
-         */
         setup_node_to_cpumask_map();
 
         reset_numa_cpu_lookup_table();
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index cf11342bf519..d545b1231594 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -100,12 +100,11 @@ __init_refok pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long add
 {
         pte_t *pte;
         extern int mem_init_done;
-        extern void *early_get_page(void);
 
         if (mem_init_done) {
                 pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
         } else {
-                pte = (pte_t *)early_get_page();
+                pte = __va(memblock_alloc(PAGE_SIZE, PAGE_SIZE));
                 if (pte)
                         clear_page(pte);
         }
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index c8d709ab489d..4fe5f64cc179 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -33,9 +33,9 @@
 #include <linux/swap.h>
 #include <linux/stddef.h>
 #include <linux/vmalloc.h>
-#include <linux/bootmem.h>
 #include <linux/memblock.h>
 #include <linux/slab.h>
+#include <linux/hugetlb.h>
 
 #include <asm/pgalloc.h>
 #include <asm/page.h>
@@ -51,6 +51,7 @@
 #include <asm/cputable.h>
 #include <asm/sections.h>
 #include <asm/firmware.h>
+#include <asm/dma.h>
 
 #include "mmu_decl.h"
 
@@ -75,11 +76,7 @@ static __ref void *early_alloc_pgtable(unsigned long size)
 {
         void *pt;
 
-        if (init_bootmem_done)
-                pt = __alloc_bootmem(size, size, __pa(MAX_DMA_ADDRESS));
-        else
-                pt = __va(memblock_alloc_base(size, size,
-                                         __pa(MAX_DMA_ADDRESS)));
+        pt = __va(memblock_alloc_base(size, size, __pa(MAX_DMA_ADDRESS)));
         memset(pt, 0, size);
 
         return pt;
@@ -113,10 +110,6 @@ int map_kernel_page(unsigned long ea, unsigned long pa, int flags)
                                                           __pgprot(flags)));
         } else {
 #ifdef CONFIG_PPC_MMU_NOHASH
-                /* Warning ! This will blow up if bootmem is not initialized
-                 * which our ppc64 code is keen to do that, we'll need to
-                 * fix it and/or be more careful
-                 */
                 pgdp = pgd_offset_k(ea);
 #ifdef PUD_TABLE_SIZE
                 if (pgd_none(*pgdp)) {
@@ -352,16 +345,31 @@ EXPORT_SYMBOL(iounmap);
 EXPORT_SYMBOL(__iounmap);
 EXPORT_SYMBOL(__iounmap_at);
 
+#ifndef __PAGETABLE_PUD_FOLDED
+/* 4 level page table */
+struct page *pgd_page(pgd_t pgd)
+{
+        if (pgd_huge(pgd))
+                return pte_page(pgd_pte(pgd));
+        return virt_to_page(pgd_page_vaddr(pgd));
+}
+#endif
+
+struct page *pud_page(pud_t pud)
+{
+        if (pud_huge(pud))
+                return pte_page(pud_pte(pud));
+        return virt_to_page(pud_page_vaddr(pud));
+}
+
 /*
  * For hugepage we have pfn in the pmd, we use PTE_RPN_SHIFT bits for flags
  * For PTE page, we have a PTE_FRAG_SIZE (4K) aligned virtual address.
  */
 struct page *pmd_page(pmd_t pmd)
 {
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-        if (pmd_trans_huge(pmd))
+        if (pmd_trans_huge(pmd) || pmd_huge(pmd))
                 return pfn_to_page(pmd_pfn(pmd));
-#endif
         return virt_to_page(pmd_page_vaddr(pmd));
 }
 
@@ -731,29 +739,15 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
 void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
                             pmd_t *pmdp, unsigned long old_pmd)
 {
-        int ssize, i;
-        unsigned long s_addr;
-        int max_hpte_count;
-        unsigned int psize, valid;
-        unsigned char *hpte_slot_array;
-        unsigned long hidx, vpn, vsid, hash, shift, slot;
-
-        /*
-         * Flush all the hptes mapping this hugepage
-         */
-        s_addr = addr & HPAGE_PMD_MASK;
-        hpte_slot_array = get_hpte_slot_array(pmdp);
-        /*
-         * IF we try to do a HUGE PTE update after a withdraw is done.
-         * we will find the below NULL. This happens when we do
-         * split_huge_page_pmd
-         */
-        if (!hpte_slot_array)
-                return;
+        int ssize;
+        unsigned int psize;
+        unsigned long vsid;
+        unsigned long flags = 0;
+        const struct cpumask *tmp;
 
         /* get the base page size,vsid and segment size */
 #ifdef CONFIG_DEBUG_VM
-        psize = get_slice_psize(mm, s_addr);
+        psize = get_slice_psize(mm, addr);
         BUG_ON(psize == MMU_PAGE_16M);
 #endif
         if (old_pmd & _PAGE_COMBO)
@@ -761,46 +755,20 @@ void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
         else
                 psize = MMU_PAGE_64K;
 
-        if (!is_kernel_addr(s_addr)) {
-                ssize = user_segment_size(s_addr);
-                vsid = get_vsid(mm->context.id, s_addr, ssize);
+        if (!is_kernel_addr(addr)) {
+                ssize = user_segment_size(addr);
+                vsid = get_vsid(mm->context.id, addr, ssize);
                 WARN_ON(vsid == 0);
         } else {
-                vsid = get_kernel_vsid(s_addr, mmu_kernel_ssize);
+                vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
                 ssize = mmu_kernel_ssize;
         }
 
-        if (ppc_md.hugepage_invalidate)
-                return ppc_md.hugepage_invalidate(vsid, s_addr,
-                                                  hpte_slot_array,
-                                                  psize, ssize);
-        /*
-         * No bluk hpte removal support, invalidate each entry
-         */
-        shift = mmu_psize_defs[psize].shift;
-        max_hpte_count = HPAGE_PMD_SIZE >> shift;
-        for (i = 0; i < max_hpte_count; i++) {
-                /*
-                 * 8 bits per each hpte entries
-                 * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit]
-                 */
-                valid = hpte_valid(hpte_slot_array, i);
-                if (!valid)
-                        continue;
-                hidx =  hpte_hash_index(hpte_slot_array, i);
-
-                /* get the vpn */
-                addr = s_addr + (i * (1ul << shift));
-                vpn = hpt_vpn(addr, vsid, ssize);
-                hash = hpt_hash(vpn, shift, ssize);
-                if (hidx & _PTEIDX_SECONDARY)
-                        hash = ~hash;
-
-                slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
-                slot += hidx & _PTEIDX_GROUP_IX;
-                ppc_md.hpte_invalidate(slot, vpn, psize,
-                                       MMU_PAGE_16M, ssize, 0);
-        }
+        tmp = cpumask_of(smp_processor_id());
+        if (cpumask_equal(mm_cpumask(mm), tmp))
+                flags |= HPTE_LOCAL_UPDATE;
+
+        return flush_hash_hugepage(vsid, addr, pmdp, psize, ssize, flags);
 }
 
 static pmd_t pmd_set_protbits(pmd_t pmd, pgprot_t pgprot)
diff --git a/arch/powerpc/oprofile/backtrace.c b/arch/powerpc/oprofile/backtrace.c
index 6adf55fa5d88..ecc66d5f02c9 100644
--- a/arch/powerpc/oprofile/backtrace.c
+++ b/arch/powerpc/oprofile/backtrace.c
@@ -10,7 +10,7 @@
 #include <linux/oprofile.h>
 #include <linux/sched.h>
 #include <asm/processor.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/compat.h>
 #include <asm/oprofile_impl.h>
 
@@ -105,6 +105,7 @@ void op_powerpc_backtrace(struct pt_regs * const regs, unsigned int depth)
                         first_frame = 0;
                 }
         } else {
+                pagefault_disable();
 #ifdef CONFIG_PPC64
                 if (!is_32bit_task()) {
                         while (depth--) {
@@ -113,7 +114,7 @@ void op_powerpc_backtrace(struct pt_regs * const regs, unsigned int depth)
                                         break;
                                 first_frame = 0;
                         }
-
+                        pagefault_enable();
                         return;
                 }
 #endif
@@ -124,5 +125,6 @@ void op_powerpc_backtrace(struct pt_regs * const regs, unsigned int depth)
                                 break;
                         first_frame = 0;
                 }
+                pagefault_enable();
         }
 }
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index a6995d4e93d4..7c4f6690533a 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -339,7 +339,7 @@ static void power_pmu_bhrb_reset(void)
 
 static void power_pmu_bhrb_enable(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
 
         if (!ppmu->bhrb_nr)
                 return;
@@ -354,7 +354,7 @@ static void power_pmu_bhrb_enable(struct perf_event *event)
 
 static void power_pmu_bhrb_disable(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
 
         if (!ppmu->bhrb_nr)
                 return;
@@ -1144,7 +1144,7 @@ static void power_pmu_disable(struct pmu *pmu)
         if (!ppmu)
                 return;
         local_irq_save(flags);
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
 
         if (!cpuhw->disabled) {
                 /*
@@ -1211,7 +1211,7 @@ static void power_pmu_enable(struct pmu *pmu)
                 return;
         local_irq_save(flags);
 
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
         if (!cpuhw->disabled)
                 goto out;
 
@@ -1403,7 +1403,7 @@ static int power_pmu_add(struct perf_event *event, int ef_flags)
          * Add the event to the list (if there is room)
          * and check whether the total set is still feasible.
          */
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
         n0 = cpuhw->n_events;
         if (n0 >= ppmu->n_counter)
                 goto out;
@@ -1469,7 +1469,7 @@ static void power_pmu_del(struct perf_event *event, int ef_flags)
 
         power_pmu_read(event);
 
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
         for (i = 0; i < cpuhw->n_events; ++i) {
                 if (event == cpuhw->event[i]) {
                         while (++i < cpuhw->n_events) {
@@ -1575,7 +1575,7 @@ static void power_pmu_stop(struct perf_event *event, int ef_flags)
  */
 static void power_pmu_start_txn(struct pmu *pmu)
 {
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
 
         perf_pmu_disable(pmu);
         cpuhw->group_flag |= PERF_EVENT_TXN;
@@ -1589,7 +1589,7 @@ static void power_pmu_start_txn(struct pmu *pmu)
  */
 static void power_pmu_cancel_txn(struct pmu *pmu)
 {
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
 
         cpuhw->group_flag &= ~PERF_EVENT_TXN;
         perf_pmu_enable(pmu);
@@ -1607,7 +1607,7 @@ static int power_pmu_commit_txn(struct pmu *pmu)
 
         if (!ppmu)
                 return -EAGAIN;
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
         n = cpuhw->n_events;
         if (check_excludes(cpuhw->event, cpuhw->flags, 0, n))
                 return -EAGAIN;
@@ -1964,7 +1964,7 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 
                 if (event->attr.sample_type & PERF_SAMPLE_BRANCH_STACK) {
                         struct cpu_hw_events *cpuhw;
-                        cpuhw = &__get_cpu_var(cpu_hw_events);
+                        cpuhw = this_cpu_ptr(&cpu_hw_events);
                         power_pmu_bhrb_read(cpuhw);
                         data.br_stack = &cpuhw->bhrb_stack;
                 }
@@ -2037,7 +2037,7 @@ static bool pmc_overflow(unsigned long val)
 static void perf_event_interrupt(struct pt_regs *regs)
 {
         int i, j;
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
         struct perf_event *event;
         unsigned long val[8];
         int found, active;
diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-emb.c
index d35ae52c69dc..4acaea01fe03 100644
--- a/arch/powerpc/perf/core-fsl-emb.c
+++ b/arch/powerpc/perf/core-fsl-emb.c
@@ -210,7 +210,7 @@ static void fsl_emb_pmu_disable(struct pmu *pmu)
         unsigned long flags;
 
         local_irq_save(flags);
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
 
         if (!cpuhw->disabled) {
                 cpuhw->disabled = 1;
@@ -249,7 +249,7 @@ static void fsl_emb_pmu_enable(struct pmu *pmu)
         unsigned long flags;
 
         local_irq_save(flags);
-        cpuhw = &__get_cpu_var(cpu_hw_events);
+        cpuhw = this_cpu_ptr(&cpu_hw_events);
         if (!cpuhw->disabled)
                 goto out;
 
@@ -653,7 +653,7 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 static void perf_event_interrupt(struct pt_regs *regs)
 {
         int i;
-        struct cpu_hw_events *cpuhw = &__get_cpu_var(cpu_hw_events);
+        struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
         struct perf_event *event;
         unsigned long val;
         int found = 0;
diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig
index 82f2da28cd27..d2ac1c116454 100644
--- a/arch/powerpc/platforms/44x/Kconfig
+++ b/arch/powerpc/platforms/44x/Kconfig
@@ -220,7 +220,6 @@ config AKEBONO
         select USB_EHCI_HCD_PLATFORM if USB_EHCI_HCD
         select MMC_SDHCI
         select MMC_SDHCI_PLTFM
-        select MMC_SDHCI_OF_476GTR
         select ATA
         select SATA_AHCI_PLATFORM
         help
diff --git a/arch/powerpc/platforms/44x/ppc476.c b/arch/powerpc/platforms/44x/ppc476.c
index 58db9d083969..c11ce6516c8f 100644
--- a/arch/powerpc/platforms/44x/ppc476.c
+++ b/arch/powerpc/platforms/44x/ppc476.c
@@ -94,7 +94,7 @@ static int avr_probe(struct i2c_client *client,
 {
         avr_i2c_client = client;
         ppc_md.restart = avr_reset_system;
-        ppc_md.power_off = avr_power_off_system;
+        pm_power_off = avr_power_off_system;
         return 0;
 }
 
diff --git a/arch/powerpc/platforms/512x/mpc512x_shared.c b/arch/powerpc/platforms/512x/mpc512x_shared.c
index e996e007bc44..711f3d352af7 100644
--- a/arch/powerpc/platforms/512x/mpc512x_shared.c
+++ b/arch/powerpc/platforms/512x/mpc512x_shared.c
@@ -18,7 +18,7 @@
 #include <linux/irq.h>
 #include <linux/of_platform.h>
 #include <linux/fsl-diu-fb.h>
-#include <linux/bootmem.h>
+#include <linux/memblock.h>
 #include <sysdev/fsl_soc.h>
 
 #include <asm/cacheflush.h>
@@ -297,14 +297,13 @@ static void __init mpc512x_setup_diu(void)
          * and so negatively affect boot time. Instead we reserve the
          * already configured frame buffer area so that it won't be
          * destroyed. The starting address of the area to reserve and
-         * also it's length is passed to reserve_bootmem(). It will be
+         * also it's length is passed to memblock_reserve(). It will be
          * freed later on first open of fbdev, when splash image is not
          * needed any more.
          */
         if (diu_shared_fb.in_use) {
-                ret = reserve_bootmem(diu_shared_fb.fb_phys,
-                                      diu_shared_fb.fb_len,
-                                      BOOTMEM_EXCLUSIVE);
+                ret = memblock_reserve(diu_shared_fb.fb_phys,
+                                       diu_shared_fb.fb_len);
                 if (ret) {
                         pr_err("%s: reserve bootmem failed\n", __func__);
                         diu_shared_fb.in_use = false;
diff --git a/arch/powerpc/platforms/52xx/efika.c b/arch/powerpc/platforms/52xx/efika.c
index 3feffde9128d..6af651e69129 100644
--- a/arch/powerpc/platforms/52xx/efika.c
+++ b/arch/powerpc/platforms/52xx/efika.c
@@ -212,6 +212,8 @@ static int __init efika_probe(void)
         DMA_MODE_READ = 0x44;
         DMA_MODE_WRITE = 0x48;
 
+        pm_power_off = rtas_power_off;
+
         return 1;
 }
 
@@ -225,7 +227,6 @@ define_machine(efika)
         .init_IRQ               = mpc52xx_init_irq,
         .get_irq                = mpc52xx_get_irq,
         .restart                = rtas_restart,
-        .power_off              = rtas_power_off,
         .halt                   = rtas_halt,
         .set_rtc_time           = rtas_set_rtc_time,
         .get_rtc_time           = rtas_get_rtc_time,
diff --git a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
index 463fa91ee5b6..15e8021ddef9 100644
--- a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
+++ b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
@@ -167,10 +167,10 @@ static int mcu_probe(struct i2c_client *client, const struct i2c_device_id *id)
         if (ret)
                 goto err;
 
-        /* XXX: this is potentially racy, but there is no lock for ppc_md */
-        if (!ppc_md.power_off) {
+        /* XXX: this is potentially racy, but there is no lock for pm_power_off */
+        if (!pm_power_off) {
                 glob_mcu = mcu;
-                ppc_md.power_off = mcu_power_off;
+                pm_power_off = mcu_power_off;
                 dev_info(&client->dev, "will provide power-off service\n");
         }
 
@@ -197,7 +197,7 @@ static int mcu_remove(struct i2c_client *client)
         device_remove_file(&client->dev, &dev_attr_status);
 
         if (glob_mcu == mcu) {
-                ppc_md.power_off = NULL;
+                pm_power_off = NULL;
                 glob_mcu = NULL;
         }
 
diff --git a/arch/powerpc/platforms/85xx/corenet_generic.c b/arch/powerpc/platforms/85xx/corenet_generic.c
index e56b89a792ed..1f309ccb096e 100644
--- a/arch/powerpc/platforms/85xx/corenet_generic.c
+++ b/arch/powerpc/platforms/85xx/corenet_generic.c
@@ -170,7 +170,7 @@ static int __init corenet_generic_probe(void)
 
                         ppc_md.get_irq = ehv_pic_get_irq;
                         ppc_md.restart = fsl_hv_restart;
-                        ppc_md.power_off = fsl_hv_halt;
+                        pm_power_off = fsl_hv_halt;
                         ppc_md.halt = fsl_hv_halt;
 #ifdef CONFIG_SMP
                         /*
diff --git a/arch/powerpc/platforms/85xx/sgy_cts1000.c b/arch/powerpc/platforms/85xx/sgy_cts1000.c
index 8162b0412117..e149c9ec26ae 100644
--- a/arch/powerpc/platforms/85xx/sgy_cts1000.c
+++ b/arch/powerpc/platforms/85xx/sgy_cts1000.c
@@ -120,7 +120,7 @@ static int gpio_halt_probe(struct platform_device *pdev)
 
         /* Register our halt function */
         ppc_md.halt = gpio_halt_cb;
-        ppc_md.power_off = gpio_halt_cb;
+        pm_power_off = gpio_halt_cb;
 
         printk(KERN_INFO "gpio-halt: registered GPIO %d (%d trigger, %d"
                " irq).\n", gpio, trigger, irq);
@@ -137,7 +137,7 @@ static int gpio_halt_remove(struct platform_device *pdev)
                 free_irq(irq, halt_node);
 
                 ppc_md.halt = NULL;
-                ppc_md.power_off = NULL;
+                pm_power_off = NULL;
 
                 gpio_free(gpio);
 
diff --git a/arch/powerpc/platforms/8xx/Kconfig b/arch/powerpc/platforms/8xx/Kconfig
index bd6f1a1cf922..157250426b56 100644
--- a/arch/powerpc/platforms/8xx/Kconfig
+++ b/arch/powerpc/platforms/8xx/Kconfig
@@ -1,6 +1,3 @@
-config FADS
-        bool
-
 config CPM1
         bool
         select CPM
@@ -13,7 +10,6 @@ choice
 
 config MPC8XXFADS
         bool "FADS"
-        select FADS
 
 config MPC86XADS
         bool "MPC86XADS"
diff --git a/arch/powerpc/platforms/cell/beat_htab.c b/arch/powerpc/platforms/cell/beat_htab.c
index d4d245c0d787..bee9232fe619 100644
--- a/arch/powerpc/platforms/cell/beat_htab.c
+++ b/arch/powerpc/platforms/cell/beat_htab.c
@@ -186,7 +186,7 @@ static long beat_lpar_hpte_updatepp(unsigned long slot,
                                     unsigned long newpp,
                                     unsigned long vpn,
                                     int psize, int apsize,
-                                    int ssize, int local)
+                                    int ssize, unsigned long flags)
 {
         unsigned long lpar_rc;
         u64 dummy0, dummy1;
@@ -369,7 +369,7 @@ static long beat_lpar_hpte_updatepp_v3(unsigned long slot,
                                        unsigned long newpp,
                                        unsigned long vpn,
                                        int psize, int apsize,
-                                       int ssize, int local)
+                                       int ssize, unsigned long flags)
 {
         unsigned long lpar_rc;
         unsigned long want_v;
diff --git a/arch/powerpc/platforms/cell/celleb_pci.c b/arch/powerpc/platforms/cell/celleb_pci.c
index 2b98a36ef8fb..3ce70ded2d6a 100644
--- a/arch/powerpc/platforms/cell/celleb_pci.c
+++ b/arch/powerpc/platforms/cell/celleb_pci.c
@@ -29,7 +29,7 @@
 #include <linux/pci.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
+#include <linux/memblock.h>
 #include <linux/pci_regs.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
@@ -401,11 +401,11 @@ error:
         } else {
                 if (config && *config) {
                         size = 256;
-                        free_bootmem(__pa(*config), size);
+                        memblock_free(__pa(*config), size);
                 }
                 if (res && *res) {
                         size = sizeof(struct celleb_pci_resource);
-                        free_bootmem(__pa(*res), size);
+                        memblock_free(__pa(*res), size);
                 }
         }
 
diff --git a/arch/powerpc/platforms/cell/celleb_scc_epci.c b/arch/powerpc/platforms/cell/celleb_scc_epci.c
index 844c0facb4f7..9438bbed402f 100644
--- a/arch/powerpc/platforms/cell/celleb_scc_epci.c
+++ b/arch/powerpc/platforms/cell/celleb_scc_epci.c
@@ -25,7 +25,6 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/pci_regs.h>
-#include <linux/bootmem.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
diff --git a/arch/powerpc/platforms/cell/celleb_scc_pciex.c b/arch/powerpc/platforms/cell/celleb_scc_pciex.c
index 4278acfa2ede..f22387598040 100644
--- a/arch/powerpc/platforms/cell/celleb_scc_pciex.c
+++ b/arch/powerpc/platforms/cell/celleb_scc_pciex.c
@@ -25,7 +25,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 
diff --git a/arch/powerpc/platforms/cell/celleb_setup.c b/arch/powerpc/platforms/cell/celleb_setup.c
index 34e8ce2976aa..90be8ec51686 100644
--- a/arch/powerpc/platforms/cell/celleb_setup.c
+++ b/arch/powerpc/platforms/cell/celleb_setup.c
@@ -142,6 +142,7 @@ static int __init celleb_probe_beat(void)
         powerpc_firmware_features |= FW_FEATURE_CELLEB_ALWAYS
                 | FW_FEATURE_BEAT | FW_FEATURE_LPAR;
         hpte_init_beat_v3();
+        pm_power_off = beat_power_off;
 
         return 1;
 }
@@ -190,6 +191,7 @@ static int __init celleb_probe_native(void)
 
         powerpc_firmware_features |= FW_FEATURE_CELLEB_ALWAYS;
         hpte_init_native();
+        pm_power_off = rtas_power_off;
 
         return 1;
 }
@@ -204,7 +206,6 @@ define_machine(celleb_beat) {
         .setup_arch             = celleb_setup_arch_beat,
         .show_cpuinfo           = celleb_show_cpuinfo,
         .restart                = beat_restart,
-        .power_off              = beat_power_off,
         .halt                   = beat_halt,
         .get_rtc_time           = beat_get_rtc_time,
         .set_rtc_time           = beat_set_rtc_time,
@@ -230,7 +231,6 @@ define_machine(celleb_native) {
         .setup_arch             = celleb_setup_arch_native,
         .show_cpuinfo           = celleb_show_cpuinfo,
         .restart                = rtas_restart,
-        .power_off              = rtas_power_off,
         .halt                   = rtas_halt,
         .get_boot_time          = rtas_get_boot_time,
         .get_rtc_time           = rtas_get_rtc_time,
diff --git a/arch/powerpc/platforms/cell/interrupt.c b/arch/powerpc/platforms/cell/interrupt.c
index 8a106b4172e0..4c11421847be 100644
--- a/arch/powerpc/platforms/cell/interrupt.c
+++ b/arch/powerpc/platforms/cell/interrupt.c
@@ -82,7 +82,7 @@ static void iic_unmask(struct irq_data *d)
 
 static void iic_eoi(struct irq_data *d)
 {
-        struct iic *iic = &__get_cpu_var(cpu_iic);
+        struct iic *iic = this_cpu_ptr(&cpu_iic);
         out_be64(&iic->regs->prio, iic->eoi_stack[--iic->eoi_ptr]);
         BUG_ON(iic->eoi_ptr < 0);
 }
@@ -148,7 +148,7 @@ static unsigned int iic_get_irq(void)
         struct iic *iic;
         unsigned int virq;
 
-        iic = &__get_cpu_var(cpu_iic);
+        iic = this_cpu_ptr(&cpu_iic);
         *(unsigned long *) &pending =
                 in_be64((u64 __iomem *) &iic->regs->pending_destr);
         if (!(pending.flags & CBE_IIC_IRQ_VALID))
@@ -163,7 +163,7 @@ static unsigned int iic_get_irq(void)
 
 void iic_setup_cpu(void)
 {
-        out_be64(&__get_cpu_var(cpu_iic).regs->prio, 0xff);
+        out_be64(this_cpu_ptr(&cpu_iic.regs->prio), 0xff);
 }
 
 u8 iic_get_target_id(int cpu)
diff --git a/arch/powerpc/platforms/cell/qpace_setup.c b/arch/powerpc/platforms/cell/qpace_setup.c
index 6e3409d590ac..d328140dc6f5 100644
--- a/arch/powerpc/platforms/cell/qpace_setup.c
+++ b/arch/powerpc/platforms/cell/qpace_setup.c
@@ -127,6 +127,7 @@ static int __init qpace_probe(void)
                 return 0;
 
         hpte_init_native();
+        pm_power_off = rtas_power_off;
 
         return 1;
 }
@@ -137,7 +138,6 @@ define_machine(qpace) {
         .setup_arch             = qpace_setup_arch,
         .show_cpuinfo           = qpace_show_cpuinfo,
         .restart                = rtas_restart,
-        .power_off              = rtas_power_off,
         .halt                   = rtas_halt,
         .get_boot_time          = rtas_get_boot_time,
         .get_rtc_time           = rtas_get_rtc_time,
diff --git a/arch/powerpc/platforms/cell/setup.c b/arch/powerpc/platforms/cell/setup.c
index 6ae25fb62015..d62aa982d530 100644
--- a/arch/powerpc/platforms/cell/setup.c
+++ b/arch/powerpc/platforms/cell/setup.c
@@ -259,6 +259,7 @@ static int __init cell_probe(void)
                 return 0;
 
         hpte_init_native();
+        pm_power_off = rtas_power_off;
 
         return 1;
 }
@@ -269,7 +270,6 @@ define_machine(cell) {
         .setup_arch             = cell_setup_arch,
         .show_cpuinfo           = cell_show_cpuinfo,
         .restart                = rtas_restart,
-        .power_off              = rtas_power_off,
         .halt                   = rtas_halt,
         .get_boot_time          = rtas_get_boot_time,
         .get_rtc_time           = rtas_get_rtc_time,
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index ffcbd242e669..f7af74f83693 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -181,7 +181,8 @@ static int __spu_trap_data_seg(struct spu *spu, unsigned long ea)
         return 0;
 }
 
-extern int hash_page(unsigned long ea, unsigned long access, unsigned long trap); //XXX
+extern int hash_page(unsigned long ea, unsigned long access,
+                     unsigned long trap, unsigned long dsisr); //XXX
 static int __spu_trap_data_map(struct spu *spu, unsigned long ea, u64 dsisr)
 {
         int ret;
@@ -196,7 +197,7 @@ static int __spu_trap_data_map(struct spu *spu, unsigned long ea, u64 dsisr)
             (REGION_ID(ea) != USER_REGION_ID)) {
 
                 spin_unlock(&spu->register_lock);
-                ret = hash_page(ea, _PAGE_PRESENT, 0x300);
+                ret = hash_page(ea, _PAGE_PRESENT, 0x300, dsisr);
                 spin_lock(&spu->register_lock);
 
                 if (!ret) {
diff --git a/arch/powerpc/platforms/cell/spufs/fault.c b/arch/powerpc/platforms/cell/spufs/fault.c
index e45894a08118..d98f845ac777 100644
--- a/arch/powerpc/platforms/cell/spufs/fault.c
+++ b/arch/powerpc/platforms/cell/spufs/fault.c
@@ -144,7 +144,7 @@ int spufs_handle_class1(struct spu_context *ctx)
         access = (_PAGE_PRESENT | _PAGE_USER);
         access |= (dsisr & MFC_DSISR_ACCESS_PUT) ? _PAGE_RW : 0UL;
         local_irq_save(flags);
-        ret = hash_page(ea, access, 0x300);
+        ret = hash_page(ea, access, 0x300, dsisr);
         local_irq_restore(flags);
 
         /* hashing failed, so try the actual fault handler */
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index 5b77b1919fd2..860a59eb8ea2 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -585,6 +585,8 @@ static int __init chrp_probe(void)
         DMA_MODE_READ = 0x44;
         DMA_MODE_WRITE = 0x48;
 
+        pm_power_off = rtas_power_off;
+
         return 1;
 }
 
@@ -597,7 +599,6 @@ define_machine(chrp) {
         .show_cpuinfo           = chrp_show_cpuinfo,
         .init_IRQ               = chrp_init_IRQ,
         .restart                = rtas_restart,
-        .power_off              = rtas_power_off,
         .halt                   = rtas_halt,
         .time_init              = chrp_time_init,
         .set_rtc_time           = chrp_set_rtc_time,
diff --git a/arch/powerpc/platforms/embedded6xx/gamecube.c b/arch/powerpc/platforms/embedded6xx/gamecube.c
index bd4ba5d7d568..fe0ed6ee285e 100644
--- a/arch/powerpc/platforms/embedded6xx/gamecube.c
+++ b/arch/powerpc/platforms/embedded6xx/gamecube.c
@@ -67,6 +67,8 @@ static int __init gamecube_probe(void)
         if (!of_flat_dt_is_compatible(dt_root, "nintendo,gamecube"))
                 return 0;
 
+        pm_power_off = gamecube_power_off;
+
         return 1;
 }
 
@@ -80,7 +82,6 @@ define_machine(gamecube) {
         .probe                  = gamecube_probe,
         .init_early             = gamecube_init_early,
         .restart                = gamecube_restart,
-        .power_off              = gamecube_power_off,
         .halt                   = gamecube_halt,
         .init_IRQ               = flipper_pic_probe,
         .get_irq                = flipper_pic_get_irq,
diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
index 168e1d80b2e5..540eeb58d3f0 100644
--- a/arch/powerpc/platforms/embedded6xx/linkstation.c
+++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
@@ -147,6 +147,9 @@ static int __init linkstation_probe(void)
 
         if (!of_flat_dt_is_compatible(root, "linkstation"))
                 return 0;
+
+        pm_power_off = linkstation_power_off;
+
         return 1;
 }
 
@@ -158,7 +161,6 @@ define_machine(linkstation){
         .show_cpuinfo           = linkstation_show_cpuinfo,
         .get_irq                = mpic_get_irq,
         .restart                = linkstation_restart,
-        .power_off              = linkstation_power_off,
         .halt                   = linkstation_halt,
         .calibrate_decr         = generic_calibrate_decr,
 };
diff --git a/arch/powerpc/platforms/embedded6xx/usbgecko_udbg.c b/arch/powerpc/platforms/embedded6xx/usbgecko_udbg.c
index 20a8ed91962e..7feb325b636b 100644
--- a/arch/powerpc/platforms/embedded6xx/usbgecko_udbg.c
+++ b/arch/powerpc/platforms/embedded6xx/usbgecko_udbg.c
@@ -247,7 +247,7 @@ void __init ug_udbg_init(void)
         np = of_find_compatible_node(NULL, NULL, "nintendo,flipper-exi");
         if (!np) {
                 udbg_printf("%s: EXI node not found\n", __func__);
-                goto done;
+                goto out;
         }
 
         exi_io_base = ug_udbg_setup_exi_io_base(np);
@@ -267,8 +267,8 @@ void __init ug_udbg_init(void)
         }
 
 done:
-        if (np)
-                of_node_put(np);
+        of_node_put(np);
+out:
         return;
 }
 
diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
index 388e29bab8f6..352592d3e44e 100644
--- a/arch/powerpc/platforms/embedded6xx/wii.c
+++ b/arch/powerpc/platforms/embedded6xx/wii.c
@@ -211,6 +211,8 @@ static int __init wii_probe(void)
         if (!of_flat_dt_is_compatible(dt_root, "nintendo,wii"))
                 return 0;
 
+        pm_power_off = wii_power_off;
+
         return 1;
 }
 
@@ -226,7 +228,6 @@ define_machine(wii) {
         .init_early             = wii_init_early,
         .setup_arch             = wii_setup_arch,
         .restart                = wii_restart,
-        .power_off              = wii_power_off,
         .halt                   = wii_halt,
         .init_IRQ               = wii_pic_probe,
         .get_irq                = flipper_pic_get_irq,
diff --git a/arch/powerpc/platforms/maple/pci.c b/arch/powerpc/platforms/maple/pci.c
index f7136aae8bbf..d3a13067ec42 100644
--- a/arch/powerpc/platforms/maple/pci.c
+++ b/arch/powerpc/platforms/maple/pci.c
@@ -15,7 +15,6 @@
 #include <linux/delay.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/irq.h>
 
 #include <asm/sections.h>
diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
index cb1b0b35a0c6..56b85cd61aaf 100644
--- a/arch/powerpc/platforms/maple/setup.c
+++ b/arch/powerpc/platforms/maple/setup.c
@@ -169,7 +169,7 @@ static void __init maple_use_rtas_reboot_and_halt_if_present(void)
         if (rtas_service_present("system-reboot") &&
             rtas_service_present("power-off")) {
                 ppc_md.restart = rtas_restart;
-                ppc_md.power_off = rtas_power_off;
+                pm_power_off = rtas_power_off;
                 ppc_md.halt = rtas_halt;
         }
 }
@@ -312,6 +312,7 @@ static int __init maple_probe(void)
         alloc_dart_table();
 
         hpte_init_native();
+        pm_power_off = maple_power_off;
 
         return 1;
 }
@@ -325,7 +326,6 @@ define_machine(maple) {
         .pci_irq_fixup          = maple_pci_irq_fixup,
         .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq,
         .restart                = maple_restart,
-        .power_off              = maple_power_off,
         .halt                   = maple_halt,
         .get_boot_time          = maple_get_boot_time,
         .set_rtc_time           = maple_set_rtc_time,
diff --git a/arch/powerpc/platforms/powermac/nvram.c b/arch/powerpc/platforms/powermac/nvram.c
index 014d06e6d46b..60b03a1703d1 100644
--- a/arch/powerpc/platforms/powermac/nvram.c
+++ b/arch/powerpc/platforms/powermac/nvram.c
@@ -513,11 +513,7 @@ static int __init core99_nvram_setup(struct device_node *dp, unsigned long addr)
                 printk(KERN_ERR "nvram: no address\n");
                 return -EINVAL;
         }
-        nvram_image = alloc_bootmem(NVRAM_SIZE);
-        if (nvram_image == NULL) {
-                printk(KERN_ERR "nvram: can't allocate ram image\n");
-                return -ENOMEM;
-        }
+        nvram_image = memblock_virt_alloc(NVRAM_SIZE, 0);
         nvram_data = ioremap(addr, NVRAM_SIZE*2);
         nvram_naddrs = 1; /* Make sure we get the correct case */
 
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index 7e868ccf3b0d..04702db35d45 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -15,7 +15,6 @@
 #include <linux/delay.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/irq.h>
 #include <linux/of_pci.h>
 
diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
index b127a29ac526..713d36d45d1d 100644
--- a/arch/powerpc/platforms/powermac/setup.c
+++ b/arch/powerpc/platforms/powermac/setup.c
@@ -632,6 +632,8 @@ static int __init pmac_probe(void)
         smu_cmdbuf_abs = memblock_alloc_base(4096, 4096, 0x80000000UL);
 #endif /* CONFIG_PMAC_SMU */
 
+        pm_power_off = pmac_power_off;
+
         return 1;
 }
 
@@ -663,7 +665,6 @@ define_machine(powermac) {
         .get_irq                = NULL, /* changed later */
         .pci_irq_fixup          = pmac_pci_irq_fixup,
         .restart                = pmac_restart,
-        .power_off              = pmac_power_off,
         .halt                   = pmac_halt,
         .time_init              = pmac_time_init,
         .get_boot_time          = pmac_get_boot_time,
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
index eba9cb10619c..2809c9895288 100644
--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -11,7 +11,6 @@
  * (at your option) any later version.
  */
 
-#include <linux/bootmem.h>
 #include <linux/debugfs.h>
 #include <linux/delay.h>
 #include <linux/io.h>
@@ -354,6 +353,9 @@ static int ioda_eeh_get_phb_state(struct eeh_pe *pe)
         } else if (!(pe->state & EEH_PE_ISOLATED)) {
                 eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
                 ioda_eeh_phb_diag(pe);
+
+                if (eeh_has_flag(EEH_EARLY_DUMP_LOG))
+                        pnv_pci_dump_phb_diag_data(pe->phb, pe->data);
         }
 
         return result;
@@ -373,7 +375,7 @@ static int ioda_eeh_get_pe_state(struct eeh_pe *pe)
          * moving forward, we have to return operational
          * state during PE reset.
          */
-        if (pe->state & EEH_PE_CFG_BLOCKED) {
+        if (pe->state & EEH_PE_RESET) {
                 result = (EEH_STATE_MMIO_ACTIVE  |
                           EEH_STATE_DMA_ACTIVE   |
                           EEH_STATE_MMIO_ENABLED |
@@ -452,6 +454,9 @@ static int ioda_eeh_get_pe_state(struct eeh_pe *pe)
 
                 eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
                 ioda_eeh_phb_diag(pe);
+
+                if (eeh_has_flag(EEH_EARLY_DUMP_LOG))
+                        pnv_pci_dump_phb_diag_data(pe->phb, pe->data);
         }
 
         return result;
@@ -731,7 +736,8 @@ static int ioda_eeh_reset(struct eeh_pe *pe, int option)
 static int ioda_eeh_get_log(struct eeh_pe *pe, int severity,
                             char *drv_log, unsigned long len)
 {
-        pnv_pci_dump_phb_diag_data(pe->phb, pe->data);
+        if (!eeh_has_flag(EEH_EARLY_DUMP_LOG))
+                pnv_pci_dump_phb_diag_data(pe->phb, pe->data);
 
         return 0;
 }
@@ -1087,6 +1093,10 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
                     !((*pe)->state & EEH_PE_ISOLATED)) {
                         eeh_pe_state_mark(*pe, EEH_PE_ISOLATED);
                         ioda_eeh_phb_diag(*pe);
+
+                        if (eeh_has_flag(EEH_EARLY_DUMP_LOG))
+                                pnv_pci_dump_phb_diag_data((*pe)->phb,
+                                                           (*pe)->data);
                 }
 
                 /*
diff --git a/arch/powerpc/platforms/powernv/opal-async.c b/arch/powerpc/platforms/powernv/opal-async.c
index e462ab947d16..693b6cdac691 100644
--- a/arch/powerpc/platforms/powernv/opal-async.c
+++ b/arch/powerpc/platforms/powernv/opal-async.c
@@ -71,6 +71,7 @@ int opal_async_get_token_interruptible(void)
 
         return token;
 }
+EXPORT_SYMBOL_GPL(opal_async_get_token_interruptible);
 
 int __opal_async_release_token(int token)
 {
@@ -102,6 +103,7 @@ int opal_async_release_token(int token)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(opal_async_release_token);
 
 int opal_async_wait_response(uint64_t token, struct opal_msg *msg)
 {
@@ -120,6 +122,7 @@ int opal_async_wait_response(uint64_t token, struct opal_msg *msg)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(opal_async_wait_response);
 
 static int opal_async_comp_event(struct notifier_block *nb,
                 unsigned long msg_type, void *msg)
diff --git a/arch/powerpc/platforms/powernv/opal-rtc.c b/arch/powerpc/platforms/powernv/opal-rtc.c
index 499707ddaa9c..37dbee15769f 100644
--- a/arch/powerpc/platforms/powernv/opal-rtc.c
+++ b/arch/powerpc/platforms/powernv/opal-rtc.c
@@ -15,6 +15,8 @@
 #include <linux/bcd.h>
 #include <linux/rtc.h>
 #include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/of_platform.h>
 
 #include <asm/opal.h>
 #include <asm/firmware.h>
@@ -43,7 +45,7 @@ unsigned long __init opal_get_boot_time(void)
         long rc = OPAL_BUSY;
 
         if (!opal_check_token(OPAL_RTC_READ))
-                goto out;
+                return 0;
 
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
@@ -53,62 +55,33 @@ unsigned long __init opal_get_boot_time(void)
                         mdelay(10);
         }
         if (rc != OPAL_SUCCESS)
-                goto out;
+                return 0;
 
         y_m_d = be32_to_cpu(__y_m_d);
         h_m_s_ms = be64_to_cpu(__h_m_s_ms);
         opal_to_tm(y_m_d, h_m_s_ms, &tm);
         return mktime(tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
                       tm.tm_hour, tm.tm_min, tm.tm_sec);
-out:
-        ppc_md.get_rtc_time = NULL;
-        ppc_md.set_rtc_time = NULL;
-        return 0;
 }
 
-void opal_get_rtc_time(struct rtc_time *tm)
+static __init int opal_time_init(void)
 {
-        long rc = OPAL_BUSY;
-        u32 y_m_d;
-        u64 h_m_s_ms;
-        __be32 __y_m_d;
-        __be64 __h_m_s_ms;
+        struct platform_device *pdev;
+        struct device_node *rtc;
 
-        while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
-                rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
-                        opal_poll_events(NULL);
+        rtc = of_find_node_by_path("/ibm,opal/rtc");
+        if (rtc) {
+                pdev = of_platform_device_create(rtc, "opal-rtc", NULL);
+                of_node_put(rtc);
+        } else {
+                if (opal_check_token(OPAL_RTC_READ) ||
+                    opal_check_token(OPAL_READ_TPO))
+                        pdev = platform_device_register_simple("opal-rtc", -1,
+                                                               NULL, 0);
                 else
-                        mdelay(10);
+                        return -ENODEV;
         }
-        if (rc != OPAL_SUCCESS)
-                return;
-        y_m_d = be32_to_cpu(__y_m_d);
-        h_m_s_ms = be64_to_cpu(__h_m_s_ms);
-        opal_to_tm(y_m_d, h_m_s_ms, tm);
-}
-
-int opal_set_rtc_time(struct rtc_time *tm)
-{
-        long rc = OPAL_BUSY;
-        u32 y_m_d = 0;
-        u64 h_m_s_ms = 0;
-
-        y_m_d |= ((u32)bin2bcd((tm->tm_year + 1900) / 100)) << 24;
-        y_m_d |= ((u32)bin2bcd((tm->tm_year + 1900) % 100)) << 16;
-        y_m_d |= ((u32)bin2bcd((tm->tm_mon + 1))) << 8;
-        y_m_d |= ((u32)bin2bcd(tm->tm_mday));
-
-        h_m_s_ms |= ((u64)bin2bcd(tm->tm_hour)) << 56;
-        h_m_s_ms |= ((u64)bin2bcd(tm->tm_min)) << 48;
-        h_m_s_ms |= ((u64)bin2bcd(tm->tm_sec)) << 40;
 
-        while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
-                rc = opal_rtc_write(y_m_d, h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
-                        opal_poll_events(NULL);
-                else
-                        mdelay(10);
-        }
-        return rc == OPAL_SUCCESS ? 0 : -EIO;
+        return PTR_ERR_OR_ZERO(pdev);
 }
+machine_subsys_initcall(powernv, opal_time_init);
diff --git a/arch/powerpc/platforms/powernv/opal-tracepoints.c b/arch/powerpc/platforms/powernv/opal-tracepoints.c
index ae14c40b4b1c..e11273b2386d 100644
--- a/arch/powerpc/platforms/powernv/opal-tracepoints.c
+++ b/arch/powerpc/platforms/powernv/opal-tracepoints.c
@@ -48,7 +48,7 @@ void __trace_opal_entry(unsigned long opcode, unsigned long *args)
 
         local_irq_save(flags);
 
-        depth = &__get_cpu_var(opal_trace_depth);
+        depth = this_cpu_ptr(&opal_trace_depth);
 
         if (*depth)
                 goto out;
@@ -69,7 +69,7 @@ void __trace_opal_exit(long opcode, unsigned long retval)
 
         local_irq_save(flags);
 
-        depth = &__get_cpu_var(opal_trace_depth);
+        depth = this_cpu_ptr(&opal_trace_depth);
 
         if (*depth)
                 goto out;
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index feb549aa3eea..0a299be588af 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -18,7 +18,7 @@
         .section        ".text"
 
 #ifdef CONFIG_TRACEPOINTS
-#ifdef CONFIG_JUMP_LABEL
+#ifdef HAVE_JUMP_LABEL
 #define OPAL_BRANCH(LABEL)                                      \
         ARCH_STATIC_BRANCH(LABEL, opal_tracepoint_key)
 #else
@@ -250,3 +250,7 @@ OPAL_CALL(opal_handle_hmi,			OPAL_HANDLE_HMI);
 OPAL_CALL(opal_register_dump_region,            OPAL_REGISTER_DUMP_REGION);
 OPAL_CALL(opal_unregister_dump_region,          OPAL_UNREGISTER_DUMP_REGION);
 OPAL_CALL(opal_pci_set_phb_cxl_mode,            OPAL_PCI_SET_PHB_CXL_MODE);
+OPAL_CALL(opal_tpo_write,                       OPAL_WRITE_TPO);
+OPAL_CALL(opal_tpo_read,                        OPAL_READ_TPO);
+OPAL_CALL(opal_ipmi_send,                       OPAL_IPMI_SEND);
+OPAL_CALL(opal_ipmi_recv,                       OPAL_IPMI_RECV);
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index d019b081df9d..cb0b6de79cd4 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -50,7 +50,6 @@ static int mc_recoverable_range_len;
 
 struct device_node *opal_node;
 static DEFINE_SPINLOCK(opal_write_lock);
-extern u64 opal_mc_secondary_handler[];
 static unsigned int *opal_irqs;
 static unsigned int opal_irq_count;
 static ATOMIC_NOTIFIER_HEAD(opal_notifier_head);
@@ -644,6 +643,16 @@ static void __init opal_dump_region_init(void)
                 pr_warn("DUMP: Failed to register kernel log buffer. "
                         "rc = %d\n", rc);
 }
+
+static void opal_ipmi_init(struct device_node *opal_node)
+{
+        struct device_node *np;
+
+        for_each_child_of_node(opal_node, np)
+                if (of_device_is_compatible(np, "ibm,opal-ipmi"))
+                        of_platform_device_create(np, NULL, NULL);
+}
+
 static int __init opal_init(void)
 {
         struct device_node *np, *consoles;
@@ -707,6 +716,8 @@ static int __init opal_init(void)
                 opal_msglog_init();
         }
 
+        opal_ipmi_init(opal_node);
+
         return 0;
 }
 machine_subsys_initcall(powernv, opal_init);
@@ -742,6 +753,8 @@ void opal_shutdown(void)
 
 /* Export this so that test modules can use it */
 EXPORT_SYMBOL_GPL(opal_invalid_call);
+EXPORT_SYMBOL_GPL(opal_ipmi_send);
+EXPORT_SYMBOL_GPL(opal_ipmi_recv);
 
 /* Convert a region of vmalloc memory to an opal sg list */
 struct opal_sg_list *opal_vmalloc_to_sg_list(void *vmalloc_addr,
@@ -805,3 +818,9 @@ void opal_free_sg_list(struct opal_sg_list *sg)
                         sg = NULL;
         }
 }
+
+EXPORT_SYMBOL_GPL(opal_poll_events);
+EXPORT_SYMBOL_GPL(opal_rtc_read);
+EXPORT_SYMBOL_GPL(opal_rtc_write);
+EXPORT_SYMBOL_GPL(opal_tpo_read);
+EXPORT_SYMBOL_GPL(opal_tpo_write);
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 3ba435ec3dcd..fac88ed8a915 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -91,6 +91,24 @@ static inline bool pnv_pci_is_mem_pref_64(unsigned long flags)
                 (IORESOURCE_MEM_64 | IORESOURCE_PREFETCH));
 }
 
+static void pnv_ioda_reserve_pe(struct pnv_phb *phb, int pe_no)
+{
+        if (!(pe_no >= 0 && pe_no < phb->ioda.total_pe)) {
+                pr_warn("%s: Invalid PE %d on PHB#%x\n",
+                        __func__, pe_no, phb->hose->global_number);
+                return;
+        }
+
+        if (test_and_set_bit(pe_no, phb->ioda.pe_alloc)) {
+                pr_warn("%s: PE %d was assigned on PHB#%x\n",
+                        __func__, pe_no, phb->hose->global_number);
+                return;
+        }
+
+        phb->ioda.pe_array[pe_no].phb = phb;
+        phb->ioda.pe_array[pe_no].pe_number = pe_no;
+}
+
 static int pnv_ioda_alloc_pe(struct pnv_phb *phb)
 {
         unsigned long pe;
@@ -172,7 +190,7 @@ fail:
         return -EIO;
 }
 
-static void pnv_ioda2_alloc_m64_pe(struct pnv_phb *phb)
+static void pnv_ioda2_reserve_m64_pe(struct pnv_phb *phb)
 {
         resource_size_t sgsz = phb->ioda.m64_segsize;
         struct pci_dev *pdev;
@@ -185,16 +203,15 @@ static void pnv_ioda2_alloc_m64_pe(struct pnv_phb *phb)
          * instead of root bus.
          */
         list_for_each_entry(pdev, &phb->hose->bus->devices, bus_list) {
-                for (i = PCI_BRIDGE_RESOURCES;
-                     i <= PCI_BRIDGE_RESOURCE_END; i++) {
-                        r = &pdev->resource[i];
+                for (i = 0; i < PCI_BRIDGE_RESOURCE_NUM; i++) {
+                        r = &pdev->resource[PCI_BRIDGE_RESOURCES + i];
                         if (!r->parent ||
                             !pnv_pci_is_mem_pref_64(r->flags))
                                 continue;
 
                         base = (r->start - phb->ioda.m64_base) / sgsz;
                         for (step = 0; step < resource_size(r) / sgsz; step++)
-                                set_bit(base + step, phb->ioda.pe_alloc);
+                                pnv_ioda_reserve_pe(phb, base + step);
                 }
         }
 }
@@ -287,8 +304,6 @@ done:
         while ((i = find_next_bit(pe_alloc, phb->ioda.total_pe, i + 1)) <
                 phb->ioda.total_pe) {
                 pe = &phb->ioda.pe_array[i];
-                pe->phb = phb;
-                pe->pe_number = i;
 
                 if (!master_pe) {
                         pe->flags |= PNV_IODA_PE_MASTER;
@@ -313,6 +328,12 @@ static void __init pnv_ioda_parse_m64_window(struct pnv_phb *phb)
         const u32 *r;
         u64 pci_addr;
 
+        /* FIXME: Support M64 for P7IOC */
+        if (phb->type != PNV_PHB_IODA2) {
+                pr_info("  Not support M64 window\n");
+                return;
+        }
+
         if (!firmware_has_feature(FW_FEATURE_OPALv3)) {
                 pr_info("  Firmware too old to support M64 window\n");
                 return;
@@ -325,12 +346,6 @@ static void __init pnv_ioda_parse_m64_window(struct pnv_phb *phb)
                 return;
         }
 
-        /* FIXME: Support M64 for P7IOC */
-        if (phb->type != PNV_PHB_IODA2) {
-                pr_info("  Not support M64 window\n");
-                return;
-        }
-
         res = &hose->mem_resources[1];
         res->start = of_translate_address(dn, r + 2);
         res->end = res->start + of_read_number(r + 4, 2) - 1;
@@ -345,7 +360,7 @@ static void __init pnv_ioda_parse_m64_window(struct pnv_phb *phb)
         /* Use last M64 BAR to cover M64 window */
         phb->ioda.m64_bar_idx = 15;
         phb->init_m64 = pnv_ioda2_init_m64;
-        phb->alloc_m64_pe = pnv_ioda2_alloc_m64_pe;
+        phb->reserve_m64_pe = pnv_ioda2_reserve_m64_pe;
         phb->pick_m64_pe = pnv_ioda2_pick_m64_pe;
 }
 
@@ -358,7 +373,9 @@ static void pnv_ioda_freeze_pe(struct pnv_phb *phb, int pe_no)
         /* Fetch master PE */
         if (pe->flags & PNV_IODA_PE_SLAVE) {
                 pe = pe->master;
-                WARN_ON(!pe || !(pe->flags & PNV_IODA_PE_MASTER));
+                if (WARN_ON(!pe || !(pe->flags & PNV_IODA_PE_MASTER)))
+                        return;
+
                 pe_no = pe->pe_number;
         }
 
@@ -507,6 +524,106 @@ static struct pnv_ioda_pe *pnv_ioda_get_pe(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_MSI */
 
+static int pnv_ioda_set_one_peltv(struct pnv_phb *phb,
+                                  struct pnv_ioda_pe *parent,
+                                  struct pnv_ioda_pe *child,
+                                  bool is_add)
+{
+        const char *desc = is_add ? "adding" : "removing";
+        uint8_t op = is_add ? OPAL_ADD_PE_TO_DOMAIN :
+                              OPAL_REMOVE_PE_FROM_DOMAIN;
+        struct pnv_ioda_pe *slave;
+        long rc;
+
+        /* Parent PE affects child PE */
+        rc = opal_pci_set_peltv(phb->opal_id, parent->pe_number,
+                                child->pe_number, op);
+        if (rc != OPAL_SUCCESS) {
+                pe_warn(child, "OPAL error %ld %s to parent PELTV\n",
+                        rc, desc);
+                return -ENXIO;
+        }
+
+        if (!(child->flags & PNV_IODA_PE_MASTER))
+                return 0;
+
+        /* Compound case: parent PE affects slave PEs */
+        list_for_each_entry(slave, &child->slaves, list) {
+                rc = opal_pci_set_peltv(phb->opal_id, parent->pe_number,
+                                        slave->pe_number, op);
+                if (rc != OPAL_SUCCESS) {
+                        pe_warn(slave, "OPAL error %ld %s to parent PELTV\n",
+                                rc, desc);
+                        return -ENXIO;
+                }
+        }
+
+        return 0;
+}
+
+static int pnv_ioda_set_peltv(struct pnv_phb *phb,
+                              struct pnv_ioda_pe *pe,
+                              bool is_add)
+{
+        struct pnv_ioda_pe *slave;
+        struct pci_dev *pdev;
+        int ret;
+
+        /*
+         * Clear PE frozen state. If it's master PE, we need
+         * clear slave PE frozen state as well.
+         */
+        if (is_add) {
+                opal_pci_eeh_freeze_clear(phb->opal_id, pe->pe_number,
+                                          OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+                if (pe->flags & PNV_IODA_PE_MASTER) {
+                        list_for_each_entry(slave, &pe->slaves, list)
+                                opal_pci_eeh_freeze_clear(phb->opal_id,
+                                                          slave->pe_number,
+                                                          OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+                }
+        }
+
+        /*
+         * Associate PE in PELT. We need add the PE into the
+         * corresponding PELT-V as well. Otherwise, the error
+         * originated from the PE might contribute to other
+         * PEs.
+         */
+        ret = pnv_ioda_set_one_peltv(phb, pe, pe, is_add);
+        if (ret)
+                return ret;
+
+        /* For compound PEs, any one affects all of them */
+        if (pe->flags & PNV_IODA_PE_MASTER) {
+                list_for_each_entry(slave, &pe->slaves, list) {
+                        ret = pnv_ioda_set_one_peltv(phb, slave, pe, is_add);
+                        if (ret)
+                                return ret;
+                }
+        }
+
+        if (pe->flags & (PNV_IODA_PE_BUS_ALL | PNV_IODA_PE_BUS))
+                pdev = pe->pbus->self;
+        else
+                pdev = pe->pdev->bus->self;
+        while (pdev) {
+                struct pci_dn *pdn = pci_get_pdn(pdev);
+                struct pnv_ioda_pe *parent;
+
+                if (pdn && pdn->pe_number != IODA_INVALID_PE) {
+                        parent = &phb->ioda.pe_array[pdn->pe_number];
+                        ret = pnv_ioda_set_one_peltv(phb, parent, pe, is_add);
+                        if (ret)
+                                return ret;
+                }
+
+                pdev = pdev->bus->self;
+        }
+
+        return 0;
+}
+
 static int pnv_ioda_configure_pe(struct pnv_phb *phb, struct pnv_ioda_pe *pe)
 {
         struct pci_dev *parent;
@@ -561,48 +678,36 @@ static int pnv_ioda_configure_pe(struct pnv_phb *phb, struct pnv_ioda_pe *pe)
                 return -ENXIO;
         }
 
-        rc = opal_pci_set_peltv(phb->opal_id, pe->pe_number,
-                                pe->pe_number, OPAL_ADD_PE_TO_DOMAIN);
-        if (rc)
-                pe_warn(pe, "OPAL error %d adding self to PELTV\n", rc);
-        opal_pci_eeh_freeze_clear(phb->opal_id, pe->pe_number,
-                                  OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+        /* Configure PELTV */
+        pnv_ioda_set_peltv(phb, pe, true);
 
-        /* Add to all parents PELT-V */
-        while (parent) {
-                struct pci_dn *pdn = pci_get_pdn(parent);
-                if (pdn && pdn->pe_number != IODA_INVALID_PE) {
-                        rc = opal_pci_set_peltv(phb->opal_id, pdn->pe_number,
-                                                pe->pe_number, OPAL_ADD_PE_TO_DOMAIN);
-                        /* XXX What to do in case of error ? */
-                }
-                parent = parent->bus->self;
-        }
         /* Setup reverse map */
         for (rid = pe->rid; rid < rid_end; rid++)
                 phb->ioda.pe_rmap[rid] = pe->pe_number;
 
         /* Setup one MVTs on IODA1 */
-        if (phb->type == PNV_PHB_IODA1) {
-                pe->mve_number = pe->pe_number;
-                rc = opal_pci_set_mve(phb->opal_id, pe->mve_number,
-                                      pe->pe_number);
+        if (phb->type != PNV_PHB_IODA1) {
+                pe->mve_number = 0;
+                goto out;
+        }
+
+        pe->mve_number = pe->pe_number;
+        rc = opal_pci_set_mve(phb->opal_id, pe->mve_number, pe->pe_number);
+        if (rc != OPAL_SUCCESS) {
+                pe_err(pe, "OPAL error %ld setting up MVE %d\n",
+                       rc, pe->mve_number);
+                pe->mve_number = -1;
+        } else {
+                rc = opal_pci_set_mve_enable(phb->opal_id,
+                                             pe->mve_number, OPAL_ENABLE_MVE);
                 if (rc) {
-                        pe_err(pe, "OPAL error %ld setting up MVE %d\n",
+                        pe_err(pe, "OPAL error %ld enabling MVE %d\n",
                                rc, pe->mve_number);
                         pe->mve_number = -1;
-                } else {
-                        rc = opal_pci_set_mve_enable(phb->opal_id,
-                                                     pe->mve_number, OPAL_ENABLE_MVE);
-                        if (rc) {
-                                pe_err(pe, "OPAL error %ld enabling MVE %d\n",
-                                       rc, pe->mve_number);
-                                pe->mve_number = -1;
-                        }
                 }
-        } else if (phb->type == PNV_PHB_IODA2)
-                pe->mve_number = 0;
+        }
 
+out:
         return 0;
 }
 
@@ -837,8 +942,8 @@ static void pnv_pci_ioda_setup_PEs(void)
                 phb = hose->private_data;
 
                 /* M64 layout might affect PE allocation */
-                if (phb->alloc_m64_pe)
-                        phb->alloc_m64_pe(phb);
+                if (phb->reserve_m64_pe)
+                        phb->reserve_m64_pe(phb);
 
                 pnv_ioda_setup_PEs(hose->bus);
         }
@@ -1834,19 +1939,14 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
         phb_id = be64_to_cpup(prop64);
         pr_debug("  PHB-ID  : 0x%016llx\n", phb_id);
 
-        phb = alloc_bootmem(sizeof(struct pnv_phb));
-        if (!phb) {
-                pr_err("  Out of memory !\n");
-                return;
-        }
+        phb = memblock_virt_alloc(sizeof(struct pnv_phb), 0);
 
         /* Allocate PCI controller */
-        memset(phb, 0, sizeof(struct pnv_phb));
         phb->hose = hose = pcibios_alloc_controller(np);
         if (!phb->hose) {
                 pr_err("  Can't allocate PCI controller for %s\n",
                        np->full_name);
-                free_bootmem((unsigned long)phb, sizeof(struct pnv_phb));
+                memblock_free(__pa(phb), sizeof(struct pnv_phb));
                 return;
         }
 
@@ -1913,8 +2013,7 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
         }
         pemap_off = size;
         size += phb->ioda.total_pe * sizeof(struct pnv_ioda_pe);
-        aux = alloc_bootmem(size);
-        memset(aux, 0, size);
+        aux = memblock_virt_alloc(size, 0);
         phb->ioda.pe_alloc = aux;
         phb->ioda.m32_segmap = aux + m32map_off;
         if (phb->type == PNV_PHB_IODA1)
@@ -1999,8 +2098,8 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
                 ioda_eeh_phb_reset(hose, EEH_RESET_DEACTIVATE);
         }
 
-        /* Configure M64 window */
-        if (phb->init_m64 && phb->init_m64(phb))
+        /* Remove M64 resource if we can't configure it successfully */
+        if (!phb->init_m64 || phb->init_m64(phb))
                 hose->mem_resources[1].flags = 0;
 }
 
diff --git a/arch/powerpc/platforms/powernv/pci-p5ioc2.c b/arch/powerpc/platforms/powernv/pci-p5ioc2.c
index 94ce3481490b..6ef6d4d8e7e2 100644
--- a/arch/powerpc/platforms/powernv/pci-p5ioc2.c
+++ b/arch/powerpc/platforms/powernv/pci-p5ioc2.c
@@ -122,12 +122,9 @@ static void __init pnv_pci_init_p5ioc2_phb(struct device_node *np, u64 hub_id,
                 return;
         }
 
-        phb = alloc_bootmem(sizeof(struct pnv_phb));
-        if (phb) {
-                memset(phb, 0, sizeof(struct pnv_phb));
-                phb->hose = pcibios_alloc_controller(np);
-        }
-        if (!phb || !phb->hose) {
+        phb = memblock_virt_alloc(sizeof(struct pnv_phb), 0);
+        phb->hose = pcibios_alloc_controller(np);
+        if (!phb->hose) {
                 pr_err("  Failed to allocate PCI controller\n");
                 return;
         }
@@ -196,16 +193,27 @@ void __init pnv_pci_init_p5ioc2_hub(struct device_node *np)
         hub_id = be64_to_cpup(prop64);
         pr_info(" HUB-ID : 0x%016llx\n", hub_id);
 
+        /* Count child PHBs and calculate TCE space per PHB */
+        for_each_child_of_node(np, phbn) {
+                if (of_device_is_compatible(phbn, "ibm,p5ioc2-pcix") ||
+                    of_device_is_compatible(phbn, "ibm,p5ioc2-pciex"))
+                        phb_count++;
+        }
+
+        if (phb_count <= 0) {
+                pr_info(" No PHBs for Hub %s\n", np->full_name);
+                return;
+        }
+
+        tce_per_phb = __rounddown_pow_of_two(P5IOC2_TCE_MEMORY / phb_count);
+        pr_info(" Allocating %lld MB of TCE memory per PHB\n",
+                tce_per_phb >> 20);
+
         /* Currently allocate 16M of TCE memory for every Hub
          *
          * XXX TODO: Make it chip local if possible
          */
-        tce_mem = __alloc_bootmem(P5IOC2_TCE_MEMORY, P5IOC2_TCE_MEMORY,
-                                  __pa(MAX_DMA_ADDRESS));
-        if (!tce_mem) {
-                pr_err(" Failed to allocate TCE Memory !\n");
-                return;
-        }
+        tce_mem = memblock_virt_alloc(P5IOC2_TCE_MEMORY, P5IOC2_TCE_MEMORY);
         pr_debug(" TCE    : 0x%016lx..0x%016lx\n",
                 __pa(tce_mem), __pa(tce_mem) + P5IOC2_TCE_MEMORY - 1);
         rc = opal_pci_set_hub_tce_memory(hub_id, __pa(tce_mem),
@@ -215,18 +223,6 @@ void __init pnv_pci_init_p5ioc2_hub(struct device_node *np)
                 return;
         }
 
-        /* Count child PHBs */
-        for_each_child_of_node(np, phbn) {
-                if (of_device_is_compatible(phbn, "ibm,p5ioc2-pcix") ||
-                    of_device_is_compatible(phbn, "ibm,p5ioc2-pciex"))
-                        phb_count++;
-        }
-
-        /* Calculate how much TCE space we can give per PHB */
-        tce_per_phb = __rounddown_pow_of_two(P5IOC2_TCE_MEMORY / phb_count);
-        pr_info(" Allocating %lld MB of TCE memory per PHB\n",
-                tce_per_phb >> 20);
-
         /* Initialize PHBs */
         for_each_child_of_node(np, phbn) {
                 if (of_device_is_compatible(phbn, "ibm,p5ioc2-pcix") ||
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 540fc6dd56b3..4945e87f12dc 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -16,7 +16,6 @@
 #include <linux/delay.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <linux/bootmem.h>
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/msi.h>
diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
index 34d29eb2a4de..6c02ff8dd69f 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -130,7 +130,7 @@ struct pnv_phb {
         u32 (*bdfn_to_pe)(struct pnv_phb *phb, struct pci_bus *bus, u32 devfn);
         void (*shutdown)(struct pnv_phb *phb);
         int (*init_m64)(struct pnv_phb *phb);
-        void (*alloc_m64_pe)(struct pnv_phb *phb);
+        void (*reserve_m64_pe)(struct pnv_phb *phb);
         int (*pick_m64_pe)(struct pnv_phb *phb, struct pci_bus *bus, int all);
         int (*get_pe_state)(struct pnv_phb *phb, int pe_no);
         void (*freeze_pe)(struct pnv_phb *phb, int pe_no);
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 3f9546d8a51f..30b1c3e298a6 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -265,10 +265,8 @@ static unsigned long pnv_memory_block_size(void)
 static void __init pnv_setup_machdep_opal(void)
 {
         ppc_md.get_boot_time = opal_get_boot_time;
-        ppc_md.get_rtc_time = opal_get_rtc_time;
-        ppc_md.set_rtc_time = opal_set_rtc_time;
         ppc_md.restart = pnv_restart;
-        ppc_md.power_off = pnv_power_off;
+        pm_power_off = pnv_power_off;
         ppc_md.halt = pnv_halt;
         ppc_md.machine_check_exception = opal_machine_check;
         ppc_md.mce_check_early_recovery = opal_mce_check_early_recovery;
@@ -285,7 +283,7 @@ static void __init pnv_setup_machdep_rtas(void)
                 ppc_md.set_rtc_time = rtas_set_rtc_time;
         }
         ppc_md.restart = rtas_restart;
-        ppc_md.power_off = rtas_power_off;
+        pm_power_off = rtas_power_off;
         ppc_md.halt = rtas_halt;
 }
 #endif /* CONFIG_PPC_POWERNV_RTAS */
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 4753958cd509..b716f666e48a 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -149,6 +149,7 @@ static int pnv_smp_cpu_disable(void)
 static void pnv_smp_cpu_kill_self(void)
 {
         unsigned int cpu;
+        unsigned long srr1;
 
         /* Standard hot unplug procedure */
         local_irq_disable();
@@ -165,13 +166,25 @@ static void pnv_smp_cpu_kill_self(void)
         mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
         while (!generic_check_cpu_restart(cpu)) {
                 ppc64_runlatch_off();
-                power7_nap(1);
+                srr1 = power7_nap(1);
                 ppc64_runlatch_on();
 
-                /* Clear the IPI that woke us up */
-                icp_native_flush_interrupt();
-                local_paca->irq_happened &= PACA_IRQ_HARD_DIS;
-                mb();
+                /*
+                 * If the SRR1 value indicates that we woke up due to
+                 * an external interrupt, then clear the interrupt.
+                 * We clear the interrupt before checking for the
+                 * reason, so as to avoid a race where we wake up for
+                 * some other reason, find nothing and clear the interrupt
+                 * just as some other cpu is sending us an interrupt.
+                 * If we returned from power7_nap as a result of
+                 * having finished executing in a KVM guest, then srr1
+                 * contains 0.
+                 */
+                if ((srr1 & SRR1_WAKEMASK) == SRR1_WAKEEE) {
+                        icp_native_flush_interrupt();
+                        local_paca->irq_happened &= PACA_IRQ_HARD_DIS;
+                        smp_mb();
+                }
 
                 if (cpu_core_split_required())
                         continue;
diff --git a/arch/powerpc/platforms/ps3/htab.c b/arch/powerpc/platforms/ps3/htab.c
index 3e270e3412ae..2f95d33cf34a 100644
--- a/arch/powerpc/platforms/ps3/htab.c
+++ b/arch/powerpc/platforms/ps3/htab.c
@@ -110,7 +110,7 @@ static long ps3_hpte_remove(unsigned long hpte_group)
 
 static long ps3_hpte_updatepp(unsigned long slot, unsigned long newpp,
                               unsigned long vpn, int psize, int apsize,
-                              int ssize, int local)
+                              int ssize, unsigned long inv_flags)
 {
         int result;
         u64 hpte_v, want_v, hpte_rs;
diff --git a/arch/powerpc/platforms/ps3/interrupt.c b/arch/powerpc/platforms/ps3/interrupt.c
index 5f3b23220b8e..a6c42f34303a 100644
--- a/arch/powerpc/platforms/ps3/interrupt.c
+++ b/arch/powerpc/platforms/ps3/interrupt.c
@@ -711,7 +711,7 @@ void __init ps3_register_ipi_irq(unsigned int cpu, unsigned int virq)
 
 static unsigned int ps3_get_irq(void)
 {
-        struct ps3_private *pd = &__get_cpu_var(ps3_private);
+        struct ps3_private *pd = this_cpu_ptr(&ps3_private);
         u64 x = (pd->bmp.status & pd->bmp.mask);
         unsigned int plug;
 
diff --git a/arch/powerpc/platforms/ps3/setup.c b/arch/powerpc/platforms/ps3/setup.c
index 3f509f86432c..799c8580ab09 100644
--- a/arch/powerpc/platforms/ps3/setup.c
+++ b/arch/powerpc/platforms/ps3/setup.c
@@ -125,12 +125,7 @@ static void __init prealloc(struct ps3_prealloc *p)
         if (!p->size)
                 return;
 
-        p->address = __alloc_bootmem(p->size, p->align, __pa(MAX_DMA_ADDRESS));
-        if (!p->address) {
-                printk(KERN_ERR "%s: Cannot allocate %s\n", __func__,
-                       p->name);
-                return;
-        }
+        p->address = memblock_virt_alloc(p->size, p->align);
 
         printk(KERN_INFO "%s: %lu bytes at %p\n", p->name, p->size,
                p->address);
@@ -248,6 +243,7 @@ static int __init ps3_probe(void)
         ps3_mm_init();
         ps3_mm_vas_create(&htab_size);
         ps3_hpte_init(htab_size);
+        pm_power_off = ps3_power_off;
 
         DBG(" <- %s:%d\n", __func__, __LINE__);
         return 1;
@@ -278,7 +274,6 @@ define_machine(ps3) {
         .calibrate_decr                 = ps3_calibrate_decr,
         .progress                       = ps3_progress,
         .restart                        = ps3_restart,
-        .power_off                      = ps3_power_off,
         .halt                           = ps3_halt,
 #if defined(CONFIG_KEXEC)
         .kexec_cpu_down                 = ps3_kexec_cpu_down,
diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
index 1062f71f5a85..39049e4884fb 100644
--- a/arch/powerpc/platforms/pseries/dtl.c
+++ b/arch/powerpc/platforms/pseries/dtl.c
@@ -75,7 +75,7 @@ static atomic_t dtl_count;
  */
 static void consume_dtle(struct dtl_entry *dtle, u64 index)
 {
-        struct dtl_ring *dtlr = &__get_cpu_var(dtl_rings);
+        struct dtl_ring *dtlr = this_cpu_ptr(&dtl_rings);
         struct dtl_entry *wp = dtlr->write_ptr;
         struct lppaca *vpa = local_paca->lppaca_ptr;
 
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 1bbb78fab530..fa41f0da5b6f 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -12,7 +12,6 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/memblock.h>
-#include <linux/vmalloc.h>
 #include <linux/memory.h>
 #include <linux/memory_hotplug.h>
 
@@ -66,22 +65,6 @@ unsigned long pseries_memory_block_size(void)
 }
 
 #ifdef CONFIG_MEMORY_HOTREMOVE
-static int pseries_remove_memory(u64 start, u64 size)
-{
-        int ret;
-
-        /* Remove htab bolted mappings for this section of memory */
-        start = (unsigned long)__va(start);
-        ret = remove_section_mapping(start, start + size);
-
-        /* Ensure all vmalloc mappings are flushed in case they also
-         * hit that section of memory
-         */
-        vm_unmap_aliases();
-
-        return ret;
-}
-
 static int pseries_remove_memblock(unsigned long base, unsigned int memblock_size)
 {
         unsigned long block_sz, start_pfn;
@@ -261,10 +244,6 @@ static int __init pseries_memory_hotplug_init(void)
         if (firmware_has_feature(FW_FEATURE_LPAR))
                 of_reconfig_notifier_register(&pseries_mem_nb);
 
-#ifdef CONFIG_MEMORY_HOTREMOVE
-        ppc_md.remove_memory = pseries_remove_memory;
-#endif
-
         return 0;
 }
 machine_device_initcall(pseries, pseries_memory_hotplug_init);
diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
index 3fda3f17b84e..ccd53f91e8aa 100644
--- a/arch/powerpc/platforms/pseries/hvCall.S
+++ b/arch/powerpc/platforms/pseries/hvCall.S
@@ -18,7 +18,7 @@
         
 #ifdef CONFIG_TRACEPOINTS
 
-#ifndef CONFIG_JUMP_LABEL
+#ifndef HAVE_JUMP_LABEL
         .section        ".toc","aw"
 
         .globl hcall_tracepoint_refcount
@@ -78,7 +78,7 @@ hcall_tracepoint_refcount:
         mr      r5,BUFREG;                                      \
         __HCALL_INST_POSTCALL
 
-#ifdef CONFIG_JUMP_LABEL
+#ifdef HAVE_JUMP_LABEL
 #define HCALL_BRANCH(LABEL)                                     \
         ARCH_STATIC_BRANCH(LABEL, hcall_tracepoint_key)
 #else
diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
index 4575f0c9e521..f02ec3ab428c 100644
--- a/arch/powerpc/platforms/pseries/hvCall_inst.c
+++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
@@ -110,7 +110,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long
         if (opcode > MAX_HCALL_OPCODE)
                 return;
 
-        h = &__get_cpu_var(hcall_stats)[opcode / 4];
+        h = this_cpu_ptr(&hcall_stats[opcode / 4]);
         h->tb_start = mftb();
         h->purr_start = mfspr(SPRN_PURR);
 }
@@ -123,7 +123,7 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long
         if (opcode > MAX_HCALL_OPCODE)
                 return;
 
-        h = &__get_cpu_var(hcall_stats)[opcode / 4];
+        h = this_cpu_ptr(&hcall_stats[opcode / 4]);
         h->num_calls++;
         h->tb_total += mftb() - h->tb_start;
         h->purr_total += mfspr(SPRN_PURR) - h->purr_start;
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 3e5bfdafee63..1d3d52dc3ff3 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -199,7 +199,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
 
         local_irq_save(flags);  /* to protect tcep and the page behind it */
 
-        tcep = __get_cpu_var(tce_page);
+        tcep = __this_cpu_read(tce_page);
 
         /* This is safe to do since interrupts are off when we're called
          * from iommu_alloc{,_sg}()
@@ -212,7 +212,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
                         return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
                                             direction, attrs);
                 }
-                __get_cpu_var(tce_page) = tcep;
+                __this_cpu_write(tce_page, tcep);
         }
 
         rpn = __pa(uaddr) >> TCE_SHIFT;
@@ -398,7 +398,7 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn,
         long l, limit;
 
         local_irq_disable();    /* to protect tcep and the page behind it */
-        tcep = __get_cpu_var(tce_page);
+        tcep = __this_cpu_read(tce_page);
 
         if (!tcep) {
                 tcep = (__be64 *)__get_free_page(GFP_ATOMIC);
@@ -406,7 +406,7 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn,
                         local_irq_enable();
                         return -ENOMEM;
                 }
-                __get_cpu_var(tce_page) = tcep;
+                __this_cpu_write(tce_page, tcep);
         }
 
         proto_tce = TCE_PCI_READ | TCE_PCI_WRITE;
@@ -574,8 +574,7 @@ static void pci_dma_bus_setup_pSeries(struct pci_bus *bus)
         while (isa_dn && isa_dn != dn)
                 isa_dn = isa_dn->parent;
 
-        if (isa_dn_orig)
-                of_node_put(isa_dn_orig);
+        of_node_put(isa_dn_orig);
 
         /* Count number of direct PCI children of the PHB. */
         for (children = 0, tmp = dn->child; tmp; tmp = tmp->sibling)
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index f6880d2a40fb..469751d92004 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -284,7 +284,7 @@ static long pSeries_lpar_hpte_updatepp(unsigned long slot,
                                        unsigned long newpp,
                                        unsigned long vpn,
                                        int psize, int apsize,
-                                       int ssize, int local)
+                                       int ssize, unsigned long inv_flags)
 {
         unsigned long lpar_rc;
         unsigned long flags = (newpp & 7) | H_AVPN;
@@ -442,7 +442,7 @@ static void __pSeries_lpar_hugepage_invalidate(unsigned long *slot,
 static void pSeries_lpar_hugepage_invalidate(unsigned long vsid,
                                              unsigned long addr,
                                              unsigned char *hpte_slot_array,
-                                             int psize, int ssize)
+                                             int psize, int ssize, int local)
 {
         int i, index = 0;
         unsigned long s_addr = addr;
@@ -515,7 +515,7 @@ static void pSeries_lpar_flush_hash_range(unsigned long number, int local)
         unsigned long vpn;
         unsigned long i, pix, rc;
         unsigned long flags = 0;
-        struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
+        struct ppc64_tlb_batch *batch = this_cpu_ptr(&ppc64_tlb_batch);
         int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
         unsigned long param[9];
         unsigned long hash, index, shift, hidx, slot;
@@ -705,7 +705,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
 
         local_irq_save(flags);
 
-        depth = &__get_cpu_var(hcall_trace_depth);
+        depth = this_cpu_ptr(&hcall_trace_depth);
 
         if (*depth)
                 goto out;
@@ -730,7 +730,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval,
 
         local_irq_save(flags);
 
-        depth = &__get_cpu_var(hcall_trace_depth);
+        depth = this_cpu_ptr(&hcall_trace_depth);
 
         if (*depth)
                 goto out;
diff --git a/arch/powerpc/platforms/pseries/nvram.c b/arch/powerpc/platforms/pseries/nvram.c
index 11a3b617ef5d..054a0ed5c7ee 100644
--- a/arch/powerpc/platforms/pseries/nvram.c
+++ b/arch/powerpc/platforms/pseries/nvram.c
@@ -715,6 +715,8 @@ static int nvram_pstore_init(void)
         nvram_pstore_info.buf = oops_data;
         nvram_pstore_info.bufsize = oops_data_sz;
 
+        spin_lock_init(&nvram_pstore_info.buf_lock);
+
         rc = pstore_register(&nvram_pstore_info);
         if (rc != 0)
                 pr_err("nvram: pstore_register() failed, defaults to "
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 67e48594040c..fe16a50700de 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -134,7 +134,7 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
         of_node_put(pdn);
 
         if (rc) {
-                pr_err("no ibm,pcie-link-speed-stats property\n");
+                pr_debug("no ibm,pcie-link-speed-stats property\n");
                 return 0;
         }
 
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 5a4d0fc03b03..c3b2a7e81ddb 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -302,8 +302,8 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
         /* If it isn't an extended log we can use the per cpu 64bit buffer */
         h = (struct rtas_error_log *)&savep[1];
         if (!rtas_error_extended(h)) {
-                memcpy(&__get_cpu_var(mce_data_buf), h, sizeof(__u64));
-                errhdr = (struct rtas_error_log *)&__get_cpu_var(mce_data_buf);
+                memcpy(this_cpu_ptr(&mce_data_buf), h, sizeof(__u64));
+                errhdr = (struct rtas_error_log *)this_cpu_ptr(&mce_data_buf);
         } else {
                 int len, error_log_length;
 
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index ed8a90022a3d..e445b6701f50 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -500,7 +500,11 @@ static void __init pSeries_setup_arch(void)
 
         if (firmware_has_feature(FW_FEATURE_SET_MODE)) {
                 long rc;
-                if ((rc = pSeries_enable_reloc_on_exc()) != H_SUCCESS) {
+
+                rc = pSeries_enable_reloc_on_exc();
+                if (rc == H_P2) {
+                        pr_info("Relocation on exceptions not supported\n");
+                } else if (rc != H_SUCCESS) {
                         pr_warn("Unable to enable relocation on exceptions: "
                                 "%ld\n", rc);
                 }
@@ -660,6 +664,34 @@ static void __init pSeries_init_early(void)
         pr_debug(" <- pSeries_init_early()\n");
 }
 
+/**
+ * pseries_power_off - tell firmware about how to power off the system.
+ *
+ * This function calls either the power-off rtas token in normal cases
+ * or the ibm,power-off-ups token (if present & requested) in case of
+ * a power failure. If power-off token is used, power on will only be
+ * possible with power button press. If ibm,power-off-ups token is used
+ * it will allow auto poweron after power is restored.
+ */
+static void pseries_power_off(void)
+{
+        int rc;
+        int rtas_poweroff_ups_token = rtas_token("ibm,power-off-ups");
+
+        if (rtas_flash_term_hook)
+                rtas_flash_term_hook(SYS_POWER_OFF);
+
+        if (rtas_poweron_auto == 0 ||
+                rtas_poweroff_ups_token == RTAS_UNKNOWN_SERVICE) {
+                rc = rtas_call(rtas_token("power-off"), 2, 1, NULL, -1, -1);
+                printk(KERN_INFO "RTAS power-off returned %d\n", rc);
+        } else {
+                rc = rtas_call(rtas_poweroff_ups_token, 0, 1, NULL);
+                printk(KERN_INFO "RTAS ibm,power-off-ups returned %d\n", rc);
+        }
+        for (;;);
+}
+
 /*
  * Called very early, MMU is off, device-tree isn't unflattened
  */
@@ -742,6 +774,8 @@ static int __init pSeries_probe(void)
         else
                 hpte_init_native();
 
+        pm_power_off = pseries_power_off;
+
         pr_debug("Machine is%s LPAR !\n",
                  (powerpc_firmware_features & FW_FEATURE_LPAR) ? "" : " not");
 
@@ -755,34 +789,6 @@ static int pSeries_pci_probe_mode(struct pci_bus *bus)
         return PCI_PROBE_NORMAL;
 }
 
-/**
- * pSeries_power_off - tell firmware about how to power off the system.
- *
- * This function calls either the power-off rtas token in normal cases
- * or the ibm,power-off-ups token (if present & requested) in case of
- * a power failure. If power-off token is used, power on will only be
- * possible with power button press. If ibm,power-off-ups token is used
- * it will allow auto poweron after power is restored.
- */
-static void pSeries_power_off(void)
-{
-        int rc;
-        int rtas_poweroff_ups_token = rtas_token("ibm,power-off-ups");
-
-        if (rtas_flash_term_hook)
-                rtas_flash_term_hook(SYS_POWER_OFF);
-
-        if (rtas_poweron_auto == 0 ||
-                rtas_poweroff_ups_token == RTAS_UNKNOWN_SERVICE) {
-                rc = rtas_call(rtas_token("power-off"), 2, 1, NULL, -1, -1);
-                printk(KERN_INFO "RTAS power-off returned %d\n", rc);
-        } else {
-                rc = rtas_call(rtas_poweroff_ups_token, 0, 1, NULL);
-                printk(KERN_INFO "RTAS ibm,power-off-ups returned %d\n", rc);
-        }
-        for (;;);
-}
-
 #ifndef CONFIG_PCI
 void pSeries_final_fixup(void) { }
 #endif
@@ -797,7 +803,6 @@ define_machine(pseries) {
         .pcibios_fixup          = pSeries_final_fixup,
         .pci_probe_mode         = pSeries_pci_probe_mode,
         .restart                = rtas_restart,
-        .power_off              = pSeries_power_off,
         .halt                   = rtas_halt,
         .panic                  = rtas_os_term,
         .get_boot_time          = rtas_get_boot_time,
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index 7aed8d0876b7..d09f4fa2c3d1 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -13,7 +13,6 @@
  *
  */
 #include <linux/irq.h>
-#include <linux/bootmem.h>
 #include <linux/msi.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
index 65d2ed4549e6..6455c1eada1a 100644
--- a/arch/powerpc/sysdev/fsl_pci.c
+++ b/arch/powerpc/sysdev/fsl_pci.c
@@ -23,7 +23,6 @@
 #include <linux/string.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
-#include <linux/bootmem.h>
 #include <linux/memblock.h>
 #include <linux/log2.h>
 #include <linux/slab.h>
@@ -152,7 +151,7 @@ static int setup_one_atmu(struct ccsr_pci __iomem *pci,
                 flags |= 0x10000000; /* enable relaxed ordering */
 
         for (i = 0; size > 0; i++) {
-                unsigned int bits = min(ilog2(size),
+                unsigned int bits = min_t(u32, ilog2(size),
                                         __ffs(pci_addr | phys_addr));
 
                 if (index + i >= 5)
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index c04b718307c8..08d60f183dad 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -58,6 +58,19 @@
 #define RIO_ISR_AACR            0x10120
 #define RIO_ISR_AACR_AA         0x1     /* Accept All ID */
 
+#define RIWTAR_TRAD_VAL_SHIFT   12
+#define RIWTAR_TRAD_MASK        0x00FFFFFF
+#define RIWBAR_BADD_VAL_SHIFT   12
+#define RIWBAR_BADD_MASK        0x003FFFFF
+#define RIWAR_ENABLE            0x80000000
+#define RIWAR_TGINT_LOCAL       0x00F00000
+#define RIWAR_RDTYP_NO_SNOOP    0x00040000
+#define RIWAR_RDTYP_SNOOP       0x00050000
+#define RIWAR_WRTYP_NO_SNOOP    0x00004000
+#define RIWAR_WRTYP_SNOOP       0x00005000
+#define RIWAR_WRTYP_ALLOC       0x00006000
+#define RIWAR_SIZE_MASK         0x0000003F
+
 #define __fsl_read_rio_config(x, addr, err, op)         \
         __asm__ __volatile__(                           \
                 "1:     "op" %1,0(%2)\n"                \
@@ -266,6 +279,89 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
         return 0;
 }
 
+static void fsl_rio_inbound_mem_init(struct rio_priv *priv)
+{
+        int i;
+
+        /* close inbound windows */
+        for (i = 0; i < RIO_INB_ATMU_COUNT; i++)
+                out_be32(&priv->inb_atmu_regs[i].riwar, 0);
+}
+
+int fsl_map_inb_mem(struct rio_mport *mport, dma_addr_t lstart,
+        u64 rstart, u32 size, u32 flags)
+{
+        struct rio_priv *priv = mport->priv;
+        u32 base_size;
+        unsigned int base_size_log;
+        u64 win_start, win_end;
+        u32 riwar;
+        int i;
+
+        if ((size & (size - 1)) != 0)
+                return -EINVAL;
+
+        base_size_log = ilog2(size);
+        base_size = 1 << base_size_log;
+
+        /* check if addresses are aligned with the window size */
+        if (lstart & (base_size - 1))
+                return -EINVAL;
+        if (rstart & (base_size - 1))
+                return -EINVAL;
+
+        /* check for conflicting ranges */
+        for (i = 0; i < RIO_INB_ATMU_COUNT; i++) {
+                riwar = in_be32(&priv->inb_atmu_regs[i].riwar);
+                if ((riwar & RIWAR_ENABLE) == 0)
+                        continue;
+                win_start = ((u64)(in_be32(&priv->inb_atmu_regs[i].riwbar) & RIWBAR_BADD_MASK))
+                        << RIWBAR_BADD_VAL_SHIFT;
+                win_end = win_start + ((1 << ((riwar & RIWAR_SIZE_MASK) + 1)) - 1);
+                if (rstart < win_end && (rstart + size) > win_start)
+                        return -EINVAL;
+        }
+
+        /* find unused atmu */
+        for (i = 0; i < RIO_INB_ATMU_COUNT; i++) {
+                riwar = in_be32(&priv->inb_atmu_regs[i].riwar);
+                if ((riwar & RIWAR_ENABLE) == 0)
+                        break;
+        }
+        if (i >= RIO_INB_ATMU_COUNT)
+                return -ENOMEM;
+
+        out_be32(&priv->inb_atmu_regs[i].riwtar, lstart >> RIWTAR_TRAD_VAL_SHIFT);
+        out_be32(&priv->inb_atmu_regs[i].riwbar, rstart >> RIWBAR_BADD_VAL_SHIFT);
+        out_be32(&priv->inb_atmu_regs[i].riwar, RIWAR_ENABLE | RIWAR_TGINT_LOCAL |
+                RIWAR_RDTYP_SNOOP | RIWAR_WRTYP_SNOOP | (base_size_log - 1));
+
+        return 0;
+}
+
+void fsl_unmap_inb_mem(struct rio_mport *mport, dma_addr_t lstart)
+{
+        u32 win_start_shift, base_start_shift;
+        struct rio_priv *priv = mport->priv;
+        u32 riwar, riwtar;
+        int i;
+
+        /* skip default window */
+        base_start_shift = lstart >> RIWTAR_TRAD_VAL_SHIFT;
+        for (i = 0; i < RIO_INB_ATMU_COUNT; i++) {
+                riwar = in_be32(&priv->inb_atmu_regs[i].riwar);
+                if ((riwar & RIWAR_ENABLE) == 0)
+                        continue;
+
+                riwtar = in_be32(&priv->inb_atmu_regs[i].riwtar);
+                win_start_shift = riwtar & RIWTAR_TRAD_MASK;
+                if (win_start_shift == base_start_shift) {
+                        out_be32(&priv->inb_atmu_regs[i].riwar, riwar & ~RIWAR_ENABLE);
+                        return;
+                }
+        }
+}
+
 void fsl_rio_port_error_handler(int offset)
 {
         /*XXX: Error recovery is not implemented, we just clear errors */
@@ -389,6 +485,8 @@ int fsl_rio_setup(struct platform_device *dev)
         ops->add_outb_message = fsl_add_outb_message;
         ops->add_inb_buffer = fsl_add_inb_buffer;
         ops->get_inb_message = fsl_get_inb_message;
+        ops->map_inb = fsl_map_inb_mem;
+        ops->unmap_inb = fsl_unmap_inb_mem;
 
         rmu_node = of_parse_phandle(dev->dev.of_node, "fsl,srio-rmu-handle", 0);
         if (!rmu_node) {
@@ -602,6 +700,11 @@ int fsl_rio_setup(struct platform_device *dev)
                         RIO_ATMU_REGS_PORT2_OFFSET));
 
                 priv->maint_atmu_regs = priv->atmu_regs + 1;
+                priv->inb_atmu_regs = (struct rio_inb_atmu_regs __iomem *)
+                        (priv->regs_win +
+                        ((i == 0) ? RIO_INB_ATMU_REGS_PORT1_OFFSET :
+                        RIO_INB_ATMU_REGS_PORT2_OFFSET));
+
 
                 /* Set to receive any dist ID for serial RapidIO controller. */
                 if (port->phy_type == RIO_PHY_SERIAL)
@@ -620,6 +723,7 @@ int fsl_rio_setup(struct platform_device *dev)
                 rio_law_start = range_start;
 
                 fsl_rio_setup_rmu(port, rmu_np[i]);
+                fsl_rio_inbound_mem_init(priv);
 
                 dbell->mport[i] = port;
 
diff --git a/arch/powerpc/sysdev/fsl_rio.h b/arch/powerpc/sysdev/fsl_rio.h
index ae8e27405a0d..d53407a34f32 100644
--- a/arch/powerpc/sysdev/fsl_rio.h
+++ b/arch/powerpc/sysdev/fsl_rio.h
@@ -50,9 +50,12 @@
 #define RIO_S_DBELL_REGS_OFFSET 0x13400
 #define RIO_S_PW_REGS_OFFSET    0x134e0
 #define RIO_ATMU_REGS_DBELL_OFFSET      0x10C40
+#define RIO_INB_ATMU_REGS_PORT1_OFFSET 0x10d60
+#define RIO_INB_ATMU_REGS_PORT2_OFFSET 0x10f60
 
 #define MAX_MSG_UNIT_NUM        2
 #define MAX_PORT_NUM            4
+#define RIO_INB_ATMU_COUNT      4
 
 struct rio_atmu_regs {
          u32 rowtar;
@@ -63,6 +66,15 @@ struct rio_atmu_regs {
          u32 pad2[3];
 };
 
+struct rio_inb_atmu_regs {
+        u32 riwtar;
+        u32 pad1;
+        u32 riwbar;
+        u32 pad2;
+        u32 riwar;
+        u32 pad3[3];
+};
+
 struct rio_dbell_ring {
         void *virt;
         dma_addr_t phys;
@@ -99,6 +111,7 @@ struct rio_priv {
         void __iomem *regs_win;
         struct rio_atmu_regs __iomem *atmu_regs;
         struct rio_atmu_regs __iomem *maint_atmu_regs;
+        struct rio_inb_atmu_regs __iomem *inb_atmu_regs;
         void __iomem *maint_win;
         void *rmm_handle; /* RapidIO message manager(unit) Handle */
 };
diff --git a/arch/powerpc/sysdev/fsl_soc.c b/arch/powerpc/sysdev/fsl_soc.c
index ffd1169ebaab..99269c041615 100644
--- a/arch/powerpc/sysdev/fsl_soc.c
+++ b/arch/powerpc/sysdev/fsl_soc.c
@@ -197,8 +197,7 @@ static int __init setup_rstcr(void)
         if (!rstcr && ppc_md.restart == fsl_rstcr_restart)
                 printk(KERN_ERR "No RSTCR register, warm reboot won't work\n");
 
-        if (np)
-                of_node_put(np);
+        of_node_put(np);
 
         return 0;
 }
@@ -238,7 +237,7 @@ void fsl_hv_restart(char *cmd)
 /*
  * Halt the current partition
  *
- * This function should be assigned to the ppc_md.power_off and ppc_md.halt
+ * This function should be assigned to the pm_power_off and ppc_md.halt
  * function pointers, to shut down the partition when we're running under
  * the Freescale hypervisor.
  */
diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
index b50f97811c25..b28733727ed3 100644
--- a/arch/powerpc/sysdev/ipic.c
+++ b/arch/powerpc/sysdev/ipic.c
@@ -20,7 +20,6 @@
 #include <linux/signal.h>
 #include <linux/syscore_ops.h>
 #include <linux/device.h>
-#include <linux/bootmem.h>
 #include <linux/spinlock.h>
 #include <linux/fsl_devices.h>
 #include <asm/irq.h>
diff --git a/arch/powerpc/sysdev/mpc5xxx_clocks.c b/arch/powerpc/sysdev/mpc5xxx_clocks.c
index 5492dc5f56f4..f4f0301b9a60 100644
--- a/arch/powerpc/sysdev/mpc5xxx_clocks.c
+++ b/arch/powerpc/sysdev/mpc5xxx_clocks.c
@@ -26,8 +26,7 @@ unsigned long mpc5xxx_get_bus_frequency(struct device_node *node)
                 of_node_put(node);
                 node = np;
         }
-        if (node)
-                of_node_put(node);
+        of_node_put(node);
 
         return p_bus_freq ? *p_bus_freq : 0;
 }
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 89cec0ed6a58..c4648ad5c1f3 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -24,7 +24,6 @@
 #include <linux/irq.h>
 #include <linux/smp.h>
 #include <linux/interrupt.h>
-#include <linux/bootmem.h>
 #include <linux/spinlock.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
diff --git a/arch/powerpc/sysdev/mpic_pasemi_msi.c b/arch/powerpc/sysdev/mpic_pasemi_msi.c
index 45c114bc430b..a3f660eed6de 100644
--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
+++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
@@ -16,7 +16,6 @@
 #undef DEBUG
 
 #include <linux/irq.h>
-#include <linux/bootmem.h>
 #include <linux/msi.h>
 #include <asm/mpic.h>
 #include <asm/prom.h>
diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c
index 0dff1cd44481..b2cef1809389 100644
--- a/arch/powerpc/sysdev/mpic_u3msi.c
+++ b/arch/powerpc/sysdev/mpic_u3msi.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/irq.h>
-#include <linux/bootmem.h>
 #include <linux/msi.h>
 #include <asm/mpic.h>
 #include <asm/prom.h>
diff --git a/arch/powerpc/sysdev/ppc4xx_cpm.c b/arch/powerpc/sysdev/ppc4xx_cpm.c
index 82e2cfe35c62..ba95adf81d8d 100644
--- a/arch/powerpc/sysdev/ppc4xx_cpm.c
+++ b/arch/powerpc/sysdev/ppc4xx_cpm.c
@@ -281,7 +281,7 @@ static int __init cpm_init(void)
                 printk(KERN_ERR "cpm: could not parse dcr property for %s\n",
                        np->full_name);
                 ret = -EINVAL;
-                goto out;
+                goto node_put;
         }
 
         cpm.dcr_host = dcr_map(np, dcr_base, dcr_len);
@@ -290,7 +290,7 @@ static int __init cpm_init(void)
                 printk(KERN_ERR "cpm: failed to map dcr property for %s\n",
                        np->full_name);
                 ret = -EINVAL;
-                goto out;
+                goto node_put;
         }
 
         /* All 4xx SoCs with a CPM controller have one of two
@@ -330,9 +330,9 @@ static int __init cpm_init(void)
 
         if (cpm.standby || cpm.suspend)
                 suspend_set_ops(&cpm_suspend_ops);
+node_put:
+        of_node_put(np);
 out:
-        if (np)
-                of_node_put(np);
         return ret;
 }
 
diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c
index 518eabbe0bdc..5e622c0544c4 100644
--- a/arch/powerpc/sysdev/ppc4xx_msi.c
+++ b/arch/powerpc/sysdev/ppc4xx_msi.c
@@ -22,7 +22,6 @@
  */
 
 #include <linux/irq.h>
-#include <linux/bootmem.h>
 #include <linux/pci.h>
 #include <linux/msi.h>
 #include <linux/of_platform.h>
diff --git a/arch/powerpc/sysdev/ppc4xx_pci.c b/arch/powerpc/sysdev/ppc4xx_pci.c
index df6e2fc4ff92..086aca69ecae 100644
--- a/arch/powerpc/sysdev/ppc4xx_pci.c
+++ b/arch/powerpc/sysdev/ppc4xx_pci.c
@@ -22,7 +22,6 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/of.h>
-#include <linux/bootmem.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
 
diff --git a/arch/powerpc/sysdev/qe_lib/qe.c b/arch/powerpc/sysdev/qe_lib/qe.c
index 238a07b97f2c..b584debbcd9c 100644
--- a/arch/powerpc/sysdev/qe_lib/qe.c
+++ b/arch/powerpc/sysdev/qe_lib/qe.c
@@ -22,7 +22,6 @@
 #include <linux/spinlock.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
-#include <linux/bootmem.h>
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
diff --git a/arch/powerpc/sysdev/qe_lib/qe_ic.c b/arch/powerpc/sysdev/qe_lib/qe_ic.c
index b2b87c30e266..543765e1ef14 100644
--- a/arch/powerpc/sysdev/qe_lib/qe_ic.c
+++ b/arch/powerpc/sysdev/qe_lib/qe_ic.c
@@ -23,7 +23,6 @@
 #include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/device.h>
-#include <linux/bootmem.h>
 #include <linux/spinlock.h>
 #include <asm/irq.h>
 #include <asm/io.h>
diff --git a/arch/powerpc/sysdev/uic.c b/arch/powerpc/sysdev/uic.c
index 92033936a8f7..7c37157d4c24 100644
--- a/arch/powerpc/sysdev/uic.c
+++ b/arch/powerpc/sysdev/uic.c
@@ -19,7 +19,6 @@
 #include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/device.h>
-#include <linux/bootmem.h>
 #include <linux/spinlock.h>
 #include <linux/irq.h>
 #include <linux/interrupt.h>
diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c
index fe0cca477164..365249cd346b 100644
--- a/arch/powerpc/sysdev/xics/xics-common.c
+++ b/arch/powerpc/sysdev/xics/xics-common.c
@@ -155,7 +155,7 @@ int __init xics_smp_probe(void)
 
 void xics_teardown_cpu(void)
 {
-        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
+        struct xics_cppr *os_cppr = this_cpu_ptr(&xics_cppr);
 
         /*
          * we have to reset the cppr index to 0 because we're
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index c8efbb37d6e0..5b150f0c5df9 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -51,6 +51,12 @@
 #include <asm/paca.h>
 #endif
 
+#if defined(CONFIG_PPC_SPLPAR)
+#include <asm/plpar_wrappers.h>
+#else
+static inline long plapr_set_ciabr(unsigned long ciabr) {return 0; };
+#endif
+
 #include "nonstdio.h"
 #include "dis-asm.h"
 
@@ -88,10 +94,9 @@ struct bpt {
 };
 
 /* Bits in bpt.enabled */
-#define BP_IABR_TE      1               /* IABR translation enabled */
-#define BP_IABR         2
-#define BP_TRAP         8
-#define BP_DABR         0x10
+#define BP_CIABR        1
+#define BP_TRAP         2
+#define BP_DABR         4
 
 #define NBPTS   256
 static struct bpt bpts[NBPTS];
@@ -270,6 +275,45 @@ static inline void cinval(void *p)
         asm volatile ("dcbi 0,%0; icbi 0,%0" : : "r" (p));
 }
 
+/**
+ * write_ciabr() - write the CIABR SPR
+ * @ciabr:      The value to write.
+ *
+ * This function writes a value to the CIARB register either directly
+ * through mtspr instruction if the kernel is in HV privilege mode or
+ * call a hypervisor function to achieve the same in case the kernel
+ * is in supervisor privilege mode.
+ */
+static void write_ciabr(unsigned long ciabr)
+{
+        if (!cpu_has_feature(CPU_FTR_ARCH_207S))
+                return;
+
+        if (cpu_has_feature(CPU_FTR_HVMODE)) {
+                mtspr(SPRN_CIABR, ciabr);
+                return;
+        }
+        plapr_set_ciabr(ciabr);
+}
+
+/**
+ * set_ciabr() - set the CIABR
+ * @addr:       The value to set.
+ *
+ * This function sets the correct privilege value into the the HW
+ * breakpoint address before writing it up in the CIABR register.
+ */
+static void set_ciabr(unsigned long addr)
+{
+        addr &= ~CIABR_PRIV;
+
+        if (cpu_has_feature(CPU_FTR_HVMODE))
+                addr |= CIABR_PRIV_HYPER;
+        else
+                addr |= CIABR_PRIV_SUPER;
+        write_ciabr(addr);
+}
+
 /*
  * Disable surveillance (the service processor watchdog function)
  * while we are in xmon.
@@ -727,7 +771,7 @@ static void insert_bpts(void)
 
         bp = bpts;
         for (i = 0; i < NBPTS; ++i, ++bp) {
-                if ((bp->enabled & (BP_TRAP|BP_IABR)) == 0)
+                if ((bp->enabled & (BP_TRAP|BP_CIABR)) == 0)
                         continue;
                 if (mread(bp->address, &bp->instr[0], 4) != 4) {
                         printf("Couldn't read instruction at %lx, "
@@ -742,7 +786,7 @@ static void insert_bpts(void)
                         continue;
                 }
                 store_inst(&bp->instr[0]);
-                if (bp->enabled & BP_IABR)
+                if (bp->enabled & BP_CIABR)
                         continue;
                 if (mwrite(bp->address, &bpinstr, 4) != 4) {
                         printf("Couldn't write instruction at %lx, "
@@ -764,9 +808,9 @@ static void insert_cpu_bpts(void)
                 brk.len = 8;
                 __set_breakpoint(&brk);
         }
-        if (iabr && cpu_has_feature(CPU_FTR_IABR))
-                mtspr(SPRN_IABR, iabr->address
-                         | (iabr->enabled & (BP_IABR|BP_IABR_TE)));
+
+        if (iabr)
+                set_ciabr(iabr->address);
 }
 
 static void remove_bpts(void)
@@ -777,7 +821,7 @@ static void remove_bpts(void)
 
         bp = bpts;
         for (i = 0; i < NBPTS; ++i, ++bp) {
-                if ((bp->enabled & (BP_TRAP|BP_IABR)) != BP_TRAP)
+                if ((bp->enabled & (BP_TRAP|BP_CIABR)) != BP_TRAP)
                         continue;
                 if (mread(bp->address, &instr, 4) == 4
                     && instr == bpinstr
@@ -792,8 +836,7 @@ static void remove_bpts(void)
 static void remove_cpu_bpts(void)
 {
         hw_breakpoint_disable();
-        if (cpu_has_feature(CPU_FTR_IABR))
-                mtspr(SPRN_IABR, 0);
+        write_ciabr(0);
 }
 
 /* Command interpreting routine */
@@ -907,7 +950,7 @@ cmds(struct pt_regs *excp)
                 case 'u':
                         dump_segments();
                         break;
-#elif defined(CONFIG_4xx)
+#elif defined(CONFIG_44x)
                 case 'u':
                         dump_tlb_44x();
                         break;
@@ -981,7 +1024,8 @@ static void bootcmds(void)
         else if (cmd == 'h')
                 ppc_md.halt();
         else if (cmd == 'p')
-                ppc_md.power_off();
+                if (pm_power_off)
+                        pm_power_off();
 }
 
 static int cpu_cmd(void)
@@ -1127,7 +1171,7 @@ static char *breakpoint_help_string =
     "b <addr> [cnt]   set breakpoint at given instr addr\n"
     "bc               clear all breakpoints\n"
     "bc <n/addr>      clear breakpoint number n or at addr\n"
-    "bi <addr> [cnt]  set hardware instr breakpoint (POWER3/RS64 only)\n"
+    "bi <addr> [cnt]  set hardware instr breakpoint (POWER8 only)\n"
     "bd <addr> [cnt]  set hardware data breakpoint\n"
     "";
 
@@ -1166,13 +1210,13 @@ bpt_cmds(void)
                 break;
 
         case 'i':       /* bi - hardware instr breakpoint */
-                if (!cpu_has_feature(CPU_FTR_IABR)) {
+                if (!cpu_has_feature(CPU_FTR_ARCH_207S)) {
                         printf("Hardware instruction breakpoint "
                                "not supported on this cpu\n");
                         break;
                 }
                 if (iabr) {
-                        iabr->enabled &= ~(BP_IABR | BP_IABR_TE);
+                        iabr->enabled &= ~BP_CIABR;
                         iabr = NULL;
                 }
                 if (!scanhex(&a))
@@ -1181,7 +1225,7 @@ bpt_cmds(void)
                         break;
                 bp = new_breakpoint(a);
                 if (bp != NULL) {
-                        bp->enabled |= BP_IABR | BP_IABR_TE;
+                        bp->enabled |= BP_CIABR;
                         iabr = bp;
                 }
                 break;
@@ -1238,7 +1282,7 @@ bpt_cmds(void)
                                 if (!bp->enabled)
                                         continue;
                                 printf("%2x %s   ", BP_NUM(bp),
-                                    (bp->enabled & BP_IABR)? "inst": "trap");
+                                    (bp->enabled & BP_CIABR) ? "inst": "trap");
                                 xmon_print_symbol(bp->address, "  ", "\n");
                         }
                         break;
diff --git a/arch/s390/include/asm/cmpxchg.h b/arch/s390/include/asm/cmpxchg.h
index 4236408070e5..6259895fcd97 100644
--- a/arch/s390/include/asm/cmpxchg.h
+++ b/arch/s390/include/asm/cmpxchg.h
@@ -11,200 +11,28 @@
 #include <linux/types.h>
 #include <linux/bug.h>
 
-extern void __xchg_called_with_bad_pointer(void);
-
-static inline unsigned long __xchg(unsigned long x, void *ptr, int size)
-{
-        unsigned long addr, old;
-        int shift;
-
-        switch (size) {
-        case 1:
-                addr = (unsigned long) ptr;
-                shift = (3 ^ (addr & 3)) << 3;
-                addr ^= addr & 3;
-                asm volatile(
-                        "       l       %0,%4\n"
-                        "0:     lr      0,%0\n"
-                        "       nr      0,%3\n"
-                        "       or      0,%2\n"
-                        "       cs      %0,0,%4\n"
-                        "       jl      0b\n"
-                        : "=&d" (old), "=Q" (*(int *) addr)
-                        : "d" ((x & 0xff) << shift), "d" (~(0xff << shift)),
-                          "Q" (*(int *) addr) : "memory", "cc", "0");
-                return old >> shift;
-        case 2:
-                addr = (unsigned long) ptr;
-                shift = (2 ^ (addr & 2)) << 3;
-                addr ^= addr & 2;
-                asm volatile(
-                        "       l       %0,%4\n"
-                        "0:     lr      0,%0\n"
-                        "       nr      0,%3\n"
-                        "       or      0,%2\n"
-                        "       cs      %0,0,%4\n"
-                        "       jl      0b\n"
-                        : "=&d" (old), "=Q" (*(int *) addr)
-                        : "d" ((x & 0xffff) << shift), "d" (~(0xffff << shift)),
-                          "Q" (*(int *) addr) : "memory", "cc", "0");
-                return old >> shift;
-        case 4:
-                asm volatile(
-                        "       l       %0,%3\n"
-                        "0:     cs      %0,%2,%3\n"
-                        "       jl      0b\n"
-                        : "=&d" (old), "=Q" (*(int *) ptr)
-                        : "d" (x), "Q" (*(int *) ptr)
-                        : "memory", "cc");
-                return old;
-#ifdef CONFIG_64BIT
-        case 8:
-                asm volatile(
-                        "       lg      %0,%3\n"
-                        "0:     csg     %0,%2,%3\n"
-                        "       jl      0b\n"
-                        : "=&d" (old), "=m" (*(long *) ptr)
-                        : "d" (x), "Q" (*(long *) ptr)
-                        : "memory", "cc");
-                return old;
-#endif /* CONFIG_64BIT */
-        }
-        __xchg_called_with_bad_pointer();
-        return x;
-}
-
-#define xchg(ptr, x)                                                      \
-({                                                                        \
-        __typeof__(*(ptr)) __ret;                                         \
-        __ret = (__typeof__(*(ptr)))                                      \
-                __xchg((unsigned long)(x), (void *)(ptr), sizeof(*(ptr)));\
-        __ret;                                                            \
+#define cmpxchg(ptr, o, n)                                              \
+({                                                                      \
+        __typeof__(*(ptr)) __o = (o);                                   \
+        __typeof__(*(ptr)) __n = (n);                                   \
+        (__typeof__(*(ptr))) __sync_val_compare_and_swap((ptr),__o,__n);\
 })
 
-/*
- * Atomic compare and exchange.  Compare OLD with MEM, if identical,
- * store NEW in MEM.  Return the initial value in MEM.  Success is
- * indicated by comparing RETURN with OLD.
- */
-
-#define __HAVE_ARCH_CMPXCHG
-
-extern void __cmpxchg_called_with_bad_pointer(void);
-
-static inline unsigned long __cmpxchg(void *ptr, unsigned long old,
-                                      unsigned long new, int size)
-{
-        unsigned long addr, prev, tmp;
-        int shift;
-
-        switch (size) {
-        case 1:
-                addr = (unsigned long) ptr;
-                shift = (3 ^ (addr & 3)) << 3;
-                addr ^= addr & 3;
-                asm volatile(
-                        "       l       %0,%2\n"
-                        "0:     nr      %0,%5\n"
-                        "       lr      %1,%0\n"
-                        "       or      %0,%3\n"
-                        "       or      %1,%4\n"
-                        "       cs      %0,%1,%2\n"
-                        "       jnl     1f\n"
-                        "       xr      %1,%0\n"
-                        "       nr      %1,%5\n"
-                        "       jnz     0b\n"
-                        "1:"
-                        : "=&d" (prev), "=&d" (tmp), "+Q" (*(int *) addr)
-                        : "d" ((old & 0xff) << shift),
-                          "d" ((new & 0xff) << shift),
-                          "d" (~(0xff << shift))
-                        : "memory", "cc");
-                return prev >> shift;
-        case 2:
-                addr = (unsigned long) ptr;
-                shift = (2 ^ (addr & 2)) << 3;
-                addr ^= addr & 2;
-                asm volatile(
-                        "       l       %0,%2\n"
-                        "0:     nr      %0,%5\n"
-                        "       lr      %1,%0\n"
-                        "       or      %0,%3\n"
-                        "       or      %1,%4\n"
-                        "       cs      %0,%1,%2\n"
-                        "       jnl     1f\n"
-                        "       xr      %1,%0\n"
-                        "       nr      %1,%5\n"
-                        "       jnz     0b\n"
-                        "1:"
-                        : "=&d" (prev), "=&d" (tmp), "+Q" (*(int *) addr)
-                        : "d" ((old & 0xffff) << shift),
-                          "d" ((new & 0xffff) << shift),
-                          "d" (~(0xffff << shift))
-                        : "memory", "cc");
-                return prev >> shift;
-        case 4:
-                asm volatile(
-                        "       cs      %0,%3,%1\n"
-                        : "=&d" (prev), "=Q" (*(int *) ptr)
-                        : "0" (old), "d" (new), "Q" (*(int *) ptr)
-                        : "memory", "cc");
-                return prev;
-#ifdef CONFIG_64BIT
-        case 8:
-                asm volatile(
-                        "       csg     %0,%3,%1\n"
-                        : "=&d" (prev), "=Q" (*(long *) ptr)
-                        : "0" (old), "d" (new), "Q" (*(long *) ptr)
-                        : "memory", "cc");
-                return prev;
-#endif /* CONFIG_64BIT */
-        }
-        __cmpxchg_called_with_bad_pointer();
-        return old;
-}
-
-#define cmpxchg(ptr, o, n)                                               \
-({                                                                       \
-        __typeof__(*(ptr)) __ret;                                        \
-        __ret = (__typeof__(*(ptr)))                                     \
-                __cmpxchg((ptr), (unsigned long)(o), (unsigned long)(n), \
-                          sizeof(*(ptr)));                               \
-        __ret;                                                           \
-})
+#define cmpxchg64       cmpxchg
+#define cmpxchg_local   cmpxchg
+#define cmpxchg64_local cmpxchg
 
-#ifdef CONFIG_64BIT
-#define cmpxchg64(ptr, o, n)                                            \
+#define xchg(ptr, x)                                                    \
 ({                                                                      \
-        cmpxchg((ptr), (o), (n));                                       \
+        __typeof__(ptr) __ptr = (ptr);                                  \
+        __typeof__(*(ptr)) __old;                                       \
+        do {                                                            \
+                __old = *__ptr;                                         \
+        } while (!__sync_bool_compare_and_swap(__ptr, __old, x));       \
+        __old;                                                          \
 })
-#else /* CONFIG_64BIT */
-static inline unsigned long long __cmpxchg64(void *ptr,
-                                             unsigned long long old,
-                                             unsigned long long new)
-{
-        register_pair rp_old = {.pair = old};
-        register_pair rp_new = {.pair = new};
-        unsigned long long *ullptr = ptr;
 
-        asm volatile(
-                "       cds     %0,%2,%1"
-                : "+d" (rp_old), "+Q" (*ullptr)
-                : "d" (rp_new)
-                : "memory", "cc");
-        return rp_old.pair;
-}
-
-#define cmpxchg64(ptr, o, n)                            \
-({                                                      \
-        __typeof__(*(ptr)) __ret;                       \
-        __ret = (__typeof__(*(ptr)))                    \
-                __cmpxchg64((ptr),                      \
-                            (unsigned long long)(o),    \
-                            (unsigned long long)(n));   \
-        __ret;                                          \
-})
-#endif /* CONFIG_64BIT */
+#define __HAVE_ARCH_CMPXCHG
 
 #define __cmpxchg_double_op(p1, p2, o1, o2, n1, n2, insn)               \
 ({                                                                      \
@@ -265,40 +93,4 @@ extern void __cmpxchg_double_called_with_bad_pointer(void);
 
 #define system_has_cmpxchg_double()     1
 
-#include <asm-generic/cmpxchg-local.h>
-
-static inline unsigned long __cmpxchg_local(void *ptr,
-                                            unsigned long old,
-                                            unsigned long new, int size)
-{
-        switch (size) {
-        case 1:
-        case 2:
-        case 4:
-#ifdef CONFIG_64BIT
-        case 8:
-#endif
-                return __cmpxchg(ptr, old, new, size);
-        default:
-                return __cmpxchg_local_generic(ptr, old, new, size);
-        }
-
-        return old;
-}
-
-/*
- * cmpxchg_local and cmpxchg64_local are atomic wrt current CPU. Always make
- * them available.
- */
-#define cmpxchg_local(ptr, o, n)                                        \
-({                                                                      \
-        __typeof__(*(ptr)) __ret;                                       \
-        __ret = (__typeof__(*(ptr)))                                    \
-                __cmpxchg_local((ptr), (unsigned long)(o),              \
-                                (unsigned long)(n), sizeof(*(ptr)));    \
-        __ret;                                                          \
-})
-
-#define cmpxchg64_local(ptr, o, n)      cmpxchg64((ptr), (o), (n))
-
 #endif /* __ASM_CMPXCHG_H */
diff --git a/arch/s390/include/asm/cputime.h b/arch/s390/include/asm/cputime.h
index f8c196984853..b91e960e4045 100644
--- a/arch/s390/include/asm/cputime.h
+++ b/arch/s390/include/asm/cputime.h
@@ -10,6 +10,8 @@
 #include <linux/types.h>
 #include <asm/div64.h>
 
+#define CPUTIME_PER_USEC 4096ULL
+#define CPUTIME_PER_SEC (CPUTIME_PER_USEC * USEC_PER_SEC)
 
 /* We want to use full resolution of the CPU timer: 2**-12 micro-seconds. */
 
@@ -38,24 +40,24 @@ static inline unsigned long __div(unsigned long long n, unsigned long base)
  */
 static inline unsigned long cputime_to_jiffies(const cputime_t cputime)
 {
-        return __div((__force unsigned long long) cputime, 4096000000ULL / HZ);
+        return __div((__force unsigned long long) cputime, CPUTIME_PER_SEC / HZ);
 }
 
 static inline cputime_t jiffies_to_cputime(const unsigned int jif)
 {
-        return (__force cputime_t)(jif * (4096000000ULL / HZ));
+        return (__force cputime_t)(jif * (CPUTIME_PER_SEC / HZ));
 }
 
 static inline u64 cputime64_to_jiffies64(cputime64_t cputime)
 {
         unsigned long long jif = (__force unsigned long long) cputime;
-        do_div(jif, 4096000000ULL / HZ);
+        do_div(jif, CPUTIME_PER_SEC / HZ);
         return jif;
 }
 
 static inline cputime64_t jiffies64_to_cputime64(const u64 jif)
 {
-        return (__force cputime64_t)(jif * (4096000000ULL / HZ));
+        return (__force cputime64_t)(jif * (CPUTIME_PER_SEC / HZ));
 }
 
 /*
@@ -68,7 +70,7 @@ static inline unsigned int cputime_to_usecs(const cputime_t cputime)
 
 static inline cputime_t usecs_to_cputime(const unsigned int m)
 {
-        return (__force cputime_t)(m * 4096ULL);
+        return (__force cputime_t)(m * CPUTIME_PER_USEC);
 }
 
 #define usecs_to_cputime64(m)           usecs_to_cputime(m)
@@ -78,12 +80,12 @@ static inline cputime_t usecs_to_cputime(const unsigned int m)
  */
 static inline unsigned int cputime_to_secs(const cputime_t cputime)
 {
-        return __div((__force unsigned long long) cputime, 2048000000) >> 1;
+        return __div((__force unsigned long long) cputime, CPUTIME_PER_SEC / 2) >> 1;
 }
 
 static inline cputime_t secs_to_cputime(const unsigned int s)
 {
-        return (__force cputime_t)(s * 4096000000ULL);
+        return (__force cputime_t)(s * CPUTIME_PER_SEC);
 }
 
 /*
@@ -91,8 +93,8 @@ static inline cputime_t secs_to_cputime(const unsigned int s)
  */
 static inline cputime_t timespec_to_cputime(const struct timespec *value)
 {
-        unsigned long long ret = value->tv_sec * 4096000000ULL;
-        return (__force cputime_t)(ret + value->tv_nsec * 4096 / 1000);
+        unsigned long long ret = value->tv_sec * CPUTIME_PER_SEC;
+        return (__force cputime_t)(ret + __div(value->tv_nsec * CPUTIME_PER_USEC, NSEC_PER_USEC));
 }
 
 static inline void cputime_to_timespec(const cputime_t cputime,
@@ -103,12 +105,12 @@ static inline void cputime_to_timespec(const cputime_t cputime,
         register_pair rp;
 
         rp.pair = __cputime >> 1;
-        asm ("dr %0,%1" : "+d" (rp) : "d" (2048000000UL));
-        value->tv_nsec = rp.subreg.even * 1000 / 4096;
+        asm ("dr %0,%1" : "+d" (rp) : "d" (CPUTIME_PER_SEC / 2));
+        value->tv_nsec = rp.subreg.even * NSEC_PER_USEC / CPUTIME_PER_USEC;
         value->tv_sec = rp.subreg.odd;
 #else
-        value->tv_nsec = (__cputime % 4096000000ULL) * 1000 / 4096;
-        value->tv_sec = __cputime / 4096000000ULL;
+        value->tv_nsec = (__cputime % CPUTIME_PER_SEC) * NSEC_PER_USEC / CPUTIME_PER_USEC;
+        value->tv_sec = __cputime / CPUTIME_PER_SEC;
 #endif
 }
 
@@ -119,8 +121,8 @@ static inline void cputime_to_timespec(const cputime_t cputime,
  */
 static inline cputime_t timeval_to_cputime(const struct timeval *value)
 {
-        unsigned long long ret = value->tv_sec * 4096000000ULL;
-        return (__force cputime_t)(ret + value->tv_usec * 4096ULL);
+        unsigned long long ret = value->tv_sec * CPUTIME_PER_SEC;
+        return (__force cputime_t)(ret + value->tv_usec * CPUTIME_PER_USEC);
 }
 
 static inline void cputime_to_timeval(const cputime_t cputime,
@@ -131,12 +133,12 @@ static inline void cputime_to_timeval(const cputime_t cputime,
         register_pair rp;
 
         rp.pair = __cputime >> 1;
-        asm ("dr %0,%1" : "+d" (rp) : "d" (2048000000UL));
-        value->tv_usec = rp.subreg.even / 4096;
+        asm ("dr %0,%1" : "+d" (rp) : "d" (CPUTIME_PER_USEC / 2));
+        value->tv_usec = rp.subreg.even / CPUTIME_PER_USEC;
         value->tv_sec = rp.subreg.odd;
 #else
-        value->tv_usec = (__cputime % 4096000000ULL) / 4096;
-        value->tv_sec = __cputime / 4096000000ULL;
+        value->tv_usec = (__cputime % CPUTIME_PER_SEC) / CPUTIME_PER_USEC;
+        value->tv_sec = __cputime / CPUTIME_PER_SEC;
 #endif
 }
 
@@ -146,13 +148,13 @@ static inline void cputime_to_timeval(const cputime_t cputime,
 static inline clock_t cputime_to_clock_t(cputime_t cputime)
 {
         unsigned long long clock = (__force unsigned long long) cputime;
-        do_div(clock, 4096000000ULL / USER_HZ);
+        do_div(clock, CPUTIME_PER_SEC / USER_HZ);
         return clock;
 }
 
 static inline cputime_t clock_t_to_cputime(unsigned long x)
 {
-        return (__force cputime_t)(x * (4096000000ULL / USER_HZ));
+        return (__force cputime_t)(x * (CPUTIME_PER_SEC / USER_HZ));
 }
 
 /*
@@ -161,7 +163,7 @@ static inline cputime_t clock_t_to_cputime(unsigned long x)
 static inline clock_t cputime64_to_clock_t(cputime64_t cputime)
 {
         unsigned long long clock = (__force unsigned long long) cputime;
-        do_div(clock, 4096000000ULL / USER_HZ);
+        do_div(clock, CPUTIME_PER_SEC / USER_HZ);
         return clock;
 }
 
diff --git a/arch/s390/include/asm/debug.h b/arch/s390/include/asm/debug.h
index 530c15eb01e9..0206c8052328 100644
--- a/arch/s390/include/asm/debug.h
+++ b/arch/s390/include/asm/debug.h
@@ -151,9 +151,21 @@ debug_text_event(debug_info_t* id, int level, const char* txt)
  * stored in the s390dbf. See Documentation/s390/s390dbf.txt for more details!
  */
 extern debug_entry_t *
-debug_sprintf_event(debug_info_t* id,int level,char *string,...)
+__debug_sprintf_event(debug_info_t *id, int level, char *string, ...)
         __attribute__ ((format(printf, 3, 4)));
 
+#define debug_sprintf_event(_id, _level, _fmt, ...)                     \
+({                                                                      \
+        debug_entry_t *__ret;                                           \
+        debug_info_t *__id = _id;                                       \
+        int __level = _level;                                           \
+        if ((!__id) || (__level > __id->level))                         \
+                __ret = NULL;                                           \
+        else                                                            \
+                __ret = __debug_sprintf_event(__id, __level,            \
+                                              _fmt, ## __VA_ARGS__);    \
+        __ret;                                                          \
+})
 
 static inline debug_entry_t*
 debug_exception(debug_info_t* id, int level, void* data, int length)
@@ -194,9 +206,22 @@ debug_text_exception(debug_info_t* id, int level, const char* txt)
  * stored in the s390dbf. See Documentation/s390/s390dbf.txt for more details!
  */
 extern debug_entry_t *
-debug_sprintf_exception(debug_info_t* id,int level,char *string,...)
+__debug_sprintf_exception(debug_info_t *id, int level, char *string, ...)
         __attribute__ ((format(printf, 3, 4)));
 
+#define debug_sprintf_exception(_id, _level, _fmt, ...)                 \
+({                                                                      \
+        debug_entry_t *__ret;                                           \
+        debug_info_t *__id = _id;                                       \
+        int __level = _level;                                           \
+        if ((!__id) || (__level > __id->level))                         \
+                __ret = NULL;                                           \
+        else                                                            \
+                __ret = __debug_sprintf_exception(__id, __level,        \
+                                                  _fmt, ## __VA_ARGS__);\
+        __ret;                                                          \
+})
+
 int debug_register_view(debug_info_t* id, struct debug_view* view);
 int debug_unregister_view(debug_info_t* id, struct debug_view* view);
 
diff --git a/arch/s390/include/asm/ftrace.h b/arch/s390/include/asm/ftrace.h
index 3aef8afec336..abb618f1ead2 100644
--- a/arch/s390/include/asm/ftrace.h
+++ b/arch/s390/include/asm/ftrace.h
@@ -1,25 +1,69 @@
 #ifndef _ASM_S390_FTRACE_H
 #define _ASM_S390_FTRACE_H
 
+#define ARCH_SUPPORTS_FTRACE_OPS 1
+
+#define MCOUNT_INSN_SIZE        24
+#define MCOUNT_RETURN_FIXUP     18
+
 #ifndef __ASSEMBLY__
 
-extern void _mcount(void);
+#define ftrace_return_address(n) __builtin_return_address(n)
+
+void _mcount(void);
+void ftrace_caller(void);
+
 extern char ftrace_graph_caller_end;
+extern unsigned long ftrace_plt;
 
 struct dyn_arch_ftrace { };
 
-#define MCOUNT_ADDR ((long)_mcount)
+#define MCOUNT_ADDR ((unsigned long)_mcount)
+#define FTRACE_ADDR ((unsigned long)ftrace_caller)
 
+#define KPROBE_ON_FTRACE_NOP    0
+#define KPROBE_ON_FTRACE_CALL   1
 
 static inline unsigned long ftrace_call_adjust(unsigned long addr)
 {
         return addr;
 }
 
-#endif /* __ASSEMBLY__ */
+struct ftrace_insn {
+        u16 opc;
+        s32 disp;
+} __packed;
+
+static inline void ftrace_generate_nop_insn(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_FUNCTION_TRACER
+        /* jg .+24 */
+        insn->opc = 0xc0f4;
+        insn->disp = MCOUNT_INSN_SIZE / 2;
+#endif
+}
 
-#define MCOUNT_INSN_SIZE  18
+static inline int is_ftrace_nop(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_FUNCTION_TRACER
+        if (insn->disp == MCOUNT_INSN_SIZE / 2)
+                return 1;
+#endif
+        return 0;
+}
 
-#define ARCH_SUPPORTS_FTRACE_OPS 1
+static inline void ftrace_generate_call_insn(struct ftrace_insn *insn,
+                                             unsigned long ip)
+{
+#ifdef CONFIG_FUNCTION_TRACER
+        unsigned long target;
+
+        /* brasl r0,ftrace_caller */
+        target = is_module_addr((void *) ip) ? ftrace_plt : FTRACE_ADDR;
+        insn->opc = 0xc005;
+        insn->disp = (target - ip) / 2;
+#endif
+}
 
+#endif /* __ASSEMBLY__ */
 #endif /* _ASM_S390_FTRACE_H */
diff --git a/arch/s390/include/asm/idle.h b/arch/s390/include/asm/idle.h
index 6af037f574b8..113cd963dbbe 100644
--- a/arch/s390/include/asm/idle.h
+++ b/arch/s390/include/asm/idle.h
@@ -9,9 +9,10 @@
 
 #include <linux/types.h>
 #include <linux/device.h>
+#include <linux/seqlock.h>
 
 struct s390_idle_data {
-        unsigned int sequence;
+        seqcount_t seqcount;
         unsigned long long idle_count;
         unsigned long long idle_time;
         unsigned long long clock_idle_enter;
diff --git a/arch/s390/include/asm/io.h b/arch/s390/include/asm/io.h
index 6ad9013c67e7..30fd5c84680e 100644
--- a/arch/s390/include/asm/io.h
+++ b/arch/s390/include/asm/io.h
@@ -39,6 +39,15 @@ static inline void iounmap(volatile void __iomem *addr)
 {
 }
 
+static inline void __iomem *ioport_map(unsigned long port, unsigned int nr)
+{
+        return NULL;
+}
+
+static inline void ioport_unmap(void __iomem *p)
+{
+}
+
 /*
  * s390 needs a private implementation of pci_iomap since ioremap with its
  * offset parameter isn't sufficient. That's because BAR spaces are not
diff --git a/arch/s390/include/asm/irq.h b/arch/s390/include/asm/irq.h
index b0d5f0a97a01..343ea7c987aa 100644
--- a/arch/s390/include/asm/irq.h
+++ b/arch/s390/include/asm/irq.h
@@ -1,11 +1,11 @@
 #ifndef _ASM_IRQ_H
 #define _ASM_IRQ_H
 
-#define EXT_INTERRUPT   1
-#define IO_INTERRUPT    2
-#define THIN_INTERRUPT  3
+#define EXT_INTERRUPT   0
+#define IO_INTERRUPT    1
+#define THIN_INTERRUPT  2
 
-#define NR_IRQS_BASE    4
+#define NR_IRQS_BASE    3
 
 #ifdef CONFIG_PCI_NR_MSI
 # define NR_IRQS        (NR_IRQS_BASE + CONFIG_PCI_NR_MSI)
@@ -13,9 +13,6 @@
 # define NR_IRQS        NR_IRQS_BASE
 #endif
 
-/* This number is used when no interrupt has been assigned */
-#define NO_IRQ          0
-
 /* External interruption codes */
 #define EXT_IRQ_INTERRUPT_KEY   0x0040
 #define EXT_IRQ_CLK_COMP        0x1004
diff --git a/arch/s390/include/asm/kprobes.h b/arch/s390/include/asm/kprobes.h
index 98629173ce3b..b47ad3b642cc 100644
--- a/arch/s390/include/asm/kprobes.h
+++ b/arch/s390/include/asm/kprobes.h
@@ -60,6 +60,7 @@ typedef u16 kprobe_opcode_t;
 struct arch_specific_insn {
         /* copy of original instruction */
         kprobe_opcode_t *insn;
+        unsigned int is_ftrace_insn : 1;
 };
 
 struct prev_kprobe {
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index 6cc51fe84410..34fbcac61133 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -147,7 +147,7 @@ struct _lowcore {
         __u32   softirq_pending;                /* 0x02ec */
         __u32   percpu_offset;                  /* 0x02f0 */
         __u32   machine_flags;                  /* 0x02f4 */
-        __u32   ftrace_func;                    /* 0x02f8 */
+        __u8    pad_0x02f8[0x02fc-0x02f8];      /* 0x02f8 */
         __u32   spinlock_lockval;               /* 0x02fc */
 
         __u8    pad_0x0300[0x0e00-0x0300];      /* 0x0300 */
@@ -297,7 +297,7 @@ struct _lowcore {
         __u64   percpu_offset;                  /* 0x0378 */
         __u64   vdso_per_cpu_data;              /* 0x0380 */
         __u64   machine_flags;                  /* 0x0388 */
-        __u64   ftrace_func;                    /* 0x0390 */
+        __u8    pad_0x0390[0x0398-0x0390];      /* 0x0390 */
         __u64   gmap;                           /* 0x0398 */
         __u32   spinlock_lockval;               /* 0x03a0 */
         __u8    pad_0x03a0[0x0400-0x03a4];      /* 0x03a4 */
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index c030900320e0..ef803c202d42 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -50,10 +50,6 @@ struct zpci_fmb {
         atomic64_t unmapped_pages;
 } __packed __aligned(16);
 
-#define ZPCI_MSI_VEC_BITS       11
-#define ZPCI_MSI_VEC_MAX        (1 << ZPCI_MSI_VEC_BITS)
-#define ZPCI_MSI_VEC_MASK       (ZPCI_MSI_VEC_MAX - 1)
-
 enum zpci_state {
         ZPCI_FN_STATE_RESERVED,
         ZPCI_FN_STATE_STANDBY,
@@ -90,6 +86,7 @@ struct zpci_dev {
 
         /* IRQ stuff */
         u64             msi_addr;       /* MSI address */
+        unsigned int    max_msi;        /* maximum number of MSI's */
         struct airq_iv *aibv;           /* adapter interrupt bit vector */
         unsigned int    aisb;           /* number of the summary bit */
 
diff --git a/arch/s390/include/asm/pci_io.h b/arch/s390/include/asm/pci_io.h
index d194d544d694..f664e96f48c7 100644
--- a/arch/s390/include/asm/pci_io.h
+++ b/arch/s390/include/asm/pci_io.h
@@ -139,7 +139,8 @@ static inline int zpci_memcpy_fromio(void *dst,
         int size, rc = 0;
 
         while (n > 0) {
-                size = zpci_get_max_write_size((u64) src, (u64) dst, n, 8);
+                size = zpci_get_max_write_size((u64 __force) src,
+                                               (u64) dst, n, 8);
                 req = ZPCI_CREATE_REQ(entry->fh, entry->bar, size);
                 rc = zpci_read_single(req, dst, offset, size);
                 if (rc)
@@ -162,7 +163,8 @@ static inline int zpci_memcpy_toio(volatile void __iomem *dst,
                 return -EINVAL;
 
         while (n > 0) {
-                size = zpci_get_max_write_size((u64) dst, (u64) src, n, 128);
+                size = zpci_get_max_write_size((u64 __force) dst,
+                                               (u64) src, n, 128);
                 req = ZPCI_CREATE_REQ(entry->fh, entry->bar, size);
 
                 if (size > 8) /* main path */
diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
index d39a31c3cdf2..e510b9460efa 100644
--- a/arch/s390/include/asm/pgalloc.h
+++ b/arch/s390/include/asm/pgalloc.h
@@ -22,8 +22,6 @@ unsigned long *page_table_alloc(struct mm_struct *);
 void page_table_free(struct mm_struct *, unsigned long *);
 void page_table_free_rcu(struct mmu_gather *, unsigned long *, unsigned long);
 
-void page_table_reset_pgste(struct mm_struct *, unsigned long, unsigned long,
-                            bool init_skey);
 int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
                           unsigned long key, bool nq);
 
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 57c882761dea..5e102422c9ab 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -133,6 +133,18 @@ extern unsigned long MODULES_END;
 #define MODULES_LEN     (1UL << 31)
 #endif
 
+static inline int is_module_addr(void *addr)
+{
+#ifdef CONFIG_64BIT
+        BUILD_BUG_ON(MODULES_LEN > (1UL << 31));
+        if (addr < (void *)MODULES_VADDR)
+                return 0;
+        if (addr > (void *)MODULES_END)
+                return 0;
+#endif
+        return 1;
+}
+
 /*
  * A 31 bit pagetable entry of S390 has following format:
  *  |   PFRA          |    |  OS  |
@@ -479,6 +491,11 @@ static inline int mm_has_pgste(struct mm_struct *mm)
         return 0;
 }
 
+/*
+ * In the case that a guest uses storage keys
+ * faults should no longer be backed by zero pages
+ */
+#define mm_forbids_zeropage mm_use_skey
 static inline int mm_use_skey(struct mm_struct *mm)
 {
 #ifdef CONFIG_PGSTE
@@ -1634,6 +1651,19 @@ static inline pmd_t pmdp_get_and_clear(struct mm_struct *mm,
         return pmd;
 }
 
+#define __HAVE_ARCH_PMDP_GET_AND_CLEAR_FULL
+static inline pmd_t pmdp_get_and_clear_full(struct mm_struct *mm,
+                                            unsigned long address,
+                                            pmd_t *pmdp, int full)
+{
+        pmd_t pmd = *pmdp;
+
+        if (!full)
+                pmdp_flush_lazy(mm, address, pmdp);
+        pmd_clear(pmdp);
+        return pmd;
+}
+
 #define __HAVE_ARCH_PMDP_CLEAR_FLUSH
 static inline pmd_t pmdp_clear_flush(struct vm_area_struct *vma,
                                      unsigned long address, pmd_t *pmdp)
@@ -1746,7 +1776,8 @@ static inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
 extern int vmem_add_mapping(unsigned long start, unsigned long size);
 extern int vmem_remove_mapping(unsigned long start, unsigned long size);
 extern int s390_enable_sie(void);
-extern void s390_enable_skey(void);
+extern int s390_enable_skey(void);
+extern void s390_reset_cmma(struct mm_struct *mm);
 
 /*
  * No page table caches to initialise
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index d559bdb03d18..bed05ea7ec27 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -217,8 +217,6 @@ static inline unsigned short stap(void)
  */
 static inline void cpu_relax(void)
 {
-        if (MACHINE_HAS_DIAG44)
-                asm volatile("diag 0,0,68");
         barrier();
 }
 
diff --git a/arch/s390/include/asm/spinlock.h b/arch/s390/include/asm/spinlock.h
index d6bdf906caa5..0e37cd041241 100644
--- a/arch/s390/include/asm/spinlock.h
+++ b/arch/s390/include/asm/spinlock.h
@@ -18,14 +18,7 @@ extern int spin_retry;
 static inline int
 _raw_compare_and_swap(unsigned int *lock, unsigned int old, unsigned int new)
 {
-        unsigned int old_expected = old;
-
-        asm volatile(
-                "       cs      %0,%3,%1"
-                : "=d" (old), "=Q" (*lock)
-                : "0" (old), "d" (new), "Q" (*lock)
-                : "cc", "memory" );
-        return old == old_expected;
+        return __sync_bool_compare_and_swap(lock, old, new);
 }
 
 /*
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 572c59949004..06d8741ad6f4 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -121,6 +121,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
 #ifdef CONFIG_64BIT
         if (tlb->mm->context.asce_limit <= (1UL << 31))
                 return;
+        pgtable_pmd_page_dtor(virt_to_page(pmd));
         tlb_remove_table(tlb, pmd);
 #endif
 }
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 4197c89c52d4..2b446cf0cc65 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -287,7 +287,9 @@
 #define __NR_getrandom          349
 #define __NR_memfd_create       350
 #define __NR_bpf                351
-#define NR_syscalls 352
+#define __NR_s390_pci_mmio_write        352
+#define __NR_s390_pci_mmio_read         353
+#define NR_syscalls 354
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index ef279a136801..e07e91605353 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -17,8 +17,8 @@
  * Make sure that the compiler is new enough. We want a compiler that
  * is known to work with the "Q" assembler constraint.
  */
-#if __GNUC__ < 3 || (__GNUC__ == 3 && __GNUC_MINOR__ < 3)
-#error Your compiler is too old; please use version 3.3.3 or newer
+#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 3)
+#error Your compiler is too old; please use version 4.3 or newer
 #endif
 
 int main(void)
@@ -156,7 +156,6 @@ int main(void)
         DEFINE(__LC_INT_CLOCK, offsetof(struct _lowcore, int_clock));
         DEFINE(__LC_MCCK_CLOCK, offsetof(struct _lowcore, mcck_clock));
         DEFINE(__LC_MACHINE_FLAGS, offsetof(struct _lowcore, machine_flags));
-        DEFINE(__LC_FTRACE_FUNC, offsetof(struct _lowcore, ftrace_func));
         DEFINE(__LC_DUMP_REIPL, offsetof(struct _lowcore, ipib));
         BLANK();
         DEFINE(__LC_CPU_TIMER_SAVE_AREA, offsetof(struct _lowcore, cpu_timer_save_area));
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 009f5eb11125..34d5fa7b01b5 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -434,7 +434,7 @@ static int setup_frame32(struct ksignal *ksig, sigset_t *set,
                         ksig->ka.sa.sa_restorer | PSW32_ADDR_AMODE;
         } else {
                 /* Signal frames without vectors registers are short ! */
-                __u16 __user *svc = (void *) frame + frame_size - 2;
+                __u16 __user *svc = (void __user *) frame + frame_size - 2;
                 if (__put_user(S390_SYSCALL_OPCODE | __NR_sigreturn, svc))
                         return -EFAULT;
                 restorer = (unsigned long __force) svc | PSW32_ADDR_AMODE;
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index c4f7a3d655b8..d7fa2f0f1425 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -218,3 +218,5 @@ COMPAT_SYSCALL_WRAP3(seccomp, unsigned int, op, unsigned int, flags, const char
 COMPAT_SYSCALL_WRAP3(getrandom, char __user *, buf, size_t, count, unsigned int, flags)
 COMPAT_SYSCALL_WRAP2(memfd_create, const char __user *, uname, unsigned int, flags)
 COMPAT_SYSCALL_WRAP3(bpf, int, cmd, union bpf_attr *, attr, unsigned int, size);
+COMPAT_SYSCALL_WRAP3(s390_pci_mmio_write, const unsigned long, mmio_addr, const void __user *, user_buffer, const size_t, length);
+COMPAT_SYSCALL_WRAP3(s390_pci_mmio_read, const unsigned long, mmio_addr, void __user *, user_buffer, const size_t, length);
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index ee8390da6ea7..c1f21aca76e7 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -1019,7 +1019,7 @@ debug_count_numargs(char *string)
  */
 
 debug_entry_t*
-debug_sprintf_event(debug_info_t* id, int level,char *string,...)
+__debug_sprintf_event(debug_info_t *id, int level, char *string, ...)
 {
         va_list   ap;
         int numargs,idx;
@@ -1027,8 +1027,6 @@ debug_sprintf_event(debug_info_t* id, int level,char *string,...)
         debug_sprintf_entry_t *curr_event;
         debug_entry_t *active;
 
-        if((!id) || (level > id->level))
-                return NULL;
         if (!debug_active || !id->areas)
                 return NULL;
         numargs=debug_count_numargs(string);
@@ -1050,14 +1048,14 @@ debug_sprintf_event(debug_info_t* id, int level,char *string,...)
 
         return active;
 }
-EXPORT_SYMBOL(debug_sprintf_event);
+EXPORT_SYMBOL(__debug_sprintf_event);
 
 /*
  * debug_sprintf_exception:
  */
 
 debug_entry_t*
-debug_sprintf_exception(debug_info_t* id, int level,char *string,...)
+__debug_sprintf_exception(debug_info_t *id, int level, char *string, ...)
 {
         va_list   ap;
         int numargs,idx;
@@ -1065,8 +1063,6 @@ debug_sprintf_exception(debug_info_t* id, int level,char *string,...)
         debug_sprintf_entry_t *curr_event;
         debug_entry_t *active;
 
-        if((!id) || (level > id->level))
-                return NULL;
         if (!debug_active || !id->areas)
                 return NULL;
 
@@ -1089,7 +1085,7 @@ debug_sprintf_exception(debug_info_t* id, int level,char *string,...)
 
         return active;
 }
-EXPORT_SYMBOL(debug_sprintf_exception);
+EXPORT_SYMBOL(__debug_sprintf_exception);
 
 /*
  * debug_register_view:
diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
index acb412442e5e..a99852e96a77 100644
--- a/arch/s390/kernel/dumpstack.c
+++ b/arch/s390/kernel/dumpstack.c
@@ -191,7 +191,8 @@ void die(struct pt_regs *regs, const char *str)
         console_verbose();
         spin_lock_irq(&die_lock);
         bust_spinlocks(1);
-        printk("%s: %04x [#%d] ", str, regs->int_code & 0xffff, ++die_counter);
+        printk("%s: %04x ilc:%d [#%d] ", str, regs->int_code & 0xffff,
+               regs->int_code >> 17, ++die_counter);
 #ifdef CONFIG_PREEMPT
         printk("PREEMPT ");
 #endif
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index cef2879edff3..302ac1f7f8e7 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -12,7 +12,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/ctype.h>
-#include <linux/ftrace.h>
 #include <linux/lockdep.h>
 #include <linux/module.h>
 #include <linux/pfn.h>
@@ -490,8 +489,5 @@ void __init startup_init(void)
         detect_machine_facilities();
         setup_topology();
         sclp_early_detect();
-#ifdef CONFIG_DYNAMIC_FTRACE
-        S390_lowcore.ftrace_func = (unsigned long)ftrace_caller;
-#endif
         lockdep_on();
 }
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 70203265196f..398329b2b518 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -53,7 +53,7 @@ _PIF_WORK	= (_PIF_PER_TRAP)
         .macro  TRACE_IRQS_ON
 #ifdef CONFIG_TRACE_IRQFLAGS
         basr    %r2,%r0
-        l       %r1,BASED(.Lhardirqs_on)
+        l       %r1,BASED(.Lc_hardirqs_on)
         basr    %r14,%r1                # call trace_hardirqs_on_caller
 #endif
         .endm
@@ -61,7 +61,7 @@ _PIF_WORK	= (_PIF_PER_TRAP)
         .macro  TRACE_IRQS_OFF
 #ifdef CONFIG_TRACE_IRQFLAGS
         basr    %r2,%r0
-        l       %r1,BASED(.Lhardirqs_off)
+        l       %r1,BASED(.Lc_hardirqs_off)
         basr    %r14,%r1                # call trace_hardirqs_off_caller
 #endif
         .endm
@@ -70,7 +70,7 @@ _PIF_WORK	= (_PIF_PER_TRAP)
 #ifdef CONFIG_LOCKDEP
         tm      __PT_PSW+1(%r11),0x01   # returning to user ?
         jz      .+10
-        l       %r1,BASED(.Llockdep_sys_exit)
+        l       %r1,BASED(.Lc_lockdep_sys_exit)
         basr    %r14,%r1                # call lockdep_sys_exit
 #endif
         .endm
@@ -87,8 +87,8 @@ _PIF_WORK	= (_PIF_PER_TRAP)
         tmh     %r8,0x0001              # interrupting from user ?
         jnz     1f
         lr      %r14,%r9
-        sl      %r14,BASED(.Lcritical_start)
-        cl      %r14,BASED(.Lcritical_length)
+        sl      %r14,BASED(.Lc_critical_start)
+        cl      %r14,BASED(.Lc_critical_length)
         jhe     0f
         la      %r11,\savearea          # inside critical section, do cleanup
         bras    %r14,cleanup_critical
@@ -162,7 +162,7 @@ ENTRY(__switch_to)
         lm      %r6,%r15,__SF_GPRS(%r15)        # load gprs of next task
         br      %r14
 
-__critical_start:
+.L__critical_start:
 /*
  * SVC interrupt handler routine. System calls are synchronous events and
  * are executed with interrupts enabled.
@@ -170,145 +170,145 @@ __critical_start:
 
 ENTRY(system_call)
         stpt    __LC_SYNC_ENTER_TIMER
-sysc_stm:
+.Lsysc_stm:
         stm     %r8,%r15,__LC_SAVE_AREA_SYNC
         l       %r12,__LC_THREAD_INFO
         l       %r13,__LC_SVC_NEW_PSW+4
         lhi     %r14,_PIF_SYSCALL
-sysc_per:
+.Lsysc_per:
         l       %r15,__LC_KERNEL_STACK
         la      %r11,STACK_FRAME_OVERHEAD(%r15) # pointer to pt_regs
-sysc_vtime:
+.Lsysc_vtime:
         UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER
         stm     %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(32,%r11),__LC_SAVE_AREA_SYNC
         mvc     __PT_PSW(8,%r11),__LC_SVC_OLD_PSW
         mvc     __PT_INT_CODE(4,%r11),__LC_SVC_ILC
         st      %r14,__PT_FLAGS(%r11)
-sysc_do_svc:
+.Lsysc_do_svc:
         l       %r10,__TI_sysc_table(%r12)      # 31 bit system call table
         lh      %r8,__PT_INT_CODE+2(%r11)
         sla     %r8,2                           # shift and test for svc0
-        jnz     sysc_nr_ok
+        jnz     .Lsysc_nr_ok
         # svc 0: system call number in %r1
         cl      %r1,BASED(.Lnr_syscalls)
-        jnl     sysc_nr_ok
+        jnl     .Lsysc_nr_ok
         sth     %r1,__PT_INT_CODE+2(%r11)
         lr      %r8,%r1
         sla     %r8,2
-sysc_nr_ok:
+.Lsysc_nr_ok:
         xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
         st      %r2,__PT_ORIG_GPR2(%r11)
         st      %r7,STACK_FRAME_OVERHEAD(%r15)
         l       %r9,0(%r8,%r10)                 # get system call addr.
         tm      __TI_flags+3(%r12),_TIF_TRACE
-        jnz     sysc_tracesys
+        jnz     .Lsysc_tracesys
         basr    %r14,%r9                        # call sys_xxxx
         st      %r2,__PT_R2(%r11)               # store return value
 
-sysc_return:
+.Lsysc_return:
         LOCKDEP_SYS_EXIT
-sysc_tif:
+.Lsysc_tif:
         tm      __PT_PSW+1(%r11),0x01           # returning to user ?
-        jno     sysc_restore
+        jno     .Lsysc_restore
         tm      __PT_FLAGS+3(%r11),_PIF_WORK
-        jnz     sysc_work
+        jnz     .Lsysc_work
         tm      __TI_flags+3(%r12),_TIF_WORK
-        jnz     sysc_work                       # check for thread work
+        jnz     .Lsysc_work                     # check for thread work
         tm      __LC_CPU_FLAGS+3,_CIF_WORK
-        jnz     sysc_work
-sysc_restore:
+        jnz     .Lsysc_work
+.Lsysc_restore:
         mvc     __LC_RETURN_PSW(8),__PT_PSW(%r11)
         stpt    __LC_EXIT_TIMER
         lm      %r0,%r15,__PT_R0(%r11)
         lpsw    __LC_RETURN_PSW
-sysc_done:
+.Lsysc_done:
 
 #
 # One of the work bits is on. Find out which one.
 #
-sysc_work:
+.Lsysc_work:
         tm      __LC_CPU_FLAGS+3,_CIF_MCCK_PENDING
-        jo      sysc_mcck_pending
+        jo      .Lsysc_mcck_pending
         tm      __TI_flags+3(%r12),_TIF_NEED_RESCHED
-        jo      sysc_reschedule
+        jo      .Lsysc_reschedule
         tm      __PT_FLAGS+3(%r11),_PIF_PER_TRAP
-        jo      sysc_singlestep
+        jo      .Lsysc_singlestep
         tm      __TI_flags+3(%r12),_TIF_SIGPENDING
-        jo      sysc_sigpending
+        jo      .Lsysc_sigpending
         tm      __TI_flags+3(%r12),_TIF_NOTIFY_RESUME
-        jo      sysc_notify_resume
+        jo      .Lsysc_notify_resume
         tm      __LC_CPU_FLAGS+3,_CIF_ASCE
-        jo      sysc_uaccess
-        j       sysc_return             # beware of critical section cleanup
+        jo      .Lsysc_uaccess
+        j       .Lsysc_return           # beware of critical section cleanup
 
 #
 # _TIF_NEED_RESCHED is set, call schedule
 #
-sysc_reschedule:
-        l       %r1,BASED(.Lschedule)
-        la      %r14,BASED(sysc_return)
+.Lsysc_reschedule:
+        l       %r1,BASED(.Lc_schedule)
+        la      %r14,BASED(.Lsysc_return)
         br      %r1                     # call schedule
 
 #
 # _CIF_MCCK_PENDING is set, call handler
 #
-sysc_mcck_pending:
-        l       %r1,BASED(.Lhandle_mcck)
-        la      %r14,BASED(sysc_return)
+.Lsysc_mcck_pending:
+        l       %r1,BASED(.Lc_handle_mcck)
+        la      %r14,BASED(.Lsysc_return)
         br      %r1                     # TIF bit will be cleared by handler
 
 #
 # _CIF_ASCE is set, load user space asce
 #
-sysc_uaccess:
+.Lsysc_uaccess:
         ni      __LC_CPU_FLAGS+3,255-_CIF_ASCE
         lctl    %c1,%c1,__LC_USER_ASCE  # load primary asce
-        j       sysc_return
+        j       .Lsysc_return
 
 #
 # _TIF_SIGPENDING is set, call do_signal
 #
-sysc_sigpending:
+.Lsysc_sigpending:
         lr      %r2,%r11                # pass pointer to pt_regs
-        l       %r1,BASED(.Ldo_signal)
+        l       %r1,BASED(.Lc_do_signal)
         basr    %r14,%r1                # call do_signal
         tm      __PT_FLAGS+3(%r11),_PIF_SYSCALL
-        jno     sysc_return
+        jno     .Lsysc_return
         lm      %r2,%r7,__PT_R2(%r11)   # load svc arguments
         l       %r10,__TI_sysc_table(%r12)      # 31 bit system call table
         xr      %r8,%r8                 # svc 0 returns -ENOSYS
         clc     __PT_INT_CODE+2(2,%r11),BASED(.Lnr_syscalls+2)
-        jnl     sysc_nr_ok              # invalid svc number -> do svc 0
+        jnl     .Lsysc_nr_ok            # invalid svc number -> do svc 0
         lh      %r8,__PT_INT_CODE+2(%r11)       # load new svc number
         sla     %r8,2
-        j       sysc_nr_ok              # restart svc
+        j       .Lsysc_nr_ok            # restart svc
 
 #
 # _TIF_NOTIFY_RESUME is set, call do_notify_resume
 #
-sysc_notify_resume:
+.Lsysc_notify_resume:
         lr      %r2,%r11                # pass pointer to pt_regs
-        l       %r1,BASED(.Ldo_notify_resume)
-        la      %r14,BASED(sysc_return)
+        l       %r1,BASED(.Lc_do_notify_resume)
+        la      %r14,BASED(.Lsysc_return)
         br      %r1                     # call do_notify_resume
 
 #
 # _PIF_PER_TRAP is set, call do_per_trap
 #
-sysc_singlestep:
+.Lsysc_singlestep:
         ni      __PT_FLAGS+3(%r11),255-_PIF_PER_TRAP
         lr      %r2,%r11                # pass pointer to pt_regs
-        l       %r1,BASED(.Ldo_per_trap)
-        la      %r14,BASED(sysc_return)
+        l       %r1,BASED(.Lc_do_per_trap)
+        la      %r14,BASED(.Lsysc_return)
         br      %r1                     # call do_per_trap
 
 #
 # call tracehook_report_syscall_entry/tracehook_report_syscall_exit before
 # and after the system call
 #
-sysc_tracesys:
-        l       %r1,BASED(.Ltrace_enter)
+.Lsysc_tracesys:
+        l       %r1,BASED(.Lc_trace_enter)
         lr      %r2,%r11                # pass pointer to pt_regs
         la      %r3,0
         xr      %r0,%r0
@@ -316,22 +316,22 @@ sysc_tracesys:
         st      %r0,__PT_R2(%r11)
         basr    %r14,%r1                # call do_syscall_trace_enter
         cl      %r2,BASED(.Lnr_syscalls)
-        jnl     sysc_tracenogo
+        jnl     .Lsysc_tracenogo
         lr      %r8,%r2
         sll     %r8,2
         l       %r9,0(%r8,%r10)
-sysc_tracego:
+.Lsysc_tracego:
         lm      %r3,%r7,__PT_R3(%r11)
         st      %r7,STACK_FRAME_OVERHEAD(%r15)
         l       %r2,__PT_ORIG_GPR2(%r11)
         basr    %r14,%r9                # call sys_xxx
         st      %r2,__PT_R2(%r11)       # store return value
-sysc_tracenogo:
+.Lsysc_tracenogo:
         tm      __TI_flags+3(%r12),_TIF_TRACE
-        jz      sysc_return
-        l       %r1,BASED(.Ltrace_exit)
+        jz      .Lsysc_return
+        l       %r1,BASED(.Lc_trace_exit)
         lr      %r2,%r11                # pass pointer to pt_regs
-        la      %r14,BASED(sysc_return)
+        la      %r14,BASED(.Lsysc_return)
         br      %r1                     # call do_syscall_trace_exit
 
 #
@@ -341,18 +341,18 @@ ENTRY(ret_from_fork)
         la      %r11,STACK_FRAME_OVERHEAD(%r15)
         l       %r12,__LC_THREAD_INFO
         l       %r13,__LC_SVC_NEW_PSW+4
-        l       %r1,BASED(.Lschedule_tail)
+        l       %r1,BASED(.Lc_schedule_tail)
         basr    %r14,%r1                # call schedule_tail
         TRACE_IRQS_ON
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         tm      __PT_PSW+1(%r11),0x01   # forking a kernel thread ?
-        jne     sysc_tracenogo
+        jne     .Lsysc_tracenogo
         # it's a kernel thread
         lm      %r9,%r10,__PT_R9(%r11)  # load gprs
 ENTRY(kernel_thread_starter)
         la      %r2,0(%r10)
         basr    %r14,%r9
-        j       sysc_tracenogo
+        j       .Lsysc_tracenogo
 
 /*
  * Program check handler routine
@@ -369,7 +369,7 @@ ENTRY(pgm_check_handler)
         tmh     %r8,0x4000              # PER bit set in old PSW ?
         jnz     0f                      # -> enabled, can't be a double fault
         tm      __LC_PGM_ILC+3,0x80     # check for per exception
-        jnz     pgm_svcper              # -> single stepped svc
+        jnz     .Lpgm_svcper            # -> single stepped svc
 0:      CHECK_STACK STACK_SIZE,__LC_SAVE_AREA_SYNC
         ahi     %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
         j       2f
@@ -386,42 +386,42 @@ ENTRY(pgm_check_handler)
         jz      0f
         l       %r1,__TI_task(%r12)
         tmh     %r8,0x0001              # kernel per event ?
-        jz      pgm_kprobe
+        jz      .Lpgm_kprobe
         oi      __PT_FLAGS+3(%r11),_PIF_PER_TRAP
         mvc     __THREAD_per_address(4,%r1),__LC_PER_ADDRESS
         mvc     __THREAD_per_cause(2,%r1),__LC_PER_CODE
         mvc     __THREAD_per_paid(1,%r1),__LC_PER_ACCESS_ID
 0:      REENABLE_IRQS
         xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
-        l       %r1,BASED(.Ljump_table)
+        l       %r1,BASED(.Lc_jump_table)
         la      %r10,0x7f
         n       %r10,__PT_INT_CODE(%r11)
-        je      sysc_return
+        je      .Lsysc_return
         sll     %r10,2
         l       %r1,0(%r10,%r1)         # load address of handler routine
         lr      %r2,%r11                # pass pointer to pt_regs
         basr    %r14,%r1                # branch to interrupt-handler
-        j       sysc_return
+        j       .Lsysc_return
 
 #
 # PER event in supervisor state, must be kprobes
 #
-pgm_kprobe:
+.Lpgm_kprobe:
         REENABLE_IRQS
         xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
-        l       %r1,BASED(.Ldo_per_trap)
+        l       %r1,BASED(.Lc_do_per_trap)
         lr      %r2,%r11                # pass pointer to pt_regs
         basr    %r14,%r1                # call do_per_trap
-        j       sysc_return
+        j       .Lsysc_return
 
 #
 # single stepped system call
 #
-pgm_svcper:
+.Lpgm_svcper:
         mvc     __LC_RETURN_PSW(4),__LC_SVC_NEW_PSW
-        mvc     __LC_RETURN_PSW+4(4),BASED(.Lsysc_per)
+        mvc     __LC_RETURN_PSW+4(4),BASED(.Lc_sysc_per)
         lhi     %r14,_PIF_SYSCALL | _PIF_PER_TRAP
-        lpsw    __LC_RETURN_PSW         # branch to sysc_per and enable irqs
+        lpsw    __LC_RETURN_PSW         # branch to .Lsysc_per and enable irqs
 
 /*
  * IO interrupt handler routine
@@ -435,9 +435,9 @@ ENTRY(io_int_handler)
         l       %r13,__LC_SVC_NEW_PSW+4
         lm      %r8,%r9,__LC_IO_OLD_PSW
         tmh     %r8,0x0001              # interrupting from user ?
-        jz      io_skip
+        jz      .Lio_skip
         UPDATE_VTIME %r14,%r15,__LC_ASYNC_ENTER_TIMER
-io_skip:
+.Lio_skip:
         SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_STACK,STACK_SHIFT
         stm     %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(32,%r11),__LC_SAVE_AREA_ASYNC
@@ -446,35 +446,35 @@ io_skip:
         xc      __PT_FLAGS(4,%r11),__PT_FLAGS(%r11)
         TRACE_IRQS_OFF
         xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
-io_loop:
-        l       %r1,BASED(.Ldo_IRQ)
+.Lio_loop:
+        l       %r1,BASED(.Lc_do_IRQ)
         lr      %r2,%r11                # pass pointer to pt_regs
         lhi     %r3,IO_INTERRUPT
         tm      __PT_INT_CODE+8(%r11),0x80      # adapter interrupt ?
-        jz      io_call
+        jz      .Lio_call
         lhi     %r3,THIN_INTERRUPT
-io_call:
+.Lio_call:
         basr    %r14,%r1                # call do_IRQ
         tm      __LC_MACHINE_FLAGS+2,0x10       # MACHINE_FLAG_LPAR
-        jz      io_return
+        jz      .Lio_return
         tpi     0
-        jz      io_return
+        jz      .Lio_return
         mvc     __PT_INT_CODE(12,%r11),__LC_SUBCHANNEL_ID
-        j       io_loop
-io_return:
+        j       .Lio_loop
+.Lio_return:
         LOCKDEP_SYS_EXIT
         TRACE_IRQS_ON
-io_tif:
+.Lio_tif:
         tm      __TI_flags+3(%r12),_TIF_WORK
-        jnz     io_work                 # there is work to do (signals etc.)
+        jnz     .Lio_work               # there is work to do (signals etc.)
         tm      __LC_CPU_FLAGS+3,_CIF_WORK
-        jnz     io_work
-io_restore:
+        jnz     .Lio_work
+.Lio_restore:
         mvc     __LC_RETURN_PSW(8),__PT_PSW(%r11)
         stpt    __LC_EXIT_TIMER
         lm      %r0,%r15,__PT_R0(%r11)
         lpsw    __LC_RETURN_PSW
-io_done:
+.Lio_done:
 
 #
 # There is work todo, find out in which context we have been interrupted:
@@ -483,15 +483,15 @@ io_done:
 #    the preemption counter and if it is zero call preempt_schedule_irq
 # Before any work can be done, a switch to the kernel stack is required.
 #
-io_work:
+.Lio_work:
         tm      __PT_PSW+1(%r11),0x01   # returning to user ?
-        jo      io_work_user            # yes -> do resched & signal
+        jo      .Lio_work_user          # yes -> do resched & signal
 #ifdef CONFIG_PREEMPT
         # check for preemptive scheduling
         icm     %r0,15,__TI_precount(%r12)
-        jnz     io_restore              # preemption disabled
+        jnz     .Lio_restore            # preemption disabled
         tm      __TI_flags+3(%r12),_TIF_NEED_RESCHED
-        jno     io_restore
+        jno     .Lio_restore
         # switch to kernel stack
         l       %r1,__PT_R15(%r11)
         ahi     %r1,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
@@ -499,20 +499,20 @@ io_work:
         xc      __SF_BACKCHAIN(4,%r1),__SF_BACKCHAIN(%r1)
         la      %r11,STACK_FRAME_OVERHEAD(%r1)
         lr      %r15,%r1
-        # TRACE_IRQS_ON already done at io_return, call
+        # TRACE_IRQS_ON already done at .Lio_return, call
         # TRACE_IRQS_OFF to keep things symmetrical
         TRACE_IRQS_OFF
-        l       %r1,BASED(.Lpreempt_irq)
+        l       %r1,BASED(.Lc_preempt_irq)
         basr    %r14,%r1                # call preempt_schedule_irq
-        j       io_return
+        j       .Lio_return
 #else
-        j       io_restore
+        j       .Lio_restore
 #endif
 
 #
 # Need to do work before returning to userspace, switch to kernel stack
 #
-io_work_user:
+.Lio_work_user:
         l       %r1,__LC_KERNEL_STACK
         mvc     STACK_FRAME_OVERHEAD(__PT_SIZE,%r1),0(%r11)
         xc      __SF_BACKCHAIN(4,%r1),__SF_BACKCHAIN(%r1)
@@ -522,74 +522,74 @@ io_work_user:
 #
 # One of the work bits is on. Find out which one.
 #
-io_work_tif:
+.Lio_work_tif:
         tm      __LC_CPU_FLAGS+3(%r12),_CIF_MCCK_PENDING
-        jo      io_mcck_pending
+        jo      .Lio_mcck_pending
         tm      __TI_flags+3(%r12),_TIF_NEED_RESCHED
-        jo      io_reschedule
+        jo      .Lio_reschedule
         tm      __TI_flags+3(%r12),_TIF_SIGPENDING
-        jo      io_sigpending
+        jo      .Lio_sigpending
         tm      __TI_flags+3(%r12),_TIF_NOTIFY_RESUME
-        jo      io_notify_resume
+        jo      .Lio_notify_resume
         tm      __LC_CPU_FLAGS+3,_CIF_ASCE
-        jo      io_uaccess
-        j       io_return               # beware of critical section cleanup
+        jo      .Lio_uaccess
+        j       .Lio_return             # beware of critical section cleanup
 
 #
 # _CIF_MCCK_PENDING is set, call handler
 #
-io_mcck_pending:
-        # TRACE_IRQS_ON already done at io_return
-        l       %r1,BASED(.Lhandle_mcck)
+.Lio_mcck_pending:
+        # TRACE_IRQS_ON already done at .Lio_return
+        l       %r1,BASED(.Lc_handle_mcck)
         basr    %r14,%r1                # TIF bit will be cleared by handler
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 #
 # _CIF_ASCE is set, load user space asce
 #
-io_uaccess:
+.Lio_uaccess:
         ni      __LC_CPU_FLAGS+3,255-_CIF_ASCE
         lctl    %c1,%c1,__LC_USER_ASCE  # load primary asce
-        j       io_return
+        j       .Lio_return
 
 #
 # _TIF_NEED_RESCHED is set, call schedule
 #
-io_reschedule:
-        # TRACE_IRQS_ON already done at io_return
-        l       %r1,BASED(.Lschedule)
+.Lio_reschedule:
+        # TRACE_IRQS_ON already done at .Lio_return
+        l       %r1,BASED(.Lc_schedule)
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         basr    %r14,%r1                # call scheduler
         ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 #
 # _TIF_SIGPENDING is set, call do_signal
 #
-io_sigpending:
-        # TRACE_IRQS_ON already done at io_return
-        l       %r1,BASED(.Ldo_signal)
+.Lio_sigpending:
+        # TRACE_IRQS_ON already done at .Lio_return
+        l       %r1,BASED(.Lc_do_signal)
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         lr      %r2,%r11                # pass pointer to pt_regs
         basr    %r14,%r1                # call do_signal
         ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 #
 # _TIF_SIGPENDING is set, call do_signal
 #
-io_notify_resume:
-        # TRACE_IRQS_ON already done at io_return
-        l       %r1,BASED(.Ldo_notify_resume)
+.Lio_notify_resume:
+        # TRACE_IRQS_ON already done at .Lio_return
+        l       %r1,BASED(.Lc_do_notify_resume)
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         lr      %r2,%r11                # pass pointer to pt_regs
         basr    %r14,%r1                # call do_notify_resume
         ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 /*
  * External interrupt handler routine
@@ -603,9 +603,9 @@ ENTRY(ext_int_handler)
         l       %r13,__LC_SVC_NEW_PSW+4
         lm      %r8,%r9,__LC_EXT_OLD_PSW
         tmh     %r8,0x0001              # interrupting from user ?
-        jz      ext_skip
+        jz      .Lext_skip
         UPDATE_VTIME %r14,%r15,__LC_ASYNC_ENTER_TIMER
-ext_skip:
+.Lext_skip:
         SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_STACK,STACK_SHIFT
         stm     %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(32,%r11),__LC_SAVE_AREA_ASYNC
@@ -614,29 +614,29 @@ ext_skip:
         mvc     __PT_INT_PARM(4,%r11),__LC_EXT_PARAMS
         xc      __PT_FLAGS(4,%r11),__PT_FLAGS(%r11)
         TRACE_IRQS_OFF
-        l       %r1,BASED(.Ldo_IRQ)
+        l       %r1,BASED(.Lc_do_IRQ)
         lr      %r2,%r11                # pass pointer to pt_regs
         lhi     %r3,EXT_INTERRUPT
         basr    %r14,%r1                # call do_IRQ
-        j       io_return
+        j       .Lio_return
 
 /*
- * Load idle PSW. The second "half" of this function is in cleanup_idle.
+ * Load idle PSW. The second "half" of this function is in .Lcleanup_idle.
  */
 ENTRY(psw_idle)
         st      %r3,__SF_EMPTY(%r15)
         basr    %r1,0
-        la      %r1,psw_idle_lpsw+4-.(%r1)
+        la      %r1,.Lpsw_idle_lpsw+4-.(%r1)
         st      %r1,__SF_EMPTY+4(%r15)
         oi      __SF_EMPTY+4(%r15),0x80
         stck    __CLOCK_IDLE_ENTER(%r2)
         stpt    __TIMER_IDLE_ENTER(%r2)
-psw_idle_lpsw:
+.Lpsw_idle_lpsw:
         lpsw    __SF_EMPTY(%r15)
         br      %r14
-psw_idle_end:
+.Lpsw_idle_end:
 
-__critical_end:
+.L__critical_end:
 
 /*
  * Machine check handler routines
@@ -650,7 +650,7 @@ ENTRY(mcck_int_handler)
         l       %r13,__LC_SVC_NEW_PSW+4
         lm      %r8,%r9,__LC_MCK_OLD_PSW
         tm      __LC_MCCK_CODE,0x80     # system damage?
-        jo      mcck_panic              # yes -> rest of mcck code invalid
+        jo      .Lmcck_panic            # yes -> rest of mcck code invalid
         la      %r14,__LC_CPU_TIMER_SAVE_AREA
         mvc     __LC_MCCK_ENTER_TIMER(8),0(%r14)
         tm      __LC_MCCK_CODE+5,0x02   # stored cpu timer value valid?
@@ -668,22 +668,22 @@ ENTRY(mcck_int_handler)
 2:      spt     0(%r14)
         mvc     __LC_MCCK_ENTER_TIMER(8),0(%r14)
 3:      tm      __LC_MCCK_CODE+2,0x09   # mwp + ia of old psw valid?
-        jno     mcck_panic              # no -> skip cleanup critical
+        jno     .Lmcck_panic            # no -> skip cleanup critical
         tm      %r8,0x0001              # interrupting from user ?
-        jz      mcck_skip
+        jz      .Lmcck_skip
         UPDATE_VTIME %r14,%r15,__LC_MCCK_ENTER_TIMER
-mcck_skip:
+.Lmcck_skip:
         SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+32,__LC_PANIC_STACK,PAGE_SHIFT
         stm     %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(32,%r11),__LC_GPREGS_SAVE_AREA+32
         stm     %r8,%r9,__PT_PSW(%r11)
         xc      __PT_FLAGS(4,%r11),__PT_FLAGS(%r11)
         xc      __SF_BACKCHAIN(4,%r15),__SF_BACKCHAIN(%r15)
-        l       %r1,BASED(.Ldo_machine_check)
+        l       %r1,BASED(.Lc_do_machine_check)
         lr      %r2,%r11                # pass pointer to pt_regs
         basr    %r14,%r1                # call s390_do_machine_check
         tm      __PT_PSW+1(%r11),0x01   # returning to user ?
-        jno     mcck_return
+        jno     .Lmcck_return
         l       %r1,__LC_KERNEL_STACK   # switch to kernel stack
         mvc     STACK_FRAME_OVERHEAD(__PT_SIZE,%r1),0(%r11)
         xc      __SF_BACKCHAIN(4,%r1),__SF_BACKCHAIN(%r1)
@@ -691,12 +691,12 @@ mcck_skip:
         lr      %r15,%r1
         ssm     __LC_PGM_NEW_PSW        # turn dat on, keep irqs off
         tm      __LC_CPU_FLAGS+3,_CIF_MCCK_PENDING
-        jno     mcck_return
+        jno     .Lmcck_return
         TRACE_IRQS_OFF
-        l       %r1,BASED(.Lhandle_mcck)
+        l       %r1,BASED(.Lc_handle_mcck)
         basr    %r14,%r1                # call s390_handle_mcck
         TRACE_IRQS_ON
-mcck_return:
+.Lmcck_return:
         mvc     __LC_RETURN_MCCK_PSW(8),__PT_PSW(%r11) # move return PSW
         tm      __LC_RETURN_MCCK_PSW+1,0x01 # returning to user ?
         jno     0f
@@ -706,15 +706,15 @@ mcck_return:
 0:      lm      %r0,%r15,__PT_R0(%r11)
         lpsw    __LC_RETURN_MCCK_PSW
 
-mcck_panic:
+.Lmcck_panic:
         l       %r14,__LC_PANIC_STACK
         slr     %r14,%r15
         sra     %r14,PAGE_SHIFT
         jz      0f
         l       %r15,__LC_PANIC_STACK
-        j       mcck_skip
+        j       .Lmcck_skip
 0:      ahi     %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
-        j       mcck_skip
+        j       .Lmcck_skip
 
 #
 # PSW restart interrupt handler
@@ -764,58 +764,58 @@ stack_overflow:
 1:      .long   kernel_stack_overflow
 #endif
 
-cleanup_table:
+.Lcleanup_table:
         .long   system_call + 0x80000000
-        .long   sysc_do_svc + 0x80000000
-        .long   sysc_tif + 0x80000000
-        .long   sysc_restore + 0x80000000
-        .long   sysc_done + 0x80000000
-        .long   io_tif + 0x80000000
-        .long   io_restore + 0x80000000
-        .long   io_done + 0x80000000
+        .long   .Lsysc_do_svc + 0x80000000
+        .long   .Lsysc_tif + 0x80000000
+        .long   .Lsysc_restore + 0x80000000
+        .long   .Lsysc_done + 0x80000000
+        .long   .Lio_tif + 0x80000000
+        .long   .Lio_restore + 0x80000000
+        .long   .Lio_done + 0x80000000
         .long   psw_idle + 0x80000000
-        .long   psw_idle_end + 0x80000000
+        .long   .Lpsw_idle_end + 0x80000000
 
 cleanup_critical:
-        cl      %r9,BASED(cleanup_table)        # system_call
+        cl      %r9,BASED(.Lcleanup_table)      # system_call
         jl      0f
-        cl      %r9,BASED(cleanup_table+4)      # sysc_do_svc
-        jl      cleanup_system_call
-        cl      %r9,BASED(cleanup_table+8)      # sysc_tif
+        cl      %r9,BASED(.Lcleanup_table+4)    # .Lsysc_do_svc
+        jl      .Lcleanup_system_call
+        cl      %r9,BASED(.Lcleanup_table+8)    # .Lsysc_tif
         jl      0f
-        cl      %r9,BASED(cleanup_table+12)     # sysc_restore
-        jl      cleanup_sysc_tif
-        cl      %r9,BASED(cleanup_table+16)     # sysc_done
-        jl      cleanup_sysc_restore
-        cl      %r9,BASED(cleanup_table+20)     # io_tif
+        cl      %r9,BASED(.Lcleanup_table+12)   # .Lsysc_restore
+        jl      .Lcleanup_sysc_tif
+        cl      %r9,BASED(.Lcleanup_table+16)   # .Lsysc_done
+        jl      .Lcleanup_sysc_restore
+        cl      %r9,BASED(.Lcleanup_table+20)   # .Lio_tif
         jl      0f
-        cl      %r9,BASED(cleanup_table+24)     # io_restore
-        jl      cleanup_io_tif
-        cl      %r9,BASED(cleanup_table+28)     # io_done
-        jl      cleanup_io_restore
-        cl      %r9,BASED(cleanup_table+32)     # psw_idle
+        cl      %r9,BASED(.Lcleanup_table+24)   # .Lio_restore
+        jl      .Lcleanup_io_tif
+        cl      %r9,BASED(.Lcleanup_table+28)   # .Lio_done
+        jl      .Lcleanup_io_restore
+        cl      %r9,BASED(.Lcleanup_table+32)   # psw_idle
         jl      0f
-        cl      %r9,BASED(cleanup_table+36)     # psw_idle_end
-        jl      cleanup_idle
+        cl      %r9,BASED(.Lcleanup_table+36)   # .Lpsw_idle_end
+        jl      .Lcleanup_idle
 0:      br      %r14
 
-cleanup_system_call:
+.Lcleanup_system_call:
         # check if stpt has been executed
-        cl      %r9,BASED(cleanup_system_call_insn)
+        cl      %r9,BASED(.Lcleanup_system_call_insn)
         jh      0f
         mvc     __LC_SYNC_ENTER_TIMER(8),__LC_ASYNC_ENTER_TIMER
         chi     %r11,__LC_SAVE_AREA_ASYNC
         je      0f
         mvc     __LC_SYNC_ENTER_TIMER(8),__LC_MCCK_ENTER_TIMER
 0:      # check if stm has been executed
-        cl      %r9,BASED(cleanup_system_call_insn+4)
+        cl      %r9,BASED(.Lcleanup_system_call_insn+4)
         jh      0f
         mvc     __LC_SAVE_AREA_SYNC(32),0(%r11)
 0:      # set up saved registers r12, and r13
         st      %r12,16(%r11)           # r12 thread-info pointer
         st      %r13,20(%r11)           # r13 literal-pool pointer
         # check if the user time calculation has been done
-        cl      %r9,BASED(cleanup_system_call_insn+8)
+        cl      %r9,BASED(.Lcleanup_system_call_insn+8)
         jh      0f
         l       %r10,__LC_EXIT_TIMER
         l       %r15,__LC_EXIT_TIMER+4
@@ -824,7 +824,7 @@ cleanup_system_call:
         st      %r10,__LC_USER_TIMER
         st      %r15,__LC_USER_TIMER+4
 0:      # check if the system time calculation has been done
-        cl      %r9,BASED(cleanup_system_call_insn+12)
+        cl      %r9,BASED(.Lcleanup_system_call_insn+12)
         jh      0f
         l       %r10,__LC_LAST_UPDATE_TIMER
         l       %r15,__LC_LAST_UPDATE_TIMER+4
@@ -848,20 +848,20 @@ cleanup_system_call:
         # setup saved register 15
         st      %r15,28(%r11)           # r15 stack pointer
         # set new psw address and exit
-        l       %r9,BASED(cleanup_table+4)      # sysc_do_svc + 0x80000000
+        l       %r9,BASED(.Lcleanup_table+4)    # .Lsysc_do_svc + 0x80000000
         br      %r14
-cleanup_system_call_insn:
+.Lcleanup_system_call_insn:
         .long   system_call + 0x80000000
-        .long   sysc_stm + 0x80000000
-        .long   sysc_vtime + 0x80000000 + 36
-        .long   sysc_vtime + 0x80000000 + 76
+        .long   .Lsysc_stm + 0x80000000
+        .long   .Lsysc_vtime + 0x80000000 + 36
+        .long   .Lsysc_vtime + 0x80000000 + 76
 
-cleanup_sysc_tif:
-        l       %r9,BASED(cleanup_table+8)      # sysc_tif + 0x80000000
+.Lcleanup_sysc_tif:
+        l       %r9,BASED(.Lcleanup_table+8)    # .Lsysc_tif + 0x80000000
         br      %r14
 
-cleanup_sysc_restore:
-        cl      %r9,BASED(cleanup_sysc_restore_insn)
+.Lcleanup_sysc_restore:
+        cl      %r9,BASED(.Lcleanup_sysc_restore_insn)
         jhe     0f
         l       %r9,12(%r11)            # get saved pointer to pt_regs
         mvc     __LC_RETURN_PSW(8),__PT_PSW(%r9)
@@ -869,15 +869,15 @@ cleanup_sysc_restore:
         lm      %r0,%r7,__PT_R0(%r9)
 0:      lm      %r8,%r9,__LC_RETURN_PSW
         br      %r14
-cleanup_sysc_restore_insn:
-        .long   sysc_done - 4 + 0x80000000
+.Lcleanup_sysc_restore_insn:
+        .long   .Lsysc_done - 4 + 0x80000000
 
-cleanup_io_tif:
-        l       %r9,BASED(cleanup_table+20)     # io_tif + 0x80000000
+.Lcleanup_io_tif:
+        l       %r9,BASED(.Lcleanup_table+20)   # .Lio_tif + 0x80000000
         br      %r14
 
-cleanup_io_restore:
-        cl      %r9,BASED(cleanup_io_restore_insn)
+.Lcleanup_io_restore:
+        cl      %r9,BASED(.Lcleanup_io_restore_insn)
         jhe     0f
         l       %r9,12(%r11)            # get saved r11 pointer to pt_regs
         mvc     __LC_RETURN_PSW(8),__PT_PSW(%r9)
@@ -885,10 +885,10 @@ cleanup_io_restore:
         lm      %r0,%r7,__PT_R0(%r9)
 0:      lm      %r8,%r9,__LC_RETURN_PSW
         br      %r14
-cleanup_io_restore_insn:
-        .long   io_done - 4 + 0x80000000
+.Lcleanup_io_restore_insn:
+        .long   .Lio_done - 4 + 0x80000000
 
-cleanup_idle:
+.Lcleanup_idle:
         # copy interrupt clock & cpu timer
         mvc     __CLOCK_IDLE_EXIT(8,%r2),__LC_INT_CLOCK
         mvc     __TIMER_IDLE_EXIT(8,%r2),__LC_ASYNC_ENTER_TIMER
@@ -897,7 +897,7 @@ cleanup_idle:
         mvc     __CLOCK_IDLE_EXIT(8,%r2),__LC_MCCK_CLOCK
         mvc     __TIMER_IDLE_EXIT(8,%r2),__LC_MCCK_ENTER_TIMER
 0:      # check if stck has been executed
-        cl      %r9,BASED(cleanup_idle_insn)
+        cl      %r9,BASED(.Lcleanup_idle_insn)
         jhe     1f
         mvc     __CLOCK_IDLE_ENTER(8,%r2),__CLOCK_IDLE_EXIT(%r2)
         mvc     __TIMER_IDLE_ENTER(8,%r2),__TIMER_IDLE_EXIT(%r3)
@@ -913,12 +913,12 @@ cleanup_idle:
         stm     %r9,%r10,__LC_SYSTEM_TIMER
         mvc     __LC_LAST_UPDATE_TIMER(8),__TIMER_IDLE_EXIT(%r2)
         # prepare return psw
-        n       %r8,BASED(cleanup_idle_wait)    # clear irq & wait state bits
+        n       %r8,BASED(.Lcleanup_idle_wait)  # clear irq & wait state bits
         l       %r9,24(%r11)                    # return from psw_idle
         br      %r14
-cleanup_idle_insn:
-        .long   psw_idle_lpsw + 0x80000000
-cleanup_idle_wait:
+.Lcleanup_idle_insn:
+        .long   .Lpsw_idle_lpsw + 0x80000000
+.Lcleanup_idle_wait:
         .long   0xfcfdffff
 
 /*
@@ -933,30 +933,30 @@ cleanup_idle_wait:
 /*
  * Symbol constants
  */
-.Ldo_machine_check:     .long   s390_do_machine_check
-.Lhandle_mcck:          .long   s390_handle_mcck
-.Ldo_IRQ:               .long   do_IRQ
-.Ldo_signal:            .long   do_signal
-.Ldo_notify_resume:     .long   do_notify_resume
-.Ldo_per_trap:          .long   do_per_trap
-.Ljump_table:           .long   pgm_check_table
-.Lschedule:             .long   schedule
+.Lc_do_machine_check:   .long   s390_do_machine_check
+.Lc_handle_mcck:        .long   s390_handle_mcck
+.Lc_do_IRQ:             .long   do_IRQ
+.Lc_do_signal:          .long   do_signal
+.Lc_do_notify_resume:   .long   do_notify_resume
+.Lc_do_per_trap:        .long   do_per_trap
+.Lc_jump_table:         .long   pgm_check_table
+.Lc_schedule:           .long   schedule
 #ifdef CONFIG_PREEMPT
-.Lpreempt_irq:          .long   preempt_schedule_irq
+.Lc_preempt_irq:        .long   preempt_schedule_irq
 #endif
-.Ltrace_enter:          .long   do_syscall_trace_enter
-.Ltrace_exit:           .long   do_syscall_trace_exit
-.Lschedule_tail:        .long   schedule_tail
-.Lsysc_per:             .long   sysc_per + 0x80000000
+.Lc_trace_enter:        .long   do_syscall_trace_enter
+.Lc_trace_exit:         .long   do_syscall_trace_exit
+.Lc_schedule_tail:      .long   schedule_tail
+.Lc_sysc_per:           .long   .Lsysc_per + 0x80000000
 #ifdef CONFIG_TRACE_IRQFLAGS
-.Lhardirqs_on:          .long   trace_hardirqs_on_caller
-.Lhardirqs_off:         .long   trace_hardirqs_off_caller
+.Lc_hardirqs_on:        .long   trace_hardirqs_on_caller
+.Lc_hardirqs_off:       .long   trace_hardirqs_off_caller
 #endif
 #ifdef CONFIG_LOCKDEP
-.Llockdep_sys_exit:     .long   lockdep_sys_exit
+.Lc_lockdep_sys_exit:   .long   lockdep_sys_exit
 #endif
-.Lcritical_start:       .long   __critical_start + 0x80000000
-.Lcritical_length:      .long   __critical_end - __critical_start
+.Lc_critical_start:     .long   .L__critical_start + 0x80000000
+.Lc_critical_length:    .long   .L__critical_end - .L__critical_start
 
                 .section .rodata, "a"
 #define SYSCALL(esa,esame,emu)  .long esa
diff --git a/arch/s390/kernel/entry.h b/arch/s390/kernel/entry.h
index 0554b9771c9f..8e61393c8275 100644
--- a/arch/s390/kernel/entry.h
+++ b/arch/s390/kernel/entry.h
@@ -74,4 +74,6 @@ struct old_sigaction;
 long sys_s390_personality(unsigned int personality);
 long sys_s390_runtime_instr(int command, int signum);
 
+long sys_s390_pci_mmio_write(unsigned long, const void __user *, size_t);
+long sys_s390_pci_mmio_read(unsigned long, void __user *, size_t);
 #endif /* _ENTRY_H */
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 7b2e03afd017..c329446a951d 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -91,7 +91,7 @@ _PIF_WORK	= (_PIF_PER_TRAP)
         .if     \reason==1
         # Some program interrupts are suppressing (e.g. protection).
         # We must also check the instruction after SIE in that case.
-        # do_protection_exception will rewind to rewind_pad
+        # do_protection_exception will rewind to .Lrewind_pad
         jh      .+42
         .else
         jhe     .+42
@@ -192,7 +192,7 @@ ENTRY(__switch_to)
         lmg     %r6,%r15,__SF_GPRS(%r15)        # load gprs of next task
         br      %r14
 
-__critical_start:
+.L__critical_start:
 /*
  * SVC interrupt handler routine. System calls are synchronous events and
  * are executed with interrupts enabled.
@@ -200,15 +200,15 @@ __critical_start:
 
 ENTRY(system_call)
         stpt    __LC_SYNC_ENTER_TIMER
-sysc_stmg:
+.Lsysc_stmg:
         stmg    %r8,%r15,__LC_SAVE_AREA_SYNC
         lg      %r10,__LC_LAST_BREAK
         lg      %r12,__LC_THREAD_INFO
         lghi    %r14,_PIF_SYSCALL
-sysc_per:
+.Lsysc_per:
         lg      %r15,__LC_KERNEL_STACK
         la      %r11,STACK_FRAME_OVERHEAD(%r15) # pointer to pt_regs
-sysc_vtime:
+.Lsysc_vtime:
         UPDATE_VTIME %r13,__LC_SYNC_ENTER_TIMER
         LAST_BREAK %r13
         stmg    %r0,%r7,__PT_R0(%r11)
@@ -216,39 +216,39 @@ sysc_vtime:
         mvc     __PT_PSW(16,%r11),__LC_SVC_OLD_PSW
         mvc     __PT_INT_CODE(4,%r11),__LC_SVC_ILC
         stg     %r14,__PT_FLAGS(%r11)
-sysc_do_svc:
+.Lsysc_do_svc:
         lg      %r10,__TI_sysc_table(%r12)      # address of system call table
         llgh    %r8,__PT_INT_CODE+2(%r11)
         slag    %r8,%r8,2                       # shift and test for svc 0
-        jnz     sysc_nr_ok
+        jnz     .Lsysc_nr_ok
         # svc 0: system call number in %r1
         llgfr   %r1,%r1                         # clear high word in r1
         cghi    %r1,NR_syscalls
-        jnl     sysc_nr_ok
+        jnl     .Lsysc_nr_ok
         sth     %r1,__PT_INT_CODE+2(%r11)
         slag    %r8,%r1,2
-sysc_nr_ok:
+.Lsysc_nr_ok:
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
         stg     %r2,__PT_ORIG_GPR2(%r11)
         stg     %r7,STACK_FRAME_OVERHEAD(%r15)
         lgf     %r9,0(%r8,%r10)                 # get system call add.
         tm      __TI_flags+7(%r12),_TIF_TRACE
-        jnz     sysc_tracesys
+        jnz     .Lsysc_tracesys
         basr    %r14,%r9                        # call sys_xxxx
         stg     %r2,__PT_R2(%r11)               # store return value
 
-sysc_return:
+.Lsysc_return:
         LOCKDEP_SYS_EXIT
-sysc_tif:
+.Lsysc_tif:
         tm      __PT_PSW+1(%r11),0x01           # returning to user ?
-        jno     sysc_restore
+        jno     .Lsysc_restore
         tm      __PT_FLAGS+7(%r11),_PIF_WORK
-        jnz     sysc_work
+        jnz     .Lsysc_work
         tm      __TI_flags+7(%r12),_TIF_WORK
-        jnz     sysc_work                       # check for work
+        jnz     .Lsysc_work                     # check for work
         tm      __LC_CPU_FLAGS+7,_CIF_WORK
-        jnz     sysc_work
-sysc_restore:
+        jnz     .Lsysc_work
+.Lsysc_restore:
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
@@ -256,101 +256,101 @@ sysc_restore:
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
         lpswe   __LC_RETURN_PSW
-sysc_done:
+.Lsysc_done:
 
 #
 # One of the work bits is on. Find out which one.
 #
-sysc_work:
+.Lsysc_work:
         tm      __LC_CPU_FLAGS+7,_CIF_MCCK_PENDING
-        jo      sysc_mcck_pending
+        jo      .Lsysc_mcck_pending
         tm      __TI_flags+7(%r12),_TIF_NEED_RESCHED
-        jo      sysc_reschedule
+        jo      .Lsysc_reschedule
 #ifdef CONFIG_UPROBES
         tm      __TI_flags+7(%r12),_TIF_UPROBE
-        jo      sysc_uprobe_notify
+        jo      .Lsysc_uprobe_notify
 #endif
         tm      __PT_FLAGS+7(%r11),_PIF_PER_TRAP
-        jo      sysc_singlestep
+        jo      .Lsysc_singlestep
         tm      __TI_flags+7(%r12),_TIF_SIGPENDING
-        jo      sysc_sigpending
+        jo      .Lsysc_sigpending
         tm      __TI_flags+7(%r12),_TIF_NOTIFY_RESUME
-        jo      sysc_notify_resume
+        jo      .Lsysc_notify_resume
         tm      __LC_CPU_FLAGS+7,_CIF_ASCE
-        jo      sysc_uaccess
-        j       sysc_return             # beware of critical section cleanup
+        jo      .Lsysc_uaccess
+        j       .Lsysc_return           # beware of critical section cleanup
 
 #
 # _TIF_NEED_RESCHED is set, call schedule
 #
-sysc_reschedule:
-        larl    %r14,sysc_return
+.Lsysc_reschedule:
+        larl    %r14,.Lsysc_return
         jg      schedule
 
 #
 # _CIF_MCCK_PENDING is set, call handler
 #
-sysc_mcck_pending:
-        larl    %r14,sysc_return
+.Lsysc_mcck_pending:
+        larl    %r14,.Lsysc_return
         jg      s390_handle_mcck        # TIF bit will be cleared by handler
 
 #
 # _CIF_ASCE is set, load user space asce
 #
-sysc_uaccess:
+.Lsysc_uaccess:
         ni      __LC_CPU_FLAGS+7,255-_CIF_ASCE
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
-        j       sysc_return
+        j       .Lsysc_return
 
 #
 # _TIF_SIGPENDING is set, call do_signal
 #
-sysc_sigpending:
+.Lsysc_sigpending:
         lgr     %r2,%r11                # pass pointer to pt_regs
         brasl   %r14,do_signal
         tm      __PT_FLAGS+7(%r11),_PIF_SYSCALL
-        jno     sysc_return
+        jno     .Lsysc_return
         lmg     %r2,%r7,__PT_R2(%r11)   # load svc arguments
         lg      %r10,__TI_sysc_table(%r12)      # address of system call table
         lghi    %r8,0                   # svc 0 returns -ENOSYS
         llgh    %r1,__PT_INT_CODE+2(%r11)       # load new svc number
         cghi    %r1,NR_syscalls
-        jnl     sysc_nr_ok              # invalid svc number -> do svc 0
+        jnl     .Lsysc_nr_ok            # invalid svc number -> do svc 0
         slag    %r8,%r1,2
-        j       sysc_nr_ok              # restart svc
+        j       .Lsysc_nr_ok            # restart svc
 
 #
 # _TIF_NOTIFY_RESUME is set, call do_notify_resume
 #
-sysc_notify_resume:
+.Lsysc_notify_resume:
         lgr     %r2,%r11                # pass pointer to pt_regs
-        larl    %r14,sysc_return
+        larl    %r14,.Lsysc_return
         jg      do_notify_resume
 
 #
 # _TIF_UPROBE is set, call uprobe_notify_resume
 #
 #ifdef CONFIG_UPROBES
-sysc_uprobe_notify:
+.Lsysc_uprobe_notify:
         lgr     %r2,%r11                # pass pointer to pt_regs
-        larl    %r14,sysc_return
+        larl    %r14,.Lsysc_return
         jg      uprobe_notify_resume
 #endif
 
 #
 # _PIF_PER_TRAP is set, call do_per_trap
 #
-sysc_singlestep:
+.Lsysc_singlestep:
         ni      __PT_FLAGS+7(%r11),255-_PIF_PER_TRAP
         lgr     %r2,%r11                # pass pointer to pt_regs
-        larl    %r14,sysc_return
+        larl    %r14,.Lsysc_return
         jg      do_per_trap
 
 #
 # call tracehook_report_syscall_entry/tracehook_report_syscall_exit before
 # and after the system call
 #
-sysc_tracesys:
+.Lsysc_tracesys:
         lgr     %r2,%r11                # pass pointer to pt_regs
         la      %r3,0
         llgh    %r0,__PT_INT_CODE+2(%r11)
@@ -358,20 +358,20 @@ sysc_tracesys:
         brasl   %r14,do_syscall_trace_enter
         lghi    %r0,NR_syscalls
         clgr    %r0,%r2
-        jnh     sysc_tracenogo
+        jnh     .Lsysc_tracenogo
         sllg    %r8,%r2,2
         lgf     %r9,0(%r8,%r10)
-sysc_tracego:
+.Lsysc_tracego:
         lmg     %r3,%r7,__PT_R3(%r11)
         stg     %r7,STACK_FRAME_OVERHEAD(%r15)
         lg      %r2,__PT_ORIG_GPR2(%r11)
         basr    %r14,%r9                # call sys_xxx
         stg     %r2,__PT_R2(%r11)       # store return value
-sysc_tracenogo:
+.Lsysc_tracenogo:
         tm      __TI_flags+7(%r12),_TIF_TRACE
-        jz      sysc_return
+        jz      .Lsysc_return
         lgr     %r2,%r11                # pass pointer to pt_regs
-        larl    %r14,sysc_return
+        larl    %r14,.Lsysc_return
         jg      do_syscall_trace_exit
 
 #
@@ -384,13 +384,13 @@ ENTRY(ret_from_fork)
         TRACE_IRQS_ON
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         tm      __PT_PSW+1(%r11),0x01   # forking a kernel thread ?
-        jne     sysc_tracenogo
+        jne     .Lsysc_tracenogo
         # it's a kernel thread
         lmg     %r9,%r10,__PT_R9(%r11)  # load gprs
 ENTRY(kernel_thread_starter)
         la      %r2,0(%r10)
         basr    %r14,%r9
-        j       sysc_tracenogo
+        j       .Lsysc_tracenogo
 
 /*
  * Program check handler routine
@@ -409,7 +409,7 @@ ENTRY(pgm_check_handler)
         tmhh    %r8,0x4000              # PER bit set in old PSW ?
         jnz     0f                      # -> enabled, can't be a double fault
         tm      __LC_PGM_ILC+3,0x80     # check for per exception
-        jnz     pgm_svcper              # -> single stepped svc
+        jnz     .Lpgm_svcper            # -> single stepped svc
 0:      CHECK_STACK STACK_SIZE,__LC_SAVE_AREA_SYNC
         aghi    %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
         j       2f
@@ -432,7 +432,7 @@ ENTRY(pgm_check_handler)
         tm      __LC_PGM_ILC+3,0x80     # check for per exception
         jz      0f
         tmhh    %r8,0x0001              # kernel per event ?
-        jz      pgm_kprobe
+        jz      .Lpgm_kprobe
         oi      __PT_FLAGS+7(%r11),_PIF_PER_TRAP
         mvc     __THREAD_per_address(8,%r14),__LC_PER_ADDRESS
         mvc     __THREAD_per_cause(2,%r14),__LC_PER_CODE
@@ -443,31 +443,31 @@ ENTRY(pgm_check_handler)
         llgh    %r10,__PT_INT_CODE+2(%r11)
         nill    %r10,0x007f
         sll     %r10,2
-        je      sysc_return
+        je      .Lsysc_return
         lgf     %r1,0(%r10,%r1)         # load address of handler routine
         lgr     %r2,%r11                # pass pointer to pt_regs
         basr    %r14,%r1                # branch to interrupt-handler
-        j       sysc_return
+        j       .Lsysc_return
 
 #
 # PER event in supervisor state, must be kprobes
 #
-pgm_kprobe:
+.Lpgm_kprobe:
         REENABLE_IRQS
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
         lgr     %r2,%r11                # pass pointer to pt_regs
         brasl   %r14,do_per_trap
-        j       sysc_return
+        j       .Lsysc_return
 
 #
 # single stepped system call
 #
-pgm_svcper:
+.Lpgm_svcper:
         mvc     __LC_RETURN_PSW(8),__LC_SVC_NEW_PSW
-        larl    %r14,sysc_per
+        larl    %r14,.Lsysc_per
         stg     %r14,__LC_RETURN_PSW+8
         lghi    %r14,_PIF_SYSCALL | _PIF_PER_TRAP
-        lpswe   __LC_RETURN_PSW         # branch to sysc_per and enable irqs
+        lpswe   __LC_RETURN_PSW         # branch to .Lsysc_per and enable irqs
 
 /*
  * IO interrupt handler routine
@@ -483,10 +483,10 @@ ENTRY(io_int_handler)
         HANDLE_SIE_INTERCEPT %r14,2
         SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_STACK,STACK_SHIFT
         tmhh    %r8,0x0001              # interrupting from user?
-        jz      io_skip
+        jz      .Lio_skip
         UPDATE_VTIME %r14,__LC_ASYNC_ENTER_TIMER
         LAST_BREAK %r14
-io_skip:
+.Lio_skip:
         stmg    %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC
         stmg    %r8,%r9,__PT_PSW(%r11)
@@ -494,29 +494,29 @@ io_skip:
         xc      __PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
         TRACE_IRQS_OFF
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
-io_loop:
+.Lio_loop:
         lgr     %r2,%r11                # pass pointer to pt_regs
         lghi    %r3,IO_INTERRUPT
         tm      __PT_INT_CODE+8(%r11),0x80      # adapter interrupt ?
-        jz      io_call
+        jz      .Lio_call
         lghi    %r3,THIN_INTERRUPT
-io_call:
+.Lio_call:
         brasl   %r14,do_IRQ
         tm      __LC_MACHINE_FLAGS+6,0x10       # MACHINE_FLAG_LPAR
-        jz      io_return
+        jz      .Lio_return
         tpi     0
-        jz      io_return
+        jz      .Lio_return
         mvc     __PT_INT_CODE(12,%r11),__LC_SUBCHANNEL_ID
-        j       io_loop
-io_return:
+        j       .Lio_loop
+.Lio_return:
         LOCKDEP_SYS_EXIT
         TRACE_IRQS_ON
-io_tif:
+.Lio_tif:
         tm      __TI_flags+7(%r12),_TIF_WORK
-        jnz     io_work                 # there is work to do (signals etc.)
+        jnz     .Lio_work               # there is work to do (signals etc.)
         tm      __LC_CPU_FLAGS+7,_CIF_WORK
-        jnz     io_work
-io_restore:
+        jnz     .Lio_work
+.Lio_restore:
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
@@ -524,7 +524,7 @@ io_restore:
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
         lpswe   __LC_RETURN_PSW
-io_done:
+.Lio_done:
 
 #
 # There is work todo, find out in which context we have been interrupted:
@@ -535,15 +535,15 @@ io_done:
 #    the preemption counter and if it is zero call preempt_schedule_irq
 # Before any work can be done, a switch to the kernel stack is required.
 #
-io_work:
+.Lio_work:
         tm      __PT_PSW+1(%r11),0x01   # returning to user ?
-        jo      io_work_user            # yes -> do resched & signal
+        jo      .Lio_work_user          # yes -> do resched & signal
 #ifdef CONFIG_PREEMPT
         # check for preemptive scheduling
         icm     %r0,15,__TI_precount(%r12)
-        jnz     io_restore              # preemption is disabled
+        jnz     .Lio_restore            # preemption is disabled
         tm      __TI_flags+7(%r12),_TIF_NEED_RESCHED
-        jno     io_restore
+        jno     .Lio_restore
         # switch to kernel stack
         lg      %r1,__PT_R15(%r11)
         aghi    %r1,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
@@ -551,19 +551,19 @@ io_work:
         xc      __SF_BACKCHAIN(8,%r1),__SF_BACKCHAIN(%r1)
         la      %r11,STACK_FRAME_OVERHEAD(%r1)
         lgr     %r15,%r1
-        # TRACE_IRQS_ON already done at io_return, call
+        # TRACE_IRQS_ON already done at .Lio_return, call
         # TRACE_IRQS_OFF to keep things symmetrical
         TRACE_IRQS_OFF
         brasl   %r14,preempt_schedule_irq
-        j       io_return
+        j       .Lio_return
 #else
-        j       io_restore
+        j       .Lio_restore
 #endif
 
 #
 # Need to do work before returning to userspace, switch to kernel stack
 #
-io_work_user:
+.Lio_work_user:
         lg      %r1,__LC_KERNEL_STACK
         mvc     STACK_FRAME_OVERHEAD(__PT_SIZE,%r1),0(%r11)
         xc      __SF_BACKCHAIN(8,%r1),__SF_BACKCHAIN(%r1)
@@ -573,70 +573,70 @@ io_work_user:
 #
 # One of the work bits is on. Find out which one.
 #
-io_work_tif:
+.Lio_work_tif:
         tm      __LC_CPU_FLAGS+7,_CIF_MCCK_PENDING
-        jo      io_mcck_pending
+        jo      .Lio_mcck_pending
         tm      __TI_flags+7(%r12),_TIF_NEED_RESCHED
-        jo      io_reschedule
+        jo      .Lio_reschedule
         tm      __TI_flags+7(%r12),_TIF_SIGPENDING
-        jo      io_sigpending
+        jo      .Lio_sigpending
         tm      __TI_flags+7(%r12),_TIF_NOTIFY_RESUME
-        jo      io_notify_resume
+        jo      .Lio_notify_resume
         tm      __LC_CPU_FLAGS+7,_CIF_ASCE
-        jo      io_uaccess
-        j       io_return               # beware of critical section cleanup
+        jo      .Lio_uaccess
+        j       .Lio_return             # beware of critical section cleanup
 
 #
 # _CIF_MCCK_PENDING is set, call handler
 #
-io_mcck_pending:
-        # TRACE_IRQS_ON already done at io_return
+.Lio_mcck_pending:
+        # TRACE_IRQS_ON already done at .Lio_return
         brasl   %r14,s390_handle_mcck   # TIF bit will be cleared by handler
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 #
 # _CIF_ASCE is set, load user space asce
 #
-io_uaccess:
+.Lio_uaccess:
         ni      __LC_CPU_FLAGS+7,255-_CIF_ASCE
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
-        j       io_return
+        j       .Lio_return
 
 #
 # _TIF_NEED_RESCHED is set, call schedule
 #
-io_reschedule:
-        # TRACE_IRQS_ON already done at io_return
+.Lio_reschedule:
+        # TRACE_IRQS_ON already done at .Lio_return
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         brasl   %r14,schedule           # call scheduler
         ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 #
 # _TIF_SIGPENDING or is set, call do_signal
 #
-io_sigpending:
-        # TRACE_IRQS_ON already done at io_return
+.Lio_sigpending:
+        # TRACE_IRQS_ON already done at .Lio_return
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         lgr     %r2,%r11                # pass pointer to pt_regs
         brasl   %r14,do_signal
         ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 #
 # _TIF_NOTIFY_RESUME or is set, call do_notify_resume
 #
-io_notify_resume:
-        # TRACE_IRQS_ON already done at io_return
+.Lio_notify_resume:
+        # TRACE_IRQS_ON already done at .Lio_return
         ssm     __LC_SVC_NEW_PSW        # reenable interrupts
         lgr     %r2,%r11                # pass pointer to pt_regs
         brasl   %r14,do_notify_resume
         ssm     __LC_PGM_NEW_PSW        # disable I/O and ext. interrupts
         TRACE_IRQS_OFF
-        j       io_return
+        j       .Lio_return
 
 /*
  * External interrupt handler routine
@@ -652,10 +652,10 @@ ENTRY(ext_int_handler)
         HANDLE_SIE_INTERCEPT %r14,3
         SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_STACK,STACK_SHIFT
         tmhh    %r8,0x0001              # interrupting from user ?
-        jz      ext_skip
+        jz      .Lext_skip
         UPDATE_VTIME %r14,__LC_ASYNC_ENTER_TIMER
         LAST_BREAK %r14
-ext_skip:
+.Lext_skip:
         stmg    %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC
         stmg    %r8,%r9,__PT_PSW(%r11)
@@ -669,23 +669,23 @@ ext_skip:
         lgr     %r2,%r11                # pass pointer to pt_regs
         lghi    %r3,EXT_INTERRUPT
         brasl   %r14,do_IRQ
-        j       io_return
+        j       .Lio_return
 
 /*
- * Load idle PSW. The second "half" of this function is in cleanup_idle.
+ * Load idle PSW. The second "half" of this function is in .Lcleanup_idle.
  */
 ENTRY(psw_idle)
         stg     %r3,__SF_EMPTY(%r15)
-        larl    %r1,psw_idle_lpsw+4
+        larl    %r1,.Lpsw_idle_lpsw+4
         stg     %r1,__SF_EMPTY+8(%r15)
         STCK    __CLOCK_IDLE_ENTER(%r2)
         stpt    __TIMER_IDLE_ENTER(%r2)
-psw_idle_lpsw:
+.Lpsw_idle_lpsw:
         lpswe   __SF_EMPTY(%r15)
         br      %r14
-psw_idle_end:
+.Lpsw_idle_end:
 
-__critical_end:
+.L__critical_end:
 
 /*
  * Machine check handler routines
@@ -701,7 +701,7 @@ ENTRY(mcck_int_handler)
         lmg     %r8,%r9,__LC_MCK_OLD_PSW
         HANDLE_SIE_INTERCEPT %r14,4
         tm      __LC_MCCK_CODE,0x80     # system damage?
-        jo      mcck_panic              # yes -> rest of mcck code invalid
+        jo      .Lmcck_panic            # yes -> rest of mcck code invalid
         lghi    %r14,__LC_CPU_TIMER_SAVE_AREA
         mvc     __LC_MCCK_ENTER_TIMER(8),0(%r14)
         tm      __LC_MCCK_CODE+5,0x02   # stored cpu timer value valid?
@@ -719,13 +719,13 @@ ENTRY(mcck_int_handler)
 2:      spt     0(%r14)
         mvc     __LC_MCCK_ENTER_TIMER(8),0(%r14)
 3:      tm      __LC_MCCK_CODE+2,0x09   # mwp + ia of old psw valid?
-        jno     mcck_panic              # no -> skip cleanup critical
+        jno     .Lmcck_panic            # no -> skip cleanup critical
         SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+64,__LC_PANIC_STACK,PAGE_SHIFT
         tm      %r8,0x0001              # interrupting from user ?
-        jz      mcck_skip
+        jz      .Lmcck_skip
         UPDATE_VTIME %r14,__LC_MCCK_ENTER_TIMER
         LAST_BREAK %r14
-mcck_skip:
+.Lmcck_skip:
         lghi    %r14,__LC_GPREGS_SAVE_AREA+64
         stmg    %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(64,%r11),0(%r14)
@@ -735,7 +735,7 @@ mcck_skip:
         lgr     %r2,%r11                # pass pointer to pt_regs
         brasl   %r14,s390_do_machine_check
         tm      __PT_PSW+1(%r11),0x01   # returning to user ?
-        jno     mcck_return
+        jno     .Lmcck_return
         lg      %r1,__LC_KERNEL_STACK   # switch to kernel stack
         mvc     STACK_FRAME_OVERHEAD(__PT_SIZE,%r1),0(%r11)
         xc      __SF_BACKCHAIN(8,%r1),__SF_BACKCHAIN(%r1)
@@ -743,11 +743,11 @@ mcck_skip:
         lgr     %r15,%r1
         ssm     __LC_PGM_NEW_PSW        # turn dat on, keep irqs off
         tm      __LC_CPU_FLAGS+7,_CIF_MCCK_PENDING
-        jno     mcck_return
+        jno     .Lmcck_return
         TRACE_IRQS_OFF
         brasl   %r14,s390_handle_mcck
         TRACE_IRQS_ON
-mcck_return:
+.Lmcck_return:
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_MCCK_PSW(16),__PT_PSW(%r11) # move return PSW
@@ -758,14 +758,14 @@ mcck_return:
 0:      lmg     %r11,%r15,__PT_R11(%r11)
         lpswe   __LC_RETURN_MCCK_PSW
 
-mcck_panic:
+.Lmcck_panic:
         lg      %r14,__LC_PANIC_STACK
         slgr    %r14,%r15
         srag    %r14,%r14,PAGE_SHIFT
         jz      0f
         lg      %r15,__LC_PANIC_STACK
 0:      aghi    %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
-        j       mcck_skip
+        j       .Lmcck_skip
 
 #
 # PSW restart interrupt handler
@@ -815,69 +815,69 @@ stack_overflow:
 #endif
 
         .align  8
-cleanup_table:
+.Lcleanup_table:
         .quad   system_call
-        .quad   sysc_do_svc
-        .quad   sysc_tif
-        .quad   sysc_restore
-        .quad   sysc_done
-        .quad   io_tif
-        .quad   io_restore
-        .quad   io_done
+        .quad   .Lsysc_do_svc
+        .quad   .Lsysc_tif
+        .quad   .Lsysc_restore
+        .quad   .Lsysc_done
+        .quad   .Lio_tif
+        .quad   .Lio_restore
+        .quad   .Lio_done
         .quad   psw_idle
-        .quad   psw_idle_end
+        .quad   .Lpsw_idle_end
 
 cleanup_critical:
-        clg     %r9,BASED(cleanup_table)        # system_call
+        clg     %r9,BASED(.Lcleanup_table)      # system_call
         jl      0f
-        clg     %r9,BASED(cleanup_table+8)      # sysc_do_svc
-        jl      cleanup_system_call
-        clg     %r9,BASED(cleanup_table+16)     # sysc_tif
+        clg     %r9,BASED(.Lcleanup_table+8)    # .Lsysc_do_svc
+        jl      .Lcleanup_system_call
+        clg     %r9,BASED(.Lcleanup_table+16)   # .Lsysc_tif
         jl      0f
-        clg     %r9,BASED(cleanup_table+24)     # sysc_restore
-        jl      cleanup_sysc_tif
-        clg     %r9,BASED(cleanup_table+32)     # sysc_done
-        jl      cleanup_sysc_restore
-        clg     %r9,BASED(cleanup_table+40)     # io_tif
+        clg     %r9,BASED(.Lcleanup_table+24)   # .Lsysc_restore
+        jl      .Lcleanup_sysc_tif
+        clg     %r9,BASED(.Lcleanup_table+32)   # .Lsysc_done
+        jl      .Lcleanup_sysc_restore
+        clg     %r9,BASED(.Lcleanup_table+40)   # .Lio_tif
         jl      0f
-        clg     %r9,BASED(cleanup_table+48)     # io_restore
-        jl      cleanup_io_tif
-        clg     %r9,BASED(cleanup_table+56)     # io_done
-        jl      cleanup_io_restore
-        clg     %r9,BASED(cleanup_table+64)     # psw_idle
+        clg     %r9,BASED(.Lcleanup_table+48)   # .Lio_restore
+        jl      .Lcleanup_io_tif
+        clg     %r9,BASED(.Lcleanup_table+56)   # .Lio_done
+        jl      .Lcleanup_io_restore
+        clg     %r9,BASED(.Lcleanup_table+64)   # psw_idle
         jl      0f
-        clg     %r9,BASED(cleanup_table+72)     # psw_idle_end
-        jl      cleanup_idle
+        clg     %r9,BASED(.Lcleanup_table+72)   # .Lpsw_idle_end
+        jl      .Lcleanup_idle
 0:      br      %r14
 
 
-cleanup_system_call:
+.Lcleanup_system_call:
         # check if stpt has been executed
-        clg     %r9,BASED(cleanup_system_call_insn)
+        clg     %r9,BASED(.Lcleanup_system_call_insn)
         jh      0f
         mvc     __LC_SYNC_ENTER_TIMER(8),__LC_ASYNC_ENTER_TIMER
         cghi    %r11,__LC_SAVE_AREA_ASYNC
         je      0f
         mvc     __LC_SYNC_ENTER_TIMER(8),__LC_MCCK_ENTER_TIMER
 0:      # check if stmg has been executed
-        clg     %r9,BASED(cleanup_system_call_insn+8)
+        clg     %r9,BASED(.Lcleanup_system_call_insn+8)
         jh      0f
         mvc     __LC_SAVE_AREA_SYNC(64),0(%r11)
 0:      # check if base register setup + TIF bit load has been done
-        clg     %r9,BASED(cleanup_system_call_insn+16)
+        clg     %r9,BASED(.Lcleanup_system_call_insn+16)
         jhe     0f
         # set up saved registers r10 and r12
         stg     %r10,16(%r11)           # r10 last break
         stg     %r12,32(%r11)           # r12 thread-info pointer
 0:      # check if the user time update has been done
-        clg     %r9,BASED(cleanup_system_call_insn+24)
+        clg     %r9,BASED(.Lcleanup_system_call_insn+24)
         jh      0f
         lg      %r15,__LC_EXIT_TIMER
         slg     %r15,__LC_SYNC_ENTER_TIMER
         alg     %r15,__LC_USER_TIMER
         stg     %r15,__LC_USER_TIMER
 0:      # check if the system time update has been done
-        clg     %r9,BASED(cleanup_system_call_insn+32)
+        clg     %r9,BASED(.Lcleanup_system_call_insn+32)
         jh      0f
         lg      %r15,__LC_LAST_UPDATE_TIMER
         slg     %r15,__LC_EXIT_TIMER
@@ -904,21 +904,21 @@ cleanup_system_call:
         # setup saved register r15
         stg     %r15,56(%r11)           # r15 stack pointer
         # set new psw address and exit
-        larl    %r9,sysc_do_svc
+        larl    %r9,.Lsysc_do_svc
         br      %r14
-cleanup_system_call_insn:
+.Lcleanup_system_call_insn:
         .quad   system_call
-        .quad   sysc_stmg
-        .quad   sysc_per
-        .quad   sysc_vtime+18
-        .quad   sysc_vtime+42
+        .quad   .Lsysc_stmg
+        .quad   .Lsysc_per
+        .quad   .Lsysc_vtime+18
+        .quad   .Lsysc_vtime+42
 
-cleanup_sysc_tif:
-        larl    %r9,sysc_tif
+.Lcleanup_sysc_tif:
+        larl    %r9,.Lsysc_tif
         br      %r14
 
-cleanup_sysc_restore:
-        clg     %r9,BASED(cleanup_sysc_restore_insn)
+.Lcleanup_sysc_restore:
+        clg     %r9,BASED(.Lcleanup_sysc_restore_insn)
         je      0f
         lg      %r9,24(%r11)            # get saved pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
@@ -926,15 +926,15 @@ cleanup_sysc_restore:
         lmg     %r0,%r7,__PT_R0(%r9)
 0:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
-cleanup_sysc_restore_insn:
-        .quad   sysc_done - 4
+.Lcleanup_sysc_restore_insn:
+        .quad   .Lsysc_done - 4
 
-cleanup_io_tif:
-        larl    %r9,io_tif
+.Lcleanup_io_tif:
+        larl    %r9,.Lio_tif
         br      %r14
 
-cleanup_io_restore:
-        clg     %r9,BASED(cleanup_io_restore_insn)
+.Lcleanup_io_restore:
+        clg     %r9,BASED(.Lcleanup_io_restore_insn)
         je      0f
         lg      %r9,24(%r11)            # get saved r11 pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
@@ -942,10 +942,10 @@ cleanup_io_restore:
         lmg     %r0,%r7,__PT_R0(%r9)
 0:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
-cleanup_io_restore_insn:
-        .quad   io_done - 4
+.Lcleanup_io_restore_insn:
+        .quad   .Lio_done - 4
 
-cleanup_idle:
+.Lcleanup_idle:
         # copy interrupt clock & cpu timer
         mvc     __CLOCK_IDLE_EXIT(8,%r2),__LC_INT_CLOCK
         mvc     __TIMER_IDLE_EXIT(8,%r2),__LC_ASYNC_ENTER_TIMER
@@ -954,7 +954,7 @@ cleanup_idle:
         mvc     __CLOCK_IDLE_EXIT(8,%r2),__LC_MCCK_CLOCK
         mvc     __TIMER_IDLE_EXIT(8,%r2),__LC_MCCK_ENTER_TIMER
 0:      # check if stck & stpt have been executed
-        clg     %r9,BASED(cleanup_idle_insn)
+        clg     %r9,BASED(.Lcleanup_idle_insn)
         jhe     1f
         mvc     __CLOCK_IDLE_ENTER(8,%r2),__CLOCK_IDLE_EXIT(%r2)
         mvc     __TIMER_IDLE_ENTER(8,%r2),__TIMER_IDLE_EXIT(%r2)
@@ -973,17 +973,17 @@ cleanup_idle:
         nihh    %r8,0xfcfd              # clear irq & wait state bits
         lg      %r9,48(%r11)            # return from psw_idle
         br      %r14
-cleanup_idle_insn:
-        .quad   psw_idle_lpsw
+.Lcleanup_idle_insn:
+        .quad   .Lpsw_idle_lpsw
 
 /*
  * Integer constants
  */
         .align  8
 .Lcritical_start:
-        .quad   __critical_start
+        .quad   .L__critical_start
 .Lcritical_length:
-        .quad   __critical_end - __critical_start
+        .quad   .L__critical_end - .L__critical_start
 
 
 #if IS_ENABLED(CONFIG_KVM)
@@ -1000,25 +1000,25 @@ ENTRY(sie64a)
         lmg     %r0,%r13,0(%r3)                 # load guest gprs 0-13
         lg      %r14,__LC_GMAP                  # get gmap pointer
         ltgr    %r14,%r14
-        jz      sie_gmap
+        jz      .Lsie_gmap
         lctlg   %c1,%c1,__GMAP_ASCE(%r14)       # load primary asce
-sie_gmap:
+.Lsie_gmap:
         lg      %r14,__SF_EMPTY(%r15)           # get control block pointer
         oi      __SIE_PROG0C+3(%r14),1          # we are going into SIE now
         tm      __SIE_PROG20+3(%r14),1          # last exit...
-        jnz     sie_done
+        jnz     .Lsie_done
         LPP     __SF_EMPTY(%r15)                # set guest id
         sie     0(%r14)
-sie_done:
+.Lsie_done:
         LPP     __SF_EMPTY+16(%r15)             # set host id
         ni      __SIE_PROG0C+3(%r14),0xfe       # no longer in SIE
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 # some program checks are suppressing. C code (e.g. do_protection_exception)
 # will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions between sie64a and sie_done should not cause program
+# instructions between sie64a and .Lsie_done should not cause program
 # interrupts. So lets use a nop (47 00 00 00) as a landing pad.
 # See also HANDLE_SIE_INTERCEPT
-rewind_pad:
+.Lrewind_pad:
         nop     0
         .globl sie_exit
 sie_exit:
@@ -1027,19 +1027,19 @@ sie_exit:
         lmg     %r6,%r14,__SF_GPRS(%r15)        # restore kernel registers
         lg      %r2,__SF_EMPTY+24(%r15)         # return exit reason code
         br      %r14
-sie_fault:
+.Lsie_fault:
         lghi    %r14,-EFAULT
         stg     %r14,__SF_EMPTY+24(%r15)        # set exit reason code
         j       sie_exit
 
         .align  8
 .Lsie_critical:
-        .quad   sie_gmap
+        .quad   .Lsie_gmap
 .Lsie_critical_length:
-        .quad   sie_done - sie_gmap
+        .quad   .Lsie_done - .Lsie_gmap
 
-        EX_TABLE(rewind_pad,sie_fault)
-        EX_TABLE(sie_exit,sie_fault)
+        EX_TABLE(.Lrewind_pad,.Lsie_fault)
+        EX_TABLE(sie_exit,.Lsie_fault)
 #endif
 
                 .section .rodata, "a"
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index ca1cabb3a96c..b86bb8823f15 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -7,6 +7,7 @@
  *              Martin Schwidefsky <schwidefsky@de.ibm.com>
  */
 
+#include <linux/moduleloader.h>
 #include <linux/hardirq.h>
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
@@ -15,60 +16,39 @@
 #include <linux/kprobes.h>
 #include <trace/syscall.h>
 #include <asm/asm-offsets.h>
+#include <asm/cacheflush.h>
 #include "entry.h"
 
-void mcount_replace_code(void);
-void ftrace_disable_code(void);
-void ftrace_enable_insn(void);
-
 /*
  * The mcount code looks like this:
  *      stg     %r14,8(%r15)            # offset 0
  *      larl    %r1,<&counter>          # offset 6
  *      brasl   %r14,_mcount            # offset 12
  *      lg      %r14,8(%r15)            # offset 18
- * Total length is 24 bytes. The complete mcount block initially gets replaced
- * by ftrace_make_nop. Subsequent calls to ftrace_make_call / ftrace_make_nop
- * only patch the jg/lg instruction within the block.
- * Note: we do not patch the first instruction to an unconditional branch,
- * since that would break kprobes/jprobes. It is easier to leave the larl
- * instruction in and only modify the second instruction.
+ * Total length is 24 bytes. Only the first instruction will be patched
+ * by ftrace_make_call / ftrace_make_nop.
  * The enabled ftrace code block looks like this:
- *      larl    %r0,.+24                # offset 0
- * >    lg      %r1,__LC_FTRACE_FUNC    # offset 6
- *      br      %r1                     # offset 12
- *      brcl    0,0                     # offset 14
- *      brc     0,0                     # offset 20
+ * >    brasl   %r0,ftrace_caller       # offset 0
+ *      larl    %r1,<&counter>          # offset 6
+ *      brasl   %r14,_mcount            # offset 12
+ *      lg      %r14,8(%r15)            # offset 18
  * The ftrace function gets called with a non-standard C function call ABI
  * where r0 contains the return address. It is also expected that the called
  * function only clobbers r0 and r1, but restores r2-r15.
+ * For module code we can't directly jump to ftrace caller, but need a
+ * trampoline (ftrace_plt), which clobbers also r1.
  * The return point of the ftrace function has offset 24, so execution
  * continues behind the mcount block.
- *      larl    %r0,.+24                # offset 0
- * >    jg      .+18                    # offset 6
- *      br      %r1                     # offset 12
- *      brcl    0,0                     # offset 14
- *      brc     0,0                     # offset 20
+ * The disabled ftrace code block looks like this:
+ * >    jg      .+24                    # offset 0
+ *      larl    %r1,<&counter>          # offset 6
+ *      brasl   %r14,_mcount            # offset 12
+ *      lg      %r14,8(%r15)            # offset 18
  * The jg instruction branches to offset 24 to skip as many instructions
  * as possible.
  */
-asm(
-        "       .align  4\n"
-        "mcount_replace_code:\n"
-        "       larl    %r0,0f\n"
-        "ftrace_disable_code:\n"
-        "       jg      0f\n"
-        "       br      %r1\n"
-        "       brcl    0,0\n"
-        "       brc     0,0\n"
-        "0:\n"
-        "       .align  4\n"
-        "ftrace_enable_insn:\n"
-        "       lg      %r1,"__stringify(__LC_FTRACE_FUNC)"\n");
-
-#define MCOUNT_BLOCK_SIZE       24
-#define MCOUNT_INSN_OFFSET      6
-#define FTRACE_INSN_SIZE        6
+
+unsigned long ftrace_plt;
 
 int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
                        unsigned long addr)
@@ -79,24 +59,62 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
 int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
                     unsigned long addr)
 {
-        /* Initial replacement of the whole mcount block */
-        if (addr == MCOUNT_ADDR) {
-                if (probe_kernel_write((void *) rec->ip - MCOUNT_INSN_OFFSET,
-                                       mcount_replace_code,
-                                       MCOUNT_BLOCK_SIZE))
-                        return -EPERM;
-                return 0;
+        struct ftrace_insn insn;
+        unsigned short op;
+        void *from, *to;
+        size_t size;
+
+        ftrace_generate_nop_insn(&insn);
+        size = sizeof(insn);
+        from = &insn;
+        to = (void *) rec->ip;
+        if (probe_kernel_read(&op, (void *) rec->ip, sizeof(op)))
+                return -EFAULT;
+        /*
+         * If we find a breakpoint instruction, a kprobe has been placed
+         * at the beginning of the function. We write the constant
+         * KPROBE_ON_FTRACE_NOP into the remaining four bytes of the original
+         * instruction so that the kprobes handler can execute a nop, if it
+         * reaches this breakpoint.
+         */
+        if (op == BREAKPOINT_INSTRUCTION) {
+                size -= 2;
+                from += 2;
+                to += 2;
+                insn.disp = KPROBE_ON_FTRACE_NOP;
         }
-        if (probe_kernel_write((void *) rec->ip, ftrace_disable_code,
-                               MCOUNT_INSN_SIZE))
+        if (probe_kernel_write(to, from, size))
                 return -EPERM;
         return 0;
 }
 
 int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 {
-        if (probe_kernel_write((void *) rec->ip, ftrace_enable_insn,
-                               FTRACE_INSN_SIZE))
+        struct ftrace_insn insn;
+        unsigned short op;
+        void *from, *to;
+        size_t size;
+
+        ftrace_generate_call_insn(&insn, rec->ip);
+        size = sizeof(insn);
+        from = &insn;
+        to = (void *) rec->ip;
+        if (probe_kernel_read(&op, (void *) rec->ip, sizeof(op)))
+                return -EFAULT;
+        /*
+         * If we find a breakpoint instruction, a kprobe has been placed
+         * at the beginning of the function. We write the constant
+         * KPROBE_ON_FTRACE_CALL into the remaining four bytes of the original
+         * instruction so that the kprobes handler can execute a brasl if it
+         * reaches this breakpoint.
+         */
+        if (op == BREAKPOINT_INSTRUCTION) {
+                size -= 2;
+                from += 2;
+                to += 2;
+                insn.disp = KPROBE_ON_FTRACE_CALL;
+        }
+        if (probe_kernel_write(to, from, size))
                 return -EPERM;
         return 0;
 }
@@ -111,13 +129,30 @@ int __init ftrace_dyn_arch_init(void)
         return 0;
 }
 
+static int __init ftrace_plt_init(void)
+{
+        unsigned int *ip;
+
+        ftrace_plt = (unsigned long) module_alloc(PAGE_SIZE);
+        if (!ftrace_plt)
+                panic("cannot allocate ftrace plt\n");
+        ip = (unsigned int *) ftrace_plt;
+        ip[0] = 0x0d10e310; /* basr 1,0; lg 1,10(1); br 1 */
+        ip[1] = 0x100a0004;
+        ip[2] = 0x07f10000;
+        ip[3] = FTRACE_ADDR >> 32;
+        ip[4] = FTRACE_ADDR & 0xffffffff;
+        set_memory_ro(ftrace_plt, 1);
+        return 0;
+}
+device_initcall(ftrace_plt_init);
+
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 /*
  * Hook the return address and push it in the stack of return addresses
  * in current thread info.
  */
-unsigned long __kprobes prepare_ftrace_return(unsigned long parent,
-                                              unsigned long ip)
+unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
 {
         struct ftrace_graph_ent trace;
 
@@ -137,6 +172,7 @@ unsigned long __kprobes prepare_ftrace_return(unsigned long parent,
 out:
         return parent;
 }
+NOKPROBE_SYMBOL(prepare_ftrace_return);
 
 /*
  * Patch the kernel code at ftrace_graph_caller location. The instruction
diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c
index 7559f1beab29..7a55c29b0b33 100644
--- a/arch/s390/kernel/idle.c
+++ b/arch/s390/kernel/idle.c
@@ -19,7 +19,7 @@
 
 static DEFINE_PER_CPU(struct s390_idle_data, s390_idle);
 
-void __kprobes enabled_wait(void)
+void enabled_wait(void)
 {
         struct s390_idle_data *idle = this_cpu_ptr(&s390_idle);
         unsigned long long idle_time;
@@ -35,31 +35,32 @@ void __kprobes enabled_wait(void)
         /* Call the assembler magic in entry.S */
         psw_idle(idle, psw_mask);
 
+        trace_hardirqs_off();
+
         /* Account time spent with enabled wait psw loaded as idle time. */
-        idle->sequence++;
-        smp_wmb();
+        write_seqcount_begin(&idle->seqcount);
         idle_time = idle->clock_idle_exit - idle->clock_idle_enter;
         idle->clock_idle_enter = idle->clock_idle_exit = 0ULL;
         idle->idle_time += idle_time;
         idle->idle_count++;
         account_idle_time(idle_time);
-        smp_wmb();
-        idle->sequence++;
+        write_seqcount_end(&idle->seqcount);
 }
+NOKPROBE_SYMBOL(enabled_wait);
 
 static ssize_t show_idle_count(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
         struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);
         unsigned long long idle_count;
-        unsigned int sequence;
+        unsigned int seq;
 
         do {
-                sequence = ACCESS_ONCE(idle->sequence);
+                seq = read_seqcount_begin(&idle->seqcount);
                 idle_count = ACCESS_ONCE(idle->idle_count);
                 if (ACCESS_ONCE(idle->clock_idle_enter))
                         idle_count++;
-        } while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+        } while (read_seqcount_retry(&idle->seqcount, seq));
         return sprintf(buf, "%llu\n", idle_count);
 }
 DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);
@@ -69,15 +70,15 @@ static ssize_t show_idle_time(struct device *dev,
 {
         struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);
         unsigned long long now, idle_time, idle_enter, idle_exit;
-        unsigned int sequence;
+        unsigned int seq;
 
         do {
                 now = get_tod_clock();
-                sequence = ACCESS_ONCE(idle->sequence);
+                seq = read_seqcount_begin(&idle->seqcount);
                 idle_time = ACCESS_ONCE(idle->idle_time);
                 idle_enter = ACCESS_ONCE(idle->clock_idle_enter);
                 idle_exit = ACCESS_ONCE(idle->clock_idle_exit);
-        } while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+        } while (read_seqcount_retry(&idle->seqcount, seq));
         idle_time += idle_enter ? ((idle_exit ? : now) - idle_enter) : 0;
         return sprintf(buf, "%llu\n", idle_time >> 12);
 }
@@ -87,14 +88,14 @@ cputime64_t arch_cpu_idle_time(int cpu)
 {
         struct s390_idle_data *idle = &per_cpu(s390_idle, cpu);
         unsigned long long now, idle_enter, idle_exit;
-        unsigned int sequence;
+        unsigned int seq;
 
         do {
                 now = get_tod_clock();
-                sequence = ACCESS_ONCE(idle->sequence);
+                seq = read_seqcount_begin(&idle->seqcount);
                 idle_enter = ACCESS_ONCE(idle->clock_idle_enter);
                 idle_exit = ACCESS_ONCE(idle->clock_idle_exit);
-        } while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+        } while (read_seqcount_retry(&idle->seqcount, seq));
         return idle_enter ? ((idle_exit ?: now) - idle_enter) : 0;
 }
 
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index 1b8a38ab7861..f238720690f3 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -127,13 +127,10 @@ int show_interrupts(struct seq_file *p, void *v)
                 for_each_online_cpu(cpu)
                         seq_printf(p, "CPU%d       ", cpu);
                 seq_putc(p, '\n');
-                goto out;
         }
         if (index < NR_IRQS) {
                 if (index >= NR_IRQS_BASE)
                         goto out;
-                /* Adjust index to process irqclass_main_desc array entries */
-                index--;
                 seq_printf(p, "%s: ", irqclass_main_desc[index].name);
                 irq = irqclass_main_desc[index].irq;
                 for_each_online_cpu(cpu)
@@ -158,7 +155,7 @@ out:
 
 unsigned int arch_dynirq_lower_bound(unsigned int from)
 {
-        return from < THIN_INTERRUPT ? THIN_INTERRUPT : from;
+        return from < NR_IRQS_BASE ? NR_IRQS_BASE : from;
 }
 
 /*
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 014d4729b134..1e4c710dfb92 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/hardirq.h>
+#include <linux/ftrace.h>
 #include <asm/cacheflush.h>
 #include <asm/sections.h>
 #include <asm/dis.h>
@@ -58,12 +59,23 @@ struct kprobe_insn_cache kprobe_dmainsn_slots = {
         .insn_size = MAX_INSN_SIZE,
 };
 
-static void __kprobes copy_instruction(struct kprobe *p)
+static void copy_instruction(struct kprobe *p)
 {
+        unsigned long ip = (unsigned long) p->addr;
         s64 disp, new_disp;
         u64 addr, new_addr;
 
-        memcpy(p->ainsn.insn, p->addr, insn_length(p->opcode >> 8));
+        if (ftrace_location(ip) == ip) {
+                /*
+                 * If kprobes patches the instruction that is morphed by
+                 * ftrace make sure that kprobes always sees the branch
+                 * "jg .+24" that skips the mcount block
+                 */
+                ftrace_generate_nop_insn((struct ftrace_insn *)p->ainsn.insn);
+                p->ainsn.is_ftrace_insn = 1;
+        } else
+                memcpy(p->ainsn.insn, p->addr, insn_length(*p->addr >> 8));
+        p->opcode = p->ainsn.insn[0];
         if (!probe_is_insn_relative_long(p->ainsn.insn))
                 return;
         /*
@@ -79,25 +91,14 @@ static void __kprobes copy_instruction(struct kprobe *p)
         new_disp = ((addr + (disp * 2)) - new_addr) / 2;
         *(s32 *)&p->ainsn.insn[1] = new_disp;
 }
+NOKPROBE_SYMBOL(copy_instruction);
 
 static inline int is_kernel_addr(void *addr)
 {
         return addr < (void *)_end;
 }
 
-static inline int is_module_addr(void *addr)
-{
-#ifdef CONFIG_64BIT
-        BUILD_BUG_ON(MODULES_LEN > (1UL << 31));
-        if (addr < (void *)MODULES_VADDR)
-                return 0;
-        if (addr > (void *)MODULES_END)
-                return 0;
-#endif
-        return 1;
-}
-
-static int __kprobes s390_get_insn_slot(struct kprobe *p)
+static int s390_get_insn_slot(struct kprobe *p)
 {
         /*
          * Get an insn slot that is within the same 2GB area like the original
@@ -111,8 +112,9 @@ static int __kprobes s390_get_insn_slot(struct kprobe *p)
                 p->ainsn.insn = get_insn_slot();
         return p->ainsn.insn ? 0 : -ENOMEM;
 }
+NOKPROBE_SYMBOL(s390_get_insn_slot);
 
-static void __kprobes s390_free_insn_slot(struct kprobe *p)
+static void s390_free_insn_slot(struct kprobe *p)
 {
         if (!p->ainsn.insn)
                 return;
@@ -122,8 +124,9 @@ static void __kprobes s390_free_insn_slot(struct kprobe *p)
                 free_insn_slot(p->ainsn.insn, 0);
         p->ainsn.insn = NULL;
 }
+NOKPROBE_SYMBOL(s390_free_insn_slot);
 
-int __kprobes arch_prepare_kprobe(struct kprobe *p)
+int arch_prepare_kprobe(struct kprobe *p)
 {
         if ((unsigned long) p->addr & 0x01)
                 return -EINVAL;
@@ -132,54 +135,79 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
                 return -EINVAL;
         if (s390_get_insn_slot(p))
                 return -ENOMEM;
-        p->opcode = *p->addr;
         copy_instruction(p);
         return 0;
 }
+NOKPROBE_SYMBOL(arch_prepare_kprobe);
 
-struct ins_replace_args {
-        kprobe_opcode_t *ptr;
-        kprobe_opcode_t opcode;
+int arch_check_ftrace_location(struct kprobe *p)
+{
+        return 0;
+}
+
+struct swap_insn_args {
+        struct kprobe *p;
+        unsigned int arm_kprobe : 1;
 };
 
-static int __kprobes swap_instruction(void *aref)
+static int swap_instruction(void *data)
 {
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
         unsigned long status = kcb->kprobe_status;
-        struct ins_replace_args *args = aref;
-
+        struct swap_insn_args *args = data;
+        struct ftrace_insn new_insn, *insn;
+        struct kprobe *p = args->p;
+        size_t len;
+
+        new_insn.opc = args->arm_kprobe ? BREAKPOINT_INSTRUCTION : p->opcode;
+        len = sizeof(new_insn.opc);
+        if (!p->ainsn.is_ftrace_insn)
+                goto skip_ftrace;
+        len = sizeof(new_insn);
+        insn = (struct ftrace_insn *) p->addr;
+        if (args->arm_kprobe) {
+                if (is_ftrace_nop(insn))
+                        new_insn.disp = KPROBE_ON_FTRACE_NOP;
+                else
+                        new_insn.disp = KPROBE_ON_FTRACE_CALL;
+        } else {
+                ftrace_generate_call_insn(&new_insn, (unsigned long)p->addr);
+                if (insn->disp == KPROBE_ON_FTRACE_NOP)
+                        ftrace_generate_nop_insn(&new_insn);
+        }
+skip_ftrace:
         kcb->kprobe_status = KPROBE_SWAP_INST;
-        probe_kernel_write(args->ptr, &args->opcode, sizeof(args->opcode));
+        probe_kernel_write(p->addr, &new_insn, len);
         kcb->kprobe_status = status;
         return 0;
 }
+NOKPROBE_SYMBOL(swap_instruction);
 
-void __kprobes arch_arm_kprobe(struct kprobe *p)
+void arch_arm_kprobe(struct kprobe *p)
 {
-        struct ins_replace_args args;
+        struct swap_insn_args args = {.p = p, .arm_kprobe = 1};
 
-        args.ptr = p->addr;
-        args.opcode = BREAKPOINT_INSTRUCTION;
         stop_machine(swap_instruction, &args, NULL);
 }
+NOKPROBE_SYMBOL(arch_arm_kprobe);
 
-void __kprobes arch_disarm_kprobe(struct kprobe *p)
+void arch_disarm_kprobe(struct kprobe *p)
 {
-        struct ins_replace_args args;
+        struct swap_insn_args args = {.p = p, .arm_kprobe = 0};
 
-        args.ptr = p->addr;
-        args.opcode = p->opcode;
         stop_machine(swap_instruction, &args, NULL);
 }
+NOKPROBE_SYMBOL(arch_disarm_kprobe);
 
-void __kprobes arch_remove_kprobe(struct kprobe *p)
+void arch_remove_kprobe(struct kprobe *p)
 {
         s390_free_insn_slot(p);
 }
+NOKPROBE_SYMBOL(arch_remove_kprobe);
 
-static void __kprobes enable_singlestep(struct kprobe_ctlblk *kcb,
-                                        struct pt_regs *regs,
-                                        unsigned long ip)
+static void enable_singlestep(struct kprobe_ctlblk *kcb,
+                              struct pt_regs *regs,
+                              unsigned long ip)
 {
         struct per_regs per_kprobe;
 
@@ -199,10 +227,11 @@ static void __kprobes enable_singlestep(struct kprobe_ctlblk *kcb,
         regs->psw.mask &= ~(PSW_MASK_IO | PSW_MASK_EXT);
         regs->psw.addr = ip | PSW_ADDR_AMODE;
 }
+NOKPROBE_SYMBOL(enable_singlestep);
 
-static void __kprobes disable_singlestep(struct kprobe_ctlblk *kcb,
-                                         struct pt_regs *regs,
-                                         unsigned long ip)
+static void disable_singlestep(struct kprobe_ctlblk *kcb,
+                               struct pt_regs *regs,
+                               unsigned long ip)
 {
         /* Restore control regs and psw mask, set new psw address */
         __ctl_load(kcb->kprobe_saved_ctl, 9, 11);
@@ -210,41 +239,43 @@ static void __kprobes disable_singlestep(struct kprobe_ctlblk *kcb,
         regs->psw.mask |= kcb->kprobe_saved_imask;
         regs->psw.addr = ip | PSW_ADDR_AMODE;
 }
+NOKPROBE_SYMBOL(disable_singlestep);
 
 /*
  * Activate a kprobe by storing its pointer to current_kprobe. The
  * previous kprobe is stored in kcb->prev_kprobe. A stack of up to
  * two kprobes can be active, see KPROBE_REENTER.
  */
-static void __kprobes push_kprobe(struct kprobe_ctlblk *kcb, struct kprobe *p)
+static void push_kprobe(struct kprobe_ctlblk *kcb, struct kprobe *p)
 {
         kcb->prev_kprobe.kp = __this_cpu_read(current_kprobe);
         kcb->prev_kprobe.status = kcb->kprobe_status;
         __this_cpu_write(current_kprobe, p);
 }
+NOKPROBE_SYMBOL(push_kprobe);
 
 /*
  * Deactivate a kprobe by backing up to the previous state. If the
  * current state is KPROBE_REENTER prev_kprobe.kp will be non-NULL,
  * for any other state prev_kprobe.kp will be NULL.
  */
-static void __kprobes pop_kprobe(struct kprobe_ctlblk *kcb)
+static void pop_kprobe(struct kprobe_ctlblk *kcb)
 {
         __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
         kcb->kprobe_status = kcb->prev_kprobe.status;
 }
+NOKPROBE_SYMBOL(pop_kprobe);
 
-void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-                                        struct pt_regs *regs)
+void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
 {
         ri->ret_addr = (kprobe_opcode_t *) regs->gprs[14];
 
         /* Replace the return addr with trampoline addr */
         regs->gprs[14] = (unsigned long) &kretprobe_trampoline;
 }
+NOKPROBE_SYMBOL(arch_prepare_kretprobe);
 
-static void __kprobes kprobe_reenter_check(struct kprobe_ctlblk *kcb,
-                                           struct kprobe *p)
+static void kprobe_reenter_check(struct kprobe_ctlblk *kcb, struct kprobe *p)
 {
         switch (kcb->kprobe_status) {
         case KPROBE_HIT_SSDONE:
@@ -264,8 +295,9 @@ static void __kprobes kprobe_reenter_check(struct kprobe_ctlblk *kcb,
                 BUG();
         }
 }
+NOKPROBE_SYMBOL(kprobe_reenter_check);
 
-static int __kprobes kprobe_handler(struct pt_regs *regs)
+static int kprobe_handler(struct pt_regs *regs)
 {
         struct kprobe_ctlblk *kcb;
         struct kprobe *p;
@@ -339,6 +371,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
         preempt_enable_no_resched();
         return 0;
 }
+NOKPROBE_SYMBOL(kprobe_handler);
 
 /*
  * Function return probe trampoline:
@@ -355,8 +388,7 @@ static void __used kretprobe_trampoline_holder(void)
 /*
  * Called when the probe at kretprobe trampoline is hit
  */
-static int __kprobes trampoline_probe_handler(struct kprobe *p,
-                                              struct pt_regs *regs)
+static int trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri;
         struct hlist_head *head, empty_rp;
@@ -444,6 +476,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
          */
         return 1;
 }
+NOKPROBE_SYMBOL(trampoline_probe_handler);
 
 /*
  * Called after single-stepping.  p->addr is the address of the
@@ -453,12 +486,30 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
  * single-stepped a copy of the instruction.  The address of this
  * copy is p->ainsn.insn.
  */
-static void __kprobes resume_execution(struct kprobe *p, struct pt_regs *regs)
+static void resume_execution(struct kprobe *p, struct pt_regs *regs)
 {
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
         unsigned long ip = regs->psw.addr & PSW_ADDR_INSN;
         int fixup = probe_get_fixup_type(p->ainsn.insn);
 
+        /* Check if the kprobes location is an enabled ftrace caller */
+        if (p->ainsn.is_ftrace_insn) {
+                struct ftrace_insn *insn = (struct ftrace_insn *) p->addr;
+                struct ftrace_insn call_insn;
+
+                ftrace_generate_call_insn(&call_insn, (unsigned long) p->addr);
+                /*
+                 * A kprobe on an enabled ftrace call site actually single
+                 * stepped an unconditional branch (ftrace nop equivalent).
+                 * Now we need to fixup things and pretend that a brasl r0,...
+                 * was executed instead.
+                 */
+                if (insn->disp == KPROBE_ON_FTRACE_CALL) {
+                        ip += call_insn.disp * 2 - MCOUNT_INSN_SIZE;
+                        regs->gprs[0] = (unsigned long)p->addr + sizeof(*insn);
+                }
+        }
+
         if (fixup & FIXUP_PSW_NORMAL)
                 ip += (unsigned long) p->addr - (unsigned long) p->ainsn.insn;
 
@@ -476,8 +527,9 @@ static void __kprobes resume_execution(struct kprobe *p, struct pt_regs *regs)
 
         disable_singlestep(kcb, regs, ip);
 }
+NOKPROBE_SYMBOL(resume_execution);
 
-static int __kprobes post_kprobe_handler(struct pt_regs *regs)
+static int post_kprobe_handler(struct pt_regs *regs)
 {
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
         struct kprobe *p = kprobe_running();
@@ -504,8 +556,9 @@ static int __kprobes post_kprobe_handler(struct pt_regs *regs)
 
         return 1;
 }
+NOKPROBE_SYMBOL(post_kprobe_handler);
 
-static int __kprobes kprobe_trap_handler(struct pt_regs *regs, int trapnr)
+static int kprobe_trap_handler(struct pt_regs *regs, int trapnr)
 {
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
         struct kprobe *p = kprobe_running();
@@ -567,8 +620,9 @@ static int __kprobes kprobe_trap_handler(struct pt_regs *regs, int trapnr)
         }
         return 0;
 }
+NOKPROBE_SYMBOL(kprobe_trap_handler);
 
-int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
+int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
 {
         int ret;
 
@@ -579,12 +633,13 @@ int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
                 local_irq_restore(regs->psw.mask & ~PSW_MASK_PER);
         return ret;
 }
+NOKPROBE_SYMBOL(kprobe_fault_handler);
 
 /*
  * Wrapper routine to for handling exceptions.
  */
-int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
-                                       unsigned long val, void *data)
+int kprobe_exceptions_notify(struct notifier_block *self,
+                             unsigned long val, void *data)
 {
         struct die_args *args = (struct die_args *) data;
         struct pt_regs *regs = args->regs;
@@ -616,8 +671,9 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 
         return ret;
 }
+NOKPROBE_SYMBOL(kprobe_exceptions_notify);
 
-int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
+int setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct jprobe *jp = container_of(p, struct jprobe, kp);
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
@@ -635,13 +691,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
         memcpy(kcb->jprobes_stack, (void *) stack, MIN_STACK_SIZE(stack));
         return 1;
 }
+NOKPROBE_SYMBOL(setjmp_pre_handler);
 
-void __kprobes jprobe_return(void)
+void jprobe_return(void)
 {
         asm volatile(".word 0x0002");
 }
+NOKPROBE_SYMBOL(jprobe_return);
 
-int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
+int longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
         unsigned long stack;
@@ -655,6 +713,7 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
         preempt_enable_no_resched();
         return 1;
 }
+NOKPROBE_SYMBOL(longjmp_break_handler);
 
 static struct kprobe trampoline = {
         .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
@@ -666,7 +725,8 @@ int __init arch_init_kprobes(void)
         return register_kprobe(&trampoline);
 }
 
-int __kprobes arch_trampoline_kprobe(struct kprobe *p)
+int arch_trampoline_kprobe(struct kprobe *p)
 {
         return p->addr == (kprobe_opcode_t *) &kretprobe_trampoline;
 }
+NOKPROBE_SYMBOL(arch_trampoline_kprobe);
diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
index 4300ea374826..b6dfc5bfcb89 100644
--- a/arch/s390/kernel/mcount.S
+++ b/arch/s390/kernel/mcount.S
@@ -27,6 +27,7 @@ ENTRY(ftrace_caller)
         .globl  ftrace_regs_caller
         .set    ftrace_regs_caller,ftrace_caller
         lgr     %r1,%r15
+        aghi    %r0,MCOUNT_RETURN_FIXUP
         aghi    %r15,-STACK_FRAME_SIZE
         stg     %r1,__SF_BACKCHAIN(%r15)
         stg     %r1,(STACK_PTREGS_GPRS+15*8)(%r15)
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index b878f12a9597..c3f8d157cb0d 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1383,7 +1383,6 @@ static int cpumsf_pmu_add(struct perf_event *event, int flags)
                 cpuhw->lsctl.ed = 1;
 
         /* Set in_use flag and store event */
-        event->hw.idx = 0;        /* only one sampling event per CPU supported */
         cpuhw->event = event;
         cpuhw->flags |= PMU_F_IN_USE;
 
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index ed84cc224899..aa7a83948c7b 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -61,7 +61,7 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
         return sf->gprs[8];
 }
 
-extern void __kprobes kernel_thread_starter(void);
+extern void kernel_thread_starter(void);
 
 /*
  * Free current thread data structures etc..
@@ -153,6 +153,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
         save_fp_ctl(&p->thread.fp_regs.fpc);
         save_fp_regs(p->thread.fp_regs.fprs);
         p->thread.fp_regs.pad = 0;
+        p->thread.vxrs = NULL;
         /* Set a new TLS ?  */
         if (clone_flags & CLONE_SETTLS) {
                 unsigned long tls = frame->childregs.gprs[6];
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 99a567b70d16..eabfb4594517 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -248,14 +248,27 @@ static unsigned long __peek_user(struct task_struct *child, addr_t addr)
                  */
                 tmp = 0;
 
+        } else if (addr == (addr_t) &dummy->regs.fp_regs.fpc) {
+                /*
+                 * floating point control reg. is in the thread structure
+                 */
+                tmp = child->thread.fp_regs.fpc;
+                tmp <<= BITS_PER_LONG - 32;
+
         } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
-                /* 
-                 * floating point regs. are stored in the thread structure
+                /*
+                 * floating point regs. are either in child->thread.fp_regs
+                 * or the child->thread.vxrs array
                  */
-                offset = addr - (addr_t) &dummy->regs.fp_regs;
-                tmp = *(addr_t *)((addr_t) &child->thread.fp_regs + offset);
-                if (addr == (addr_t) &dummy->regs.fp_regs.fpc)
-                        tmp <<= BITS_PER_LONG - 32;
+                offset = addr - (addr_t) &dummy->regs.fp_regs.fprs;
+#ifdef CONFIG_64BIT
+                if (child->thread.vxrs)
+                        tmp = *(addr_t *)
+                               ((addr_t) child->thread.vxrs + 2*offset);
+                else
+#endif
+                        tmp = *(addr_t *)
+                               ((addr_t) &child->thread.fp_regs.fprs + offset);
 
         } else if (addr < (addr_t) (&dummy->regs.per_info + 1)) {
                 /*
@@ -383,16 +396,29 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
                  */
                 return 0;
 
+        } else if (addr == (addr_t) &dummy->regs.fp_regs.fpc) {
+                /*
+                 * floating point control reg. is in the thread structure
+                 */
+                if ((unsigned int) data != 0 ||
+                    test_fp_ctl(data >> (BITS_PER_LONG - 32)))
+                        return -EINVAL;
+                child->thread.fp_regs.fpc = data >> (BITS_PER_LONG - 32);
+
         } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
                 /*
-                 * floating point regs. are stored in the thread structure
+                 * floating point regs. are either in child->thread.fp_regs
+                 * or the child->thread.vxrs array
                  */
-                if (addr == (addr_t) &dummy->regs.fp_regs.fpc)
-                        if ((unsigned int) data != 0 ||
-                            test_fp_ctl(data >> (BITS_PER_LONG - 32)))
-                                return -EINVAL;
-                offset = addr - (addr_t) &dummy->regs.fp_regs;
-                *(addr_t *)((addr_t) &child->thread.fp_regs + offset) = data;
+                offset = addr - (addr_t) &dummy->regs.fp_regs.fprs;
+#ifdef CONFIG_64BIT
+                if (child->thread.vxrs)
+                        *(addr_t *)((addr_t)
+                                child->thread.vxrs + 2*offset) = data;
+                else
+#endif
+                        *(addr_t *)((addr_t)
+                                &child->thread.fp_regs.fprs + offset) = data;
 
         } else if (addr < (addr_t) (&dummy->regs.per_info + 1)) {
                 /*
@@ -611,12 +637,26 @@ static u32 __peek_user_compat(struct task_struct *child, addr_t addr)
                  */
                 tmp = 0;
 
+        } else if (addr == (addr_t) &dummy32->regs.fp_regs.fpc) {
+                /*
+                 * floating point control reg. is in the thread structure
+                 */
+                tmp = child->thread.fp_regs.fpc;
+
         } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
                 /*
-                 * floating point regs. are stored in the thread structure 
+                 * floating point regs. are either in child->thread.fp_regs
+                 * or the child->thread.vxrs array
                  */
-                offset = addr - (addr_t) &dummy32->regs.fp_regs;
-                tmp = *(__u32 *)((addr_t) &child->thread.fp_regs + offset);
+                offset = addr - (addr_t) &dummy32->regs.fp_regs.fprs;
+#ifdef CONFIG_64BIT
+                if (child->thread.vxrs)
+                        tmp = *(__u32 *)
+                               ((addr_t) child->thread.vxrs + 2*offset);
+                else
+#endif
+                        tmp = *(__u32 *)
+                               ((addr_t) &child->thread.fp_regs.fprs + offset);
 
         } else if (addr < (addr_t) (&dummy32->regs.per_info + 1)) {
                 /*
@@ -722,15 +762,28 @@ static int __poke_user_compat(struct task_struct *child,
                  */
                 return 0;
 
-        } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
+        } else if (addr == (addr_t) &dummy32->regs.fp_regs.fpc) {
                 /*
-                 * floating point regs. are stored in the thread structure 
+                 * floating point control reg. is in the thread structure
                  */
-                if (addr == (addr_t) &dummy32->regs.fp_regs.fpc &&
-                    test_fp_ctl(tmp))
+                if (test_fp_ctl(tmp))
                         return -EINVAL;
-                offset = addr - (addr_t) &dummy32->regs.fp_regs;
-                *(__u32 *)((addr_t) &child->thread.fp_regs + offset) = tmp;
+                child->thread.fp_regs.fpc = data;
+
+        } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
+                /*
+                 * floating point regs. are either in child->thread.fp_regs
+                 * or the child->thread.vxrs array
+                 */
+                offset = addr - (addr_t) &dummy32->regs.fp_regs.fprs;
+#ifdef CONFIG_64BIT
+                if (child->thread.vxrs)
+                        *(__u32 *)((addr_t)
+                                child->thread.vxrs + 2*offset) = tmp;
+                else
+#endif
+                        *(__u32 *)((addr_t)
+                                &child->thread.fp_regs.fprs + offset) = tmp;
 
         } else if (addr < (addr_t) (&dummy32->regs.per_info + 1)) {
                 /*
@@ -1038,12 +1091,6 @@ static int s390_tdb_set(struct task_struct *target,
         return 0;
 }
 
-static int s390_vxrs_active(struct task_struct *target,
-                              const struct user_regset *regset)
-{
-        return !!target->thread.vxrs;
-}
-
 static int s390_vxrs_low_get(struct task_struct *target,
                              const struct user_regset *regset,
                              unsigned int pos, unsigned int count,
@@ -1052,6 +1099,8 @@ static int s390_vxrs_low_get(struct task_struct *target,
         __u64 vxrs[__NUM_VXRS_LOW];
         int i;
 
+        if (!MACHINE_HAS_VX)
+                return -ENODEV;
         if (target->thread.vxrs) {
                 if (target == current)
                         save_vx_regs(target->thread.vxrs);
@@ -1070,6 +1119,8 @@ static int s390_vxrs_low_set(struct task_struct *target,
         __u64 vxrs[__NUM_VXRS_LOW];
         int i, rc;
 
+        if (!MACHINE_HAS_VX)
+                return -ENODEV;
         if (!target->thread.vxrs) {
                 rc = alloc_vector_registers(target);
                 if (rc)
@@ -1095,6 +1146,8 @@ static int s390_vxrs_high_get(struct task_struct *target,
 {
         __vector128 vxrs[__NUM_VXRS_HIGH];
 
+        if (!MACHINE_HAS_VX)
+                return -ENODEV;
         if (target->thread.vxrs) {
                 if (target == current)
                         save_vx_regs(target->thread.vxrs);
@@ -1112,6 +1165,8 @@ static int s390_vxrs_high_set(struct task_struct *target,
 {
         int rc;
 
+        if (!MACHINE_HAS_VX)
+                return -ENODEV;
         if (!target->thread.vxrs) {
                 rc = alloc_vector_registers(target);
                 if (rc)
@@ -1196,7 +1251,6 @@ static const struct user_regset s390_regsets[] = {
                 .n = __NUM_VXRS_LOW,
                 .size = sizeof(__u64),
                 .align = sizeof(__u64),
-                .active = s390_vxrs_active,
                 .get = s390_vxrs_low_get,
                 .set = s390_vxrs_low_set,
         },
@@ -1205,7 +1259,6 @@ static const struct user_regset s390_regsets[] = {
                 .n = __NUM_VXRS_HIGH,
                 .size = sizeof(__vector128),
                 .align = sizeof(__vector128),
-                .active = s390_vxrs_active,
                 .get = s390_vxrs_high_get,
                 .set = s390_vxrs_high_set,
         },
@@ -1419,7 +1472,6 @@ static const struct user_regset s390_compat_regsets[] = {
                 .n = __NUM_VXRS_LOW,
                 .size = sizeof(__u64),
                 .align = sizeof(__u64),
-                .active = s390_vxrs_active,
                 .get = s390_vxrs_low_get,
                 .set = s390_vxrs_low_set,
         },
@@ -1428,7 +1480,6 @@ static const struct user_regset s390_compat_regsets[] = {
                 .n = __NUM_VXRS_HIGH,
                 .size = sizeof(__vector128),
                 .align = sizeof(__vector128),
-                .active = s390_vxrs_active,
                 .get = s390_vxrs_high_get,
                 .set = s390_vxrs_high_set,
         },
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index e80d9ff9a56d..4e532c67832f 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -41,7 +41,6 @@
 #include <linux/ctype.h>
 #include <linux/reboot.h>
 #include <linux/topology.h>
-#include <linux/ftrace.h>
 #include <linux/kexec.h>
 #include <linux/crash_dump.h>
 #include <linux/memory.h>
@@ -356,7 +355,6 @@ static void __init setup_lowcore(void)
         lc->steal_timer = S390_lowcore.steal_timer;
         lc->last_update_timer = S390_lowcore.last_update_timer;
         lc->last_update_clock = S390_lowcore.last_update_clock;
-        lc->ftrace_func = S390_lowcore.ftrace_func;
 
         restart_stack = __alloc_bootmem(ASYNC_SIZE, ASYNC_SIZE, 0);
         restart_stack += ASYNC_SIZE;
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index 0c1a0ff0a558..6a2ac257d98f 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -371,7 +371,7 @@ static int setup_frame(int sig, struct k_sigaction *ka,
                 restorer = (unsigned long) ka->sa.sa_restorer | PSW_ADDR_AMODE;
         } else {
                 /* Signal frame without vector registers are short ! */
-                __u16 __user *svc = (void *) frame + frame_size - 2;
+                __u16 __user *svc = (void __user *) frame + frame_size - 2;
                 if (__put_user(S390_SYSCALL_OPCODE | __NR_sigreturn, svc))
                         return -EFAULT;
                 restorer = (unsigned long) svc | PSW_ADDR_AMODE;
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 6fd9e60101f1..0b499f5cbe19 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -236,7 +236,6 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
         lc->percpu_offset = __per_cpu_offset[cpu];
         lc->kernel_asce = S390_lowcore.kernel_asce;
         lc->machine_flags = S390_lowcore.machine_flags;
-        lc->ftrace_func = S390_lowcore.ftrace_func;
         lc->user_timer = lc->system_timer = lc->steal_timer = 0;
         __ctl_store(lc->cregs_save_area, 0, 15);
         save_access_regs((unsigned int *) lc->access_regs_save_area);
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 9f7087fd58de..a2987243bc76 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -360,3 +360,5 @@ SYSCALL(sys_seccomp,sys_seccomp,compat_sys_seccomp)
 SYSCALL(sys_getrandom,sys_getrandom,compat_sys_getrandom)
 SYSCALL(sys_memfd_create,sys_memfd_create,compat_sys_memfd_create) /* 350 */
 SYSCALL(sys_bpf,sys_bpf,compat_sys_bpf)
+SYSCALL(sys_ni_syscall,sys_s390_pci_mmio_write,compat_sys_s390_pci_mmio_write)
+SYSCALL(sys_ni_syscall,sys_s390_pci_mmio_read,compat_sys_s390_pci_mmio_read)
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 005d665fe4a5..20660dddb2d6 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -61,10 +61,11 @@ static DEFINE_PER_CPU(struct clock_event_device, comparators);
 /*
  * Scheduler clock - returns current time in nanosec units.
  */
-unsigned long long notrace __kprobes sched_clock(void)
+unsigned long long notrace sched_clock(void)
 {
         return tod_to_ns(get_tod_clock_monotonic());
 }
+NOKPROBE_SYMBOL(sched_clock);
 
 /*
  * Monotonic_clock - returns # of nanoseconds passed since time_init()
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 9ff5ecba26ab..f081cf1157c3 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -49,7 +49,8 @@ static inline void report_user_fault(struct pt_regs *regs, int signr)
                 return;
         if (!printk_ratelimit())
                 return;
-        printk("User process fault: interruption code 0x%X ", regs->int_code);
+        printk("User process fault: interruption code %04x ilc:%d ",
+               regs->int_code & 0xffff, regs->int_code >> 17);
         print_vma_addr("in ", regs->psw.addr & PSW_ADDR_INSN);
         printk("\n");
         show_regs(regs);
@@ -87,16 +88,16 @@ void do_report_trap(struct pt_regs *regs, int si_signo, int si_code, char *str)
         }
 }
 
-static void __kprobes do_trap(struct pt_regs *regs, int si_signo, int si_code,
-                              char *str)
+static void do_trap(struct pt_regs *regs, int si_signo, int si_code, char *str)
 {
         if (notify_die(DIE_TRAP, str, regs, 0,
                        regs->int_code, si_signo) == NOTIFY_STOP)
                 return;
         do_report_trap(regs, si_signo, si_code, str);
 }
+NOKPROBE_SYMBOL(do_trap);
 
-void __kprobes do_per_trap(struct pt_regs *regs)
+void do_per_trap(struct pt_regs *regs)
 {
         siginfo_t info;
 
@@ -111,6 +112,7 @@ void __kprobes do_per_trap(struct pt_regs *regs)
                 (void __force __user *) current->thread.per_event.address;
         force_sig_info(SIGTRAP, &info, current);
 }
+NOKPROBE_SYMBOL(do_per_trap);
 
 void default_trap_handler(struct pt_regs *regs)
 {
@@ -151,8 +153,6 @@ DO_ERROR_INFO(privileged_op, SIGILL, ILL_PRVOPC,
               "privileged operation")
 DO_ERROR_INFO(special_op_exception, SIGILL, ILL_ILLOPN,
               "special operation exception")
-DO_ERROR_INFO(translation_exception, SIGILL, ILL_ILLOPN,
-              "translation exception")
 
 #ifdef CONFIG_64BIT
 DO_ERROR_INFO(transaction_exception, SIGILL, ILL_ILLOPN,
@@ -179,7 +179,13 @@ static inline void do_fp_trap(struct pt_regs *regs, int fpc)
         do_trap(regs, SIGFPE, si_code, "floating point exception");
 }
 
-void __kprobes illegal_op(struct pt_regs *regs)
+void translation_exception(struct pt_regs *regs)
+{
+        /* May never happen. */
+        die(regs, "Translation exception");
+}
+
+void illegal_op(struct pt_regs *regs)
 {
         siginfo_t info;
         __u8 opcode[6];
@@ -252,7 +258,7 @@ void __kprobes illegal_op(struct pt_regs *regs)
         if (signal)
                 do_trap(regs, signal, ILL_ILLOPC, "illegal operation");
 }
-
+NOKPROBE_SYMBOL(illegal_op);
 
 #ifdef CONFIG_MATHEMU
 void specification_exception(struct pt_regs *regs)
@@ -469,7 +475,7 @@ void space_switch_exception(struct pt_regs *regs)
         do_trap(regs, SIGILL, ILL_PRVOPC, "space switch event");
 }
 
-void __kprobes kernel_stack_overflow(struct pt_regs * regs)
+void kernel_stack_overflow(struct pt_regs *regs)
 {
         bust_spinlocks(1);
         printk("Kernel stack overflow.\n");
@@ -477,6 +483,7 @@ void __kprobes kernel_stack_overflow(struct pt_regs * regs)
         bust_spinlocks(0);
         panic("Corrupt kernel stack, can't continue.");
 }
+NOKPROBE_SYMBOL(kernel_stack_overflow);
 
 void __init trap_init(void)
 {
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 55aade49b6d1..6b049ee75a56 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -271,7 +271,7 @@ static int kvm_s390_mem_control(struct kvm *kvm, struct kvm_device_attr *attr)
         case KVM_S390_VM_MEM_CLR_CMMA:
                 mutex_lock(&kvm->lock);
                 idx = srcu_read_lock(&kvm->srcu);
-                page_table_reset_pgste(kvm->arch.gmap->mm, 0, TASK_SIZE, false);
+                s390_reset_cmma(kvm->arch.gmap->mm);
                 srcu_read_unlock(&kvm->srcu, idx);
                 mutex_unlock(&kvm->lock);
                 ret = 0;
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 72bb2dd8b9cd..f47cb0c6d906 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -156,21 +156,25 @@ static int handle_store_cpu_address(struct kvm_vcpu *vcpu)
         return 0;
 }
 
-static void __skey_check_enable(struct kvm_vcpu *vcpu)
+static int __skey_check_enable(struct kvm_vcpu *vcpu)
 {
+        int rc = 0;
         if (!(vcpu->arch.sie_block->ictl & (ICTL_ISKE | ICTL_SSKE | ICTL_RRBE)))
-                return;
+                return rc;
 
-        s390_enable_skey();
+        rc = s390_enable_skey();
         trace_kvm_s390_skey_related_inst(vcpu);
         vcpu->arch.sie_block->ictl &= ~(ICTL_ISKE | ICTL_SSKE | ICTL_RRBE);
+        return rc;
 }
 
 
 static int handle_skey(struct kvm_vcpu *vcpu)
 {
-        __skey_check_enable(vcpu);
+        int rc = __skey_check_enable(vcpu);
 
+        if (rc)
+                return rc;
         vcpu->stat.instruction_storage_key++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
@@ -683,7 +687,10 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                 }
 
                 if (vcpu->run->s.regs.gprs[reg1] & PFMF_SK) {
-                        __skey_check_enable(vcpu);
+                        int rc = __skey_check_enable(vcpu);
+
+                        if (rc)
+                                return rc;
                         if (set_guest_storage_key(current->mm, useraddr,
                                         vcpu->run->s.regs.gprs[reg1] & PFMF_KEY,
                                         vcpu->run->s.regs.gprs[reg1] & PFMF_NQ))
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index a2b81d6ce8a5..811937bb90be 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -261,8 +261,8 @@ static inline void report_user_fault(struct pt_regs *regs, long signr)
                 return;
         if (!printk_ratelimit())
                 return;
-        printk(KERN_ALERT "User process fault: interruption code 0x%X ",
-               regs->int_code);
+        printk(KERN_ALERT "User process fault: interruption code %04x ilc:%d",
+               regs->int_code & 0xffff, regs->int_code >> 17);
         print_vma_addr(KERN_CONT "in ", regs->psw.addr & PSW_ADDR_INSN);
         printk(KERN_CONT "\n");
         printk(KERN_ALERT "failing address: %016lx TEID: %016lx\n",
@@ -548,7 +548,7 @@ out:
         return fault;
 }
 
-void __kprobes do_protection_exception(struct pt_regs *regs)
+void do_protection_exception(struct pt_regs *regs)
 {
         unsigned long trans_exc_code;
         int fault;
@@ -574,8 +574,9 @@ void __kprobes do_protection_exception(struct pt_regs *regs)
         if (unlikely(fault))
                 do_fault_error(regs, fault);
 }
+NOKPROBE_SYMBOL(do_protection_exception);
 
-void __kprobes do_dat_exception(struct pt_regs *regs)
+void do_dat_exception(struct pt_regs *regs)
 {
         int access, fault;
 
@@ -584,6 +585,7 @@ void __kprobes do_dat_exception(struct pt_regs *regs)
         if (unlikely(fault))
                 do_fault_error(regs, fault);
 }
+NOKPROBE_SYMBOL(do_dat_exception);
 
 #ifdef CONFIG_PFAULT 
 /*
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 1b79ca67392f..71c7eff2c89f 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -18,6 +18,8 @@
 #include <linux/rcupdate.h>
 #include <linux/slab.h>
 #include <linux/swapops.h>
+#include <linux/ksm.h>
+#include <linux/mman.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -750,8 +752,7 @@ int gmap_ipte_notify(struct gmap *gmap, unsigned long gaddr, unsigned long len)
                         break;
                 /* Walk the process page table, lock and get pte pointer */
                 ptep = get_locked_pte(gmap->mm, addr, &ptl);
-                if (unlikely(!ptep))
-                        continue;
+                VM_BUG_ON(!ptep);
                 /* Set notification bit in the pgste of the pte */
                 entry = *ptep;
                 if ((pte_val(entry) & (_PAGE_INVALID | _PAGE_PROTECT)) == 0) {
@@ -761,7 +762,7 @@ int gmap_ipte_notify(struct gmap *gmap, unsigned long gaddr, unsigned long len)
                         gaddr += PAGE_SIZE;
                         len -= PAGE_SIZE;
                 }
-                spin_unlock(ptl);
+                pte_unmap_unlock(ptep, ptl);
         }
         up_read(&gmap->mm->mmap_sem);
         return rc;
@@ -834,99 +835,6 @@ static inline void page_table_free_pgste(unsigned long *table)
         __free_page(page);
 }
 
-static inline unsigned long page_table_reset_pte(struct mm_struct *mm, pmd_t *pmd,
-                        unsigned long addr, unsigned long end, bool init_skey)
-{
-        pte_t *start_pte, *pte;
-        spinlock_t *ptl;
-        pgste_t pgste;
-
-        start_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
-        pte = start_pte;
-        do {
-                pgste = pgste_get_lock(pte);
-                pgste_val(pgste) &= ~_PGSTE_GPS_USAGE_MASK;
-                if (init_skey) {
-                        unsigned long address;
-
-                        pgste_val(pgste) &= ~(PGSTE_ACC_BITS | PGSTE_FP_BIT |
-                                              PGSTE_GR_BIT | PGSTE_GC_BIT);
-
-                        /* skip invalid and not writable pages */
-                        if (pte_val(*pte) & _PAGE_INVALID ||
-                            !(pte_val(*pte) & _PAGE_WRITE)) {
-                                pgste_set_unlock(pte, pgste);
-                                continue;
-                        }
-
-                        address = pte_val(*pte) & PAGE_MASK;
-                        page_set_storage_key(address, PAGE_DEFAULT_KEY, 1);
-                }
-                pgste_set_unlock(pte, pgste);
-        } while (pte++, addr += PAGE_SIZE, addr != end);
-        pte_unmap_unlock(start_pte, ptl);
-
-        return addr;
-}
-
-static inline unsigned long page_table_reset_pmd(struct mm_struct *mm, pud_t *pud,
-                        unsigned long addr, unsigned long end, bool init_skey)
-{
-        unsigned long next;
-        pmd_t *pmd;
-
-        pmd = pmd_offset(pud, addr);
-        do {
-                next = pmd_addr_end(addr, end);
-                if (pmd_none_or_clear_bad(pmd))
-                        continue;
-                next = page_table_reset_pte(mm, pmd, addr, next, init_skey);
-        } while (pmd++, addr = next, addr != end);
-
-        return addr;
-}
-
-static inline unsigned long page_table_reset_pud(struct mm_struct *mm, pgd_t *pgd,
-                        unsigned long addr, unsigned long end, bool init_skey)
-{
-        unsigned long next;
-        pud_t *pud;
-
-        pud = pud_offset(pgd, addr);
-        do {
-                next = pud_addr_end(addr, end);
-                if (pud_none_or_clear_bad(pud))
-                        continue;
-                next = page_table_reset_pmd(mm, pud, addr, next, init_skey);
-        } while (pud++, addr = next, addr != end);
-
-        return addr;
-}
-
-void page_table_reset_pgste(struct mm_struct *mm, unsigned long start,
-                            unsigned long end, bool init_skey)
-{
-        unsigned long addr, next;
-        pgd_t *pgd;
-
-        down_write(&mm->mmap_sem);
-        if (init_skey && mm_use_skey(mm))
-                goto out_up;
-        addr = start;
-        pgd = pgd_offset(mm, addr);
-        do {
-                next = pgd_addr_end(addr, end);
-                if (pgd_none_or_clear_bad(pgd))
-                        continue;
-                next = page_table_reset_pud(mm, pgd, addr, next, init_skey);
-        } while (pgd++, addr = next, addr != end);
-        if (init_skey)
-                current->mm->context.use_skey = 1;
-out_up:
-        up_write(&mm->mmap_sem);
-}
-EXPORT_SYMBOL(page_table_reset_pgste);
-
 int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
                           unsigned long key, bool nq)
 {
@@ -992,11 +900,6 @@ static inline unsigned long *page_table_alloc_pgste(struct mm_struct *mm)
         return NULL;
 }
 
-void page_table_reset_pgste(struct mm_struct *mm, unsigned long start,
-                            unsigned long end, bool init_skey)
-{
-}
-
 static inline void page_table_free_pgste(unsigned long *table)
 {
 }
@@ -1347,13 +1250,89 @@ EXPORT_SYMBOL_GPL(s390_enable_sie);
  * Enable storage key handling from now on and initialize the storage
  * keys with the default key.
  */
-void s390_enable_skey(void)
+static int __s390_enable_skey(pte_t *pte, unsigned long addr,
+                              unsigned long next, struct mm_walk *walk)
 {
-        page_table_reset_pgste(current->mm, 0, TASK_SIZE, true);
+        unsigned long ptev;
+        pgste_t pgste;
+
+        pgste = pgste_get_lock(pte);
+        /*
+         * Remove all zero page mappings,
+         * after establishing a policy to forbid zero page mappings
+         * following faults for that page will get fresh anonymous pages
+         */
+        if (is_zero_pfn(pte_pfn(*pte))) {
+                ptep_flush_direct(walk->mm, addr, pte);
+                pte_val(*pte) = _PAGE_INVALID;
+        }
+        /* Clear storage key */
+        pgste_val(pgste) &= ~(PGSTE_ACC_BITS | PGSTE_FP_BIT |
+                              PGSTE_GR_BIT | PGSTE_GC_BIT);
+        ptev = pte_val(*pte);
+        if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE))
+                page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1);
+        pgste_set_unlock(pte, pgste);
+        return 0;
+}
+
+int s390_enable_skey(void)
+{
+        struct mm_walk walk = { .pte_entry = __s390_enable_skey };
+        struct mm_struct *mm = current->mm;
+        struct vm_area_struct *vma;
+        int rc = 0;
+
+        down_write(&mm->mmap_sem);
+        if (mm_use_skey(mm))
+                goto out_up;
+
+        mm->context.use_skey = 1;
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                if (ksm_madvise(vma, vma->vm_start, vma->vm_end,
+                                MADV_UNMERGEABLE, &vma->vm_flags)) {
+                        mm->context.use_skey = 0;
+                        rc = -ENOMEM;
+                        goto out_up;
+                }
+        }
+        mm->def_flags &= ~VM_MERGEABLE;
+
+        walk.mm = mm;
+        walk_page_range(0, TASK_SIZE, &walk);
+
+out_up:
+        up_write(&mm->mmap_sem);
+        return rc;
 }
 EXPORT_SYMBOL_GPL(s390_enable_skey);
 
 /*
+ * Reset CMMA state, make all pages stable again.
+ */
+static int __s390_reset_cmma(pte_t *pte, unsigned long addr,
+                             unsigned long next, struct mm_walk *walk)
+{
+        pgste_t pgste;
+
+        pgste = pgste_get_lock(pte);
+        pgste_val(pgste) &= ~_PGSTE_GPS_USAGE_MASK;
+        pgste_set_unlock(pte, pgste);
+        return 0;
+}
+
+void s390_reset_cmma(struct mm_struct *mm)
+{
+        struct mm_walk walk = { .pte_entry = __s390_reset_cmma };
+
+        down_write(&mm->mmap_sem);
+        walk.mm = mm;
+        walk_page_range(0, TASK_SIZE, &walk);
+        up_write(&mm->mmap_sem);
+}
+EXPORT_SYMBOL_GPL(s390_reset_cmma);
+
+/*
  * Test and reset if a guest page is dirty
  */
 bool gmap_test_and_clear_dirty(unsigned long address, struct gmap *gmap)
diff --git a/arch/s390/pci/Makefile b/arch/s390/pci/Makefile
index a9e1dc4ae442..805d8b29193a 100644
--- a/arch/s390/pci/Makefile
+++ b/arch/s390/pci/Makefile
@@ -3,4 +3,4 @@
 #
 
 obj-$(CONFIG_PCI)       += pci.o pci_dma.o pci_clp.o pci_sysfs.o \
-                           pci_event.o pci_debug.o pci_insn.o
+                           pci_event.o pci_debug.o pci_insn.o pci_mmio.o
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index d59c82569750..3290f11ae1d9 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -369,8 +369,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
 
         if (type == PCI_CAP_ID_MSI && nvec > 1)
                 return 1;
-        msi_vecs = min(nvec, ZPCI_MSI_VEC_MAX);
-        msi_vecs = min_t(unsigned int, msi_vecs, CONFIG_PCI_NR_MSI);
+        msi_vecs = min_t(unsigned int, nvec, zdev->max_msi);
 
         /* Allocate adapter summary indicator bit */
         rc = -EIO;
@@ -474,7 +473,8 @@ static void zpci_map_resources(struct zpci_dev *zdev)
                 len = pci_resource_len(pdev, i);
                 if (!len)
                         continue;
-                pdev->resource[i].start = (resource_size_t) pci_iomap(pdev, i, 0);
+                pdev->resource[i].start =
+                        (resource_size_t __force) pci_iomap(pdev, i, 0);
                 pdev->resource[i].end = pdev->resource[i].start + len - 1;
         }
 }
@@ -489,7 +489,8 @@ static void zpci_unmap_resources(struct zpci_dev *zdev)
                 len = pci_resource_len(pdev, i);
                 if (!len)
                         continue;
-                pci_iounmap(pdev, (void *) pdev->resource[i].start);
+                pci_iounmap(pdev, (void __iomem __force *)
+                            pdev->resource[i].start);
         }
 }
 
diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
index 6e22a247de9b..d6e411ed8b1f 100644
--- a/arch/s390/pci/pci_clp.c
+++ b/arch/s390/pci/pci_clp.c
@@ -62,6 +62,7 @@ static void clp_store_query_pci_fngrp(struct zpci_dev *zdev,
         zdev->tlb_refresh = response->refresh;
         zdev->dma_mask = response->dasm;
         zdev->msi_addr = response->msia;
+        zdev->max_msi = response->noi;
         zdev->fmb_update = response->mui;
 
         switch (response->version) {
diff --git a/arch/s390/pci/pci_debug.c b/arch/s390/pci/pci_debug.c
index eec598c5939f..3229a2e570df 100644
--- a/arch/s390/pci/pci_debug.c
+++ b/arch/s390/pci/pci_debug.c
@@ -158,10 +158,7 @@ int __init zpci_debug_init(void)
 
 void zpci_debug_exit(void)
 {
-        if (pci_debug_msg_id)
-                debug_unregister(pci_debug_msg_id);
-        if (pci_debug_err_id)
-                debug_unregister(pci_debug_err_id);
-
+        debug_unregister(pci_debug_msg_id);
+        debug_unregister(pci_debug_err_id);
         debugfs_remove(debugfs_root);
 }
diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
new file mode 100644
index 000000000000..62c5ea6d8682
--- /dev/null
+++ b/arch/s390/pci/pci_mmio.c
@@ -0,0 +1,115 @@
+/*
+ * Access to PCI I/O memory from user space programs.
+ *
+ * Copyright IBM Corp. 2014
+ * Author(s): Alexey Ishchuk <aishchuk@linux.vnet.ibm.com>
+ */
+#include <linux/kernel.h>
+#include <linux/syscalls.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/errno.h>
+#include <linux/pci.h>
+
+static long get_pfn(unsigned long user_addr, unsigned long access,
+                    unsigned long *pfn)
+{
+        struct vm_area_struct *vma;
+        long ret;
+
+        down_read(&current->mm->mmap_sem);
+        ret = -EINVAL;
+        vma = find_vma(current->mm, user_addr);
+        if (!vma)
+                goto out;
+        ret = -EACCES;
+        if (!(vma->vm_flags & access))
+                goto out;
+        ret = follow_pfn(vma, user_addr, pfn);
+out:
+        up_read(&current->mm->mmap_sem);
+        return ret;
+}
+
+SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
+                const void __user *, user_buffer, size_t, length)
+{
+        u8 local_buf[64];
+        void __iomem *io_addr;
+        void *buf;
+        unsigned long pfn;
+        long ret;
+
+        if (!zpci_is_enabled())
+                return -ENODEV;
+
+        if (length <= 0 || PAGE_SIZE - (mmio_addr & ~PAGE_MASK) < length)
+                return -EINVAL;
+        if (length > 64) {
+                buf = kmalloc(length, GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
+        } else
+                buf = local_buf;
+
+        ret = get_pfn(mmio_addr, VM_WRITE, &pfn);
+        if (ret)
+                goto out;
+        io_addr = (void *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
+
+        ret = -EFAULT;
+        if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
+                goto out;
+
+        if (copy_from_user(buf, user_buffer, length))
+                goto out;
+
+        memcpy_toio(io_addr, buf, length);
+        ret = 0;
+out:
+        if (buf != local_buf)
+                kfree(buf);
+        return ret;
+}
+
+SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
+                void __user *, user_buffer, size_t, length)
+{
+        u8 local_buf[64];
+        void __iomem *io_addr;
+        void *buf;
+        unsigned long pfn;
+        long ret;
+
+        if (!zpci_is_enabled())
+                return -ENODEV;
+
+        if (length <= 0 || PAGE_SIZE - (mmio_addr & ~PAGE_MASK) < length)
+                return -EINVAL;
+        if (length > 64) {
+                buf = kmalloc(length, GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
+        } else
+                buf = local_buf;
+
+        ret = get_pfn(mmio_addr, VM_READ, &pfn);
+        if (ret)
+                goto out;
+        io_addr = (void *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
+
+        ret = -EFAULT;
+        if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
+                goto out;
+
+        memcpy_fromio(buf, io_addr, length);
+
+        if (copy_to_user(user_buffer, buf, length))
+                goto out;
+
+        ret = 0;
+out:
+        if (buf != local_buf)
+                kfree(buf);
+        return ret;
+}
diff --git a/arch/x86/include/asm/xen/cpuid.h b/arch/x86/include/asm/xen/cpuid.h
new file mode 100644
index 000000000000..0d809e9fc975
--- /dev/null
+++ b/arch/x86/include/asm/xen/cpuid.h
@@ -0,0 +1,91 @@
+/******************************************************************************
+ * arch-x86/cpuid.h
+ *
+ * CPUID interface to Xen.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Copyright (c) 2007 Citrix Systems, Inc.
+ *
+ * Authors:
+ *    Keir Fraser <keir@xen.org>
+ */
+
+#ifndef __XEN_PUBLIC_ARCH_X86_CPUID_H__
+#define __XEN_PUBLIC_ARCH_X86_CPUID_H__
+
+/*
+ * For compatibility with other hypervisor interfaces, the Xen cpuid leaves
+ * can be found at the first otherwise unused 0x100 aligned boundary starting
+ * from 0x40000000.
+ *
+ * e.g If viridian extensions are enabled for an HVM domain, the Xen cpuid
+ * leaves will start at 0x40000100
+ */
+
+#define XEN_CPUID_FIRST_LEAF 0x40000000
+#define XEN_CPUID_LEAF(i)    (XEN_CPUID_FIRST_LEAF + (i))
+
+/*
+ * Leaf 1 (0x40000x00)
+ * EAX: Largest Xen-information leaf. All leaves up to an including @EAX
+ *      are supported by the Xen host.
+ * EBX-EDX: "XenVMMXenVMM" signature, allowing positive identification
+ *      of a Xen host.
+ */
+#define XEN_CPUID_SIGNATURE_EBX 0x566e6558 /* "XenV" */
+#define XEN_CPUID_SIGNATURE_ECX 0x65584d4d /* "MMXe" */
+#define XEN_CPUID_SIGNATURE_EDX 0x4d4d566e /* "nVMM" */
+
+/*
+ * Leaf 2 (0x40000x01)
+ * EAX[31:16]: Xen major version.
+ * EAX[15: 0]: Xen minor version.
+ * EBX-EDX: Reserved (currently all zeroes).
+ */
+
+/*
+ * Leaf 3 (0x40000x02)
+ * EAX: Number of hypercall transfer pages. This register is always guaranteed
+ *      to specify one hypercall page.
+ * EBX: Base address of Xen-specific MSRs.
+ * ECX: Features 1. Unused bits are set to zero.
+ * EDX: Features 2. Unused bits are set to zero.
+ */
+
+/* Does the host support MMU_PT_UPDATE_PRESERVE_AD for this guest? */
+#define _XEN_CPUID_FEAT1_MMU_PT_UPDATE_PRESERVE_AD 0
+#define XEN_CPUID_FEAT1_MMU_PT_UPDATE_PRESERVE_AD  (1u<<0)
+
+/*
+ * Leaf 5 (0x40000x04)
+ * HVM-specific features
+ */
+
+/* EAX Features */
+/* Virtualized APIC registers */
+#define XEN_HVM_CPUID_APIC_ACCESS_VIRT (1u << 0)
+/* Virtualized x2APIC accesses */
+#define XEN_HVM_CPUID_X2APIC_VIRT      (1u << 1)
+/* Memory mapped from other domains has valid IOMMU entries */
+#define XEN_HVM_CPUID_IOMMU_MAPPINGS   (1u << 2)
+
+#define XEN_CPUID_MAX_NUM_LEAVES 4
+
+#endif /* __XEN_PUBLIC_ARCH_X86_CPUID_H__ */
diff --git a/arch/x86/include/asm/xen/page-coherent.h b/arch/x86/include/asm/xen/page-coherent.h
index 7f02fe4e2c7b..acd844c017d3 100644
--- a/arch/x86/include/asm/xen/page-coherent.h
+++ b/arch/x86/include/asm/xen/page-coherent.h
@@ -22,8 +22,8 @@ static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
 }
 
 static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             unsigned long offset, size_t size, enum dma_data_direction dir,
-             struct dma_attrs *attrs) { }
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, struct dma_attrs *attrs) { }
 
 static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
                 size_t size, enum dma_data_direction dir,
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index c949923a5668..f58ef6c0613b 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -236,4 +236,11 @@ void make_lowmem_page_readwrite(void *vaddr);
 #define xen_remap(cookie, size) ioremap((cookie), (size));
 #define xen_unmap(cookie) iounmap((cookie))
 
+static inline bool xen_arch_need_swiotlb(struct device *dev,
+                                         unsigned long pfn,
+                                         unsigned long mfn)
+{
+        return false;
+}
+
 #endif /* _ASM_X86_XEN_PAGE_H */
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index 1819a91bbb9f..c489ef2c1a39 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -23,6 +23,8 @@
 #include <xen/features.h>
 #include <xen/events.h>
 #include <asm/xen/pci.h>
+#include <asm/xen/cpuid.h>
+#include <asm/apic.h>
 #include <asm/i8259.h>
 
 static int xen_pcifront_enable_irq(struct pci_dev *dev)
@@ -423,6 +425,28 @@ int __init pci_xen_init(void)
         return 0;
 }
 
+#ifdef CONFIG_PCI_MSI
+void __init xen_msi_init(void)
+{
+        if (!disable_apic) {
+                /*
+                 * If hardware supports (x2)APIC virtualization (as indicated
+                 * by hypervisor's leaf 4) then we don't need to use pirqs/
+                 * event channels for MSI handling and instead use regular
+                 * APIC processing
+                 */
+                uint32_t eax = cpuid_eax(xen_cpuid_base() + 4);
+
+                if (((eax & XEN_HVM_CPUID_X2APIC_VIRT) && x2apic_mode) ||
+                    ((eax & XEN_HVM_CPUID_APIC_ACCESS_VIRT) && cpu_has_apic))
+                        return;
+        }
+
+        x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
+        x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+}
+#endif
+
 int __init pci_xen_hvm_init(void)
 {
         if (!xen_have_vector_callback || !xen_feature(XENFEAT_hvm_pirqs))
@@ -437,8 +461,11 @@ int __init pci_xen_hvm_init(void)
 #endif
 
 #ifdef CONFIG_PCI_MSI
-        x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
-        x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+        /*
+         * We need to wait until after x2apic is initialized
+         * before we can set MSI IRQ ops.
+         */
+        x86_platform.apic_post_init = xen_msi_init;
 #endif
         return 0;
 }
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index cd4de7e038ea..c6bcb8c719d8 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -33,6 +33,7 @@
 #include <linux/pci.h>
 #include <linux/pci-acpi.h>
 #include <linux/pci-aspm.h>
+#include <linux/dmar.h>
 #include <linux/acpi.h>
 #include <linux/slab.h>
 #include <linux/dmi.h>
@@ -525,6 +526,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
         struct acpi_pci_root *root;
         acpi_handle handle = device->handle;
         int no_aspm = 0, clear_aspm = 0;
+        bool hotadd = system_state != SYSTEM_BOOTING;
 
         root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
         if (!root)
@@ -571,6 +573,11 @@ static int acpi_pci_root_add(struct acpi_device *device,
         strcpy(acpi_device_class(device), ACPI_PCI_ROOT_CLASS);
         device->driver_data = root;
 
+        if (hotadd && dmar_device_add(handle)) {
+                result = -ENXIO;
+                goto end;
+        }
+
         pr_info(PREFIX "%s [%s] (domain %04x %pR)\n",
                acpi_device_name(device), acpi_device_bid(device),
                root->segment, &root->secondary);
@@ -597,7 +604,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
                         root->segment, (unsigned int)root->secondary.start);
                 device->driver_data = NULL;
                 result = -ENODEV;
-                goto end;
+                goto remove_dmar;
         }
 
         if (clear_aspm) {
@@ -611,7 +618,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
         if (device->wakeup.flags.run_wake)
                 device_set_run_wake(root->bus->bridge, true);
 
-        if (system_state != SYSTEM_BOOTING) {
+        if (hotadd) {
                 pcibios_resource_survey_bus(root->bus);
                 pci_assign_unassigned_root_bus_resources(root->bus);
         }
@@ -621,6 +628,9 @@ static int acpi_pci_root_add(struct acpi_device *device,
         pci_unlock_rescan_remove();
         return 1;
 
+remove_dmar:
+        if (hotadd)
+                dmar_device_remove(handle);
 end:
         kfree(root);
         return result;
@@ -639,6 +649,8 @@ static void acpi_pci_root_remove(struct acpi_device *device)
 
         pci_remove_root_bus(root->bus);
 
+        dmar_device_remove(device->handle);
+
         pci_unlock_rescan_remove();
 
         kfree(root);
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 973a3332a85f..80f4de729a86 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -95,8 +95,12 @@ static int amba_pm_runtime_suspend(struct device *dev)
         struct amba_device *pcdev = to_amba_device(dev);
         int ret = pm_generic_runtime_suspend(dev);
 
-        if (ret == 0 && dev->driver)
-                clk_disable_unprepare(pcdev->pclk);
+        if (ret == 0 && dev->driver) {
+                if (pm_runtime_is_irq_safe(dev))
+                        clk_disable(pcdev->pclk);
+                else
+                        clk_disable_unprepare(pcdev->pclk);
+        }
 
         return ret;
 }
@@ -107,7 +111,10 @@ static int amba_pm_runtime_resume(struct device *dev)
         int ret;
 
         if (dev->driver) {
-                ret = clk_prepare_enable(pcdev->pclk);
+                if (pm_runtime_is_irq_safe(dev))
+                        ret = clk_enable(pcdev->pclk);
+                else
+                        ret = clk_prepare_enable(pcdev->pclk);
                 /* Failure is probably fatal to the system, but... */
                 if (ret)
                         return ret;
@@ -115,7 +122,7 @@ static int amba_pm_runtime_resume(struct device *dev)
 
         return pm_generic_runtime_resume(dev);
 }
-#endif
+#endif /* CONFIG_PM */
 
 static const struct dev_pm_ops amba_pm = {
         .suspend        = pm_generic_suspend,
diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c
index e44d675a30ec..b5aedca5ea3c 100644
--- a/drivers/ata/ahci_sunxi.c
+++ b/drivers/ata/ahci_sunxi.c
@@ -27,6 +27,12 @@
 #include <linux/regulator/consumer.h>
 #include "ahci.h"
 
+/* Insmod parameters */
+static bool enable_pmp;
+module_param(enable_pmp, bool, 0);
+MODULE_PARM_DESC(enable_pmp,
+        "Enable support for sata port multipliers, only use if you use a pmp!");
+
 #define AHCI_BISTAFR    0x00a0
 #define AHCI_BISTCR     0x00a4
 #define AHCI_BISTFCTR   0x00a8
@@ -184,7 +190,15 @@ static int ahci_sunxi_probe(struct platform_device *pdev)
                 goto disable_resources;
 
         hpriv->flags = AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI |
-                       AHCI_HFLAG_NO_PMP | AHCI_HFLAG_YES_NCQ;
+                       AHCI_HFLAG_YES_NCQ;
+
+        /*
+         * The sunxi sata controller seems to be unable to successfully do a
+         * soft reset if no pmp is attached, so disable pmp use unless
+         * requested, otherwise directly attached disks do not work.
+         */
+        if (!enable_pmp)
+                hpriv->flags |= AHCI_HFLAG_NO_PMP;
 
         rc = ahci_platform_init_host(pdev, hpriv, &ahci_sunxi_port_info);
         if (rc)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index c5ba15af87d3..5c84fb5c3372 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1043,8 +1043,8 @@ const char *sata_spd_string(unsigned int spd)
  *      None.
  *
  *      RETURNS:
- *      Device type, %ATA_DEV_ATA, %ATA_DEV_ATAPI, %ATA_DEV_PMP or
- *      %ATA_DEV_UNKNOWN the event of failure.
+ *      Device type, %ATA_DEV_ATA, %ATA_DEV_ATAPI, %ATA_DEV_PMP,
+ *      %ATA_DEV_ZAC, or %ATA_DEV_UNKNOWN the event of failure.
  */
 unsigned int ata_dev_classify(const struct ata_taskfile *tf)
 {
@@ -1089,6 +1089,11 @@ unsigned int ata_dev_classify(const struct ata_taskfile *tf)
                 return ATA_DEV_SEMB;
         }
 
+        if ((tf->lbam == 0xcd) && (tf->lbah == 0xab)) {
+                DPRINTK("found ZAC device by sig\n");
+                return ATA_DEV_ZAC;
+        }
+
         DPRINTK("unknown device\n");
         return ATA_DEV_UNKNOWN;
 }
@@ -1329,7 +1334,7 @@ static int ata_hpa_resize(struct ata_device *dev)
         int rc;
 
         /* do we need to do it? */
-        if (dev->class != ATA_DEV_ATA ||
+        if ((dev->class != ATA_DEV_ATA && dev->class != ATA_DEV_ZAC) ||
             !ata_id_has_lba(dev->id) || !ata_id_hpa_enabled(dev->id) ||
             (dev->horkage & ATA_HORKAGE_BROKEN_HPA))
                 return 0;
@@ -1889,6 +1894,7 @@ retry:
         case ATA_DEV_SEMB:
                 class = ATA_DEV_ATA;    /* some hard drives report SEMB sig */
         case ATA_DEV_ATA:
+        case ATA_DEV_ZAC:
                 tf.command = ATA_CMD_ID_ATA;
                 break;
         case ATA_DEV_ATAPI:
@@ -1980,7 +1986,7 @@ retry:
         rc = -EINVAL;
         reason = "device reports invalid type";
 
-        if (class == ATA_DEV_ATA) {
+        if (class == ATA_DEV_ATA || class == ATA_DEV_ZAC) {
                 if (!ata_id_is_ata(id) && !ata_id_is_cfa(id))
                         goto err_out;
                 if (ap->host->flags & ATA_HOST_IGNORE_ATA &&
@@ -2015,7 +2021,8 @@ retry:
                         goto retry;
         }
 
-        if ((flags & ATA_READID_POSTRESET) && class == ATA_DEV_ATA) {
+        if ((flags & ATA_READID_POSTRESET) &&
+            (class == ATA_DEV_ATA || class == ATA_DEV_ZAC)) {
                 /*
                  * The exact sequence expected by certain pre-ATA4 drives is:
                  * SRST RESET
@@ -2280,7 +2287,7 @@ int ata_dev_configure(struct ata_device *dev)
                         sizeof(modelbuf));
 
         /* ATA-specific feature tests */
-        if (dev->class == ATA_DEV_ATA) {
+        if (dev->class == ATA_DEV_ATA || dev->class == ATA_DEV_ZAC) {
                 if (ata_id_is_cfa(id)) {
                         /* CPRM may make this media unusable */
                         if (id[ATA_ID_CFA_KEY_MGMT] & 1)
@@ -4033,6 +4040,7 @@ int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
         if (ata_class_enabled(new_class) &&
             new_class != ATA_DEV_ATA &&
             new_class != ATA_DEV_ATAPI &&
+            new_class != ATA_DEV_ZAC &&
             new_class != ATA_DEV_SEMB) {
                 ata_dev_info(dev, "class mismatch %u != %u\n",
                              dev->class, new_class);
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index dad83df555c4..3dbec8954c86 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1809,6 +1809,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
 
         switch (qc->dev->class) {
         case ATA_DEV_ATA:
+        case ATA_DEV_ZAC:
                 if (err & ATA_ICRC)
                         qc->err_mask |= AC_ERR_ATA_BUS;
                 if (err & (ATA_UNC | ATA_AMNF))
@@ -3792,7 +3793,8 @@ int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
                                 struct ata_eh_context *ehc = &link->eh_context;
                                 unsigned long tmp;
 
-                                if (dev->class != ATA_DEV_ATA)
+                                if (dev->class != ATA_DEV_ATA &&
+                                    dev->class != ATA_DEV_ZAC)
                                         continue;
                                 if (!(ehc->i.dev_action[dev->devno] &
                                       ATA_EH_PARK))
@@ -3873,7 +3875,8 @@ int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
 
                 /* retry flush if necessary */
                 ata_for_each_dev(dev, link, ALL) {
-                        if (dev->class != ATA_DEV_ATA)
+                        if (dev->class != ATA_DEV_ATA &&
+                            dev->class != ATA_DEV_ZAC)
                                 continue;
                         rc = ata_eh_maybe_retry_flush(dev);
                         if (rc)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index dd45c6a03e5d..e364e86e84d7 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -235,7 +235,8 @@ static ssize_t ata_scsi_park_store(struct device *device,
                 rc = -ENODEV;
                 goto unlock;
         }
-        if (dev->class != ATA_DEV_ATA) {
+        if (dev->class != ATA_DEV_ATA &&
+            dev->class != ATA_DEV_ZAC) {
                 rc = -EOPNOTSUPP;
                 goto unlock;
         }
@@ -1961,6 +1962,7 @@ static void ata_scsi_rbuf_fill(struct ata_scsi_args *args,
 static unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf)
 {
         const u8 versions[] = {
+                0x00,
                 0x60,   /* SAM-3 (no version claimed) */
 
                 0x03,
@@ -1969,6 +1971,20 @@ static unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf)
                 0x02,
                 0x60    /* SPC-3 (no version claimed) */
         };
+        const u8 versions_zbc[] = {
+                0x00,
+                0xA0,   /* SAM-5 (no version claimed) */
+
+                0x04,
+                0xC0,   /* SBC-3 (no version claimed) */
+
+                0x04,
+                0x60,   /* SPC-4 (no version claimed) */
+
+                0x60,
+                0x20,   /* ZBC (no version claimed) */
+        };
+
         u8 hdr[] = {
                 TYPE_DISK,
                 0,
@@ -1983,6 +1999,11 @@ static unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf)
         if (ata_id_removeable(args->id))
                 hdr[1] |= (1 << 7);
 
+        if (args->dev->class == ATA_DEV_ZAC) {
+                hdr[0] = TYPE_ZBC;
+                hdr[2] = 0x6; /* ZBC is defined in SPC-4 */
+        }
+
         memcpy(rbuf, hdr, sizeof(hdr));
         memcpy(&rbuf[8], "ATA     ", 8);
         ata_id_string(args->id, &rbuf[16], ATA_ID_PROD, 16);
@@ -1995,7 +2016,10 @@ static unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf)
         if (rbuf[32] == 0 || rbuf[32] == ' ')
                 memcpy(&rbuf[32], "n/a ", 4);
 
-        memcpy(rbuf + 59, versions, sizeof(versions));
+        if (args->dev->class == ATA_DEV_ZAC)
+                memcpy(rbuf + 58, versions_zbc, sizeof(versions_zbc));
+        else
+                memcpy(rbuf + 58, versions, sizeof(versions));
 
         return 0;
 }
@@ -2564,7 +2588,6 @@ static void atapi_request_sense(struct ata_queued_cmd *qc)
 
         DPRINTK("ATAPI request sense\n");
 
-        /* FIXME: is this needed? */
         memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
 
 #ifdef CONFIG_ATA_SFF
@@ -3405,7 +3428,7 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
         ata_xlat_func_t xlat_func;
         int rc = 0;
 
-        if (dev->class == ATA_DEV_ATA) {
+        if (dev->class == ATA_DEV_ATA || dev->class == ATA_DEV_ZAC) {
                 if (unlikely(!scmd->cmd_len || scmd->cmd_len > dev->cdb_len))
                         goto bad_cdb_len;
 
diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index e37413228228..3227b7c8a05f 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -143,6 +143,7 @@ static struct {
         { ATA_DEV_PMP_UNSUP,            "pmp" },
         { ATA_DEV_SEMB,                 "semb" },
         { ATA_DEV_SEMB_UNSUP,           "semb" },
+        { ATA_DEV_ZAC,                  "zac" },
         { ATA_DEV_NONE,                 "none" }
 };
 ata_bitfield_name_search(class, ata_class_names)
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index 5ec69c3d409d..04faf6df959f 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -20,6 +20,9 @@
 #include <linux/serial_core.h>
 #include <linux/serial_reg.h>
 #include <linux/time.h>
+#ifdef CONFIG_BCM47XX
+#include <bcm47xx_nvram.h>
+#endif
 
 enum bcma_boot_dev {
         BCMA_BOOT_DEV_UNK = 0,
@@ -316,10 +319,16 @@ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
         switch (boot_dev) {
         case BCMA_BOOT_DEV_PARALLEL:
         case BCMA_BOOT_DEV_SERIAL:
-                /* TODO: Init NVRAM using BCMA_SOC_FLASH2 window */
+#ifdef CONFIG_BCM47XX
+                bcm47xx_nvram_init_from_mem(BCMA_SOC_FLASH2,
+                                            BCMA_SOC_FLASH2_SZ);
+#endif
                 break;
         case BCMA_BOOT_DEV_NAND:
-                /* TODO: Init NVRAM using BCMA_SOC_FLASH1 window */
+#ifdef CONFIG_BCM47XX
+                bcm47xx_nvram_init_from_mem(BCMA_SOC_FLASH1,
+                                            BCMA_SOC_FLASH1_SZ);
+#endif
                 break;
         default:
                 break;
diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig
index db1c9b7adaa6..6ed9e9fe5233 100644
--- a/drivers/char/ipmi/Kconfig
+++ b/drivers/char/ipmi/Kconfig
@@ -62,6 +62,20 @@ config IPMI_SI_PROBE_DEFAULTS
          only be available on older systems if the "ipmi_si_intf.trydefaults=1"
          boot argument is passed.
 
+config IPMI_SSIF
+       tristate 'IPMI SMBus handler (SSIF)'
+       select I2C
+       help
+         Provides a driver for a SMBus interface to a BMC, meaning that you
+         have a driver that must be accessed over an I2C bus instead of a
+         standard interface.  This module requires I2C support.
+
+config IPMI_POWERNV
+       depends on PPC_POWERNV
+       tristate 'POWERNV (OPAL firmware) IPMI interface'
+       help
+         Provides a driver for OPAL firmware-based IPMI interfaces.
+
 config IPMI_WATCHDOG
        tristate 'IPMI Watchdog Timer'
        help
diff --git a/drivers/char/ipmi/Makefile b/drivers/char/ipmi/Makefile
index 16a93648d54e..f3ffde1f5f1f 100644
--- a/drivers/char/ipmi/Makefile
+++ b/drivers/char/ipmi/Makefile
@@ -7,5 +7,7 @@ ipmi_si-y := ipmi_si_intf.o ipmi_kcs_sm.o ipmi_smic_sm.o ipmi_bt_sm.o
 obj-$(CONFIG_IPMI_HANDLER) += ipmi_msghandler.o
 obj-$(CONFIG_IPMI_DEVICE_INTERFACE) += ipmi_devintf.o
 obj-$(CONFIG_IPMI_SI) += ipmi_si.o
+obj-$(CONFIG_IPMI_SSIF) += ipmi_ssif.o
+obj-$(CONFIG_IPMI_POWERNV) += ipmi_powernv.o
 obj-$(CONFIG_IPMI_WATCHDOG) += ipmi_watchdog.o
 obj-$(CONFIG_IPMI_POWEROFF) += ipmi_poweroff.o
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index f816211f062f..5fa83f751378 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -56,6 +56,8 @@ static int ipmi_init_msghandler(void);
 static void smi_recv_tasklet(unsigned long);
 static void handle_new_recv_msgs(ipmi_smi_t intf);
 static void need_waiter(ipmi_smi_t intf);
+static int handle_one_recv_msg(ipmi_smi_t          intf,
+                               struct ipmi_smi_msg *msg);
 
 static int initialized;
 
@@ -191,12 +193,12 @@ struct ipmi_proc_entry {
 #endif
 
 struct bmc_device {
-        struct platform_device *dev;
+        struct platform_device pdev;
         struct ipmi_device_id  id;
         unsigned char          guid[16];
         int                    guid_set;
-
-        struct kref            refcount;
+        char                   name[16];
+        struct kref            usecount;
 
         /* bmc device attributes */
         struct device_attribute device_id_attr;
@@ -210,6 +212,7 @@ struct bmc_device {
         struct device_attribute guid_attr;
         struct device_attribute aux_firmware_rev_attr;
 };
+#define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 
 /*
  * Various statistics for IPMI, these index stats[] in the ipmi_smi
@@ -323,6 +326,9 @@ struct ipmi_smi {
 
         struct kref refcount;
 
+        /* Set when the interface is being unregistered. */
+        bool in_shutdown;
+
         /* Used for a list of interfaces. */
         struct list_head link;
 
@@ -341,7 +347,6 @@ struct ipmi_smi {
 
         struct bmc_device *bmc;
         char *my_dev_name;
-        char *sysfs_name;
 
         /*
          * This is the lower-layer's sender routine.  Note that you
@@ -377,11 +382,16 @@ struct ipmi_smi {
          * periodic timer interrupt.  The tasklet is for handling received
          * messages directly from the handler.
          */
-        spinlock_t       waiting_msgs_lock;
-        struct list_head waiting_msgs;
+        spinlock_t       waiting_rcv_msgs_lock;
+        struct list_head waiting_rcv_msgs;
         atomic_t         watchdog_pretimeouts_to_deliver;
         struct tasklet_struct recv_tasklet;
 
+        spinlock_t             xmit_msgs_lock;
+        struct list_head       xmit_msgs;
+        struct ipmi_smi_msg    *curr_msg;
+        struct list_head       hp_xmit_msgs;
+
         /*
          * The list of command receivers that are registered for commands
          * on this interface.
@@ -474,6 +484,18 @@ static DEFINE_MUTEX(smi_watchers_mutex);
 #define ipmi_get_stat(intf, stat) \
         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 
+static char *addr_src_to_str[] = { "invalid", "hotmod", "hardcoded", "SPMI",
+                                   "ACPI", "SMBIOS", "PCI",
+                                   "device-tree", "default" };
+
+const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
+{
+        if (src > SI_DEFAULT)
+                src = 0; /* Invalid */
+        return addr_src_to_str[src];
+}
+EXPORT_SYMBOL(ipmi_addr_src_to_str);
+
 static int is_lan_addr(struct ipmi_addr *addr)
 {
         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
@@ -517,7 +539,7 @@ static void clean_up_interface_data(ipmi_smi_t intf)
 
         tasklet_kill(&intf->recv_tasklet);
 
-        free_smi_msg_list(&intf->waiting_msgs);
+        free_smi_msg_list(&intf->waiting_rcv_msgs);
         free_recv_msg_list(&intf->waiting_events);
 
         /*
@@ -1473,6 +1495,30 @@ static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
         smi_msg->msgid = msgid;
 }
 
+static void smi_send(ipmi_smi_t intf, struct ipmi_smi_handlers *handlers,
+                     struct ipmi_smi_msg *smi_msg, int priority)
+{
+        int run_to_completion = intf->run_to_completion;
+        unsigned long flags;
+
+        if (!run_to_completion)
+                spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+        if (intf->curr_msg) {
+                if (priority > 0)
+                        list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
+                else
+                        list_add_tail(&smi_msg->link, &intf->xmit_msgs);
+                smi_msg = NULL;
+        } else {
+                intf->curr_msg = smi_msg;
+        }
+        if (!run_to_completion)
+                spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+
+        if (smi_msg)
+                handlers->sender(intf->send_info, smi_msg);
+}
+
 /*
  * Separate from ipmi_request so that the user does not have to be
  * supplied in certain circumstances (mainly at panic time).  If
@@ -1497,7 +1543,6 @@ static int i_ipmi_request(ipmi_user_t          user,
         struct ipmi_smi_msg      *smi_msg;
         struct ipmi_recv_msg     *recv_msg;
         unsigned long            flags;
-        struct ipmi_smi_handlers *handlers;
 
 
         if (supplied_recv)
@@ -1520,8 +1565,7 @@ static int i_ipmi_request(ipmi_user_t          user,
         }
 
         rcu_read_lock();
-        handlers = intf->handlers;
-        if (!handlers) {
+        if (intf->in_shutdown) {
                 rv = -ENODEV;
                 goto out_err;
         }
@@ -1856,7 +1900,7 @@ static int i_ipmi_request(ipmi_user_t          user,
         }
 #endif
 
-        handlers->sender(intf->send_info, smi_msg, priority);
+        smi_send(intf, intf->handlers, smi_msg, priority);
         rcu_read_unlock();
 
         return 0;
@@ -2153,7 +2197,7 @@ static void remove_proc_entries(ipmi_smi_t smi)
 static int __find_bmc_guid(struct device *dev, void *data)
 {
         unsigned char *id = data;
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
         return memcmp(bmc->guid, id, 16) == 0;
 }
 
@@ -2164,7 +2208,7 @@ static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
 
         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
         if (dev)
-                return dev_get_drvdata(dev);
+                return to_bmc_device(dev);
         else
                 return NULL;
 }
@@ -2177,7 +2221,7 @@ struct prod_dev_id {
 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
 {
         struct prod_dev_id *id = data;
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return (bmc->id.product_id == id->product_id
                 && bmc->id.device_id == id->device_id);
@@ -2195,7 +2239,7 @@ static struct bmc_device *ipmi_find_bmc_prod_dev_id(
 
         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
         if (dev)
-                return dev_get_drvdata(dev);
+                return to_bmc_device(dev);
         else
                 return NULL;
 }
@@ -2204,84 +2248,92 @@ static ssize_t device_id_show(struct device *dev,
                               struct device_attribute *attr,
                               char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
 }
+DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
 
-static ssize_t provides_dev_sdrs_show(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
+static ssize_t provides_device_sdrs_show(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 10, "%u\n",
                         (bmc->id.device_revision & 0x80) >> 7);
 }
+DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show, NULL);
 
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 20, "%u\n",
                         bmc->id.device_revision & 0x0F);
 }
+DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
 
-static ssize_t firmware_rev_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
+static ssize_t firmware_revision_show(struct device *dev,
+                                      struct device_attribute *attr,
+                                      char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
                         bmc->id.firmware_revision_2);
 }
+DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
 
 static ssize_t ipmi_version_show(struct device *dev,
                                  struct device_attribute *attr,
                                  char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 20, "%u.%u\n",
                         ipmi_version_major(&bmc->id),
                         ipmi_version_minor(&bmc->id));
 }
+DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
 
 static ssize_t add_dev_support_show(struct device *dev,
                                     struct device_attribute *attr,
                                     char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 10, "0x%02x\n",
                         bmc->id.additional_device_support);
 }
+DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, NULL);
 
 static ssize_t manufacturer_id_show(struct device *dev,
                                     struct device_attribute *attr,
                                     char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
 }
+DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
 
 static ssize_t product_id_show(struct device *dev,
                                struct device_attribute *attr,
                                char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
 }
+DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
 
 static ssize_t aux_firmware_rev_show(struct device *dev,
                                      struct device_attribute *attr,
                                      char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
                         bmc->id.aux_firmware_revision[3],
@@ -2289,174 +2341,96 @@ static ssize_t aux_firmware_rev_show(struct device *dev,
                         bmc->id.aux_firmware_revision[1],
                         bmc->id.aux_firmware_revision[0]);
 }
+DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
 
 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                          char *buf)
 {
-        struct bmc_device *bmc = dev_get_drvdata(dev);
+        struct bmc_device *bmc = to_bmc_device(dev);
 
         return snprintf(buf, 100, "%Lx%Lx\n",
                         (long long) bmc->guid[0],
                         (long long) bmc->guid[8]);
 }
+DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
+
+static struct attribute *bmc_dev_attrs[] = {
+        &dev_attr_device_id.attr,
+        &dev_attr_provides_device_sdrs.attr,
+        &dev_attr_revision.attr,
+        &dev_attr_firmware_revision.attr,
+        &dev_attr_ipmi_version.attr,
+        &dev_attr_additional_device_support.attr,
+        &dev_attr_manufacturer_id.attr,
+        &dev_attr_product_id.attr,
+        NULL
+};
 
-static void remove_files(struct bmc_device *bmc)
-{
-        if (!bmc->dev)
-                return;
+static struct attribute_group bmc_dev_attr_group = {
+        .attrs          = bmc_dev_attrs,
+};
 
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->device_id_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->provides_dev_sdrs_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->revision_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->firmware_rev_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->version_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->add_dev_support_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->manufacturer_id_attr);
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->product_id_attr);
+static const struct attribute_group *bmc_dev_attr_groups[] = {
+        &bmc_dev_attr_group,
+        NULL
+};
 
-        if (bmc->id.aux_firmware_revision_set)
-                device_remove_file(&bmc->dev->dev,
-                                   &bmc->aux_firmware_rev_attr);
-        if (bmc->guid_set)
-                device_remove_file(&bmc->dev->dev,
-                                   &bmc->guid_attr);
+static struct device_type bmc_device_type = {
+        .groups         = bmc_dev_attr_groups,
+};
+
+static void
+release_bmc_device(struct device *dev)
+{
+        kfree(to_bmc_device(dev));
 }
 
 static void
 cleanup_bmc_device(struct kref *ref)
 {
-        struct bmc_device *bmc;
+        struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
 
-        bmc = container_of(ref, struct bmc_device, refcount);
+        if (bmc->id.aux_firmware_revision_set)
+                device_remove_file(&bmc->pdev.dev,
+                                   &bmc->aux_firmware_rev_attr);
+        if (bmc->guid_set)
+                device_remove_file(&bmc->pdev.dev,
+                                   &bmc->guid_attr);
 
-        remove_files(bmc);
-        platform_device_unregister(bmc->dev);
-        kfree(bmc);
+        platform_device_unregister(&bmc->pdev);
 }
 
 static void ipmi_bmc_unregister(ipmi_smi_t intf)
 {
         struct bmc_device *bmc = intf->bmc;
 
-        if (intf->sysfs_name) {
-                sysfs_remove_link(&intf->si_dev->kobj, intf->sysfs_name);
-                kfree(intf->sysfs_name);
-                intf->sysfs_name = NULL;
-        }
+        sysfs_remove_link(&intf->si_dev->kobj, "bmc");
         if (intf->my_dev_name) {
-                sysfs_remove_link(&bmc->dev->dev.kobj, intf->my_dev_name);
+                sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
                 kfree(intf->my_dev_name);
                 intf->my_dev_name = NULL;
         }
 
         mutex_lock(&ipmidriver_mutex);
-        kref_put(&bmc->refcount, cleanup_bmc_device);
+        kref_put(&bmc->usecount, cleanup_bmc_device);
         intf->bmc = NULL;
         mutex_unlock(&ipmidriver_mutex);
 }
 
-static int create_files(struct bmc_device *bmc)
+static int create_bmc_files(struct bmc_device *bmc)
 {
         int err;
 
-        bmc->device_id_attr.attr.name = "device_id";
-        bmc->device_id_attr.attr.mode = S_IRUGO;
-        bmc->device_id_attr.show = device_id_show;
-        sysfs_attr_init(&bmc->device_id_attr.attr);
-
-        bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
-        bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
-        bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
-        sysfs_attr_init(&bmc->provides_dev_sdrs_attr.attr);
-
-        bmc->revision_attr.attr.name = "revision";
-        bmc->revision_attr.attr.mode = S_IRUGO;
-        bmc->revision_attr.show = revision_show;
-        sysfs_attr_init(&bmc->revision_attr.attr);
-
-        bmc->firmware_rev_attr.attr.name = "firmware_revision";
-        bmc->firmware_rev_attr.attr.mode = S_IRUGO;
-        bmc->firmware_rev_attr.show = firmware_rev_show;
-        sysfs_attr_init(&bmc->firmware_rev_attr.attr);
-
-        bmc->version_attr.attr.name = "ipmi_version";
-        bmc->version_attr.attr.mode = S_IRUGO;
-        bmc->version_attr.show = ipmi_version_show;
-        sysfs_attr_init(&bmc->version_attr.attr);
-
-        bmc->add_dev_support_attr.attr.name = "additional_device_support";
-        bmc->add_dev_support_attr.attr.mode = S_IRUGO;
-        bmc->add_dev_support_attr.show = add_dev_support_show;
-        sysfs_attr_init(&bmc->add_dev_support_attr.attr);
-
-        bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
-        bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
-        bmc->manufacturer_id_attr.show = manufacturer_id_show;
-        sysfs_attr_init(&bmc->manufacturer_id_attr.attr);
-
-        bmc->product_id_attr.attr.name = "product_id";
-        bmc->product_id_attr.attr.mode = S_IRUGO;
-        bmc->product_id_attr.show = product_id_show;
-        sysfs_attr_init(&bmc->product_id_attr.attr);
-
-        bmc->guid_attr.attr.name = "guid";
-        bmc->guid_attr.attr.mode = S_IRUGO;
-        bmc->guid_attr.show = guid_show;
-        sysfs_attr_init(&bmc->guid_attr.attr);
-
-        bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
-        bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
-        bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
-        sysfs_attr_init(&bmc->aux_firmware_rev_attr.attr);
-
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->device_id_attr);
-        if (err)
-                goto out;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->provides_dev_sdrs_attr);
-        if (err)
-                goto out_devid;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->revision_attr);
-        if (err)
-                goto out_sdrs;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->firmware_rev_attr);
-        if (err)
-                goto out_rev;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->version_attr);
-        if (err)
-                goto out_firm;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->add_dev_support_attr);
-        if (err)
-                goto out_version;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->manufacturer_id_attr);
-        if (err)
-                goto out_add_dev;
-        err = device_create_file(&bmc->dev->dev,
-                           &bmc->product_id_attr);
-        if (err)
-                goto out_manu;
         if (bmc->id.aux_firmware_revision_set) {
-                err = device_create_file(&bmc->dev->dev,
+                bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
+                err = device_create_file(&bmc->pdev.dev,
                                    &bmc->aux_firmware_rev_attr);
                 if (err)
-                        goto out_prod_id;
+                        goto out;
         }
         if (bmc->guid_set) {
-                err = device_create_file(&bmc->dev->dev,
+                bmc->guid_attr.attr.name = "guid";
+                err = device_create_file(&bmc->pdev.dev,
                                    &bmc->guid_attr);
                 if (err)
                         goto out_aux_firm;
@@ -2466,44 +2440,17 @@ static int create_files(struct bmc_device *bmc)
 
 out_aux_firm:
         if (bmc->id.aux_firmware_revision_set)
-                device_remove_file(&bmc->dev->dev,
+                device_remove_file(&bmc->pdev.dev,
                                    &bmc->aux_firmware_rev_attr);
-out_prod_id:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->product_id_attr);
-out_manu:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->manufacturer_id_attr);
-out_add_dev:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->add_dev_support_attr);
-out_version:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->version_attr);
-out_firm:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->firmware_rev_attr);
-out_rev:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->revision_attr);
-out_sdrs:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->provides_dev_sdrs_attr);
-out_devid:
-        device_remove_file(&bmc->dev->dev,
-                           &bmc->device_id_attr);
 out:
         return err;
 }
 
-static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
-                             const char *sysfs_name)
+static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum)
 {
         int               rv;
         struct bmc_device *bmc = intf->bmc;
         struct bmc_device *old_bmc;
-        int               size;
-        char              dummy[1];
 
         mutex_lock(&ipmidriver_mutex);
 
@@ -2527,7 +2474,7 @@ static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
                 intf->bmc = old_bmc;
                 bmc = old_bmc;
 
-                kref_get(&bmc->refcount);
+                kref_get(&bmc->usecount);
                 mutex_unlock(&ipmidriver_mutex);
 
                 printk(KERN_INFO
@@ -2537,12 +2484,12 @@ static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
                        bmc->id.product_id,
                        bmc->id.device_id);
         } else {
-                char name[14];
                 unsigned char orig_dev_id = bmc->id.device_id;
                 int warn_printed = 0;
 
-                snprintf(name, sizeof(name),
+                snprintf(bmc->name, sizeof(bmc->name),
                          "ipmi_bmc.%4.4x", bmc->id.product_id);
+                bmc->pdev.name = bmc->name;
 
                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
                                                  bmc->id.product_id,
@@ -2566,23 +2513,16 @@ static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
                         }
                 }
 
-                bmc->dev = platform_device_alloc(name, bmc->id.device_id);
-                if (!bmc->dev) {
-                        mutex_unlock(&ipmidriver_mutex);
-                        printk(KERN_ERR
-                               "ipmi_msghandler:"
-                               " Unable to allocate platform device\n");
-                        return -ENOMEM;
-                }
-                bmc->dev->dev.driver = &ipmidriver.driver;
-                dev_set_drvdata(&bmc->dev->dev, bmc);
-                kref_init(&bmc->refcount);
+                bmc->pdev.dev.driver = &ipmidriver.driver;
+                bmc->pdev.id = bmc->id.device_id;
+                bmc->pdev.dev.release = release_bmc_device;
+                bmc->pdev.dev.type = &bmc_device_type;
+                kref_init(&bmc->usecount);
 
-                rv = platform_device_add(bmc->dev);
+                rv = platform_device_register(&bmc->pdev);
                 mutex_unlock(&ipmidriver_mutex);
                 if (rv) {
-                        platform_device_put(bmc->dev);
-                        bmc->dev = NULL;
+                        put_device(&bmc->pdev.dev);
                         printk(KERN_ERR
                                "ipmi_msghandler:"
                                " Unable to register bmc device: %d\n",
@@ -2594,10 +2534,10 @@ static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
                         return rv;
                 }
 
-                rv = create_files(bmc);
+                rv = create_bmc_files(bmc);
                 if (rv) {
                         mutex_lock(&ipmidriver_mutex);
-                        platform_device_unregister(bmc->dev);
+                        platform_device_unregister(&bmc->pdev);
                         mutex_unlock(&ipmidriver_mutex);
 
                         return rv;
@@ -2614,44 +2554,26 @@ static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
          * create symlink from system interface device to bmc device
          * and back.
          */
-        intf->sysfs_name = kstrdup(sysfs_name, GFP_KERNEL);
-        if (!intf->sysfs_name) {
-                rv = -ENOMEM;
-                printk(KERN_ERR
-                       "ipmi_msghandler: allocate link to BMC: %d\n",
-                       rv);
-                goto out_err;
-        }
-
-        rv = sysfs_create_link(&intf->si_dev->kobj,
-                               &bmc->dev->dev.kobj, intf->sysfs_name);
+        rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
         if (rv) {
-                kfree(intf->sysfs_name);
-                intf->sysfs_name = NULL;
                 printk(KERN_ERR
                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
                        rv);
                 goto out_err;
         }
 
-        size = snprintf(dummy, 0, "ipmi%d", ifnum);
-        intf->my_dev_name = kmalloc(size+1, GFP_KERNEL);
+        intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", ifnum);
         if (!intf->my_dev_name) {
-                kfree(intf->sysfs_name);
-                intf->sysfs_name = NULL;
                 rv = -ENOMEM;
                 printk(KERN_ERR
                        "ipmi_msghandler: allocate link from BMC: %d\n",
                        rv);
                 goto out_err;
         }
-        snprintf(intf->my_dev_name, size+1, "ipmi%d", ifnum);
 
-        rv = sysfs_create_link(&bmc->dev->dev.kobj, &intf->si_dev->kobj,
+        rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
                                intf->my_dev_name);
         if (rv) {
-                kfree(intf->sysfs_name);
-                intf->sysfs_name = NULL;
                 kfree(intf->my_dev_name);
                 intf->my_dev_name = NULL;
                 printk(KERN_ERR
@@ -2850,7 +2772,6 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                       void                     *send_info,
                       struct ipmi_device_id    *device_id,
                       struct device            *si_dev,
-                      const char               *sysfs_name,
                       unsigned char            slave_addr)
 {
         int              i, j;
@@ -2909,12 +2830,15 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
 #ifdef CONFIG_PROC_FS
         mutex_init(&intf->proc_entry_lock);
 #endif
-        spin_lock_init(&intf->waiting_msgs_lock);
-        INIT_LIST_HEAD(&intf->waiting_msgs);
+        spin_lock_init(&intf->waiting_rcv_msgs_lock);
+        INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
         tasklet_init(&intf->recv_tasklet,
                      smi_recv_tasklet,
                      (unsigned long) intf);
         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
+        spin_lock_init(&intf->xmit_msgs_lock);
+        INIT_LIST_HEAD(&intf->xmit_msgs);
+        INIT_LIST_HEAD(&intf->hp_xmit_msgs);
         spin_lock_init(&intf->events_lock);
         atomic_set(&intf->event_waiters, 0);
         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
@@ -2984,7 +2908,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
         if (rv == 0)
                 rv = add_proc_entries(intf, i);
 
-        rv = ipmi_bmc_register(intf, i, sysfs_name);
+        rv = ipmi_bmc_register(intf, i);
 
  out:
         if (rv) {
@@ -3014,12 +2938,50 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
 }
 EXPORT_SYMBOL(ipmi_register_smi);
 
+static void deliver_smi_err_response(ipmi_smi_t intf,
+                                     struct ipmi_smi_msg *msg,
+                                     unsigned char err)
+{
+        msg->rsp[0] = msg->data[0] | 4;
+        msg->rsp[1] = msg->data[1];
+        msg->rsp[2] = err;
+        msg->rsp_size = 3;
+        /* It's an error, so it will never requeue, no need to check return. */
+        handle_one_recv_msg(intf, msg);
+}
+
 static void cleanup_smi_msgs(ipmi_smi_t intf)
 {
         int              i;
         struct seq_table *ent;
+        struct ipmi_smi_msg *msg;
+        struct list_head *entry;
+        struct list_head tmplist;
+
+        /* Clear out our transmit queues and hold the messages. */
+        INIT_LIST_HEAD(&tmplist);
+        list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
+        list_splice_tail(&intf->xmit_msgs, &tmplist);
+
+        /* Current message first, to preserve order */
+        while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
+                /* Wait for the message to clear out. */
+                schedule_timeout(1);
+        }
 
         /* No need for locks, the interface is down. */
+
+        /*
+         * Return errors for all pending messages in queue and in the
+         * tables waiting for remote responses.
+         */
+        while (!list_empty(&tmplist)) {
+                entry = tmplist.next;
+                list_del(entry);
+                msg = list_entry(entry, struct ipmi_smi_msg, link);
+                deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
+        }
+
         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
                 ent = &(intf->seq_table[i]);
                 if (!ent->inuse)
@@ -3031,20 +2993,33 @@ static void cleanup_smi_msgs(ipmi_smi_t intf)
 int ipmi_unregister_smi(ipmi_smi_t intf)
 {
         struct ipmi_smi_watcher *w;
-        int    intf_num = intf->intf_num;
+        int intf_num = intf->intf_num;
+        ipmi_user_t user;
 
         ipmi_bmc_unregister(intf);
 
         mutex_lock(&smi_watchers_mutex);
         mutex_lock(&ipmi_interfaces_mutex);
         intf->intf_num = -1;
-        intf->handlers = NULL;
+        intf->in_shutdown = true;
         list_del_rcu(&intf->link);
         mutex_unlock(&ipmi_interfaces_mutex);
         synchronize_rcu();
 
         cleanup_smi_msgs(intf);
 
+        /* Clean up the effects of users on the lower-level software. */
+        mutex_lock(&ipmi_interfaces_mutex);
+        rcu_read_lock();
+        list_for_each_entry_rcu(user, &intf->users, link) {
+                module_put(intf->handlers->owner);
+                if (intf->handlers->dec_usecount)
+                        intf->handlers->dec_usecount(intf->send_info);
+        }
+        rcu_read_unlock();
+        intf->handlers = NULL;
+        mutex_unlock(&ipmi_interfaces_mutex);
+
         remove_proc_entries(intf);
 
         /*
@@ -3134,7 +3109,6 @@ static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
         ipmi_user_t              user = NULL;
         struct ipmi_ipmb_addr    *ipmb_addr;
         struct ipmi_recv_msg     *recv_msg;
-        struct ipmi_smi_handlers *handlers;
 
         if (msg->rsp_size < 10) {
                 /* Message not big enough, just ignore it. */
@@ -3188,9 +3162,8 @@ static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
         }
 #endif
                 rcu_read_lock();
-                handlers = intf->handlers;
-                if (handlers) {
-                        handlers->sender(intf->send_info, msg, 0);
+                if (!intf->in_shutdown) {
+                        smi_send(intf, intf->handlers, msg, 0);
                         /*
                          * We used the message, so return the value
                          * that causes it to not be freed or
@@ -3857,32 +3830,32 @@ static void handle_new_recv_msgs(ipmi_smi_t intf)
 
         /* See if any waiting messages need to be processed. */
         if (!run_to_completion)
-                spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
-        while (!list_empty(&intf->waiting_msgs)) {
-                smi_msg = list_entry(intf->waiting_msgs.next,
+                spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
+        while (!list_empty(&intf->waiting_rcv_msgs)) {
+                smi_msg = list_entry(intf->waiting_rcv_msgs.next,
                                      struct ipmi_smi_msg, link);
-                list_del(&smi_msg->link);
                 if (!run_to_completion)
-                        spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
+                        spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
+                                               flags);
                 rv = handle_one_recv_msg(intf, smi_msg);
                 if (!run_to_completion)
-                        spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
-                if (rv == 0) {
-                        /* Message handled */
-                        ipmi_free_smi_msg(smi_msg);
-                } else if (rv < 0) {
-                        /* Fatal error on the message, del but don't free. */
-                } else {
+                        spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
+                if (rv > 0) {
                         /*
                          * To preserve message order, quit if we
                          * can't handle a message.
                          */
-                        list_add(&smi_msg->link, &intf->waiting_msgs);
                         break;
+                } else {
+                        list_del(&smi_msg->link);
+                        if (rv == 0)
+                                /* Message handled */
+                                ipmi_free_smi_msg(smi_msg);
+                        /* If rv < 0, fatal error, del but don't free. */
                 }
         }
         if (!run_to_completion)
-                spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
+                spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
 
         /*
          * If the pretimout count is non-zero, decrement one from it and
@@ -3903,7 +3876,41 @@ static void handle_new_recv_msgs(ipmi_smi_t intf)
 
 static void smi_recv_tasklet(unsigned long val)
 {
-        handle_new_recv_msgs((ipmi_smi_t) val);
+        unsigned long flags = 0; /* keep us warning-free. */
+        ipmi_smi_t intf = (ipmi_smi_t) val;
+        int run_to_completion = intf->run_to_completion;
+        struct ipmi_smi_msg *newmsg = NULL;
+
+        /*
+         * Start the next message if available.
+         *
+         * Do this here, not in the actual receiver, because we may deadlock
+         * because the lower layer is allowed to hold locks while calling
+         * message delivery.
+         */
+        if (!run_to_completion)
+                spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+        if (intf->curr_msg == NULL && !intf->in_shutdown) {
+                struct list_head *entry = NULL;
+
+                /* Pick the high priority queue first. */
+                if (!list_empty(&intf->hp_xmit_msgs))
+                        entry = intf->hp_xmit_msgs.next;
+                else if (!list_empty(&intf->xmit_msgs))
+                        entry = intf->xmit_msgs.next;
+
+                if (entry) {
+                        list_del(entry);
+                        newmsg = list_entry(entry, struct ipmi_smi_msg, link);
+                        intf->curr_msg = newmsg;
+                }
+        }
+        if (!run_to_completion)
+                spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+        if (newmsg)
+                intf->handlers->sender(intf->send_info, newmsg);
+
+        handle_new_recv_msgs(intf);
 }
 
 /* Handle a new message from the lower layer. */
@@ -3911,13 +3918,16 @@ void ipmi_smi_msg_received(ipmi_smi_t          intf,
                            struct ipmi_smi_msg *msg)
 {
         unsigned long flags = 0; /* keep us warning-free. */
-        int           run_to_completion;
-
+        int run_to_completion = intf->run_to_completion;
 
         if ((msg->data_size >= 2)
             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
             && (msg->data[1] == IPMI_SEND_MSG_CMD)
             && (msg->user_data == NULL)) {
+
+                if (intf->in_shutdown)
+                        goto free_msg;
+
                 /*
                  * This is the local response to a command send, start
                  * the timer for these.  The user_data will not be
@@ -3953,29 +3963,40 @@ void ipmi_smi_msg_received(ipmi_smi_t          intf,
                         /* The message was sent, start the timer. */
                         intf_start_seq_timer(intf, msg->msgid);
 
+free_msg:
                 ipmi_free_smi_msg(msg);
-                goto out;
+        } else {
+                /*
+                 * To preserve message order, we keep a queue and deliver from
+                 * a tasklet.
+                 */
+                if (!run_to_completion)
+                        spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
+                list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
+                if (!run_to_completion)
+                        spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
+                                               flags);
         }
 
-        /*
-         * To preserve message order, if the list is not empty, we
-         * tack this message onto the end of the list.
-         */
-        run_to_completion = intf->run_to_completion;
         if (!run_to_completion)
-                spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
-        list_add_tail(&msg->link, &intf->waiting_msgs);
+                spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+        if (msg == intf->curr_msg)
+                intf->curr_msg = NULL;
         if (!run_to_completion)
-                spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
+                spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
 
-        tasklet_schedule(&intf->recv_tasklet);
- out:
-        return;
+        if (run_to_completion)
+                smi_recv_tasklet((unsigned long) intf);
+        else
+                tasklet_schedule(&intf->recv_tasklet);
 }
 EXPORT_SYMBOL(ipmi_smi_msg_received);
 
 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
 {
+        if (intf->in_shutdown)
+                return;
+
         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
         tasklet_schedule(&intf->recv_tasklet);
 }
@@ -4017,7 +4038,7 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
         struct ipmi_recv_msg     *msg;
         struct ipmi_smi_handlers *handlers;
 
-        if (intf->intf_num == -1)
+        if (intf->in_shutdown)
                 return;
 
         if (!ent->inuse)
@@ -4082,8 +4103,7 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                                 ipmi_inc_stat(intf,
                                               retransmitted_ipmb_commands);
 
-                        intf->handlers->sender(intf->send_info,
-                                               smi_msg, 0);
+                        smi_send(intf, intf->handlers, smi_msg, 0);
                 } else
                         ipmi_free_smi_msg(smi_msg);
 
@@ -4145,15 +4165,12 @@ static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)
 
 static void ipmi_request_event(ipmi_smi_t intf)
 {
-        struct ipmi_smi_handlers *handlers;
-
         /* No event requests when in maintenance mode. */
         if (intf->maintenance_mode_enable)
                 return;
 
-        handlers = intf->handlers;
-        if (handlers)
-                handlers->request_events(intf->send_info);
+        if (!intf->in_shutdown)
+                intf->handlers->request_events(intf->send_info);
 }
 
 static struct timer_list ipmi_timer;
@@ -4548,6 +4565,7 @@ static int ipmi_init_msghandler(void)
         proc_ipmi_root = proc_mkdir("ipmi", NULL);
         if (!proc_ipmi_root) {
             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
+            driver_unregister(&ipmidriver.driver);
             return -ENOMEM;
         }
 
diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c
new file mode 100644
index 000000000000..79524ed2a3cb
--- /dev/null
+++ b/drivers/char/ipmi/ipmi_powernv.c
@@ -0,0 +1,310 @@
+/*
+ * PowerNV OPAL IPMI driver
+ *
+ * Copyright 2014 IBM Corp.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#define pr_fmt(fmt)        "ipmi-powernv: " fmt
+
+#include <linux/ipmi_smi.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/of.h>
+
+#include <asm/opal.h>
+
+
+struct ipmi_smi_powernv {
+        u64                     interface_id;
+        struct ipmi_device_id   ipmi_id;
+        ipmi_smi_t              intf;
+        u64                     event;
+        struct notifier_block   event_nb;
+
+        /**
+         * We assume that there can only be one outstanding request, so
+         * keep the pending message in cur_msg. We protect this from concurrent
+         * updates through send & recv calls, (and consequently opal_msg, which
+         * is in-use when cur_msg is set) with msg_lock
+         */
+        spinlock_t              msg_lock;
+        struct ipmi_smi_msg     *cur_msg;
+        struct opal_ipmi_msg    *opal_msg;
+};
+
+static int ipmi_powernv_start_processing(void *send_info, ipmi_smi_t intf)
+{
+        struct ipmi_smi_powernv *smi = send_info;
+
+        smi->intf = intf;
+        return 0;
+}
+
+static void send_error_reply(struct ipmi_smi_powernv *smi,
+                struct ipmi_smi_msg *msg, u8 completion_code)
+{
+        msg->rsp[0] = msg->data[0] | 0x4;
+        msg->rsp[1] = msg->data[1];
+        msg->rsp[2] = completion_code;
+        msg->rsp_size = 3;
+        ipmi_smi_msg_received(smi->intf, msg);
+}
+
+static void ipmi_powernv_send(void *send_info, struct ipmi_smi_msg *msg)
+{
+        struct ipmi_smi_powernv *smi = send_info;
+        struct opal_ipmi_msg *opal_msg;
+        unsigned long flags;
+        int comp, rc;
+        size_t size;
+
+        /* ensure data_len will fit in the opal_ipmi_msg buffer... */
+        if (msg->data_size > IPMI_MAX_MSG_LENGTH) {
+                comp = IPMI_REQ_LEN_EXCEEDED_ERR;
+                goto err;
+        }
+
+        /* ... and that we at least have netfn and cmd bytes */
+        if (msg->data_size < 2) {
+                comp = IPMI_REQ_LEN_INVALID_ERR;
+                goto err;
+        }
+
+        spin_lock_irqsave(&smi->msg_lock, flags);
+
+        if (smi->cur_msg) {
+                comp = IPMI_NODE_BUSY_ERR;
+                goto err_unlock;
+        }
+
+        /* format our data for the OPAL API */
+        opal_msg = smi->opal_msg;
+        opal_msg->version = OPAL_IPMI_MSG_FORMAT_VERSION_1;
+        opal_msg->netfn = msg->data[0];
+        opal_msg->cmd = msg->data[1];
+        if (msg->data_size > 2)
+                memcpy(opal_msg->data, msg->data + 2, msg->data_size - 2);
+
+        /* data_size already includes the netfn and cmd bytes */
+        size = sizeof(*opal_msg) + msg->data_size - 2;
+
+        pr_devel("%s: opal_ipmi_send(0x%llx, %p, %ld)\n", __func__,
+                        smi->interface_id, opal_msg, size);
+        rc = opal_ipmi_send(smi->interface_id, opal_msg, size);
+        pr_devel("%s:  -> %d\n", __func__, rc);
+
+        if (!rc) {
+                smi->cur_msg = msg;
+                spin_unlock_irqrestore(&smi->msg_lock, flags);
+                return;
+        }
+
+        comp = IPMI_ERR_UNSPECIFIED;
+err_unlock:
+        spin_unlock_irqrestore(&smi->msg_lock, flags);
+err:
+        send_error_reply(smi, msg, comp);
+}
+
+static int ipmi_powernv_recv(struct ipmi_smi_powernv *smi)
+{
+        struct opal_ipmi_msg *opal_msg;
+        struct ipmi_smi_msg *msg;
+        unsigned long flags;
+        uint64_t size;
+        int rc;
+
+        pr_devel("%s: opal_ipmi_recv(%llx, msg, sz)\n", __func__,
+                        smi->interface_id);
+
+        spin_lock_irqsave(&smi->msg_lock, flags);
+
+        if (!smi->cur_msg) {
+                pr_warn("no current message?\n");
+                return 0;
+        }
+
+        msg = smi->cur_msg;
+        opal_msg = smi->opal_msg;
+
+        size = cpu_to_be64(sizeof(*opal_msg) + IPMI_MAX_MSG_LENGTH);
+
+        rc = opal_ipmi_recv(smi->interface_id,
+                        opal_msg,
+                        &size);
+        size = be64_to_cpu(size);
+        pr_devel("%s:   -> %d (size %lld)\n", __func__,
+                        rc, rc == 0 ? size : 0);
+        if (rc) {
+                spin_unlock_irqrestore(&smi->msg_lock, flags);
+                ipmi_free_smi_msg(msg);
+                return 0;
+        }
+
+        if (size < sizeof(*opal_msg)) {
+                spin_unlock_irqrestore(&smi->msg_lock, flags);
+                pr_warn("unexpected IPMI message size %lld\n", size);
+                return 0;
+        }
+
+        if (opal_msg->version != OPAL_IPMI_MSG_FORMAT_VERSION_1) {
+                spin_unlock_irqrestore(&smi->msg_lock, flags);
+                pr_warn("unexpected IPMI message format (version %d)\n",
+                                opal_msg->version);
+                return 0;
+        }
+
+        msg->rsp[0] = opal_msg->netfn;
+        msg->rsp[1] = opal_msg->cmd;
+        if (size > sizeof(*opal_msg))
+                memcpy(&msg->rsp[2], opal_msg->data, size - sizeof(*opal_msg));
+        msg->rsp_size = 2 + size - sizeof(*opal_msg);
+
+        smi->cur_msg = NULL;
+        spin_unlock_irqrestore(&smi->msg_lock, flags);
+        ipmi_smi_msg_received(smi->intf, msg);
+        return 0;
+}
+
+static void ipmi_powernv_request_events(void *send_info)
+{
+}
+
+static void ipmi_powernv_set_run_to_completion(void *send_info,
+                bool run_to_completion)
+{
+}
+
+static void ipmi_powernv_poll(void *send_info)
+{
+        struct ipmi_smi_powernv *smi = send_info;
+
+        ipmi_powernv_recv(smi);
+}
+
+static struct ipmi_smi_handlers ipmi_powernv_smi_handlers = {
+        .owner                  = THIS_MODULE,
+        .start_processing       = ipmi_powernv_start_processing,
+        .sender                 = ipmi_powernv_send,
+        .request_events         = ipmi_powernv_request_events,
+        .set_run_to_completion  = ipmi_powernv_set_run_to_completion,
+        .poll                   = ipmi_powernv_poll,
+};
+
+static int ipmi_opal_event(struct notifier_block *nb,
+                          unsigned long events, void *change)
+{
+        struct ipmi_smi_powernv *smi = container_of(nb,
+                                        struct ipmi_smi_powernv, event_nb);
+
+        if (events & smi->event)
+                ipmi_powernv_recv(smi);
+        return 0;
+}
+
+static int ipmi_powernv_probe(struct platform_device *pdev)
+{
+        struct ipmi_smi_powernv *ipmi;
+        struct device *dev;
+        u32 prop;
+        int rc;
+
+        if (!pdev || !pdev->dev.of_node)
+                return -ENODEV;
+
+        dev = &pdev->dev;
+
+        ipmi = devm_kzalloc(dev, sizeof(*ipmi), GFP_KERNEL);
+        if (!ipmi)
+                return -ENOMEM;
+
+        spin_lock_init(&ipmi->msg_lock);
+
+        rc = of_property_read_u32(dev->of_node, "ibm,ipmi-interface-id",
+                        &prop);
+        if (rc) {
+                dev_warn(dev, "No interface ID property\n");
+                goto err_free;
+        }
+        ipmi->interface_id = prop;
+
+        rc = of_property_read_u32(dev->of_node, "interrupts", &prop);
+        if (rc) {
+                dev_warn(dev, "No interrupts property\n");
+                goto err_free;
+        }
+
+        ipmi->event = 1ull << prop;
+        ipmi->event_nb.notifier_call = ipmi_opal_event;
+
+        rc = opal_notifier_register(&ipmi->event_nb);
+        if (rc) {
+                dev_warn(dev, "OPAL notifier registration failed (%d)\n", rc);
+                goto err_free;
+        }
+
+        ipmi->opal_msg = devm_kmalloc(dev,
+                        sizeof(*ipmi->opal_msg) + IPMI_MAX_MSG_LENGTH,
+                        GFP_KERNEL);
+        if (!ipmi->opal_msg) {
+                rc = -ENOMEM;
+                goto err_unregister;
+        }
+
+        /* todo: query actual ipmi_device_id */
+        rc = ipmi_register_smi(&ipmi_powernv_smi_handlers, ipmi,
+                        &ipmi->ipmi_id, dev, 0);
+        if (rc) {
+                dev_warn(dev, "IPMI SMI registration failed (%d)\n", rc);
+                goto err_free_msg;
+        }
+
+        dev_set_drvdata(dev, ipmi);
+        return 0;
+
+err_free_msg:
+        devm_kfree(dev, ipmi->opal_msg);
+err_unregister:
+        opal_notifier_unregister(&ipmi->event_nb);
+err_free:
+        devm_kfree(dev, ipmi);
+        return rc;
+}
+
+static int ipmi_powernv_remove(struct platform_device *pdev)
+{
+        struct ipmi_smi_powernv *smi = dev_get_drvdata(&pdev->dev);
+
+        ipmi_unregister_smi(smi->intf);
+        opal_notifier_unregister(&smi->event_nb);
+        return 0;
+}
+
+static const struct of_device_id ipmi_powernv_match[] = {
+        { .compatible = "ibm,opal-ipmi" },
+        { },
+};
+
+
+static struct platform_driver powernv_ipmi_driver = {
+        .driver = {
+                .name           = "ipmi-powernv",
+                .owner          = THIS_MODULE,
+                .of_match_table = ipmi_powernv_match,
+        },
+        .probe  = ipmi_powernv_probe,
+        .remove = ipmi_powernv_remove,
+};
+
+
+module_platform_driver(powernv_ipmi_driver);
+
+MODULE_DEVICE_TABLE(of, ipmi_powernv_match);
+MODULE_DESCRIPTION("powernv IPMI driver");
+MODULE_AUTHOR("Jeremy Kerr <jk@ozlabs.org>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 5c4e1f625bbb..90c7fdf95419 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -92,12 +92,9 @@ enum si_intf_state {
         SI_GETTING_FLAGS,
         SI_GETTING_EVENTS,
         SI_CLEARING_FLAGS,
-        SI_CLEARING_FLAGS_THEN_SET_IRQ,
         SI_GETTING_MESSAGES,
-        SI_ENABLE_INTERRUPTS1,
-        SI_ENABLE_INTERRUPTS2,
-        SI_DISABLE_INTERRUPTS1,
-        SI_DISABLE_INTERRUPTS2
+        SI_CHECKING_ENABLES,
+        SI_SETTING_ENABLES
         /* FIXME - add watchdog stuff. */
 };
 
@@ -111,10 +108,6 @@ enum si_type {
 };
 static char *si_to_str[] = { "kcs", "smic", "bt" };
 
-static char *ipmi_addr_src_to_str[] = { NULL, "hotmod", "hardcoded", "SPMI",
-                                        "ACPI", "SMBIOS", "PCI",
-                                        "device-tree", "default" };
-
 #define DEVICE_NAME "ipmi_si"
 
 static struct platform_driver ipmi_driver;
@@ -174,8 +167,7 @@ struct smi_info {
         struct si_sm_handlers  *handlers;
         enum si_type           si_type;
         spinlock_t             si_lock;
-        struct list_head       xmit_msgs;
-        struct list_head       hp_xmit_msgs;
+        struct ipmi_smi_msg    *waiting_msg;
         struct ipmi_smi_msg    *curr_msg;
         enum si_intf_state     si_state;
 
@@ -254,9 +246,6 @@ struct smi_info {
         /* The time (in jiffies) the last timeout occurred at. */
         unsigned long       last_timeout_jiffies;
 
-        /* Used to gracefully stop the timer without race conditions. */
-        atomic_t            stop_operation;
-
         /* Are we waiting for the events, pretimeouts, received msgs? */
         atomic_t            need_watch;
 
@@ -268,6 +257,16 @@ struct smi_info {
          */
         bool interrupt_disabled;
 
+        /*
+         * Does the BMC support events?
+         */
+        bool supports_event_msg_buff;
+
+        /*
+         * Did we get an attention that we did not handle?
+         */
+        bool got_attn;
+
         /* From the get device id response... */
         struct ipmi_device_id device_id;
 
@@ -332,7 +331,10 @@ static void deliver_recv_msg(struct smi_info *smi_info,
                              struct ipmi_smi_msg *msg)
 {
         /* Deliver the message to the upper layer. */
-        ipmi_smi_msg_received(smi_info->intf, msg);
+        if (smi_info->intf)
+                ipmi_smi_msg_received(smi_info->intf, msg);
+        else
+                ipmi_free_smi_msg(msg);
 }
 
 static void return_hosed_msg(struct smi_info *smi_info, int cCode)
@@ -356,28 +358,18 @@ static void return_hosed_msg(struct smi_info *smi_info, int cCode)
 static enum si_sm_result start_next_msg(struct smi_info *smi_info)
 {
         int              rv;
-        struct list_head *entry = NULL;
 #ifdef DEBUG_TIMING
         struct timeval t;
 #endif
 
-        /* Pick the high priority queue first. */
-        if (!list_empty(&(smi_info->hp_xmit_msgs))) {
-                entry = smi_info->hp_xmit_msgs.next;
-        } else if (!list_empty(&(smi_info->xmit_msgs))) {
-                entry = smi_info->xmit_msgs.next;
-        }
-
-        if (!entry) {
+        if (!smi_info->waiting_msg) {
                 smi_info->curr_msg = NULL;
                 rv = SI_SM_IDLE;
         } else {
                 int err;
 
-                list_del(entry);
-                smi_info->curr_msg = list_entry(entry,
-                                                struct ipmi_smi_msg,
-                                                link);
+                smi_info->curr_msg = smi_info->waiting_msg;
+                smi_info->waiting_msg = NULL;
 #ifdef DEBUG_TIMING
                 do_gettimeofday(&t);
                 printk(KERN_DEBUG "**Start2: %d.%9.9d\n", t.tv_sec, t.tv_usec);
@@ -401,30 +393,15 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info)
         return rv;
 }
 
-static void start_enable_irq(struct smi_info *smi_info)
+static void start_check_enables(struct smi_info *smi_info)
 {
         unsigned char msg[2];
 
-        /*
-         * If we are enabling interrupts, we have to tell the
-         * BMC to use them.
-         */
         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
         msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
 
         smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
-        smi_info->si_state = SI_ENABLE_INTERRUPTS1;
-}
-
-static void start_disable_irq(struct smi_info *smi_info)
-{
-        unsigned char msg[2];
-
-        msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
-        msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
-
-        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
-        smi_info->si_state = SI_DISABLE_INTERRUPTS1;
+        smi_info->si_state = SI_CHECKING_ENABLES;
 }
 
 static void start_clear_flags(struct smi_info *smi_info)
@@ -440,6 +417,32 @@ static void start_clear_flags(struct smi_info *smi_info)
         smi_info->si_state = SI_CLEARING_FLAGS;
 }
 
+static void start_getting_msg_queue(struct smi_info *smi_info)
+{
+        smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
+        smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD;
+        smi_info->curr_msg->data_size = 2;
+
+        smi_info->handlers->start_transaction(
+                smi_info->si_sm,
+                smi_info->curr_msg->data,
+                smi_info->curr_msg->data_size);
+        smi_info->si_state = SI_GETTING_MESSAGES;
+}
+
+static void start_getting_events(struct smi_info *smi_info)
+{
+        smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
+        smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
+        smi_info->curr_msg->data_size = 2;
+
+        smi_info->handlers->start_transaction(
+                smi_info->si_sm,
+                smi_info->curr_msg->data,
+                smi_info->curr_msg->data_size);
+        smi_info->si_state = SI_GETTING_EVENTS;
+}
+
 static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 {
         smi_info->last_timeout_jiffies = jiffies;
@@ -453,22 +456,45 @@ static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
  * polled until we can allocate some memory.  Once we have some
  * memory, we will re-enable the interrupt.
  */
-static inline void disable_si_irq(struct smi_info *smi_info)
+static inline bool disable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
-                start_disable_irq(smi_info);
                 smi_info->interrupt_disabled = true;
-                if (!atomic_read(&smi_info->stop_operation))
-                        smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+                start_check_enables(smi_info);
+                return true;
         }
+        return false;
 }
 
-static inline void enable_si_irq(struct smi_info *smi_info)
+static inline bool enable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
-                start_enable_irq(smi_info);
                 smi_info->interrupt_disabled = false;
+                start_check_enables(smi_info);
+                return true;
         }
+        return false;
+}
+
+/*
+ * Allocate a message.  If unable to allocate, start the interrupt
+ * disable process and return NULL.  If able to allocate but
+ * interrupts are disabled, free the message and return NULL after
+ * starting the interrupt enable process.
+ */
+static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
+{
+        struct ipmi_smi_msg *msg;
+
+        msg = ipmi_alloc_smi_msg();
+        if (!msg) {
+                if (!disable_si_irq(smi_info))
+                        smi_info->si_state = SI_NORMAL;
+        } else if (enable_si_irq(smi_info)) {
+                ipmi_free_smi_msg(msg);
+                msg = NULL;
+        }
+        return msg;
 }
 
 static void handle_flags(struct smi_info *smi_info)
@@ -480,45 +506,22 @@ static void handle_flags(struct smi_info *smi_info)
 
                 start_clear_flags(smi_info);
                 smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
-                ipmi_smi_watchdog_pretimeout(smi_info->intf);
+                if (smi_info->intf)
+                        ipmi_smi_watchdog_pretimeout(smi_info->intf);
         } else if (smi_info->msg_flags & RECEIVE_MSG_AVAIL) {
                 /* Messages available. */
-                smi_info->curr_msg = ipmi_alloc_smi_msg();
-                if (!smi_info->curr_msg) {
-                        disable_si_irq(smi_info);
-                        smi_info->si_state = SI_NORMAL;
+                smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
+                if (!smi_info->curr_msg)
                         return;
-                }
-                enable_si_irq(smi_info);
-
-                smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
-                smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD;
-                smi_info->curr_msg->data_size = 2;
 
-                smi_info->handlers->start_transaction(
-                        smi_info->si_sm,
-                        smi_info->curr_msg->data,
-                        smi_info->curr_msg->data_size);
-                smi_info->si_state = SI_GETTING_MESSAGES;
+                start_getting_msg_queue(smi_info);
         } else if (smi_info->msg_flags & EVENT_MSG_BUFFER_FULL) {
                 /* Events available. */
-                smi_info->curr_msg = ipmi_alloc_smi_msg();
-                if (!smi_info->curr_msg) {
-                        disable_si_irq(smi_info);
-                        smi_info->si_state = SI_NORMAL;
+                smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
+                if (!smi_info->curr_msg)
                         return;
-                }
-                enable_si_irq(smi_info);
-
-                smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
-                smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
-                smi_info->curr_msg->data_size = 2;
 
-                smi_info->handlers->start_transaction(
-                        smi_info->si_sm,
-                        smi_info->curr_msg->data,
-                        smi_info->curr_msg->data_size);
-                smi_info->si_state = SI_GETTING_EVENTS;
+                start_getting_events(smi_info);
         } else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
                    smi_info->oem_data_avail_handler) {
                 if (smi_info->oem_data_avail_handler(smi_info))
@@ -527,6 +530,55 @@ static void handle_flags(struct smi_info *smi_info)
                 smi_info->si_state = SI_NORMAL;
 }
 
+/*
+ * Global enables we care about.
+ */
+#define GLOBAL_ENABLES_MASK (IPMI_BMC_EVT_MSG_BUFF | IPMI_BMC_RCV_MSG_INTR | \
+                             IPMI_BMC_EVT_MSG_INTR)
+
+static u8 current_global_enables(struct smi_info *smi_info, u8 base,
+                                 bool *irq_on)
+{
+        u8 enables = 0;
+
+        if (smi_info->supports_event_msg_buff)
+                enables |= IPMI_BMC_EVT_MSG_BUFF;
+        else
+                enables &= ~IPMI_BMC_EVT_MSG_BUFF;
+
+        if (smi_info->irq && !smi_info->interrupt_disabled)
+                enables |= IPMI_BMC_RCV_MSG_INTR;
+        else
+                enables &= ~IPMI_BMC_RCV_MSG_INTR;
+
+        if (smi_info->supports_event_msg_buff &&
+            smi_info->irq && !smi_info->interrupt_disabled)
+
+                enables |= IPMI_BMC_EVT_MSG_INTR;
+        else
+                enables &= ~IPMI_BMC_EVT_MSG_INTR;
+
+        *irq_on = enables & (IPMI_BMC_EVT_MSG_INTR | IPMI_BMC_RCV_MSG_INTR);
+
+        return enables;
+}
+
+static void check_bt_irq(struct smi_info *smi_info, bool irq_on)
+{
+        u8 irqstate = smi_info->io.inputb(&smi_info->io, IPMI_BT_INTMASK_REG);
+
+        irqstate &= IPMI_BT_INTMASK_ENABLE_IRQ_BIT;
+
+        if ((bool)irqstate == irq_on)
+                return;
+
+        if (irq_on)
+                smi_info->io.outputb(&smi_info->io, IPMI_BT_INTMASK_REG,
+                                     IPMI_BT_INTMASK_ENABLE_IRQ_BIT);
+        else
+                smi_info->io.outputb(&smi_info->io, IPMI_BT_INTMASK_REG, 0);
+}
+
 static void handle_transaction_done(struct smi_info *smi_info)
 {
         struct ipmi_smi_msg *msg;
@@ -581,7 +633,6 @@ static void handle_transaction_done(struct smi_info *smi_info)
         }
 
         case SI_CLEARING_FLAGS:
-        case SI_CLEARING_FLAGS_THEN_SET_IRQ:
         {
                 unsigned char msg[3];
 
@@ -592,10 +643,7 @@ static void handle_transaction_done(struct smi_info *smi_info)
                         dev_warn(smi_info->dev,
                                  "Error clearing flags: %2.2x\n", msg[2]);
                 }
-                if (smi_info->si_state == SI_CLEARING_FLAGS_THEN_SET_IRQ)
-                        start_enable_irq(smi_info);
-                else
-                        smi_info->si_state = SI_NORMAL;
+                smi_info->si_state = SI_NORMAL;
                 break;
         }
 
@@ -675,9 +723,11 @@ static void handle_transaction_done(struct smi_info *smi_info)
                 break;
         }
 
-        case SI_ENABLE_INTERRUPTS1:
+        case SI_CHECKING_ENABLES:
         {
                 unsigned char msg[4];
+                u8 enables;
+                bool irq_on;
 
                 /* We got the flags from the SMI, now handle them. */
                 smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
@@ -687,70 +737,53 @@ static void handle_transaction_done(struct smi_info *smi_info)
                         dev_warn(smi_info->dev,
                                  "Maybe ok, but ipmi might run very slowly.\n");
                         smi_info->si_state = SI_NORMAL;
-                } else {
+                        break;
+                }
+                enables = current_global_enables(smi_info, 0, &irq_on);
+                if (smi_info->si_type == SI_BT)
+                        /* BT has its own interrupt enable bit. */
+                        check_bt_irq(smi_info, irq_on);
+                if (enables != (msg[3] & GLOBAL_ENABLES_MASK)) {
+                        /* Enables are not correct, fix them. */
                         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
                         msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
-                        msg[2] = (msg[3] |
-                                  IPMI_BMC_RCV_MSG_INTR |
-                                  IPMI_BMC_EVT_MSG_INTR);
+                        msg[2] = enables | (msg[3] & ~GLOBAL_ENABLES_MASK);
                         smi_info->handlers->start_transaction(
                                 smi_info->si_sm, msg, 3);
-                        smi_info->si_state = SI_ENABLE_INTERRUPTS2;
+                        smi_info->si_state = SI_SETTING_ENABLES;
+                } else if (smi_info->supports_event_msg_buff) {
+                        smi_info->curr_msg = ipmi_alloc_smi_msg();
+                        if (!smi_info->curr_msg) {
+                                smi_info->si_state = SI_NORMAL;
+                                break;
+                        }
+                        start_getting_msg_queue(smi_info);
+                } else {
+                        smi_info->si_state = SI_NORMAL;
                 }
                 break;
         }
 
-        case SI_ENABLE_INTERRUPTS2:
+        case SI_SETTING_ENABLES:
         {
                 unsigned char msg[4];
 
-                /* We got the flags from the SMI, now handle them. */
                 smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
-                if (msg[2] != 0) {
+                if (msg[2] != 0)
                         dev_warn(smi_info->dev,
-                                 "Couldn't set irq info: %x.\n", msg[2]);
-                        dev_warn(smi_info->dev,
-                                 "Maybe ok, but ipmi might run very slowly.\n");
-                } else
-                        smi_info->interrupt_disabled = false;
-                smi_info->si_state = SI_NORMAL;
-                break;
-        }
-
-        case SI_DISABLE_INTERRUPTS1:
-        {
-                unsigned char msg[4];
+                                 "Could not set the global enables: 0x%x.\n",
+                                 msg[2]);
 
-                /* We got the flags from the SMI, now handle them. */
-                smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
-                if (msg[2] != 0) {
-                        dev_warn(smi_info->dev, "Could not disable interrupts"
-                                 ", failed get.\n");
-                        smi_info->si_state = SI_NORMAL;
+                if (smi_info->supports_event_msg_buff) {
+                        smi_info->curr_msg = ipmi_alloc_smi_msg();
+                        if (!smi_info->curr_msg) {
+                                smi_info->si_state = SI_NORMAL;
+                                break;
+                        }
+                        start_getting_msg_queue(smi_info);
                 } else {
-                        msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
-                        msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
-                        msg[2] = (msg[3] &
-                                  ~(IPMI_BMC_RCV_MSG_INTR |
-                                    IPMI_BMC_EVT_MSG_INTR));
-                        smi_info->handlers->start_transaction(
-                                smi_info->si_sm, msg, 3);
-                        smi_info->si_state = SI_DISABLE_INTERRUPTS2;
-                }
-                break;
-        }
-
-        case SI_DISABLE_INTERRUPTS2:
-        {
-                unsigned char msg[4];
-
-                /* We got the flags from the SMI, now handle them. */
-                smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
-                if (msg[2] != 0) {
-                        dev_warn(smi_info->dev, "Could not disable interrupts"
-                                 ", failed set.\n");
+                        smi_info->si_state = SI_NORMAL;
                 }
-                smi_info->si_state = SI_NORMAL;
                 break;
         }
         }
@@ -808,25 +841,35 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
          * We prefer handling attn over new messages.  But don't do
          * this if there is not yet an upper layer to handle anything.
          */
-        if (likely(smi_info->intf) && si_sm_result == SI_SM_ATTN) {
+        if (likely(smi_info->intf) &&
+            (si_sm_result == SI_SM_ATTN || smi_info->got_attn)) {
                 unsigned char msg[2];
 
-                smi_inc_stat(smi_info, attentions);
+                if (smi_info->si_state != SI_NORMAL) {
+                        /*
+                         * We got an ATTN, but we are doing something else.
+                         * Handle the ATTN later.
+                         */
+                        smi_info->got_attn = true;
+                } else {
+                        smi_info->got_attn = false;
+                        smi_inc_stat(smi_info, attentions);
 
-                /*
-                 * Got a attn, send down a get message flags to see
-                 * what's causing it.  It would be better to handle
-                 * this in the upper layer, but due to the way
-                 * interrupts work with the SMI, that's not really
-                 * possible.
-                 */
-                msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
-                msg[1] = IPMI_GET_MSG_FLAGS_CMD;
+                        /*
+                         * Got a attn, send down a get message flags to see
+                         * what's causing it.  It would be better to handle
+                         * this in the upper layer, but due to the way
+                         * interrupts work with the SMI, that's not really
+                         * possible.
+                         */
+                        msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
+                        msg[1] = IPMI_GET_MSG_FLAGS_CMD;
 
-                smi_info->handlers->start_transaction(
-                        smi_info->si_sm, msg, 2);
-                smi_info->si_state = SI_GETTING_FLAGS;
-                goto restart;
+                        smi_info->handlers->start_transaction(
+                                smi_info->si_sm, msg, 2);
+                        smi_info->si_state = SI_GETTING_FLAGS;
+                        goto restart;
+                }
         }
 
         /* If we are currently idle, try to start the next message. */
@@ -846,19 +889,21 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                  */
                 atomic_set(&smi_info->req_events, 0);
 
-                smi_info->curr_msg = ipmi_alloc_smi_msg();
-                if (!smi_info->curr_msg)
-                        goto out;
-
-                smi_info->curr_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
-                smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
-                smi_info->curr_msg->data_size = 2;
+                /*
+                 * Take this opportunity to check the interrupt and
+                 * message enable state for the BMC.  The BMC can be
+                 * asynchronously reset, and may thus get interrupts
+                 * disable and messages disabled.
+                 */
+                if (smi_info->supports_event_msg_buff || smi_info->irq) {
+                        start_check_enables(smi_info);
+                } else {
+                        smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
+                        if (!smi_info->curr_msg)
+                                goto out;
 
-                smi_info->handlers->start_transaction(
-                        smi_info->si_sm,
-                        smi_info->curr_msg->data,
-                        smi_info->curr_msg->data_size);
-                smi_info->si_state = SI_GETTING_EVENTS;
+                        start_getting_events(smi_info);
+                }
                 goto restart;
         }
  out:
@@ -879,8 +924,7 @@ static void check_start_timer_thread(struct smi_info *smi_info)
 }
 
 static void sender(void                *send_info,
-                   struct ipmi_smi_msg *msg,
-                   int                 priority)
+                   struct ipmi_smi_msg *msg)
 {
         struct smi_info   *smi_info = send_info;
         enum si_sm_result result;
@@ -889,14 +933,8 @@ static void sender(void                *send_info,
         struct timeval    t;
 #endif
 
-        if (atomic_read(&smi_info->stop_operation)) {
-                msg->rsp[0] = msg->data[0] | 4;
-                msg->rsp[1] = msg->data[1];
-                msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
-                msg->rsp_size = 3;
-                deliver_recv_msg(smi_info, msg);
-                return;
-        }
+        BUG_ON(smi_info->waiting_msg);
+        smi_info->waiting_msg = msg;
 
 #ifdef DEBUG_TIMING
         do_gettimeofday(&t);
@@ -905,16 +943,16 @@ static void sender(void                *send_info,
 
         if (smi_info->run_to_completion) {
                 /*
-                 * If we are running to completion, then throw it in
-                 * the list and run transactions until everything is
-                 * clear.  Priority doesn't matter here.
+                 * If we are running to completion, start it and run
+                 * transactions until everything is clear.
                  */
+                smi_info->curr_msg = smi_info->waiting_msg;
+                smi_info->waiting_msg = NULL;
 
                 /*
                  * Run to completion means we are single-threaded, no
                  * need for locks.
                  */
-                list_add_tail(&(msg->link), &(smi_info->xmit_msgs));
 
                 result = smi_event_handler(smi_info, 0);
                 while (result != SI_SM_IDLE) {
@@ -926,11 +964,6 @@ static void sender(void                *send_info,
         }
 
         spin_lock_irqsave(&smi_info->si_lock, flags);
-        if (priority > 0)
-                list_add_tail(&msg->link, &smi_info->hp_xmit_msgs);
-        else
-                list_add_tail(&msg->link, &smi_info->xmit_msgs);
-
         check_start_timer_thread(smi_info);
         spin_unlock_irqrestore(&smi_info->si_lock, flags);
 }
@@ -1068,8 +1101,7 @@ static void request_events(void *send_info)
 {
         struct smi_info *smi_info = send_info;
 
-        if (atomic_read(&smi_info->stop_operation) ||
-                                !smi_info->has_event_buffer)
+        if (!smi_info->has_event_buffer)
                 return;
 
         atomic_set(&smi_info->req_events, 1);
@@ -1697,7 +1729,7 @@ static int parse_str(struct hotmod_vals *v, int *val, char *name, char **curr)
         }
         *s = '\0';
         s++;
-        for (i = 0; hotmod_ops[i].name; i++) {
+        for (i = 0; v[i].name; i++) {
                 if (strcmp(*curr, v[i].name) == 0) {
                         *val = v[i].val;
                         *curr = s;
@@ -2133,6 +2165,9 @@ static int try_init_spmi(struct SPMITable *spmi)
         case 3: /* BT */
                 info->si_type = SI_BT;
                 break;
+        case 4: /* SSIF, just ignore */
+                kfree(info);
+                return -EIO;
         default:
                 printk(KERN_INFO PFX "Unknown ACPI/SPMI SI type %d\n",
                        spmi->InterfaceType);
@@ -2250,6 +2285,8 @@ static int ipmi_pnp_probe(struct pnp_dev *dev,
         case 3:
                 info->si_type = SI_BT;
                 break;
+        case 4: /* SSIF, just ignore */
+                goto err_free;
         default:
                 dev_info(&dev->dev, "unknown IPMI type %lld\n", tmp);
                 goto err_free;
@@ -2913,9 +2950,11 @@ static int try_enable_event_buffer(struct smi_info *smi_info)
                 goto out;
         }
 
-        if (resp[3] & IPMI_BMC_EVT_MSG_BUFF)
+        if (resp[3] & IPMI_BMC_EVT_MSG_BUFF) {
                 /* buffer is already enabled, nothing to do. */
+                smi_info->supports_event_msg_buff = true;
                 goto out;
+        }
 
         msg[0] = IPMI_NETFN_APP_REQUEST << 2;
         msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
@@ -2948,6 +2987,9 @@ static int try_enable_event_buffer(struct smi_info *smi_info)
                  * that the event buffer is not supported.
                  */
                 rv = -ENOENT;
+        else
+                smi_info->supports_event_msg_buff = true;
+
  out:
         kfree(resp);
         return rv;
@@ -3188,15 +3230,10 @@ static void setup_xaction_handlers(struct smi_info *smi_info)
 
 static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
 {
-        if (smi_info->intf) {
-                /*
-                 * The timer and thread are only running if the
-                 * interface has been started up and registered.
-                 */
-                if (smi_info->thread != NULL)
-                        kthread_stop(smi_info->thread);
+        if (smi_info->thread != NULL)
+                kthread_stop(smi_info->thread);
+        if (smi_info->timer_running)
                 del_timer_sync(&smi_info->si_timer);
-        }
 }
 
 static struct ipmi_default_vals
@@ -3274,8 +3311,8 @@ static int add_smi(struct smi_info *new_smi)
         int rv = 0;
 
         printk(KERN_INFO PFX "Adding %s-specified %s state machine",
-                        ipmi_addr_src_to_str[new_smi->addr_source],
-                        si_to_str[new_smi->si_type]);
+               ipmi_addr_src_to_str(new_smi->addr_source),
+               si_to_str[new_smi->si_type]);
         mutex_lock(&smi_infos_lock);
         if (!is_new_interface(new_smi)) {
                 printk(KERN_CONT " duplicate interface\n");
@@ -3305,7 +3342,7 @@ static int try_smi_init(struct smi_info *new_smi)
         printk(KERN_INFO PFX "Trying %s-specified %s state"
                " machine at %s address 0x%lx, slave address 0x%x,"
                " irq %d\n",
-               ipmi_addr_src_to_str[new_smi->addr_source],
+               ipmi_addr_src_to_str(new_smi->addr_source),
                si_to_str[new_smi->si_type],
                addr_space_to_str[new_smi->io.addr_type],
                new_smi->io.addr_data,
@@ -3371,8 +3408,7 @@ static int try_smi_init(struct smi_info *new_smi)
         setup_oem_data_handler(new_smi);
         setup_xaction_handlers(new_smi);
 
-        INIT_LIST_HEAD(&(new_smi->xmit_msgs));
-        INIT_LIST_HEAD(&(new_smi->hp_xmit_msgs));
+        new_smi->waiting_msg = NULL;
         new_smi->curr_msg = NULL;
         atomic_set(&new_smi->req_events, 0);
         new_smi->run_to_completion = false;
@@ -3380,7 +3416,6 @@ static int try_smi_init(struct smi_info *new_smi)
                 atomic_set(&new_smi->stats[i], 0);
 
         new_smi->interrupt_disabled = true;
-        atomic_set(&new_smi->stop_operation, 0);
         atomic_set(&new_smi->need_watch, 0);
         new_smi->intf_num = smi_num;
         smi_num++;
@@ -3394,9 +3429,15 @@ static int try_smi_init(struct smi_info *new_smi)
          * timer to avoid racing with the timer.
          */
         start_clear_flags(new_smi);
-        /* IRQ is defined to be set when non-zero. */
-        if (new_smi->irq)
-                new_smi->si_state = SI_CLEARING_FLAGS_THEN_SET_IRQ;
+
+        /*
+         * IRQ is defined to be set when non-zero.  req_events will
+         * cause a global flags check that will enable interrupts.
+         */
+        if (new_smi->irq) {
+                new_smi->interrupt_disabled = false;
+                atomic_set(&new_smi->req_events, 1);
+        }
 
         if (!new_smi->dev) {
                 /*
@@ -3428,7 +3469,6 @@ static int try_smi_init(struct smi_info *new_smi)
                                new_smi,
                                &new_smi->device_id,
                                new_smi->dev,
-                               "bmc",
                                new_smi->slave_addr);
         if (rv) {
                 dev_err(new_smi->dev, "Unable to register device: error %d\n",
@@ -3466,15 +3506,15 @@ static int try_smi_init(struct smi_info *new_smi)
         return 0;
 
  out_err_stop_timer:
-        atomic_inc(&new_smi->stop_operation);
         wait_for_timer_and_thread(new_smi);
 
  out_err:
         new_smi->interrupt_disabled = true;
 
         if (new_smi->intf) {
-                ipmi_unregister_smi(new_smi->intf);
+                ipmi_smi_t intf = new_smi->intf;
                 new_smi->intf = NULL;
+                ipmi_unregister_smi(intf);
         }
 
         if (new_smi->irq_cleanup) {
@@ -3653,60 +3693,49 @@ module_init(init_ipmi_si);
 static void cleanup_one_si(struct smi_info *to_clean)
 {
         int           rv = 0;
-        unsigned long flags;
 
         if (!to_clean)
                 return;
 
+        if (to_clean->intf) {
+                ipmi_smi_t intf = to_clean->intf;
+
+                to_clean->intf = NULL;
+                rv = ipmi_unregister_smi(intf);
+                if (rv) {
+                        pr_err(PFX "Unable to unregister device: errno=%d\n",
+                               rv);
+                }
+        }
+
         if (to_clean->dev)
                 dev_set_drvdata(to_clean->dev, NULL);
 
         list_del(&to_clean->link);
 
-        /* Tell the driver that we are shutting down. */
-        atomic_inc(&to_clean->stop_operation);
-
         /*
-         * Make sure the timer and thread are stopped and will not run
-         * again.
+         * Make sure that interrupts, the timer and the thread are
+         * stopped and will not run again.
          */
+        if (to_clean->irq_cleanup)
+                to_clean->irq_cleanup(to_clean);
         wait_for_timer_and_thread(to_clean);
 
         /*
          * Timeouts are stopped, now make sure the interrupts are off
-         * for the device.  A little tricky with locks to make sure
-         * there are no races.
+         * in the BMC.  Note that timers and CPU interrupts are off,
+         * so no need for locks.
          */
-        spin_lock_irqsave(&to_clean->si_lock, flags);
         while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
-                spin_unlock_irqrestore(&to_clean->si_lock, flags);
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
-                spin_lock_irqsave(&to_clean->si_lock, flags);
         }
         disable_si_irq(to_clean);
-        spin_unlock_irqrestore(&to_clean->si_lock, flags);
         while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
         }
 
-        /* Clean up interrupts and make sure that everything is done. */
-        if (to_clean->irq_cleanup)
-                to_clean->irq_cleanup(to_clean);
-        while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
-                poll(to_clean);
-                schedule_timeout_uninterruptible(1);
-        }
-
-        if (to_clean->intf)
-                rv = ipmi_unregister_smi(to_clean->intf);
-
-        if (rv) {
-                printk(KERN_ERR PFX "Unable to unregister device: errno=%d\n",
-                       rv);
-        }
-
         if (to_clean->handlers)
                 to_clean->handlers->cleanup(to_clean->si_sm);
 
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
new file mode 100644
index 000000000000..e178ac27e73c
--- /dev/null
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -0,0 +1,1870 @@
+/*
+ * ipmi_ssif.c
+ *
+ * The interface to the IPMI driver for SMBus access to a SMBus
+ * compliant device.  Called SSIF by the IPMI spec.
+ *
+ * Author: Intel Corporation
+ *         Todd Davis <todd.c.davis@intel.com>
+ *
+ * Rewritten by Corey Minyard <minyard@acm.org> to support the
+ * non-blocking I2C interface, add support for multi-part
+ * transactions, add PEC support, and general clenaup.
+ *
+ * Copyright 2003 Intel Corporation
+ * Copyright 2005 MontaVista Software
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License as published by the
+ *  Free Software Foundation; either version 2 of the License, or (at your
+ *  option) any later version.
+ */
+
+/*
+ * This file holds the "policy" for the interface to the SSIF state
+ * machine.  It does the configuration, handles timers and interrupts,
+ * and drives the real SSIF state machine.
+ */
+
+/*
+ * TODO: Figure out how to use SMB alerts.  This will require a new
+ * interface into the I2C driver, I believe.
+ */
+
+#include <linux/version.h>
+#if defined(MODVERSIONS)
+#include <linux/modversions.h>
+#endif
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/sched.h>
+#include <linux/seq_file.h>
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/i2c.h>
+#include <linux/ipmi_smi.h>
+#include <linux/init.h>
+#include <linux/dmi.h>
+#include <linux/kthread.h>
+#include <linux/acpi.h>
+
+#define PFX "ipmi_ssif: "
+#define DEVICE_NAME "ipmi_ssif"
+
+#define IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD      0x57
+
+#define SSIF_IPMI_REQUEST                       2
+#define SSIF_IPMI_MULTI_PART_REQUEST_START      6
+#define SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE     7
+#define SSIF_IPMI_RESPONSE                      3
+#define SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE    9
+
+/* ssif_debug is a bit-field
+ *      SSIF_DEBUG_MSG -        commands and their responses
+ *      SSIF_DEBUG_STATES -     message states
+ *      SSIF_DEBUG_TIMING -      Measure times between events in the driver
+ */
+#define SSIF_DEBUG_TIMING       4
+#define SSIF_DEBUG_STATE        2
+#define SSIF_DEBUG_MSG          1
+#define SSIF_NODEBUG            0
+#define SSIF_DEFAULT_DEBUG      (SSIF_NODEBUG)
+
+/*
+ * Timer values
+ */
+#define SSIF_MSG_USEC           20000   /* 20ms between message tries. */
+#define SSIF_MSG_PART_USEC      5000    /* 5ms for a message part */
+
+/* How many times to we retry sending/receiving the message. */
+#define SSIF_SEND_RETRIES       5
+#define SSIF_RECV_RETRIES       250
+
+#define SSIF_MSG_MSEC           (SSIF_MSG_USEC / 1000)
+#define SSIF_MSG_JIFFIES        ((SSIF_MSG_USEC * 1000) / TICK_NSEC)
+#define SSIF_MSG_PART_JIFFIES   ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC)
+
+enum ssif_intf_state {
+        SSIF_NORMAL,
+        SSIF_GETTING_FLAGS,
+        SSIF_GETTING_EVENTS,
+        SSIF_CLEARING_FLAGS,
+        SSIF_GETTING_MESSAGES,
+        /* FIXME - add watchdog stuff. */
+};
+
+#define SSIF_IDLE(ssif)  ((ssif)->ssif_state == SSIF_NORMAL \
+                          && (ssif)->curr_msg == NULL)
+
+/*
+ * Indexes into stats[] in ssif_info below.
+ */
+enum ssif_stat_indexes {
+        /* Number of total messages sent. */
+        SSIF_STAT_sent_messages = 0,
+
+        /*
+         * Number of message parts sent.  Messages may be broken into
+         * parts if they are long.
+         */
+        SSIF_STAT_sent_messages_parts,
+
+        /*
+         * Number of time a message was retried.
+         */
+        SSIF_STAT_send_retries,
+
+        /*
+         * Number of times the send of a message failed.
+         */
+        SSIF_STAT_send_errors,
+
+        /*
+         * Number of message responses received.
+         */
+        SSIF_STAT_received_messages,
+
+        /*
+         * Number of message fragments received.
+         */
+        SSIF_STAT_received_message_parts,
+
+        /*
+         * Number of times the receive of a message was retried.
+         */
+        SSIF_STAT_receive_retries,
+
+        /*
+         * Number of errors receiving messages.
+         */
+        SSIF_STAT_receive_errors,
+
+        /*
+         * Number of times a flag fetch was requested.
+         */
+        SSIF_STAT_flag_fetches,
+
+        /*
+         * Number of times the hardware didn't follow the state machine.
+         */
+        SSIF_STAT_hosed,
+
+        /*
+         * Number of received events.
+         */
+        SSIF_STAT_events,
+
+        /* Number of asyncronous messages received. */
+        SSIF_STAT_incoming_messages,
+
+        /* Number of watchdog pretimeouts. */
+        SSIF_STAT_watchdog_pretimeouts,
+
+        /* Always add statistics before this value, it must be last. */
+        SSIF_NUM_STATS
+};
+
+struct ssif_addr_info {
+        unsigned short addr;
+        struct i2c_board_info binfo;
+        char *adapter_name;
+        int debug;
+        int slave_addr;
+        enum ipmi_addr_src addr_src;
+        union ipmi_smi_info_union addr_info;
+
+        struct mutex clients_mutex;
+        struct list_head clients;
+
+        struct list_head link;
+};
+
+struct ssif_info;
+
+typedef void (*ssif_i2c_done)(struct ssif_info *ssif_info, int result,
+                             unsigned char *data, unsigned int len);
+
+struct ssif_info {
+        ipmi_smi_t          intf;
+        int                 intf_num;
+        spinlock_t          lock;
+        struct ipmi_smi_msg *waiting_msg;
+        struct ipmi_smi_msg *curr_msg;
+        enum ssif_intf_state ssif_state;
+        unsigned long       ssif_debug;
+
+        struct ipmi_smi_handlers handlers;
+
+        enum ipmi_addr_src addr_source; /* ACPI, PCI, SMBIOS, hardcode, etc. */
+        union ipmi_smi_info_union addr_info;
+
+        /*
+         * Flags from the last GET_MSG_FLAGS command, used when an ATTN
+         * is set to hold the flags until we are done handling everything
+         * from the flags.
+         */
+#define RECEIVE_MSG_AVAIL       0x01
+#define EVENT_MSG_BUFFER_FULL   0x02
+#define WDT_PRE_TIMEOUT_INT     0x08
+        unsigned char       msg_flags;
+
+        bool                has_event_buffer;
+
+        /*
+         * If set to true, this will request events the next time the
+         * state machine is idle.
+         */
+        bool                req_events;
+
+        /*
+         * If set to true, this will request flags the next time the
+         * state machine is idle.
+         */
+        bool                req_flags;
+
+        /*
+         * Used to perform timer operations when run-to-completion
+         * mode is on.  This is a countdown timer.
+         */
+        int                 rtc_us_timer;
+
+        /* Used for sending/receiving data.  +1 for the length. */
+        unsigned char data[IPMI_MAX_MSG_LENGTH + 1];
+        unsigned int  data_len;
+
+        /* Temp receive buffer, gets copied into data. */
+        unsigned char recv[I2C_SMBUS_BLOCK_MAX];
+
+        struct i2c_client *client;
+        ssif_i2c_done done_handler;
+
+        /* Thread interface handling */
+        struct task_struct *thread;
+        struct completion wake_thread;
+        bool stopping;
+        int i2c_read_write;
+        int i2c_command;
+        unsigned char *i2c_data;
+        unsigned int i2c_size;
+
+        /* From the device id response. */
+        struct ipmi_device_id device_id;
+
+        struct timer_list retry_timer;
+        int retries_left;
+
+        /* Info from SSIF cmd */
+        unsigned char max_xmit_msg_size;
+        unsigned char max_recv_msg_size;
+        unsigned int  multi_support;
+        int           supports_pec;
+
+#define SSIF_NO_MULTI           0
+#define SSIF_MULTI_2_PART       1
+#define SSIF_MULTI_n_PART       2
+        unsigned char *multi_data;
+        unsigned int  multi_len;
+        unsigned int  multi_pos;
+
+        atomic_t stats[SSIF_NUM_STATS];
+};
+
+#define ssif_inc_stat(ssif, stat) \
+        atomic_inc(&(ssif)->stats[SSIF_STAT_ ## stat])
+#define ssif_get_stat(ssif, stat) \
+        ((unsigned int) atomic_read(&(ssif)->stats[SSIF_STAT_ ## stat]))
+
+static bool initialized;
+
+static atomic_t next_intf = ATOMIC_INIT(0);
+
+static void return_hosed_msg(struct ssif_info *ssif_info,
+                             struct ipmi_smi_msg *msg);
+static void start_next_msg(struct ssif_info *ssif_info, unsigned long *flags);
+static int start_send(struct ssif_info *ssif_info,
+                      unsigned char   *data,
+                      unsigned int    len);
+
+static unsigned long *ipmi_ssif_lock_cond(struct ssif_info *ssif_info,
+                                          unsigned long *flags)
+{
+        spin_lock_irqsave(&ssif_info->lock, *flags);
+        return flags;
+}
+
+static void ipmi_ssif_unlock_cond(struct ssif_info *ssif_info,
+                                  unsigned long *flags)
+{
+        spin_unlock_irqrestore(&ssif_info->lock, *flags);
+}
+
+static void deliver_recv_msg(struct ssif_info *ssif_info,
+                             struct ipmi_smi_msg *msg)
+{
+        ipmi_smi_t    intf = ssif_info->intf;
+
+        if (!intf) {
+                ipmi_free_smi_msg(msg);
+        } else if (msg->rsp_size < 0) {
+                return_hosed_msg(ssif_info, msg);
+                pr_err(PFX
+                       "Malformed message in deliver_recv_msg: rsp_size = %d\n",
+                       msg->rsp_size);
+        } else {
+                ipmi_smi_msg_received(intf, msg);
+        }
+}
+
+static void return_hosed_msg(struct ssif_info *ssif_info,
+                             struct ipmi_smi_msg *msg)
+{
+        ssif_inc_stat(ssif_info, hosed);
+
+        /* Make it a response */
+        msg->rsp[0] = msg->data[0] | 4;
+        msg->rsp[1] = msg->data[1];
+        msg->rsp[2] = 0xFF; /* Unknown error. */
+        msg->rsp_size = 3;
+
+        deliver_recv_msg(ssif_info, msg);
+}
+
+/*
+ * Must be called with the message lock held.  This will release the
+ * message lock.  Note that the caller will check SSIF_IDLE and start a
+ * new operation, so there is no need to check for new messages to
+ * start in here.
+ */
+static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags)
+{
+        unsigned char msg[3];
+
+        ssif_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
+        ssif_info->ssif_state = SSIF_CLEARING_FLAGS;
+        ipmi_ssif_unlock_cond(ssif_info, flags);
+
+        /* Make sure the watchdog pre-timeout flag is not set at startup. */
+        msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
+        msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
+        msg[2] = WDT_PRE_TIMEOUT_INT;
+
+        if (start_send(ssif_info, msg, 3) != 0) {
+                /* Error, just go to normal state. */
+                ssif_info->ssif_state = SSIF_NORMAL;
+        }
+}
+
+static void start_flag_fetch(struct ssif_info *ssif_info, unsigned long *flags)
+{
+        unsigned char mb[2];
+
+        ssif_info->req_flags = false;
+        ssif_info->ssif_state = SSIF_GETTING_FLAGS;
+        ipmi_ssif_unlock_cond(ssif_info, flags);
+
+        mb[0] = (IPMI_NETFN_APP_REQUEST << 2);
+        mb[1] = IPMI_GET_MSG_FLAGS_CMD;
+        if (start_send(ssif_info, mb, 2) != 0)
+                ssif_info->ssif_state = SSIF_NORMAL;
+}
+
+static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags,
+                             struct ipmi_smi_msg *msg)
+{
+        if (start_send(ssif_info, msg->data, msg->data_size) != 0) {
+                unsigned long oflags;
+
+                flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+                ssif_info->curr_msg = NULL;
+                ssif_info->ssif_state = SSIF_NORMAL;
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+                ipmi_free_smi_msg(msg);
+        }
+}
+
+static void start_event_fetch(struct ssif_info *ssif_info, unsigned long *flags)
+{
+        struct ipmi_smi_msg *msg;
+
+        ssif_info->req_events = false;
+
+        msg = ipmi_alloc_smi_msg();
+        if (!msg) {
+                ssif_info->ssif_state = SSIF_NORMAL;
+                return;
+        }
+
+        ssif_info->curr_msg = msg;
+        ssif_info->ssif_state = SSIF_GETTING_EVENTS;
+        ipmi_ssif_unlock_cond(ssif_info, flags);
+
+        msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
+        msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
+        msg->data_size = 2;
+
+        check_start_send(ssif_info, flags, msg);
+}
+
+static void start_recv_msg_fetch(struct ssif_info *ssif_info,
+                                 unsigned long *flags)
+{
+        struct ipmi_smi_msg *msg;
+
+        msg = ipmi_alloc_smi_msg();
+        if (!msg) {
+                ssif_info->ssif_state = SSIF_NORMAL;
+                return;
+        }
+
+        ssif_info->curr_msg = msg;
+        ssif_info->ssif_state = SSIF_GETTING_MESSAGES;
+        ipmi_ssif_unlock_cond(ssif_info, flags);
+
+        msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
+        msg->data[1] = IPMI_GET_MSG_CMD;
+        msg->data_size = 2;
+
+        check_start_send(ssif_info, flags, msg);
+}
+
+/*
+ * Must be called with the message lock held.  This will release the
+ * message lock.  Note that the caller will check SSIF_IDLE and start a
+ * new operation, so there is no need to check for new messages to
+ * start in here.
+ */
+static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags)
+{
+        if (ssif_info->msg_flags & WDT_PRE_TIMEOUT_INT) {
+                ipmi_smi_t intf = ssif_info->intf;
+                /* Watchdog pre-timeout */
+                ssif_inc_stat(ssif_info, watchdog_pretimeouts);
+                start_clear_flags(ssif_info, flags);
+                if (intf)
+                        ipmi_smi_watchdog_pretimeout(intf);
+        } else if (ssif_info->msg_flags & RECEIVE_MSG_AVAIL)
+                /* Messages available. */
+                start_recv_msg_fetch(ssif_info, flags);
+        else if (ssif_info->msg_flags & EVENT_MSG_BUFFER_FULL)
+                /* Events available. */
+                start_event_fetch(ssif_info, flags);
+        else {
+                ssif_info->ssif_state = SSIF_NORMAL;
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+        }
+}
+
+static int ipmi_ssif_thread(void *data)
+{
+        struct ssif_info *ssif_info = data;
+
+        while (!kthread_should_stop()) {
+                int result;
+
+                /* Wait for something to do */
+                wait_for_completion(&ssif_info->wake_thread);
+                init_completion(&ssif_info->wake_thread);
+
+                if (ssif_info->stopping)
+                        break;
+
+                if (ssif_info->i2c_read_write == I2C_SMBUS_WRITE) {
+                        result = i2c_smbus_write_block_data(
+                                ssif_info->client, SSIF_IPMI_REQUEST,
+                                ssif_info->i2c_data[0],
+                                ssif_info->i2c_data + 1);
+                        ssif_info->done_handler(ssif_info, result, NULL, 0);
+                } else {
+                        result = i2c_smbus_read_block_data(
+                                ssif_info->client, SSIF_IPMI_RESPONSE,
+                                ssif_info->i2c_data);
+                        if (result < 0)
+                                ssif_info->done_handler(ssif_info, result,
+                                                        NULL, 0);
+                        else
+                                ssif_info->done_handler(ssif_info, 0,
+                                                        ssif_info->i2c_data,
+                                                        result);
+                }
+        }
+
+        return 0;
+}
+
+static int ssif_i2c_send(struct ssif_info *ssif_info,
+                        ssif_i2c_done handler,
+                        int read_write, int command,
+                        unsigned char *data, unsigned int size)
+{
+        ssif_info->done_handler = handler;
+
+        ssif_info->i2c_read_write = read_write;
+        ssif_info->i2c_command = command;
+        ssif_info->i2c_data = data;
+        ssif_info->i2c_size = size;
+        complete(&ssif_info->wake_thread);
+        return 0;
+}
+
+
+static void msg_done_handler(struct ssif_info *ssif_info, int result,
+                             unsigned char *data, unsigned int len);
+
+static void retry_timeout(unsigned long data)
+{
+        struct ssif_info *ssif_info = (void *) data;
+        int rv;
+
+        if (ssif_info->stopping)
+                return;
+
+        ssif_info->rtc_us_timer = 0;
+
+        rv = ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
+                          SSIF_IPMI_RESPONSE,
+                          ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
+        if (rv < 0) {
+                /* request failed, just return the error. */
+                if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                        pr_info("Error from i2c_non_blocking_op(5)\n");
+
+                msg_done_handler(ssif_info, -EIO, NULL, 0);
+        }
+}
+
+static int start_resend(struct ssif_info *ssif_info);
+
+static void msg_done_handler(struct ssif_info *ssif_info, int result,
+                             unsigned char *data, unsigned int len)
+{
+        struct ipmi_smi_msg *msg;
+        unsigned long oflags, *flags;
+        int rv;
+
+        /*
+         * We are single-threaded here, so no need for a lock until we
+         * start messing with driver states or the queues.
+         */
+
+        if (result < 0) {
+                ssif_info->retries_left--;
+                if (ssif_info->retries_left > 0) {
+                        ssif_inc_stat(ssif_info, receive_retries);
+
+                        mod_timer(&ssif_info->retry_timer,
+                                  jiffies + SSIF_MSG_JIFFIES);
+                        ssif_info->rtc_us_timer = SSIF_MSG_USEC;
+                        return;
+                }
+
+                ssif_inc_stat(ssif_info, receive_errors);
+
+                if  (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                        pr_info("Error in msg_done_handler: %d\n", result);
+                len = 0;
+                goto continue_op;
+        }
+
+        if ((len > 1) && (ssif_info->multi_pos == 0)
+                                && (data[0] == 0x00) && (data[1] == 0x01)) {
+                /* Start of multi-part read.  Start the next transaction. */
+                int i;
+
+                ssif_inc_stat(ssif_info, received_message_parts);
+
+                /* Remove the multi-part read marker. */
+                for (i = 0; i < (len-2); i++)
+                        ssif_info->data[i] = data[i+2];
+                len -= 2;
+                ssif_info->multi_len = len;
+                ssif_info->multi_pos = 1;
+
+                rv = ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
+                                  SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE,
+                                  ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
+                if (rv < 0) {
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Error from i2c_non_blocking_op(1)\n");
+
+                        result = -EIO;
+                } else
+                        return;
+        } else if (ssif_info->multi_pos) {
+                /* Middle of multi-part read.  Start the next transaction. */
+                int i;
+                unsigned char blocknum;
+
+                if (len == 0) {
+                        result = -EIO;
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info(PFX "Middle message with no data\n");
+
+                        goto continue_op;
+                }
+
+                blocknum = data[ssif_info->multi_len];
+
+                if (ssif_info->multi_len+len-1 > IPMI_MAX_MSG_LENGTH) {
+                        /* Received message too big, abort the operation. */
+                        result = -E2BIG;
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Received message too big\n");
+
+                        goto continue_op;
+                }
+
+                /* Remove the blocknum from the data. */
+                for (i = 0; i < (len-1); i++)
+                        ssif_info->data[i+ssif_info->multi_len] = data[i+1];
+                len--;
+                ssif_info->multi_len += len;
+                if (blocknum == 0xff) {
+                        /* End of read */
+                        len = ssif_info->multi_len;
+                        data = ssif_info->data;
+                } else if ((blocknum+1) != ssif_info->multi_pos) {
+                        /*
+                         * Out of sequence block, just abort.  Block
+                         * numbers start at zero for the second block,
+                         * but multi_pos starts at one, so the +1.
+                         */
+                        result = -EIO;
+                } else {
+                        ssif_inc_stat(ssif_info, received_message_parts);
+
+                        ssif_info->multi_pos++;
+
+                        rv = ssif_i2c_send(ssif_info, msg_done_handler,
+                                           I2C_SMBUS_READ,
+                                           SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE,
+                                           ssif_info->recv,
+                                           I2C_SMBUS_BLOCK_DATA);
+                        if (rv < 0) {
+                                if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                        pr_info(PFX
+                                                "Error from i2c_non_blocking_op(2)\n");
+
+                                result = -EIO;
+                        } else
+                                return;
+                }
+        }
+
+        if (result < 0) {
+                ssif_inc_stat(ssif_info, receive_errors);
+        } else {
+                ssif_inc_stat(ssif_info, received_messages);
+                ssif_inc_stat(ssif_info, received_message_parts);
+        }
+
+
+ continue_op:
+        if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
+                pr_info(PFX "DONE 1: state = %d, result=%d.\n",
+                        ssif_info->ssif_state, result);
+
+        flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+        msg = ssif_info->curr_msg;
+        if (msg) {
+                msg->rsp_size = len;
+                if (msg->rsp_size > IPMI_MAX_MSG_LENGTH)
+                        msg->rsp_size = IPMI_MAX_MSG_LENGTH;
+                memcpy(msg->rsp, data, msg->rsp_size);
+                ssif_info->curr_msg = NULL;
+        }
+
+        switch (ssif_info->ssif_state) {
+        case SSIF_NORMAL:
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+                if (!msg)
+                        break;
+
+                if (result < 0)
+                        return_hosed_msg(ssif_info, msg);
+                else
+                        deliver_recv_msg(ssif_info, msg);
+                break;
+
+        case SSIF_GETTING_FLAGS:
+                /* We got the flags from the SSIF, now handle them. */
+                if ((result < 0) || (len < 4) || (data[2] != 0)) {
+                        /*
+                         * Error fetching flags, or invalid length,
+                         * just give up for now.
+                         */
+                        ssif_info->ssif_state = SSIF_NORMAL;
+                        ipmi_ssif_unlock_cond(ssif_info, flags);
+                        pr_warn(PFX "Error getting flags: %d %d, %x\n",
+                               result, len, data[2]);
+                } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
+                           || data[1] != IPMI_GET_MSG_FLAGS_CMD) {
+                        pr_warn(PFX "Invalid response getting flags: %x %x\n",
+                                data[0], data[1]);
+                } else {
+                        ssif_inc_stat(ssif_info, flag_fetches);
+                        ssif_info->msg_flags = data[3];
+                        handle_flags(ssif_info, flags);
+                }
+                break;
+
+        case SSIF_CLEARING_FLAGS:
+                /* We cleared the flags. */
+                if ((result < 0) || (len < 3) || (data[2] != 0)) {
+                        /* Error clearing flags */
+                        pr_warn(PFX "Error clearing flags: %d %d, %x\n",
+                               result, len, data[2]);
+                } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
+                           || data[1] != IPMI_CLEAR_MSG_FLAGS_CMD) {
+                        pr_warn(PFX "Invalid response clearing flags: %x %x\n",
+                                data[0], data[1]);
+                }
+                ssif_info->ssif_state = SSIF_NORMAL;
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+                break;
+
+        case SSIF_GETTING_EVENTS:
+                if ((result < 0) || (len < 3) || (msg->rsp[2] != 0)) {
+                        /* Error getting event, probably done. */
+                        msg->done(msg);
+
+                        /* Take off the event flag. */
+                        ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
+                        handle_flags(ssif_info, flags);
+                } else if (msg->rsp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
+                           || msg->rsp[1] != IPMI_READ_EVENT_MSG_BUFFER_CMD) {
+                        pr_warn(PFX "Invalid response getting events: %x %x\n",
+                                msg->rsp[0], msg->rsp[1]);
+                        msg->done(msg);
+                        /* Take off the event flag. */
+                        ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
+                        handle_flags(ssif_info, flags);
+                } else {
+                        handle_flags(ssif_info, flags);
+                        ssif_inc_stat(ssif_info, events);
+                        deliver_recv_msg(ssif_info, msg);
+                }
+                break;
+
+        case SSIF_GETTING_MESSAGES:
+                if ((result < 0) || (len < 3) || (msg->rsp[2] != 0)) {
+                        /* Error getting event, probably done. */
+                        msg->done(msg);
+
+                        /* Take off the msg flag. */
+                        ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
+                        handle_flags(ssif_info, flags);
+                } else if (msg->rsp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
+                           || msg->rsp[1] != IPMI_GET_MSG_CMD) {
+                        pr_warn(PFX "Invalid response clearing flags: %x %x\n",
+                                msg->rsp[0], msg->rsp[1]);
+                        msg->done(msg);
+
+                        /* Take off the msg flag. */
+                        ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
+                        handle_flags(ssif_info, flags);
+                } else {
+                        ssif_inc_stat(ssif_info, incoming_messages);
+                        handle_flags(ssif_info, flags);
+                        deliver_recv_msg(ssif_info, msg);
+                }
+                break;
+        }
+
+        flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+        if (SSIF_IDLE(ssif_info) && !ssif_info->stopping) {
+                if (ssif_info->req_events)
+                        start_event_fetch(ssif_info, flags);
+                else if (ssif_info->req_flags)
+                        start_flag_fetch(ssif_info, flags);
+                else
+                        start_next_msg(ssif_info, flags);
+        } else
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+
+        if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
+                pr_info(PFX "DONE 2: state = %d.\n", ssif_info->ssif_state);
+}
+
+static void msg_written_handler(struct ssif_info *ssif_info, int result,
+                                unsigned char *data, unsigned int len)
+{
+        int rv;
+
+        /* We are single-threaded here, so no need for a lock. */
+        if (result < 0) {
+                ssif_info->retries_left--;
+                if (ssif_info->retries_left > 0) {
+                        if (!start_resend(ssif_info)) {
+                                ssif_inc_stat(ssif_info, send_retries);
+                                return;
+                        }
+                        /* request failed, just return the error. */
+                        ssif_inc_stat(ssif_info, send_errors);
+
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info(PFX
+                                        "Out of retries in msg_written_handler\n");
+                        msg_done_handler(ssif_info, -EIO, NULL, 0);
+                        return;
+                }
+
+                ssif_inc_stat(ssif_info, send_errors);
+
+                /*
+                 * Got an error on transmit, let the done routine
+                 * handle it.
+                 */
+                if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                        pr_info("Error in msg_written_handler: %d\n", result);
+
+                msg_done_handler(ssif_info, result, NULL, 0);
+                return;
+        }
+
+        if (ssif_info->multi_data) {
+                /* In the middle of a multi-data write. */
+                int left;
+
+                ssif_inc_stat(ssif_info, sent_messages_parts);
+
+                left = ssif_info->multi_len - ssif_info->multi_pos;
+                if (left > 32)
+                        left = 32;
+                /* Length byte. */
+                ssif_info->multi_data[ssif_info->multi_pos] = left;
+                ssif_info->multi_pos += left;
+                if (left < 32)
+                        /*
+                         * Write is finished.  Note that we must end
+                         * with a write of less than 32 bytes to
+                         * complete the transaction, even if it is
+                         * zero bytes.
+                         */
+                        ssif_info->multi_data = NULL;
+
+                rv = ssif_i2c_send(ssif_info, msg_written_handler,
+                                  I2C_SMBUS_WRITE,
+                                  SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE,
+                                  ssif_info->multi_data + ssif_info->multi_pos,
+                                  I2C_SMBUS_BLOCK_DATA);
+                if (rv < 0) {
+                        /* request failed, just return the error. */
+                        ssif_inc_stat(ssif_info, send_errors);
+
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Error from i2c_non_blocking_op(3)\n");
+                        msg_done_handler(ssif_info, -EIO, NULL, 0);
+                }
+        } else {
+                ssif_inc_stat(ssif_info, sent_messages);
+                ssif_inc_stat(ssif_info, sent_messages_parts);
+
+                /* Wait a jiffie then request the next message */
+                ssif_info->retries_left = SSIF_RECV_RETRIES;
+                ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC;
+                mod_timer(&ssif_info->retry_timer,
+                          jiffies + SSIF_MSG_PART_JIFFIES);
+                return;
+        }
+}
+
+static int start_resend(struct ssif_info *ssif_info)
+{
+        int rv;
+        int command;
+
+        if (ssif_info->data_len > 32) {
+                command = SSIF_IPMI_MULTI_PART_REQUEST_START;
+                ssif_info->multi_data = ssif_info->data;
+                ssif_info->multi_len = ssif_info->data_len;
+                /*
+                 * Subtle thing, this is 32, not 33, because we will
+                 * overwrite the thing at position 32 (which was just
+                 * transmitted) with the new length.
+                 */
+                ssif_info->multi_pos = 32;
+                ssif_info->data[0] = 32;
+        } else {
+                ssif_info->multi_data = NULL;
+                command = SSIF_IPMI_REQUEST;
+                ssif_info->data[0] = ssif_info->data_len;
+        }
+
+        rv = ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE,
+                          command, ssif_info->data, I2C_SMBUS_BLOCK_DATA);
+        if (rv && (ssif_info->ssif_debug & SSIF_DEBUG_MSG))
+                pr_info("Error from i2c_non_blocking_op(4)\n");
+        return rv;
+}
+
+static int start_send(struct ssif_info *ssif_info,
+                      unsigned char   *data,
+                      unsigned int    len)
+{
+        if (len > IPMI_MAX_MSG_LENGTH)
+                return -E2BIG;
+        if (len > ssif_info->max_xmit_msg_size)
+                return -E2BIG;
+
+        ssif_info->retries_left = SSIF_SEND_RETRIES;
+        memcpy(ssif_info->data+1, data, len);
+        ssif_info->data_len = len;
+        return start_resend(ssif_info);
+}
+
+/* Must be called with the message lock held. */
+static void start_next_msg(struct ssif_info *ssif_info, unsigned long *flags)
+{
+        struct ipmi_smi_msg *msg;
+        unsigned long oflags;
+
+ restart:
+        if (!SSIF_IDLE(ssif_info)) {
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+                return;
+        }
+
+        if (!ssif_info->waiting_msg) {
+                ssif_info->curr_msg = NULL;
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+        } else {
+                int rv;
+
+                ssif_info->curr_msg = ssif_info->waiting_msg;
+                ssif_info->waiting_msg = NULL;
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+                rv = start_send(ssif_info,
+                                ssif_info->curr_msg->data,
+                                ssif_info->curr_msg->data_size);
+                if (rv) {
+                        msg = ssif_info->curr_msg;
+                        ssif_info->curr_msg = NULL;
+                        return_hosed_msg(ssif_info, msg);
+                        flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+                        goto restart;
+                }
+        }
+}
+
+static void sender(void                *send_info,
+                   struct ipmi_smi_msg *msg)
+{
+        struct ssif_info *ssif_info = (struct ssif_info *) send_info;
+        unsigned long oflags, *flags;
+
+        BUG_ON(ssif_info->waiting_msg);
+        ssif_info->waiting_msg = msg;
+
+        flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+        start_next_msg(ssif_info, flags);
+
+        if (ssif_info->ssif_debug & SSIF_DEBUG_TIMING) {
+                struct timeval t;
+
+                do_gettimeofday(&t);
+                pr_info("**Enqueue %02x %02x: %ld.%6.6ld\n",
+                       msg->data[0], msg->data[1], t.tv_sec, t.tv_usec);
+        }
+}
+
+static int get_smi_info(void *send_info, struct ipmi_smi_info *data)
+{
+        struct ssif_info *ssif_info = send_info;
+
+        data->addr_src = ssif_info->addr_source;
+        data->dev = &ssif_info->client->dev;
+        data->addr_info = ssif_info->addr_info;
+        get_device(data->dev);
+
+        return 0;
+}
+
+/*
+ * Instead of having our own timer to periodically check the message
+ * flags, we let the message handler drive us.
+ */
+static void request_events(void *send_info)
+{
+        struct ssif_info *ssif_info = (struct ssif_info *) send_info;
+        unsigned long oflags, *flags;
+
+        if (!ssif_info->has_event_buffer)
+                return;
+
+        flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+        /*
+         * Request flags first, not events, because the lower layer
+         * doesn't have a way to send an attention.  But make sure
+         * event checking still happens.
+         */
+        ssif_info->req_events = true;
+        if (SSIF_IDLE(ssif_info))
+                start_flag_fetch(ssif_info, flags);
+        else {
+                ssif_info->req_flags = true;
+                ipmi_ssif_unlock_cond(ssif_info, flags);
+        }
+}
+
+static int inc_usecount(void *send_info)
+{
+        struct ssif_info *ssif_info = send_info;
+
+        if (!i2c_get_adapter(ssif_info->client->adapter->nr))
+                return -ENODEV;
+
+        i2c_use_client(ssif_info->client);
+        return 0;
+}
+
+static void dec_usecount(void *send_info)
+{
+        struct ssif_info *ssif_info = send_info;
+
+        i2c_release_client(ssif_info->client);
+        i2c_put_adapter(ssif_info->client->adapter);
+}
+
+static int ssif_start_processing(void *send_info,
+                                 ipmi_smi_t intf)
+{
+        struct ssif_info *ssif_info = send_info;
+
+        ssif_info->intf = intf;
+
+        return 0;
+}
+
+#define MAX_SSIF_BMCS 4
+
+static unsigned short addr[MAX_SSIF_BMCS];
+static int num_addrs;
+module_param_array(addr, ushort, &num_addrs, 0);
+MODULE_PARM_DESC(addr, "The addresses to scan for IPMI BMCs on the SSIFs.");
+
+static char *adapter_name[MAX_SSIF_BMCS];
+static int num_adapter_names;
+module_param_array(adapter_name, charp, &num_adapter_names, 0);
+MODULE_PARM_DESC(adapter_name, "The string name of the I2C device that has the BMC.  By default all devices are scanned.");
+
+static int slave_addrs[MAX_SSIF_BMCS];
+static int num_slave_addrs;
+module_param_array(slave_addrs, int, &num_slave_addrs, 0);
+MODULE_PARM_DESC(slave_addrs,
+                 "The default IPMB slave address for the controller.");
+
+/*
+ * Bit 0 enables message debugging, bit 1 enables state debugging, and
+ * bit 2 enables timing debugging.  This is an array indexed by
+ * interface number"
+ */
+static int dbg[MAX_SSIF_BMCS];
+static int num_dbg;
+module_param_array(dbg, int, &num_dbg, 0);
+MODULE_PARM_DESC(dbg, "Turn on debugging.");
+
+static bool ssif_dbg_probe;
+module_param_named(dbg_probe, ssif_dbg_probe, bool, 0);
+MODULE_PARM_DESC(dbg_probe, "Enable debugging of probing of adapters.");
+
+static int use_thread;
+module_param(use_thread, int, 0);
+MODULE_PARM_DESC(use_thread, "Use the thread interface.");
+
+static bool ssif_tryacpi = 1;
+module_param_named(tryacpi, ssif_tryacpi, bool, 0);
+MODULE_PARM_DESC(tryacpi, "Setting this to zero will disable the default scan of the interfaces identified via ACPI");
+
+static bool ssif_trydmi = 1;
+module_param_named(trydmi, ssif_trydmi, bool, 0);
+MODULE_PARM_DESC(trydmi, "Setting this to zero will disable the default scan of the interfaces identified via DMI (SMBIOS)");
+
+static DEFINE_MUTEX(ssif_infos_mutex);
+static LIST_HEAD(ssif_infos);
+
+static int ssif_remove(struct i2c_client *client)
+{
+        struct ssif_info *ssif_info = i2c_get_clientdata(client);
+        int rv;
+
+        if (!ssif_info)
+                return 0;
+
+        i2c_set_clientdata(client, NULL);
+
+        /*
+         * After this point, we won't deliver anything asychronously
+         * to the message handler.  We can unregister ourself.
+         */
+        rv = ipmi_unregister_smi(ssif_info->intf);
+        if (rv) {
+                pr_err(PFX "Unable to unregister device: errno=%d\n", rv);
+                return rv;
+        }
+        ssif_info->intf = NULL;
+
+        /* make sure the driver is not looking for flags any more. */
+        while (ssif_info->ssif_state != SSIF_NORMAL)
+                schedule_timeout(1);
+
+        ssif_info->stopping = true;
+        del_timer_sync(&ssif_info->retry_timer);
+        if (ssif_info->thread) {
+                complete(&ssif_info->wake_thread);
+                kthread_stop(ssif_info->thread);
+        }
+
+        /*
+         * No message can be outstanding now, we have removed the
+         * upper layer and it permitted us to do so.
+         */
+        kfree(ssif_info);
+        return 0;
+}
+
+static int do_cmd(struct i2c_client *client, int len, unsigned char *msg,
+                  int *resp_len, unsigned char *resp)
+{
+        int retry_cnt;
+        int ret;
+
+        retry_cnt = SSIF_SEND_RETRIES;
+ retry1:
+        ret = i2c_smbus_write_block_data(client, SSIF_IPMI_REQUEST, len, msg);
+        if (ret) {
+                retry_cnt--;
+                if (retry_cnt > 0)
+                        goto retry1;
+                return -ENODEV;
+        }
+
+        ret = -ENODEV;
+        retry_cnt = SSIF_RECV_RETRIES;
+        while (retry_cnt > 0) {
+                ret = i2c_smbus_read_block_data(client, SSIF_IPMI_RESPONSE,
+                                                resp);
+                if (ret > 0)
+                        break;
+                msleep(SSIF_MSG_MSEC);
+                retry_cnt--;
+                if (retry_cnt <= 0)
+                        break;
+        }
+
+        if (ret > 0) {
+                /* Validate that the response is correct. */
+                if (ret < 3 ||
+                    (resp[0] != (msg[0] | (1 << 2))) ||
+                    (resp[1] != msg[1]))
+                        ret = -EINVAL;
+                else {
+                        *resp_len = ret;
+                        ret = 0;
+                }
+        }
+
+        return ret;
+}
+
+static int ssif_detect(struct i2c_client *client, struct i2c_board_info *info)
+{
+        unsigned char *resp;
+        unsigned char msg[3];
+        int           rv;
+        int           len;
+
+        resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        /* Do a Get Device ID command, since it is required. */
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_DEVICE_ID_CMD;
+        rv = do_cmd(client, 2, msg, &len, resp);
+        if (rv)
+                rv = -ENODEV;
+        else
+                strlcpy(info->type, DEVICE_NAME, I2C_NAME_SIZE);
+        kfree(resp);
+        return rv;
+}
+
+static int smi_type_proc_show(struct seq_file *m, void *v)
+{
+        return seq_puts(m, "ssif\n");
+}
+
+static int smi_type_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, smi_type_proc_show, inode->i_private);
+}
+
+static const struct file_operations smi_type_proc_ops = {
+        .open           = smi_type_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int smi_stats_proc_show(struct seq_file *m, void *v)
+{
+        struct ssif_info *ssif_info = m->private;
+
+        seq_printf(m, "sent_messages:          %u\n",
+                   ssif_get_stat(ssif_info, sent_messages));
+        seq_printf(m, "sent_messages_parts:    %u\n",
+                   ssif_get_stat(ssif_info, sent_messages_parts));
+        seq_printf(m, "send_retries:           %u\n",
+                   ssif_get_stat(ssif_info, send_retries));
+        seq_printf(m, "send_errors:            %u\n",
+                   ssif_get_stat(ssif_info, send_errors));
+        seq_printf(m, "received_messages:      %u\n",
+                   ssif_get_stat(ssif_info, received_messages));
+        seq_printf(m, "received_message_parts: %u\n",
+                   ssif_get_stat(ssif_info, received_message_parts));
+        seq_printf(m, "receive_retries:        %u\n",
+                   ssif_get_stat(ssif_info, receive_retries));
+        seq_printf(m, "receive_errors:         %u\n",
+                   ssif_get_stat(ssif_info, receive_errors));
+        seq_printf(m, "flag_fetches:           %u\n",
+                   ssif_get_stat(ssif_info, flag_fetches));
+        seq_printf(m, "hosed:                  %u\n",
+                   ssif_get_stat(ssif_info, hosed));
+        seq_printf(m, "events:                 %u\n",
+                   ssif_get_stat(ssif_info, events));
+        seq_printf(m, "watchdog_pretimeouts:   %u\n",
+                   ssif_get_stat(ssif_info, watchdog_pretimeouts));
+        return 0;
+}
+
+static int smi_stats_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
+}
+
+static const struct file_operations smi_stats_proc_ops = {
+        .open           = smi_stats_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct ssif_addr_info *ssif_info_find(unsigned short addr,
+                                             char *adapter_name,
+                                             bool match_null_name)
+{
+        struct ssif_addr_info *info, *found = NULL;
+
+restart:
+        list_for_each_entry(info, &ssif_infos, link) {
+                if (info->binfo.addr == addr) {
+                        if (info->adapter_name || adapter_name) {
+                                if (!info->adapter_name != !adapter_name) {
+                                        /* One is NULL and one is not */
+                                        continue;
+                                }
+                                if (strcmp(info->adapter_name, adapter_name))
+                                        /* Names to not match */
+                                        continue;
+                        }
+                        found = info;
+                        break;
+                }
+        }
+
+        if (!found && match_null_name) {
+                /* Try to get an exact match first, then try with a NULL name */
+                adapter_name = NULL;
+                match_null_name = false;
+                goto restart;
+        }
+
+        return found;
+}
+
+static bool check_acpi(struct ssif_info *ssif_info, struct device *dev)
+{
+#ifdef CONFIG_ACPI
+        acpi_handle acpi_handle;
+
+        acpi_handle = ACPI_HANDLE(dev);
+        if (acpi_handle) {
+                ssif_info->addr_source = SI_ACPI;
+                ssif_info->addr_info.acpi_info.acpi_handle = acpi_handle;
+                return true;
+        }
+#endif
+        return false;
+}
+
+static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+{
+        unsigned char     msg[3];
+        unsigned char     *resp;
+        struct ssif_info   *ssif_info;
+        int               rv = 0;
+        int               len;
+        int               i;
+        u8                slave_addr = 0;
+        struct ssif_addr_info *addr_info = NULL;
+
+
+        resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        ssif_info = kzalloc(sizeof(*ssif_info), GFP_KERNEL);
+        if (!ssif_info) {
+                kfree(resp);
+                return -ENOMEM;
+        }
+
+        if (!check_acpi(ssif_info, &client->dev)) {
+                addr_info = ssif_info_find(client->addr, client->adapter->name,
+                                           true);
+                if (!addr_info) {
+                        /* Must have come in through sysfs. */
+                        ssif_info->addr_source = SI_HOTMOD;
+                } else {
+                        ssif_info->addr_source = addr_info->addr_src;
+                        ssif_info->ssif_debug = addr_info->debug;
+                        ssif_info->addr_info = addr_info->addr_info;
+                        slave_addr = addr_info->slave_addr;
+                }
+        }
+
+        pr_info(PFX "Trying %s-specified SSIF interface at i2c address 0x%x, adapter %s, slave address 0x%x\n",
+               ipmi_addr_src_to_str(ssif_info->addr_source),
+               client->addr, client->adapter->name, slave_addr);
+
+        /*
+         * Do a Get Device ID command, since it comes back with some
+         * useful info.
+         */
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_DEVICE_ID_CMD;
+        rv = do_cmd(client, 2, msg, &len, resp);
+        if (rv)
+                goto out;
+
+        rv = ipmi_demangle_device_id(resp, len, &ssif_info->device_id);
+        if (rv)
+                goto out;
+
+        ssif_info->client = client;
+        i2c_set_clientdata(client, ssif_info);
+
+        /* Now check for system interface capabilities */
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD;
+        msg[2] = 0; /* SSIF */
+        rv = do_cmd(client, 3, msg, &len, resp);
+        if (!rv && (len >= 3) && (resp[2] == 0)) {
+                if (len < 7) {
+                        if (ssif_dbg_probe)
+                                pr_info(PFX "SSIF info too short: %d\n", len);
+                        goto no_support;
+                }
+
+                /* Got a good SSIF response, handle it. */
+                ssif_info->max_xmit_msg_size = resp[5];
+                ssif_info->max_recv_msg_size = resp[6];
+                ssif_info->multi_support = (resp[4] >> 6) & 0x3;
+                ssif_info->supports_pec = (resp[4] >> 3) & 0x1;
+
+                /* Sanitize the data */
+                switch (ssif_info->multi_support) {
+                case SSIF_NO_MULTI:
+                        if (ssif_info->max_xmit_msg_size > 32)
+                                ssif_info->max_xmit_msg_size = 32;
+                        if (ssif_info->max_recv_msg_size > 32)
+                                ssif_info->max_recv_msg_size = 32;
+                        break;
+
+                case SSIF_MULTI_2_PART:
+                        if (ssif_info->max_xmit_msg_size > 64)
+                                ssif_info->max_xmit_msg_size = 64;
+                        if (ssif_info->max_recv_msg_size > 62)
+                                ssif_info->max_recv_msg_size = 62;
+                        break;
+
+                case SSIF_MULTI_n_PART:
+                        break;
+
+                default:
+                        /* Data is not sane, just give up. */
+                        goto no_support;
+                }
+        } else {
+ no_support:
+                /* Assume no multi-part or PEC support */
+                pr_info(PFX "Error fetching SSIF: %d %d %2.2x, your system probably doesn't support this command so  using defaults\n",
+                       rv, len, resp[2]);
+
+                ssif_info->max_xmit_msg_size = 32;
+                ssif_info->max_recv_msg_size = 32;
+                ssif_info->multi_support = SSIF_NO_MULTI;
+                ssif_info->supports_pec = 0;
+        }
+
+        /* Make sure the NMI timeout is cleared. */
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
+        msg[2] = WDT_PRE_TIMEOUT_INT;
+        rv = do_cmd(client, 3, msg, &len, resp);
+        if (rv || (len < 3) || (resp[2] != 0))
+                pr_warn(PFX "Unable to clear message flags: %d %d %2.2x\n",
+                        rv, len, resp[2]);
+
+        /* Attempt to enable the event buffer. */
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
+        rv = do_cmd(client, 2, msg, &len, resp);
+        if (rv || (len < 4) || (resp[2] != 0)) {
+                pr_warn(PFX "Error getting global enables: %d %d %2.2x\n",
+                        rv, len, resp[2]);
+                rv = 0; /* Not fatal */
+                goto found;
+        }
+
+        if (resp[3] & IPMI_BMC_EVT_MSG_BUFF) {
+                ssif_info->has_event_buffer = true;
+                /* buffer is already enabled, nothing to do. */
+                goto found;
+        }
+
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
+        msg[2] = resp[3] | IPMI_BMC_EVT_MSG_BUFF;
+        rv = do_cmd(client, 3, msg, &len, resp);
+        if (rv || (len < 2)) {
+                pr_warn(PFX "Error getting global enables: %d %d %2.2x\n",
+                        rv, len, resp[2]);
+                rv = 0; /* Not fatal */
+                goto found;
+        }
+
+        if (resp[2] == 0)
+                /* A successful return means the event buffer is supported. */
+                ssif_info->has_event_buffer = true;
+
+ found:
+        ssif_info->intf_num = atomic_inc_return(&next_intf);
+
+        if (ssif_dbg_probe) {
+                pr_info("ssif_probe: i2c_probe found device at i2c address %x\n",
+                        client->addr);
+        }
+
+        spin_lock_init(&ssif_info->lock);
+        ssif_info->ssif_state = SSIF_NORMAL;
+        init_timer(&ssif_info->retry_timer);
+        ssif_info->retry_timer.data = (unsigned long) ssif_info;
+        ssif_info->retry_timer.function = retry_timeout;
+
+        for (i = 0; i < SSIF_NUM_STATS; i++)
+                atomic_set(&ssif_info->stats[i], 0);
+
+        if (ssif_info->supports_pec)
+                ssif_info->client->flags |= I2C_CLIENT_PEC;
+
+        ssif_info->handlers.owner = THIS_MODULE;
+        ssif_info->handlers.start_processing = ssif_start_processing;
+        ssif_info->handlers.get_smi_info = get_smi_info;
+        ssif_info->handlers.sender = sender;
+        ssif_info->handlers.request_events = request_events;
+        ssif_info->handlers.inc_usecount = inc_usecount;
+        ssif_info->handlers.dec_usecount = dec_usecount;
+
+        {
+                unsigned int thread_num;
+
+                thread_num = ((ssif_info->client->adapter->nr << 8) |
+                              ssif_info->client->addr);
+                init_completion(&ssif_info->wake_thread);
+                ssif_info->thread = kthread_run(ipmi_ssif_thread, ssif_info,
+                                               "kssif%4.4x", thread_num);
+                if (IS_ERR(ssif_info->thread)) {
+                        rv = PTR_ERR(ssif_info->thread);
+                        dev_notice(&ssif_info->client->dev,
+                                   "Could not start kernel thread: error %d\n",
+                                   rv);
+                        goto out;
+                }
+        }
+
+        rv = ipmi_register_smi(&ssif_info->handlers,
+                               ssif_info,
+                               &ssif_info->device_id,
+                               &ssif_info->client->dev,
+                               slave_addr);
+         if (rv) {
+                pr_err(PFX "Unable to register device: error %d\n", rv);
+                goto out;
+        }
+
+        rv = ipmi_smi_add_proc_entry(ssif_info->intf, "type",
+                                     &smi_type_proc_ops,
+                                     ssif_info);
+        if (rv) {
+                pr_err(PFX "Unable to create proc entry: %d\n", rv);
+                goto out_err_unreg;
+        }
+
+        rv = ipmi_smi_add_proc_entry(ssif_info->intf, "ssif_stats",
+                                     &smi_stats_proc_ops,
+                                     ssif_info);
+        if (rv) {
+                pr_err(PFX "Unable to create proc entry: %d\n", rv);
+                goto out_err_unreg;
+        }
+
+ out:
+        if (rv)
+                kfree(ssif_info);
+        kfree(resp);
+        return rv;
+
+ out_err_unreg:
+        ipmi_unregister_smi(ssif_info->intf);
+        goto out;
+}
+
+static int ssif_adapter_handler(struct device *adev, void *opaque)
+{
+        struct ssif_addr_info *addr_info = opaque;
+
+        if (adev->type != &i2c_adapter_type)
+                return 0;
+
+        i2c_new_device(to_i2c_adapter(adev), &addr_info->binfo);
+
+        if (!addr_info->adapter_name)
+                return 1; /* Only try the first I2C adapter by default. */
+        return 0;
+}
+
+static int new_ssif_client(int addr, char *adapter_name,
+                           int debug, int slave_addr,
+                           enum ipmi_addr_src addr_src)
+{
+        struct ssif_addr_info *addr_info;
+        int rv = 0;
+
+        mutex_lock(&ssif_infos_mutex);
+        if (ssif_info_find(addr, adapter_name, false)) {
+                rv = -EEXIST;
+                goto out_unlock;
+        }
+
+        addr_info = kzalloc(sizeof(*addr_info), GFP_KERNEL);
+        if (!addr_info) {
+                rv = -ENOMEM;
+                goto out_unlock;
+        }
+
+        if (adapter_name) {
+                addr_info->adapter_name = kstrdup(adapter_name, GFP_KERNEL);
+                if (!addr_info->adapter_name) {
+                        kfree(addr_info);
+                        rv = -ENOMEM;
+                        goto out_unlock;
+                }
+        }
+
+        strncpy(addr_info->binfo.type, DEVICE_NAME,
+                sizeof(addr_info->binfo.type));
+        addr_info->binfo.addr = addr;
+        addr_info->binfo.platform_data = addr_info;
+        addr_info->debug = debug;
+        addr_info->slave_addr = slave_addr;
+        addr_info->addr_src = addr_src;
+
+        list_add_tail(&addr_info->link, &ssif_infos);
+
+        if (initialized)
+                i2c_for_each_dev(addr_info, ssif_adapter_handler);
+        /* Otherwise address list will get it */
+
+out_unlock:
+        mutex_unlock(&ssif_infos_mutex);
+        return rv;
+}
+
+static void free_ssif_clients(void)
+{
+        struct ssif_addr_info *info, *tmp;
+
+        mutex_lock(&ssif_infos_mutex);
+        list_for_each_entry_safe(info, tmp, &ssif_infos, link) {
+                list_del(&info->link);
+                kfree(info->adapter_name);
+                kfree(info);
+        }
+        mutex_unlock(&ssif_infos_mutex);
+}
+
+static unsigned short *ssif_address_list(void)
+{
+        struct ssif_addr_info *info;
+        unsigned int count = 0, i;
+        unsigned short *address_list;
+
+        list_for_each_entry(info, &ssif_infos, link)
+                count++;
+
+        address_list = kzalloc(sizeof(*address_list) * (count + 1), GFP_KERNEL);
+        if (!address_list)
+                return NULL;
+
+        i = 0;
+        list_for_each_entry(info, &ssif_infos, link) {
+                unsigned short addr = info->binfo.addr;
+                int j;
+
+                for (j = 0; j < i; j++) {
+                        if (address_list[j] == addr)
+                                goto skip_addr;
+                }
+                address_list[i] = addr;
+skip_addr:
+                i++;
+        }
+        address_list[i] = I2C_CLIENT_END;
+
+        return address_list;
+}
+
+#ifdef CONFIG_ACPI
+static struct acpi_device_id ssif_acpi_match[] = {
+        { "IPI0001", 0 },
+        { },
+};
+MODULE_DEVICE_TABLE(acpi, ssif_acpi_match);
+
+/*
+ * Once we get an ACPI failure, we don't try any more, because we go
+ * through the tables sequentially.  Once we don't find a table, there
+ * are no more.
+ */
+static int acpi_failure;
+
+/*
+ * Defined in the IPMI 2.0 spec.
+ */
+struct SPMITable {
+        s8      Signature[4];
+        u32     Length;
+        u8      Revision;
+        u8      Checksum;
+        s8      OEMID[6];
+        s8      OEMTableID[8];
+        s8      OEMRevision[4];
+        s8      CreatorID[4];
+        s8      CreatorRevision[4];
+        u8      InterfaceType;
+        u8      IPMIlegacy;
+        s16     SpecificationRevision;
+
+        /*
+         * Bit 0 - SCI interrupt supported
+         * Bit 1 - I/O APIC/SAPIC
+         */
+        u8      InterruptType;
+
+        /*
+         * If bit 0 of InterruptType is set, then this is the SCI
+         * interrupt in the GPEx_STS register.
+         */
+        u8      GPE;
+
+        s16     Reserved;
+
+        /*
+         * If bit 1 of InterruptType is set, then this is the I/O
+         * APIC/SAPIC interrupt.
+         */
+        u32     GlobalSystemInterrupt;
+
+        /* The actual register address. */
+        struct acpi_generic_address addr;
+
+        u8      UID[4];
+
+        s8      spmi_id[1]; /* A '\0' terminated array starts here. */
+};
+
+static int try_init_spmi(struct SPMITable *spmi)
+{
+        unsigned short myaddr;
+
+        if (num_addrs >= MAX_SSIF_BMCS)
+                return -1;
+
+        if (spmi->IPMIlegacy != 1) {
+                pr_warn("IPMI: Bad SPMI legacy: %d\n", spmi->IPMIlegacy);
+                return -ENODEV;
+        }
+
+        if (spmi->InterfaceType != 4)
+                return -ENODEV;
+
+        if (spmi->addr.space_id != ACPI_ADR_SPACE_SMBUS) {
+                pr_warn(PFX "Invalid ACPI SSIF I/O Address type: %d\n",
+                        spmi->addr.space_id);
+                return -EIO;
+        }
+
+        myaddr = spmi->addr.address >> 1;
+
+        return new_ssif_client(myaddr, NULL, 0, 0, SI_SPMI);
+}
+
+static void spmi_find_bmc(void)
+{
+        acpi_status      status;
+        struct SPMITable *spmi;
+        int              i;
+
+        if (acpi_disabled)
+                return;
+
+        if (acpi_failure)
+                return;
+
+        for (i = 0; ; i++) {
+                status = acpi_get_table(ACPI_SIG_SPMI, i+1,
+                                        (struct acpi_table_header **)&spmi);
+                if (status != AE_OK)
+                        return;
+
+                try_init_spmi(spmi);
+        }
+}
+#else
+static void spmi_find_bmc(void) { }
+#endif
+
+#ifdef CONFIG_DMI
+static int decode_dmi(const struct dmi_device *dmi_dev)
+{
+        struct dmi_header *dm = dmi_dev->device_data;
+        u8             *data = (u8 *) dm;
+        u8             len = dm->length;
+        unsigned short myaddr;
+        int            slave_addr;
+
+        if (num_addrs >= MAX_SSIF_BMCS)
+                return -1;
+
+        if (len < 9)
+                return -1;
+
+        if (data[0x04] != 4) /* Not SSIF */
+                return -1;
+
+        if ((data[8] >> 1) == 0) {
+                /*
+                 * Some broken systems put the I2C address in
+                 * the slave address field.  We try to
+                 * accommodate them here.
+                 */
+                myaddr = data[6] >> 1;
+                slave_addr = 0;
+        } else {
+                myaddr = data[8] >> 1;
+                slave_addr = data[6];
+        }
+
+        return new_ssif_client(myaddr, NULL, 0, 0, SI_SMBIOS);
+}
+
+static void dmi_iterator(void)
+{
+        const struct dmi_device *dev = NULL;
+
+        while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))
+                decode_dmi(dev);
+}
+#else
+static void dmi_iterator(void) { }
+#endif
+
+static const struct i2c_device_id ssif_id[] = {
+        { DEVICE_NAME, 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, ssif_id);
+
+static struct i2c_driver ssif_i2c_driver = {
+        .class          = I2C_CLASS_HWMON,
+        .driver         = {
+                .owner                  = THIS_MODULE,
+                .name                   = DEVICE_NAME
+        },
+        .probe          = ssif_probe,
+        .remove         = ssif_remove,
+        .id_table       = ssif_id,
+        .detect         = ssif_detect
+};
+
+static int init_ipmi_ssif(void)
+{
+        int i;
+        int rv;
+
+        if (initialized)
+                return 0;
+
+        pr_info("IPMI SSIF Interface driver\n");
+
+        /* build list for i2c from addr list */
+        for (i = 0; i < num_addrs; i++) {
+                rv = new_ssif_client(addr[i], adapter_name[i],
+                                     dbg[i], slave_addrs[i],
+                                     SI_HARDCODED);
+                if (!rv)
+                        pr_err(PFX
+                               "Couldn't add hardcoded device at addr 0x%x\n",
+                               addr[i]);
+        }
+
+        if (ssif_tryacpi)
+                ssif_i2c_driver.driver.acpi_match_table =
+                        ACPI_PTR(ssif_acpi_match);
+        if (ssif_trydmi)
+                dmi_iterator();
+        if (ssif_tryacpi)
+                spmi_find_bmc();
+
+        ssif_i2c_driver.address_list = ssif_address_list();
+
+        rv = i2c_add_driver(&ssif_i2c_driver);
+        if (!rv)
+                initialized = true;
+
+        return rv;
+}
+module_init(init_ipmi_ssif);
+
+static void cleanup_ipmi_ssif(void)
+{
+        if (!initialized)
+                return;
+
+        initialized = false;
+
+        i2c_del_driver(&ssif_i2c_driver);
+
+        free_ssif_clients();
+}
+module_exit(cleanup_ipmi_ssif);
+
+MODULE_AUTHOR("Todd C Davis <todd.c.davis@intel.com>, Corey Minyard <minyard@acm.org>");
+MODULE_DESCRIPTION("IPMI driver for management controllers on a SMBus");
+MODULE_LICENSE("GPL");
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 455fd17d938e..3f44f292d066 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -28,7 +28,7 @@ config COMMON_CLK_WM831X
         depends on MFD_WM831X
         ---help---
           Supports the clocking subsystem of the WM831x/2x series of
-          PMICs from Wolfson Microlectronics.
+          PMICs from Wolfson Microelectronics.
 
 source "drivers/clk/versatile/Kconfig"
 
diff --git a/drivers/clk/clk-ls1x.c b/drivers/clk/clk-ls1x.c
index f20b750235f6..ca80103ac188 100644
--- a/drivers/clk/clk-ls1x.c
+++ b/drivers/clk/clk-ls1x.c
@@ -15,7 +15,8 @@
 
 #include <loongson1.h>
 
-#define OSC     33
+#define OSC             (33 * 1000000)
+#define DIV_APB         2
 
 static DEFINE_SPINLOCK(_lock);
 
@@ -29,13 +30,12 @@ static void ls1x_pll_clk_disable(struct clk_hw *hw)
 }
 
 static unsigned long ls1x_pll_recalc_rate(struct clk_hw *hw,
-                                             unsigned long parent_rate)
+                                          unsigned long parent_rate)
 {
         u32 pll, rate;
 
         pll = __raw_readl(LS1X_CLK_PLL_FREQ);
-        rate = ((12 + (pll & 0x3f)) * 1000000) +
-                ((((pll >> 8) & 0x3ff) * 1000000) >> 10);
+        rate = 12 + (pll & 0x3f) + (((pll >> 8) & 0x3ff) >> 10);
         rate *= OSC;
         rate >>= 1;
 
@@ -48,8 +48,10 @@ static const struct clk_ops ls1x_pll_clk_ops = {
         .recalc_rate = ls1x_pll_recalc_rate,
 };
 
-static struct clk * __init clk_register_pll(struct device *dev,
-         const char *name, const char *parent_name, unsigned long flags)
+static struct clk *__init clk_register_pll(struct device *dev,
+                                           const char *name,
+                                           const char *parent_name,
+                                           unsigned long flags)
 {
         struct clk_hw *hw;
         struct clk *clk;
@@ -78,34 +80,83 @@ static struct clk * __init clk_register_pll(struct device *dev,
         return clk;
 }
 
+static const char const *cpu_parents[] = { "cpu_clk_div", "osc_33m_clk", };
+static const char const *ahb_parents[] = { "ahb_clk_div", "osc_33m_clk", };
+static const char const *dc_parents[] = { "dc_clk_div", "osc_33m_clk", };
+
 void __init ls1x_clk_init(void)
 {
         struct clk *clk;
 
-        clk = clk_register_pll(NULL, "pll_clk", NULL, CLK_IS_ROOT);
-        clk_prepare_enable(clk);
-
-        clk = clk_register_divider(NULL, "cpu_clk", "pll_clk",
-                        CLK_SET_RATE_PARENT, LS1X_CLK_PLL_DIV, DIV_CPU_SHIFT,
-                        DIV_CPU_WIDTH, CLK_DIVIDER_ONE_BASED, &_lock);
-        clk_prepare_enable(clk);
-        clk_register_clkdev(clk, "cpu", NULL);
-
-        clk = clk_register_divider(NULL, "dc_clk", "pll_clk",
-                        CLK_SET_RATE_PARENT, LS1X_CLK_PLL_DIV, DIV_DC_SHIFT,
-                        DIV_DC_WIDTH, CLK_DIVIDER_ONE_BASED, &_lock);
-        clk_prepare_enable(clk);
-        clk_register_clkdev(clk, "dc", NULL);
-
-        clk = clk_register_divider(NULL, "ahb_clk", "pll_clk",
-                        CLK_SET_RATE_PARENT, LS1X_CLK_PLL_DIV, DIV_DDR_SHIFT,
-                        DIV_DDR_WIDTH, CLK_DIVIDER_ONE_BASED, &_lock);
-        clk_prepare_enable(clk);
-        clk_register_clkdev(clk, "ahb", NULL);
+        clk = clk_register_fixed_rate(NULL, "osc_33m_clk", NULL, CLK_IS_ROOT,
+                                      OSC);
+        clk_register_clkdev(clk, "osc_33m_clk", NULL);
+
+        /* clock derived from 33 MHz OSC clk */
+        clk = clk_register_pll(NULL, "pll_clk", "osc_33m_clk", 0);
+        clk_register_clkdev(clk, "pll_clk", NULL);
+
+        /* clock derived from PLL clk */
+        /*                                 _____
+         *         _______________________|     |
+         * OSC ___/                       | MUX |___ CPU CLK
+         *        \___ PLL ___ CPU DIV ___|     |
+         *                                |_____|
+         */
+        clk = clk_register_divider(NULL, "cpu_clk_div", "pll_clk",
+                                   CLK_GET_RATE_NOCACHE, LS1X_CLK_PLL_DIV,
+                                   DIV_CPU_SHIFT, DIV_CPU_WIDTH,
+                                   CLK_DIVIDER_ONE_BASED |
+                                   CLK_DIVIDER_ROUND_CLOSEST, &_lock);
+        clk_register_clkdev(clk, "cpu_clk_div", NULL);
+        clk = clk_register_mux(NULL, "cpu_clk", cpu_parents,
+                               ARRAY_SIZE(cpu_parents),
+                               CLK_SET_RATE_NO_REPARENT, LS1X_CLK_PLL_DIV,
+                               BYPASS_CPU_SHIFT, BYPASS_CPU_WIDTH, 0, &_lock);
+        clk_register_clkdev(clk, "cpu_clk", NULL);
+
+        /*                                 _____
+         *         _______________________|     |
+         * OSC ___/                       | MUX |___ DC  CLK
+         *        \___ PLL ___ DC  DIV ___|     |
+         *                                |_____|
+         */
+        clk = clk_register_divider(NULL, "dc_clk_div", "pll_clk",
+                                   0, LS1X_CLK_PLL_DIV, DIV_DC_SHIFT,
+                                   DIV_DC_WIDTH, CLK_DIVIDER_ONE_BASED, &_lock);
+        clk_register_clkdev(clk, "dc_clk_div", NULL);
+        clk = clk_register_mux(NULL, "dc_clk", dc_parents,
+                               ARRAY_SIZE(dc_parents),
+                               CLK_SET_RATE_NO_REPARENT, LS1X_CLK_PLL_DIV,
+                               BYPASS_DC_SHIFT, BYPASS_DC_WIDTH, 0, &_lock);
+        clk_register_clkdev(clk, "dc_clk", NULL);
+
+        /*                                 _____
+         *         _______________________|     |
+         * OSC ___/                       | MUX |___ DDR CLK
+         *        \___ PLL ___ DDR DIV ___|     |
+         *                                |_____|
+         */
+        clk = clk_register_divider(NULL, "ahb_clk_div", "pll_clk",
+                                   0, LS1X_CLK_PLL_DIV, DIV_DDR_SHIFT,
+                                   DIV_DDR_WIDTH, CLK_DIVIDER_ONE_BASED,
+                                   &_lock);
+        clk_register_clkdev(clk, "ahb_clk_div", NULL);
+        clk = clk_register_mux(NULL, "ahb_clk", ahb_parents,
+                               ARRAY_SIZE(ahb_parents),
+                               CLK_SET_RATE_NO_REPARENT, LS1X_CLK_PLL_DIV,
+                               BYPASS_DDR_SHIFT, BYPASS_DDR_WIDTH, 0, &_lock);
+        clk_register_clkdev(clk, "ahb_clk", NULL);
         clk_register_clkdev(clk, "stmmaceth", NULL);
 
-        clk = clk_register_fixed_factor(NULL, "apb_clk", "ahb_clk", 0, 1, 2);
-        clk_prepare_enable(clk);
-        clk_register_clkdev(clk, "apb", NULL);
+        /* clock derived from AHB clk */
+        /* APB clk is always half of the AHB clk */
+        clk = clk_register_fixed_factor(NULL, "apb_clk", "ahb_clk", 0, 1,
+                                        DIV_APB);
+        clk_register_clkdev(clk, "apb_clk", NULL);
+        clk_register_clkdev(clk, "ls1x_i2c", NULL);
+        clk_register_clkdev(clk, "ls1x_pwmtimer", NULL);
+        clk_register_clkdev(clk, "ls1x_spi", NULL);
+        clk_register_clkdev(clk, "ls1x_wdt", NULL);
         clk_register_clkdev(clk, "serial8250", NULL);
 }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index f657a48d20eb..fc01ec27d3c8 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -224,4 +224,9 @@ config CLKSRC_VERSATILE
           ARM Versatile, RealView and Versatile Express reference
           platforms.
 
+config CLKSRC_MIPS_GIC
+        bool
+        depends on MIPS_GIC
+        select CLKSRC_OF
+
 endmenu
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index fae0435cc23d..94d90b24b56b 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -47,3 +47,4 @@ obj-$(CONFIG_ARCH_HAS_TICK_BROADCAST)	+= dummy_timer.o
 obj-$(CONFIG_ARCH_KEYSTONE)             += timer-keystone.o
 obj-$(CONFIG_ARCH_INTEGRATOR_AP)        += timer-integrator-ap.o
 obj-$(CONFIG_CLKSRC_VERSATILE)          += versatile.o
+obj-$(CONFIG_CLKSRC_MIPS_GIC)           += mips-gic-timer.o
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
new file mode 100644
index 000000000000..3bd31b1321f6
--- /dev/null
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -0,0 +1,166 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
+ */
+#include <linux/clockchips.h>
+#include <linux/cpu.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irqchip/mips-gic.h>
+#include <linux/notifier.h>
+#include <linux/of_irq.h>
+#include <linux/percpu.h>
+#include <linux/smp.h>
+#include <linux/time.h>
+
+static DEFINE_PER_CPU(struct clock_event_device, gic_clockevent_device);
+static int gic_timer_irq;
+static unsigned int gic_frequency;
+
+static int gic_next_event(unsigned long delta, struct clock_event_device *evt)
+{
+        u64 cnt;
+        int res;
+
+        cnt = gic_read_count();
+        cnt += (u64)delta;
+        gic_write_cpu_compare(cnt, cpumask_first(evt->cpumask));
+        res = ((int)(gic_read_count() - cnt) >= 0) ? -ETIME : 0;
+        return res;
+}
+
+static void gic_set_clock_mode(enum clock_event_mode mode,
+                                struct clock_event_device *evt)
+{
+        /* Nothing to do ...  */
+}
+
+static irqreturn_t gic_compare_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *cd = dev_id;
+
+        gic_write_compare(gic_read_compare());
+        cd->event_handler(cd);
+        return IRQ_HANDLED;
+}
+
+struct irqaction gic_compare_irqaction = {
+        .handler = gic_compare_interrupt,
+        .percpu_dev_id = &gic_clockevent_device,
+        .flags = IRQF_PERCPU | IRQF_TIMER,
+        .name = "timer",
+};
+
+static void gic_clockevent_cpu_init(struct clock_event_device *cd)
+{
+        unsigned int cpu = smp_processor_id();
+
+        cd->name                = "MIPS GIC";
+        cd->features            = CLOCK_EVT_FEAT_ONESHOT |
+                                  CLOCK_EVT_FEAT_C3STOP;
+
+        cd->rating              = 350;
+        cd->irq                 = gic_timer_irq;
+        cd->cpumask             = cpumask_of(cpu);
+        cd->set_next_event      = gic_next_event;
+        cd->set_mode            = gic_set_clock_mode;
+
+        clockevents_config_and_register(cd, gic_frequency, 0x300, 0x7fffffff);
+
+        enable_percpu_irq(gic_timer_irq, IRQ_TYPE_NONE);
+}
+
+static void gic_clockevent_cpu_exit(struct clock_event_device *cd)
+{
+        disable_percpu_irq(gic_timer_irq);
+}
+
+static int gic_cpu_notifier(struct notifier_block *nb, unsigned long action,
+                                void *data)
+{
+        switch (action & ~CPU_TASKS_FROZEN) {
+        case CPU_STARTING:
+                gic_clockevent_cpu_init(this_cpu_ptr(&gic_clockevent_device));
+                break;
+        case CPU_DYING:
+                gic_clockevent_cpu_exit(this_cpu_ptr(&gic_clockevent_device));
+                break;
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block gic_cpu_nb = {
+        .notifier_call = gic_cpu_notifier,
+};
+
+static int gic_clockevent_init(void)
+{
+        if (!cpu_has_counter || !gic_frequency)
+                return -ENXIO;
+
+        setup_percpu_irq(gic_timer_irq, &gic_compare_irqaction);
+
+        register_cpu_notifier(&gic_cpu_nb);
+
+        gic_clockevent_cpu_init(this_cpu_ptr(&gic_clockevent_device));
+
+        return 0;
+}
+
+static cycle_t gic_hpt_read(struct clocksource *cs)
+{
+        return gic_read_count();
+}
+
+static struct clocksource gic_clocksource = {
+        .name   = "GIC",
+        .read   = gic_hpt_read,
+        .flags  = CLOCK_SOURCE_IS_CONTINUOUS,
+};
+
+static void __init __gic_clocksource_init(void)
+{
+        /* Set clocksource mask. */
+        gic_clocksource.mask = CLOCKSOURCE_MASK(gic_get_count_width());
+
+        /* Calculate a somewhat reasonable rating value. */
+        gic_clocksource.rating = 200 + gic_frequency / 10000000;
+
+        clocksource_register_hz(&gic_clocksource, gic_frequency);
+
+        gic_clockevent_init();
+}
+
+void __init gic_clocksource_init(unsigned int frequency)
+{
+        gic_frequency = frequency;
+        gic_timer_irq = MIPS_GIC_IRQ_BASE +
+                GIC_LOCAL_TO_HWIRQ(GIC_LOCAL_INT_COMPARE);
+
+        __gic_clocksource_init();
+}
+
+static void __init gic_clocksource_of_init(struct device_node *node)
+{
+        if (WARN_ON(!gic_present || !node->parent ||
+                    !of_device_is_compatible(node->parent, "mti,gic")))
+                return;
+
+        if (of_property_read_u32(node, "clock-frequency", &gic_frequency)) {
+                pr_err("GIC frequency not specified.\n");
+                return;
+        }
+        gic_timer_irq = irq_of_parse_and_map(node, 0);
+        if (!gic_timer_irq) {
+                pr_err("GIC timer IRQ not specified.\n");
+                return;
+        }
+
+        __gic_clocksource_init();
+}
+CLOCKSOURCE_OF_DECLARE(mips_gic_timer, "mti,gic-timer",
+                       gic_clocksource_of_init);
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index 9bc2720628a4..91ebe282b106 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -197,7 +197,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
 
         ret = allocate_resources(policy->cpu, &cpu_dev, &cpu_reg, &cpu_clk);
         if (ret) {
-                pr_err("%s: Failed to allocate resources\n: %d", __func__, ret);
+                pr_err("%s: Failed to allocate resources: %d\n", __func__, ret);
                 return ret;
         }
 
diff --git a/drivers/dma-buf/fence.c b/drivers/dma-buf/fence.c
index 7bb9d65d9a2c..e5541117b3e9 100644
--- a/drivers/dma-buf/fence.c
+++ b/drivers/dma-buf/fence.c
@@ -283,7 +283,7 @@ EXPORT_SYMBOL(fence_add_callback);
  * @cb:         [in]    the callback to remove
  *
  * Remove a previously queued callback from the fence. This function returns
- * true if the callback is succesfully removed, or false if the fence has
+ * true if the callback is successfully removed, or false if the fence has
  * already been signaled.
  *
  * *WARNING*:
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index de469821bc1b..f2b2c4e87aef 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -107,6 +107,13 @@ config AT_HDMAC
         help
           Support the Atmel AHB DMA controller.
 
+config AT_XDMAC
+        tristate "Atmel XDMA support"
+        depends on ARCH_AT91
+        select DMA_ENGINE
+        help
+          Support the Atmel XDMA controller.
+
 config FSL_DMA
         tristate "Freescale Elo series DMA support"
         depends on FSL_SOC
@@ -395,12 +402,12 @@ config XILINX_VDMA
 
 config DMA_SUN6I
         tristate "Allwinner A31 SoCs DMA support"
-        depends on MACH_SUN6I || COMPILE_TEST
+        depends on MACH_SUN6I || MACH_SUN8I || COMPILE_TEST
         depends on RESET_CONTROLLER
         select DMA_ENGINE
         select DMA_VIRTUAL_CHANNELS
         help
-          Support for the DMA engine for Allwinner A31 SoCs.
+          Support for the DMA engine first found in Allwinner A31 SoCs.
 
 config NBPFAXI_DMA
         tristate "Renesas Type-AXI NBPF DMA support"
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index cb626c179911..2022b5451377 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_PPC_BESTCOMM) += bestcomm/
 obj-$(CONFIG_MV_XOR) += mv_xor.o
 obj-$(CONFIG_DW_DMAC_CORE) += dw/
 obj-$(CONFIG_AT_HDMAC) += at_hdmac.o
+obj-$(CONFIG_AT_XDMAC) += at_xdmac.o
 obj-$(CONFIG_MX3_IPU) += ipu/
 obj-$(CONFIG_TXX9_DMAC) += txx9dmac.o
 obj-$(CONFIG_SH_DMAE_BASE) += sh/
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index e34024b000a4..1364d00881dd 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -2164,7 +2164,6 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
                          __func__, ret);
                 goto out_no_memcpy;
         }
-        pl08x->memcpy.chancnt = ret;
 
         /* Register slave channels */
         ret = pl08x_dma_init_virtual_channels(pl08x, &pl08x->slave,
@@ -2175,7 +2174,6 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
                                 __func__, ret);
                 goto out_no_slave;
         }
-        pl08x->slave.chancnt = ret;
 
         ret = dma_async_device_register(&pl08x->memcpy);
         if (ret) {
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
new file mode 100644
index 000000000000..b60d77a22df6
--- /dev/null
+++ b/drivers/dma/at_xdmac.c
@@ -0,0 +1,1524 @@
+/*
+ * Driver for the Atmel Extensible DMA Controller (aka XDMAC on AT91 systems)
+ *
+ * Copyright (C) 2014 Atmel Corporation
+ *
+ * Author: Ludovic Desroches <ludovic.desroches@atmel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <asm/barrier.h>
+#include <dt-bindings/dma/at91.h>
+#include <linux/clk.h>
+#include <linux/dmaengine.h>
+#include <linux/dmapool.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/of_dma.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/pm.h>
+
+#include "dmaengine.h"
+
+/* Global registers */
+#define AT_XDMAC_GTYPE          0x00    /* Global Type Register */
+#define         AT_XDMAC_NB_CH(i)       (((i) & 0x1F) + 1)              /* Number of Channels Minus One */
+#define         AT_XDMAC_FIFO_SZ(i)     (((i) >> 5) & 0x7FF)            /* Number of Bytes */
+#define         AT_XDMAC_NB_REQ(i)      ((((i) >> 16) & 0x3F) + 1)      /* Number of Peripheral Requests Minus One */
+#define AT_XDMAC_GCFG           0x04    /* Global Configuration Register */
+#define AT_XDMAC_GWAC           0x08    /* Global Weighted Arbiter Configuration Register */
+#define AT_XDMAC_GIE            0x0C    /* Global Interrupt Enable Register */
+#define AT_XDMAC_GID            0x10    /* Global Interrupt Disable Register */
+#define AT_XDMAC_GIM            0x14    /* Global Interrupt Mask Register */
+#define AT_XDMAC_GIS            0x18    /* Global Interrupt Status Register */
+#define AT_XDMAC_GE             0x1C    /* Global Channel Enable Register */
+#define AT_XDMAC_GD             0x20    /* Global Channel Disable Register */
+#define AT_XDMAC_GS             0x24    /* Global Channel Status Register */
+#define AT_XDMAC_GRS            0x28    /* Global Channel Read Suspend Register */
+#define AT_XDMAC_GWS            0x2C    /* Global Write Suspend Register */
+#define AT_XDMAC_GRWS           0x30    /* Global Channel Read Write Suspend Register */
+#define AT_XDMAC_GRWR           0x34    /* Global Channel Read Write Resume Register */
+#define AT_XDMAC_GSWR           0x38    /* Global Channel Software Request Register */
+#define AT_XDMAC_GSWS           0x3C    /* Global channel Software Request Status Register */
+#define AT_XDMAC_GSWF           0x40    /* Global Channel Software Flush Request Register */
+#define AT_XDMAC_VERSION        0xFFC   /* XDMAC Version Register */
+
+/* Channel relative registers offsets */
+#define AT_XDMAC_CIE            0x00    /* Channel Interrupt Enable Register */
+#define         AT_XDMAC_CIE_BIE        BIT(0)  /* End of Block Interrupt Enable Bit */
+#define         AT_XDMAC_CIE_LIE        BIT(1)  /* End of Linked List Interrupt Enable Bit */
+#define         AT_XDMAC_CIE_DIE        BIT(2)  /* End of Disable Interrupt Enable Bit */
+#define         AT_XDMAC_CIE_FIE        BIT(3)  /* End of Flush Interrupt Enable Bit */
+#define         AT_XDMAC_CIE_RBEIE      BIT(4)  /* Read Bus Error Interrupt Enable Bit */
+#define         AT_XDMAC_CIE_WBEIE      BIT(5)  /* Write Bus Error Interrupt Enable Bit */
+#define         AT_XDMAC_CIE_ROIE       BIT(6)  /* Request Overflow Interrupt Enable Bit */
+#define AT_XDMAC_CID            0x04    /* Channel Interrupt Disable Register */
+#define         AT_XDMAC_CID_BID        BIT(0)  /* End of Block Interrupt Disable Bit */
+#define         AT_XDMAC_CID_LID        BIT(1)  /* End of Linked List Interrupt Disable Bit */
+#define         AT_XDMAC_CID_DID        BIT(2)  /* End of Disable Interrupt Disable Bit */
+#define         AT_XDMAC_CID_FID        BIT(3)  /* End of Flush Interrupt Disable Bit */
+#define         AT_XDMAC_CID_RBEID      BIT(4)  /* Read Bus Error Interrupt Disable Bit */
+#define         AT_XDMAC_CID_WBEID      BIT(5)  /* Write Bus Error Interrupt Disable Bit */
+#define         AT_XDMAC_CID_ROID       BIT(6)  /* Request Overflow Interrupt Disable Bit */
+#define AT_XDMAC_CIM            0x08    /* Channel Interrupt Mask Register */
+#define         AT_XDMAC_CIM_BIM        BIT(0)  /* End of Block Interrupt Mask Bit */
+#define         AT_XDMAC_CIM_LIM        BIT(1)  /* End of Linked List Interrupt Mask Bit */
+#define         AT_XDMAC_CIM_DIM        BIT(2)  /* End of Disable Interrupt Mask Bit */
+#define         AT_XDMAC_CIM_FIM        BIT(3)  /* End of Flush Interrupt Mask Bit */
+#define         AT_XDMAC_CIM_RBEIM      BIT(4)  /* Read Bus Error Interrupt Mask Bit */
+#define         AT_XDMAC_CIM_WBEIM      BIT(5)  /* Write Bus Error Interrupt Mask Bit */
+#define         AT_XDMAC_CIM_ROIM       BIT(6)  /* Request Overflow Interrupt Mask Bit */
+#define AT_XDMAC_CIS            0x0C    /* Channel Interrupt Status Register */
+#define         AT_XDMAC_CIS_BIS        BIT(0)  /* End of Block Interrupt Status Bit */
+#define         AT_XDMAC_CIS_LIS        BIT(1)  /* End of Linked List Interrupt Status Bit */
+#define         AT_XDMAC_CIS_DIS        BIT(2)  /* End of Disable Interrupt Status Bit */
+#define         AT_XDMAC_CIS_FIS        BIT(3)  /* End of Flush Interrupt Status Bit */
+#define         AT_XDMAC_CIS_RBEIS      BIT(4)  /* Read Bus Error Interrupt Status Bit */
+#define         AT_XDMAC_CIS_WBEIS      BIT(5)  /* Write Bus Error Interrupt Status Bit */
+#define         AT_XDMAC_CIS_ROIS       BIT(6)  /* Request Overflow Interrupt Status Bit */
+#define AT_XDMAC_CSA            0x10    /* Channel Source Address Register */
+#define AT_XDMAC_CDA            0x14    /* Channel Destination Address Register */
+#define AT_XDMAC_CNDA           0x18    /* Channel Next Descriptor Address Register */
+#define         AT_XDMAC_CNDA_NDAIF(i)  ((i) & 0x1)                     /* Channel x Next Descriptor Interface */
+#define         AT_XDMAC_CNDA_NDA(i)    ((i) & 0xfffffffc)              /* Channel x Next Descriptor Address */
+#define AT_XDMAC_CNDC           0x1C    /* Channel Next Descriptor Control Register */
+#define         AT_XDMAC_CNDC_NDE               (0x1 << 0)              /* Channel x Next Descriptor Enable */
+#define         AT_XDMAC_CNDC_NDSUP             (0x1 << 1)              /* Channel x Next Descriptor Source Update */
+#define         AT_XDMAC_CNDC_NDDUP             (0x1 << 2)              /* Channel x Next Descriptor Destination Update */
+#define         AT_XDMAC_CNDC_NDVIEW_NDV0       (0x0 << 3)              /* Channel x Next Descriptor View 0 */
+#define         AT_XDMAC_CNDC_NDVIEW_NDV1       (0x1 << 3)              /* Channel x Next Descriptor View 1 */
+#define         AT_XDMAC_CNDC_NDVIEW_NDV2       (0x2 << 3)              /* Channel x Next Descriptor View 2 */
+#define         AT_XDMAC_CNDC_NDVIEW_NDV3       (0x3 << 3)              /* Channel x Next Descriptor View 3 */
+#define AT_XDMAC_CUBC           0x20    /* Channel Microblock Control Register */
+#define AT_XDMAC_CBC            0x24    /* Channel Block Control Register */
+#define AT_XDMAC_CC             0x28    /* Channel Configuration Register */
+#define         AT_XDMAC_CC_TYPE        (0x1 << 0)      /* Channel Transfer Type */
+#define                 AT_XDMAC_CC_TYPE_MEM_TRAN       (0x0 << 0)      /* Memory to Memory Transfer */
+#define                 AT_XDMAC_CC_TYPE_PER_TRAN       (0x1 << 0)      /* Peripheral to Memory or Memory to Peripheral Transfer */
+#define         AT_XDMAC_CC_MBSIZE_MASK (0x3 << 1)
+#define                 AT_XDMAC_CC_MBSIZE_SINGLE       (0x0 << 1)
+#define                 AT_XDMAC_CC_MBSIZE_FOUR         (0x1 << 1)
+#define                 AT_XDMAC_CC_MBSIZE_EIGHT        (0x2 << 1)
+#define                 AT_XDMAC_CC_MBSIZE_SIXTEEN      (0x3 << 1)
+#define         AT_XDMAC_CC_DSYNC       (0x1 << 4)      /* Channel Synchronization */
+#define                 AT_XDMAC_CC_DSYNC_PER2MEM       (0x0 << 4)
+#define                 AT_XDMAC_CC_DSYNC_MEM2PER       (0x1 << 4)
+#define         AT_XDMAC_CC_PROT        (0x1 << 5)      /* Channel Protection */
+#define                 AT_XDMAC_CC_PROT_SEC            (0x0 << 5)
+#define                 AT_XDMAC_CC_PROT_UNSEC          (0x1 << 5)
+#define         AT_XDMAC_CC_SWREQ       (0x1 << 6)      /* Channel Software Request Trigger */
+#define                 AT_XDMAC_CC_SWREQ_HWR_CONNECTED (0x0 << 6)
+#define                 AT_XDMAC_CC_SWREQ_SWR_CONNECTED (0x1 << 6)
+#define         AT_XDMAC_CC_MEMSET      (0x1 << 7)      /* Channel Fill Block of memory */
+#define                 AT_XDMAC_CC_MEMSET_NORMAL_MODE  (0x0 << 7)
+#define                 AT_XDMAC_CC_MEMSET_HW_MODE      (0x1 << 7)
+#define         AT_XDMAC_CC_CSIZE(i)    ((0x7 & (i)) << 8)      /* Channel Chunk Size */
+#define         AT_XDMAC_CC_DWIDTH_OFFSET       11
+#define         AT_XDMAC_CC_DWIDTH_MASK (0x3 << AT_XDMAC_CC_DWIDTH_OFFSET)
+#define         AT_XDMAC_CC_DWIDTH(i)   ((0x3 & (i)) << AT_XDMAC_CC_DWIDTH_OFFSET)      /* Channel Data Width */
+#define                 AT_XDMAC_CC_DWIDTH_BYTE         0x0
+#define                 AT_XDMAC_CC_DWIDTH_HALFWORD     0x1
+#define                 AT_XDMAC_CC_DWIDTH_WORD         0x2
+#define                 AT_XDMAC_CC_DWIDTH_DWORD        0x3
+#define         AT_XDMAC_CC_SIF(i)      ((0x1 & (i)) << 13)     /* Channel Source Interface Identifier */
+#define         AT_XDMAC_CC_DIF(i)      ((0x1 & (i)) << 14)     /* Channel Destination Interface Identifier */
+#define         AT_XDMAC_CC_SAM_MASK    (0x3 << 16)     /* Channel Source Addressing Mode */
+#define                 AT_XDMAC_CC_SAM_FIXED_AM        (0x0 << 16)
+#define                 AT_XDMAC_CC_SAM_INCREMENTED_AM  (0x1 << 16)
+#define                 AT_XDMAC_CC_SAM_UBS_AM          (0x2 << 16)
+#define                 AT_XDMAC_CC_SAM_UBS_DS_AM       (0x3 << 16)
+#define         AT_XDMAC_CC_DAM_MASK    (0x3 << 18)     /* Channel Source Addressing Mode */
+#define                 AT_XDMAC_CC_DAM_FIXED_AM        (0x0 << 18)
+#define                 AT_XDMAC_CC_DAM_INCREMENTED_AM  (0x1 << 18)
+#define                 AT_XDMAC_CC_DAM_UBS_AM          (0x2 << 18)
+#define                 AT_XDMAC_CC_DAM_UBS_DS_AM       (0x3 << 18)
+#define         AT_XDMAC_CC_INITD       (0x1 << 21)     /* Channel Initialization Terminated (read only) */
+#define                 AT_XDMAC_CC_INITD_TERMINATED    (0x0 << 21)
+#define                 AT_XDMAC_CC_INITD_IN_PROGRESS   (0x1 << 21)
+#define         AT_XDMAC_CC_RDIP        (0x1 << 22)     /* Read in Progress (read only) */
+#define                 AT_XDMAC_CC_RDIP_DONE           (0x0 << 22)
+#define                 AT_XDMAC_CC_RDIP_IN_PROGRESS    (0x1 << 22)
+#define         AT_XDMAC_CC_WRIP        (0x1 << 23)     /* Write in Progress (read only) */
+#define                 AT_XDMAC_CC_WRIP_DONE           (0x0 << 23)
+#define                 AT_XDMAC_CC_WRIP_IN_PROGRESS    (0x1 << 23)
+#define         AT_XDMAC_CC_PERID(i)    (0x7f & (h) << 24)      /* Channel Peripheral Identifier */
+#define AT_XDMAC_CDS_MSP        0x2C    /* Channel Data Stride Memory Set Pattern */
+#define AT_XDMAC_CSUS           0x30    /* Channel Source Microblock Stride */
+#define AT_XDMAC_CDUS           0x34    /* Channel Destination Microblock Stride */
+
+#define AT_XDMAC_CHAN_REG_BASE  0x50    /* Channel registers base address */
+
+/* Microblock control members */
+#define AT_XDMAC_MBR_UBC_UBLEN_MAX      0xFFFFFFUL      /* Maximum Microblock Length */
+#define AT_XDMAC_MBR_UBC_NDE            (0x1 << 24)     /* Next Descriptor Enable */
+#define AT_XDMAC_MBR_UBC_NSEN           (0x1 << 25)     /* Next Descriptor Source Update */
+#define AT_XDMAC_MBR_UBC_NDEN           (0x1 << 26)     /* Next Descriptor Destination Update */
+#define AT_XDMAC_MBR_UBC_NDV0           (0x0 << 27)     /* Next Descriptor View 0 */
+#define AT_XDMAC_MBR_UBC_NDV1           (0x1 << 27)     /* Next Descriptor View 1 */
+#define AT_XDMAC_MBR_UBC_NDV2           (0x2 << 27)     /* Next Descriptor View 2 */
+#define AT_XDMAC_MBR_UBC_NDV3           (0x3 << 27)     /* Next Descriptor View 3 */
+
+#define AT_XDMAC_MAX_CHAN       0x20
+
+enum atc_status {
+        AT_XDMAC_CHAN_IS_CYCLIC = 0,
+        AT_XDMAC_CHAN_IS_PAUSED,
+};
+
+/* ----- Channels ----- */
+struct at_xdmac_chan {
+        struct dma_chan                 chan;
+        void __iomem                    *ch_regs;
+        u32                             mask;           /* Channel Mask */
+        u32                             cfg[3];         /* Channel Configuration Register */
+        #define AT_XDMAC_CUR_CFG        0               /* Current channel conf */
+        #define AT_XDMAC_DEV_TO_MEM_CFG 1               /* Predifined dev to mem channel conf */
+        #define AT_XDMAC_MEM_TO_DEV_CFG 2               /* Predifined mem to dev channel conf */
+        u8                              perid;          /* Peripheral ID */
+        u8                              perif;          /* Peripheral Interface */
+        u8                              memif;          /* Memory Interface */
+        u32                             per_src_addr;
+        u32                             per_dst_addr;
+        u32                             save_cim;
+        u32                             save_cnda;
+        u32                             save_cndc;
+        unsigned long                   status;
+        struct tasklet_struct           tasklet;
+
+        spinlock_t                      lock;
+
+        struct list_head                xfers_list;
+        struct list_head                free_descs_list;
+};
+
+
+/* ----- Controller ----- */
+struct at_xdmac {
+        struct dma_device       dma;
+        void __iomem            *regs;
+        int                     irq;
+        struct clk              *clk;
+        u32                     save_gim;
+        u32                     save_gs;
+        struct dma_pool         *at_xdmac_desc_pool;
+        struct at_xdmac_chan    chan[0];
+};
+
+
+/* ----- Descriptors ----- */
+
+/* Linked List Descriptor */
+struct at_xdmac_lld {
+        dma_addr_t      mbr_nda;        /* Next Descriptor Member */
+        u32             mbr_ubc;        /* Microblock Control Member */
+        dma_addr_t      mbr_sa;         /* Source Address Member */
+        dma_addr_t      mbr_da;         /* Destination Address Member */
+        u32             mbr_cfg;        /* Configuration Register */
+};
+
+
+struct at_xdmac_desc {
+        struct at_xdmac_lld             lld;
+        enum dma_transfer_direction     direction;
+        struct dma_async_tx_descriptor  tx_dma_desc;
+        struct list_head                desc_node;
+        /* Following members are only used by the first descriptor */
+        bool                            active_xfer;
+        unsigned int                    xfer_size;
+        struct list_head                descs_list;
+        struct list_head                xfer_node;
+};
+
+static inline void __iomem *at_xdmac_chan_reg_base(struct at_xdmac *atxdmac, unsigned int chan_nb)
+{
+        return atxdmac->regs + (AT_XDMAC_CHAN_REG_BASE + chan_nb * 0x40);
+}
+
+#define at_xdmac_read(atxdmac, reg) readl_relaxed((atxdmac)->regs + (reg))
+#define at_xdmac_write(atxdmac, reg, value) \
+        writel_relaxed((value), (atxdmac)->regs + (reg))
+
+#define at_xdmac_chan_read(atchan, reg) readl_relaxed((atchan)->ch_regs + (reg))
+#define at_xdmac_chan_write(atchan, reg, value) writel_relaxed((value), (atchan)->ch_regs + (reg))
+
+static inline struct at_xdmac_chan *to_at_xdmac_chan(struct dma_chan *dchan)
+{
+        return container_of(dchan, struct at_xdmac_chan, chan);
+}
+
+static struct device *chan2dev(struct dma_chan *chan)
+{
+        return &chan->dev->device;
+}
+
+static inline struct at_xdmac *to_at_xdmac(struct dma_device *ddev)
+{
+        return container_of(ddev, struct at_xdmac, dma);
+}
+
+static inline struct at_xdmac_desc *txd_to_at_desc(struct dma_async_tx_descriptor *txd)
+{
+        return container_of(txd, struct at_xdmac_desc, tx_dma_desc);
+}
+
+static inline int at_xdmac_chan_is_cyclic(struct at_xdmac_chan *atchan)
+{
+        return test_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);
+}
+
+static inline int at_xdmac_chan_is_paused(struct at_xdmac_chan *atchan)
+{
+        return test_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status);
+}
+
+static inline int at_xdmac_csize(u32 maxburst)
+{
+        int csize;
+
+        csize = ffs(maxburst) - 1;
+        if (csize > 4)
+                csize = -EINVAL;
+
+        return csize;
+};
+
+static inline u8 at_xdmac_get_dwidth(u32 cfg)
+{
+        return (cfg & AT_XDMAC_CC_DWIDTH_MASK) >> AT_XDMAC_CC_DWIDTH_OFFSET;
+};
+
+static unsigned int init_nr_desc_per_channel = 64;
+module_param(init_nr_desc_per_channel, uint, 0644);
+MODULE_PARM_DESC(init_nr_desc_per_channel,
+                 "initial descriptors per channel (default: 64)");
+
+
+static bool at_xdmac_chan_is_enabled(struct at_xdmac_chan *atchan)
+{
+        return at_xdmac_chan_read(atchan, AT_XDMAC_GS) & atchan->mask;
+}
+
+static void at_xdmac_off(struct at_xdmac *atxdmac)
+{
+        at_xdmac_write(atxdmac, AT_XDMAC_GD, -1L);
+
+        /* Wait that all chans are disabled. */
+        while (at_xdmac_read(atxdmac, AT_XDMAC_GS))
+                cpu_relax();
+
+        at_xdmac_write(atxdmac, AT_XDMAC_GID, -1L);
+}
+
+/* Call with lock hold. */
+static void at_xdmac_start_xfer(struct at_xdmac_chan *atchan,
+                                struct at_xdmac_desc *first)
+{
+        struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device);
+        u32             reg;
+
+        dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first);
+
+        if (at_xdmac_chan_is_enabled(atchan))
+                return;
+
+        /* Set transfer as active to not try to start it again. */
+        first->active_xfer = true;
+
+        /* Tell xdmac where to get the first descriptor. */
+        reg = AT_XDMAC_CNDA_NDA(first->tx_dma_desc.phys)
+              | AT_XDMAC_CNDA_NDAIF(atchan->memif);
+        at_xdmac_chan_write(atchan, AT_XDMAC_CNDA, reg);
+
+        /*
+         * When doing memory to memory transfer we need to use the next
+         * descriptor view 2 since some fields of the configuration register
+         * depend on transfer size and src/dest addresses.
+         */
+        if (is_slave_direction(first->direction)) {
+                reg = AT_XDMAC_CNDC_NDVIEW_NDV1;
+                if (first->direction == DMA_MEM_TO_DEV)
+                        atchan->cfg[AT_XDMAC_CUR_CFG] =
+                                atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
+                else
+                        atchan->cfg[AT_XDMAC_CUR_CFG] =
+                                atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
+                at_xdmac_chan_write(atchan, AT_XDMAC_CC,
+                                    atchan->cfg[AT_XDMAC_CUR_CFG]);
+        } else {
+                /*
+                 * No need to write AT_XDMAC_CC reg, it will be done when the
+                 * descriptor is fecthed.
+                 */
+                reg = AT_XDMAC_CNDC_NDVIEW_NDV2;
+        }
+
+        reg |= AT_XDMAC_CNDC_NDDUP
+               | AT_XDMAC_CNDC_NDSUP
+               | AT_XDMAC_CNDC_NDE;
+        at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, reg);
+
+        dev_vdbg(chan2dev(&atchan->chan),
+                 "%s: CC=0x%08x CNDA=0x%08x, CNDC=0x%08x, CSA=0x%08x, CDA=0x%08x, CUBC=0x%08x\n",
+                 __func__, at_xdmac_chan_read(atchan, AT_XDMAC_CC),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CNDA),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CNDC),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CSA),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
+
+        at_xdmac_chan_write(atchan, AT_XDMAC_CID, 0xffffffff);
+        reg = AT_XDMAC_CIE_RBEIE | AT_XDMAC_CIE_WBEIE | AT_XDMAC_CIE_ROIE;
+        /*
+         * There is no end of list when doing cyclic dma, we need to get
+         * an interrupt after each periods.
+         */
+        if (at_xdmac_chan_is_cyclic(atchan))
+                at_xdmac_chan_write(atchan, AT_XDMAC_CIE,
+                                    reg | AT_XDMAC_CIE_BIE);
+        else
+                at_xdmac_chan_write(atchan, AT_XDMAC_CIE,
+                                    reg | AT_XDMAC_CIE_LIE);
+        at_xdmac_write(atxdmac, AT_XDMAC_GIE, atchan->mask);
+        dev_vdbg(chan2dev(&atchan->chan),
+                 "%s: enable channel (0x%08x)\n", __func__, atchan->mask);
+        wmb();
+        at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+
+        dev_vdbg(chan2dev(&atchan->chan),
+                 "%s: CC=0x%08x CNDA=0x%08x, CNDC=0x%08x, CSA=0x%08x, CDA=0x%08x, CUBC=0x%08x\n",
+                 __func__, at_xdmac_chan_read(atchan, AT_XDMAC_CC),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CNDA),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CNDC),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CSA),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
+                 at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
+
+}
+
+static dma_cookie_t at_xdmac_tx_submit(struct dma_async_tx_descriptor *tx)
+{
+        struct at_xdmac_desc    *desc = txd_to_at_desc(tx);
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(tx->chan);
+        dma_cookie_t            cookie;
+
+        spin_lock_bh(&atchan->lock);
+        cookie = dma_cookie_assign(tx);
+
+        dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n",
+                 __func__, atchan, desc);
+        list_add_tail(&desc->xfer_node, &atchan->xfers_list);
+        if (list_is_singular(&atchan->xfers_list))
+                at_xdmac_start_xfer(atchan, desc);
+
+        spin_unlock_bh(&atchan->lock);
+        return cookie;
+}
+
+static struct at_xdmac_desc *at_xdmac_alloc_desc(struct dma_chan *chan,
+                                                 gfp_t gfp_flags)
+{
+        struct at_xdmac_desc    *desc;
+        struct at_xdmac         *atxdmac = to_at_xdmac(chan->device);
+        dma_addr_t              phys;
+
+        desc = dma_pool_alloc(atxdmac->at_xdmac_desc_pool, gfp_flags, &phys);
+        if (desc) {
+                memset(desc, 0, sizeof(*desc));
+                INIT_LIST_HEAD(&desc->descs_list);
+                dma_async_tx_descriptor_init(&desc->tx_dma_desc, chan);
+                desc->tx_dma_desc.tx_submit = at_xdmac_tx_submit;
+                desc->tx_dma_desc.phys = phys;
+        }
+
+        return desc;
+}
+
+/* Call must be protected by lock. */
+static struct at_xdmac_desc *at_xdmac_get_desc(struct at_xdmac_chan *atchan)
+{
+        struct at_xdmac_desc *desc;
+
+        if (list_empty(&atchan->free_descs_list)) {
+                desc = at_xdmac_alloc_desc(&atchan->chan, GFP_NOWAIT);
+        } else {
+                desc = list_first_entry(&atchan->free_descs_list,
+                                        struct at_xdmac_desc, desc_node);
+                list_del(&desc->desc_node);
+                desc->active_xfer = false;
+        }
+
+        return desc;
+}
+
+static struct dma_chan *at_xdmac_xlate(struct of_phandle_args *dma_spec,
+                                       struct of_dma *of_dma)
+{
+        struct at_xdmac         *atxdmac = of_dma->of_dma_data;
+        struct at_xdmac_chan    *atchan;
+        struct dma_chan         *chan;
+        struct device           *dev = atxdmac->dma.dev;
+
+        if (dma_spec->args_count != 1) {
+                dev_err(dev, "dma phandler args: bad number of args\n");
+                return NULL;
+        }
+
+        chan = dma_get_any_slave_channel(&atxdmac->dma);
+        if (!chan) {
+                dev_err(dev, "can't get a dma channel\n");
+                return NULL;
+        }
+
+        atchan = to_at_xdmac_chan(chan);
+        atchan->memif = AT91_XDMAC_DT_GET_MEM_IF(dma_spec->args[0]);
+        atchan->perif = AT91_XDMAC_DT_GET_PER_IF(dma_spec->args[0]);
+        atchan->perid = AT91_XDMAC_DT_GET_PERID(dma_spec->args[0]);
+        dev_dbg(dev, "chan dt cfg: memif=%u perif=%u perid=%u\n",
+                 atchan->memif, atchan->perif, atchan->perid);
+
+        return chan;
+}
+
+static int at_xdmac_set_slave_config(struct dma_chan *chan,
+                                      struct dma_slave_config *sconfig)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        u8 dwidth;
+        int csize;
+
+        atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG] =
+                AT91_XDMAC_DT_PERID(atchan->perid)
+                | AT_XDMAC_CC_DAM_INCREMENTED_AM
+                | AT_XDMAC_CC_SAM_FIXED_AM
+                | AT_XDMAC_CC_DIF(atchan->memif)
+                | AT_XDMAC_CC_SIF(atchan->perif)
+                | AT_XDMAC_CC_SWREQ_HWR_CONNECTED
+                | AT_XDMAC_CC_DSYNC_PER2MEM
+                | AT_XDMAC_CC_MBSIZE_SIXTEEN
+                | AT_XDMAC_CC_TYPE_PER_TRAN;
+        csize = at_xdmac_csize(sconfig->src_maxburst);
+        if (csize < 0) {
+                dev_err(chan2dev(chan), "invalid src maxburst value\n");
+                return -EINVAL;
+        }
+        atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG] |= AT_XDMAC_CC_CSIZE(csize);
+        dwidth = ffs(sconfig->src_addr_width) - 1;
+        atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG] |= AT_XDMAC_CC_DWIDTH(dwidth);
+
+
+        atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG] =
+                AT91_XDMAC_DT_PERID(atchan->perid)
+                | AT_XDMAC_CC_DAM_FIXED_AM
+                | AT_XDMAC_CC_SAM_INCREMENTED_AM
+                | AT_XDMAC_CC_DIF(atchan->perif)
+                | AT_XDMAC_CC_SIF(atchan->memif)
+                | AT_XDMAC_CC_SWREQ_HWR_CONNECTED
+                | AT_XDMAC_CC_DSYNC_MEM2PER
+                | AT_XDMAC_CC_MBSIZE_SIXTEEN
+                | AT_XDMAC_CC_TYPE_PER_TRAN;
+        csize = at_xdmac_csize(sconfig->dst_maxburst);
+        if (csize < 0) {
+                dev_err(chan2dev(chan), "invalid src maxburst value\n");
+                return -EINVAL;
+        }
+        atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG] |= AT_XDMAC_CC_CSIZE(csize);
+        dwidth = ffs(sconfig->dst_addr_width) - 1;
+        atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG] |= AT_XDMAC_CC_DWIDTH(dwidth);
+
+        /* Src and dst addr are needed to configure the link list descriptor. */
+        atchan->per_src_addr = sconfig->src_addr;
+        atchan->per_dst_addr = sconfig->dst_addr;
+
+        dev_dbg(chan2dev(chan),
+                "%s: cfg[dev2mem]=0x%08x, cfg[mem2dev]=0x%08x, per_src_addr=0x%08x, per_dst_addr=0x%08x\n",
+                __func__, atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG],
+                atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG],
+                atchan->per_src_addr, atchan->per_dst_addr);
+
+        return 0;
+}
+
+static struct dma_async_tx_descriptor *
+at_xdmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+                       unsigned int sg_len, enum dma_transfer_direction direction,
+                       unsigned long flags, void *context)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac_desc    *first = NULL, *prev = NULL;
+        struct scatterlist      *sg;
+        int                     i;
+        u32                     cfg;
+        unsigned int            xfer_size = 0;
+
+        if (!sgl)
+                return NULL;
+
+        if (!is_slave_direction(direction)) {
+                dev_err(chan2dev(chan), "invalid DMA direction\n");
+                return NULL;
+        }
+
+        dev_dbg(chan2dev(chan), "%s: sg_len=%d, dir=%s, flags=0x%lx\n",
+                 __func__, sg_len,
+                 direction == DMA_MEM_TO_DEV ? "to device" : "from device",
+                 flags);
+
+        /* Protect dma_sconfig field that can be modified by set_slave_conf. */
+        spin_lock_bh(&atchan->lock);
+
+        /* Prepare descriptors. */
+        for_each_sg(sgl, sg, sg_len, i) {
+                struct at_xdmac_desc    *desc = NULL;
+                u32                     len, mem;
+
+                len = sg_dma_len(sg);
+                mem = sg_dma_address(sg);
+                if (unlikely(!len)) {
+                        dev_err(chan2dev(chan), "sg data length is zero\n");
+                        spin_unlock_bh(&atchan->lock);
+                        return NULL;
+                }
+                dev_dbg(chan2dev(chan), "%s: * sg%d len=%u, mem=0x%08x\n",
+                         __func__, i, len, mem);
+
+                desc = at_xdmac_get_desc(atchan);
+                if (!desc) {
+                        dev_err(chan2dev(chan), "can't get descriptor\n");
+                        if (first)
+                                list_splice_init(&first->descs_list, &atchan->free_descs_list);
+                        spin_unlock_bh(&atchan->lock);
+                        return NULL;
+                }
+
+                /* Linked list descriptor setup. */
+                if (direction == DMA_DEV_TO_MEM) {
+                        desc->lld.mbr_sa = atchan->per_src_addr;
+                        desc->lld.mbr_da = mem;
+                        cfg = atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
+                } else {
+                        desc->lld.mbr_sa = mem;
+                        desc->lld.mbr_da = atchan->per_dst_addr;
+                        cfg = atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
+                }
+                desc->lld.mbr_ubc = AT_XDMAC_MBR_UBC_NDV1               /* next descriptor view */
+                        | AT_XDMAC_MBR_UBC_NDEN                         /* next descriptor dst parameter update */
+                        | AT_XDMAC_MBR_UBC_NSEN                         /* next descriptor src parameter update */
+                        | (i == sg_len - 1 ? 0 : AT_XDMAC_MBR_UBC_NDE)  /* descriptor fetch */
+                        | len / (1 << at_xdmac_get_dwidth(cfg));        /* microblock length */
+                dev_dbg(chan2dev(chan),
+                         "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x\n",
+                         __func__, &desc->lld.mbr_sa, &desc->lld.mbr_da, desc->lld.mbr_ubc);
+
+                /* Chain lld. */
+                if (prev) {
+                        prev->lld.mbr_nda = desc->tx_dma_desc.phys;
+                        dev_dbg(chan2dev(chan),
+                                 "%s: chain lld: prev=0x%p, mbr_nda=%pad\n",
+                                 __func__, prev, &prev->lld.mbr_nda);
+                }
+
+                prev = desc;
+                if (!first)
+                        first = desc;
+
+                dev_dbg(chan2dev(chan), "%s: add desc 0x%p to descs_list 0x%p\n",
+                         __func__, desc, first);
+                list_add_tail(&desc->desc_node, &first->descs_list);
+                xfer_size += len;
+        }
+
+        spin_unlock_bh(&atchan->lock);
+
+        first->tx_dma_desc.flags = flags;
+        first->xfer_size = xfer_size;
+        first->direction = direction;
+
+        return &first->tx_dma_desc;
+}
+
+static struct dma_async_tx_descriptor *
+at_xdmac_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr,
+                         size_t buf_len, size_t period_len,
+                         enum dma_transfer_direction direction,
+                         unsigned long flags)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac_desc    *first = NULL, *prev = NULL;
+        unsigned int            periods = buf_len / period_len;
+        int                     i;
+        u32                     cfg;
+
+        dev_dbg(chan2dev(chan), "%s: buf_addr=%pad, buf_len=%zd, period_len=%zd, dir=%s, flags=0x%lx\n",
+                __func__, &buf_addr, buf_len, period_len,
+                direction == DMA_MEM_TO_DEV ? "mem2per" : "per2mem", flags);
+
+        if (!is_slave_direction(direction)) {
+                dev_err(chan2dev(chan), "invalid DMA direction\n");
+                return NULL;
+        }
+
+        if (test_and_set_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status)) {
+                dev_err(chan2dev(chan), "channel currently used\n");
+                return NULL;
+        }
+
+        for (i = 0; i < periods; i++) {
+                struct at_xdmac_desc    *desc = NULL;
+
+                spin_lock_bh(&atchan->lock);
+                desc = at_xdmac_get_desc(atchan);
+                if (!desc) {
+                        dev_err(chan2dev(chan), "can't get descriptor\n");
+                        if (first)
+                                list_splice_init(&first->descs_list, &atchan->free_descs_list);
+                        spin_unlock_bh(&atchan->lock);
+                        return NULL;
+                }
+                spin_unlock_bh(&atchan->lock);
+                dev_dbg(chan2dev(chan),
+                        "%s: desc=0x%p, tx_dma_desc.phys=%pad\n",
+                        __func__, desc, &desc->tx_dma_desc.phys);
+
+                if (direction == DMA_DEV_TO_MEM) {
+                        desc->lld.mbr_sa = atchan->per_src_addr;
+                        desc->lld.mbr_da = buf_addr + i * period_len;
+                        cfg = atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
+                } else {
+                        desc->lld.mbr_sa = buf_addr + i * period_len;
+                        desc->lld.mbr_da = atchan->per_dst_addr;
+                        cfg = atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
+                }
+                desc->lld.mbr_ubc = AT_XDMAC_MBR_UBC_NDV1
+                        | AT_XDMAC_MBR_UBC_NDEN
+                        | AT_XDMAC_MBR_UBC_NSEN
+                        | AT_XDMAC_MBR_UBC_NDE
+                        | period_len >> at_xdmac_get_dwidth(cfg);
+
+                dev_dbg(chan2dev(chan),
+                         "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x\n",
+                         __func__, &desc->lld.mbr_sa, &desc->lld.mbr_da, desc->lld.mbr_ubc);
+
+                /* Chain lld. */
+                if (prev) {
+                        prev->lld.mbr_nda = desc->tx_dma_desc.phys;
+                        dev_dbg(chan2dev(chan),
+                                 "%s: chain lld: prev=0x%p, mbr_nda=%pad\n",
+                                 __func__, prev, &prev->lld.mbr_nda);
+                }
+
+                prev = desc;
+                if (!first)
+                        first = desc;
+
+                dev_dbg(chan2dev(chan), "%s: add desc 0x%p to descs_list 0x%p\n",
+                         __func__, desc, first);
+                list_add_tail(&desc->desc_node, &first->descs_list);
+        }
+
+        prev->lld.mbr_nda = first->tx_dma_desc.phys;
+        dev_dbg(chan2dev(chan),
+                "%s: chain lld: prev=0x%p, mbr_nda=%pad\n",
+                __func__, prev, &prev->lld.mbr_nda);
+        first->tx_dma_desc.flags = flags;
+        first->xfer_size = buf_len;
+        first->direction = direction;
+
+        return &first->tx_dma_desc;
+}
+
+static struct dma_async_tx_descriptor *
+at_xdmac_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
+                         size_t len, unsigned long flags)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac_desc    *first = NULL, *prev = NULL;
+        size_t                  remaining_size = len, xfer_size = 0, ublen;
+        dma_addr_t              src_addr = src, dst_addr = dest;
+        u32                     dwidth;
+        /*
+         * WARNING: We don't know the direction, it involves we can't
+         * dynamically set the source and dest interface so we have to use the
+         * same one. Only interface 0 allows EBI access. Hopefully we can
+         * access DDR through both ports (at least on SAMA5D4x), so we can use
+         * the same interface for source and dest, that solves the fact we
+         * don't know the direction.
+         */
+        u32                     chan_cc = AT_XDMAC_CC_DAM_INCREMENTED_AM
+                                        | AT_XDMAC_CC_SAM_INCREMENTED_AM
+                                        | AT_XDMAC_CC_DIF(0)
+                                        | AT_XDMAC_CC_SIF(0)
+                                        | AT_XDMAC_CC_MBSIZE_SIXTEEN
+                                        | AT_XDMAC_CC_TYPE_MEM_TRAN;
+
+        dev_dbg(chan2dev(chan), "%s: src=%pad, dest=%pad, len=%zd, flags=0x%lx\n",
+                __func__, &src, &dest, len, flags);
+
+        if (unlikely(!len))
+                return NULL;
+
+        /*
+         * Check address alignment to select the greater data width we can use.
+         * Some XDMAC implementations don't provide dword transfer, in this
+         * case selecting dword has the same behavior as selecting word transfers.
+         */
+        if (!((src_addr | dst_addr) & 7)) {
+                dwidth = AT_XDMAC_CC_DWIDTH_DWORD;
+                dev_dbg(chan2dev(chan), "%s: dwidth: double word\n", __func__);
+        } else if (!((src_addr | dst_addr)  & 3)) {
+                dwidth = AT_XDMAC_CC_DWIDTH_WORD;
+                dev_dbg(chan2dev(chan), "%s: dwidth: word\n", __func__);
+        } else if (!((src_addr | dst_addr) & 1)) {
+                dwidth = AT_XDMAC_CC_DWIDTH_HALFWORD;
+                dev_dbg(chan2dev(chan), "%s: dwidth: half word\n", __func__);
+        } else {
+                dwidth = AT_XDMAC_CC_DWIDTH_BYTE;
+                dev_dbg(chan2dev(chan), "%s: dwidth: byte\n", __func__);
+        }
+
+        /* Prepare descriptors. */
+        while (remaining_size) {
+                struct at_xdmac_desc    *desc = NULL;
+
+                dev_dbg(chan2dev(chan), "%s: remaining_size=%zu\n", __func__, remaining_size);
+
+                spin_lock_bh(&atchan->lock);
+                desc = at_xdmac_get_desc(atchan);
+                spin_unlock_bh(&atchan->lock);
+                if (!desc) {
+                        dev_err(chan2dev(chan), "can't get descriptor\n");
+                        if (first)
+                                list_splice_init(&first->descs_list, &atchan->free_descs_list);
+                        return NULL;
+                }
+
+                /* Update src and dest addresses. */
+                src_addr += xfer_size;
+                dst_addr += xfer_size;
+
+                if (remaining_size >= AT_XDMAC_MBR_UBC_UBLEN_MAX << dwidth)
+                        xfer_size = AT_XDMAC_MBR_UBC_UBLEN_MAX << dwidth;
+                else
+                        xfer_size = remaining_size;
+
+                dev_dbg(chan2dev(chan), "%s: xfer_size=%zu\n", __func__, xfer_size);
+
+                /* Check remaining length and change data width if needed. */
+                if (!((src_addr | dst_addr | xfer_size) & 7)) {
+                        dwidth = AT_XDMAC_CC_DWIDTH_DWORD;
+                        dev_dbg(chan2dev(chan), "%s: dwidth: double word\n", __func__);
+                } else if (!((src_addr | dst_addr | xfer_size)  & 3)) {
+                        dwidth = AT_XDMAC_CC_DWIDTH_WORD;
+                        dev_dbg(chan2dev(chan), "%s: dwidth: word\n", __func__);
+                } else if (!((src_addr | dst_addr | xfer_size) & 1)) {
+                        dwidth = AT_XDMAC_CC_DWIDTH_HALFWORD;
+                        dev_dbg(chan2dev(chan), "%s: dwidth: half word\n", __func__);
+                } else if ((src_addr | dst_addr | xfer_size) & 1) {
+                        dwidth = AT_XDMAC_CC_DWIDTH_BYTE;
+                        dev_dbg(chan2dev(chan), "%s: dwidth: byte\n", __func__);
+                }
+                chan_cc |= AT_XDMAC_CC_DWIDTH(dwidth);
+
+                ublen = xfer_size >> dwidth;
+                remaining_size -= xfer_size;
+
+                desc->lld.mbr_sa = src_addr;
+                desc->lld.mbr_da = dst_addr;
+                desc->lld.mbr_ubc = AT_XDMAC_MBR_UBC_NDV2
+                        | AT_XDMAC_MBR_UBC_NDEN
+                        | AT_XDMAC_MBR_UBC_NSEN
+                        | (remaining_size ? AT_XDMAC_MBR_UBC_NDE : 0)
+                        | ublen;
+                desc->lld.mbr_cfg = chan_cc;
+
+                dev_dbg(chan2dev(chan),
+                         "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+                         __func__, &desc->lld.mbr_sa, &desc->lld.mbr_da, desc->lld.mbr_ubc, desc->lld.mbr_cfg);
+
+                /* Chain lld. */
+                if (prev) {
+                        prev->lld.mbr_nda = desc->tx_dma_desc.phys;
+                        dev_dbg(chan2dev(chan),
+                                 "%s: chain lld: prev=0x%p, mbr_nda=0x%08x\n",
+                                 __func__, prev, prev->lld.mbr_nda);
+                }
+
+                prev = desc;
+                if (!first)
+                        first = desc;
+
+                dev_dbg(chan2dev(chan), "%s: add desc 0x%p to descs_list 0x%p\n",
+                         __func__, desc, first);
+                list_add_tail(&desc->desc_node, &first->descs_list);
+        }
+
+        first->tx_dma_desc.flags = flags;
+        first->xfer_size = len;
+
+        return &first->tx_dma_desc;
+}
+
+static enum dma_status
+at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
+                struct dma_tx_state *txstate)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac         *atxdmac = to_at_xdmac(atchan->chan.device);
+        struct at_xdmac_desc    *desc, *_desc;
+        struct list_head        *descs_list;
+        enum dma_status         ret;
+        int                     residue;
+        u32                     cur_nda, mask, value;
+        u8                      dwidth = at_xdmac_get_dwidth(atchan->cfg[AT_XDMAC_CUR_CFG]);
+
+        ret = dma_cookie_status(chan, cookie, txstate);
+        if (ret == DMA_COMPLETE)
+                return ret;
+
+        if (!txstate)
+                return ret;
+
+        spin_lock_bh(&atchan->lock);
+
+        desc = list_first_entry(&atchan->xfers_list, struct at_xdmac_desc, xfer_node);
+
+        /*
+         * If the transfer has not been started yet, don't need to compute the
+         * residue, it's the transfer length.
+         */
+        if (!desc->active_xfer) {
+                dma_set_residue(txstate, desc->xfer_size);
+                spin_unlock_bh(&atchan->lock);
+                return ret;
+        }
+
+        residue = desc->xfer_size;
+        /*
+         * Flush FIFO: only relevant when the transfer is source peripheral
+         * synchronized.
+         */
+        mask = AT_XDMAC_CC_TYPE | AT_XDMAC_CC_DSYNC;
+        value = AT_XDMAC_CC_TYPE_PER_TRAN | AT_XDMAC_CC_DSYNC_PER2MEM;
+        if ((atchan->cfg[AT_XDMAC_CUR_CFG] & mask) == value) {
+                at_xdmac_write(atxdmac, AT_XDMAC_GSWF, atchan->mask);
+                while (!(at_xdmac_chan_read(atchan, AT_XDMAC_CIS) & AT_XDMAC_CIS_FIS))
+                        cpu_relax();
+        }
+
+        cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
+        /*
+         * Remove size of all microblocks already transferred and the current
+         * one. Then add the remaining size to transfer of the current
+         * microblock.
+         */
+        descs_list = &desc->descs_list;
+        list_for_each_entry_safe(desc, _desc, descs_list, desc_node) {
+                residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth;
+                if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda)
+                        break;
+        }
+        residue += at_xdmac_chan_read(atchan, AT_XDMAC_CUBC) << dwidth;
+
+        spin_unlock_bh(&atchan->lock);
+
+        dma_set_residue(txstate, residue);
+
+        dev_dbg(chan2dev(chan),
+                 "%s: desc=0x%p, tx_dma_desc.phys=%pad, tx_status=%d, cookie=%d, residue=%d\n",
+                 __func__, desc, &desc->tx_dma_desc.phys, ret, cookie, residue);
+
+        return ret;
+}
+
+/* Call must be protected by lock. */
+static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan,
+                                    struct at_xdmac_desc *desc)
+{
+        dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc);
+
+        /*
+         * Remove the transfer from the transfer list then move the transfer
+         * descriptors into the free descriptors list.
+         */
+        list_del(&desc->xfer_node);
+        list_splice_init(&desc->descs_list, &atchan->free_descs_list);
+}
+
+static void at_xdmac_advance_work(struct at_xdmac_chan *atchan)
+{
+        struct at_xdmac_desc    *desc;
+
+        spin_lock_bh(&atchan->lock);
+
+        /*
+         * If channel is enabled, do nothing, advance_work will be triggered
+         * after the interruption.
+         */
+        if (!at_xdmac_chan_is_enabled(atchan) && !list_empty(&atchan->xfers_list)) {
+                desc = list_first_entry(&atchan->xfers_list,
+                                        struct at_xdmac_desc,
+                                        xfer_node);
+                dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc);
+                if (!desc->active_xfer)
+                        at_xdmac_start_xfer(atchan, desc);
+        }
+
+        spin_unlock_bh(&atchan->lock);
+}
+
+static void at_xdmac_handle_cyclic(struct at_xdmac_chan *atchan)
+{
+        struct at_xdmac_desc            *desc;
+        struct dma_async_tx_descriptor  *txd;
+
+        desc = list_first_entry(&atchan->xfers_list, struct at_xdmac_desc, xfer_node);
+        txd = &desc->tx_dma_desc;
+
+        if (txd->callback && (txd->flags & DMA_PREP_INTERRUPT))
+                txd->callback(txd->callback_param);
+}
+
+static void at_xdmac_tasklet(unsigned long data)
+{
+        struct at_xdmac_chan    *atchan = (struct at_xdmac_chan *)data;
+        struct at_xdmac_desc    *desc;
+        u32                     error_mask;
+
+        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n",
+                 __func__, atchan->status);
+
+        error_mask = AT_XDMAC_CIS_RBEIS
+                     | AT_XDMAC_CIS_WBEIS
+                     | AT_XDMAC_CIS_ROIS;
+
+        if (at_xdmac_chan_is_cyclic(atchan)) {
+                at_xdmac_handle_cyclic(atchan);
+        } else if ((atchan->status & AT_XDMAC_CIS_LIS)
+                   || (atchan->status & error_mask)) {
+                struct dma_async_tx_descriptor  *txd;
+
+                if (atchan->status & AT_XDMAC_CIS_RBEIS)
+                        dev_err(chan2dev(&atchan->chan), "read bus error!!!");
+                if (atchan->status & AT_XDMAC_CIS_WBEIS)
+                        dev_err(chan2dev(&atchan->chan), "write bus error!!!");
+                if (atchan->status & AT_XDMAC_CIS_ROIS)
+                        dev_err(chan2dev(&atchan->chan), "request overflow error!!!");
+
+                spin_lock_bh(&atchan->lock);
+                desc = list_first_entry(&atchan->xfers_list,
+                                        struct at_xdmac_desc,
+                                        xfer_node);
+                dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc);
+                BUG_ON(!desc->active_xfer);
+
+                txd = &desc->tx_dma_desc;
+
+                at_xdmac_remove_xfer(atchan, desc);
+                spin_unlock_bh(&atchan->lock);
+
+                if (!at_xdmac_chan_is_cyclic(atchan)) {
+                        dma_cookie_complete(txd);
+                        if (txd->callback && (txd->flags & DMA_PREP_INTERRUPT))
+                                txd->callback(txd->callback_param);
+                }
+
+                dma_run_dependencies(txd);
+
+                at_xdmac_advance_work(atchan);
+        }
+}
+
+static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
+{
+        struct at_xdmac         *atxdmac = (struct at_xdmac *)dev_id;
+        struct at_xdmac_chan    *atchan;
+        u32                     imr, status, pending;
+        u32                     chan_imr, chan_status;
+        int                     i, ret = IRQ_NONE;
+
+        do {
+                imr = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
+                status = at_xdmac_read(atxdmac, AT_XDMAC_GIS);
+                pending = status & imr;
+
+                dev_vdbg(atxdmac->dma.dev,
+                         "%s: status=0x%08x, imr=0x%08x, pending=0x%08x\n",
+                         __func__, status, imr, pending);
+
+                if (!pending)
+                        break;
+
+                /* We have to find which channel has generated the interrupt. */
+                for (i = 0; i < atxdmac->dma.chancnt; i++) {
+                        if (!((1 << i) & pending))
+                                continue;
+
+                        atchan = &atxdmac->chan[i];
+                        chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
+                        chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS);
+                        atchan->status = chan_status & chan_imr;
+                        dev_vdbg(atxdmac->dma.dev,
+                                 "%s: chan%d: imr=0x%x, status=0x%x\n",
+                                 __func__, i, chan_imr, chan_status);
+                        dev_vdbg(chan2dev(&atchan->chan),
+                                 "%s: CC=0x%08x CNDA=0x%08x, CNDC=0x%08x, CSA=0x%08x, CDA=0x%08x, CUBC=0x%08x\n",
+                                 __func__,
+                                 at_xdmac_chan_read(atchan, AT_XDMAC_CC),
+                                 at_xdmac_chan_read(atchan, AT_XDMAC_CNDA),
+                                 at_xdmac_chan_read(atchan, AT_XDMAC_CNDC),
+                                 at_xdmac_chan_read(atchan, AT_XDMAC_CSA),
+                                 at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
+                                 at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
+
+                        if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
+                                at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
+
+                        tasklet_schedule(&atchan->tasklet);
+                        ret = IRQ_HANDLED;
+                }
+
+        } while (pending);
+
+        return ret;
+}
+
+static void at_xdmac_issue_pending(struct dma_chan *chan)
+{
+        struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan);
+
+        dev_dbg(chan2dev(&atchan->chan), "%s\n", __func__);
+
+        if (!at_xdmac_chan_is_cyclic(atchan))
+                at_xdmac_advance_work(atchan);
+
+        return;
+}
+
+static int at_xdmac_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
+                            unsigned long arg)
+{
+        struct at_xdmac_desc    *desc, *_desc;
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac         *atxdmac = to_at_xdmac(atchan->chan.device);
+        int                     ret = 0;
+
+        dev_dbg(chan2dev(chan), "%s: cmd=%d\n", __func__, cmd);
+
+        spin_lock_bh(&atchan->lock);
+
+        switch (cmd) {
+        case DMA_PAUSE:
+                at_xdmac_write(atxdmac, AT_XDMAC_GRWS, atchan->mask);
+                set_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status);
+                break;
+
+        case DMA_RESUME:
+                if (!at_xdmac_chan_is_paused(atchan))
+                        break;
+
+                at_xdmac_write(atxdmac, AT_XDMAC_GRWR, atchan->mask);
+                clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status);
+                break;
+
+        case DMA_TERMINATE_ALL:
+                at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
+                while (at_xdmac_read(atxdmac, AT_XDMAC_GS) & atchan->mask)
+                        cpu_relax();
+
+                /* Cancel all pending transfers. */
+                list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node)
+                        at_xdmac_remove_xfer(atchan, desc);
+
+                clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);
+                break;
+
+        case DMA_SLAVE_CONFIG:
+                ret = at_xdmac_set_slave_config(chan,
+                                (struct dma_slave_config *)arg);
+                break;
+
+        default:
+                dev_err(chan2dev(chan),
+                        "unmanaged or unknown dma control cmd: %d\n", cmd);
+                ret = -ENXIO;
+        }
+
+        spin_unlock_bh(&atchan->lock);
+
+        return ret;
+}
+
+static int at_xdmac_alloc_chan_resources(struct dma_chan *chan)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac_desc    *desc;
+        int                     i;
+
+        spin_lock_bh(&atchan->lock);
+
+        if (at_xdmac_chan_is_enabled(atchan)) {
+                dev_err(chan2dev(chan),
+                        "can't allocate channel resources (channel enabled)\n");
+                i = -EIO;
+                goto spin_unlock;
+        }
+
+        if (!list_empty(&atchan->free_descs_list)) {
+                dev_err(chan2dev(chan),
+                        "can't allocate channel resources (channel not free from a previous use)\n");
+                i = -EIO;
+                goto spin_unlock;
+        }
+
+        for (i = 0; i < init_nr_desc_per_channel; i++) {
+                desc = at_xdmac_alloc_desc(chan, GFP_ATOMIC);
+                if (!desc) {
+                        dev_warn(chan2dev(chan),
+                                "only %d descriptors have been allocated\n", i);
+                        break;
+                }
+                list_add_tail(&desc->desc_node, &atchan->free_descs_list);
+        }
+
+        dma_cookie_init(chan);
+
+        dev_dbg(chan2dev(chan), "%s: allocated %d descriptors\n", __func__, i);
+
+spin_unlock:
+        spin_unlock_bh(&atchan->lock);
+        return i;
+}
+
+static void at_xdmac_free_chan_resources(struct dma_chan *chan)
+{
+        struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+        struct at_xdmac         *atxdmac = to_at_xdmac(chan->device);
+        struct at_xdmac_desc    *desc, *_desc;
+
+        list_for_each_entry_safe(desc, _desc, &atchan->free_descs_list, desc_node) {
+                dev_dbg(chan2dev(chan), "%s: freeing descriptor %p\n", __func__, desc);
+                list_del(&desc->desc_node);
+                dma_pool_free(atxdmac->at_xdmac_desc_pool, desc, desc->tx_dma_desc.phys);
+        }
+
+        return;
+}
+
+#define AT_XDMAC_DMA_BUSWIDTHS\
+        (BIT(DMA_SLAVE_BUSWIDTH_UNDEFINED) |\
+        BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) |\
+        BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) |\
+        BIT(DMA_SLAVE_BUSWIDTH_4_BYTES) |\
+        BIT(DMA_SLAVE_BUSWIDTH_8_BYTES))
+
+static int at_xdmac_device_slave_caps(struct dma_chan *dchan,
+                                      struct dma_slave_caps *caps)
+{
+
+        caps->src_addr_widths = AT_XDMAC_DMA_BUSWIDTHS;
+        caps->dstn_addr_widths = AT_XDMAC_DMA_BUSWIDTHS;
+        caps->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        caps->cmd_pause = true;
+        caps->cmd_terminate = true;
+        caps->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int atmel_xdmac_prepare(struct device *dev)
+{
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct at_xdmac         *atxdmac = platform_get_drvdata(pdev);
+        struct dma_chan         *chan, *_chan;
+
+        list_for_each_entry_safe(chan, _chan, &atxdmac->dma.channels, device_node) {
+                struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+
+                /* Wait for transfer completion, except in cyclic case. */
+                if (at_xdmac_chan_is_enabled(atchan) && !at_xdmac_chan_is_cyclic(atchan))
+                        return -EAGAIN;
+        }
+        return 0;
+}
+#else
+#       define atmel_xdmac_prepare NULL
+#endif
+
+#ifdef CONFIG_PM_SLEEP
+static int atmel_xdmac_suspend(struct device *dev)
+{
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct at_xdmac         *atxdmac = platform_get_drvdata(pdev);
+        struct dma_chan         *chan, *_chan;
+
+        list_for_each_entry_safe(chan, _chan, &atxdmac->dma.channels, device_node) {
+                struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
+
+                if (at_xdmac_chan_is_cyclic(atchan)) {
+                        if (!at_xdmac_chan_is_paused(atchan))
+                                at_xdmac_control(chan, DMA_PAUSE, 0);
+                        atchan->save_cim = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
+                        atchan->save_cnda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA);
+                        atchan->save_cndc = at_xdmac_chan_read(atchan, AT_XDMAC_CNDC);
+                }
+        }
+        atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
+
+        at_xdmac_off(atxdmac);
+        clk_disable_unprepare(atxdmac->clk);
+        return 0;
+}
+
+static int atmel_xdmac_resume(struct device *dev)
+{
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct at_xdmac         *atxdmac = platform_get_drvdata(pdev);
+        struct at_xdmac_chan    *atchan;
+        struct dma_chan         *chan, *_chan;
+        int                     i;
+        u32                     cfg;
+
+        clk_prepare_enable(atxdmac->clk);
+
+        /* Clear pending interrupts. */
+        for (i = 0; i < atxdmac->dma.chancnt; i++) {
+                atchan = &atxdmac->chan[i];
+                while (at_xdmac_chan_read(atchan, AT_XDMAC_CIS))
+                        cpu_relax();
+        }
+
+        at_xdmac_write(atxdmac, AT_XDMAC_GIE, atxdmac->save_gim);
+        at_xdmac_write(atxdmac, AT_XDMAC_GE, atxdmac->save_gs);
+        list_for_each_entry_safe(chan, _chan, &atxdmac->dma.channels, device_node) {
+                atchan = to_at_xdmac_chan(chan);
+                cfg = atchan->cfg[AT_XDMAC_CUR_CFG];
+                at_xdmac_chan_write(atchan, AT_XDMAC_CC, cfg);
+                if (at_xdmac_chan_is_cyclic(atchan)) {
+                        at_xdmac_chan_write(atchan, AT_XDMAC_CNDA, atchan->save_cnda);
+                        at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+                        at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+                        wmb();
+                        at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+                }
+        }
+        return 0;
+}
+#endif /* CONFIG_PM_SLEEP */
+
+static int at_xdmac_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        struct at_xdmac *atxdmac;
+        int             irq, size, nr_channels, i, ret;
+        void __iomem    *base;
+        u32             reg;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0)
+                return irq;
+
+        base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        /*
+         * Read number of xdmac channels, read helper function can't be used
+         * since atxdmac is not yet allocated and we need to know the number
+         * of channels to do the allocation.
+         */
+        reg = readl_relaxed(base + AT_XDMAC_GTYPE);
+        nr_channels = AT_XDMAC_NB_CH(reg);
+        if (nr_channels > AT_XDMAC_MAX_CHAN) {
+                dev_err(&pdev->dev, "invalid number of channels (%u)\n",
+                        nr_channels);
+                return -EINVAL;
+        }
+
+        size = sizeof(*atxdmac);
+        size += nr_channels * sizeof(struct at_xdmac_chan);
+        atxdmac = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
+        if (!atxdmac) {
+                dev_err(&pdev->dev, "can't allocate at_xdmac structure\n");
+                return -ENOMEM;
+        }
+
+        atxdmac->regs = base;
+        atxdmac->irq = irq;
+
+        atxdmac->clk = devm_clk_get(&pdev->dev, "dma_clk");
+        if (IS_ERR(atxdmac->clk)) {
+                dev_err(&pdev->dev, "can't get dma_clk\n");
+                return PTR_ERR(atxdmac->clk);
+        }
+
+        /* Do not use dev res to prevent races with tasklet */
+        ret = request_irq(atxdmac->irq, at_xdmac_interrupt, 0, "at_xdmac", atxdmac);
+        if (ret) {
+                dev_err(&pdev->dev, "can't request irq\n");
+                return ret;
+        }
+
+        ret = clk_prepare_enable(atxdmac->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "can't prepare or enable clock\n");
+                goto err_free_irq;
+        }
+
+        atxdmac->at_xdmac_desc_pool =
+                dmam_pool_create(dev_name(&pdev->dev), &pdev->dev,
+                                sizeof(struct at_xdmac_desc), 4, 0);
+        if (!atxdmac->at_xdmac_desc_pool) {
+                dev_err(&pdev->dev, "no memory for descriptors dma pool\n");
+                ret = -ENOMEM;
+                goto err_clk_disable;
+        }
+
+        dma_cap_set(DMA_CYCLIC, atxdmac->dma.cap_mask);
+        dma_cap_set(DMA_MEMCPY, atxdmac->dma.cap_mask);
+        dma_cap_set(DMA_SLAVE, atxdmac->dma.cap_mask);
+        /*
+         * Without DMA_PRIVATE the driver is not able to allocate more than
+         * one channel, second allocation fails in private_candidate.
+         */
+        dma_cap_set(DMA_PRIVATE, atxdmac->dma.cap_mask);
+        atxdmac->dma.dev                                = &pdev->dev;
+        atxdmac->dma.device_alloc_chan_resources        = at_xdmac_alloc_chan_resources;
+        atxdmac->dma.device_free_chan_resources         = at_xdmac_free_chan_resources;
+        atxdmac->dma.device_tx_status                   = at_xdmac_tx_status;
+        atxdmac->dma.device_issue_pending               = at_xdmac_issue_pending;
+        atxdmac->dma.device_prep_dma_cyclic             = at_xdmac_prep_dma_cyclic;
+        atxdmac->dma.device_prep_dma_memcpy             = at_xdmac_prep_dma_memcpy;
+        atxdmac->dma.device_prep_slave_sg               = at_xdmac_prep_slave_sg;
+        atxdmac->dma.device_control                     = at_xdmac_control;
+        atxdmac->dma.device_slave_caps                  = at_xdmac_device_slave_caps;
+
+        /* Disable all chans and interrupts. */
+        at_xdmac_off(atxdmac);
+
+        /* Init channels. */
+        INIT_LIST_HEAD(&atxdmac->dma.channels);
+        for (i = 0; i < nr_channels; i++) {
+                struct at_xdmac_chan *atchan = &atxdmac->chan[i];
+
+                atchan->chan.device = &atxdmac->dma;
+                list_add_tail(&atchan->chan.device_node,
+                              &atxdmac->dma.channels);
+
+                atchan->ch_regs = at_xdmac_chan_reg_base(atxdmac, i);
+                atchan->mask = 1 << i;
+
+                spin_lock_init(&atchan->lock);
+                INIT_LIST_HEAD(&atchan->xfers_list);
+                INIT_LIST_HEAD(&atchan->free_descs_list);
+                tasklet_init(&atchan->tasklet, at_xdmac_tasklet,
+                             (unsigned long)atchan);
+
+                /* Clear pending interrupts. */
+                while (at_xdmac_chan_read(atchan, AT_XDMAC_CIS))
+                        cpu_relax();
+        }
+        platform_set_drvdata(pdev, atxdmac);
+
+        ret = dma_async_device_register(&atxdmac->dma);
+        if (ret) {
+                dev_err(&pdev->dev, "fail to register DMA engine device\n");
+                goto err_clk_disable;
+        }
+
+        ret = of_dma_controller_register(pdev->dev.of_node,
+                                         at_xdmac_xlate, atxdmac);
+        if (ret) {
+                dev_err(&pdev->dev, "could not register of dma controller\n");
+                goto err_dma_unregister;
+        }
+
+        dev_info(&pdev->dev, "%d channels, mapped at 0x%p\n",
+                 nr_channels, atxdmac->regs);
+
+        return 0;
+
+err_dma_unregister:
+        dma_async_device_unregister(&atxdmac->dma);
+err_clk_disable:
+        clk_disable_unprepare(atxdmac->clk);
+err_free_irq:
+        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        return ret;
+}
+
+static int at_xdmac_remove(struct platform_device *pdev)
+{
+        struct at_xdmac *atxdmac = (struct at_xdmac *)platform_get_drvdata(pdev);
+        int             i;
+
+        at_xdmac_off(atxdmac);
+        of_dma_controller_free(pdev->dev.of_node);
+        dma_async_device_unregister(&atxdmac->dma);
+        clk_disable_unprepare(atxdmac->clk);
+
+        synchronize_irq(atxdmac->irq);
+
+        free_irq(atxdmac->irq, atxdmac->dma.dev);
+
+        for (i = 0; i < atxdmac->dma.chancnt; i++) {
+                struct at_xdmac_chan *atchan = &atxdmac->chan[i];
+
+                tasklet_kill(&atchan->tasklet);
+                at_xdmac_free_chan_resources(&atchan->chan);
+        }
+
+        return 0;
+}
+
+static const struct dev_pm_ops atmel_xdmac_dev_pm_ops = {
+        .prepare        = atmel_xdmac_prepare,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(atmel_xdmac_suspend, atmel_xdmac_resume)
+};
+
+static const struct of_device_id atmel_xdmac_dt_ids[] = {
+        {
+                .compatible = "atmel,sama5d4-dma",
+        }, {
+                /* sentinel */
+        }
+};
+MODULE_DEVICE_TABLE(of, atmel_xdmac_dt_ids);
+
+static struct platform_driver at_xdmac_driver = {
+        .probe          = at_xdmac_probe,
+        .remove         = at_xdmac_remove,
+        .driver = {
+                .name           = "at_xdmac",
+                .owner          = THIS_MODULE,
+                .of_match_table = of_match_ptr(atmel_xdmac_dt_ids),
+                .pm             = &atmel_xdmac_dev_pm_ops,
+        }
+};
+
+static int __init at_xdmac_init(void)
+{
+        return platform_driver_probe(&at_xdmac_driver, at_xdmac_probe);
+}
+subsys_initcall(at_xdmac_init);
+
+MODULE_DESCRIPTION("Atmel Extended DMA Controller driver");
+MODULE_AUTHOR("Ludovic Desroches <ludovic.desroches@atmel.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 68007974961a..918b7b3f766f 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -525,8 +525,6 @@ static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id, int irq)
         vchan_init(&c->vc, &d->ddev);
         INIT_LIST_HEAD(&c->node);
 
-        d->ddev.chancnt++;
-
         c->chan_base = BCM2835_DMA_CHANIO(d->base, chan_id);
         c->ch = chan_id;
         c->irq_number = irq;
@@ -694,7 +692,6 @@ static struct platform_driver bcm2835_dma_driver = {
         .remove = bcm2835_dma_remove,
         .driver = {
                 .name = "bcm2835-dma",
-                .owner = THIS_MODULE,
                 .of_match_table = of_match_ptr(bcm2835_dma_of_match),
         },
 };
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index a58eec3b2cad..b743adf56465 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -1,3 +1,4 @@
+#include <linux/delay.h>
 #include <linux/dmaengine.h>
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
@@ -567,7 +568,7 @@ static int cppi41_tear_down_chan(struct cppi41_channel *c)
                 reg |= GCR_TEARDOWN;
                 cppi_writel(reg, c->gcr_reg);
                 c->td_queued = 1;
-                c->td_retry = 100;
+                c->td_retry = 500;
         }
 
         if (!c->td_seen || !c->td_desc_seen) {
@@ -603,12 +604,16 @@ static int cppi41_tear_down_chan(struct cppi41_channel *c)
          * descriptor before the TD we fetch it from enqueue, it has to be
          * there waiting for us.
          */
-        if (!c->td_seen && c->td_retry)
+        if (!c->td_seen && c->td_retry) {
+                udelay(1);
                 return -EAGAIN;
-
+        }
         WARN_ON(!c->td_retry);
+
         if (!c->td_desc_seen) {
                 desc_phys = cppi41_pop_desc(cdd, c->q_num);
+                if (!desc_phys)
+                        desc_phys = cppi41_pop_desc(cdd, c->q_comp_num);
                 WARN_ON(!desc_phys);
         }
 
@@ -1088,7 +1093,6 @@ static struct platform_driver cpp41_dma_driver = {
         .remove = cppi41_dma_remove,
         .driver = {
                 .name = "cppi41-dma-engine",
-                .owner = THIS_MODULE,
                 .pm = &cppi41_pm_ops,
                 .of_match_table = of_match_ptr(cppi41_dma_ids),
         },
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index ae2ab14e64b3..bdeafeefa5f6 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -563,10 +563,9 @@ static int jz4740_dma_probe(struct platform_device *pdev)
         dd->device_prep_dma_cyclic = jz4740_dma_prep_dma_cyclic;
         dd->device_control = jz4740_dma_control;
         dd->dev = &pdev->dev;
-        dd->chancnt = JZ_DMA_NR_CHANS;
         INIT_LIST_HEAD(&dd->channels);
 
-        for (i = 0; i < dd->chancnt; i++) {
+        for (i = 0; i < JZ_DMA_NR_CHANS; i++) {
                 chan = &dmadev->chan[i];
                 chan->id = i;
                 chan->vchan.desc_free = jz4740_dma_desc_free;
@@ -608,7 +607,6 @@ static struct platform_driver jz4740_dma_driver = {
         .remove = jz4740_dma_remove,
         .driver = {
                 .name = "jz4740-dma",
-                .owner = THIS_MODULE,
         },
 };
 module_platform_driver(jz4740_dma_driver);
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 24bfaf0b92ba..e057935e3023 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -330,8 +330,7 @@ static int __init dma_channel_table_init(void)
         if (err) {
                 pr_err("initialization failure\n");
                 for_each_dma_cap_mask(cap, dma_cap_mask_all)
-                        if (channel_table[cap])
-                                free_percpu(channel_table[cap]);
+                        free_percpu(channel_table[cap]);
         }
 
         return err;
diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
index 3c5711d5fe97..6fb2e902b459 100644
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -118,17 +118,17 @@
                                 BIT(DMA_SLAVE_BUSWIDTH_8_BYTES)
 
 struct fsl_edma_hw_tcd {
-        u32     saddr;
-        u16     soff;
-        u16     attr;
-        u32     nbytes;
-        u32     slast;
-        u32     daddr;
-        u16     doff;
-        u16     citer;
-        u32     dlast_sga;
-        u16     csr;
-        u16     biter;
+        __le32  saddr;
+        __le16  soff;
+        __le16  attr;
+        __le32  nbytes;
+        __le32  slast;
+        __le32  daddr;
+        __le16  doff;
+        __le16  citer;
+        __le32  dlast_sga;
+        __le16  csr;
+        __le16  biter;
 };
 
 struct fsl_edma_sw_tcd {
@@ -175,18 +175,12 @@ struct fsl_edma_engine {
 };
 
 /*
- * R/W functions for big- or little-endian registers
- * the eDMA controller's endian is independent of the CPU core's endian.
+ * R/W functions for big- or little-endian registers:
+ * The eDMA controller's endian is independent of the CPU core's endian.
+ * For the big-endian IP module, the offset for 8-bit or 16-bit registers
+ * should also be swapped opposite to that in little-endian IP.
  */
 
-static u16 edma_readw(struct fsl_edma_engine *edma, void __iomem *addr)
-{
-        if (edma->big_endian)
-                return ioread16be(addr);
-        else
-                return ioread16(addr);
-}
-
 static u32 edma_readl(struct fsl_edma_engine *edma, void __iomem *addr)
 {
         if (edma->big_endian)
@@ -197,13 +191,18 @@ static u32 edma_readl(struct fsl_edma_engine *edma, void __iomem *addr)
 
 static void edma_writeb(struct fsl_edma_engine *edma, u8 val, void __iomem *addr)
 {
-        iowrite8(val, addr);
+        /* swap the reg offset for these in big-endian mode */
+        if (edma->big_endian)
+                iowrite8(val, (void __iomem *)((unsigned long)addr ^ 0x3));
+        else
+                iowrite8(val, addr);
 }
 
 static void edma_writew(struct fsl_edma_engine *edma, u16 val, void __iomem *addr)
 {
+        /* swap the reg offset for these in big-endian mode */
         if (edma->big_endian)
-                iowrite16be(val, addr);
+                iowrite16be(val, (void __iomem *)((unsigned long)addr ^ 0x2));
         else
                 iowrite16(val, addr);
 }
@@ -254,13 +253,12 @@ static void fsl_edma_chan_mux(struct fsl_edma_chan *fsl_chan,
         chans_per_mux = fsl_chan->edma->n_chans / DMAMUX_NR;
         ch_off = fsl_chan->vchan.chan.chan_id % chans_per_mux;
         muxaddr = fsl_chan->edma->muxbase[ch / chans_per_mux];
+        slot = EDMAMUX_CHCFG_SOURCE(slot);
 
         if (enable)
-                edma_writeb(fsl_chan->edma,
-                                EDMAMUX_CHCFG_ENBL | EDMAMUX_CHCFG_SOURCE(slot),
-                                muxaddr + ch_off);
+                iowrite8(EDMAMUX_CHCFG_ENBL | slot, muxaddr + ch_off);
         else
-                edma_writeb(fsl_chan->edma, EDMAMUX_CHCFG_DIS, muxaddr + ch_off);
+                iowrite8(EDMAMUX_CHCFG_DIS, muxaddr + ch_off);
 }
 
 static unsigned int fsl_edma_get_tcd_attr(enum dma_slave_buswidth addr_width)
@@ -286,9 +284,8 @@ static void fsl_edma_free_desc(struct virt_dma_desc *vdesc)
 
         fsl_desc = to_fsl_edma_desc(vdesc);
         for (i = 0; i < fsl_desc->n_tcds; i++)
-                        dma_pool_free(fsl_desc->echan->tcd_pool,
-                                        fsl_desc->tcd[i].vtcd,
-                                        fsl_desc->tcd[i].ptcd);
+                dma_pool_free(fsl_desc->echan->tcd_pool, fsl_desc->tcd[i].vtcd,
+                              fsl_desc->tcd[i].ptcd);
         kfree(fsl_desc);
 }
 
@@ -363,8 +360,8 @@ static size_t fsl_edma_desc_residue(struct fsl_edma_chan *fsl_chan,
 
         /* calculate the total size in this desc */
         for (len = i = 0; i < fsl_chan->edesc->n_tcds; i++)
-                len += edma_readl(fsl_chan->edma, &(edesc->tcd[i].vtcd->nbytes))
-                        * edma_readw(fsl_chan->edma, &(edesc->tcd[i].vtcd->biter));
+                len += le32_to_cpu(edesc->tcd[i].vtcd->nbytes)
+                        * le16_to_cpu(edesc->tcd[i].vtcd->biter);
 
         if (!in_progress)
                 return len;
@@ -376,17 +373,15 @@ static size_t fsl_edma_desc_residue(struct fsl_edma_chan *fsl_chan,
 
         /* figure out the finished and calculate the residue */
         for (i = 0; i < fsl_chan->edesc->n_tcds; i++) {
-                size = edma_readl(fsl_chan->edma, &(edesc->tcd[i].vtcd->nbytes))
-                        * edma_readw(fsl_chan->edma, &(edesc->tcd[i].vtcd->biter));
+                size = le32_to_cpu(edesc->tcd[i].vtcd->nbytes)
+                        * le16_to_cpu(edesc->tcd[i].vtcd->biter);
                 if (dir == DMA_MEM_TO_DEV)
-                        dma_addr = edma_readl(fsl_chan->edma,
-                                        &(edesc->tcd[i].vtcd->saddr));
+                        dma_addr = le32_to_cpu(edesc->tcd[i].vtcd->saddr);
                 else
-                        dma_addr = edma_readl(fsl_chan->edma,
-                                        &(edesc->tcd[i].vtcd->daddr));
+                        dma_addr = le32_to_cpu(edesc->tcd[i].vtcd->daddr);
 
                 len -= size;
-                if (cur_addr > dma_addr && cur_addr < dma_addr + size) {
+                if (cur_addr >= dma_addr && cur_addr < dma_addr + size) {
                         len += dma_addr + size - cur_addr;
                         break;
                 }
@@ -424,55 +419,67 @@ static enum dma_status fsl_edma_tx_status(struct dma_chan *chan,
         return fsl_chan->status;
 }
 
-static void fsl_edma_set_tcd_params(struct fsl_edma_chan *fsl_chan,
-                u32 src, u32 dst, u16 attr, u16 soff, u32 nbytes,
-                u32 slast, u16 citer, u16 biter, u32 doff, u32 dlast_sga,
-                u16 csr)
+static void fsl_edma_set_tcd_regs(struct fsl_edma_chan *fsl_chan,
+                                  struct fsl_edma_hw_tcd *tcd)
 {
+        struct fsl_edma_engine *edma = fsl_chan->edma;
         void __iomem *addr = fsl_chan->edma->membase;
         u32 ch = fsl_chan->vchan.chan.chan_id;
 
         /*
-         * TCD parameters have been swapped in fill_tcd_params(),
-         * so just write them to registers in the cpu endian here
+         * TCD parameters are stored in struct fsl_edma_hw_tcd in little
+         * endian format. However, we need to load the TCD registers in
+         * big- or little-endian obeying the eDMA engine model endian.
          */
-        writew(0, addr + EDMA_TCD_CSR(ch));
-        writel(src, addr + EDMA_TCD_SADDR(ch));
-        writel(dst, addr + EDMA_TCD_DADDR(ch));
-        writew(attr, addr + EDMA_TCD_ATTR(ch));
-        writew(soff, addr + EDMA_TCD_SOFF(ch));
-        writel(nbytes, addr + EDMA_TCD_NBYTES(ch));
-        writel(slast, addr + EDMA_TCD_SLAST(ch));
-        writew(citer, addr + EDMA_TCD_CITER(ch));
-        writew(biter, addr + EDMA_TCD_BITER(ch));
-        writew(doff, addr + EDMA_TCD_DOFF(ch));
-        writel(dlast_sga, addr + EDMA_TCD_DLAST_SGA(ch));
-        writew(csr, addr + EDMA_TCD_CSR(ch));
-}
-
-static void fill_tcd_params(struct fsl_edma_engine *edma,
-                struct fsl_edma_hw_tcd *tcd, u32 src, u32 dst,
-                u16 attr, u16 soff, u32 nbytes, u32 slast, u16 citer,
-                u16 biter, u16 doff, u32 dlast_sga, bool major_int,
-                bool disable_req, bool enable_sg)
+        edma_writew(edma, 0, addr + EDMA_TCD_CSR(ch));
+        edma_writel(edma, le32_to_cpu(tcd->saddr), addr + EDMA_TCD_SADDR(ch));
+        edma_writel(edma, le32_to_cpu(tcd->daddr), addr + EDMA_TCD_DADDR(ch));
+
+        edma_writew(edma, le16_to_cpu(tcd->attr), addr + EDMA_TCD_ATTR(ch));
+        edma_writew(edma, le16_to_cpu(tcd->soff), addr + EDMA_TCD_SOFF(ch));
+
+        edma_writel(edma, le32_to_cpu(tcd->nbytes), addr + EDMA_TCD_NBYTES(ch));
+        edma_writel(edma, le32_to_cpu(tcd->slast), addr + EDMA_TCD_SLAST(ch));
+
+        edma_writew(edma, le16_to_cpu(tcd->citer), addr + EDMA_TCD_CITER(ch));
+        edma_writew(edma, le16_to_cpu(tcd->biter), addr + EDMA_TCD_BITER(ch));
+        edma_writew(edma, le16_to_cpu(tcd->doff), addr + EDMA_TCD_DOFF(ch));
+
+        edma_writel(edma, le32_to_cpu(tcd->dlast_sga), addr + EDMA_TCD_DLAST_SGA(ch));
+
+        edma_writew(edma, le16_to_cpu(tcd->csr), addr + EDMA_TCD_CSR(ch));
+}
+
+static inline
+void fsl_edma_fill_tcd(struct fsl_edma_hw_tcd *tcd, u32 src, u32 dst,
+                       u16 attr, u16 soff, u32 nbytes, u32 slast, u16 citer,
+                       u16 biter, u16 doff, u32 dlast_sga, bool major_int,
+                       bool disable_req, bool enable_sg)
 {
         u16 csr = 0;
 
         /*
-         * eDMA hardware SGs require the TCD parameters stored in memory
-         * the same endian as the eDMA module so that they can be loaded
-         * automatically by the engine
+         * eDMA hardware SGs require the TCDs to be stored in little
+         * endian format irrespective of the register endian model.
+         * So we put the value in little endian in memory, waiting
+         * for fsl_edma_set_tcd_regs doing the swap.
          */
-        edma_writel(edma, src, &(tcd->saddr));
-        edma_writel(edma, dst, &(tcd->daddr));
-        edma_writew(edma, attr, &(tcd->attr));
-        edma_writew(edma, EDMA_TCD_SOFF_SOFF(soff), &(tcd->soff));
-        edma_writel(edma, EDMA_TCD_NBYTES_NBYTES(nbytes), &(tcd->nbytes));
-        edma_writel(edma, EDMA_TCD_SLAST_SLAST(slast), &(tcd->slast));
-        edma_writew(edma, EDMA_TCD_CITER_CITER(citer), &(tcd->citer));
-        edma_writew(edma, EDMA_TCD_DOFF_DOFF(doff), &(tcd->doff));
-        edma_writel(edma, EDMA_TCD_DLAST_SGA_DLAST_SGA(dlast_sga), &(tcd->dlast_sga));
-        edma_writew(edma, EDMA_TCD_BITER_BITER(biter), &(tcd->biter));
+        tcd->saddr = cpu_to_le32(src);
+        tcd->daddr = cpu_to_le32(dst);
+
+        tcd->attr = cpu_to_le16(attr);
+
+        tcd->soff = cpu_to_le16(EDMA_TCD_SOFF_SOFF(soff));
+
+        tcd->nbytes = cpu_to_le32(EDMA_TCD_NBYTES_NBYTES(nbytes));
+        tcd->slast = cpu_to_le32(EDMA_TCD_SLAST_SLAST(slast));
+
+        tcd->citer = cpu_to_le16(EDMA_TCD_CITER_CITER(citer));
+        tcd->doff = cpu_to_le16(EDMA_TCD_DOFF_DOFF(doff));
+
+        tcd->dlast_sga = cpu_to_le32(EDMA_TCD_DLAST_SGA_DLAST_SGA(dlast_sga));
+
+        tcd->biter = cpu_to_le16(EDMA_TCD_BITER_BITER(biter));
         if (major_int)
                 csr |= EDMA_TCD_CSR_INT_MAJOR;
 
@@ -482,7 +489,7 @@ static void fill_tcd_params(struct fsl_edma_engine *edma,
         if (enable_sg)
                 csr |= EDMA_TCD_CSR_E_SG;
 
-        edma_writew(edma, csr, &(tcd->csr));
+        tcd->csr = cpu_to_le16(csr);
 }
 
 static struct fsl_edma_desc *fsl_edma_alloc_desc(struct fsl_edma_chan *fsl_chan,
@@ -558,9 +565,9 @@ static struct dma_async_tx_descriptor *fsl_edma_prep_dma_cyclic(
                         doff = fsl_chan->fsc.addr_width;
                 }
 
-                fill_tcd_params(fsl_chan->edma, fsl_desc->tcd[i].vtcd, src_addr,
-                                dst_addr, fsl_chan->fsc.attr, soff, nbytes, 0,
-                                iter, iter, doff, last_sg, true, false, true);
+                fsl_edma_fill_tcd(fsl_desc->tcd[i].vtcd, src_addr, dst_addr,
+                                  fsl_chan->fsc.attr, soff, nbytes, 0, iter,
+                                  iter, doff, last_sg, true, false, true);
                 dma_buf_next += period_len;
         }
 
@@ -607,16 +614,16 @@ static struct dma_async_tx_descriptor *fsl_edma_prep_slave_sg(
                 iter = sg_dma_len(sg) / nbytes;
                 if (i < sg_len - 1) {
                         last_sg = fsl_desc->tcd[(i + 1)].ptcd;
-                        fill_tcd_params(fsl_chan->edma, fsl_desc->tcd[i].vtcd,
-                                        src_addr, dst_addr, fsl_chan->fsc.attr,
-                                        soff, nbytes, 0, iter, iter, doff, last_sg,
-                                        false, false, true);
+                        fsl_edma_fill_tcd(fsl_desc->tcd[i].vtcd, src_addr,
+                                          dst_addr, fsl_chan->fsc.attr, soff,
+                                          nbytes, 0, iter, iter, doff, last_sg,
+                                          false, false, true);
                 } else {
                         last_sg = 0;
-                        fill_tcd_params(fsl_chan->edma, fsl_desc->tcd[i].vtcd,
-                                        src_addr, dst_addr, fsl_chan->fsc.attr,
-                                        soff, nbytes, 0, iter, iter, doff, last_sg,
-                                        true, true, false);
+                        fsl_edma_fill_tcd(fsl_desc->tcd[i].vtcd, src_addr,
+                                          dst_addr, fsl_chan->fsc.attr, soff,
+                                          nbytes, 0, iter, iter, doff, last_sg,
+                                          true, true, false);
                 }
         }
 
@@ -625,17 +632,13 @@ static struct dma_async_tx_descriptor *fsl_edma_prep_slave_sg(
 
 static void fsl_edma_xfer_desc(struct fsl_edma_chan *fsl_chan)
 {
-        struct fsl_edma_hw_tcd *tcd;
         struct virt_dma_desc *vdesc;
 
         vdesc = vchan_next_desc(&fsl_chan->vchan);
         if (!vdesc)
                 return;
         fsl_chan->edesc = to_fsl_edma_desc(vdesc);
-        tcd = fsl_chan->edesc->tcd[0].vtcd;
-        fsl_edma_set_tcd_params(fsl_chan, tcd->saddr, tcd->daddr, tcd->attr,
-                        tcd->soff, tcd->nbytes, tcd->slast, tcd->citer,
-                        tcd->biter, tcd->doff, tcd->dlast_sga, tcd->csr);
+        fsl_edma_set_tcd_regs(fsl_chan, fsl_chan->edesc->tcd[0].vtcd);
         fsl_edma_enable_request(fsl_chan);
         fsl_chan->status = DMA_IN_PROGRESS;
 }
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 994bcb2c6b92..3d8feb5e4c2f 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1337,7 +1337,6 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
 
         /* Add the channel to DMA device channel list */
         list_add_tail(&chan->common.device_node, &fdev->common.channels);
-        fdev->common.chancnt++;
 
         dev_info(fdev->dev, "#%d (%s), irq %d\n", chan->id, compatible,
                  chan->irq != NO_IRQ ? chan->irq : fdev->irq);
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 88afc48c2ca7..d0df198f62e9 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -729,6 +729,7 @@ static void sdma_get_pc(struct sdma_channel *sdmac,
         case IMX_DMATYPE_CSPI:
         case IMX_DMATYPE_EXT:
         case IMX_DMATYPE_SSI:
+        case IMX_DMATYPE_SAI:
                 per_2_emi = sdma->script_addrs->app_2_mcu_addr;
                 emi_2_per = sdma->script_addrs->mcu_2_app_addr;
                 break;
@@ -1287,7 +1288,8 @@ static void sdma_load_firmware(const struct firmware *fw, void *context)
         unsigned short *ram_code;
 
         if (!fw) {
-                dev_err(sdma->dev, "firmware not found\n");
+                dev_info(sdma->dev, "external firmware not found, using ROM firmware\n");
+                /* In this case we just use the ROM firmware. */
                 return;
         }
 
@@ -1346,7 +1348,7 @@ static int sdma_get_firmware(struct sdma_engine *sdma,
         return ret;
 }
 
-static int __init sdma_init(struct sdma_engine *sdma)
+static int sdma_init(struct sdma_engine *sdma)
 {
         int i, ret;
         dma_addr_t ccb_phys;
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 895f869d6c2c..32eae38291e5 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -1265,9 +1265,17 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
         op = IOAT_OP_XOR;
 
         dest_dma = dma_map_page(dev, dest, 0, PAGE_SIZE, DMA_FROM_DEVICE);
+        if (dma_mapping_error(dev, dest_dma))
+                goto dma_unmap;
+
         for (i = 0; i < IOAT_NUM_SRC_TEST; i++)
+                dma_srcs[i] = DMA_ERROR_CODE;
+        for (i = 0; i < IOAT_NUM_SRC_TEST; i++) {
                 dma_srcs[i] = dma_map_page(dev, xor_srcs[i], 0, PAGE_SIZE,
                                            DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, dma_srcs[i]))
+                        goto dma_unmap;
+        }
         tx = dma->device_prep_dma_xor(dma_chan, dest_dma, dma_srcs,
                                       IOAT_NUM_SRC_TEST, PAGE_SIZE,
                                       DMA_PREP_INTERRUPT);
@@ -1298,7 +1306,6 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
                 goto dma_unmap;
         }
 
-        dma_unmap_page(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
         for (i = 0; i < IOAT_NUM_SRC_TEST; i++)
                 dma_unmap_page(dev, dma_srcs[i], PAGE_SIZE, DMA_TO_DEVICE);
 
@@ -1313,6 +1320,8 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
         }
         dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
 
+        dma_unmap_page(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
+
         /* skip validate if the capability is not present */
         if (!dma_has_cap(DMA_XOR_VAL, dma_chan->device->cap_mask))
                 goto free_resources;
@@ -1327,8 +1336,13 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
         xor_val_result = 1;
 
         for (i = 0; i < IOAT_NUM_SRC_TEST + 1; i++)
+                dma_srcs[i] = DMA_ERROR_CODE;
+        for (i = 0; i < IOAT_NUM_SRC_TEST + 1; i++) {
                 dma_srcs[i] = dma_map_page(dev, xor_val_srcs[i], 0, PAGE_SIZE,
                                            DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, dma_srcs[i]))
+                        goto dma_unmap;
+        }
         tx = dma->device_prep_dma_xor_val(dma_chan, dma_srcs,
                                           IOAT_NUM_SRC_TEST + 1, PAGE_SIZE,
                                           &xor_val_result, DMA_PREP_INTERRUPT);
@@ -1374,8 +1388,13 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
 
         xor_val_result = 0;
         for (i = 0; i < IOAT_NUM_SRC_TEST + 1; i++)
+                dma_srcs[i] = DMA_ERROR_CODE;
+        for (i = 0; i < IOAT_NUM_SRC_TEST + 1; i++) {
                 dma_srcs[i] = dma_map_page(dev, xor_val_srcs[i], 0, PAGE_SIZE,
                                            DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, dma_srcs[i]))
+                        goto dma_unmap;
+        }
         tx = dma->device_prep_dma_xor_val(dma_chan, dma_srcs,
                                           IOAT_NUM_SRC_TEST + 1, PAGE_SIZE,
                                           &xor_val_result, DMA_PREP_INTERRUPT);
@@ -1417,14 +1436,18 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
         goto free_resources;
 dma_unmap:
         if (op == IOAT_OP_XOR) {
-                dma_unmap_page(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
+                if (dest_dma != DMA_ERROR_CODE)
+                        dma_unmap_page(dev, dest_dma, PAGE_SIZE,
+                                       DMA_FROM_DEVICE);
                 for (i = 0; i < IOAT_NUM_SRC_TEST; i++)
-                        dma_unmap_page(dev, dma_srcs[i], PAGE_SIZE,
-                                       DMA_TO_DEVICE);
+                        if (dma_srcs[i] != DMA_ERROR_CODE)
+                                dma_unmap_page(dev, dma_srcs[i], PAGE_SIZE,
+                                               DMA_TO_DEVICE);
         } else if (op == IOAT_OP_XOR_VAL) {
                 for (i = 0; i < IOAT_NUM_SRC_TEST + 1; i++)
-                        dma_unmap_page(dev, dma_srcs[i], PAGE_SIZE,
-                                       DMA_TO_DEVICE);
+                        if (dma_srcs[i] != DMA_ERROR_CODE)
+                                dma_unmap_page(dev, dma_srcs[i], PAGE_SIZE,
+                                               DMA_TO_DEVICE);
         }
 free_resources:
         dma->device_free_chan_resources(dma_chan);
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index c56137bc3868..263d9f6a207e 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -1557,7 +1557,6 @@ static struct platform_driver iop_adma_driver = {
         .probe          = iop_adma_probe,
         .remove         = iop_adma_remove,
         .driver         = {
-                .owner  = THIS_MODULE,
                 .name   = "iop-adma",
         },
 };
diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
index a1f911aaf220..a1de14ab2c51 100644
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -722,7 +722,6 @@ static int k3_dma_probe(struct platform_device *op)
         d->slave.device_issue_pending = k3_dma_issue_pending;
         d->slave.device_control = k3_dma_control;
         d->slave.copy_align = DMA_ALIGN;
-        d->slave.chancnt = d->dma_requests;
 
         /* init virtual channel */
         d->chans = devm_kzalloc(&op->dev,
@@ -787,6 +786,7 @@ static int k3_dma_remove(struct platform_device *op)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int k3_dma_suspend(struct device *dev)
 {
         struct k3_dma_dev *d = dev_get_drvdata(dev);
@@ -816,13 +816,13 @@ static int k3_dma_resume(struct device *dev)
         k3_dma_enable_dma(d, true);
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(k3_dma_pmops, k3_dma_suspend, k3_dma_resume);
 
 static struct platform_driver k3_pdma_driver = {
         .driver         = {
                 .name   = DRIVER_NAME,
-                .owner  = THIS_MODULE,
                 .pm     = &k3_dma_pmops,
                 .of_match_table = k3_pdma_dt_ids,
         },
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index a1a4db5721b8..8b8952f35e6c 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -1098,7 +1098,6 @@ static const struct platform_device_id mmp_pdma_id_table[] = {
 static struct platform_driver mmp_pdma_driver = {
         .driver         = {
                 .name   = "mmp-pdma",
-                .owner  = THIS_MODULE,
                 .of_match_table = mmp_pdma_dt_ids,
         },
         .id_table       = mmp_pdma_id_table,
diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
index c6bd015b7165..bfb46957c3dc 100644
--- a/drivers/dma/mmp_tdma.c
+++ b/drivers/dma/mmp_tdma.c
@@ -703,7 +703,6 @@ static const struct platform_device_id mmp_tdma_id_table[] = {
 static struct platform_driver mmp_tdma_driver = {
         .driver         = {
                 .name   = "mmp-tdma",
-                .owner  = THIS_MODULE,
                 .of_match_table = mmp_tdma_dt_ids,
         },
         .id_table       = mmp_tdma_id_table,
diff --git a/drivers/dma/mpc512x_dma.c b/drivers/dma/mpc512x_dma.c
index 881db2bcb48b..01bec4023de2 100644
--- a/drivers/dma/mpc512x_dma.c
+++ b/drivers/dma/mpc512x_dma.c
@@ -885,6 +885,7 @@ static int mpc_dma_probe(struct platform_device *op)
         struct resource res;
         ulong regs_start, regs_size;
         int retval, i;
+        u8 chancnt;
 
         mdma = devm_kzalloc(dev, sizeof(struct mpc_dma), GFP_KERNEL);
         if (!mdma) {
@@ -956,10 +957,6 @@ static int mpc_dma_probe(struct platform_device *op)
 
         dma = &mdma->dma;
         dma->dev = dev;
-        if (mdma->is_mpc8308)
-                dma->chancnt = MPC8308_DMACHAN_MAX;
-        else
-                dma->chancnt = MPC512x_DMACHAN_MAX;
         dma->device_alloc_chan_resources = mpc_dma_alloc_chan_resources;
         dma->device_free_chan_resources = mpc_dma_free_chan_resources;
         dma->device_issue_pending = mpc_dma_issue_pending;
@@ -972,7 +969,12 @@ static int mpc_dma_probe(struct platform_device *op)
         dma_cap_set(DMA_MEMCPY, dma->cap_mask);
         dma_cap_set(DMA_SLAVE, dma->cap_mask);
 
-        for (i = 0; i < dma->chancnt; i++) {
+        if (mdma->is_mpc8308)
+                chancnt = MPC8308_DMACHAN_MAX;
+        else
+                chancnt = MPC512x_DMACHAN_MAX;
+
+        for (i = 0; i < chancnt; i++) {
                 mchan = &mdma->channels[i];
 
                 mchan->chan.device = dma;
@@ -1090,7 +1092,6 @@ static struct platform_driver mpc_dma_driver = {
         .remove         = mpc_dma_remove,
         .driver = {
                 .name = DRV_NAME,
-                .owner = THIS_MODULE,
                 .of_match_table = mpc_dma_match,
         },
 };
diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
index bda20e6e1007..d7d61e1a01c3 100644
--- a/drivers/dma/nbpfaxi.c
+++ b/drivers/dma/nbpfaxi.c
@@ -1500,7 +1500,6 @@ static const struct dev_pm_ops nbpf_pm_ops = {
 
 static struct platform_driver nbpf_driver = {
         .driver = {
-                .owner = THIS_MODULE,
                 .name = "dma-nbpf",
                 .of_match_table = nbpf_match,
                 .pm = &nbpf_pm_ops,
diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
index bbea8243f9e8..6ea1aded7e74 100644
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -1074,8 +1074,6 @@ static int omap_dma_chan_init(struct omap_dmadev *od, int dma_sig)
         vchan_init(&c->vc, &od->ddev);
         INIT_LIST_HEAD(&c->node);
 
-        od->ddev.chancnt++;
-
         return 0;
 }
 
diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
index 9f9ca9fe5ce6..6e0e47d76b23 100644
--- a/drivers/dma/pch_dma.c
+++ b/drivers/dma/pch_dma.c
@@ -997,7 +997,7 @@ static void pch_dma_remove(struct pci_dev *pdev)
 #define PCI_DEVICE_ID_ML7831_DMA1_8CH   0x8810
 #define PCI_DEVICE_ID_ML7831_DMA2_4CH   0x8815
 
-const struct pci_device_id pch_dma_id_table[] = {
+static const struct pci_device_id pch_dma_id_table[] = {
         { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_EG20T_PCH_DMA_8CH), 8 },
         { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_EG20T_PCH_DMA_4CH), 4 },
         { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7213_DMA1_8CH), 8}, /* UART Video */
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 19a99743cf52..bdf40b530032 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -27,6 +27,7 @@
 #include <linux/of.h>
 #include <linux/of_dma.h>
 #include <linux/err.h>
+#include <linux/pm_runtime.h>
 
 #include "dmaengine.h"
 #define PL330_MAX_CHAN          8
@@ -265,6 +266,9 @@ static unsigned cmd_line;
 
 #define NR_DEFAULT_DESC 16
 
+/* Delay for runtime PM autosuspend, ms */
+#define PL330_AUTOSUSPEND_DELAY 20
+
 /* Populated by the PL330 core driver for DMA API driver's info */
 struct pl330_config {
         u32     periph_id;
@@ -1958,6 +1962,7 @@ static void pl330_tasklet(unsigned long data)
         struct dma_pl330_chan *pch = (struct dma_pl330_chan *)data;
         struct dma_pl330_desc *desc, *_dt;
         unsigned long flags;
+        bool power_down = false;
 
         spin_lock_irqsave(&pch->lock, flags);
 
@@ -1972,10 +1977,17 @@ static void pl330_tasklet(unsigned long data)
         /* Try to submit a req imm. next to the last completed cookie */
         fill_queue(pch);
 
-        /* Make sure the PL330 Channel thread is active */
-        spin_lock(&pch->thread->dmac->lock);
-        _start(pch->thread);
-        spin_unlock(&pch->thread->dmac->lock);
+        if (list_empty(&pch->work_list)) {
+                spin_lock(&pch->thread->dmac->lock);
+                _stop(pch->thread);
+                spin_unlock(&pch->thread->dmac->lock);
+                power_down = true;
+        } else {
+                /* Make sure the PL330 Channel thread is active */
+                spin_lock(&pch->thread->dmac->lock);
+                _start(pch->thread);
+                spin_unlock(&pch->thread->dmac->lock);
+        }
 
         while (!list_empty(&pch->completed_list)) {
                 dma_async_tx_callback callback;
@@ -1990,6 +2002,12 @@ static void pl330_tasklet(unsigned long data)
                 if (pch->cyclic) {
                         desc->status = PREP;
                         list_move_tail(&desc->node, &pch->work_list);
+                        if (power_down) {
+                                spin_lock(&pch->thread->dmac->lock);
+                                _start(pch->thread);
+                                spin_unlock(&pch->thread->dmac->lock);
+                                power_down = false;
+                        }
                 } else {
                         desc->status = FREE;
                         list_move_tail(&desc->node, &pch->dmac->desc_pool);
@@ -2004,6 +2022,12 @@ static void pl330_tasklet(unsigned long data)
                 }
         }
         spin_unlock_irqrestore(&pch->lock, flags);
+
+        /* If work list empty, power down */
+        if (power_down) {
+                pm_runtime_mark_last_busy(pch->dmac->ddma.dev);
+                pm_runtime_put_autosuspend(pch->dmac->ddma.dev);
+        }
 }
 
 bool pl330_filter(struct dma_chan *chan, void *param)
@@ -2073,6 +2097,7 @@ static int pl330_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd, unsigned
 
         switch (cmd) {
         case DMA_TERMINATE_ALL:
+                pm_runtime_get_sync(pl330->ddma.dev);
                 spin_lock_irqsave(&pch->lock, flags);
 
                 spin_lock(&pl330->lock);
@@ -2099,10 +2124,15 @@ static int pl330_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd, unsigned
                         dma_cookie_complete(&desc->txd);
                 }
 
+                if (!list_empty(&pch->work_list))
+                        pm_runtime_put(pl330->ddma.dev);
+
                 list_splice_tail_init(&pch->submitted_list, &pl330->desc_pool);
                 list_splice_tail_init(&pch->work_list, &pl330->desc_pool);
                 list_splice_tail_init(&pch->completed_list, &pl330->desc_pool);
                 spin_unlock_irqrestore(&pch->lock, flags);
+                pm_runtime_mark_last_busy(pl330->ddma.dev);
+                pm_runtime_put_autosuspend(pl330->ddma.dev);
                 break;
         case DMA_SLAVE_CONFIG:
                 slave_config = (struct dma_slave_config *)arg;
@@ -2138,6 +2168,7 @@ static void pl330_free_chan_resources(struct dma_chan *chan)
 
         tasklet_kill(&pch->task);
 
+        pm_runtime_get_sync(pch->dmac->ddma.dev);
         spin_lock_irqsave(&pch->lock, flags);
 
         pl330_release_channel(pch->thread);
@@ -2147,6 +2178,8 @@ static void pl330_free_chan_resources(struct dma_chan *chan)
                 list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool);
 
         spin_unlock_irqrestore(&pch->lock, flags);
+        pm_runtime_mark_last_busy(pch->dmac->ddma.dev);
+        pm_runtime_put_autosuspend(pch->dmac->ddma.dev);
 }
 
 static enum dma_status
@@ -2162,6 +2195,15 @@ static void pl330_issue_pending(struct dma_chan *chan)
         unsigned long flags;
 
         spin_lock_irqsave(&pch->lock, flags);
+        if (list_empty(&pch->work_list)) {
+                /*
+                 * Warn on nothing pending. Empty submitted_list may
+                 * break our pm_runtime usage counter as it is
+                 * updated on work_list emptiness status.
+                 */
+                WARN_ON(list_empty(&pch->submitted_list));
+                pm_runtime_get_sync(pch->dmac->ddma.dev);
+        }
         list_splice_tail_init(&pch->submitted_list, &pch->work_list);
         spin_unlock_irqrestore(&pch->lock, flags);
 
@@ -2594,6 +2636,46 @@ static int pl330_dma_device_slave_caps(struct dma_chan *dchan,
         return 0;
 }
 
+/*
+ * Runtime PM callbacks are provided by amba/bus.c driver.
+ *
+ * It is assumed here that IRQ safe runtime PM is chosen in probe and amba
+ * bus driver will only disable/enable the clock in runtime PM callbacks.
+ */
+static int __maybe_unused pl330_suspend(struct device *dev)
+{
+        struct amba_device *pcdev = to_amba_device(dev);
+
+        pm_runtime_disable(dev);
+
+        if (!pm_runtime_status_suspended(dev)) {
+                /* amba did not disable the clock */
+                amba_pclk_disable(pcdev);
+        }
+        amba_pclk_unprepare(pcdev);
+
+        return 0;
+}
+
+static int __maybe_unused pl330_resume(struct device *dev)
+{
+        struct amba_device *pcdev = to_amba_device(dev);
+        int ret;
+
+        ret = amba_pclk_prepare(pcdev);
+        if (ret)
+                return ret;
+
+        if (!pm_runtime_status_suspended(dev))
+                ret = amba_pclk_enable(pcdev);
+
+        pm_runtime_enable(dev);
+
+        return ret;
+}
+
+static SIMPLE_DEV_PM_OPS(pl330_pm, pl330_suspend, pl330_resume);
+
 static int
 pl330_probe(struct amba_device *adev, const struct amba_id *id)
 {
@@ -2619,6 +2701,9 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                 return -ENOMEM;
         }
 
+        pd = &pl330->ddma;
+        pd->dev = &adev->dev;
+
         pl330->mcbufsz = pdat ? pdat->mcbuf_sz : 0;
 
         res = &adev->res;
@@ -2655,7 +2740,6 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
         if (!add_desc(pl330, GFP_KERNEL, NR_DEFAULT_DESC))
                 dev_warn(&adev->dev, "unable to allocate desc\n");
 
-        pd = &pl330->ddma;
         INIT_LIST_HEAD(&pd->channels);
 
         /* Initialize channel parameters */
@@ -2692,7 +2776,6 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                 list_add_tail(&pch->chan.device_node, &pd->channels);
         }
 
-        pd->dev = &adev->dev;
         if (pdat) {
                 pd->cap_mask = pdat->cap_mask;
         } else {
@@ -2747,6 +2830,12 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                 pcfg->data_buf_dep, pcfg->data_bus_width / 8, pcfg->num_chan,
                 pcfg->num_peri, pcfg->num_events);
 
+        pm_runtime_irq_safe(&adev->dev);
+        pm_runtime_use_autosuspend(&adev->dev);
+        pm_runtime_set_autosuspend_delay(&adev->dev, PL330_AUTOSUSPEND_DELAY);
+        pm_runtime_mark_last_busy(&adev->dev);
+        pm_runtime_put_autosuspend(&adev->dev);
+
         return 0;
 probe_err3:
         /* Idle the DMAC */
@@ -2773,6 +2862,8 @@ static int pl330_remove(struct amba_device *adev)
         struct pl330_dmac *pl330 = amba_get_drvdata(adev);
         struct dma_pl330_chan *pch, *_p;
 
+        pm_runtime_get_noresume(pl330->ddma.dev);
+
         if (adev->dev.of_node)
                 of_dma_controller_free(adev->dev.of_node);
 
@@ -2811,6 +2902,7 @@ static struct amba_driver pl330_driver = {
         .drv = {
                 .owner = THIS_MODULE,
                 .name = "dma-pl330",
+                .pm = &pl330_pm,
         },
         .id_table = pl330_ids,
         .probe = pl330_probe,
@@ -2819,6 +2911,6 @@ static struct amba_driver pl330_driver = {
 
 module_amba_driver(pl330_driver);
 
-MODULE_AUTHOR("Jaswinder Singh <jassi.brar@samsung.com>");
+MODULE_AUTHOR("Jaswinder Singh <jassisinghbrar@gmail.com>");
 MODULE_DESCRIPTION("API Driver for PL330 DMAC");
 MODULE_LICENSE("GPL");
diff --git a/drivers/dma/qcom_bam_dma.c b/drivers/dma/qcom_bam_dma.c
index 7a4bbb0f80a5..3122a99ec06b 100644
--- a/drivers/dma/qcom_bam_dma.c
+++ b/drivers/dma/qcom_bam_dma.c
@@ -79,35 +79,97 @@ struct bam_async_desc {
         struct bam_desc_hw desc[0];
 };
 
-#define BAM_CTRL                        0x0000
-#define BAM_REVISION                    0x0004
-#define BAM_SW_REVISION                 0x0080
-#define BAM_NUM_PIPES                   0x003C
-#define BAM_TIMER                       0x0040
-#define BAM_TIMER_CTRL                  0x0044
-#define BAM_DESC_CNT_TRSHLD             0x0008
-#define BAM_IRQ_SRCS                    0x000C
-#define BAM_IRQ_SRCS_MSK                0x0010
-#define BAM_IRQ_SRCS_UNMASKED           0x0030
-#define BAM_IRQ_STTS                    0x0014
-#define BAM_IRQ_CLR                     0x0018
-#define BAM_IRQ_EN                      0x001C
-#define BAM_CNFG_BITS                   0x007C
-#define BAM_IRQ_SRCS_EE(ee)             (0x0800 + ((ee) * 0x80))
-#define BAM_IRQ_SRCS_MSK_EE(ee)         (0x0804 + ((ee) * 0x80))
-#define BAM_P_CTRL(pipe)                (0x1000 + ((pipe) * 0x1000))
-#define BAM_P_RST(pipe)                 (0x1004 + ((pipe) * 0x1000))
-#define BAM_P_HALT(pipe)                (0x1008 + ((pipe) * 0x1000))
-#define BAM_P_IRQ_STTS(pipe)            (0x1010 + ((pipe) * 0x1000))
-#define BAM_P_IRQ_CLR(pipe)             (0x1014 + ((pipe) * 0x1000))
-#define BAM_P_IRQ_EN(pipe)              (0x1018 + ((pipe) * 0x1000))
-#define BAM_P_EVNT_DEST_ADDR(pipe)      (0x182C + ((pipe) * 0x1000))
-#define BAM_P_EVNT_REG(pipe)            (0x1818 + ((pipe) * 0x1000))
-#define BAM_P_SW_OFSTS(pipe)            (0x1800 + ((pipe) * 0x1000))
-#define BAM_P_DATA_FIFO_ADDR(pipe)      (0x1824 + ((pipe) * 0x1000))
-#define BAM_P_DESC_FIFO_ADDR(pipe)      (0x181C + ((pipe) * 0x1000))
-#define BAM_P_EVNT_TRSHLD(pipe)         (0x1828 + ((pipe) * 0x1000))
-#define BAM_P_FIFO_SIZES(pipe)          (0x1820 + ((pipe) * 0x1000))
+enum bam_reg {
+        BAM_CTRL,
+        BAM_REVISION,
+        BAM_NUM_PIPES,
+        BAM_DESC_CNT_TRSHLD,
+        BAM_IRQ_SRCS,
+        BAM_IRQ_SRCS_MSK,
+        BAM_IRQ_SRCS_UNMASKED,
+        BAM_IRQ_STTS,
+        BAM_IRQ_CLR,
+        BAM_IRQ_EN,
+        BAM_CNFG_BITS,
+        BAM_IRQ_SRCS_EE,
+        BAM_IRQ_SRCS_MSK_EE,
+        BAM_P_CTRL,
+        BAM_P_RST,
+        BAM_P_HALT,
+        BAM_P_IRQ_STTS,
+        BAM_P_IRQ_CLR,
+        BAM_P_IRQ_EN,
+        BAM_P_EVNT_DEST_ADDR,
+        BAM_P_EVNT_REG,
+        BAM_P_SW_OFSTS,
+        BAM_P_DATA_FIFO_ADDR,
+        BAM_P_DESC_FIFO_ADDR,
+        BAM_P_EVNT_GEN_TRSHLD,
+        BAM_P_FIFO_SIZES,
+};
+
+struct reg_offset_data {
+        u32 base_offset;
+        unsigned int pipe_mult, evnt_mult, ee_mult;
+};
+
+static const struct reg_offset_data bam_v1_3_reg_info[] = {
+        [BAM_CTRL]              = { 0x0F80, 0x00, 0x00, 0x00 },
+        [BAM_REVISION]          = { 0x0F84, 0x00, 0x00, 0x00 },
+        [BAM_NUM_PIPES]         = { 0x0FBC, 0x00, 0x00, 0x00 },
+        [BAM_DESC_CNT_TRSHLD]   = { 0x0F88, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS]          = { 0x0F8C, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS_MSK]      = { 0x0F90, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS_UNMASKED] = { 0x0FB0, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_STTS]          = { 0x0F94, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_CLR]           = { 0x0F98, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_EN]            = { 0x0F9C, 0x00, 0x00, 0x00 },
+        [BAM_CNFG_BITS]         = { 0x0FFC, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS_EE]       = { 0x1800, 0x00, 0x00, 0x80 },
+        [BAM_IRQ_SRCS_MSK_EE]   = { 0x1804, 0x00, 0x00, 0x80 },
+        [BAM_P_CTRL]            = { 0x0000, 0x80, 0x00, 0x00 },
+        [BAM_P_RST]             = { 0x0004, 0x80, 0x00, 0x00 },
+        [BAM_P_HALT]            = { 0x0008, 0x80, 0x00, 0x00 },
+        [BAM_P_IRQ_STTS]        = { 0x0010, 0x80, 0x00, 0x00 },
+        [BAM_P_IRQ_CLR]         = { 0x0014, 0x80, 0x00, 0x00 },
+        [BAM_P_IRQ_EN]          = { 0x0018, 0x80, 0x00, 0x00 },
+        [BAM_P_EVNT_DEST_ADDR]  = { 0x102C, 0x00, 0x40, 0x00 },
+        [BAM_P_EVNT_REG]        = { 0x1018, 0x00, 0x40, 0x00 },
+        [BAM_P_SW_OFSTS]        = { 0x1000, 0x00, 0x40, 0x00 },
+        [BAM_P_DATA_FIFO_ADDR]  = { 0x1024, 0x00, 0x40, 0x00 },
+        [BAM_P_DESC_FIFO_ADDR]  = { 0x101C, 0x00, 0x40, 0x00 },
+        [BAM_P_EVNT_GEN_TRSHLD] = { 0x1028, 0x00, 0x40, 0x00 },
+        [BAM_P_FIFO_SIZES]      = { 0x1020, 0x00, 0x40, 0x00 },
+};
+
+static const struct reg_offset_data bam_v1_4_reg_info[] = {
+        [BAM_CTRL]              = { 0x0000, 0x00, 0x00, 0x00 },
+        [BAM_REVISION]          = { 0x0004, 0x00, 0x00, 0x00 },
+        [BAM_NUM_PIPES]         = { 0x003C, 0x00, 0x00, 0x00 },
+        [BAM_DESC_CNT_TRSHLD]   = { 0x0008, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS]          = { 0x000C, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS_MSK]      = { 0x0010, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS_UNMASKED] = { 0x0030, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_STTS]          = { 0x0014, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_CLR]           = { 0x0018, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_EN]            = { 0x001C, 0x00, 0x00, 0x00 },
+        [BAM_CNFG_BITS]         = { 0x007C, 0x00, 0x00, 0x00 },
+        [BAM_IRQ_SRCS_EE]       = { 0x0800, 0x00, 0x00, 0x80 },
+        [BAM_IRQ_SRCS_MSK_EE]   = { 0x0804, 0x00, 0x00, 0x80 },
+        [BAM_P_CTRL]            = { 0x1000, 0x1000, 0x00, 0x00 },
+        [BAM_P_RST]             = { 0x1004, 0x1000, 0x00, 0x00 },
+        [BAM_P_HALT]            = { 0x1008, 0x1000, 0x00, 0x00 },
+        [BAM_P_IRQ_STTS]        = { 0x1010, 0x1000, 0x00, 0x00 },
+        [BAM_P_IRQ_CLR]         = { 0x1014, 0x1000, 0x00, 0x00 },
+        [BAM_P_IRQ_EN]          = { 0x1018, 0x1000, 0x00, 0x00 },
+        [BAM_P_EVNT_DEST_ADDR]  = { 0x102C, 0x00, 0x1000, 0x00 },
+        [BAM_P_EVNT_REG]        = { 0x1018, 0x00, 0x1000, 0x00 },
+        [BAM_P_SW_OFSTS]        = { 0x1000, 0x00, 0x1000, 0x00 },
+        [BAM_P_DATA_FIFO_ADDR]  = { 0x1824, 0x00, 0x1000, 0x00 },
+        [BAM_P_DESC_FIFO_ADDR]  = { 0x181C, 0x00, 0x1000, 0x00 },
+        [BAM_P_EVNT_GEN_TRSHLD] = { 0x1828, 0x00, 0x1000, 0x00 },
+        [BAM_P_FIFO_SIZES]      = { 0x1820, 0x00, 0x1000, 0x00 },
+};
 
 /* BAM CTRL */
 #define BAM_SW_RST                      BIT(0)
@@ -297,6 +359,8 @@ struct bam_device {
         /* execution environment ID, from DT */
         u32 ee;
 
+        const struct reg_offset_data *layout;
+
         struct clk *bamclk;
         int irq;
 
@@ -305,6 +369,23 @@ struct bam_device {
 };
 
 /**
+ * bam_addr - returns BAM register address
+ * @bdev: bam device
+ * @pipe: pipe instance (ignored when register doesn't have multiple instances)
+ * @reg:  register enum
+ */
+static inline void __iomem *bam_addr(struct bam_device *bdev, u32 pipe,
+                enum bam_reg reg)
+{
+        const struct reg_offset_data r = bdev->layout[reg];
+
+        return bdev->regs + r.base_offset +
+                r.pipe_mult * pipe +
+                r.evnt_mult * pipe +
+                r.ee_mult * bdev->ee;
+}
+
+/**
  * bam_reset_channel - Reset individual BAM DMA channel
  * @bchan: bam channel
  *
@@ -317,8 +398,8 @@ static void bam_reset_channel(struct bam_chan *bchan)
         lockdep_assert_held(&bchan->vc.lock);
 
         /* reset channel */
-        writel_relaxed(1, bdev->regs + BAM_P_RST(bchan->id));
-        writel_relaxed(0, bdev->regs + BAM_P_RST(bchan->id));
+        writel_relaxed(1, bam_addr(bdev, bchan->id, BAM_P_RST));
+        writel_relaxed(0, bam_addr(bdev, bchan->id, BAM_P_RST));
 
         /* don't allow cpu to reorder BAM register accesses done after this */
         wmb();
@@ -347,17 +428,18 @@ static void bam_chan_init_hw(struct bam_chan *bchan,
          * because we allocated 1 more descriptor (8 bytes) than we can use
          */
         writel_relaxed(ALIGN(bchan->fifo_phys, sizeof(struct bam_desc_hw)),
-                        bdev->regs + BAM_P_DESC_FIFO_ADDR(bchan->id));
-        writel_relaxed(BAM_DESC_FIFO_SIZE, bdev->regs +
-                        BAM_P_FIFO_SIZES(bchan->id));
+                        bam_addr(bdev, bchan->id, BAM_P_DESC_FIFO_ADDR));
+        writel_relaxed(BAM_DESC_FIFO_SIZE,
+                        bam_addr(bdev, bchan->id, BAM_P_FIFO_SIZES));
 
         /* enable the per pipe interrupts, enable EOT, ERR, and INT irqs */
-        writel_relaxed(P_DEFAULT_IRQS_EN, bdev->regs + BAM_P_IRQ_EN(bchan->id));
+        writel_relaxed(P_DEFAULT_IRQS_EN,
+                        bam_addr(bdev, bchan->id, BAM_P_IRQ_EN));
 
         /* unmask the specific pipe and EE combo */
-        val = readl_relaxed(bdev->regs + BAM_IRQ_SRCS_MSK_EE(bdev->ee));
+        val = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_SRCS_MSK_EE));
         val |= BIT(bchan->id);
-        writel_relaxed(val, bdev->regs + BAM_IRQ_SRCS_MSK_EE(bdev->ee));
+        writel_relaxed(val, bam_addr(bdev, 0, BAM_IRQ_SRCS_MSK_EE));
 
         /* don't allow cpu to reorder the channel enable done below */
         wmb();
@@ -367,7 +449,7 @@ static void bam_chan_init_hw(struct bam_chan *bchan,
         if (dir == DMA_DEV_TO_MEM)
                 val |= P_DIRECTION;
 
-        writel_relaxed(val, bdev->regs + BAM_P_CTRL(bchan->id));
+        writel_relaxed(val, bam_addr(bdev, bchan->id, BAM_P_CTRL));
 
         bchan->initialized = 1;
 
@@ -432,12 +514,12 @@ static void bam_free_chan(struct dma_chan *chan)
         bchan->fifo_virt = NULL;
 
         /* mask irq for pipe/channel */
-        val = readl_relaxed(bdev->regs + BAM_IRQ_SRCS_MSK_EE(bdev->ee));
+        val = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_SRCS_MSK_EE));
         val &= ~BIT(bchan->id);
-        writel_relaxed(val, bdev->regs + BAM_IRQ_SRCS_MSK_EE(bdev->ee));
+        writel_relaxed(val, bam_addr(bdev, 0, BAM_IRQ_SRCS_MSK_EE));
 
         /* disable irq */
-        writel_relaxed(0, bdev->regs + BAM_P_IRQ_EN(bchan->id));
+        writel_relaxed(0, bam_addr(bdev, bchan->id, BAM_P_IRQ_EN));
 }
 
 /**
@@ -583,14 +665,14 @@ static int bam_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
         switch (cmd) {
         case DMA_PAUSE:
                 spin_lock_irqsave(&bchan->vc.lock, flag);
-                writel_relaxed(1, bdev->regs + BAM_P_HALT(bchan->id));
+                writel_relaxed(1, bam_addr(bdev, bchan->id, BAM_P_HALT));
                 bchan->paused = 1;
                 spin_unlock_irqrestore(&bchan->vc.lock, flag);
                 break;
 
         case DMA_RESUME:
                 spin_lock_irqsave(&bchan->vc.lock, flag);
-                writel_relaxed(0, bdev->regs + BAM_P_HALT(bchan->id));
+                writel_relaxed(0, bam_addr(bdev, bchan->id, BAM_P_HALT));
                 bchan->paused = 0;
                 spin_unlock_irqrestore(&bchan->vc.lock, flag);
                 break;
@@ -626,7 +708,7 @@ static u32 process_channel_irqs(struct bam_device *bdev)
         unsigned long flags;
         struct bam_async_desc *async_desc;
 
-        srcs = readl_relaxed(bdev->regs + BAM_IRQ_SRCS_EE(bdev->ee));
+        srcs = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_SRCS_EE));
 
         /* return early if no pipe/channel interrupts are present */
         if (!(srcs & P_IRQ))
@@ -639,11 +721,9 @@ static u32 process_channel_irqs(struct bam_device *bdev)
                         continue;
 
                 /* clear pipe irq */
-                pipe_stts = readl_relaxed(bdev->regs +
-                        BAM_P_IRQ_STTS(i));
+                pipe_stts = readl_relaxed(bam_addr(bdev, i, BAM_P_IRQ_STTS));
 
-                writel_relaxed(pipe_stts, bdev->regs +
-                                BAM_P_IRQ_CLR(i));
+                writel_relaxed(pipe_stts, bam_addr(bdev, i, BAM_P_IRQ_CLR));
 
                 spin_lock_irqsave(&bchan->vc.lock, flags);
                 async_desc = bchan->curr_txd;
@@ -694,12 +774,12 @@ static irqreturn_t bam_dma_irq(int irq, void *data)
                 tasklet_schedule(&bdev->task);
 
         if (srcs & BAM_IRQ)
-                clr_mask = readl_relaxed(bdev->regs + BAM_IRQ_STTS);
+                clr_mask = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_STTS));
 
         /* don't allow reorder of the various accesses to the BAM registers */
         mb();
 
-        writel_relaxed(clr_mask, bdev->regs + BAM_IRQ_CLR);
+        writel_relaxed(clr_mask, bam_addr(bdev, 0, BAM_IRQ_CLR));
 
         return IRQ_HANDLED;
 }
@@ -763,7 +843,7 @@ static void bam_apply_new_config(struct bam_chan *bchan,
         else
                 maxburst = bchan->slave.dst_maxburst;
 
-        writel_relaxed(maxburst, bdev->regs + BAM_DESC_CNT_TRSHLD);
+        writel_relaxed(maxburst, bam_addr(bdev, 0, BAM_DESC_CNT_TRSHLD));
 
         bchan->reconfigure = 0;
 }
@@ -830,7 +910,7 @@ static void bam_start_dma(struct bam_chan *bchan)
         /* ensure descriptor writes and dma start not reordered */
         wmb();
         writel_relaxed(bchan->tail * sizeof(struct bam_desc_hw),
-                        bdev->regs + BAM_P_EVNT_REG(bchan->id));
+                        bam_addr(bdev, bchan->id, BAM_P_EVNT_REG));
 }
 
 /**
@@ -918,43 +998,44 @@ static int bam_init(struct bam_device *bdev)
         u32 val;
 
         /* read revision and configuration information */
-        val = readl_relaxed(bdev->regs + BAM_REVISION) >> NUM_EES_SHIFT;
+        val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION)) >> NUM_EES_SHIFT;
         val &= NUM_EES_MASK;
 
         /* check that configured EE is within range */
         if (bdev->ee >= val)
                 return -EINVAL;
 
-        val = readl_relaxed(bdev->regs + BAM_NUM_PIPES);
+        val = readl_relaxed(bam_addr(bdev, 0, BAM_NUM_PIPES));
         bdev->num_channels = val & BAM_NUM_PIPES_MASK;
 
         /* s/w reset bam */
         /* after reset all pipes are disabled and idle */
-        val = readl_relaxed(bdev->regs + BAM_CTRL);
+        val = readl_relaxed(bam_addr(bdev, 0, BAM_CTRL));
         val |= BAM_SW_RST;
-        writel_relaxed(val, bdev->regs + BAM_CTRL);
+        writel_relaxed(val, bam_addr(bdev, 0, BAM_CTRL));
         val &= ~BAM_SW_RST;
-        writel_relaxed(val, bdev->regs + BAM_CTRL);
+        writel_relaxed(val, bam_addr(bdev, 0, BAM_CTRL));
 
         /* make sure previous stores are visible before enabling BAM */
         wmb();
 
         /* enable bam */
         val |= BAM_EN;
-        writel_relaxed(val, bdev->regs + BAM_CTRL);
+        writel_relaxed(val, bam_addr(bdev, 0, BAM_CTRL));
 
         /* set descriptor threshhold, start with 4 bytes */
-        writel_relaxed(DEFAULT_CNT_THRSHLD, bdev->regs + BAM_DESC_CNT_TRSHLD);
+        writel_relaxed(DEFAULT_CNT_THRSHLD,
+                        bam_addr(bdev, 0, BAM_DESC_CNT_TRSHLD));
 
         /* Enable default set of h/w workarounds, ie all except BAM_FULL_PIPE */
-        writel_relaxed(BAM_CNFG_BITS_DEFAULT, bdev->regs + BAM_CNFG_BITS);
+        writel_relaxed(BAM_CNFG_BITS_DEFAULT, bam_addr(bdev, 0, BAM_CNFG_BITS));
 
         /* enable irqs for errors */
         writel_relaxed(BAM_ERROR_EN | BAM_HRESP_ERR_EN,
-                                bdev->regs + BAM_IRQ_EN);
+                        bam_addr(bdev, 0, BAM_IRQ_EN));
 
         /* unmask global bam interrupt */
-        writel_relaxed(BAM_IRQ_MSK, bdev->regs + BAM_IRQ_SRCS_MSK_EE(bdev->ee));
+        writel_relaxed(BAM_IRQ_MSK, bam_addr(bdev, 0, BAM_IRQ_SRCS_MSK_EE));
 
         return 0;
 }
@@ -969,9 +1050,18 @@ static void bam_channel_init(struct bam_device *bdev, struct bam_chan *bchan,
         bchan->vc.desc_free = bam_dma_free_desc;
 }
 
+static const struct of_device_id bam_of_match[] = {
+        { .compatible = "qcom,bam-v1.3.0", .data = &bam_v1_3_reg_info },
+        { .compatible = "qcom,bam-v1.4.0", .data = &bam_v1_4_reg_info },
+        {}
+};
+
+MODULE_DEVICE_TABLE(of, bam_of_match);
+
 static int bam_dma_probe(struct platform_device *pdev)
 {
         struct bam_device *bdev;
+        const struct of_device_id *match;
         struct resource *iores;
         int ret, i;
 
@@ -981,6 +1071,14 @@ static int bam_dma_probe(struct platform_device *pdev)
 
         bdev->dev = &pdev->dev;
 
+        match = of_match_node(bam_of_match, pdev->dev.of_node);
+        if (!match) {
+                dev_err(&pdev->dev, "Unsupported BAM module\n");
+                return -ENODEV;
+        }
+
+        bdev->layout = match->data;
+
         iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         bdev->regs = devm_ioremap_resource(&pdev->dev, iores);
         if (IS_ERR(bdev->regs))
@@ -1084,7 +1182,7 @@ static int bam_dma_remove(struct platform_device *pdev)
         dma_async_device_unregister(&bdev->common);
 
         /* mask all interrupts for this execution environment */
-        writel_relaxed(0, bdev->regs + BAM_IRQ_SRCS_MSK_EE(bdev->ee));
+        writel_relaxed(0, bam_addr(bdev, 0,  BAM_IRQ_SRCS_MSK_EE));
 
         devm_free_irq(bdev->dev, bdev->irq, bdev);
 
@@ -1104,18 +1202,11 @@ static int bam_dma_remove(struct platform_device *pdev)
         return 0;
 }
 
-static const struct of_device_id bam_of_match[] = {
-        { .compatible = "qcom,bam-v1.4.0", },
-        {}
-};
-MODULE_DEVICE_TABLE(of, bam_of_match);
-
 static struct platform_driver bam_dma_driver = {
         .probe = bam_dma_probe,
         .remove = bam_dma_remove,
         .driver = {
                 .name = "bam-dma-engine",
-                .owner = THIS_MODULE,
                 .of_match_table = bam_of_match,
         },
 };
diff --git a/drivers/dma/s3c24xx-dma.c b/drivers/dma/s3c24xx-dma.c
index 7416572d1e40..6941a77521c3 100644
--- a/drivers/dma/s3c24xx-dma.c
+++ b/drivers/dma/s3c24xx-dma.c
@@ -1402,7 +1402,6 @@ static int s3c24xx_dma_remove(struct platform_device *pdev)
 static struct platform_driver s3c24xx_dma_driver = {
         .driver         = {
                 .name   = "s3c24xx-dma",
-                .owner  = THIS_MODULE,
         },
         .id_table       = s3c24xx_dma_driver_ids,
         .probe          = s3c24xx_dma_probe,
diff --git a/drivers/dma/sa11x0-dma.c b/drivers/dma/sa11x0-dma.c
index 4b0ef043729a..2329d295efb5 100644
--- a/drivers/dma/sa11x0-dma.c
+++ b/drivers/dma/sa11x0-dma.c
@@ -829,7 +829,6 @@ static int sa11x0_dma_init_dmadev(struct dma_device *dmadev,
 {
         unsigned i;
 
-        dmadev->chancnt = ARRAY_SIZE(chan_desc);
         INIT_LIST_HEAD(&dmadev->channels);
         dmadev->dev = dev;
         dmadev->device_alloc_chan_resources = sa11x0_dma_alloc_chan_resources;
@@ -838,7 +837,7 @@ static int sa11x0_dma_init_dmadev(struct dma_device *dmadev,
         dmadev->device_tx_status = sa11x0_dma_tx_status;
         dmadev->device_issue_pending = sa11x0_dma_issue_pending;
 
-        for (i = 0; i < dmadev->chancnt; i++) {
+        for (i = 0; i < ARRAY_SIZE(chan_desc); i++) {
                 struct sa11x0_dma_chan *c;
 
                 c = kzalloc(sizeof(*c), GFP_KERNEL);
diff --git a/drivers/dma/sh/rcar-audmapp.c b/drivers/dma/sh/rcar-audmapp.c
index 80fd2aeb4870..d95bbdd721f4 100644
--- a/drivers/dma/sh/rcar-audmapp.c
+++ b/drivers/dma/sh/rcar-audmapp.c
@@ -253,7 +253,6 @@ static int audmapp_chan_probe(struct platform_device *pdev,
 
 static void audmapp_chan_remove(struct audmapp_device *audev)
 {
-        struct dma_device *dma_dev = &audev->shdma_dev.dma_dev;
         struct shdma_chan *schan;
         int i;
 
@@ -261,7 +260,6 @@ static void audmapp_chan_remove(struct audmapp_device *audev)
                 BUG_ON(!schan);
                 shdma_chan_remove(schan);
         }
-        dma_dev->chancnt = 0;
 }
 
 static struct dma_chan *audmapp_of_xlate(struct of_phandle_args *dma_spec,
@@ -367,7 +365,6 @@ static struct platform_driver audmapp_driver = {
         .probe          = audmapp_probe,
         .remove         = audmapp_remove,
         .driver         = {
-                .owner  = THIS_MODULE,
                 .name   = "rcar-audmapp-engine",
                 .of_match_table = audmapp_of_match,
         },
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index b212d9471ab5..20a6f6f2a018 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -619,7 +619,6 @@ error:
 
 static void hpb_dmae_chan_remove(struct hpb_dmae_device *hpbdev)
 {
-        struct dma_device *dma_dev = &hpbdev->shdma_dev.dma_dev;
         struct shdma_chan *schan;
         int i;
 
@@ -628,7 +627,6 @@ static void hpb_dmae_chan_remove(struct hpb_dmae_device *hpbdev)
 
                 shdma_chan_remove(schan);
         }
-        dma_dev->chancnt = 0;
 }
 
 static int hpb_dmae_remove(struct platform_device *pdev)
@@ -655,7 +653,6 @@ static struct platform_driver hpb_dmae_driver = {
         .remove         = hpb_dmae_remove,
         .shutdown       = hpb_dmae_shutdown,
         .driver = {
-                .owner  = THIS_MODULE,
                 .name   = "hpb-dma-engine",
         },
 };
diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
index 42d497416196..3a2adb131d46 100644
--- a/drivers/dma/sh/shdma-base.c
+++ b/drivers/dma/sh/shdma-base.c
@@ -391,6 +391,8 @@ static dma_async_tx_callback __ld_cleanup(struct shdma_chan *schan, bool all)
                                 dev_dbg(schan->dev, "Bring down channel %d\n", schan->id);
                                 pm_runtime_put(schan->dev);
                                 schan->pm_state = SHDMA_PM_ESTABLISHED;
+                        } else if (schan->pm_state == SHDMA_PM_PENDING) {
+                                shdma_chan_xfer_ld_queue(schan);
                         }
                 }
         }
@@ -951,7 +953,7 @@ void shdma_chan_probe(struct shdma_dev *sdev,
         /* Add the channel to DMA device channel list */
         list_add_tail(&schan->dma_chan.device_node,
                         &sdev->dma_dev.channels);
-        sdev->schan[sdev->dma_dev.chancnt++] = schan;
+        sdev->schan[id] = schan;
 }
 EXPORT_SYMBOL(shdma_chan_probe);
 
diff --git a/drivers/dma/sh/shdma-of.c b/drivers/dma/sh/shdma-of.c
index b4ff9d3e56d1..f999f9b0d314 100644
--- a/drivers/dma/sh/shdma-of.c
+++ b/drivers/dma/sh/shdma-of.c
@@ -66,7 +66,6 @@ MODULE_DEVICE_TABLE(of, sh_dmae_of_match);
 
 static struct platform_driver shdma_of = {
         .driver         = {
-                .owner  = THIS_MODULE,
                 .name   = "shdma-of",
                 .of_match_table = shdma_of_match,
         },
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index 58eb85770eba..b65317c6ea4e 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -572,7 +572,6 @@ err_no_irq:
 
 static void sh_dmae_chan_remove(struct sh_dmae_device *shdev)
 {
-        struct dma_device *dma_dev = &shdev->shdma_dev.dma_dev;
         struct shdma_chan *schan;
         int i;
 
@@ -581,7 +580,6 @@ static void sh_dmae_chan_remove(struct sh_dmae_device *shdev)
 
                 shdma_chan_remove(schan);
         }
-        dma_dev->chancnt = 0;
 }
 
 static void sh_dmae_shutdown(struct platform_device *pdev)
diff --git a/drivers/dma/sh/sudmac.c b/drivers/dma/sh/sudmac.c
index 3ce103909896..6da2eaa6c294 100644
--- a/drivers/dma/sh/sudmac.c
+++ b/drivers/dma/sh/sudmac.c
@@ -295,7 +295,6 @@ err_no_irq:
 
 static void sudmac_chan_remove(struct sudmac_device *su_dev)
 {
-        struct dma_device *dma_dev = &su_dev->shdma_dev.dma_dev;
         struct shdma_chan *schan;
         int i;
 
@@ -304,7 +303,6 @@ static void sudmac_chan_remove(struct sudmac_device *su_dev)
 
                 shdma_chan_remove(schan);
         }
-        dma_dev->chancnt = 0;
 }
 
 static dma_addr_t sudmac_slave_addr(struct shdma_chan *schan)
@@ -411,7 +409,6 @@ static int sudmac_remove(struct platform_device *pdev)
 
 static struct platform_driver sudmac_driver = {
         .driver         = {
-                .owner  = THIS_MODULE,
                 .name   = SUDMAC_DRV_NAME,
         },
         .probe          = sudmac_probe,
diff --git a/drivers/dma/sirf-dma.c b/drivers/dma/sirf-dma.c
index aac03ab10c54..feb1e8ab8d7b 100644
--- a/drivers/dma/sirf-dma.c
+++ b/drivers/dma/sirf-dma.c
@@ -735,7 +735,6 @@ static int sirfsoc_dma_probe(struct platform_device *op)
 
         dma = &sdma->dma;
         dma->dev = dev;
-        dma->chancnt = SIRFSOC_DMA_CHANNELS;
 
         dma->device_alloc_chan_resources = sirfsoc_dma_alloc_chan_resources;
         dma->device_free_chan_resources = sirfsoc_dma_free_chan_resources;
@@ -752,7 +751,7 @@ static int sirfsoc_dma_probe(struct platform_device *op)
         dma_cap_set(DMA_INTERLEAVE, dma->cap_mask);
         dma_cap_set(DMA_PRIVATE, dma->cap_mask);
 
-        for (i = 0; i < dma->chancnt; i++) {
+        for (i = 0; i < SIRFSOC_DMA_CHANNELS; i++) {
                 schan = &sdma->channels[i];
 
                 schan->chan.device = dma;
@@ -835,6 +834,7 @@ static int sirfsoc_dma_runtime_resume(struct device *dev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int sirfsoc_dma_pm_suspend(struct device *dev)
 {
         struct sirfsoc_dma *sdma = dev_get_drvdata(dev);
@@ -916,6 +916,7 @@ static int sirfsoc_dma_pm_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static const struct dev_pm_ops sirfsoc_dma_pm_ops = {
         SET_RUNTIME_PM_OPS(sirfsoc_dma_runtime_suspend, sirfsoc_dma_runtime_resume, NULL)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index d9ca3e32d748..4d0710648b08 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -3432,6 +3432,7 @@ static int __init d40_lcla_allocate(struct d40_base *base)
 
                         d40_err(base->dev, "Failed to allocate %d pages.\n",
                                 base->lcla_pool.pages);
+                        ret = -ENOMEM;
 
                         for (j = 0; j < i; j++)
                                 free_pages(page_list[j], base->lcla_pool.pages);
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 91292f5513ff..159f1736a16f 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -18,6 +18,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/of_dma.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/reset.h>
 #include <linux/slab.h>
@@ -26,24 +27,6 @@
 #include "virt-dma.h"
 
 /*
- * There's 16 physical channels that can work in parallel.
- *
- * However we have 30 different endpoints for our requests.
- *
- * Since the channels are able to handle only an unidirectional
- * transfer, we need to allocate more virtual channels so that
- * everyone can grab one channel.
- *
- * Some devices can't work in both direction (mostly because it
- * wouldn't make sense), so we have a bit fewer virtual channels than
- * 2 channels per endpoints.
- */
-
-#define NR_MAX_CHANNELS         16
-#define NR_MAX_REQUESTS         30
-#define NR_MAX_VCHANS           53
-
-/*
  * Common registers
  */
 #define DMA_IRQ_EN(x)           ((x) * 0x04)
@@ -60,6 +43,12 @@
 #define DMA_STAT                0x30
 
 /*
+ * sun8i specific registers
+ */
+#define SUN8I_DMA_GATE          0x20
+#define SUN8I_DMA_GATE_ENABLE   0x4
+
+/*
  * Channels specific registers
  */
 #define DMA_CHAN_ENABLE         0x00
@@ -102,6 +91,19 @@
 #define DRQ_SDRAM       1
 
 /*
+ * Hardware channels / ports representation
+ *
+ * The hardware is used in several SoCs, with differing numbers
+ * of channels and endpoints. This structure ties those numbers
+ * to a certain compatible string.
+ */
+struct sun6i_dma_config {
+        u32 nr_max_channels;
+        u32 nr_max_requests;
+        u32 nr_max_vchans;
+};
+
+/*
  * Hardware representation of the LLI
  *
  * The hardware will be fed the physical address of this structure,
@@ -159,6 +161,7 @@ struct sun6i_dma_dev {
         struct dma_pool         *pool;
         struct sun6i_pchan      *pchans;
         struct sun6i_vchan      *vchans;
+        const struct sun6i_dma_config *cfg;
 };
 
 static struct device *chan2dev(struct dma_chan *chan)
@@ -426,6 +429,7 @@ static int sun6i_dma_start_desc(struct sun6i_vchan *vchan)
 static void sun6i_dma_tasklet(unsigned long data)
 {
         struct sun6i_dma_dev *sdev = (struct sun6i_dma_dev *)data;
+        const struct sun6i_dma_config *cfg = sdev->cfg;
         struct sun6i_vchan *vchan;
         struct sun6i_pchan *pchan;
         unsigned int pchan_alloc = 0;
@@ -453,7 +457,7 @@ static void sun6i_dma_tasklet(unsigned long data)
         }
 
         spin_lock_irq(&sdev->lock);
-        for (pchan_idx = 0; pchan_idx < NR_MAX_CHANNELS; pchan_idx++) {
+        for (pchan_idx = 0; pchan_idx < cfg->nr_max_channels; pchan_idx++) {
                 pchan = &sdev->pchans[pchan_idx];
 
                 if (pchan->vchan || list_empty(&sdev->pending))
@@ -474,7 +478,7 @@ static void sun6i_dma_tasklet(unsigned long data)
         }
         spin_unlock_irq(&sdev->lock);
 
-        for (pchan_idx = 0; pchan_idx < NR_MAX_CHANNELS; pchan_idx++) {
+        for (pchan_idx = 0; pchan_idx < cfg->nr_max_channels; pchan_idx++) {
                 if (!(pchan_alloc & BIT(pchan_idx)))
                         continue;
 
@@ -496,7 +500,7 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
         int i, j, ret = IRQ_NONE;
         u32 status;
 
-        for (i = 0; i < 2; i++) {
+        for (i = 0; i < sdev->cfg->nr_max_channels / DMA_IRQ_CHAN_NR; i++) {
                 status = readl(sdev->base + DMA_IRQ_STAT(i));
                 if (!status)
                         continue;
@@ -506,7 +510,7 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
 
                 writel(status, sdev->base + DMA_IRQ_STAT(i));
 
-                for (j = 0; (j < 8) && status; j++) {
+                for (j = 0; (j < DMA_IRQ_CHAN_NR) && status; j++) {
                         if (status & DMA_IRQ_QUEUE) {
                                 pchan = sdev->pchans + j;
                                 vchan = pchan->vchan;
@@ -519,7 +523,7 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
                                 }
                         }
 
-                        status = status >> 4;
+                        status = status >> DMA_IRQ_CHAN_WIDTH;
                 }
 
                 if (!atomic_read(&sdev->tasklet_shutdown))
@@ -815,7 +819,7 @@ static struct dma_chan *sun6i_dma_of_xlate(struct of_phandle_args *dma_spec,
         struct dma_chan *chan;
         u8 port = dma_spec->args[0];
 
-        if (port > NR_MAX_REQUESTS)
+        if (port > sdev->cfg->nr_max_requests)
                 return NULL;
 
         chan = dma_get_any_slave_channel(&sdev->slave);
@@ -848,7 +852,7 @@ static inline void sun6i_dma_free(struct sun6i_dma_dev *sdev)
 {
         int i;
 
-        for (i = 0; i < NR_MAX_VCHANS; i++) {
+        for (i = 0; i < sdev->cfg->nr_max_vchans; i++) {
                 struct sun6i_vchan *vchan = &sdev->vchans[i];
 
                 list_del(&vchan->vc.chan.device_node);
@@ -856,8 +860,48 @@ static inline void sun6i_dma_free(struct sun6i_dma_dev *sdev)
         }
 }
 
+/*
+ * For A31:
+ *
+ * There's 16 physical channels that can work in parallel.
+ *
+ * However we have 30 different endpoints for our requests.
+ *
+ * Since the channels are able to handle only an unidirectional
+ * transfer, we need to allocate more virtual channels so that
+ * everyone can grab one channel.
+ *
+ * Some devices can't work in both direction (mostly because it
+ * wouldn't make sense), so we have a bit fewer virtual channels than
+ * 2 channels per endpoints.
+ */
+
+static struct sun6i_dma_config sun6i_a31_dma_cfg = {
+        .nr_max_channels = 16,
+        .nr_max_requests = 30,
+        .nr_max_vchans   = 53,
+};
+
+/*
+ * The A23 only has 8 physical channels, a maximum DRQ port id of 24,
+ * and a total of 37 usable source and destination endpoints.
+ */
+
+static struct sun6i_dma_config sun8i_a23_dma_cfg = {
+        .nr_max_channels = 8,
+        .nr_max_requests = 24,
+        .nr_max_vchans   = 37,
+};
+
+static struct of_device_id sun6i_dma_match[] = {
+        { .compatible = "allwinner,sun6i-a31-dma", .data = &sun6i_a31_dma_cfg },
+        { .compatible = "allwinner,sun8i-a23-dma", .data = &sun8i_a23_dma_cfg },
+        { /* sentinel */ }
+};
+
 static int sun6i_dma_probe(struct platform_device *pdev)
 {
+        const struct of_device_id *device;
         struct sun6i_dma_dev *sdc;
         struct resource *res;
         int ret, i;
@@ -866,6 +910,11 @@ static int sun6i_dma_probe(struct platform_device *pdev)
         if (!sdc)
                 return -ENOMEM;
 
+        device = of_match_device(sun6i_dma_match, &pdev->dev);
+        if (!device)
+                return -ENODEV;
+        sdc->cfg = device->data;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         sdc->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(sdc->base))
@@ -912,31 +961,30 @@ static int sun6i_dma_probe(struct platform_device *pdev)
         sdc->slave.device_prep_slave_sg         = sun6i_dma_prep_slave_sg;
         sdc->slave.device_prep_dma_memcpy       = sun6i_dma_prep_dma_memcpy;
         sdc->slave.device_control               = sun6i_dma_control;
-        sdc->slave.chancnt                      = NR_MAX_VCHANS;
         sdc->slave.copy_align                   = 4;
 
         sdc->slave.dev = &pdev->dev;
 
-        sdc->pchans = devm_kcalloc(&pdev->dev, NR_MAX_CHANNELS,
+        sdc->pchans = devm_kcalloc(&pdev->dev, sdc->cfg->nr_max_channels,
                                    sizeof(struct sun6i_pchan), GFP_KERNEL);
         if (!sdc->pchans)
                 return -ENOMEM;
 
-        sdc->vchans = devm_kcalloc(&pdev->dev, NR_MAX_VCHANS,
+        sdc->vchans = devm_kcalloc(&pdev->dev, sdc->cfg->nr_max_vchans,
                                    sizeof(struct sun6i_vchan), GFP_KERNEL);
         if (!sdc->vchans)
                 return -ENOMEM;
 
         tasklet_init(&sdc->task, sun6i_dma_tasklet, (unsigned long)sdc);
 
-        for (i = 0; i < NR_MAX_CHANNELS; i++) {
+        for (i = 0; i < sdc->cfg->nr_max_channels; i++) {
                 struct sun6i_pchan *pchan = &sdc->pchans[i];
 
                 pchan->idx = i;
                 pchan->base = sdc->base + 0x100 + i * 0x40;
         }
 
-        for (i = 0; i < NR_MAX_VCHANS; i++) {
+        for (i = 0; i < sdc->cfg->nr_max_vchans; i++) {
                 struct sun6i_vchan *vchan = &sdc->vchans[i];
 
                 INIT_LIST_HEAD(&vchan->node);
@@ -976,6 +1024,15 @@ static int sun6i_dma_probe(struct platform_device *pdev)
                 goto err_dma_unregister;
         }
 
+        /*
+         * sun8i variant requires us to toggle a dma gating register,
+         * as seen in Allwinner's SDK. This register is not documented
+         * in the A23 user manual.
+         */
+        if (of_device_is_compatible(pdev->dev.of_node,
+                                    "allwinner,sun8i-a23-dma"))
+                writel(SUN8I_DMA_GATE_ENABLE, sdc->base + SUN8I_DMA_GATE);
+
         return 0;
 
 err_dma_unregister:
@@ -1008,11 +1065,6 @@ static int sun6i_dma_remove(struct platform_device *pdev)
         return 0;
 }
 
-static struct of_device_id sun6i_dma_match[] = {
-        { .compatible = "allwinner,sun6i-a31-dma" },
-        { /* sentinel */ }
-};
-
 static struct platform_driver sun6i_dma_driver = {
         .probe          = sun6i_dma_probe,
         .remove         = sun6i_dma_remove,
diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 1c867d0303db..d8450c3f35f0 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -1597,7 +1597,6 @@ static const struct dev_pm_ops tegra_dma_dev_pm_ops = {
 static struct platform_driver tegra_dmac_driver = {
         .driver = {
                 .name   = "tegra-apbdma",
-                .owner = THIS_MODULE,
                 .pm     = &tegra_dma_dev_pm_ops,
                 .of_match_table = tegra_dma_of_match,
         },
diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c
index 4506a7b4f972..2407ccf1a64b 100644
--- a/drivers/dma/timb_dma.c
+++ b/drivers/dma/timb_dma.c
@@ -783,7 +783,6 @@ static int td_remove(struct platform_device *pdev)
 static struct platform_driver td_driver = {
         .driver = {
                 .name   = DRIVER_NAME,
-                .owner  = THIS_MODULE,
         },
         .probe  = td_probe,
         .remove = td_remove,
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index 17686caf64d5..0659ec9c4488 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -76,7 +76,7 @@ static void channel64_write_CHAR(const struct txx9dmac_chan *dc, dma_addr_t val)
 
 static void channel64_clear_CHAR(const struct txx9dmac_chan *dc)
 {
-#if defined(CONFIG_32BIT) && !defined(CONFIG_64BIT_PHYS_ADDR)
+#if defined(CONFIG_32BIT) && !defined(CONFIG_PHYS_ADDR_T_64BIT)
         channel64_writel(dc, CHAR, 0);
         channel64_writel(dc, __pad_CHAR, 0);
 #else
diff --git a/drivers/dma/txx9dmac.h b/drivers/dma/txx9dmac.h
index f5a760598882..f6517b928bab 100644
--- a/drivers/dma/txx9dmac.h
+++ b/drivers/dma/txx9dmac.h
@@ -67,7 +67,7 @@ static inline bool txx9_dma_have_SMPCHN(void)
 
 /* Hardware register definitions. */
 struct txx9dmac_cregs {
-#if defined(CONFIG_32BIT) && !defined(CONFIG_64BIT_PHYS_ADDR)
+#if defined(CONFIG_32BIT) && !defined(CONFIG_PHYS_ADDR_T_64BIT)
         TXX9_DMA_REG32(CHAR);   /* Chain Address Register */
 #else
         u64 CHAR;               /* Chain Address Register */
@@ -201,7 +201,7 @@ static inline bool is_dmac64(const struct txx9dmac_chan *dc)
 #ifdef TXX9_DMA_USE_SIMPLE_CHAIN
 /* Hardware descriptor definition. (for simple-chain) */
 struct txx9dmac_hwdesc {
-#if defined(CONFIG_32BIT) && !defined(CONFIG_64BIT_PHYS_ADDR)
+#if defined(CONFIG_32BIT) && !defined(CONFIG_PHYS_ADDR_T_64BIT)
         TXX9_DMA_REG32(CHAR);
 #else
         u64 CHAR;
diff --git a/drivers/dma/xilinx/xilinx_vdma.c b/drivers/dma/xilinx/xilinx_vdma.c
index a6e64767186e..4a3a8f3137b3 100644
--- a/drivers/dma/xilinx/xilinx_vdma.c
+++ b/drivers/dma/xilinx/xilinx_vdma.c
@@ -942,6 +942,9 @@ xilinx_vdma_dma_prep_interleaved(struct dma_chan *dchan,
         if (!xt->numf || !xt->sgl[0].size)
                 return NULL;
 
+        if (xt->frame_size != 1)
+                return NULL;
+
         /* Allocate a transaction descriptor. */
         desc = xilinx_vdma_alloc_tx_descriptor(chan);
         if (!desc)
@@ -960,7 +963,7 @@ xilinx_vdma_dma_prep_interleaved(struct dma_chan *dchan,
         hw = &segment->hw;
         hw->vsize = xt->numf;
         hw->hsize = xt->sgl[0].size;
-        hw->stride = xt->sgl[0].icg <<
+        hw->stride = (xt->sgl[0].icg + xt->sgl[0].size) <<
                         XILINX_VDMA_FRMDLY_STRIDE_STRIDE_SHIFT;
         hw->stride |= chan->config.frm_dly <<
                         XILINX_VDMA_FRMDLY_STRIDE_FRMDLY_SHIFT;
@@ -971,9 +974,11 @@ xilinx_vdma_dma_prep_interleaved(struct dma_chan *dchan,
                 hw->buf_addr = xt->src_start;
 
         /* Link the previous next descriptor to current */
-        prev = list_last_entry(&desc->segments,
-                                struct xilinx_vdma_tx_segment, node);
-        prev->hw.next_desc = segment->phys;
+        if (!list_empty(&desc->segments)) {
+                prev = list_last_entry(&desc->segments,
+                                       struct xilinx_vdma_tx_segment, node);
+                prev->hw.next_desc = segment->phys;
+        }
 
         /* Insert the segment into the descriptor segments list. */
         list_add_tail(&segment->node, &desc->segments);
diff --git a/drivers/gpio/gpio-msm-v1.c b/drivers/gpio/gpio-msm-v1.c
index 73b73969d361..997e61ef173c 100644
--- a/drivers/gpio/gpio-msm-v1.c
+++ b/drivers/gpio/gpio-msm-v1.c
@@ -686,7 +686,7 @@ static int gpio_msm_v1_probe(struct platform_device *pdev)
         irq_set_chained_handler(irq1, msm_gpio_irq_handler);
         irq_set_chained_handler(irq2, msm_gpio_irq_handler);
         irq_set_irq_wake(irq1, 1);
-        irq_set_irq_wake(irq2, 2);
+        irq_set_irq_wake(irq2, 1);
         return 0;
 }
 
diff --git a/drivers/gpio/gpio-spear-spics.c b/drivers/gpio/gpio-spear-spics.c
index 353263c85d26..506a2ea0eb4c 100644
--- a/drivers/gpio/gpio-spear-spics.c
+++ b/drivers/gpio/gpio-spear-spics.c
@@ -204,5 +204,5 @@ static int __init spics_gpio_init(void)
 subsys_initcall(spics_gpio_init);
 
 MODULE_AUTHOR("Shiraz Hashim <shiraz.linux.kernel@gmail.com>");
-MODULE_DESCRIPTION("ST Microlectronics SPEAr SPI Chip Select Abstraction");
+MODULE_DESCRIPTION("STMicroelectronics SPEAr SPI Chip Select Abstraction");
 MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
index 4a85bb644e24..b928c17bdeed 100644
--- a/drivers/gpu/drm/radeon/mkregtable.c
+++ b/drivers/gpu/drm/radeon/mkregtable.c
@@ -347,7 +347,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_entry - get the struct for this entry
  * @ptr:        the &struct list_head pointer.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_entry(ptr, type, member) \
         container_of(ptr, type, member)
@@ -356,7 +356,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_first_entry - get the first element from a list
  * @ptr:        the list head to take the element from.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Note, that list is expected to be not empty.
  */
@@ -406,7 +406,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry  -       iterate over list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry(pos, head, member)                          \
         for (pos = list_entry((head)->next, typeof(*pos), member);      \
@@ -417,7 +417,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_reverse - iterate backwards over list of given type.
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry_reverse(pos, head, member)                  \
         for (pos = list_entry((head)->prev, typeof(*pos), member);      \
@@ -428,7 +428,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue()
  * @pos:        the type * to use as a start point
  * @head:       the head of the list
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Prepares a pos entry for use as a start point in list_for_each_entry_continue().
  */
@@ -439,7 +439,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_continue - continue iteration over list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Continue to iterate over list of given type, continuing after
  * the current position.
@@ -453,7 +453,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_continue_reverse - iterate backwards from the given point
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Start to iterate over list of given type backwards, continuing after
  * the current position.
@@ -467,7 +467,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_from - iterate over list of given type from the current point
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate over list of given type, continuing from current position.
  */
@@ -480,7 +480,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry_safe(pos, n, head, member)                  \
         for (pos = list_entry((head)->next, typeof(*pos), member),      \
@@ -493,7 +493,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate over list of given type, continuing after current point,
  * safe against removal of list entry.
@@ -509,7 +509,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate over list of given type from current point, safe against
  * removal of list entry.
@@ -524,7 +524,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate backwards over list of given type, safe against removal
  * of list entry.
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index f42df4dd58d2..230b6f887cd8 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -371,6 +371,7 @@ config HID_LOGITECH_DJ
         tristate "Logitech Unifying receivers full support"
         depends on HIDRAW
         depends on HID_LOGITECH
+        select HID_LOGITECH_HIDPP
         ---help---
         Say Y if you want support for Logitech Unifying receivers and devices.
         Unifying receivers are capable of pairing up to 6 Logitech compliant
@@ -378,6 +379,17 @@ config HID_LOGITECH_DJ
         generic USB_HID driver and all incoming events will be multiplexed
         into a single mouse and a single keyboard device.
 
+config HID_LOGITECH_HIDPP
+        tristate "Logitech HID++ devices support"
+        depends on HID_LOGITECH
+        ---help---
+        Support for Logitech devices relyingon the HID++ Logitech specification
+
+        Say Y if you want support for Logitech devices relying on the HID++
+        specification. Such devices are the various Logitech Touchpads (T650,
+        T651, TK820), some mice (Zone Touch mouse), or even keyboards (Solar
+        Keayboard).
+
 config LOGITECH_FF
         bool "Logitech force feedback support"
         depends on HID_LOGITECH
@@ -613,6 +625,13 @@ config HID_PICOLCD_CIR
         ---help---
           Provide access to PicoLCD's CIR interface via remote control (LIRC).
 
+config HID_PLANTRONICS
+        tristate "Plantronics USB HID Driver"
+        default !EXPERT
+        depends on HID
+        ---help---
+        Provides HID support for Plantronics telephony devices.
+
 config HID_PRIMAX
         tristate "Primax non-fully HID-compliant devices"
         depends on HID
@@ -629,7 +648,7 @@ config HID_ROCCAT
         support for its special functionalities.
 
 config HID_SAITEK
-        tristate "Saitek non-fully HID-compliant devices"
+        tristate "Saitek (Mad Catz) non-fully HID-compliant devices"
         depends on HID
         ---help---
         Support for Saitek devices that are not fully compliant with the
@@ -637,6 +656,7 @@ config HID_SAITEK
 
         Supported devices:
         - PS1000 Dual Analog Pad
+        - R.A.T.9 Gaming Mouse
         - R.A.T.7 Gaming Mouse
         - M.M.O.7 Gaming Mouse
 
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index e2850d8af9ca..debd15b44b59 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -63,6 +63,7 @@ obj-$(CONFIG_HID_LCPOWER)       += hid-lcpower.o
 obj-$(CONFIG_HID_LENOVO)        += hid-lenovo.o
 obj-$(CONFIG_HID_LOGITECH)      += hid-logitech.o
 obj-$(CONFIG_HID_LOGITECH_DJ)   += hid-logitech-dj.o
+obj-$(CONFIG_HID_LOGITECH_HIDPP)        += hid-logitech-hidpp.o
 obj-$(CONFIG_HID_MAGICMOUSE)    += hid-magicmouse.o
 obj-$(CONFIG_HID_MICROSOFT)     += hid-microsoft.o
 obj-$(CONFIG_HID_MONTEREY)      += hid-monterey.o
@@ -94,6 +95,7 @@ ifdef CONFIG_DEBUG_FS
 hid-picolcd-y                   += hid-picolcd_debugfs.o
 endif
 
+obj-$(CONFIG_HID_PLANTRONICS)   += hid-plantronics.o
 obj-$(CONFIG_HID_PRIMAX)        += hid-primax.o
 obj-$(CONFIG_HID_ROCCAT)        += hid-roccat.o hid-roccat-common.o \
         hid-roccat-arvo.o hid-roccat-isku.o hid-roccat-kone.o \
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3402033fa52a..c3d0ac1a0988 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -702,6 +702,11 @@ static void hid_scan_collection(struct hid_parser *parser, unsigned type)
         if (((parser->global.usage_page << 16) == HID_UP_SENSOR) &&
             type == HID_COLLECTION_PHYSICAL)
                 hid->group = HID_GROUP_SENSOR_HUB;
+
+        if (hid->vendor == USB_VENDOR_ID_MICROSOFT &&
+            hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 &&
+            hid->group == HID_GROUP_MULTITOUCH)
+                hid->group = HID_GROUP_GENERIC;
 }
 
 static int hid_scan_main(struct hid_parser *parser, struct hid_item *item)
@@ -780,22 +785,19 @@ static int hid_scan_report(struct hid_device *hid)
                 hid->group = HID_GROUP_MULTITOUCH_WIN_8;
 
         /*
-        * Vendor specific handlings
-        */
-        if ((hid->vendor == USB_VENDOR_ID_SYNAPTICS) &&
-            (hid->group == HID_GROUP_GENERIC) &&
-            /* only bind to the mouse interface of composite USB devices */
-            (hid->bus != BUS_USB || hid->type == HID_TYPE_USBMOUSE))
-                /* hid-rmi should take care of them, not hid-generic */
-                hid->group = HID_GROUP_RMI;
-
-        /*
          * Vendor specific handlings
          */
         switch (hid->vendor) {
         case USB_VENDOR_ID_WACOM:
                 hid->group = HID_GROUP_WACOM;
                 break;
+        case USB_VENDOR_ID_SYNAPTICS:
+                if ((hid->group == HID_GROUP_GENERIC) &&
+                    (hid->bus != BUS_USB || hid->type == HID_TYPE_USBMOUSE))
+                        /* hid-rmi should only bind to the mouse interface of
+                         * composite USB devices */
+                        hid->group = HID_GROUP_RMI;
+                break;
         }
 
         vfree(parser);
@@ -1280,12 +1282,6 @@ void hid_output_report(struct hid_report *report, __u8 *data)
 }
 EXPORT_SYMBOL_GPL(hid_output_report);
 
-static int hid_report_len(struct hid_report *report)
-{
-        /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
-        return ((report->size - 1) >> 3) + 1 + (report->id > 0);
-}
-
 /*
  * Allocator for buffer that is going to be passed to hid_output_report()
  */
@@ -1822,6 +1818,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
@@ -1862,6 +1859,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
@@ -1887,6 +1885,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_6000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
 #if IS_ENABLED(CONFIG_HID_ROCCAT)
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
@@ -1910,10 +1909,12 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
 #endif
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_BUZZ_CONTROLLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
@@ -2539,7 +2540,8 @@ int hid_add_device(struct hid_device *hdev)
          * Scan generic devices for group information
          */
         if (hid_ignore_special_drivers ||
-            !hid_match_id(hdev, hid_have_special_driver)) {
+            (!hdev->group &&
+             !hid_match_id(hdev, hid_have_special_driver))) {
                 ret = hid_scan_report(hdev);
                 if (ret)
                         hid_warn(hdev, "bad device descriptor (%d)\n", ret);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 7c863738e419..7460f3402298 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -300,6 +300,7 @@
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103     0x0103
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c     0x010c
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 
 #define USB_VENDOR_ID_ELECOM            0x056e
@@ -578,6 +579,7 @@
 
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+#define USB_DEVICE_ID_LOGITECH_T651     0xb00c
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
@@ -620,6 +622,7 @@
 
 #define USB_VENDOR_ID_MADCATZ           0x0738
 #define USB_DEVICE_ID_MADCATZ_BEATPAD   0x4540
+#define USB_DEVICE_ID_MADCATZ_RAT9      0x1709
 
 #define USB_VENDOR_ID_MCC               0x09db
 #define USB_DEVICE_ID_MCC_PMD1024LS     0x0076
@@ -649,6 +652,7 @@
 #define USB_DEVICE_ID_MS_SURFACE_PRO_2   0x0799
 #define USB_DEVICE_ID_MS_TOUCH_COVER_2   0x07a7
 #define USB_DEVICE_ID_MS_TYPE_COVER_2    0x07a9
+#define USB_DEVICE_ID_MS_TYPE_COVER_3    0x07dc
 
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -716,6 +720,8 @@
 #define USB_DEVICE_ID_ORTEK_PKB1700     0x1700
 #define USB_DEVICE_ID_ORTEK_WKB2000     0x2000
 
+#define USB_VENDOR_ID_PLANTRONICS       0x047f
+
 #define USB_VENDOR_ID_PANASONIC         0x04da
 #define USB_DEVICE_ID_PANABOARD_UBT780  0x1044
 #define USB_DEVICE_ID_PANABOARD_UBT880  0x104d
@@ -813,6 +819,9 @@
 #define USB_VENDOR_ID_SKYCABLE                  0x1223
 #define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER       0x3F07
 
+#define USB_VENDOR_ID_SMK               0x0609
+#define USB_DEVICE_ID_SMK_PS3_BDREMOTE  0x0306
+
 #define USB_VENDOR_ID_SONY                      0x054c
 #define USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE       0x024b
 #define USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE       0x0374
@@ -931,6 +940,9 @@
 #define USB_DEVICE_ID_VERNIER_CYCLOPS   0x0004
 #define USB_DEVICE_ID_VERNIER_LCSPEC    0x0006
 
+#define USB_VENDOR_ID_VTL               0x0306
+#define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F       0xff3f
+
 #define USB_VENDOR_ID_WACOM             0x056a
 #define USB_DEVICE_ID_WACOM_GRAPHIRE_BLUETOOTH  0x81
 #define USB_DEVICE_ID_WACOM_INTUOS4_BLUETOOTH   0x00BD
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 725f22ca47fc..e0a0f06ac5ef 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -872,7 +872,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT);   break;
                 case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL);   break;
 
-                default:    goto ignore;
+                default: map_key_clear(KEY_UNKNOWN);
                 }
                 break;
 
@@ -1215,7 +1215,7 @@ static void hidinput_led_worker(struct work_struct *work)
                 return hid->ll_driver->request(hid, report, HID_REQ_SET_REPORT);
 
         /* fall back to generic raw-output-report */
-        len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
+        len = hid_report_len(report);
         buf = hid_alloc_report_buf(report, GFP_KERNEL);
         if (!buf)
                 return;
diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index bf227f7679af..4c55f4d95798 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -62,7 +62,6 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev,
         /* HID_UP_LNVENDOR = USB, HID_UP_MSVENDOR = BT */
         if ((usage->hid & HID_USAGE_PAGE) == HID_UP_MSVENDOR ||
             (usage->hid & HID_USAGE_PAGE) == HID_UP_LNVENDOR) {
-                set_bit(EV_REP, hi->input->evbit);
                 switch (usage->hid & HID_USAGE) {
                 case 0x00f1: /* Fn-F4: Mic mute */
                         map_key_clear(KEY_MICMUTE);
@@ -85,13 +84,13 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev,
                 case 0x00f8: /* Fn-F11: View open applications (3 boxes) */
                         map_key_clear(KEY_SCALE);
                         return 1;
-                case 0x00fa: /* Fn-Esc: Fn-lock toggle */
-                        map_key_clear(KEY_FN_ESC);
-                        return 1;
-                case 0x00fb: /* Fn-F12: Open My computer (6 boxes) USB-only */
+                case 0x00f9: /* Fn-F12: Open My computer (6 boxes) USB-only */
                         /* NB: This mapping is invented in raw_event below */
                         map_key_clear(KEY_FILE);
                         return 1;
+                case 0x00fa: /* Fn-Esc: Fn-lock toggle */
+                        map_key_clear(KEY_FN_ESC);
+                        return 1;
                 }
         }
 
@@ -207,8 +206,8 @@ static int lenovo_raw_event(struct hid_device *hdev,
                         && data[0] == 0x15
                         && data[1] == 0x94
                         && data[2] == 0x01)) {
-                data[1] = 0x0;
-                data[2] = 0x4;
+                data[1] = 0x00;
+                data[2] = 0x01;
         }
 
         return 0;
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 71f569292cab..c917ab61aafa 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -26,9 +26,104 @@
 #include <linux/hid.h>
 #include <linux/module.h>
 #include <linux/usb.h>
+#include <linux/kfifo.h>
 #include <asm/unaligned.h>
 #include "hid-ids.h"
-#include "hid-logitech-dj.h"
+
+#define DJ_MAX_PAIRED_DEVICES                   6
+#define DJ_MAX_NUMBER_NOTIFICATIONS             8
+#define DJ_RECEIVER_INDEX                       0
+#define DJ_DEVICE_INDEX_MIN                     1
+#define DJ_DEVICE_INDEX_MAX                     6
+
+#define DJREPORT_SHORT_LENGTH                   15
+#define DJREPORT_LONG_LENGTH                    32
+
+#define REPORT_ID_DJ_SHORT                      0x20
+#define REPORT_ID_DJ_LONG                       0x21
+
+#define REPORT_ID_HIDPP_SHORT                   0x10
+#define REPORT_ID_HIDPP_LONG                    0x11
+
+#define HIDPP_REPORT_SHORT_LENGTH               7
+#define HIDPP_REPORT_LONG_LENGTH                20
+
+#define HIDPP_RECEIVER_INDEX                    0xff
+
+#define REPORT_TYPE_RFREPORT_FIRST              0x01
+#define REPORT_TYPE_RFREPORT_LAST               0x1F
+
+/* Command Switch to DJ mode */
+#define REPORT_TYPE_CMD_SWITCH                  0x80
+#define CMD_SWITCH_PARAM_DEVBITFIELD            0x00
+#define CMD_SWITCH_PARAM_TIMEOUT_SECONDS        0x01
+#define TIMEOUT_NO_KEEPALIVE                    0x00
+
+/* Command to Get the list of Paired devices */
+#define REPORT_TYPE_CMD_GET_PAIRED_DEVICES      0x81
+
+/* Device Paired Notification */
+#define REPORT_TYPE_NOTIF_DEVICE_PAIRED         0x41
+#define SPFUNCTION_MORE_NOTIF_EXPECTED          0x01
+#define SPFUNCTION_DEVICE_LIST_EMPTY            0x02
+#define DEVICE_PAIRED_PARAM_SPFUNCTION          0x00
+#define DEVICE_PAIRED_PARAM_EQUAD_ID_LSB        0x01
+#define DEVICE_PAIRED_PARAM_EQUAD_ID_MSB        0x02
+#define DEVICE_PAIRED_RF_REPORT_TYPE            0x03
+
+/* Device Un-Paired Notification */
+#define REPORT_TYPE_NOTIF_DEVICE_UNPAIRED       0x40
+
+
+/* Connection Status Notification */
+#define REPORT_TYPE_NOTIF_CONNECTION_STATUS     0x42
+#define CONNECTION_STATUS_PARAM_STATUS          0x00
+#define STATUS_LINKLOSS                         0x01
+
+/* Error Notification */
+#define REPORT_TYPE_NOTIF_ERROR                 0x7F
+#define NOTIF_ERROR_PARAM_ETYPE                 0x00
+#define ETYPE_KEEPALIVE_TIMEOUT                 0x01
+
+/* supported DJ HID && RF report types */
+#define REPORT_TYPE_KEYBOARD                    0x01
+#define REPORT_TYPE_MOUSE                       0x02
+#define REPORT_TYPE_CONSUMER_CONTROL            0x03
+#define REPORT_TYPE_SYSTEM_CONTROL              0x04
+#define REPORT_TYPE_MEDIA_CENTER                0x08
+#define REPORT_TYPE_LEDS                        0x0E
+
+/* RF Report types bitfield */
+#define STD_KEYBOARD                            0x00000002
+#define STD_MOUSE                               0x00000004
+#define MULTIMEDIA                              0x00000008
+#define POWER_KEYS                              0x00000010
+#define MEDIA_CENTER                            0x00000100
+#define KBD_LEDS                                0x00004000
+
+struct dj_report {
+        u8 report_id;
+        u8 device_index;
+        u8 report_type;
+        u8 report_params[DJREPORT_SHORT_LENGTH - 3];
+};
+
+struct dj_receiver_dev {
+        struct hid_device *hdev;
+        struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES +
+                                            DJ_DEVICE_INDEX_MIN];
+        struct work_struct work;
+        struct kfifo notif_fifo;
+        spinlock_t lock;
+        bool querying_devices;
+};
+
+struct dj_device {
+        struct hid_device *hdev;
+        struct dj_receiver_dev *dj_receiver_dev;
+        u32 reports_supported;
+        u8 device_index;
+};
 
 /* Keyboard descriptor (1) */
 static const char kbd_descriptor[] = {
@@ -156,6 +251,57 @@ static const char media_descriptor[] = {
         0xc0,                   /* EndCollection                       */
 };                              /*                                     */
 
+/* HIDPP descriptor */
+static const char hidpp_descriptor[] = {
+        0x06, 0x00, 0xff,       /* Usage Page (Vendor Defined Page 1)  */
+        0x09, 0x01,             /* Usage (Vendor Usage 1)              */
+        0xa1, 0x01,             /* Collection (Application)            */
+        0x85, 0x10,             /*   Report ID (16)                    */
+        0x75, 0x08,             /*   Report Size (8)                   */
+        0x95, 0x06,             /*   Report Count (6)                  */
+        0x15, 0x00,             /*   Logical Minimum (0)               */
+        0x26, 0xff, 0x00,       /*   Logical Maximum (255)             */
+        0x09, 0x01,             /*   Usage (Vendor Usage 1)            */
+        0x81, 0x00,             /*   Input (Data,Arr,Abs)              */
+        0x09, 0x01,             /*   Usage (Vendor Usage 1)            */
+        0x91, 0x00,             /*   Output (Data,Arr,Abs)             */
+        0xc0,                   /* End Collection                      */
+        0x06, 0x00, 0xff,       /* Usage Page (Vendor Defined Page 1)  */
+        0x09, 0x02,             /* Usage (Vendor Usage 2)              */
+        0xa1, 0x01,             /* Collection (Application)            */
+        0x85, 0x11,             /*   Report ID (17)                    */
+        0x75, 0x08,             /*   Report Size (8)                   */
+        0x95, 0x13,             /*   Report Count (19)                 */
+        0x15, 0x00,             /*   Logical Minimum (0)               */
+        0x26, 0xff, 0x00,       /*   Logical Maximum (255)             */
+        0x09, 0x02,             /*   Usage (Vendor Usage 2)            */
+        0x81, 0x00,             /*   Input (Data,Arr,Abs)              */
+        0x09, 0x02,             /*   Usage (Vendor Usage 2)            */
+        0x91, 0x00,             /*   Output (Data,Arr,Abs)             */
+        0xc0,                   /* End Collection                      */
+        0x06, 0x00, 0xff,       /* Usage Page (Vendor Defined Page 1)  */
+        0x09, 0x04,             /* Usage (Vendor Usage 0x04)           */
+        0xa1, 0x01,             /* Collection (Application)            */
+        0x85, 0x20,             /*   Report ID (32)                    */
+        0x75, 0x08,             /*   Report Size (8)                   */
+        0x95, 0x0e,             /*   Report Count (14)                 */
+        0x15, 0x00,             /*   Logical Minimum (0)               */
+        0x26, 0xff, 0x00,       /*   Logical Maximum (255)             */
+        0x09, 0x41,             /*   Usage (Vendor Usage 0x41)         */
+        0x81, 0x00,             /*   Input (Data,Arr,Abs)              */
+        0x09, 0x41,             /*   Usage (Vendor Usage 0x41)         */
+        0x91, 0x00,             /*   Output (Data,Arr,Abs)             */
+        0x85, 0x21,             /*   Report ID (33)                    */
+        0x95, 0x1f,             /*   Report Count (31)                 */
+        0x15, 0x00,             /*   Logical Minimum (0)               */
+        0x26, 0xff, 0x00,       /*   Logical Maximum (255)             */
+        0x09, 0x42,             /*   Usage (Vendor Usage 0x42)         */
+        0x81, 0x00,             /*   Input (Data,Arr,Abs)              */
+        0x09, 0x42,             /*   Usage (Vendor Usage 0x42)         */
+        0x91, 0x00,             /*   Output (Data,Arr,Abs)             */
+        0xc0,                   /* End Collection                      */
+};
+
 /* Maximum size of all defined hid reports in bytes (including report id) */
 #define MAX_REPORT_SIZE 8
 
@@ -165,7 +311,8 @@ static const char media_descriptor[] = {
          sizeof(mse_descriptor) +               \
          sizeof(consumer_descriptor) +          \
          sizeof(syscontrol_descriptor) +        \
-         sizeof(media_descriptor))
+         sizeof(media_descriptor) +     \
+         sizeof(hidpp_descriptor))
 
 /* Number of possible hid report types that can be created by this driver.
  *
@@ -256,11 +403,15 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
         dj_hiddev->dev.parent = &djrcv_hdev->dev;
         dj_hiddev->bus = BUS_USB;
         dj_hiddev->vendor = le16_to_cpu(usbdev->descriptor.idVendor);
-        dj_hiddev->product = le16_to_cpu(usbdev->descriptor.idProduct);
+        dj_hiddev->product =
+                (dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_MSB]
+                                                                        << 8) |
+                dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_LSB];
         snprintf(dj_hiddev->name, sizeof(dj_hiddev->name),
-                "Logitech Unifying Device. Wireless PID:%02x%02x",
-                dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_MSB],
-                dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_LSB]);
+                "Logitech Unifying Device. Wireless PID:%04x",
+                dj_hiddev->product);
+
+        dj_hiddev->group = HID_GROUP_LOGITECH_DJ_DEVICE;
 
         usb_make_path(usbdev, dj_hiddev->phys, sizeof(dj_hiddev->phys));
         snprintf(tmpstr, sizeof(tmpstr), ":%d", dj_report->device_index);
@@ -422,6 +573,13 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
         }
 }
 
+static void logi_dj_recv_forward_hidpp(struct dj_device *dj_dev, u8 *data,
+                                       int size)
+{
+        /* We are called from atomic context (tasklet && djrcv->lock held) */
+        if (hid_input_report(dj_dev->hdev, HID_INPUT_REPORT, data, size, 1))
+                dbg_hid("hid_input_report error\n");
+}
 
 static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
                                     struct dj_report *dj_report)
@@ -472,7 +630,9 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                           unsigned timeout)
 {
+        struct hid_device *hdev = djrcv_dev->hdev;
         struct dj_report *dj_report;
+        u8 *buf;
         int retval;
 
         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
@@ -484,7 +644,6 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
         dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
         dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
         retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
-        kfree(dj_report);
 
         /*
          * Ugly sleep to work around a USB 3.0 bug when the receiver is still
@@ -493,6 +652,30 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
          */
         msleep(50);
 
+        /*
+         * Magical bits to set up hidpp notifications when the dj devices
+         * are connected/disconnected.
+         *
+         * We can reuse dj_report because HIDPP_REPORT_SHORT_LENGTH is smaller
+         * than DJREPORT_SHORT_LENGTH.
+         */
+        buf = (u8 *)dj_report;
+
+        memset(buf, 0, HIDPP_REPORT_SHORT_LENGTH);
+
+        buf[0] = REPORT_ID_HIDPP_SHORT;
+        buf[1] = 0xFF;
+        buf[2] = 0x80;
+        buf[3] = 0x00;
+        buf[4] = 0x00;
+        buf[5] = 0x09;
+        buf[6] = 0x00;
+
+        hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf,
+                        HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT,
+                        HID_REQ_SET_REPORT);
+
+        kfree(dj_report);
         return retval;
 }
 
@@ -509,6 +692,9 @@ static void logi_dj_ll_close(struct hid_device *hid)
         dbg_hid("%s:%s\n", __func__, hid->phys);
 }
 
+static u8 unifying_name_query[]  = {0x10, 0xff, 0x83, 0xb5, 0x40, 0x00, 0x00};
+static u8 unifying_name_answer[] = {0x11, 0xff, 0x83, 0xb5};
+
 static int logi_dj_ll_raw_request(struct hid_device *hid,
                                   unsigned char reportnum, __u8 *buf,
                                   size_t count, unsigned char report_type,
@@ -519,6 +705,22 @@ static int logi_dj_ll_raw_request(struct hid_device *hid,
         u8 *out_buf;
         int ret;
 
+        if ((buf[0] == REPORT_ID_HIDPP_SHORT) ||
+            (buf[0] == REPORT_ID_HIDPP_LONG)) {
+                if (count < 2)
+                        return -EINVAL;
+
+                /* special case where we should not overwrite
+                 * the device_index */
+                if (count == 7 && !memcmp(buf, unifying_name_query,
+                                          sizeof(unifying_name_query)))
+                        buf[4] |= djdev->device_index - 1;
+                else
+                        buf[1] = djdev->device_index;
+                return hid_hw_raw_request(djrcv_dev->hdev, reportnum, buf,
+                                count, report_type, reqtype);
+        }
+
         if (buf[0] != REPORT_TYPE_LEDS)
                 return -EINVAL;
 
@@ -597,6 +799,8 @@ static int logi_dj_ll_parse(struct hid_device *hid)
                         __func__, djdev->reports_supported);
         }
 
+        rdcat(rdesc, &rsize, hidpp_descriptor, sizeof(hidpp_descriptor));
+
         retval = hid_parse_report(hid, rdesc, rsize);
         kfree(rdesc);
 
@@ -624,8 +828,7 @@ static struct hid_ll_driver logi_dj_ll_driver = {
         .raw_request = logi_dj_ll_raw_request,
 };
 
-
-static int logi_dj_raw_event(struct hid_device *hdev,
+static int logi_dj_dj_event(struct hid_device *hdev,
                              struct hid_report *report, u8 *data,
                              int size)
 {
@@ -633,36 +836,24 @@ static int logi_dj_raw_event(struct hid_device *hdev,
         struct dj_report *dj_report = (struct dj_report *) data;
         unsigned long flags;
 
-        dbg_hid("%s, size:%d\n", __func__, size);
-
-        /* Here we receive all data coming from iface 2, there are 4 cases:
-         *
-         * 1) Data should continue its normal processing i.e. data does not
-         * come from the DJ collection, in which case we do nothing and
-         * return 0, so hid-core can continue normal processing (will forward
-         * to associated hidraw device)
+        /*
+         * Here we receive all data coming from iface 2, there are 3 cases:
          *
-         * 2) Data is from DJ collection, and is intended for this driver i. e.
-         * data contains arrival, departure, etc notifications, in which case
-         * we queue them for delayed processing by the work queue. We return 1
-         * to hid-core as no further processing is required from it.
+         * 1) Data is intended for this driver i. e. data contains arrival,
+         * departure, etc notifications, in which case we queue them for delayed
+         * processing by the work queue. We return 1 to hid-core as no further
+         * processing is required from it.
          *
-         * 3) Data is from DJ collection, and informs a connection change,
-         * if the change means rf link loss, then we must send a null report
-         * to the upper layer to discard potentially pressed keys that may be
-         * repeated forever by the input layer. Return 1 to hid-core as no
-         * further processing is required.
+         * 2) Data informs a connection change, if the change means rf link
+         * loss, then we must send a null report to the upper layer to discard
+         * potentially pressed keys that may be repeated forever by the input
+         * layer. Return 1 to hid-core as no further processing is required.
          *
-         * 4) Data is from DJ collection and is an actual input event from
-         * a paired DJ device in which case we forward it to the correct hid
-         * device (via hid_input_report() ) and return 1 so hid-core does not do
-         * anything else with it.
+         * 3) Data is an actual input event from a paired DJ device in which
+         * case we forward it to the correct hid device (via hid_input_report()
+         * ) and return 1 so hid-core does not anything else with it.
          */
 
-        /* case 1) */
-        if (data[0] != REPORT_ID_DJ_SHORT)
-                return false;
-
         if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
             (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
                 /*
@@ -707,6 +898,80 @@ out:
         return true;
 }
 
+static int logi_dj_hidpp_event(struct hid_device *hdev,
+                             struct hid_report *report, u8 *data,
+                             int size)
+{
+        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
+        struct dj_report *dj_report = (struct dj_report *) data;
+        unsigned long flags;
+        u8 device_index = dj_report->device_index;
+
+        if (device_index == HIDPP_RECEIVER_INDEX) {
+                /* special case were the device wants to know its unifying
+                 * name */
+                if (size == HIDPP_REPORT_LONG_LENGTH &&
+                    !memcmp(data, unifying_name_answer,
+                            sizeof(unifying_name_answer)) &&
+                    ((data[4] & 0xF0) == 0x40))
+                        device_index = (data[4] & 0x0F) + 1;
+                else
+                        return false;
+        }
+
+        /*
+         * Data is from the HID++ collection, in this case, we forward the
+         * data to the corresponding child dj device and return 0 to hid-core
+         * so he data also goes to the hidraw device of the receiver. This
+         * allows a user space application to implement the full HID++ routing
+         * via the receiver.
+         */
+
+        if ((device_index < DJ_DEVICE_INDEX_MIN) ||
+            (device_index > DJ_DEVICE_INDEX_MAX)) {
+                /*
+                 * Device index is wrong, bail out.
+                 * This driver can ignore safely the receiver notifications,
+                 * so ignore those reports too.
+                 */
+                dev_err(&hdev->dev, "%s: invalid device index:%d\n",
+                                __func__, dj_report->device_index);
+                return false;
+        }
+
+        spin_lock_irqsave(&djrcv_dev->lock, flags);
+
+        if (!djrcv_dev->paired_dj_devices[device_index])
+                /* received an event for an unknown device, bail out */
+                goto out;
+
+        logi_dj_recv_forward_hidpp(djrcv_dev->paired_dj_devices[device_index],
+                                   data, size);
+
+out:
+        spin_unlock_irqrestore(&djrcv_dev->lock, flags);
+
+        return false;
+}
+
+static int logi_dj_raw_event(struct hid_device *hdev,
+                             struct hid_report *report, u8 *data,
+                             int size)
+{
+        dbg_hid("%s, size:%d\n", __func__, size);
+
+        switch (data[0]) {
+        case REPORT_ID_DJ_SHORT:
+                return logi_dj_dj_event(hdev, report, data, size);
+        case REPORT_ID_HIDPP_SHORT:
+                /* intentional fallthrough */
+        case REPORT_ID_HIDPP_LONG:
+                return logi_dj_hidpp_event(hdev, report, data, size);
+        }
+
+        return false;
+}
+
 static int logi_dj_probe(struct hid_device *hdev,
                          const struct hid_device_id *id)
 {
@@ -714,9 +979,6 @@ static int logi_dj_probe(struct hid_device *hdev,
         struct dj_receiver_dev *djrcv_dev;
         int retval;
 
-        if (is_dj_device((struct dj_device *)hdev->driver_data))
-                return -ENODEV;
-
         dbg_hid("%s called for ifnum %d\n", __func__,
                 intf->cur_altsetting->desc.bInterfaceNumber);
 
@@ -869,22 +1131,6 @@ static void logi_dj_remove(struct hid_device *hdev)
         hid_set_drvdata(hdev, NULL);
 }
 
-static int logi_djdevice_probe(struct hid_device *hdev,
-                         const struct hid_device_id *id)
-{
-        int ret;
-        struct dj_device *dj_dev = hdev->driver_data;
-
-        if (!is_dj_device(dj_dev))
-                return -ENODEV;
-
-        ret = hid_parse(hdev);
-        if (!ret)
-                ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
-
-        return ret;
-}
-
 static const struct hid_device_id logi_dj_receivers[] = {
         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
@@ -906,51 +1152,8 @@ static struct hid_driver logi_djreceiver_driver = {
 #endif
 };
 
+module_hid_driver(logi_djreceiver_driver);
 
-static const struct hid_device_id logi_dj_devices[] = {
-        {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
-                USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
-        {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
-                USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
-        {}
-};
-
-static struct hid_driver logi_djdevice_driver = {
-        .name = "logitech-djdevice",
-        .id_table = logi_dj_devices,
-        .probe = logi_djdevice_probe,
-};
-
-
-static int __init logi_dj_init(void)
-{
-        int retval;
-
-        dbg_hid("Logitech-DJ:%s\n", __func__);
-
-        retval = hid_register_driver(&logi_djreceiver_driver);
-        if (retval)
-                return retval;
-
-        retval = hid_register_driver(&logi_djdevice_driver);
-        if (retval)
-                hid_unregister_driver(&logi_djreceiver_driver);
-
-        return retval;
-
-}
-
-static void __exit logi_dj_exit(void)
-{
-        dbg_hid("Logitech-DJ:%s\n", __func__);
-
-        hid_unregister_driver(&logi_djdevice_driver);
-        hid_unregister_driver(&logi_djreceiver_driver);
-
-}
-
-module_init(logi_dj_init);
-module_exit(logi_dj_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Logitech");
 MODULE_AUTHOR("Nestor Lopez Casado");
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
deleted file mode 100644
index daeb0aa4bee9..000000000000
--- a/drivers/hid/hid-logitech-dj.h
+++ /dev/null
@@ -1,125 +0,0 @@
-#ifndef __HID_LOGITECH_DJ_H
-#define __HID_LOGITECH_DJ_H
-
-/*
- *  HID driver for Logitech Unifying receivers
- *
- *  Copyright (c) 2011 Logitech
- */
-
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
- */
-
-#include <linux/kfifo.h>
-
-#define DJ_MAX_PAIRED_DEVICES                   6
-#define DJ_MAX_NUMBER_NOTIFICATIONS             8
-#define DJ_RECEIVER_INDEX                       0
-#define DJ_DEVICE_INDEX_MIN                     1
-#define DJ_DEVICE_INDEX_MAX                     6
-
-#define DJREPORT_SHORT_LENGTH                   15
-#define DJREPORT_LONG_LENGTH                    32
-
-#define REPORT_ID_DJ_SHORT                      0x20
-#define REPORT_ID_DJ_LONG                       0x21
-
-#define REPORT_TYPE_RFREPORT_FIRST              0x01
-#define REPORT_TYPE_RFREPORT_LAST               0x1F
-
-/* Command Switch to DJ mode */
-#define REPORT_TYPE_CMD_SWITCH                  0x80
-#define CMD_SWITCH_PARAM_DEVBITFIELD            0x00
-#define CMD_SWITCH_PARAM_TIMEOUT_SECONDS        0x01
-#define TIMEOUT_NO_KEEPALIVE                    0x00
-
-/* Command to Get the list of Paired devices */
-#define REPORT_TYPE_CMD_GET_PAIRED_DEVICES      0x81
-
-/* Device Paired Notification */
-#define REPORT_TYPE_NOTIF_DEVICE_PAIRED         0x41
-#define SPFUNCTION_MORE_NOTIF_EXPECTED          0x01
-#define SPFUNCTION_DEVICE_LIST_EMPTY            0x02
-#define DEVICE_PAIRED_PARAM_SPFUNCTION          0x00
-#define DEVICE_PAIRED_PARAM_EQUAD_ID_LSB        0x01
-#define DEVICE_PAIRED_PARAM_EQUAD_ID_MSB        0x02
-#define DEVICE_PAIRED_RF_REPORT_TYPE            0x03
-
-/* Device Un-Paired Notification */
-#define REPORT_TYPE_NOTIF_DEVICE_UNPAIRED       0x40
-
-
-/* Connection Status Notification */
-#define REPORT_TYPE_NOTIF_CONNECTION_STATUS     0x42
-#define CONNECTION_STATUS_PARAM_STATUS          0x00
-#define STATUS_LINKLOSS                         0x01
-
-/* Error Notification */
-#define REPORT_TYPE_NOTIF_ERROR                 0x7F
-#define NOTIF_ERROR_PARAM_ETYPE                 0x00
-#define ETYPE_KEEPALIVE_TIMEOUT                 0x01
-
-/* supported DJ HID && RF report types */
-#define REPORT_TYPE_KEYBOARD                    0x01
-#define REPORT_TYPE_MOUSE                       0x02
-#define REPORT_TYPE_CONSUMER_CONTROL            0x03
-#define REPORT_TYPE_SYSTEM_CONTROL              0x04
-#define REPORT_TYPE_MEDIA_CENTER                0x08
-#define REPORT_TYPE_LEDS                        0x0E
-
-/* RF Report types bitfield */
-#define STD_KEYBOARD                            0x00000002
-#define STD_MOUSE                               0x00000004
-#define MULTIMEDIA                              0x00000008
-#define POWER_KEYS                              0x00000010
-#define MEDIA_CENTER                            0x00000100
-#define KBD_LEDS                                0x00004000
-
-struct dj_report {
-        u8 report_id;
-        u8 device_index;
-        u8 report_type;
-        u8 report_params[DJREPORT_SHORT_LENGTH - 3];
-};
-
-struct dj_receiver_dev {
-        struct hid_device *hdev;
-        struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES +
-                                            DJ_DEVICE_INDEX_MIN];
-        struct work_struct work;
-        struct kfifo notif_fifo;
-        spinlock_t lock;
-        bool querying_devices;
-};
-
-struct dj_device {
-        struct hid_device *hdev;
-        struct dj_receiver_dev *dj_receiver_dev;
-        u32 reports_supported;
-        u8 device_index;
-};
-
-/**
- * is_dj_device - know if the given dj_device is not the receiver.
- * @dj_dev: the dj device to test
- *
- * This macro tests if a struct dj_device pointer is a device created
- * by the bus enumarator.
- */
-#define is_dj_device(dj_dev) \
-        (&(dj_dev)->dj_receiver_dev->hdev->dev == (dj_dev)->hdev->dev.parent)
-
-#endif
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
new file mode 100644
index 000000000000..2f420c0b6609
--- /dev/null
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -0,0 +1,1241 @@
+/*
+ *  HIDPP protocol for Logitech Unifying receivers
+ *
+ *  Copyright (c) 2011 Logitech (c)
+ *  Copyright (c) 2012-2013 Google (c)
+ *  Copyright (c) 2013-2014 Red Hat Inc.
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; version 2 of the License.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/device.h>
+#include <linux/hid.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/kfifo.h>
+#include <linux/input/mt.h>
+#include <asm/unaligned.h>
+#include "hid-ids.h"
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
+MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
+
+#define REPORT_ID_HIDPP_SHORT                   0x10
+#define REPORT_ID_HIDPP_LONG                    0x11
+
+#define HIDPP_REPORT_SHORT_LENGTH               7
+#define HIDPP_REPORT_LONG_LENGTH                20
+
+#define HIDPP_QUIRK_CLASS_WTP                   BIT(0)
+
+/* bits 1..20 are reserved for classes */
+#define HIDPP_QUIRK_DELAYED_INIT                BIT(21)
+#define HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS        BIT(22)
+#define HIDPP_QUIRK_MULTI_INPUT                 BIT(23)
+
+/*
+ * There are two hidpp protocols in use, the first version hidpp10 is known
+ * as register access protocol or RAP, the second version hidpp20 is known as
+ * feature access protocol or FAP
+ *
+ * Most older devices (including the Unifying usb receiver) use the RAP protocol
+ * where as most newer devices use the FAP protocol. Both protocols are
+ * compatible with the underlying transport, which could be usb, Unifiying, or
+ * bluetooth. The message lengths are defined by the hid vendor specific report
+ * descriptor for the HIDPP_SHORT report type (total message lenth 7 bytes) and
+ * the HIDPP_LONG report type (total message length 20 bytes)
+ *
+ * The RAP protocol uses both report types, whereas the FAP only uses HIDPP_LONG
+ * messages. The Unifying receiver itself responds to RAP messages (device index
+ * is 0xFF for the receiver), and all messages (short or long) with a device
+ * index between 1 and 6 are passed untouched to the corresponding paired
+ * Unifying device.
+ *
+ * The paired device can be RAP or FAP, it will receive the message untouched
+ * from the Unifiying receiver.
+ */
+
+struct fap {
+        u8 feature_index;
+        u8 funcindex_clientid;
+        u8 params[HIDPP_REPORT_LONG_LENGTH - 4U];
+};
+
+struct rap {
+        u8 sub_id;
+        u8 reg_address;
+        u8 params[HIDPP_REPORT_LONG_LENGTH - 4U];
+};
+
+struct hidpp_report {
+        u8 report_id;
+        u8 device_index;
+        union {
+                struct fap fap;
+                struct rap rap;
+                u8 rawbytes[sizeof(struct fap)];
+        };
+} __packed;
+
+struct hidpp_device {
+        struct hid_device *hid_dev;
+        struct mutex send_mutex;
+        void *send_receive_buf;
+        wait_queue_head_t wait;
+        bool answer_available;
+        u8 protocol_major;
+        u8 protocol_minor;
+
+        void *private_data;
+
+        struct work_struct work;
+        struct kfifo delayed_work_fifo;
+        atomic_t connected;
+        struct input_dev *delayed_input;
+
+        unsigned long quirks;
+};
+
+
+#define HIDPP_ERROR                             0x8f
+#define HIDPP_ERROR_SUCCESS                     0x00
+#define HIDPP_ERROR_INVALID_SUBID               0x01
+#define HIDPP_ERROR_INVALID_ADRESS              0x02
+#define HIDPP_ERROR_INVALID_VALUE               0x03
+#define HIDPP_ERROR_CONNECT_FAIL                0x04
+#define HIDPP_ERROR_TOO_MANY_DEVICES            0x05
+#define HIDPP_ERROR_ALREADY_EXISTS              0x06
+#define HIDPP_ERROR_BUSY                        0x07
+#define HIDPP_ERROR_UNKNOWN_DEVICE              0x08
+#define HIDPP_ERROR_RESOURCE_ERROR              0x09
+#define HIDPP_ERROR_REQUEST_UNAVAILABLE         0x0a
+#define HIDPP_ERROR_INVALID_PARAM_VALUE         0x0b
+#define HIDPP_ERROR_WRONG_PIN_CODE              0x0c
+
+static void hidpp_connect_event(struct hidpp_device *hidpp_dev);
+
+static int __hidpp_send_report(struct hid_device *hdev,
+                                struct hidpp_report *hidpp_report)
+{
+        int fields_count, ret;
+
+        switch (hidpp_report->report_id) {
+        case REPORT_ID_HIDPP_SHORT:
+                fields_count = HIDPP_REPORT_SHORT_LENGTH;
+                break;
+        case REPORT_ID_HIDPP_LONG:
+                fields_count = HIDPP_REPORT_LONG_LENGTH;
+                break;
+        default:
+                return -ENODEV;
+        }
+
+        /*
+         * set the device_index as the receiver, it will be overwritten by
+         * hid_hw_request if needed
+         */
+        hidpp_report->device_index = 0xff;
+
+        ret = hid_hw_raw_request(hdev, hidpp_report->report_id,
+                (u8 *)hidpp_report, fields_count, HID_OUTPUT_REPORT,
+                HID_REQ_SET_REPORT);
+
+        return ret == fields_count ? 0 : -1;
+}
+
+/**
+ * hidpp_send_message_sync() returns 0 in case of success, and something else
+ * in case of a failure.
+ * - If ' something else' is positive, that means that an error has been raised
+ *   by the protocol itself.
+ * - If ' something else' is negative, that means that we had a classic error
+ *   (-ENOMEM, -EPIPE, etc...)
+ */
+static int hidpp_send_message_sync(struct hidpp_device *hidpp,
+        struct hidpp_report *message,
+        struct hidpp_report *response)
+{
+        int ret;
+
+        mutex_lock(&hidpp->send_mutex);
+
+        hidpp->send_receive_buf = response;
+        hidpp->answer_available = false;
+
+        /*
+         * So that we can later validate the answer when it arrives
+         * in hidpp_raw_event
+         */
+        *response = *message;
+
+        ret = __hidpp_send_report(hidpp->hid_dev, message);
+
+        if (ret) {
+                dbg_hid("__hidpp_send_report returned err: %d\n", ret);
+                memset(response, 0, sizeof(struct hidpp_report));
+                goto exit;
+        }
+
+        if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
+                                5*HZ)) {
+                dbg_hid("%s:timeout waiting for response\n", __func__);
+                memset(response, 0, sizeof(struct hidpp_report));
+                ret = -ETIMEDOUT;
+        }
+
+        if (response->report_id == REPORT_ID_HIDPP_SHORT &&
+            response->fap.feature_index == HIDPP_ERROR) {
+                ret = response->fap.params[1];
+                dbg_hid("__hidpp_send_report got hidpp error %02X\n", ret);
+                goto exit;
+        }
+
+exit:
+        mutex_unlock(&hidpp->send_mutex);
+        return ret;
+
+}
+
+static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
+        u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
+        struct hidpp_report *response)
+{
+        struct hidpp_report *message;
+        int ret;
+
+        if (param_count > sizeof(message->fap.params))
+                return -EINVAL;
+
+        message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
+        if (!message)
+                return -ENOMEM;
+        message->report_id = REPORT_ID_HIDPP_LONG;
+        message->fap.feature_index = feat_index;
+        message->fap.funcindex_clientid = funcindex_clientid;
+        memcpy(&message->fap.params, params, param_count);
+
+        ret = hidpp_send_message_sync(hidpp, message, response);
+        kfree(message);
+        return ret;
+}
+
+static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
+        u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
+        struct hidpp_report *response)
+{
+        struct hidpp_report *message;
+        int ret;
+
+        if ((report_id != REPORT_ID_HIDPP_SHORT) &&
+            (report_id != REPORT_ID_HIDPP_LONG))
+                return -EINVAL;
+
+        if (param_count > sizeof(message->rap.params))
+                return -EINVAL;
+
+        message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
+        if (!message)
+                return -ENOMEM;
+        message->report_id = report_id;
+        message->rap.sub_id = sub_id;
+        message->rap.reg_address = reg_address;
+        memcpy(&message->rap.params, params, param_count);
+
+        ret = hidpp_send_message_sync(hidpp_dev, message, response);
+        kfree(message);
+        return ret;
+}
+
+static void delayed_work_cb(struct work_struct *work)
+{
+        struct hidpp_device *hidpp = container_of(work, struct hidpp_device,
+                                                        work);
+        hidpp_connect_event(hidpp);
+}
+
+static inline bool hidpp_match_answer(struct hidpp_report *question,
+                struct hidpp_report *answer)
+{
+        return (answer->fap.feature_index == question->fap.feature_index) &&
+           (answer->fap.funcindex_clientid == question->fap.funcindex_clientid);
+}
+
+static inline bool hidpp_match_error(struct hidpp_report *question,
+                struct hidpp_report *answer)
+{
+        return (answer->fap.feature_index == HIDPP_ERROR) &&
+            (answer->fap.funcindex_clientid == question->fap.feature_index) &&
+            (answer->fap.params[0] == question->fap.funcindex_clientid);
+}
+
+static inline bool hidpp_report_is_connect_event(struct hidpp_report *report)
+{
+        return (report->report_id == REPORT_ID_HIDPP_SHORT) &&
+                (report->rap.sub_id == 0x41);
+}
+
+/* -------------------------------------------------------------------------- */
+/* HIDP++ 1.0 commands                                                        */
+/* -------------------------------------------------------------------------- */
+
+#define HIDPP_SET_REGISTER                              0x80
+#define HIDPP_GET_REGISTER                              0x81
+#define HIDPP_SET_LONG_REGISTER                         0x82
+#define HIDPP_GET_LONG_REGISTER                         0x83
+
+#define HIDPP_REG_PAIRING_INFORMATION                   0xB5
+#define DEVICE_NAME                                     0x40
+
+static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
+{
+        struct hidpp_report response;
+        int ret;
+        /* hid-logitech-dj is in charge of setting the right device index */
+        u8 params[1] = { DEVICE_NAME };
+        char *name;
+        int len;
+
+        ret = hidpp_send_rap_command_sync(hidpp_dev,
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_GET_LONG_REGISTER,
+                                        HIDPP_REG_PAIRING_INFORMATION,
+                                        params, 1, &response);
+        if (ret)
+                return NULL;
+
+        len = response.rap.params[1];
+
+        if (2 + len > sizeof(response.rap.params))
+                return NULL;
+
+        name = kzalloc(len + 1, GFP_KERNEL);
+        if (!name)
+                return NULL;
+
+        memcpy(name, &response.rap.params[2], len);
+        return name;
+}
+
+/* -------------------------------------------------------------------------- */
+/* 0x0000: Root                                                               */
+/* -------------------------------------------------------------------------- */
+
+#define HIDPP_PAGE_ROOT                                 0x0000
+#define HIDPP_PAGE_ROOT_IDX                             0x00
+
+#define CMD_ROOT_GET_FEATURE                            0x01
+#define CMD_ROOT_GET_PROTOCOL_VERSION                   0x11
+
+static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,
+        u8 *feature_index, u8 *feature_type)
+{
+        struct hidpp_report response;
+        int ret;
+        u8 params[2] = { feature >> 8, feature & 0x00FF };
+
+        ret = hidpp_send_fap_command_sync(hidpp,
+                        HIDPP_PAGE_ROOT_IDX,
+                        CMD_ROOT_GET_FEATURE,
+                        params, 2, &response);
+        if (ret)
+                return ret;
+
+        *feature_index = response.fap.params[0];
+        *feature_type = response.fap.params[1];
+
+        return ret;
+}
+
+static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
+{
+        struct hidpp_report response;
+        int ret;
+
+        ret = hidpp_send_fap_command_sync(hidpp,
+                        HIDPP_PAGE_ROOT_IDX,
+                        CMD_ROOT_GET_PROTOCOL_VERSION,
+                        NULL, 0, &response);
+
+        if (ret == HIDPP_ERROR_INVALID_SUBID) {
+                hidpp->protocol_major = 1;
+                hidpp->protocol_minor = 0;
+                return 0;
+        }
+
+        /* the device might not be connected */
+        if (ret == HIDPP_ERROR_RESOURCE_ERROR)
+                return -EIO;
+
+        if (ret > 0) {
+                hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
+                        __func__, ret);
+                return -EPROTO;
+        }
+        if (ret)
+                return ret;
+
+        hidpp->protocol_major = response.fap.params[0];
+        hidpp->protocol_minor = response.fap.params[1];
+
+        return ret;
+}
+
+static bool hidpp_is_connected(struct hidpp_device *hidpp)
+{
+        int ret;
+
+        ret = hidpp_root_get_protocol_version(hidpp);
+        if (!ret)
+                hid_dbg(hidpp->hid_dev, "HID++ %u.%u device connected.\n",
+                        hidpp->protocol_major, hidpp->protocol_minor);
+        return ret == 0;
+}
+
+/* -------------------------------------------------------------------------- */
+/* 0x0005: GetDeviceNameType                                                  */
+/* -------------------------------------------------------------------------- */
+
+#define HIDPP_PAGE_GET_DEVICE_NAME_TYPE                 0x0005
+
+#define CMD_GET_DEVICE_NAME_TYPE_GET_COUNT              0x01
+#define CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME        0x11
+#define CMD_GET_DEVICE_NAME_TYPE_GET_TYPE               0x21
+
+static int hidpp_devicenametype_get_count(struct hidpp_device *hidpp,
+        u8 feature_index, u8 *nameLength)
+{
+        struct hidpp_report response;
+        int ret;
+
+        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
+                CMD_GET_DEVICE_NAME_TYPE_GET_COUNT, NULL, 0, &response);
+
+        if (ret > 0) {
+                hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
+                        __func__, ret);
+                return -EPROTO;
+        }
+        if (ret)
+                return ret;
+
+        *nameLength = response.fap.params[0];
+
+        return ret;
+}
+
+static int hidpp_devicenametype_get_device_name(struct hidpp_device *hidpp,
+        u8 feature_index, u8 char_index, char *device_name, int len_buf)
+{
+        struct hidpp_report response;
+        int ret, i;
+        int count;
+
+        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
+                CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME, &char_index, 1,
+                &response);
+
+        if (ret > 0) {
+                hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
+                        __func__, ret);
+                return -EPROTO;
+        }
+        if (ret)
+                return ret;
+
+        if (response.report_id == REPORT_ID_HIDPP_LONG)
+                count = HIDPP_REPORT_LONG_LENGTH - 4;
+        else
+                count = HIDPP_REPORT_SHORT_LENGTH - 4;
+
+        if (len_buf < count)
+                count = len_buf;
+
+        for (i = 0; i < count; i++)
+                device_name[i] = response.fap.params[i];
+
+        return count;
+}
+
+static char *hidpp_get_device_name(struct hidpp_device *hidpp)
+{
+        u8 feature_type;
+        u8 feature_index;
+        u8 __name_length;
+        char *name;
+        unsigned index = 0;
+        int ret;
+
+        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_GET_DEVICE_NAME_TYPE,
+                &feature_index, &feature_type);
+        if (ret)
+                return NULL;
+
+        ret = hidpp_devicenametype_get_count(hidpp, feature_index,
+                &__name_length);
+        if (ret)
+                return NULL;
+
+        name = kzalloc(__name_length + 1, GFP_KERNEL);
+        if (!name)
+                return NULL;
+
+        while (index < __name_length) {
+                ret = hidpp_devicenametype_get_device_name(hidpp,
+                        feature_index, index, name + index,
+                        __name_length - index);
+                if (ret <= 0) {
+                        kfree(name);
+                        return NULL;
+                }
+                index += ret;
+        }
+
+        return name;
+}
+
+/* -------------------------------------------------------------------------- */
+/* 0x6100: TouchPadRawXY                                                      */
+/* -------------------------------------------------------------------------- */
+
+#define HIDPP_PAGE_TOUCHPAD_RAW_XY                      0x6100
+
+#define CMD_TOUCHPAD_GET_RAW_INFO                       0x01
+#define CMD_TOUCHPAD_SET_RAW_REPORT_STATE               0x21
+
+#define EVENT_TOUCHPAD_RAW_XY                           0x00
+
+#define TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT               0x01
+#define TOUCHPAD_RAW_XY_ORIGIN_UPPER_LEFT               0x03
+
+struct hidpp_touchpad_raw_info {
+        u16 x_size;
+        u16 y_size;
+        u8 z_range;
+        u8 area_range;
+        u8 timestamp_unit;
+        u8 maxcontacts;
+        u8 origin;
+        u16 res;
+};
+
+struct hidpp_touchpad_raw_xy_finger {
+        u8 contact_type;
+        u8 contact_status;
+        u16 x;
+        u16 y;
+        u8 z;
+        u8 area;
+        u8 finger_id;
+};
+
+struct hidpp_touchpad_raw_xy {
+        u16 timestamp;
+        struct hidpp_touchpad_raw_xy_finger fingers[2];
+        u8 spurious_flag;
+        u8 end_of_frame;
+        u8 finger_count;
+        u8 button;
+};
+
+static int hidpp_touchpad_get_raw_info(struct hidpp_device *hidpp,
+        u8 feature_index, struct hidpp_touchpad_raw_info *raw_info)
+{
+        struct hidpp_report response;
+        int ret;
+        u8 *params = (u8 *)response.fap.params;
+
+        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
+                CMD_TOUCHPAD_GET_RAW_INFO, NULL, 0, &response);
+
+        if (ret > 0) {
+                hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
+                        __func__, ret);
+                return -EPROTO;
+        }
+        if (ret)
+                return ret;
+
+        raw_info->x_size = get_unaligned_be16(&params[0]);
+        raw_info->y_size = get_unaligned_be16(&params[2]);
+        raw_info->z_range = params[4];
+        raw_info->area_range = params[5];
+        raw_info->maxcontacts = params[7];
+        raw_info->origin = params[8];
+        /* res is given in unit per inch */
+        raw_info->res = get_unaligned_be16(&params[13]) * 2 / 51;
+
+        return ret;
+}
+
+static int hidpp_touchpad_set_raw_report_state(struct hidpp_device *hidpp_dev,
+                u8 feature_index, bool send_raw_reports,
+                bool sensor_enhanced_settings)
+{
+        struct hidpp_report response;
+
+        /*
+         * Params:
+         *   bit 0 - enable raw
+         *   bit 1 - 16bit Z, no area
+         *   bit 2 - enhanced sensitivity
+         *   bit 3 - width, height (4 bits each) instead of area
+         *   bit 4 - send raw + gestures (degrades smoothness)
+         *   remaining bits - reserved
+         */
+        u8 params = send_raw_reports | (sensor_enhanced_settings << 2);
+
+        return hidpp_send_fap_command_sync(hidpp_dev, feature_index,
+                CMD_TOUCHPAD_SET_RAW_REPORT_STATE, &params, 1, &response);
+}
+
+static void hidpp_touchpad_touch_event(u8 *data,
+        struct hidpp_touchpad_raw_xy_finger *finger)
+{
+        u8 x_m = data[0] << 2;
+        u8 y_m = data[2] << 2;
+
+        finger->x = x_m << 6 | data[1];
+        finger->y = y_m << 6 | data[3];
+
+        finger->contact_type = data[0] >> 6;
+        finger->contact_status = data[2] >> 6;
+
+        finger->z = data[4];
+        finger->area = data[5];
+        finger->finger_id = data[6] >> 4;
+}
+
+static void hidpp_touchpad_raw_xy_event(struct hidpp_device *hidpp_dev,
+                u8 *data, struct hidpp_touchpad_raw_xy *raw_xy)
+{
+        memset(raw_xy, 0, sizeof(struct hidpp_touchpad_raw_xy));
+        raw_xy->end_of_frame = data[8] & 0x01;
+        raw_xy->spurious_flag = (data[8] >> 1) & 0x01;
+        raw_xy->finger_count = data[15] & 0x0f;
+        raw_xy->button = (data[8] >> 2) & 0x01;
+
+        if (raw_xy->finger_count) {
+                hidpp_touchpad_touch_event(&data[2], &raw_xy->fingers[0]);
+                hidpp_touchpad_touch_event(&data[9], &raw_xy->fingers[1]);
+        }
+}
+
+/* ************************************************************************** */
+/*                                                                            */
+/* Device Support                                                             */
+/*                                                                            */
+/* ************************************************************************** */
+
+/* -------------------------------------------------------------------------- */
+/* Touchpad HID++ devices                                                     */
+/* -------------------------------------------------------------------------- */
+
+#define WTP_MANUAL_RESOLUTION                           39
+
+struct wtp_data {
+        struct input_dev *input;
+        u16 x_size, y_size;
+        u8 finger_count;
+        u8 mt_feature_index;
+        u8 button_feature_index;
+        u8 maxcontacts;
+        bool flip_y;
+        unsigned int resolution;
+};
+
+static int wtp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+                struct hid_field *field, struct hid_usage *usage,
+                unsigned long **bit, int *max)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+
+        if ((hidpp->quirks & HIDPP_QUIRK_MULTI_INPUT) &&
+            (field->application == HID_GD_KEYBOARD))
+                return 0;
+
+        return -1;
+}
+
+static void wtp_populate_input(struct hidpp_device *hidpp,
+                struct input_dev *input_dev, bool origin_is_hid_core)
+{
+        struct wtp_data *wd = hidpp->private_data;
+
+        if ((hidpp->quirks & HIDPP_QUIRK_MULTI_INPUT) && origin_is_hid_core)
+                /* this is the generic hid-input call */
+                return;
+
+        __set_bit(EV_ABS, input_dev->evbit);
+        __set_bit(EV_KEY, input_dev->evbit);
+        __clear_bit(EV_REL, input_dev->evbit);
+        __clear_bit(EV_LED, input_dev->evbit);
+
+        input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, wd->x_size, 0, 0);
+        input_abs_set_res(input_dev, ABS_MT_POSITION_X, wd->resolution);
+        input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, wd->y_size, 0, 0);
+        input_abs_set_res(input_dev, ABS_MT_POSITION_Y, wd->resolution);
+
+        /* Max pressure is not given by the devices, pick one */
+        input_set_abs_params(input_dev, ABS_MT_PRESSURE, 0, 50, 0, 0);
+
+        input_set_capability(input_dev, EV_KEY, BTN_LEFT);
+
+        if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS)
+                input_set_capability(input_dev, EV_KEY, BTN_RIGHT);
+        else
+                __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
+
+        input_mt_init_slots(input_dev, wd->maxcontacts, INPUT_MT_POINTER |
+                INPUT_MT_DROP_UNUSED);
+
+        wd->input = input_dev;
+}
+
+static void wtp_touch_event(struct wtp_data *wd,
+        struct hidpp_touchpad_raw_xy_finger *touch_report)
+{
+        int slot;
+
+        if (!touch_report->finger_id || touch_report->contact_type)
+                /* no actual data */
+                return;
+
+        slot = input_mt_get_slot_by_key(wd->input, touch_report->finger_id);
+
+        input_mt_slot(wd->input, slot);
+        input_mt_report_slot_state(wd->input, MT_TOOL_FINGER,
+                                        touch_report->contact_status);
+        if (touch_report->contact_status) {
+                input_event(wd->input, EV_ABS, ABS_MT_POSITION_X,
+                                touch_report->x);
+                input_event(wd->input, EV_ABS, ABS_MT_POSITION_Y,
+                                wd->flip_y ? wd->y_size - touch_report->y :
+                                             touch_report->y);
+                input_event(wd->input, EV_ABS, ABS_MT_PRESSURE,
+                                touch_report->area);
+        }
+}
+
+static void wtp_send_raw_xy_event(struct hidpp_device *hidpp,
+                struct hidpp_touchpad_raw_xy *raw)
+{
+        struct wtp_data *wd = hidpp->private_data;
+        int i;
+
+        for (i = 0; i < 2; i++)
+                wtp_touch_event(wd, &(raw->fingers[i]));
+
+        if (raw->end_of_frame &&
+            !(hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS))
+                input_event(wd->input, EV_KEY, BTN_LEFT, raw->button);
+
+        if (raw->end_of_frame || raw->finger_count <= 2) {
+                input_mt_sync_frame(wd->input);
+                input_sync(wd->input);
+        }
+}
+
+static int wtp_mouse_raw_xy_event(struct hidpp_device *hidpp, u8 *data)
+{
+        struct wtp_data *wd = hidpp->private_data;
+        u8 c1_area = ((data[7] & 0xf) * (data[7] & 0xf) +
+                      (data[7] >> 4) * (data[7] >> 4)) / 2;
+        u8 c2_area = ((data[13] & 0xf) * (data[13] & 0xf) +
+                      (data[13] >> 4) * (data[13] >> 4)) / 2;
+        struct hidpp_touchpad_raw_xy raw = {
+                .timestamp = data[1],
+                .fingers = {
+                        {
+                                .contact_type = 0,
+                                .contact_status = !!data[7],
+                                .x = get_unaligned_le16(&data[3]),
+                                .y = get_unaligned_le16(&data[5]),
+                                .z = c1_area,
+                                .area = c1_area,
+                                .finger_id = data[2],
+                        }, {
+                                .contact_type = 0,
+                                .contact_status = !!data[13],
+                                .x = get_unaligned_le16(&data[9]),
+                                .y = get_unaligned_le16(&data[11]),
+                                .z = c2_area,
+                                .area = c2_area,
+                                .finger_id = data[8],
+                        }
+                },
+                .finger_count = wd->maxcontacts,
+                .spurious_flag = 0,
+                .end_of_frame = (data[0] >> 7) == 0,
+                .button = data[0] & 0x01,
+        };
+
+        wtp_send_raw_xy_event(hidpp, &raw);
+
+        return 1;
+}
+
+static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+        struct wtp_data *wd = hidpp->private_data;
+        struct hidpp_report *report = (struct hidpp_report *)data;
+        struct hidpp_touchpad_raw_xy raw;
+
+        if (!wd || !wd->input)
+                return 1;
+
+        switch (data[0]) {
+        case 0x02:
+                if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {
+                        input_event(wd->input, EV_KEY, BTN_LEFT,
+                                        !!(data[1] & 0x01));
+                        input_event(wd->input, EV_KEY, BTN_RIGHT,
+                                        !!(data[1] & 0x02));
+                        input_sync(wd->input);
+                } else {
+                        if (size < 21)
+                                return 1;
+                        return wtp_mouse_raw_xy_event(hidpp, &data[7]);
+                }
+        case REPORT_ID_HIDPP_LONG:
+                if ((report->fap.feature_index != wd->mt_feature_index) ||
+                    (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))
+                        return 1;
+                hidpp_touchpad_raw_xy_event(hidpp, data + 4, &raw);
+
+                wtp_send_raw_xy_event(hidpp, &raw);
+                return 0;
+        }
+
+        return 0;
+}
+
+static int wtp_get_config(struct hidpp_device *hidpp)
+{
+        struct wtp_data *wd = hidpp->private_data;
+        struct hidpp_touchpad_raw_info raw_info = {0};
+        u8 feature_type;
+        int ret;
+
+        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_TOUCHPAD_RAW_XY,
+                &wd->mt_feature_index, &feature_type);
+        if (ret)
+                /* means that the device is not powered up */
+                return ret;
+
+        ret = hidpp_touchpad_get_raw_info(hidpp, wd->mt_feature_index,
+                &raw_info);
+        if (ret)
+                return ret;
+
+        wd->x_size = raw_info.x_size;
+        wd->y_size = raw_info.y_size;
+        wd->maxcontacts = raw_info.maxcontacts;
+        wd->flip_y = raw_info.origin == TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT;
+        wd->resolution = raw_info.res;
+        if (!wd->resolution)
+                wd->resolution = WTP_MANUAL_RESOLUTION;
+
+        return 0;
+}
+
+static int wtp_allocate(struct hid_device *hdev, const struct hid_device_id *id)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+        struct wtp_data *wd;
+
+        wd = devm_kzalloc(&hdev->dev, sizeof(struct wtp_data),
+                        GFP_KERNEL);
+        if (!wd)
+                return -ENOMEM;
+
+        hidpp->private_data = wd;
+
+        return 0;
+};
+
+static void wtp_connect(struct hid_device *hdev, bool connected)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+        struct wtp_data *wd = hidpp->private_data;
+        int ret;
+
+        if (!connected)
+                return;
+
+        if (!wd->x_size) {
+                ret = wtp_get_config(hidpp);
+                if (ret) {
+                        hid_err(hdev, "Can not get wtp config: %d\n", ret);
+                        return;
+                }
+        }
+
+        hidpp_touchpad_set_raw_report_state(hidpp, wd->mt_feature_index,
+                        true, true);
+}
+
+/* -------------------------------------------------------------------------- */
+/* Generic HID++ devices                                                      */
+/* -------------------------------------------------------------------------- */
+
+static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+                struct hid_field *field, struct hid_usage *usage,
+                unsigned long **bit, int *max)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
+                return wtp_input_mapping(hdev, hi, field, usage, bit, max);
+
+        return 0;
+}
+
+static void hidpp_populate_input(struct hidpp_device *hidpp,
+                struct input_dev *input, bool origin_is_hid_core)
+{
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
+                wtp_populate_input(hidpp, input, origin_is_hid_core);
+}
+
+static void hidpp_input_configured(struct hid_device *hdev,
+                                struct hid_input *hidinput)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+        struct input_dev *input = hidinput->input;
+
+        hidpp_populate_input(hidpp, input, true);
+}
+
+static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+                int size)
+{
+        struct hidpp_report *question = hidpp->send_receive_buf;
+        struct hidpp_report *answer = hidpp->send_receive_buf;
+        struct hidpp_report *report = (struct hidpp_report *)data;
+
+        /*
+         * If the mutex is locked then we have a pending answer from a
+         * previoulsly sent command
+         */
+        if (unlikely(mutex_is_locked(&hidpp->send_mutex))) {
+                /*
+                 * Check for a correct hidpp20 answer or the corresponding
+                 * error
+                 */
+                if (hidpp_match_answer(question, report) ||
+                                hidpp_match_error(question, report)) {
+                        *answer = *report;
+                        hidpp->answer_available = true;
+                        wake_up(&hidpp->wait);
+                        /*
+                         * This was an answer to a command that this driver sent
+                         * We return 1 to hid-core to avoid forwarding the
+                         * command upstream as it has been treated by the driver
+                         */
+
+                        return 1;
+                }
+        }
+
+        if (unlikely(hidpp_report_is_connect_event(report))) {
+                atomic_set(&hidpp->connected,
+                                !(report->rap.params[0] & (1 << 6)));
+                if ((hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT) &&
+                    (schedule_work(&hidpp->work) == 0))
+                        dbg_hid("%s: connect event already queued\n", __func__);
+                return 1;
+        }
+
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
+                return wtp_raw_event(hidpp->hid_dev, data, size);
+
+        return 0;
+}
+
+static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
+                u8 *data, int size)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+
+        switch (data[0]) {
+        case REPORT_ID_HIDPP_LONG:
+                if (size != HIDPP_REPORT_LONG_LENGTH) {
+                        hid_err(hdev, "received hid++ report of bad size (%d)",
+                                size);
+                        return 1;
+                }
+                return hidpp_raw_hidpp_event(hidpp, data, size);
+        case REPORT_ID_HIDPP_SHORT:
+                if (size != HIDPP_REPORT_SHORT_LENGTH) {
+                        hid_err(hdev, "received hid++ report of bad size (%d)",
+                                size);
+                        return 1;
+                }
+                return hidpp_raw_hidpp_event(hidpp, data, size);
+        }
+
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
+                return wtp_raw_event(hdev, data, size);
+
+        return 0;
+}
+
+static void hidpp_overwrite_name(struct hid_device *hdev, bool use_unifying)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+        char *name;
+
+        if (use_unifying)
+                /*
+                 * the device is connected through an Unifying receiver, and
+                 * might not be already connected.
+                 * Ask the receiver for its name.
+                 */
+                name = hidpp_get_unifying_name(hidpp);
+        else
+                name = hidpp_get_device_name(hidpp);
+
+        if (!name)
+                hid_err(hdev, "unable to retrieve the name of the device");
+        else
+                snprintf(hdev->name, sizeof(hdev->name), "%s", name);
+
+        kfree(name);
+}
+
+static int hidpp_input_open(struct input_dev *dev)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+
+        return hid_hw_open(hid);
+}
+
+static void hidpp_input_close(struct input_dev *dev)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+
+        hid_hw_close(hid);
+}
+
+static struct input_dev *hidpp_allocate_input(struct hid_device *hdev)
+{
+        struct input_dev *input_dev = devm_input_allocate_device(&hdev->dev);
+
+        if (!input_dev)
+                return NULL;
+
+        input_set_drvdata(input_dev, hdev);
+        input_dev->open = hidpp_input_open;
+        input_dev->close = hidpp_input_close;
+
+        input_dev->name = hdev->name;
+        input_dev->phys = hdev->phys;
+        input_dev->uniq = hdev->uniq;
+        input_dev->id.bustype = hdev->bus;
+        input_dev->id.vendor  = hdev->vendor;
+        input_dev->id.product = hdev->product;
+        input_dev->id.version = hdev->version;
+        input_dev->dev.parent = &hdev->dev;
+
+        return input_dev;
+}
+
+static void hidpp_connect_event(struct hidpp_device *hidpp)
+{
+        struct hid_device *hdev = hidpp->hid_dev;
+        int ret = 0;
+        bool connected = atomic_read(&hidpp->connected);
+        struct input_dev *input;
+        char *name, *devm_name;
+
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
+                wtp_connect(hdev, connected);
+
+        if (!connected || hidpp->delayed_input)
+                return;
+
+        if (!hidpp->protocol_major) {
+                ret = !hidpp_is_connected(hidpp);
+                if (ret) {
+                        hid_err(hdev, "Can not get the protocol version.\n");
+                        return;
+                }
+        }
+
+        /* the device is already connected, we can ask for its name and
+         * protocol */
+        hid_info(hdev, "HID++ %u.%u device connected.\n",
+                 hidpp->protocol_major, hidpp->protocol_minor);
+
+        input = hidpp_allocate_input(hdev);
+        if (!input) {
+                hid_err(hdev, "cannot allocate new input device: %d\n", ret);
+                return;
+        }
+
+        name = hidpp_get_device_name(hidpp);
+        if (!name) {
+                hid_err(hdev, "unable to retrieve the name of the device");
+        } else {
+                devm_name = devm_kasprintf(&hdev->dev, GFP_KERNEL, "%s", name);
+                if (devm_name)
+                        input->name = devm_name;
+                kfree(name);
+        }
+
+        hidpp_populate_input(hidpp, input, false);
+
+        ret = input_register_device(input);
+        if (ret)
+                input_free_device(input);
+
+        hidpp->delayed_input = input;
+}
+
+static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+{
+        struct hidpp_device *hidpp;
+        int ret;
+        bool connected;
+        unsigned int connect_mask = HID_CONNECT_DEFAULT;
+
+        hidpp = devm_kzalloc(&hdev->dev, sizeof(struct hidpp_device),
+                        GFP_KERNEL);
+        if (!hidpp)
+                return -ENOMEM;
+
+        hidpp->hid_dev = hdev;
+        hid_set_drvdata(hdev, hidpp);
+
+        hidpp->quirks = id->driver_data;
+
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
+                ret = wtp_allocate(hdev, id);
+                if (ret)
+                        goto wtp_allocate_fail;
+        }
+
+        INIT_WORK(&hidpp->work, delayed_work_cb);
+        mutex_init(&hidpp->send_mutex);
+        init_waitqueue_head(&hidpp->wait);
+
+        ret = hid_parse(hdev);
+        if (ret) {
+                hid_err(hdev, "%s:parse failed\n", __func__);
+                goto hid_parse_fail;
+        }
+
+        /* Allow incoming packets */
+        hid_device_io_start(hdev);
+
+        connected = hidpp_is_connected(hidpp);
+        if (id->group != HID_GROUP_LOGITECH_DJ_DEVICE) {
+                if (!connected) {
+                        hid_err(hdev, "Device not connected");
+                        hid_device_io_stop(hdev);
+                        goto hid_parse_fail;
+                }
+
+                hid_info(hdev, "HID++ %u.%u device connected.\n",
+                         hidpp->protocol_major, hidpp->protocol_minor);
+        }
+
+        hidpp_overwrite_name(hdev, id->group == HID_GROUP_LOGITECH_DJ_DEVICE);
+        atomic_set(&hidpp->connected, connected);
+
+        if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
+                ret = wtp_get_config(hidpp);
+                if (ret)
+                        goto hid_parse_fail;
+        }
+
+        /* Block incoming packets */
+        hid_device_io_stop(hdev);
+
+        if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
+                connect_mask &= ~HID_CONNECT_HIDINPUT;
+
+        /* Re-enable hidinput for multi-input devices */
+        if (hidpp->quirks & HIDPP_QUIRK_MULTI_INPUT)
+                connect_mask |= HID_CONNECT_HIDINPUT;
+
+        ret = hid_hw_start(hdev, connect_mask);
+        if (ret) {
+                hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
+                goto hid_hw_start_fail;
+        }
+
+        if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT) {
+                /* Allow incoming packets */
+                hid_device_io_start(hdev);
+
+                hidpp_connect_event(hidpp);
+        }
+
+        return ret;
+
+hid_hw_start_fail:
+hid_parse_fail:
+        cancel_work_sync(&hidpp->work);
+        mutex_destroy(&hidpp->send_mutex);
+wtp_allocate_fail:
+        hid_set_drvdata(hdev, NULL);
+        return ret;
+}
+
+static void hidpp_remove(struct hid_device *hdev)
+{
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+
+        cancel_work_sync(&hidpp->work);
+        mutex_destroy(&hidpp->send_mutex);
+        hid_hw_stop(hdev);
+}
+
+static const struct hid_device_id hidpp_devices[] = {
+        { /* wireless touchpad */
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4011),
+          .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
+                         HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
+        { /* wireless touchpad T650 */
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4101),
+          .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
+        { /* wireless touchpad T651 */
+          HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
+                USB_DEVICE_ID_LOGITECH_T651),
+          .driver_data = HIDPP_QUIRK_CLASS_WTP },
+        { /* Keyboard TK820 */
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4102),
+          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_MULTI_INPUT |
+                         HIDPP_QUIRK_CLASS_WTP },
+
+        { HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
+        {}
+};
+
+MODULE_DEVICE_TABLE(hid, hidpp_devices);
+
+static struct hid_driver hidpp_driver = {
+        .name = "logitech-hidpp-device",
+        .id_table = hidpp_devices,
+        .probe = hidpp_probe,
+        .remove = hidpp_remove,
+        .raw_event = hidpp_raw_event,
+        .input_configured = hidpp_input_configured,
+        .input_mapping = hidpp_input_mapping,
+};
+
+module_hid_driver(hidpp_driver);
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index 8ba17a946f2a..cacda43f6a6f 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -274,6 +274,8 @@ static const struct hid_device_id ms_devices[] = {
                 .driver_data = MS_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
                 .driver_data = MS_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
+                .driver_data = MS_HIDINPUT },
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
                 .driver_data = MS_PRESENTER },
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 51e25b9407f2..f65e78b46999 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -67,6 +67,7 @@ MODULE_LICENSE("GPL");
 #define MT_QUIRK_IGNORE_DUPLICATES      (1 << 10)
 #define MT_QUIRK_HOVERING               (1 << 11)
 #define MT_QUIRK_CONTACT_CNT_ACCURATE   (1 << 12)
+#define MT_QUIRK_FORCE_GET_FEATURE      (1 << 13)
 
 #define MT_INPUTMODE_TOUCHSCREEN        0x02
 #define MT_INPUTMODE_TOUCHPAD           0x03
@@ -150,6 +151,7 @@ static void mt_post_parse(struct mt_device *td);
 #define MT_CLS_FLATFROG                         0x0107
 #define MT_CLS_GENERALTOUCH_TWOFINGERS          0x0108
 #define MT_CLS_GENERALTOUCH_PWT_TENFINGERS      0x0109
+#define MT_CLS_VTL                              0x0110
 
 #define MT_DEFAULT_MAXCONTACT   10
 #define MT_MAX_MAXCONTACT       250
@@ -255,6 +257,11 @@ static struct mt_class mt_classes[] = {
                 .sn_move = 2048,
                 .maxcontacts = 40,
         },
+        { .name = MT_CLS_VTL,
+                .quirks = MT_QUIRK_ALWAYS_VALID |
+                        MT_QUIRK_CONTACT_CNT_ACCURATE |
+                        MT_QUIRK_FORCE_GET_FEATURE,
+        },
         { }
 };
 
@@ -809,6 +816,9 @@ static void mt_set_input_mode(struct hid_device *hdev)
         struct mt_device *td = hid_get_drvdata(hdev);
         struct hid_report *r;
         struct hid_report_enum *re;
+        struct mt_class *cls = &td->mtclass;
+        char *buf;
+        int report_len;
 
         if (td->inputmode < 0)
                 return;
@@ -816,6 +826,18 @@ static void mt_set_input_mode(struct hid_device *hdev)
         re = &(hdev->report_enum[HID_FEATURE_REPORT]);
         r = re->report_id_hash[td->inputmode];
         if (r) {
+                if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) {
+                        report_len = hid_report_len(r);
+                        buf = hid_alloc_report_buf(r, GFP_KERNEL);
+                        if (!buf) {
+                                hid_err(hdev, "failed to allocate buffer for report\n");
+                                return;
+                        }
+                        hid_hw_raw_request(hdev, r->id, buf, report_len,
+                                           HID_FEATURE_REPORT,
+                                           HID_REQ_GET_REPORT);
+                        kfree(buf);
+                }
                 r->field[0]->value[td->inputmode_index] = td->inputmode_value;
                 hid_hw_request(hdev, r, HID_REQ_SET_REPORT);
         }
@@ -1281,6 +1303,11 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_UNITEC,
                         USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19) },
 
+        /* VTL panels */
+        { .driver_data = MT_CLS_VTL,
+                MT_USB_DEVICE(USB_VENDOR_ID_VTL,
+                        USB_DEVICE_ID_VTL_MULTITOUCH_FF3F) },
+
         /* Wistron panels */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_WISTRON,
diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
new file mode 100644
index 000000000000..2180e0789b76
--- /dev/null
+++ b/drivers/hid/hid-plantronics.c
@@ -0,0 +1,55 @@
+/*
+ *  Plantronics USB HID Driver
+ *
+ *  Copyright (c) 2014 JD Cole <jd.cole@plantronics.com>
+ *  Copyright (c) 2014 Terry Junge <terry.junge@plantronics.com>
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include "hid-ids.h"
+
+#include <linux/hid.h>
+#include <linux/module.h>
+
+static int plantronics_input_mapping(struct hid_device *hdev,
+                                     struct hid_input *hi,
+                                     struct hid_field *field,
+                                     struct hid_usage *usage,
+                                     unsigned long **bit, int *max)
+{
+        if (field->application == HID_CP_CONSUMERCONTROL
+            && (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) {
+                hid_dbg(hdev, "usage: %08x (appl: %08x) - defaulted\n",
+                         usage->hid, field->application);
+                return 0;
+        }
+
+        hid_dbg(hdev, "usage: %08x (appl: %08x) - ignored\n",
+                usage->hid, field->application);
+
+        return -1;
+}
+
+static const struct hid_device_id plantronics_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, plantronics_devices);
+
+static struct hid_driver plantronics_driver = {
+        .name = "plantronics",
+        .id_table = plantronics_devices,
+        .input_mapping = plantronics_input_mapping,
+};
+module_hid_driver(plantronics_driver);
+
+MODULE_AUTHOR("JD Cole <jd.cole@plantronics.com>");
+MODULE_AUTHOR("Terry Junge <terry.junge@plantronics.com>");
+MODULE_DESCRIPTION("Plantronics USB HID Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 3cccff73b9b9..b51200fe2f33 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -584,11 +584,15 @@ static int rmi_populate_f11(struct hid_device *hdev)
         bool has_query10 = false;
         bool has_query11;
         bool has_query12;
+        bool has_query27;
+        bool has_query28;
+        bool has_query36 = false;
         bool has_physical_props;
         bool has_gestures;
         bool has_rel;
+        bool has_data40 = false;
         unsigned x_size, y_size;
-        u16 query12_offset;
+        u16 query_offset;
 
         if (!data->f11.query_base_addr) {
                 hid_err(hdev, "No 2D sensor found, giving up.\n");
@@ -604,6 +608,8 @@ static int rmi_populate_f11(struct hid_device *hdev)
         has_query9 = !!(buf[0] & BIT(3));
         has_query11 = !!(buf[0] & BIT(4));
         has_query12 = !!(buf[0] & BIT(5));
+        has_query27 = !!(buf[0] & BIT(6));
+        has_query28 = !!(buf[0] & BIT(7));
 
         /* query 1 to get the max number of fingers */
         ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
@@ -626,43 +632,43 @@ static int rmi_populate_f11(struct hid_device *hdev)
         has_rel = !!(buf[0] & BIT(3));
         has_gestures = !!(buf[0] & BIT(5));
 
+        /*
+         * At least 4 queries are guaranteed to be present in F11
+         * +1 for query 5 which is present since absolute events are
+         * reported and +1 for query 12.
+         */
+        query_offset = 6;
+
+        if (has_rel)
+                ++query_offset; /* query 6 is present */
+
         if (has_gestures) {
                 /* query 8 to find out if query 10 exists */
-                ret = rmi_read(hdev, data->f11.query_base_addr + 8, buf);
+                ret = rmi_read(hdev,
+                        data->f11.query_base_addr + query_offset + 1, buf);
                 if (ret) {
                         hid_err(hdev, "can not read gesture information: %d.\n",
                                 ret);
                         return ret;
                 }
                 has_query10 = !!(buf[0] & BIT(2));
-        }
 
-        /*
-         * At least 4 queries are guaranteed to be present in F11
-         * +1 for query 5 which is present since absolute events are
-         * reported and +1 for query 12.
-         */
-        query12_offset = 6;
-
-        if (has_rel)
-                ++query12_offset; /* query 6 is present */
-
-        if (has_gestures)
-                query12_offset += 2; /* query 7 and 8 are present */
+                query_offset += 2; /* query 7 and 8 are present */
+        }
 
         if (has_query9)
-                ++query12_offset;
+                ++query_offset;
 
         if (has_query10)
-                ++query12_offset;
+                ++query_offset;
 
         if (has_query11)
-                ++query12_offset;
+                ++query_offset;
 
         /* query 12 to know if the physical properties are reported */
         if (has_query12) {
                 ret = rmi_read(hdev, data->f11.query_base_addr
-                                + query12_offset, buf);
+                                + query_offset, buf);
                 if (ret) {
                         hid_err(hdev, "can not get query 12: %d.\n", ret);
                         return ret;
@@ -670,9 +676,10 @@ static int rmi_populate_f11(struct hid_device *hdev)
                 has_physical_props = !!(buf[0] & BIT(5));
 
                 if (has_physical_props) {
+                        query_offset += 1;
                         ret = rmi_read_block(hdev,
                                         data->f11.query_base_addr
-                                                + query12_offset + 1, buf, 4);
+                                                + query_offset, buf, 4);
                         if (ret) {
                                 hid_err(hdev, "can not read query 15-18: %d.\n",
                                         ret);
@@ -687,9 +694,45 @@ static int rmi_populate_f11(struct hid_device *hdev)
 
                         hid_info(hdev, "%s: size in mm: %d x %d\n",
                                  __func__, data->x_size_mm, data->y_size_mm);
+
+                        /*
+                         * query 15 - 18 contain the size of the sensor
+                         * and query 19 - 26 contain bezel dimensions
+                         */
+                        query_offset += 12;
+                }
+        }
+
+        if (has_query27)
+                ++query_offset;
+
+        if (has_query28) {
+                ret = rmi_read(hdev, data->f11.query_base_addr
+                                + query_offset, buf);
+                if (ret) {
+                        hid_err(hdev, "can not get query 28: %d.\n", ret);
+                        return ret;
+                }
+
+                has_query36 = !!(buf[0] & BIT(6));
+        }
+
+        if (has_query36) {
+                query_offset += 2;
+                ret = rmi_read(hdev, data->f11.query_base_addr
+                                + query_offset, buf);
+                if (ret) {
+                        hid_err(hdev, "can not get query 36: %d.\n", ret);
+                        return ret;
                 }
+
+                has_data40 = !!(buf[0] & BIT(5));
         }
 
+
+        if (has_data40)
+                data->f11.report_size += data->max_fingers * 2;
+
         /*
          * retrieve the ctrl registers
          * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 6101816a7ddd..c29265055ac1 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -46,6 +46,7 @@ static void kone_profile_activated(struct kone_device *kone, uint new_profile)
 static void kone_profile_report(struct kone_device *kone, uint new_profile)
 {
         struct kone_roccat_report roccat_report;
+
         roccat_report.event = kone_mouse_event_switch_profile;
         roccat_report.value = new_profile;
         roccat_report.key = 0;
@@ -163,6 +164,7 @@ static int kone_set_settings(struct usb_device *usb_dev,
                 struct kone_settings const *settings)
 {
         int retval;
+
         retval = kone_send(usb_dev, kone_command_settings,
                         settings, sizeof(struct kone_settings));
         if (retval)
@@ -387,7 +389,7 @@ static struct bin_attribute bin_attr_profile##number = {	\
         .read = kone_sysfs_read_profilex,                       \
         .write = kone_sysfs_write_profilex,                     \
         .private = &profile_numbers[number-1],                  \
-};
+}
 PROFILE_ATTR(1);
 PROFILE_ATTR(2);
 PROFILE_ATTR(3);
@@ -456,6 +458,7 @@ static ssize_t kone_sysfs_show_tcu(struct device *dev,
 static int kone_tcu_command(struct usb_device *usb_dev, int number)
 {
         unsigned char value;
+
         value = number;
         return kone_send(usb_dev, kone_command_calibrate, &value, 1);
 }
@@ -697,10 +700,8 @@ static int kone_init_specials(struct hid_device *hdev)
                         == USB_INTERFACE_PROTOCOL_MOUSE) {
 
                 kone = kzalloc(sizeof(*kone), GFP_KERNEL);
-                if (!kone) {
-                        hid_err(hdev, "can't alloc device descriptor\n");
+                if (!kone)
                         return -ENOMEM;
-                }
                 hid_set_drvdata(hdev, kone);
 
                 retval = kone_init_kone_device_struct(usb_dev, kone);
diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
index 69cca1476a0c..5632c54eadf0 100644
--- a/drivers/hid/hid-saitek.c
+++ b/drivers/hid/hid-saitek.c
@@ -7,7 +7,7 @@
  *  (This module is based on "hid-ortek".)
  *  Copyright (c) 2012 Andreas Hübner
  *
- *  R.A.T.7, M.M.O.7 (USB gaming mice):
+ *  R.A.T.7, R.A.T.9, M.M.O.7 (USB gaming mice):
  *  Fixes the mode button which cycles through three constantly pressed
  *  buttons. All three press events are mapped to one button and the
  *  missing release event is generated immediately.
@@ -179,6 +179,8 @@ static const struct hid_device_id saitek_devices[] = {
                 .driver_data = SAITEK_FIX_PS1000 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
+                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7),
                 .driver_data = SAITEK_RELEASE_MODE_MMO7 },
         { }
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index bc4269e559f1..31e9d2561106 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -798,6 +798,12 @@ union sixaxis_output_report_01 {
         __u8 buf[36];
 };
 
+#define DS4_REPORT_0x02_SIZE 37
+#define DS4_REPORT_0x05_SIZE 32
+#define DS4_REPORT_0x11_SIZE 78
+#define DS4_REPORT_0x81_SIZE 7
+#define SIXAXIS_REPORT_0xF2_SIZE 18
+
 static spinlock_t sony_dev_list_lock;
 static LIST_HEAD(sony_device_list);
 static DEFINE_IDA(sony_device_id_allocator);
@@ -811,6 +817,7 @@ struct sony_sc {
         struct work_struct state_worker;
         struct power_supply battery;
         int device_id;
+        __u8 *output_report_dmabuf;
 
 #ifdef CONFIG_SONY_FF
         __u8 left;
@@ -1142,9 +1149,20 @@ static int sixaxis_set_operational_usb(struct hid_device *hdev)
 
 static int sixaxis_set_operational_bt(struct hid_device *hdev)
 {
-        unsigned char buf[] = { 0xf4,  0x42, 0x03, 0x00, 0x00 };
-        return hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf),
+        static const __u8 report[] = { 0xf4, 0x42, 0x03, 0x00, 0x00 };
+        __u8 *buf;
+        int ret;
+
+        buf = kmemdup(report, sizeof(report), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(report),
                                   HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+
+        kfree(buf);
+
+        return ret;
 }
 
 /*
@@ -1153,10 +1171,19 @@ static int sixaxis_set_operational_bt(struct hid_device *hdev)
  */
 static int dualshock4_set_operational_bt(struct hid_device *hdev)
 {
-        __u8 buf[37] = { 0 };
+        __u8 *buf;
+        int ret;
+
+        buf = kmalloc(DS4_REPORT_0x02_SIZE, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
-        return hid_hw_raw_request(hdev, 0x02, buf, sizeof(buf),
+        ret = hid_hw_raw_request(hdev, 0x02, buf, DS4_REPORT_0x02_SIZE,
                                 HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
+
+        kfree(buf);
+
+        return ret;
 }
 
 static void sixaxis_set_leds_from_id(int id, __u8 values[MAX_LEDS])
@@ -1471,9 +1498,7 @@ error_leds:
 
 static void sixaxis_state_worker(struct work_struct *work)
 {
-        struct sony_sc *sc = container_of(work, struct sony_sc, state_worker);
-        int n;
-        union sixaxis_output_report_01 report = {
+        static const union sixaxis_output_report_01 default_report = {
                 .buf = {
                         0x01,
                         0x00, 0xff, 0x00, 0xff, 0x00,
@@ -1485,20 +1510,27 @@ static void sixaxis_state_worker(struct work_struct *work)
                         0x00, 0x00, 0x00, 0x00, 0x00
                 }
         };
+        struct sony_sc *sc = container_of(work, struct sony_sc, state_worker);
+        struct sixaxis_output_report *report =
+                (struct sixaxis_output_report *)sc->output_report_dmabuf;
+        int n;
+
+        /* Initialize the report with default values */
+        memcpy(report, &default_report, sizeof(struct sixaxis_output_report));
 
 #ifdef CONFIG_SONY_FF
-        report.data.rumble.right_motor_on = sc->right ? 1 : 0;
-        report.data.rumble.left_motor_force = sc->left;
+        report->rumble.right_motor_on = sc->right ? 1 : 0;
+        report->rumble.left_motor_force = sc->left;
 #endif
 
-        report.data.leds_bitmap |= sc->led_state[0] << 1;
-        report.data.leds_bitmap |= sc->led_state[1] << 2;
-        report.data.leds_bitmap |= sc->led_state[2] << 3;
-        report.data.leds_bitmap |= sc->led_state[3] << 4;
+        report->leds_bitmap |= sc->led_state[0] << 1;
+        report->leds_bitmap |= sc->led_state[1] << 2;
+        report->leds_bitmap |= sc->led_state[2] << 3;
+        report->leds_bitmap |= sc->led_state[3] << 4;
 
         /* Set flag for all leds off, required for 3rd party INTEC controller */
-        if ((report.data.leds_bitmap & 0x1E) == 0)
-                report.data.leds_bitmap |= 0x20;
+        if ((report->leds_bitmap & 0x1E) == 0)
+                report->leds_bitmap |= 0x20;
 
         /*
          * The LEDs in the report are indexed in reverse order to their
@@ -1511,28 +1543,30 @@ static void sixaxis_state_worker(struct work_struct *work)
          */
         for (n = 0; n < 4; n++) {
                 if (sc->led_delay_on[n] || sc->led_delay_off[n]) {
-                        report.data.led[3 - n].duty_off = sc->led_delay_off[n];
-                        report.data.led[3 - n].duty_on = sc->led_delay_on[n];
+                        report->led[3 - n].duty_off = sc->led_delay_off[n];
+                        report->led[3 - n].duty_on = sc->led_delay_on[n];
                 }
         }
 
-        hid_hw_raw_request(sc->hdev, report.data.report_id, report.buf,
-                        sizeof(report), HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
+        hid_hw_raw_request(sc->hdev, report->report_id, (__u8 *)report,
+                        sizeof(struct sixaxis_output_report),
+                        HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
 }
 
 static void dualshock4_state_worker(struct work_struct *work)
 {
         struct sony_sc *sc = container_of(work, struct sony_sc, state_worker);
         struct hid_device *hdev = sc->hdev;
+        __u8 *buf = sc->output_report_dmabuf;
         int offset;
 
-        __u8 buf[78] = { 0 };
-
         if (sc->quirks & DUALSHOCK4_CONTROLLER_USB) {
+                memset(buf, 0, DS4_REPORT_0x05_SIZE);
                 buf[0] = 0x05;
                 buf[1] = 0xFF;
                 offset = 4;
         } else {
+                memset(buf, 0, DS4_REPORT_0x11_SIZE);
                 buf[0] = 0x11;
                 buf[1] = 0xB0;
                 buf[3] = 0x0F;
@@ -1560,12 +1594,33 @@ static void dualshock4_state_worker(struct work_struct *work)
         buf[offset++] = sc->led_delay_off[3];
 
         if (sc->quirks & DUALSHOCK4_CONTROLLER_USB)
-                hid_hw_output_report(hdev, buf, 32);
+                hid_hw_output_report(hdev, buf, DS4_REPORT_0x05_SIZE);
         else
-                hid_hw_raw_request(hdev, 0x11, buf, 78,
+                hid_hw_raw_request(hdev, 0x11, buf, DS4_REPORT_0x11_SIZE,
                                 HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
 }
 
+static int sony_allocate_output_report(struct sony_sc *sc)
+{
+        if (sc->quirks & SIXAXIS_CONTROLLER)
+                sc->output_report_dmabuf =
+                        kmalloc(sizeof(union sixaxis_output_report_01),
+                                GFP_KERNEL);
+        else if (sc->quirks & DUALSHOCK4_CONTROLLER_BT)
+                sc->output_report_dmabuf = kmalloc(DS4_REPORT_0x11_SIZE,
+                                                GFP_KERNEL);
+        else if (sc->quirks & DUALSHOCK4_CONTROLLER_USB)
+                sc->output_report_dmabuf = kmalloc(DS4_REPORT_0x05_SIZE,
+                                                GFP_KERNEL);
+        else
+                return 0;
+
+        if (!sc->output_report_dmabuf)
+                return -ENOMEM;
+
+        return 0;
+}
+
 #ifdef CONFIG_SONY_FF
 static int sony_play_effect(struct input_dev *dev, void *data,
                             struct ff_effect *effect)
@@ -1754,6 +1809,7 @@ static int sony_get_bt_devaddr(struct sony_sc *sc)
 
 static int sony_check_add(struct sony_sc *sc)
 {
+        __u8 *buf = NULL;
         int n, ret;
 
         if ((sc->quirks & DUALSHOCK4_CONTROLLER_BT) ||
@@ -1769,36 +1825,44 @@ static int sony_check_add(struct sony_sc *sc)
                         return 0;
                 }
         } else if (sc->quirks & DUALSHOCK4_CONTROLLER_USB) {
-                __u8 buf[7];
+                buf = kmalloc(DS4_REPORT_0x81_SIZE, GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
 
                 /*
                  * The MAC address of a DS4 controller connected via USB can be
                  * retrieved with feature report 0x81. The address begins at
                  * offset 1.
                  */
-                ret = hid_hw_raw_request(sc->hdev, 0x81, buf, sizeof(buf),
-                                HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
+                ret = hid_hw_raw_request(sc->hdev, 0x81, buf,
+                                DS4_REPORT_0x81_SIZE, HID_FEATURE_REPORT,
+                                HID_REQ_GET_REPORT);
 
-                if (ret != 7) {
+                if (ret != DS4_REPORT_0x81_SIZE) {
                         hid_err(sc->hdev, "failed to retrieve feature report 0x81 with the DualShock 4 MAC address\n");
-                        return ret < 0 ? ret : -EINVAL;
+                        ret = ret < 0 ? ret : -EINVAL;
+                        goto out_free;
                 }
 
                 memcpy(sc->mac_address, &buf[1], sizeof(sc->mac_address));
         } else if (sc->quirks & SIXAXIS_CONTROLLER_USB) {
-                __u8 buf[18];
+                buf = kmalloc(SIXAXIS_REPORT_0xF2_SIZE, GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
 
                 /*
                  * The MAC address of a Sixaxis controller connected via USB can
                  * be retrieved with feature report 0xf2. The address begins at
                  * offset 4.
                  */
-                ret = hid_hw_raw_request(sc->hdev, 0xf2, buf, sizeof(buf),
-                                HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
+                ret = hid_hw_raw_request(sc->hdev, 0xf2, buf,
+                                SIXAXIS_REPORT_0xF2_SIZE, HID_FEATURE_REPORT,
+                                HID_REQ_GET_REPORT);
 
-                if (ret != 18) {
+                if (ret != SIXAXIS_REPORT_0xF2_SIZE) {
                         hid_err(sc->hdev, "failed to retrieve feature report 0xf2 with the Sixaxis MAC address\n");
-                        return ret < 0 ? ret : -EINVAL;
+                        ret = ret < 0 ? ret : -EINVAL;
+                        goto out_free;
                 }
 
                 /*
@@ -1811,7 +1875,13 @@ static int sony_check_add(struct sony_sc *sc)
                 return 0;
         }
 
-        return sony_check_add_dev_list(sc);
+        ret = sony_check_add_dev_list(sc);
+
+out_free:
+
+        kfree(buf);
+
+        return ret;
 }
 
 static int sony_set_device_id(struct sony_sc *sc)
@@ -1895,6 +1965,12 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 return ret;
         }
 
+        ret = sony_allocate_output_report(sc);
+        if (ret < 0) {
+                hid_err(hdev, "failed to allocate the output report buffer\n");
+                goto err_stop;
+        }
+
         ret = sony_set_device_id(sc);
         if (ret < 0) {
                 hid_err(hdev, "failed to allocate the device id\n");
@@ -1984,6 +2060,7 @@ err_stop:
         if (sc->quirks & SONY_BATTERY_SUPPORT)
                 sony_battery_remove(sc);
         sony_cancel_work_sync(sc);
+        kfree(sc->output_report_dmabuf);
         sony_remove_dev_list(sc);
         sony_release_device_id(sc);
         hid_hw_stop(hdev);
@@ -2004,6 +2081,8 @@ static void sony_remove(struct hid_device *hdev)
 
         sony_cancel_work_sync(sc);
 
+        kfree(sc->output_report_dmabuf);
+
         sony_remove_dev_list(sc);
 
         sony_release_device_id(sc);
@@ -2034,6 +2113,9 @@ static const struct hid_device_id sony_devices[] = {
         /* Logitech Harmony Adapter for PS3 */
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3),
                 .driver_data = PS3REMOTE },
+        /* SMK-Link PS3 BD Remote Control */
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE),
+                .driver_data = PS3REMOTE },
         /* Sony Dualshock 4 controllers for PS4 */
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER),
                 .driver_data = DUALSHOCK4_CONTROLLER_USB },
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index f09e70cafaf1..d32037cbf9db 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -137,6 +137,7 @@ struct i2c_hid {
                                                    * descriptor. */
         unsigned int            bufsize;        /* i2c buffer size */
         char                    *inbuf;         /* Input buffer */
+        char                    *rawbuf;        /* Raw Input buffer */
         char                    *cmdbuf;        /* Command buffer */
         char                    *argsbuf;       /* Command arguments buffer */
 
@@ -369,7 +370,7 @@ static int i2c_hid_hwreset(struct i2c_client *client)
 static void i2c_hid_get_input(struct i2c_hid *ihid)
 {
         int ret, ret_size;
-        int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
+        int size = ihid->bufsize;
 
         ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
         if (ret != size) {
@@ -437,7 +438,7 @@ static void i2c_hid_init_report(struct hid_report *report, u8 *buffer,
                         report->id, buffer, size))
                 return;
 
-        i2c_hid_dbg(ihid, "report (len=%d): %*ph\n", size, size, ihid->inbuf);
+        i2c_hid_dbg(ihid, "report (len=%d): %*ph\n", size, size, buffer);
 
         ret_size = buffer[0] | (buffer[1] << 8);
 
@@ -504,9 +505,11 @@ static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type,
 static void i2c_hid_free_buffers(struct i2c_hid *ihid)
 {
         kfree(ihid->inbuf);
+        kfree(ihid->rawbuf);
         kfree(ihid->argsbuf);
         kfree(ihid->cmdbuf);
         ihid->inbuf = NULL;
+        ihid->rawbuf = NULL;
         ihid->cmdbuf = NULL;
         ihid->argsbuf = NULL;
         ihid->bufsize = 0;
@@ -522,10 +525,11 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
                        report_size; /* report */
 
         ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
+        ihid->rawbuf = kzalloc(report_size, GFP_KERNEL);
         ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
         ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);
 
-        if (!ihid->inbuf || !ihid->argsbuf || !ihid->cmdbuf) {
+        if (!ihid->inbuf || !ihid->rawbuf || !ihid->argsbuf || !ihid->cmdbuf) {
                 i2c_hid_free_buffers(ihid);
                 return -ENOMEM;
         }
@@ -552,12 +556,12 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
 
         ret = i2c_hid_get_report(client,
                         report_type == HID_FEATURE_REPORT ? 0x03 : 0x01,
-                        report_number, ihid->inbuf, ask_count);
+                        report_number, ihid->rawbuf, ask_count);
 
         if (ret < 0)
                 return ret;
 
-        ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
+        ret_count = ihid->rawbuf[0] | (ihid->rawbuf[1] << 8);
 
         if (ret_count <= 2)
                 return 0;
@@ -566,7 +570,7 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
 
         /* The query buffer contains the size, dropping it in the reply */
         count = min(count, ret_count - 2);
-        memcpy(buf, ihid->inbuf + 2, count);
+        memcpy(buf, ihid->rawbuf + 2, count);
 
         return count;
 }
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index ca6849a0121e..bfbe1bedda7f 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -278,18 +278,20 @@ static void hid_irq_in(struct urb *urb)
                 usbhid->retry_delay = 0;
                 if ((hid->quirks & HID_QUIRK_ALWAYS_POLL) && !hid->open)
                         break;
-                hid_input_report(urb->context, HID_INPUT_REPORT,
-                                 urb->transfer_buffer,
-                                 urb->actual_length, 1);
-                /*
-                 * autosuspend refused while keys are pressed
-                 * because most keyboards don't wake up when
-                 * a key is released
-                 */
-                if (hid_check_keys_pressed(hid))
-                        set_bit(HID_KEYS_PRESSED, &usbhid->iofl);
-                else
-                        clear_bit(HID_KEYS_PRESSED, &usbhid->iofl);
+                if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
+                        hid_input_report(urb->context, HID_INPUT_REPORT,
+                                         urb->transfer_buffer,
+                                         urb->actual_length, 1);
+                        /*
+                         * autosuspend refused while keys are pressed
+                         * because most keyboards don't wake up when
+                         * a key is released
+                         */
+                        if (hid_check_keys_pressed(hid))
+                                set_bit(HID_KEYS_PRESSED, &usbhid->iofl);
+                        else
+                                clear_bit(HID_KEYS_PRESSED, &usbhid->iofl);
+                }
                 break;
         case -EPIPE:            /* stall */
                 usbhid_mark_busy(usbhid);
@@ -338,8 +340,7 @@ static int hid_submit_out(struct hid_device *hid)
         report = usbhid->out[usbhid->outtail].report;
         raw_report = usbhid->out[usbhid->outtail].raw_report;
 
-        usbhid->urbout->transfer_buffer_length = ((report->size - 1) >> 3) +
-                                                 1 + (report->id > 0);
+        usbhid->urbout->transfer_buffer_length = hid_report_len(report);
         usbhid->urbout->dev = hid_to_usb_dev(hid);
         if (raw_report) {
                 memcpy(usbhid->outbuf, raw_report,
@@ -688,6 +689,7 @@ int usbhid_open(struct hid_device *hid)
                         goto done;
                 }
                 usbhid->intf->needs_remote_wakeup = 1;
+                set_bit(HID_RESUME_RUNNING, &usbhid->iofl);
                 res = hid_start_in(hid);
                 if (res) {
                         if (res != -ENOSPC) {
@@ -701,6 +703,15 @@ int usbhid_open(struct hid_device *hid)
                         }
                 }
                 usb_autopm_put_interface(usbhid->intf);
+
+                /*
+                 * In case events are generated while nobody was listening,
+                 * some are released when the device is re-opened.
+                 * Wait 50 msec for the queue to empty before allowing events
+                 * to go through hid.
+                 */
+                msleep(50);
+                clear_bit(HID_RESUME_RUNNING, &usbhid->iofl);
         }
 done:
         mutex_unlock(&hid_open_mut);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 552671ee7c5d..dc89be90b35e 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -73,11 +73,13 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/usbhid/usbhid.h b/drivers/hid/usbhid/usbhid.h
index f633c24ce28b..807922b49aa4 100644
--- a/drivers/hid/usbhid/usbhid.h
+++ b/drivers/hid/usbhid/usbhid.h
@@ -52,6 +52,7 @@ struct usb_interface *usbhid_find_interface(int minor);
 #define HID_STARTED             8
 #define HID_KEYS_PRESSED        10
 #define HID_NO_BANDWIDTH        11
+#define HID_RESUME_RUNNING      12
 
 /*
  * USB-specific HID struct, to be pointed to
diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h
index 0cc53440543a..7db432809e9e 100644
--- a/drivers/hid/wacom.h
+++ b/drivers/hid/wacom.h
@@ -140,7 +140,7 @@ extern const struct hid_device_id wacom_ids[];
 
 void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len);
 void wacom_setup_device_quirks(struct wacom_features *features);
-int wacom_setup_input_capabilities(struct input_dev *input_dev,
+int wacom_setup_pentouch_input_capabilities(struct input_dev *input_dev,
                                    struct wacom_wac *wacom_wac);
 int wacom_setup_pad_input_capabilities(struct input_dev *input_dev,
                                        struct wacom_wac *wacom_wac);
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 8593047bb726..654202941d30 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -13,6 +13,7 @@
 
 #include "wacom_wac.h"
 #include "wacom.h"
+#include <linux/input/mt.h>
 
 #define WAC_MSG_RETRIES         5
 
@@ -70,22 +71,15 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
 static int wacom_open(struct input_dev *dev)
 {
         struct wacom *wacom = input_get_drvdata(dev);
-        int retval;
-
-        mutex_lock(&wacom->lock);
-        retval = hid_hw_open(wacom->hdev);
-        mutex_unlock(&wacom->lock);
 
-        return retval;
+        return hid_hw_open(wacom->hdev);
 }
 
 static void wacom_close(struct input_dev *dev)
 {
         struct wacom *wacom = input_get_drvdata(dev);
 
-        mutex_lock(&wacom->lock);
         hid_hw_close(wacom->hdev);
-        mutex_unlock(&wacom->lock);
 }
 
 /*
@@ -192,9 +186,15 @@ static void wacom_usage_mapping(struct hid_device *hdev,
         if (!pen && !finger)
                 return;
 
-        if (finger && !features->touch_max)
-                /* touch device at least supports one touch point */
-                features->touch_max = 1;
+        /*
+         * Bamboo models do not support HID_DG_CONTACTMAX.
+         * And, Bamboo Pen only descriptor contains touch.
+         */
+        if (features->type != BAMBOO_PT) {
+                /* ISDv4 touch devices at least supports one touch point */
+                if (finger && !features->touch_max)
+                        features->touch_max = 1;
+        }
 
         switch (usage->hid) {
         case HID_GD_X:
@@ -230,6 +230,21 @@ static void wacom_usage_mapping(struct hid_device *hdev,
                 wacom_wac_usage_mapping(hdev, field, usage);
 }
 
+static void wacom_post_parse_hid(struct hid_device *hdev,
+                                 struct wacom_features *features)
+{
+        struct wacom *wacom = hid_get_drvdata(hdev);
+        struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+
+        if (features->type == HID_GENERIC) {
+                /* Any last-minute generic device setup */
+                if (features->touch_max > 1) {
+                        input_mt_init_slots(wacom_wac->input, wacom_wac->features.touch_max,
+                                    INPUT_MT_DIRECT);
+                }
+        }
+}
+
 static void wacom_parse_hid(struct hid_device *hdev,
                            struct wacom_features *features)
 {
@@ -264,6 +279,8 @@ static void wacom_parse_hid(struct hid_device *hdev,
                                 wacom_usage_mapping(hdev, hreport->field[i],
                                                 hreport->field[i]->usage + j);
         }
+
+        wacom_post_parse_hid(hdev, features);
 }
 
 static int wacom_hid_set_device_mode(struct hid_device *hdev)
@@ -1129,7 +1146,7 @@ static void wacom_clean_inputs(struct wacom *wacom)
                         input_free_device(wacom->wacom_wac.input);
         }
         if (wacom->wacom_wac.pad_input) {
-                if (wacom->wacom_wac.input_registered)
+                if (wacom->wacom_wac.pad_registered)
                         input_unregister_device(wacom->wacom_wac.pad_input);
                 else
                         input_free_device(wacom->wacom_wac.pad_input);
@@ -1151,13 +1168,13 @@ static int wacom_register_inputs(struct wacom *wacom)
         if (!input_dev || !pad_input_dev)
                 return -EINVAL;
 
-        error = wacom_setup_input_capabilities(input_dev, wacom_wac);
-        if (error)
-                return error;
-
-        error = input_register_device(input_dev);
-        if (error)
-                return error;
+        error = wacom_setup_pentouch_input_capabilities(input_dev, wacom_wac);
+        if (!error) {
+                error = input_register_device(input_dev);
+                if (error)
+                        return error;
+                wacom_wac->input_registered = true;
+        }
 
         error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac);
         if (error) {
@@ -1169,22 +1186,23 @@ static int wacom_register_inputs(struct wacom *wacom)
                 error = input_register_device(pad_input_dev);
                 if (error)
                         goto fail_register_pad_input;
+                wacom_wac->pad_registered = true;
 
                 error = wacom_initialize_leds(wacom);
                 if (error)
                         goto fail_leds;
         }
 
-        wacom_wac->input_registered = true;
-
         return 0;
 
 fail_leds:
         input_unregister_device(pad_input_dev);
         pad_input_dev = NULL;
+        wacom_wac->pad_registered = false;
 fail_register_pad_input:
         input_unregister_device(input_dev);
         wacom_wac->input = NULL;
+        wacom_wac->input_registered = false;
         return error;
 }
 
@@ -1321,12 +1339,6 @@ static void wacom_calculate_res(struct wacom_features *features)
                                                     features->unitExpo);
 }
 
-static int wacom_hid_report_len(struct hid_report *report)
-{
-        /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
-        return ((report->size - 1) >> 3) + 1 + (report->id > 0);
-}
-
 static size_t wacom_compute_pktlen(struct hid_device *hdev)
 {
         struct hid_report_enum *report_enum;
@@ -1336,7 +1348,7 @@ static size_t wacom_compute_pktlen(struct hid_device *hdev)
         report_enum = hdev->report_enum + HID_INPUT_REPORT;
 
         list_for_each_entry(report, &report_enum->report_list, list) {
-                size_t report_size = wacom_hid_report_len(report);
+                size_t report_size = hid_report_len(report);
                 if (report_size > size)
                         size = report_size;
         }
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 586b2405b0d4..ac7447c7b82e 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -25,6 +25,10 @@
 #define WACOM_INTUOS_RES        100
 #define WACOM_INTUOS3_RES       200
 
+/* Newer Cintiq and DTU have an offset between tablet and screen areas */
+#define WACOM_DTU_OFFSET        200
+#define WACOM_CINTIQ_OFFSET     400
+
 /*
  * Scale factor relating reported contact size to logical contact area.
  * 2^14/pi is a good approximation on Intuos5 and 3rd-gen Bamboo
@@ -600,8 +604,8 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
                 }
                 input_report_abs(input, ABS_PRESSURE, t);
                 input_report_abs(input, ABS_TILT_X,
-                                ((data[7] << 1) & 0x7e) | (data[8] >> 7));
-                input_report_abs(input, ABS_TILT_Y, data[8] & 0x7f);
+                                 (((data[7] << 1) & 0x7e) | (data[8] >> 7)) - 64);
+                input_report_abs(input, ABS_TILT_Y, (data[8] & 0x7f) - 64);
                 input_report_key(input, BTN_STYLUS, data[1] & 2);
                 input_report_key(input, BTN_STYLUS2, data[1] & 4);
                 input_report_key(input, BTN_TOUCH, t > 10);
@@ -612,8 +616,8 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
                 input_report_abs(input, ABS_WHEEL,
                                 (data[6] << 2) | ((data[7] >> 6) & 3));
                 input_report_abs(input, ABS_TILT_X,
-                                ((data[7] << 1) & 0x7e) | (data[8] >> 7));
-                input_report_abs(input, ABS_TILT_Y, data[8] & 0x7f);
+                                 (((data[7] << 1) & 0x7e) | (data[8] >> 7)) - 64);
+                input_report_abs(input, ABS_TILT_Y, (data[8] & 0x7f) - 64);
         }
 }
 
@@ -915,8 +919,8 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
                                 input_report_key(input, BTN_EXTRA,  data[6] & 0x10);
 
                                 input_report_abs(input, ABS_TILT_X,
-                                        ((data[7] << 1) & 0x7e) | (data[8] >> 7));
-                                input_report_abs(input, ABS_TILT_Y, data[8] & 0x7f);
+                                        (((data[7] << 1) & 0x7e) | (data[8] >> 7)) - 64);
+                                input_report_abs(input, ABS_TILT_Y, (data[8] & 0x7f) - 64);
                         } else {
                                 /* 2D mouse packet */
                                 input_report_key(input, BTN_LEFT,   data[8] & 0x04);
@@ -1377,11 +1381,12 @@ static void wacom_wac_finger_usage_mapping(struct hid_device *hdev,
 {
         struct wacom *wacom = hid_get_drvdata(hdev);
         struct wacom_wac *wacom_wac = &wacom->wacom_wac;
-        struct input_dev *input = wacom_wac->input;
+        struct wacom_features *features = &wacom_wac->features;
         unsigned touch_max = wacom_wac->features.touch_max;
 
         switch (usage->hid) {
         case HID_GD_X:
+                features->last_slot_field = usage->hid;
                 if (touch_max == 1)
                         wacom_map_usage(wacom, usage, field, EV_ABS, ABS_X, 4);
                 else
@@ -1389,6 +1394,7 @@ static void wacom_wac_finger_usage_mapping(struct hid_device *hdev,
                                         ABS_MT_POSITION_X, 4);
                 break;
         case HID_GD_Y:
+                features->last_slot_field = usage->hid;
                 if (touch_max == 1)
                         wacom_map_usage(wacom, usage, field, EV_ABS, ABS_Y, 4);
                 else
@@ -1396,19 +1402,48 @@ static void wacom_wac_finger_usage_mapping(struct hid_device *hdev,
                                         ABS_MT_POSITION_Y, 4);
                 break;
         case HID_DG_CONTACTID:
-                input_mt_init_slots(input, wacom_wac->features.touch_max,
-                        INPUT_MT_DIRECT);
+                features->last_slot_field = usage->hid;
                 break;
         case HID_DG_INRANGE:
+                features->last_slot_field = usage->hid;
                 break;
         case HID_DG_INVERT:
+                features->last_slot_field = usage->hid;
                 break;
         case HID_DG_TIPSWITCH:
+                features->last_slot_field = usage->hid;
                 wacom_map_usage(wacom, usage, field, EV_KEY, BTN_TOUCH, 0);
                 break;
         }
 }
 
+static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
+                struct input_dev *input)
+{
+        struct hid_data *hid_data = &wacom_wac->hid_data;
+        bool mt = wacom_wac->features.touch_max > 1;
+        bool prox = hid_data->tipswitch &&
+                    !wacom_wac->shared->stylus_in_proximity;
+
+        if (mt) {
+                int slot;
+
+                slot = input_mt_get_slot_by_key(input, hid_data->id);
+                input_mt_slot(input, slot);
+                input_mt_report_slot_state(input, MT_TOOL_FINGER, prox);
+        }
+        else {
+                input_report_key(input, BTN_TOUCH, prox);
+        }
+
+        if (prox) {
+                input_report_abs(input, mt ? ABS_MT_POSITION_X : ABS_X,
+                                 hid_data->x);
+                input_report_abs(input, mt ? ABS_MT_POSITION_Y : ABS_Y,
+                                 hid_data->y);
+        }
+}
+
 static int wacom_wac_finger_event(struct hid_device *hdev,
                 struct hid_field *field, struct hid_usage *usage, __s32 value)
 {
@@ -1431,36 +1466,35 @@ static int wacom_wac_finger_event(struct hid_device *hdev,
         }
 
 
+        if (usage->usage_index + 1 == field->report_count) {
+                if (usage->hid == wacom_wac->features.last_slot_field)
+                        wacom_wac_finger_slot(wacom_wac, wacom_wac->input);
+        }
+
         return 0;
 }
 
-static void wacom_wac_finger_mt_report(struct wacom_wac *wacom_wac,
-                struct input_dev *input, bool touch)
+static int wacom_wac_finger_count_touches(struct hid_device *hdev)
 {
-        int slot;
-        struct hid_data *hid_data = &wacom_wac->hid_data;
+        struct wacom *wacom = hid_get_drvdata(hdev);
+        struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+        struct input_dev *input = wacom_wac->input;
+        unsigned touch_max = wacom_wac->features.touch_max;
+        int count = 0;
+        int i;
 
-        slot = input_mt_get_slot_by_key(input, hid_data->id);
+        if (touch_max == 1)
+                return wacom_wac->hid_data.tipswitch &&
+                       !wacom_wac->shared->stylus_in_proximity;
 
-        input_mt_slot(input, slot);
-        input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
-        if (touch) {
-                input_report_abs(input, ABS_MT_POSITION_X, hid_data->x);
-                input_report_abs(input, ABS_MT_POSITION_Y, hid_data->y);
+        for (i = 0; i < input->mt->num_slots; i++) {
+                struct input_mt_slot *ps = &input->mt->slots[i];
+                int id = input_mt_get_value(ps, ABS_MT_TRACKING_ID);
+                if (id >= 0)
+                        count++;
         }
-        input_mt_sync_frame(input);
-}
 
-static void wacom_wac_finger_single_touch_report(struct wacom_wac *wacom_wac,
-                struct input_dev *input, bool touch)
-{
-        struct hid_data *hid_data = &wacom_wac->hid_data;
-
-        if (touch) {
-                input_report_abs(input, ABS_X, hid_data->x);
-                input_report_abs(input, ABS_Y, hid_data->y);
-        }
-        input_report_key(input, BTN_TOUCH, touch);
+        return count;
 }
 
 static void wacom_wac_finger_report(struct hid_device *hdev,
@@ -1469,24 +1503,23 @@ static void wacom_wac_finger_report(struct hid_device *hdev,
         struct wacom *wacom = hid_get_drvdata(hdev);
         struct wacom_wac *wacom_wac = &wacom->wacom_wac;
         struct input_dev *input = wacom_wac->input;
-        bool touch = wacom_wac->hid_data.tipswitch &&
-                     !wacom_wac->shared->stylus_in_proximity;
         unsigned touch_max = wacom_wac->features.touch_max;
 
         if (touch_max > 1)
-                wacom_wac_finger_mt_report(wacom_wac, input, touch);
-        else
-                wacom_wac_finger_single_touch_report(wacom_wac, input, touch);
+                input_mt_sync_frame(input);
+
         input_sync(input);
 
         /* keep touch state for pen event */
-        wacom_wac->shared->touch_down = touch;
+        wacom_wac->shared->touch_down = wacom_wac_finger_count_touches(hdev);
 }
 
 #define WACOM_PEN_FIELD(f)      (((f)->logical == HID_DG_STYLUS) || \
-                                 ((f)->physical == HID_DG_STYLUS))
+                                 ((f)->physical == HID_DG_STYLUS) || \
+                                 ((f)->application == HID_DG_PEN))
 #define WACOM_FINGER_FIELD(f)   (((f)->logical == HID_DG_FINGER) || \
-                                 ((f)->physical == HID_DG_FINGER))
+                                 ((f)->physical == HID_DG_FINGER) || \
+                                 ((f)->application == HID_DG_TOUCHSCREEN))
 
 void wacom_wac_usage_mapping(struct hid_device *hdev,
                 struct hid_field *field, struct hid_usage *usage)
@@ -1681,7 +1714,9 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
             return 0;
 
         if (data[0] == WACOM_REPORT_USB) {
-                if (features->type == INTUOSHT && features->touch_max) {
+                if (features->type == INTUOSHT &&
+                    wacom->shared->touch_input &&
+                    features->touch_max) {
                         input_report_switch(wacom->shared->touch_input,
                                             SW_MUTE_DEVICE, data[8] & 0x40);
                         input_sync(wacom->shared->touch_input);
@@ -1774,7 +1809,8 @@ static int wacom_wireless_irq(struct wacom_wac *wacom, size_t len)
                 int pid, battery, ps_connected;
 
                 if ((wacom->shared->type == INTUOSHT) &&
-                                wacom->shared->touch_max) {
+                    wacom->shared->touch_input &&
+                    wacom->shared->touch_max) {
                         input_report_switch(wacom->shared->touch_input,
                                         SW_MUTE_DEVICE, data[5] & 0x40);
                         input_sync(wacom->shared->touch_input);
@@ -1838,6 +1874,7 @@ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len)
                 break;
 
         case DTUS:
+        case DTUSX:
                 sync = wacom_dtus_irq(wacom_wac);
                 break;
 
@@ -1926,8 +1963,10 @@ static void wacom_setup_cintiq(struct wacom_wac *wacom_wac)
         input_set_abs_params(input_dev, ABS_DISTANCE,
                              0, wacom_wac->features.distance_max, 0, 0);
         input_set_abs_params(input_dev, ABS_WHEEL, 0, 1023, 0, 0);
-        input_set_abs_params(input_dev, ABS_TILT_X, 0, 127, 0, 0);
-        input_set_abs_params(input_dev, ABS_TILT_Y, 0, 127, 0, 0);
+        input_set_abs_params(input_dev, ABS_TILT_X, -64, 63, 0, 0);
+        input_abs_set_res(input_dev, ABS_TILT_X, 57);
+        input_set_abs_params(input_dev, ABS_TILT_Y, -64, 63, 0, 0);
+        input_abs_set_res(input_dev, ABS_TILT_Y, 57);
 }
 
 static void wacom_setup_intuos(struct wacom_wac *wacom_wac)
@@ -1947,6 +1986,7 @@ static void wacom_setup_intuos(struct wacom_wac *wacom_wac)
         __set_bit(BTN_TOOL_LENS, input_dev->keybit);
 
         input_set_abs_params(input_dev, ABS_RZ, -900, 899, 0, 0);
+        input_abs_set_res(input_dev, ABS_RZ, 287);
         input_set_abs_params(input_dev, ABS_THROTTLE, -1023, 1023, 0, 0);
 }
 
@@ -2029,7 +2069,7 @@ static void wacom_abs_set_axis(struct input_dev *input_dev,
         }
 }
 
-int wacom_setup_input_capabilities(struct input_dev *input_dev,
+int wacom_setup_pentouch_input_capabilities(struct input_dev *input_dev,
                                    struct wacom_wac *wacom_wac)
 {
         struct wacom_features *features = &wacom_wac->features;
@@ -2047,9 +2087,6 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
         switch (features->type) {
         case WACOM_MO:
-                input_set_abs_params(input_dev, ABS_WHEEL, 0, 71, 0, 0);
-                /* fall through */
-
         case WACOM_G4:
                 /* fall through */
 
@@ -2092,6 +2129,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
         case WACOM_24HD:
                 input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                input_abs_set_res(input_dev, ABS_Z, 287);
                 input_set_abs_params(input_dev, ABS_THROTTLE, 0, 71, 0, 0);
                 /* fall through */
 
@@ -2106,6 +2144,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
         case WACOM_BEE:
         case CINTIQ:
                 input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                input_abs_set_res(input_dev, ABS_Z, 287);
 
                 __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
 
@@ -2114,6 +2153,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
         case WACOM_13HD:
                 input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                input_abs_set_res(input_dev, ABS_Z, 287);
                 __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
                 wacom_setup_cintiq(wacom_wac);
                 break;
@@ -2122,6 +2162,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
         case INTUOS3L:
         case INTUOS3S:
                 input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                input_abs_set_res(input_dev, ABS_Z, 287);
                 /* fall through */
 
         case INTUOS:
@@ -2144,6 +2185,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                                               0, 0);
 
                         input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                        input_abs_set_res(input_dev, ABS_Z, 287);
 
                         wacom_setup_intuos(wacom_wac);
                 } else if (features->device_type == BTN_TOOL_FINGER) {
@@ -2162,6 +2204,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
         case INTUOS4L:
         case INTUOS4S:
                 input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                input_abs_set_res(input_dev, ABS_Z, 287);
                 wacom_setup_intuos(wacom_wac);
 
                 __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
@@ -2196,6 +2239,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                 /* fall through */
 
         case DTUS:
+        case DTUSX:
         case PL:
         case DTU:
                 __set_bit(BTN_TOOL_PEN, input_dev->keybit);
@@ -2246,6 +2290,9 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                                 __clear_bit(ABS_X, input_dev->absbit);
                                 __clear_bit(ABS_Y, input_dev->absbit);
                                 __clear_bit(BTN_TOUCH, input_dev->keybit);
+
+                                /* PAD is setup by wacom_setup_pad_input_capabilities later */
+                                return 1;
                         }
                 } else if (features->device_type == BTN_TOOL_PEN) {
                         __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
@@ -2261,6 +2308,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
         case CINTIQ_HYBRID:
                 input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                input_abs_set_res(input_dev, ABS_Z, 287);
                 __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
 
                 wacom_setup_cintiq(wacom_wac);
@@ -2303,9 +2351,7 @@ int wacom_setup_pad_input_capabilities(struct input_dev *input_dev,
 
         case WACOM_G4:
                 __set_bit(BTN_BACK, input_dev->keybit);
-                __set_bit(BTN_LEFT, input_dev->keybit);
                 __set_bit(BTN_FORWARD, input_dev->keybit);
-                __set_bit(BTN_RIGHT, input_dev->keybit);
                 input_set_capability(input_dev, EV_REL, REL_WHEEL);
                 break;
 
@@ -2402,7 +2448,7 @@ int wacom_setup_pad_input_capabilities(struct input_dev *input_dev,
         case INTUOSPS:
                 /* touch interface does not have the pad device */
                 if (features->device_type != BTN_TOOL_PEN)
-                        return 1;
+                        return -ENODEV;
 
                 for (i = 0; i < 7; i++)
                         __set_bit(BTN_0 + i, input_dev->keybit);
@@ -2446,8 +2492,10 @@ int wacom_setup_pad_input_capabilities(struct input_dev *input_dev,
         case INTUOSHT:
         case BAMBOO_PT:
                 /* pad device is on the touch interface */
-                if (features->device_type != BTN_TOOL_FINGER)
-                        return 1;
+                if ((features->device_type != BTN_TOOL_FINGER) ||
+                    /* Bamboo Pen only tablet does not have pad */
+                    ((features->type == BAMBOO_PT) && !features->touch_max))
+                        return -ENODEV;
 
                 __clear_bit(ABS_MISC, input_dev->absbit);
 
@@ -2460,7 +2508,7 @@ int wacom_setup_pad_input_capabilities(struct input_dev *input_dev,
 
         default:
                 /* no pad supported */
-                return 1;
+                return -ENODEV;
         }
         return 0;
 }
@@ -2664,11 +2712,13 @@ static const struct wacom_features wacom_features_0x317 =
           INTUOSPL, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, .touch_max = 16,
           .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
 static const struct wacom_features wacom_features_0xF4 =
-        { "Wacom Cintiq 24HD", 104280, 65400, 2047, 63,
-          WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200 };
+        { "Wacom Cintiq 24HD", 104080, 65200, 2047, 63,
+          WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0xF8 =
-        { "Wacom Cintiq 24HD touch", 104280, 65400, 2047, 63, /* Pen */
-          WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200,
+        { "Wacom Cintiq 24HD touch", 104080, 65200, 2047, 63, /* Pen */
+          WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET,
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf6 };
 static const struct wacom_features wacom_features_0xF6 =
         { "Wacom Cintiq 24HD touch", .type = WACOM_24HDT, /* Touch */
@@ -2684,8 +2734,9 @@ static const struct wacom_features wacom_features_0xC6 =
         { "Wacom Cintiq 12WX", 53020, 33440, 1023, 63,
           WACOM_BEE, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0x304 =
-        { "Wacom Cintiq 13HD", 59352, 33648, 1023, 63,
-          WACOM_13HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200 };
+        { "Wacom Cintiq 13HD", 59152, 33448, 1023, 63,
+          WACOM_13HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0xC7 =
         { "Wacom DTU1931", 37832, 30305, 511, 0,
           PL, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2697,28 +2748,38 @@ static const struct wacom_features wacom_features_0xF0 =
         { "Wacom DTU1631", 34623, 19553, 511, 0,
           DTU, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0xFB =
-        { "Wacom DTU1031", 22096, 13960, 511, 0,
-          DTUS, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+        { "Wacom DTU1031", 21896, 13760, 511, 0,
+          DTUS, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
+          WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
+static const struct wacom_features wacom_features_0x32F =
+        { "Wacom DTU1031X", 22472, 12728, 511, 0,
+          DTUSX, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
+          WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
 static const struct wacom_features wacom_features_0x57 =
         { "Wacom DTK2241", 95640, 54060, 2047, 63,
-          DTK, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200 };
+          DTK, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0x59 = /* Pen */
         { "Wacom DTH2242", 95640, 54060, 2047, 63,
-          DTK, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200,
+          DTK, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET,
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x5D };
 static const struct wacom_features wacom_features_0x5D = /* Touch */
         { "Wacom DTH2242",       .type = WACOM_24HDT,
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x59, .touch_max = 10,
           .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
 static const struct wacom_features wacom_features_0xCC =
-        { "Wacom Cintiq 21UX2", 87000, 65400, 2047, 63,
-          WACOM_21UX2, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200 };
+        { "Wacom Cintiq 21UX2", 86800, 65200, 2047, 63,
+          WACOM_21UX2, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0xFA =
-        { "Wacom Cintiq 22HD", 95640, 54060, 2047, 63,
-          WACOM_22HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200 };
+        { "Wacom Cintiq 22HD", 95440, 53860, 2047, 63,
+          WACOM_22HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0x5B =
-        { "Wacom Cintiq 22HDT", 95640, 54060, 2047, 63,
-          WACOM_22HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200,
+        { "Wacom Cintiq 22HDT", 95440, 53860, 2047, 63,
+          WACOM_22HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET,
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x5e };
 static const struct wacom_features wacom_features_0x5E =
         { "Wacom Cintiq 22HDT", .type = WACOM_24HDT,
@@ -2863,21 +2924,27 @@ static const struct wacom_features wacom_features_0x6004 =
         { "ISD-V4", 12800, 8000, 255, 0,
           TABLETPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x307 =
-        { "Wacom ISDv5 307", 59352, 33648, 2047, 63,
-          CINTIQ_HYBRID, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200,
+        { "Wacom ISDv5 307", 59152, 33448, 2047, 63,
+          CINTIQ_HYBRID, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET,
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x309 };
 static const struct wacom_features wacom_features_0x309 =
         { "Wacom ISDv5 309", .type = WACOM_24HDT, /* Touch */
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x0307, .touch_max = 10,
           .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
 static const struct wacom_features wacom_features_0x30A =
-        { "Wacom ISDv5 30A", 59352, 33648, 2047, 63,
-          CINTIQ_HYBRID, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200,
+        { "Wacom ISDv5 30A", 59152, 33448, 2047, 63,
+          CINTIQ_HYBRID, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET,
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x30C };
 static const struct wacom_features wacom_features_0x30C =
         { "Wacom ISDv5 30C", .type = WACOM_24HDT, /* Touch */
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x30A, .touch_max = 10,
           .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
+static const struct wacom_features wacom_features_0x323 =
+        { "Wacom Intuos P M", 21600, 13500, 1023, 31,
+          INTUOSHT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
+          .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
 
 static const struct wacom_features wacom_features_HID_ANY_ID =
         { "Wacom HID", .type = HID_GENERIC };
@@ -3022,10 +3089,13 @@ const struct hid_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0x314) },
         { USB_DEVICE_WACOM(0x315) },
         { USB_DEVICE_WACOM(0x317) },
+        { USB_DEVICE_WACOM(0x323) },
+        { USB_DEVICE_WACOM(0x32F) },
         { USB_DEVICE_WACOM(0x4001) },
         { USB_DEVICE_WACOM(0x4004) },
         { USB_DEVICE_WACOM(0x5000) },
         { USB_DEVICE_WACOM(0x5002) },
+        { USB_DEVICE_LENOVO(0x6004) },
 
         { USB_DEVICE_WACOM(HID_ANY_ID) },
         { }
diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
index 0f0b85ec1322..bfad815cda8a 100644
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -80,6 +80,7 @@ enum {
         PL,
         DTU,
         DTUS,
+        DTUSX,
         INTUOS,
         INTUOS3S,
         INTUOS3,
@@ -144,6 +145,7 @@ struct wacom_features {
         int pktlen;
         bool check_for_hid_type;
         int hid_type;
+        int last_slot_field;
 };
 
 struct wacom_shared {
@@ -183,6 +185,7 @@ struct wacom_wac {
         struct input_dev *input;
         struct input_dev *pad_input;
         bool input_registered;
+        bool pad_registered;
         int pid;
         int battery_capacity;
         int num_contacts_left;
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 6dbfbc209491..30f0e61341c5 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -144,13 +144,26 @@ config OMAP_IOMMU
         select IOMMU_API
 
 config OMAP_IOMMU_DEBUG
-       tristate "Export OMAP IOMMU internals in DebugFS"
-       depends on OMAP_IOMMU && DEBUG_FS
-       help
-         Select this to see extensive information about
-         the internal state of OMAP IOMMU in debugfs.
+        bool "Export OMAP IOMMU internals in DebugFS"
+        depends on OMAP_IOMMU && DEBUG_FS
+        ---help---
+          Select this to see extensive information about
+          the internal state of OMAP IOMMU in debugfs.
+
+          Say N unless you know you need this.
 
-         Say N unless you know you need this.
+config ROCKCHIP_IOMMU
+        bool "Rockchip IOMMU Support"
+        depends on ARM
+        depends on ARCH_ROCKCHIP || COMPILE_TEST
+        select IOMMU_API
+        select ARM_DMA_USE_IOMMU
+        help
+          Support for IOMMUs found on Rockchip rk32xx SOCs.
+          These IOMMUs allow virtualization of the address space used by most
+          cores within the multimedia subsystem.
+          Say Y here if you are using a Rockchip SoC that includes an IOMMU
+          device.
 
 config TEGRA_IOMMU_GART
         bool "Tegra GART IOMMU Support"
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 16edef74b8ee..7b976f294a69 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -11,8 +11,8 @@ obj-$(CONFIG_INTEL_IOMMU) += iova.o intel-iommu.o
 obj-$(CONFIG_IPMMU_VMSA) += ipmmu-vmsa.o
 obj-$(CONFIG_IRQ_REMAP) += intel_irq_remapping.o irq_remapping.o
 obj-$(CONFIG_OMAP_IOMMU) += omap-iommu.o
-obj-$(CONFIG_OMAP_IOMMU) += omap-iommu2.o
 obj-$(CONFIG_OMAP_IOMMU_DEBUG) += omap-iommu-debug.o
+obj-$(CONFIG_ROCKCHIP_IOMMU) += rockchip-iommu.o
 obj-$(CONFIG_TEGRA_IOMMU_GART) += tegra-gart.o
 obj-$(CONFIG_TEGRA_IOMMU_SMMU) += tegra-smmu.o
 obj-$(CONFIG_EXYNOS_IOMMU) += exynos-iommu.o
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 2d84c9edf3b8..b205f76d7129 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3411,6 +3411,8 @@ static bool amd_iommu_capable(enum iommu_cap cap)
                 return true;
         case IOMMU_CAP_INTR_REMAP:
                 return (irq_remapping_enabled == 1);
+        case IOMMU_CAP_NOEXEC:
+                return false;
         }
 
         return false;
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 90d734bbf467..a2d87a60c27f 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -279,10 +279,8 @@ static void free_pasid_state(struct pasid_state *pasid_state)
 
 static void put_pasid_state(struct pasid_state *pasid_state)
 {
-        if (atomic_dec_and_test(&pasid_state->count)) {
-                put_device_state(pasid_state->device_state);
+        if (atomic_dec_and_test(&pasid_state->count))
                 wake_up(&pasid_state->wq);
-        }
 }
 
 static void put_pasid_state_wait(struct pasid_state *pasid_state)
@@ -291,9 +289,7 @@ static void put_pasid_state_wait(struct pasid_state *pasid_state)
 
         prepare_to_wait(&pasid_state->wq, &wait, TASK_UNINTERRUPTIBLE);
 
-        if (atomic_dec_and_test(&pasid_state->count))
-                put_device_state(pasid_state->device_state);
-        else
+        if (!atomic_dec_and_test(&pasid_state->count))
                 schedule();
 
         finish_wait(&pasid_state->wq, &wait);
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index e393ae01b5d2..b8aac1389a96 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -404,9 +404,16 @@ struct arm_smmu_cfg {
 #define ARM_SMMU_CB_ASID(cfg)           ((cfg)->cbndx)
 #define ARM_SMMU_CB_VMID(cfg)           ((cfg)->cbndx + 1)
 
+enum arm_smmu_domain_stage {
+        ARM_SMMU_DOMAIN_S1 = 0,
+        ARM_SMMU_DOMAIN_S2,
+        ARM_SMMU_DOMAIN_NESTED,
+};
+
 struct arm_smmu_domain {
         struct arm_smmu_device          *smmu;
         struct arm_smmu_cfg             cfg;
+        enum arm_smmu_domain_stage      stage;
         spinlock_t                      lock;
 };
 
@@ -906,19 +913,46 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
         if (smmu_domain->smmu)
                 goto out_unlock;
 
-        if (smmu->features & ARM_SMMU_FEAT_TRANS_NESTED) {
+        /*
+         * Mapping the requested stage onto what we support is surprisingly
+         * complicated, mainly because the spec allows S1+S2 SMMUs without
+         * support for nested translation. That means we end up with the
+         * following table:
+         *
+         * Requested        Supported        Actual
+         *     S1               N              S1
+         *     S1             S1+S2            S1
+         *     S1               S2             S2
+         *     S1               S1             S1
+         *     N                N              N
+         *     N              S1+S2            S2
+         *     N                S2             S2
+         *     N                S1             S1
+         *
+         * Note that you can't actually request stage-2 mappings.
+         */
+        if (!(smmu->features & ARM_SMMU_FEAT_TRANS_S1))
+                smmu_domain->stage = ARM_SMMU_DOMAIN_S2;
+        if (!(smmu->features & ARM_SMMU_FEAT_TRANS_S2))
+                smmu_domain->stage = ARM_SMMU_DOMAIN_S1;
+
+        switch (smmu_domain->stage) {
+        case ARM_SMMU_DOMAIN_S1:
+                cfg->cbar = CBAR_TYPE_S1_TRANS_S2_BYPASS;
+                start = smmu->num_s2_context_banks;
+                break;
+        case ARM_SMMU_DOMAIN_NESTED:
                 /*
                  * We will likely want to change this if/when KVM gets
                  * involved.
                  */
-                cfg->cbar = CBAR_TYPE_S1_TRANS_S2_BYPASS;
-                start = smmu->num_s2_context_banks;
-        } else if (smmu->features & ARM_SMMU_FEAT_TRANS_S1) {
-                cfg->cbar = CBAR_TYPE_S1_TRANS_S2_BYPASS;
-                start = smmu->num_s2_context_banks;
-        } else {
+        case ARM_SMMU_DOMAIN_S2:
                 cfg->cbar = CBAR_TYPE_S2_TRANS;
                 start = 0;
+                break;
+        default:
+                ret = -EINVAL;
+                goto out_unlock;
         }
 
         ret = __arm_smmu_alloc_bitmap(smmu->context_map, start,
@@ -1281,7 +1315,7 @@ static int arm_smmu_alloc_init_pte(struct arm_smmu_device *smmu, pmd_t *pmd,
                                    unsigned long pfn, int prot, int stage)
 {
         pte_t *pte, *start;
-        pteval_t pteval = ARM_SMMU_PTE_PAGE | ARM_SMMU_PTE_AF | ARM_SMMU_PTE_XN;
+        pteval_t pteval = ARM_SMMU_PTE_PAGE | ARM_SMMU_PTE_AF;
 
         if (pmd_none(*pmd)) {
                 /* Allocate a new set of tables */
@@ -1315,10 +1349,11 @@ static int arm_smmu_alloc_init_pte(struct arm_smmu_device *smmu, pmd_t *pmd,
                         pteval |= ARM_SMMU_PTE_MEMATTR_NC;
         }
 
+        if (prot & IOMMU_NOEXEC)
+                pteval |= ARM_SMMU_PTE_XN;
+
         /* If no access, create a faulting entry to avoid TLB fills */
-        if (prot & IOMMU_EXEC)
-                pteval &= ~ARM_SMMU_PTE_XN;
-        else if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
+        if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
                 pteval &= ~ARM_SMMU_PTE_PAGE;
 
         pteval |= ARM_SMMU_PTE_SH_IS;
@@ -1568,6 +1603,8 @@ static bool arm_smmu_capable(enum iommu_cap cap)
                 return true;
         case IOMMU_CAP_INTR_REMAP:
                 return true; /* MSIs are just memory writes */
+        case IOMMU_CAP_NOEXEC:
+                return true;
         default:
                 return false;
         }
@@ -1644,21 +1681,57 @@ static void arm_smmu_remove_device(struct device *dev)
         iommu_group_remove_device(dev);
 }
 
+static int arm_smmu_domain_get_attr(struct iommu_domain *domain,
+                                    enum iommu_attr attr, void *data)
+{
+        struct arm_smmu_domain *smmu_domain = domain->priv;
+
+        switch (attr) {
+        case DOMAIN_ATTR_NESTING:
+                *(int *)data = (smmu_domain->stage == ARM_SMMU_DOMAIN_NESTED);
+                return 0;
+        default:
+                return -ENODEV;
+        }
+}
+
+static int arm_smmu_domain_set_attr(struct iommu_domain *domain,
+                                    enum iommu_attr attr, void *data)
+{
+        struct arm_smmu_domain *smmu_domain = domain->priv;
+
+        switch (attr) {
+        case DOMAIN_ATTR_NESTING:
+                if (smmu_domain->smmu)
+                        return -EPERM;
+                if (*(int *)data)
+                        smmu_domain->stage = ARM_SMMU_DOMAIN_NESTED;
+                else
+                        smmu_domain->stage = ARM_SMMU_DOMAIN_S1;
+
+                return 0;
+        default:
+                return -ENODEV;
+        }
+}
+
 static const struct iommu_ops arm_smmu_ops = {
-        .capable        = arm_smmu_capable,
-        .domain_init    = arm_smmu_domain_init,
-        .domain_destroy = arm_smmu_domain_destroy,
-        .attach_dev     = arm_smmu_attach_dev,
-        .detach_dev     = arm_smmu_detach_dev,
-        .map            = arm_smmu_map,
-        .unmap          = arm_smmu_unmap,
-        .map_sg         = default_iommu_map_sg,
-        .iova_to_phys   = arm_smmu_iova_to_phys,
-        .add_device     = arm_smmu_add_device,
-        .remove_device  = arm_smmu_remove_device,
-        .pgsize_bitmap  = (SECTION_SIZE |
-                           ARM_SMMU_PTE_CONT_SIZE |
-                           PAGE_SIZE),
+        .capable                = arm_smmu_capable,
+        .domain_init            = arm_smmu_domain_init,
+        .domain_destroy         = arm_smmu_domain_destroy,
+        .attach_dev             = arm_smmu_attach_dev,
+        .detach_dev             = arm_smmu_detach_dev,
+        .map                    = arm_smmu_map,
+        .unmap                  = arm_smmu_unmap,
+        .map_sg                 = default_iommu_map_sg,
+        .iova_to_phys           = arm_smmu_iova_to_phys,
+        .add_device             = arm_smmu_add_device,
+        .remove_device          = arm_smmu_remove_device,
+        .domain_get_attr        = arm_smmu_domain_get_attr,
+        .domain_set_attr        = arm_smmu_domain_set_attr,
+        .pgsize_bitmap          = (SECTION_SIZE |
+                                   ARM_SMMU_PTE_CONT_SIZE |
+                                   PAGE_SIZE),
 };
 
 static void arm_smmu_device_reset(struct arm_smmu_device *smmu)
@@ -2073,8 +2146,20 @@ static struct platform_driver arm_smmu_driver = {
 
 static int __init arm_smmu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        /*
+         * Play nice with systems that don't have an ARM SMMU by checking that
+         * an ARM SMMU exists in the system before proceeding with the driver
+         * and IOMMU bus operation registration.
+         */
+        np = of_find_matching_node(NULL, arm_smmu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         ret = platform_driver_register(&arm_smmu_driver);
         if (ret)
                 return ret;
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index c5c61cabd6e3..9847613085e1 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -44,6 +44,14 @@
 
 #include "irq_remapping.h"
 
+typedef int (*dmar_res_handler_t)(struct acpi_dmar_header *, void *);
+struct dmar_res_callback {
+        dmar_res_handler_t      cb[ACPI_DMAR_TYPE_RESERVED];
+        void                    *arg[ACPI_DMAR_TYPE_RESERVED];
+        bool                    ignore_unhandled;
+        bool                    print_entry;
+};
+
 /*
  * Assumptions:
  * 1) The hotplug framework guarentees that DMAR unit will be hot-added
@@ -62,11 +70,12 @@ LIST_HEAD(dmar_drhd_units);
 struct acpi_table_header * __initdata dmar_tbl;
 static acpi_size dmar_tbl_size;
 static int dmar_dev_scope_status = 1;
+static unsigned long dmar_seq_ids[BITS_TO_LONGS(DMAR_UNITS_SUPPORTED)];
 
 static int alloc_iommu(struct dmar_drhd_unit *drhd);
 static void free_iommu(struct intel_iommu *iommu);
 
-static void __init dmar_register_drhd_unit(struct dmar_drhd_unit *drhd)
+static void dmar_register_drhd_unit(struct dmar_drhd_unit *drhd)
 {
         /*
          * add INCLUDE_ALL at the tail, so scan the list will find it at
@@ -344,24 +353,45 @@ static struct notifier_block dmar_pci_bus_nb = {
         .priority = INT_MIN,
 };
 
+static struct dmar_drhd_unit *
+dmar_find_dmaru(struct acpi_dmar_hardware_unit *drhd)
+{
+        struct dmar_drhd_unit *dmaru;
+
+        list_for_each_entry_rcu(dmaru, &dmar_drhd_units, list)
+                if (dmaru->segment == drhd->segment &&
+                    dmaru->reg_base_addr == drhd->address)
+                        return dmaru;
+
+        return NULL;
+}
+
 /**
  * dmar_parse_one_drhd - parses exactly one DMA remapping hardware definition
  * structure which uniquely represent one DMA remapping hardware unit
  * present in the platform
  */
-static int __init
-dmar_parse_one_drhd(struct acpi_dmar_header *header)
+static int dmar_parse_one_drhd(struct acpi_dmar_header *header, void *arg)
 {
         struct acpi_dmar_hardware_unit *drhd;
         struct dmar_drhd_unit *dmaru;
         int ret = 0;
 
         drhd = (struct acpi_dmar_hardware_unit *)header;
-        dmaru = kzalloc(sizeof(*dmaru), GFP_KERNEL);
+        dmaru = dmar_find_dmaru(drhd);
+        if (dmaru)
+                goto out;
+
+        dmaru = kzalloc(sizeof(*dmaru) + header->length, GFP_KERNEL);
         if (!dmaru)
                 return -ENOMEM;
 
-        dmaru->hdr = header;
+        /*
+         * If header is allocated from slab by ACPI _DSM method, we need to
+         * copy the content because the memory buffer will be freed on return.
+         */
+        dmaru->hdr = (void *)(dmaru + 1);
+        memcpy(dmaru->hdr, header, header->length);
         dmaru->reg_base_addr = drhd->address;
         dmaru->segment = drhd->segment;
         dmaru->include_all = drhd->flags & 0x1; /* BIT0: INCLUDE_ALL */
@@ -381,6 +411,11 @@ dmar_parse_one_drhd(struct acpi_dmar_header *header)
                 return ret;
         }
         dmar_register_drhd_unit(dmaru);
+
+out:
+        if (arg)
+                (*(int *)arg)++;
+
         return 0;
 }
 
@@ -393,7 +428,8 @@ static void dmar_free_drhd(struct dmar_drhd_unit *dmaru)
         kfree(dmaru);
 }
 
-static int __init dmar_parse_one_andd(struct acpi_dmar_header *header)
+static int __init dmar_parse_one_andd(struct acpi_dmar_header *header,
+                                      void *arg)
 {
         struct acpi_dmar_andd *andd = (void *)header;
 
@@ -414,8 +450,7 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header)
 }
 
 #ifdef CONFIG_ACPI_NUMA
-static int __init
-dmar_parse_one_rhsa(struct acpi_dmar_header *header)
+static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg)
 {
         struct acpi_dmar_rhsa *rhsa;
         struct dmar_drhd_unit *drhd;
@@ -442,6 +477,8 @@ dmar_parse_one_rhsa(struct acpi_dmar_header *header)
 
         return 0;
 }
+#else
+#define dmar_parse_one_rhsa             dmar_res_noop
 #endif
 
 static void __init
@@ -503,6 +540,52 @@ static int __init dmar_table_detect(void)
         return (ACPI_SUCCESS(status) ? 1 : 0);
 }
 
+static int dmar_walk_remapping_entries(struct acpi_dmar_header *start,
+                                       size_t len, struct dmar_res_callback *cb)
+{
+        int ret = 0;
+        struct acpi_dmar_header *iter, *next;
+        struct acpi_dmar_header *end = ((void *)start) + len;
+
+        for (iter = start; iter < end && ret == 0; iter = next) {
+                next = (void *)iter + iter->length;
+                if (iter->length == 0) {
+                        /* Avoid looping forever on bad ACPI tables */
+                        pr_debug(FW_BUG "Invalid 0-length structure\n");
+                        break;
+                } else if (next > end) {
+                        /* Avoid passing table end */
+                        pr_warn(FW_BUG "record passes table end\n");
+                        ret = -EINVAL;
+                        break;
+                }
+
+                if (cb->print_entry)
+                        dmar_table_print_dmar_entry(iter);
+
+                if (iter->type >= ACPI_DMAR_TYPE_RESERVED) {
+                        /* continue for forward compatibility */
+                        pr_debug("Unknown DMAR structure type %d\n",
+                                 iter->type);
+                } else if (cb->cb[iter->type]) {
+                        ret = cb->cb[iter->type](iter, cb->arg[iter->type]);
+                } else if (!cb->ignore_unhandled) {
+                        pr_warn("No handler for DMAR structure type %d\n",
+                                iter->type);
+                        ret = -EINVAL;
+                }
+        }
+
+        return ret;
+}
+
+static inline int dmar_walk_dmar_table(struct acpi_table_dmar *dmar,
+                                       struct dmar_res_callback *cb)
+{
+        return dmar_walk_remapping_entries((void *)(dmar + 1),
+                        dmar->header.length - sizeof(*dmar), cb);
+}
+
 /**
  * parse_dmar_table - parses the DMA reporting table
  */
@@ -510,9 +593,18 @@ static int __init
 parse_dmar_table(void)
 {
         struct acpi_table_dmar *dmar;
-        struct acpi_dmar_header *entry_header;
         int ret = 0;
         int drhd_count = 0;
+        struct dmar_res_callback cb = {
+                .print_entry = true,
+                .ignore_unhandled = true,
+                .arg[ACPI_DMAR_TYPE_HARDWARE_UNIT] = &drhd_count,
+                .cb[ACPI_DMAR_TYPE_HARDWARE_UNIT] = &dmar_parse_one_drhd,
+                .cb[ACPI_DMAR_TYPE_RESERVED_MEMORY] = &dmar_parse_one_rmrr,
+                .cb[ACPI_DMAR_TYPE_ROOT_ATS] = &dmar_parse_one_atsr,
+                .cb[ACPI_DMAR_TYPE_HARDWARE_AFFINITY] = &dmar_parse_one_rhsa,
+                .cb[ACPI_DMAR_TYPE_NAMESPACE] = &dmar_parse_one_andd,
+        };
 
         /*
          * Do it again, earlier dmar_tbl mapping could be mapped with
@@ -536,51 +628,10 @@ parse_dmar_table(void)
         }
 
         pr_info("Host address width %d\n", dmar->width + 1);
-
-        entry_header = (struct acpi_dmar_header *)(dmar + 1);
-        while (((unsigned long)entry_header) <
-                        (((unsigned long)dmar) + dmar_tbl->length)) {
-                /* Avoid looping forever on bad ACPI tables */
-                if (entry_header->length == 0) {
-                        pr_warn("Invalid 0-length structure\n");
-                        ret = -EINVAL;
-                        break;
-                }
-
-                dmar_table_print_dmar_entry(entry_header);
-
-                switch (entry_header->type) {
-                case ACPI_DMAR_TYPE_HARDWARE_UNIT:
-                        drhd_count++;
-                        ret = dmar_parse_one_drhd(entry_header);
-                        break;
-                case ACPI_DMAR_TYPE_RESERVED_MEMORY:
-                        ret = dmar_parse_one_rmrr(entry_header);
-                        break;
-                case ACPI_DMAR_TYPE_ROOT_ATS:
-                        ret = dmar_parse_one_atsr(entry_header);
-                        break;
-                case ACPI_DMAR_TYPE_HARDWARE_AFFINITY:
-#ifdef CONFIG_ACPI_NUMA
-                        ret = dmar_parse_one_rhsa(entry_header);
-#endif
-                        break;
-                case ACPI_DMAR_TYPE_NAMESPACE:
-                        ret = dmar_parse_one_andd(entry_header);
-                        break;
-                default:
-                        pr_warn("Unknown DMAR structure type %d\n",
-                                entry_header->type);
-                        ret = 0; /* for forward compatibility */
-                        break;
-                }
-                if (ret)
-                        break;
-
-                entry_header = ((void *)entry_header + entry_header->length);
-        }
-        if (drhd_count == 0)
+        ret = dmar_walk_dmar_table(dmar, &cb);
+        if (ret == 0 && drhd_count == 0)
                 pr_warn(FW_BUG "No DRHD structure found in DMAR table\n");
+
         return ret;
 }
 
@@ -778,76 +829,68 @@ static void warn_invalid_dmar(u64 addr, const char *message)
                 dmi_get_system_info(DMI_PRODUCT_VERSION));
 }
 
-static int __init check_zero_address(void)
+static int __ref
+dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg)
 {
-        struct acpi_table_dmar *dmar;
-        struct acpi_dmar_header *entry_header;
         struct acpi_dmar_hardware_unit *drhd;
+        void __iomem *addr;
+        u64 cap, ecap;
 
-        dmar = (struct acpi_table_dmar *)dmar_tbl;
-        entry_header = (struct acpi_dmar_header *)(dmar + 1);
-
-        while (((unsigned long)entry_header) <
-                        (((unsigned long)dmar) + dmar_tbl->length)) {
-                /* Avoid looping forever on bad ACPI tables */
-                if (entry_header->length == 0) {
-                        pr_warn("Invalid 0-length structure\n");
-                        return 0;
-                }
+        drhd = (void *)entry;
+        if (!drhd->address) {
+                warn_invalid_dmar(0, "");
+                return -EINVAL;
+        }
 
-                if (entry_header->type == ACPI_DMAR_TYPE_HARDWARE_UNIT) {
-                        void __iomem *addr;
-                        u64 cap, ecap;
+        if (arg)
+                addr = ioremap(drhd->address, VTD_PAGE_SIZE);
+        else
+                addr = early_ioremap(drhd->address, VTD_PAGE_SIZE);
+        if (!addr) {
+                pr_warn("IOMMU: can't validate: %llx\n", drhd->address);
+                return -EINVAL;
+        }
 
-                        drhd = (void *)entry_header;
-                        if (!drhd->address) {
-                                warn_invalid_dmar(0, "");
-                                goto failed;
-                        }
+        cap = dmar_readq(addr + DMAR_CAP_REG);
+        ecap = dmar_readq(addr + DMAR_ECAP_REG);
 
-                        addr = early_ioremap(drhd->address, VTD_PAGE_SIZE);
-                        if (!addr ) {
-                                printk("IOMMU: can't validate: %llx\n", drhd->address);
-                                goto failed;
-                        }
-                        cap = dmar_readq(addr + DMAR_CAP_REG);
-                        ecap = dmar_readq(addr + DMAR_ECAP_REG);
-                        early_iounmap(addr, VTD_PAGE_SIZE);
-                        if (cap == (uint64_t)-1 && ecap == (uint64_t)-1) {
-                                warn_invalid_dmar(drhd->address,
-                                                  " returns all ones");
-                                goto failed;
-                        }
-                }
+        if (arg)
+                iounmap(addr);
+        else
+                early_iounmap(addr, VTD_PAGE_SIZE);
 
-                entry_header = ((void *)entry_header + entry_header->length);
+        if (cap == (uint64_t)-1 && ecap == (uint64_t)-1) {
+                warn_invalid_dmar(drhd->address, " returns all ones");
+                return -EINVAL;
         }
-        return 1;
 
-failed:
         return 0;
 }
 
 int __init detect_intel_iommu(void)
 {
         int ret;
+        struct dmar_res_callback validate_drhd_cb = {
+                .cb[ACPI_DMAR_TYPE_HARDWARE_UNIT] = &dmar_validate_one_drhd,
+                .ignore_unhandled = true,
+        };
 
         down_write(&dmar_global_lock);
         ret = dmar_table_detect();
         if (ret)
-                ret = check_zero_address();
-        {
-                if (ret && !no_iommu && !iommu_detected && !dmar_disabled) {
-                        iommu_detected = 1;
-                        /* Make sure ACS will be enabled */
-                        pci_request_acs();
-                }
+                ret = !dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl,
+                                            &validate_drhd_cb);
+        if (ret && !no_iommu && !iommu_detected && !dmar_disabled) {
+                iommu_detected = 1;
+                /* Make sure ACS will be enabled */
+                pci_request_acs();
+        }
 
 #ifdef CONFIG_X86
-                if (ret)
-                        x86_init.iommu.iommu_init = intel_iommu_init;
+        if (ret)
+                x86_init.iommu.iommu_init = intel_iommu_init;
 #endif
-        }
+
         early_acpi_os_unmap_memory((void __iomem *)dmar_tbl, dmar_tbl_size);
         dmar_tbl = NULL;
         up_write(&dmar_global_lock);
@@ -931,11 +974,32 @@ out:
         return err;
 }
 
+static int dmar_alloc_seq_id(struct intel_iommu *iommu)
+{
+        iommu->seq_id = find_first_zero_bit(dmar_seq_ids,
+                                            DMAR_UNITS_SUPPORTED);
+        if (iommu->seq_id >= DMAR_UNITS_SUPPORTED) {
+                iommu->seq_id = -1;
+        } else {
+                set_bit(iommu->seq_id, dmar_seq_ids);
+                sprintf(iommu->name, "dmar%d", iommu->seq_id);
+        }
+
+        return iommu->seq_id;
+}
+
+static void dmar_free_seq_id(struct intel_iommu *iommu)
+{
+        if (iommu->seq_id >= 0) {
+                clear_bit(iommu->seq_id, dmar_seq_ids);
+                iommu->seq_id = -1;
+        }
+}
+
 static int alloc_iommu(struct dmar_drhd_unit *drhd)
 {
         struct intel_iommu *iommu;
         u32 ver, sts;
-        static int iommu_allocated = 0;
         int agaw = 0;
         int msagaw = 0;
         int err;
@@ -949,13 +1013,16 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
         if (!iommu)
                 return -ENOMEM;
 
-        iommu->seq_id = iommu_allocated++;
-        sprintf (iommu->name, "dmar%d", iommu->seq_id);
+        if (dmar_alloc_seq_id(iommu) < 0) {
+                pr_err("IOMMU: failed to allocate seq_id\n");
+                err = -ENOSPC;
+                goto error;
+        }
 
         err = map_iommu(iommu, drhd->reg_base_addr);
         if (err) {
                 pr_err("IOMMU: failed to map %s\n", iommu->name);
-                goto error;
+                goto error_free_seq_id;
         }
 
         err = -EINVAL;
@@ -1005,9 +1072,11 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 
         return 0;
 
- err_unmap:
+err_unmap:
         unmap_iommu(iommu);
- error:
+error_free_seq_id:
+        dmar_free_seq_id(iommu);
+error:
         kfree(iommu);
         return err;
 }
@@ -1031,6 +1100,7 @@ static void free_iommu(struct intel_iommu *iommu)
         if (iommu->reg)
                 unmap_iommu(iommu);
 
+        dmar_free_seq_id(iommu);
         kfree(iommu);
 }
 
@@ -1661,12 +1731,17 @@ int __init dmar_ir_support(void)
         return dmar->flags & 0x1;
 }
 
+/* Check whether DMAR units are in use */
+static inline bool dmar_in_use(void)
+{
+        return irq_remapping_enabled || intel_iommu_enabled;
+}
+
 static int __init dmar_free_unused_resources(void)
 {
         struct dmar_drhd_unit *dmaru, *dmaru_n;
 
-        /* DMAR units are in use */
-        if (irq_remapping_enabled || intel_iommu_enabled)
+        if (dmar_in_use())
                 return 0;
 
         if (dmar_dev_scope_status != 1 && !list_empty(&dmar_drhd_units))
@@ -1684,3 +1759,242 @@ static int __init dmar_free_unused_resources(void)
 
 late_initcall(dmar_free_unused_resources);
 IOMMU_INIT_POST(detect_intel_iommu);
+
+/*
+ * DMAR Hotplug Support
+ * For more details, please refer to Intel(R) Virtualization Technology
+ * for Directed-IO Architecture Specifiction, Rev 2.2, Section 8.8
+ * "Remapping Hardware Unit Hot Plug".
+ */
+static u8 dmar_hp_uuid[] = {
+        /* 0000 */    0xA6, 0xA3, 0xC1, 0xD8, 0x9B, 0xBE, 0x9B, 0x4C,
+        /* 0008 */    0x91, 0xBF, 0xC3, 0xCB, 0x81, 0xFC, 0x5D, 0xAF
+};
+
+/*
+ * Currently there's only one revision and BIOS will not check the revision id,
+ * so use 0 for safety.
+ */
+#define DMAR_DSM_REV_ID                 0
+#define DMAR_DSM_FUNC_DRHD              1
+#define DMAR_DSM_FUNC_ATSR              2
+#define DMAR_DSM_FUNC_RHSA              3
+
+static inline bool dmar_detect_dsm(acpi_handle handle, int func)
+{
+        return acpi_check_dsm(handle, dmar_hp_uuid, DMAR_DSM_REV_ID, 1 << func);
+}
+
+static int dmar_walk_dsm_resource(acpi_handle handle, int func,
+                                  dmar_res_handler_t handler, void *arg)
+{
+        int ret = -ENODEV;
+        union acpi_object *obj;
+        struct acpi_dmar_header *start;
+        struct dmar_res_callback callback;
+        static int res_type[] = {
+                [DMAR_DSM_FUNC_DRHD] = ACPI_DMAR_TYPE_HARDWARE_UNIT,
+                [DMAR_DSM_FUNC_ATSR] = ACPI_DMAR_TYPE_ROOT_ATS,
+                [DMAR_DSM_FUNC_RHSA] = ACPI_DMAR_TYPE_HARDWARE_AFFINITY,
+        };
+
+        if (!dmar_detect_dsm(handle, func))
+                return 0;
+
+        obj = acpi_evaluate_dsm_typed(handle, dmar_hp_uuid, DMAR_DSM_REV_ID,
+                                      func, NULL, ACPI_TYPE_BUFFER);
+        if (!obj)
+                return -ENODEV;
+
+        memset(&callback, 0, sizeof(callback));
+        callback.cb[res_type[func]] = handler;
+        callback.arg[res_type[func]] = arg;
+        start = (struct acpi_dmar_header *)obj->buffer.pointer;
+        ret = dmar_walk_remapping_entries(start, obj->buffer.length, &callback);
+
+        ACPI_FREE(obj);
+
+        return ret;
+}
+
+static int dmar_hp_add_drhd(struct acpi_dmar_header *header, void *arg)
+{
+        int ret;
+        struct dmar_drhd_unit *dmaru;
+
+        dmaru = dmar_find_dmaru((struct acpi_dmar_hardware_unit *)header);
+        if (!dmaru)
+                return -ENODEV;
+
+        ret = dmar_ir_hotplug(dmaru, true);
+        if (ret == 0)
+                ret = dmar_iommu_hotplug(dmaru, true);
+
+        return ret;
+}
+
+static int dmar_hp_remove_drhd(struct acpi_dmar_header *header, void *arg)
+{
+        int i, ret;
+        struct device *dev;
+        struct dmar_drhd_unit *dmaru;
+
+        dmaru = dmar_find_dmaru((struct acpi_dmar_hardware_unit *)header);
+        if (!dmaru)
+                return 0;
+
+        /*
+         * All PCI devices managed by this unit should have been destroyed.
+         */
+        if (!dmaru->include_all && dmaru->devices && dmaru->devices_cnt)
+                for_each_active_dev_scope(dmaru->devices,
+                                          dmaru->devices_cnt, i, dev)
+                        return -EBUSY;
+
+        ret = dmar_ir_hotplug(dmaru, false);
+        if (ret == 0)
+                ret = dmar_iommu_hotplug(dmaru, false);
+
+        return ret;
+}
+
+static int dmar_hp_release_drhd(struct acpi_dmar_header *header, void *arg)
+{
+        struct dmar_drhd_unit *dmaru;
+
+        dmaru = dmar_find_dmaru((struct acpi_dmar_hardware_unit *)header);
+        if (dmaru) {
+                list_del_rcu(&dmaru->list);
+                synchronize_rcu();
+                dmar_free_drhd(dmaru);
+        }
+
+        return 0;
+}
+
+static int dmar_hotplug_insert(acpi_handle handle)
+{
+        int ret;
+        int drhd_count = 0;
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                                     &dmar_validate_one_drhd, (void *)1);
+        if (ret)
+                goto out;
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                                     &dmar_parse_one_drhd, (void *)&drhd_count);
+        if (ret == 0 && drhd_count == 0) {
+                pr_warn(FW_BUG "No DRHD structures in buffer returned by _DSM method\n");
+                goto out;
+        } else if (ret) {
+                goto release_drhd;
+        }
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_RHSA,
+                                     &dmar_parse_one_rhsa, NULL);
+        if (ret)
+                goto release_drhd;
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_ATSR,
+                                     &dmar_parse_one_atsr, NULL);
+        if (ret)
+                goto release_atsr;
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                                     &dmar_hp_add_drhd, NULL);
+        if (!ret)
+                return 0;
+
+        dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                               &dmar_hp_remove_drhd, NULL);
+release_atsr:
+        dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_ATSR,
+                               &dmar_release_one_atsr, NULL);
+release_drhd:
+        dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                               &dmar_hp_release_drhd, NULL);
+out:
+        return ret;
+}
+
+static int dmar_hotplug_remove(acpi_handle handle)
+{
+        int ret;
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_ATSR,
+                                     &dmar_check_one_atsr, NULL);
+        if (ret)
+                return ret;
+
+        ret = dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                                     &dmar_hp_remove_drhd, NULL);
+        if (ret == 0) {
+                WARN_ON(dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_ATSR,
+                                               &dmar_release_one_atsr, NULL));
+                WARN_ON(dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                                               &dmar_hp_release_drhd, NULL));
+        } else {
+                dmar_walk_dsm_resource(handle, DMAR_DSM_FUNC_DRHD,
+                                       &dmar_hp_add_drhd, NULL);
+        }
+
+        return ret;
+}
+
+static acpi_status dmar_get_dsm_handle(acpi_handle handle, u32 lvl,
+                                       void *context, void **retval)
+{
+        acpi_handle *phdl = retval;
+
+        if (dmar_detect_dsm(handle, DMAR_DSM_FUNC_DRHD)) {
+                *phdl = handle;
+                return AE_CTRL_TERMINATE;
+        }
+
+        return AE_OK;
+}
+
+static int dmar_device_hotplug(acpi_handle handle, bool insert)
+{
+        int ret;
+        acpi_handle tmp = NULL;
+        acpi_status status;
+
+        if (!dmar_in_use())
+                return 0;
+
+        if (dmar_detect_dsm(handle, DMAR_DSM_FUNC_DRHD)) {
+                tmp = handle;
+        } else {
+                status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle,
+                                             ACPI_UINT32_MAX,
+                                             dmar_get_dsm_handle,
+                                             NULL, NULL, &tmp);
+                if (ACPI_FAILURE(status)) {
+                        pr_warn("Failed to locate _DSM method.\n");
+                        return -ENXIO;
+                }
+        }
+        if (tmp == NULL)
+                return 0;
+
+        down_write(&dmar_global_lock);
+        if (insert)
+                ret = dmar_hotplug_insert(tmp);
+        else
+                ret = dmar_hotplug_remove(tmp);
+        up_write(&dmar_global_lock);
+
+        return ret;
+}
+
+int dmar_device_add(acpi_handle handle)
+{
+        return dmar_device_hotplug(handle, true);
+}
+
+int dmar_device_remove(acpi_handle handle)
+{
+        return dmar_device_hotplug(handle, false);
+}
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 02cd26a17fe0..1232336b960e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -195,6 +195,7 @@ static inline void set_root_present(struct root_entry *root)
 }
 static inline void set_root_value(struct root_entry *root, unsigned long value)
 {
+        root->val &= ~VTD_PAGE_MASK;
         root->val |= value & VTD_PAGE_MASK;
 }
 
@@ -247,6 +248,7 @@ static inline void context_set_translation_type(struct context_entry *context,
 static inline void context_set_address_root(struct context_entry *context,
                                             unsigned long value)
 {
+        context->lo &= ~VTD_PAGE_MASK;
         context->lo |= value & VTD_PAGE_MASK;
 }
 
@@ -328,17 +330,10 @@ static int hw_pass_through = 1;
 /* si_domain contains mulitple devices */
 #define DOMAIN_FLAG_STATIC_IDENTITY     (1 << 1)
 
-/* define the limit of IOMMUs supported in each domain */
-#ifdef  CONFIG_X86
-# define        IOMMU_UNITS_SUPPORTED   MAX_IO_APICS
-#else
-# define        IOMMU_UNITS_SUPPORTED   64
-#endif
-
 struct dmar_domain {
         int     id;                     /* domain id */
         int     nid;                    /* node id */
-        DECLARE_BITMAP(iommu_bmp, IOMMU_UNITS_SUPPORTED);
+        DECLARE_BITMAP(iommu_bmp, DMAR_UNITS_SUPPORTED);
                                         /* bitmap of iommus this domain uses*/
 
         struct list_head devices;       /* all devices' list */
@@ -1132,8 +1127,11 @@ static int iommu_alloc_root_entry(struct intel_iommu *iommu)
         unsigned long flags;
 
         root = (struct root_entry *)alloc_pgtable_page(iommu->node);
-        if (!root)
+        if (!root) {
+                pr_err("IOMMU: allocating root entry for %s failed\n",
+                        iommu->name);
                 return -ENOMEM;
+        }
 
         __iommu_flush_cache(iommu, root, ROOT_SIZE);
 
@@ -1473,7 +1471,7 @@ static int iommu_init_domains(struct intel_iommu *iommu)
         return 0;
 }
 
-static void free_dmar_iommu(struct intel_iommu *iommu)
+static void disable_dmar_iommu(struct intel_iommu *iommu)
 {
         struct dmar_domain *domain;
         int i;
@@ -1497,11 +1495,16 @@ static void free_dmar_iommu(struct intel_iommu *iommu)
 
         if (iommu->gcmd & DMA_GCMD_TE)
                 iommu_disable_translation(iommu);
+}
 
-        kfree(iommu->domains);
-        kfree(iommu->domain_ids);
-        iommu->domains = NULL;
-        iommu->domain_ids = NULL;
+static void free_dmar_iommu(struct intel_iommu *iommu)
+{
+        if ((iommu->domains) && (iommu->domain_ids)) {
+                kfree(iommu->domains);
+                kfree(iommu->domain_ids);
+                iommu->domains = NULL;
+                iommu->domain_ids = NULL;
+        }
 
         g_iommus[iommu->seq_id] = NULL;
 
@@ -1983,7 +1986,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
 {
         struct dma_pte *first_pte = NULL, *pte = NULL;
         phys_addr_t uninitialized_var(pteval);
-        unsigned long sg_res;
+        unsigned long sg_res = 0;
         unsigned int largepage_lvl = 0;
         unsigned long lvl_pages = 0;
 
@@ -1994,10 +1997,8 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
 
         prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP;
 
-        if (sg)
-                sg_res = 0;
-        else {
-                sg_res = nr_pages + 1;
+        if (!sg) {
+                sg_res = nr_pages;
                 pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
         }
 
@@ -2708,6 +2709,41 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
         return 0;
 }
 
+static void intel_iommu_init_qi(struct intel_iommu *iommu)
+{
+        /*
+         * Start from the sane iommu hardware state.
+         * If the queued invalidation is already initialized by us
+         * (for example, while enabling interrupt-remapping) then
+         * we got the things already rolling from a sane state.
+         */
+        if (!iommu->qi) {
+                /*
+                 * Clear any previous faults.
+                 */
+                dmar_fault(-1, iommu);
+                /*
+                 * Disable queued invalidation if supported and already enabled
+                 * before OS handover.
+                 */
+                dmar_disable_qi(iommu);
+        }
+
+        if (dmar_enable_qi(iommu)) {
+                /*
+                 * Queued Invalidate not enabled, use Register Based Invalidate
+                 */
+                iommu->flush.flush_context = __iommu_flush_context;
+                iommu->flush.flush_iotlb = __iommu_flush_iotlb;
+                pr_info("IOMMU: %s using Register based invalidation\n",
+                        iommu->name);
+        } else {
+                iommu->flush.flush_context = qi_flush_context;
+                iommu->flush.flush_iotlb = qi_flush_iotlb;
+                pr_info("IOMMU: %s using Queued invalidation\n", iommu->name);
+        }
+}
+
 static int __init init_dmars(void)
 {
         struct dmar_drhd_unit *drhd;
@@ -2728,14 +2764,18 @@ static int __init init_dmars(void)
                  * threaded kernel __init code path all other access are read
                  * only
                  */
-                if (g_num_of_iommus < IOMMU_UNITS_SUPPORTED) {
+                if (g_num_of_iommus < DMAR_UNITS_SUPPORTED) {
                         g_num_of_iommus++;
                         continue;
                 }
                 printk_once(KERN_ERR "intel-iommu: exceeded %d IOMMUs\n",
-                          IOMMU_UNITS_SUPPORTED);
+                          DMAR_UNITS_SUPPORTED);
         }
 
+        /* Preallocate enough resources for IOMMU hot-addition */
+        if (g_num_of_iommus < DMAR_UNITS_SUPPORTED)
+                g_num_of_iommus = DMAR_UNITS_SUPPORTED;
+
         g_iommus = kcalloc(g_num_of_iommus, sizeof(struct intel_iommu *),
                         GFP_KERNEL);
         if (!g_iommus) {
@@ -2764,58 +2804,14 @@ static int __init init_dmars(void)
                  * among all IOMMU's. Need to Split it later.
                  */
                 ret = iommu_alloc_root_entry(iommu);
-                if (ret) {
-                        printk(KERN_ERR "IOMMU: allocate root entry failed\n");
+                if (ret)
                         goto free_iommu;
-                }
                 if (!ecap_pass_through(iommu->ecap))
                         hw_pass_through = 0;
         }
 
-        /*
-         * Start from the sane iommu hardware state.
-         */
-        for_each_active_iommu(iommu, drhd) {
-                /*
-                 * If the queued invalidation is already initialized by us
-                 * (for example, while enabling interrupt-remapping) then
-                 * we got the things already rolling from a sane state.
-                 */
-                if (iommu->qi)
-                        continue;
-
-                /*
-                 * Clear any previous faults.
-                 */
-                dmar_fault(-1, iommu);
-                /*
-                 * Disable queued invalidation if supported and already enabled
-                 * before OS handover.
-                 */
-                dmar_disable_qi(iommu);
-        }
-
-        for_each_active_iommu(iommu, drhd) {
-                if (dmar_enable_qi(iommu)) {
-                        /*
-                         * Queued Invalidate not enabled, use Register Based
-                         * Invalidate
-                         */
-                        iommu->flush.flush_context = __iommu_flush_context;
-                        iommu->flush.flush_iotlb = __iommu_flush_iotlb;
-                        printk(KERN_INFO "IOMMU %d 0x%Lx: using Register based "
-                               "invalidation\n",
-                                iommu->seq_id,
-                               (unsigned long long)drhd->reg_base_addr);
-                } else {
-                        iommu->flush.flush_context = qi_flush_context;
-                        iommu->flush.flush_iotlb = qi_flush_iotlb;
-                        printk(KERN_INFO "IOMMU %d 0x%Lx: using Queued "
-                               "invalidation\n",
-                                iommu->seq_id,
-                               (unsigned long long)drhd->reg_base_addr);
-                }
-        }
+        for_each_active_iommu(iommu, drhd)
+                intel_iommu_init_qi(iommu);
 
         if (iommu_pass_through)
                 iommu_identity_mapping |= IDENTMAP_ALL;
@@ -2901,8 +2897,10 @@ static int __init init_dmars(void)
         return 0;
 
 free_iommu:
-        for_each_active_iommu(iommu, drhd)
+        for_each_active_iommu(iommu, drhd) {
+                disable_dmar_iommu(iommu);
                 free_dmar_iommu(iommu);
+        }
         kfree(deferred_flush);
 free_g_iommus:
         kfree(g_iommus);
@@ -3682,7 +3680,7 @@ static inline void init_iommu_pm_ops(void) {}
 #endif  /* CONFIG_PM */
 
 
-int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header)
+int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
 {
         struct acpi_dmar_reserved_memory *rmrr;
         struct dmar_rmrr_unit *rmrru;
@@ -3708,17 +3706,48 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header)
         return 0;
 }
 
-int __init dmar_parse_one_atsr(struct acpi_dmar_header *hdr)
+static struct dmar_atsr_unit *dmar_find_atsr(struct acpi_dmar_atsr *atsr)
+{
+        struct dmar_atsr_unit *atsru;
+        struct acpi_dmar_atsr *tmp;
+
+        list_for_each_entry_rcu(atsru, &dmar_atsr_units, list) {
+                tmp = (struct acpi_dmar_atsr *)atsru->hdr;
+                if (atsr->segment != tmp->segment)
+                        continue;
+                if (atsr->header.length != tmp->header.length)
+                        continue;
+                if (memcmp(atsr, tmp, atsr->header.length) == 0)
+                        return atsru;
+        }
+
+        return NULL;
+}
+
+int dmar_parse_one_atsr(struct acpi_dmar_header *hdr, void *arg)
 {
         struct acpi_dmar_atsr *atsr;
         struct dmar_atsr_unit *atsru;
 
+        if (system_state != SYSTEM_BOOTING && !intel_iommu_enabled)
+                return 0;
+
         atsr = container_of(hdr, struct acpi_dmar_atsr, header);
-        atsru = kzalloc(sizeof(*atsru), GFP_KERNEL);
+        atsru = dmar_find_atsr(atsr);
+        if (atsru)
+                return 0;
+
+        atsru = kzalloc(sizeof(*atsru) + hdr->length, GFP_KERNEL);
         if (!atsru)
                 return -ENOMEM;
 
-        atsru->hdr = hdr;
+        /*
+         * If memory is allocated from slab by ACPI _DSM method, we need to
+         * copy the memory content because the memory buffer will be freed
+         * on return.
+         */
+        atsru->hdr = (void *)(atsru + 1);
+        memcpy(atsru->hdr, hdr, hdr->length);
         atsru->include_all = atsr->flags & 0x1;
         if (!atsru->include_all) {
                 atsru->devices = dmar_alloc_dev_scope((void *)(atsr + 1),
@@ -3741,6 +3770,138 @@ static void intel_iommu_free_atsr(struct dmar_atsr_unit *atsru)
         kfree(atsru);
 }
 
+int dmar_release_one_atsr(struct acpi_dmar_header *hdr, void *arg)
+{
+        struct acpi_dmar_atsr *atsr;
+        struct dmar_atsr_unit *atsru;
+
+        atsr = container_of(hdr, struct acpi_dmar_atsr, header);
+        atsru = dmar_find_atsr(atsr);
+        if (atsru) {
+                list_del_rcu(&atsru->list);
+                synchronize_rcu();
+                intel_iommu_free_atsr(atsru);
+        }
+
+        return 0;
+}
+
+int dmar_check_one_atsr(struct acpi_dmar_header *hdr, void *arg)
+{
+        int i;
+        struct device *dev;
+        struct acpi_dmar_atsr *atsr;
+        struct dmar_atsr_unit *atsru;
+
+        atsr = container_of(hdr, struct acpi_dmar_atsr, header);
+        atsru = dmar_find_atsr(atsr);
+        if (!atsru)
+                return 0;
+
+        if (!atsru->include_all && atsru->devices && atsru->devices_cnt)
+                for_each_active_dev_scope(atsru->devices, atsru->devices_cnt,
+                                          i, dev)
+                        return -EBUSY;
+
+        return 0;
+}
+
+static int intel_iommu_add(struct dmar_drhd_unit *dmaru)
+{
+        int sp, ret = 0;
+        struct intel_iommu *iommu = dmaru->iommu;
+
+        if (g_iommus[iommu->seq_id])
+                return 0;
+
+        if (hw_pass_through && !ecap_pass_through(iommu->ecap)) {
+                pr_warn("IOMMU: %s doesn't support hardware pass through.\n",
+                        iommu->name);
+                return -ENXIO;
+        }
+        if (!ecap_sc_support(iommu->ecap) &&
+            domain_update_iommu_snooping(iommu)) {
+                pr_warn("IOMMU: %s doesn't support snooping.\n",
+                        iommu->name);
+                return -ENXIO;
+        }
+        sp = domain_update_iommu_superpage(iommu) - 1;
+        if (sp >= 0 && !(cap_super_page_val(iommu->cap) & (1 << sp))) {
+                pr_warn("IOMMU: %s doesn't support large page.\n",
+                        iommu->name);
+                return -ENXIO;
+        }
+
+        /*
+         * Disable translation if already enabled prior to OS handover.
+         */
+        if (iommu->gcmd & DMA_GCMD_TE)
+                iommu_disable_translation(iommu);
+
+        g_iommus[iommu->seq_id] = iommu;
+        ret = iommu_init_domains(iommu);
+        if (ret == 0)
+                ret = iommu_alloc_root_entry(iommu);
+        if (ret)
+                goto out;
+
+        if (dmaru->ignored) {
+                /*
+                 * we always have to disable PMRs or DMA may fail on this device
+                 */
+                if (force_on)
+                        iommu_disable_protect_mem_regions(iommu);
+                return 0;
+        }
+
+        intel_iommu_init_qi(iommu);
+        iommu_flush_write_buffer(iommu);
+        ret = dmar_set_interrupt(iommu);
+        if (ret)
+                goto disable_iommu;
+
+        iommu_set_root_entry(iommu);
+        iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
+        iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+        iommu_enable_translation(iommu);
+
+        if (si_domain) {
+                ret = iommu_attach_domain(si_domain, iommu);
+                if (ret < 0 || si_domain->id != ret)
+                        goto disable_iommu;
+                domain_attach_iommu(si_domain, iommu);
+        }
+
+        iommu_disable_protect_mem_regions(iommu);
+        return 0;
+
+disable_iommu:
+        disable_dmar_iommu(iommu);
+out:
+        free_dmar_iommu(iommu);
+        return ret;
+}
+
+int dmar_iommu_hotplug(struct dmar_drhd_unit *dmaru, bool insert)
+{
+        int ret = 0;
+        struct intel_iommu *iommu = dmaru->iommu;
+
+        if (!intel_iommu_enabled)
+                return 0;
+        if (iommu == NULL)
+                return -EINVAL;
+
+        if (insert) {
+                ret = intel_iommu_add(dmaru);
+        } else {
+                disable_dmar_iommu(iommu);
+                free_dmar_iommu(iommu);
+        }
+
+        return ret;
+}
+
 static void intel_iommu_free_dmars(void)
 {
         struct dmar_rmrr_unit *rmrru, *rmrr_n;
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 7c80661b35c1..27541d440849 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -36,7 +36,6 @@ struct hpet_scope {
 
 static struct ioapic_scope ir_ioapic[MAX_IO_APICS];
 static struct hpet_scope ir_hpet[MAX_HPET_TBS];
-static int ir_ioapic_num, ir_hpet_num;
 
 /*
  * Lock ordering:
@@ -206,7 +205,7 @@ static struct intel_iommu *map_hpet_to_ir(u8 hpet_id)
         int i;
 
         for (i = 0; i < MAX_HPET_TBS; i++)
-                if (ir_hpet[i].id == hpet_id)
+                if (ir_hpet[i].id == hpet_id && ir_hpet[i].iommu)
                         return ir_hpet[i].iommu;
         return NULL;
 }
@@ -216,7 +215,7 @@ static struct intel_iommu *map_ioapic_to_ir(int apic)
         int i;
 
         for (i = 0; i < MAX_IO_APICS; i++)
-                if (ir_ioapic[i].id == apic)
+                if (ir_ioapic[i].id == apic && ir_ioapic[i].iommu)
                         return ir_ioapic[i].iommu;
         return NULL;
 }
@@ -325,7 +324,7 @@ static int set_ioapic_sid(struct irte *irte, int apic)
 
         down_read(&dmar_global_lock);
         for (i = 0; i < MAX_IO_APICS; i++) {
-                if (ir_ioapic[i].id == apic) {
+                if (ir_ioapic[i].iommu && ir_ioapic[i].id == apic) {
                         sid = (ir_ioapic[i].bus << 8) | ir_ioapic[i].devfn;
                         break;
                 }
@@ -352,7 +351,7 @@ static int set_hpet_sid(struct irte *irte, u8 id)
 
         down_read(&dmar_global_lock);
         for (i = 0; i < MAX_HPET_TBS; i++) {
-                if (ir_hpet[i].id == id) {
+                if (ir_hpet[i].iommu && ir_hpet[i].id == id) {
                         sid = (ir_hpet[i].bus << 8) | ir_hpet[i].devfn;
                         break;
                 }
@@ -473,17 +472,17 @@ static void iommu_set_irq_remapping(struct intel_iommu *iommu, int mode)
         raw_spin_unlock_irqrestore(&iommu->register_lock, flags);
 }
 
-
-static int intel_setup_irq_remapping(struct intel_iommu *iommu, int mode)
+static int intel_setup_irq_remapping(struct intel_iommu *iommu)
 {
         struct ir_table *ir_table;
         struct page *pages;
         unsigned long *bitmap;
 
-        ir_table = iommu->ir_table = kzalloc(sizeof(struct ir_table),
-                                             GFP_ATOMIC);
+        if (iommu->ir_table)
+                return 0;
 
-        if (!iommu->ir_table)
+        ir_table = kzalloc(sizeof(struct ir_table), GFP_ATOMIC);
+        if (!ir_table)
                 return -ENOMEM;
 
         pages = alloc_pages_node(iommu->node, GFP_ATOMIC | __GFP_ZERO,
@@ -492,24 +491,37 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu, int mode)
         if (!pages) {
                 pr_err("IR%d: failed to allocate pages of order %d\n",
                        iommu->seq_id, INTR_REMAP_PAGE_ORDER);
-                kfree(iommu->ir_table);
-                return -ENOMEM;
+                goto out_free_table;
         }
 
         bitmap = kcalloc(BITS_TO_LONGS(INTR_REMAP_TABLE_ENTRIES),
                          sizeof(long), GFP_ATOMIC);
         if (bitmap == NULL) {
                 pr_err("IR%d: failed to allocate bitmap\n", iommu->seq_id);
-                __free_pages(pages, INTR_REMAP_PAGE_ORDER);
-                kfree(ir_table);
-                return -ENOMEM;
+                goto out_free_pages;
         }
 
         ir_table->base = page_address(pages);
         ir_table->bitmap = bitmap;
-
-        iommu_set_irq_remapping(iommu, mode);
+        iommu->ir_table = ir_table;
         return 0;
+
+out_free_pages:
+        __free_pages(pages, INTR_REMAP_PAGE_ORDER);
+out_free_table:
+        kfree(ir_table);
+        return -ENOMEM;
+}
+
+static void intel_teardown_irq_remapping(struct intel_iommu *iommu)
+{
+        if (iommu && iommu->ir_table) {
+                free_pages((unsigned long)iommu->ir_table->base,
+                           INTR_REMAP_PAGE_ORDER);
+                kfree(iommu->ir_table->bitmap);
+                kfree(iommu->ir_table);
+                iommu->ir_table = NULL;
+        }
 }
 
 /*
@@ -666,9 +678,10 @@ static int __init intel_enable_irq_remapping(void)
                 if (!ecap_ir_support(iommu->ecap))
                         continue;
 
-                if (intel_setup_irq_remapping(iommu, eim))
+                if (intel_setup_irq_remapping(iommu))
                         goto error;
 
+                iommu_set_irq_remapping(iommu, eim);
                 setup = 1;
         }
 
@@ -689,9 +702,11 @@ static int __init intel_enable_irq_remapping(void)
         return eim ? IRQ_REMAP_X2APIC_MODE : IRQ_REMAP_XAPIC_MODE;
 
 error:
-        /*
-         * handle error condition gracefully here!
-         */
+        for_each_iommu(iommu, drhd)
+                if (ecap_ir_support(iommu->ecap)) {
+                        iommu_disable_irq_remapping(iommu);
+                        intel_teardown_irq_remapping(iommu);
+                }
 
         if (x2apic_present)
                 pr_warn("Failed to enable irq remapping.  You are vulnerable to irq-injection attacks.\n");
@@ -699,12 +714,13 @@ error:
         return -1;
 }
 
-static void ir_parse_one_hpet_scope(struct acpi_dmar_device_scope *scope,
-                                      struct intel_iommu *iommu)
+static int ir_parse_one_hpet_scope(struct acpi_dmar_device_scope *scope,
+                                   struct intel_iommu *iommu,
+                                   struct acpi_dmar_hardware_unit *drhd)
 {
         struct acpi_dmar_pci_path *path;
         u8 bus;
-        int count;
+        int count, free = -1;
 
         bus = scope->bus;
         path = (struct acpi_dmar_pci_path *)(scope + 1);
@@ -720,19 +736,36 @@ static void ir_parse_one_hpet_scope(struct acpi_dmar_device_scope *scope,
                                            PCI_SECONDARY_BUS);
                 path++;
         }
-        ir_hpet[ir_hpet_num].bus   = bus;
-        ir_hpet[ir_hpet_num].devfn = PCI_DEVFN(path->device, path->function);
-        ir_hpet[ir_hpet_num].iommu = iommu;
-        ir_hpet[ir_hpet_num].id    = scope->enumeration_id;
-        ir_hpet_num++;
+
+        for (count = 0; count < MAX_HPET_TBS; count++) {
+                if (ir_hpet[count].iommu == iommu &&
+                    ir_hpet[count].id == scope->enumeration_id)
+                        return 0;
+                else if (ir_hpet[count].iommu == NULL && free == -1)
+                        free = count;
+        }
+        if (free == -1) {
+                pr_warn("Exceeded Max HPET blocks\n");
+                return -ENOSPC;
+        }
+
+        ir_hpet[free].iommu = iommu;
+        ir_hpet[free].id    = scope->enumeration_id;
+        ir_hpet[free].bus   = bus;
+        ir_hpet[free].devfn = PCI_DEVFN(path->device, path->function);
+        pr_info("HPET id %d under DRHD base 0x%Lx\n",
+                scope->enumeration_id, drhd->address);
+
+        return 0;
 }
 
-static void ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
-                                      struct intel_iommu *iommu)
+static int ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
+                                     struct intel_iommu *iommu,
+                                     struct acpi_dmar_hardware_unit *drhd)
 {
         struct acpi_dmar_pci_path *path;
         u8 bus;
-        int count;
+        int count, free = -1;
 
         bus = scope->bus;
         path = (struct acpi_dmar_pci_path *)(scope + 1);
@@ -749,54 +782,63 @@ static void ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
                 path++;
         }
 
-        ir_ioapic[ir_ioapic_num].bus   = bus;
-        ir_ioapic[ir_ioapic_num].devfn = PCI_DEVFN(path->device, path->function);
-        ir_ioapic[ir_ioapic_num].iommu = iommu;
-        ir_ioapic[ir_ioapic_num].id    = scope->enumeration_id;
-        ir_ioapic_num++;
+        for (count = 0; count < MAX_IO_APICS; count++) {
+                if (ir_ioapic[count].iommu == iommu &&
+                    ir_ioapic[count].id == scope->enumeration_id)
+                        return 0;
+                else if (ir_ioapic[count].iommu == NULL && free == -1)
+                        free = count;
+        }
+        if (free == -1) {
+                pr_warn("Exceeded Max IO APICS\n");
+                return -ENOSPC;
+        }
+
+        ir_ioapic[free].bus   = bus;
+        ir_ioapic[free].devfn = PCI_DEVFN(path->device, path->function);
+        ir_ioapic[free].iommu = iommu;
+        ir_ioapic[free].id    = scope->enumeration_id;
+        pr_info("IOAPIC id %d under DRHD base  0x%Lx IOMMU %d\n",
+                scope->enumeration_id, drhd->address, iommu->seq_id);
+
+        return 0;
 }
 
 static int ir_parse_ioapic_hpet_scope(struct acpi_dmar_header *header,
                                       struct intel_iommu *iommu)
 {
+        int ret = 0;
         struct acpi_dmar_hardware_unit *drhd;
         struct acpi_dmar_device_scope *scope;
         void *start, *end;
 
         drhd = (struct acpi_dmar_hardware_unit *)header;
-
         start = (void *)(drhd + 1);
         end = ((void *)drhd) + header->length;
 
-        while (start < end) {
+        while (start < end && ret == 0) {
                 scope = start;
-                if (scope->entry_type == ACPI_DMAR_SCOPE_TYPE_IOAPIC) {
-                        if (ir_ioapic_num == MAX_IO_APICS) {
-                                printk(KERN_WARNING "Exceeded Max IO APICS\n");
-                                return -1;
-                        }
-
-                        printk(KERN_INFO "IOAPIC id %d under DRHD base "
-                               " 0x%Lx IOMMU %d\n", scope->enumeration_id,
-                               drhd->address, iommu->seq_id);
+                if (scope->entry_type == ACPI_DMAR_SCOPE_TYPE_IOAPIC)
+                        ret = ir_parse_one_ioapic_scope(scope, iommu, drhd);
+                else if (scope->entry_type == ACPI_DMAR_SCOPE_TYPE_HPET)
+                        ret = ir_parse_one_hpet_scope(scope, iommu, drhd);
+                start += scope->length;
+        }
 
-                        ir_parse_one_ioapic_scope(scope, iommu);
-                } else if (scope->entry_type == ACPI_DMAR_SCOPE_TYPE_HPET) {
-                        if (ir_hpet_num == MAX_HPET_TBS) {
-                                printk(KERN_WARNING "Exceeded Max HPET blocks\n");
-                                return -1;
-                        }
+        return ret;
+}
 
-                        printk(KERN_INFO "HPET id %d under DRHD base"
-                               " 0x%Lx\n", scope->enumeration_id,
-                               drhd->address);
+static void ir_remove_ioapic_hpet_scope(struct intel_iommu *iommu)
+{
+        int i;
 
-                        ir_parse_one_hpet_scope(scope, iommu);
-                }
-                start += scope->length;
-        }
+        for (i = 0; i < MAX_HPET_TBS; i++)
+                if (ir_hpet[i].iommu == iommu)
+                        ir_hpet[i].iommu = NULL;
 
-        return 0;
+        for (i = 0; i < MAX_IO_APICS; i++)
+                if (ir_ioapic[i].iommu == iommu)
+                        ir_ioapic[i].iommu = NULL;
 }
 
 /*
@@ -1171,3 +1213,86 @@ struct irq_remap_ops intel_irq_remap_ops = {
         .msi_setup_irq          = intel_msi_setup_irq,
         .alloc_hpet_msi         = intel_alloc_hpet_msi,
 };
+
+/*
+ * Support of Interrupt Remapping Unit Hotplug
+ */
+static int dmar_ir_add(struct dmar_drhd_unit *dmaru, struct intel_iommu *iommu)
+{
+        int ret;
+        int eim = x2apic_enabled();
+
+        if (eim && !ecap_eim_support(iommu->ecap)) {
+                pr_info("DRHD %Lx: EIM not supported by DRHD, ecap %Lx\n",
+                        iommu->reg_phys, iommu->ecap);
+                return -ENODEV;
+        }
+
+        if (ir_parse_ioapic_hpet_scope(dmaru->hdr, iommu)) {
+                pr_warn("DRHD %Lx: failed to parse managed IOAPIC/HPET\n",
+                        iommu->reg_phys);
+                return -ENODEV;
+        }
+
+        /* TODO: check all IOAPICs are covered by IOMMU */
+
+        /* Setup Interrupt-remapping now. */
+        ret = intel_setup_irq_remapping(iommu);
+        if (ret) {
+                pr_err("DRHD %Lx: failed to allocate resource\n",
+                       iommu->reg_phys);
+                ir_remove_ioapic_hpet_scope(iommu);
+                return ret;
+        }
+
+        if (!iommu->qi) {
+                /* Clear previous faults. */
+                dmar_fault(-1, iommu);
+                iommu_disable_irq_remapping(iommu);
+                dmar_disable_qi(iommu);
+        }
+
+        /* Enable queued invalidation */
+        ret = dmar_enable_qi(iommu);
+        if (!ret) {
+                iommu_set_irq_remapping(iommu, eim);
+        } else {
+                pr_err("DRHD %Lx: failed to enable queued invalidation, ecap %Lx, ret %d\n",
+                       iommu->reg_phys, iommu->ecap, ret);
+                intel_teardown_irq_remapping(iommu);
+                ir_remove_ioapic_hpet_scope(iommu);
+        }
+
+        return ret;
+}
+
+int dmar_ir_hotplug(struct dmar_drhd_unit *dmaru, bool insert)
+{
+        int ret = 0;
+        struct intel_iommu *iommu = dmaru->iommu;
+
+        if (!irq_remapping_enabled)
+                return 0;
+        if (iommu == NULL)
+                return -EINVAL;
+        if (!ecap_ir_support(iommu->ecap))
+                return 0;
+
+        if (insert) {
+                if (!iommu->ir_table)
+                        ret = dmar_ir_add(dmaru, iommu);
+        } else {
+                if (iommu->ir_table) {
+                        if (!bitmap_empty(iommu->ir_table->bitmap,
+                                          INTR_REMAP_TABLE_ENTRIES)) {
+                                ret = -EBUSY;
+                        } else {
+                                iommu_disable_irq_remapping(iommu);
+                                intel_teardown_irq_remapping(iommu);
+                                ir_remove_ioapic_hpet_scope(iommu);
+                        }
+                }
+        }
+
+        return ret;
+}
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 02e4313e937c..1bd63352ab17 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -1143,14 +1143,24 @@ size_t default_iommu_map_sg(struct iommu_domain *domain, unsigned long iova,
 {
         struct scatterlist *s;
         size_t mapped = 0;
-        unsigned int i;
+        unsigned int i, min_pagesz;
         int ret;
 
-        for_each_sg(sg, s, nents, i) {
-                phys_addr_t phys = page_to_phys(sg_page(s));
+        if (unlikely(domain->ops->pgsize_bitmap == 0UL))
+                return 0;
 
-                /* We are mapping on page boundarys, so offset must be 0 */
-                if (s->offset)
+        min_pagesz = 1 << __ffs(domain->ops->pgsize_bitmap);
+
+        for_each_sg(sg, s, nents, i) {
+                phys_addr_t phys = page_to_phys(sg_page(s)) + s->offset;
+
+                /*
+                 * We are mapping on IOMMU page boundaries, so offset within
+                 * the page must be 0. However, the IOMMU may support pages
+                 * smaller than PAGE_SIZE, so s->offset may still represent
+                 * an offset of that boundary within the CPU page.
+                 */
+                if (!IS_ALIGNED(s->offset, min_pagesz))
                         goto out_err;
 
                 ret = iommu_map(domain, iova + mapped, phys, s->length, prot);
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index e509c58eee92..99effbb17191 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -1185,7 +1185,7 @@ static int ipmmu_probe(struct platform_device *pdev)
                                dev_name(&pdev->dev), mmu);
         if (ret < 0) {
                 dev_err(&pdev->dev, "failed to request IRQ %d\n", irq);
-                return irq;
+                return ret;
         }
 
         ipmmu_device_reset(mmu);
diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 1c7b78ecf3e3..e1b05379ca0e 100644
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -73,8 +73,7 @@ fail:
 
 static void __disable_clocks(struct msm_iommu_drvdata *drvdata)
 {
-        if (drvdata->clk)
-                clk_disable(drvdata->clk);
+        clk_disable(drvdata->clk);
         clk_disable(drvdata->pclk);
 }
 
diff --git a/drivers/iommu/msm_iommu_dev.c b/drivers/iommu/msm_iommu_dev.c
index 61def7cb5263..b6d01f97e537 100644
--- a/drivers/iommu/msm_iommu_dev.c
+++ b/drivers/iommu/msm_iommu_dev.c
@@ -131,7 +131,7 @@ static int msm_iommu_probe(struct platform_device *pdev)
         struct clk *iommu_clk;
         struct clk *iommu_pclk;
         struct msm_iommu_drvdata *drvdata;
-        struct msm_iommu_dev *iommu_dev = pdev->dev.platform_data;
+        struct msm_iommu_dev *iommu_dev = dev_get_platdata(&pdev->dev);
         void __iomem *regs_base;
         int ret, irq, par;
 
@@ -224,8 +224,7 @@ static int msm_iommu_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, drvdata);
 
-        if (iommu_clk)
-                clk_disable(iommu_clk);
+        clk_disable(iommu_clk);
 
         clk_disable(iommu_pclk);
 
@@ -264,7 +263,7 @@ static int msm_iommu_remove(struct platform_device *pdev)
 
 static int msm_iommu_ctx_probe(struct platform_device *pdev)
 {
-        struct msm_iommu_ctx_dev *c = pdev->dev.platform_data;
+        struct msm_iommu_ctx_dev *c = dev_get_platdata(&pdev->dev);
         struct msm_iommu_drvdata *drvdata;
         struct msm_iommu_ctx_drvdata *ctx_drvdata;
         int i, ret;
@@ -323,8 +322,7 @@ static int msm_iommu_ctx_probe(struct platform_device *pdev)
                 SET_NSCFG(drvdata->base, mid, 3);
         }
 
-        if (drvdata->clk)
-                clk_disable(drvdata->clk);
+        clk_disable(drvdata->clk);
         clk_disable(drvdata->pclk);
 
         dev_info(&pdev->dev, "context %s using bank %d\n", c->name, c->num);
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 531658d17333..f3d20a2039d2 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -10,45 +10,35 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/module.h>
 #include <linux/err.h>
-#include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
-#include <linux/platform_device.h>
 #include <linux/debugfs.h>
-#include <linux/omap-iommu.h>
 #include <linux/platform_data/iommu-omap.h>
 
 #include "omap-iopgtable.h"
 #include "omap-iommu.h"
 
-#define MAXCOLUMN 100 /* for short messages */
-
 static DEFINE_MUTEX(iommu_debug_lock);
 
 static struct dentry *iommu_debug_root;
 
-static ssize_t debug_read_ver(struct file *file, char __user *userbuf,
-                              size_t count, loff_t *ppos)
+static inline bool is_omap_iommu_detached(struct omap_iommu *obj)
 {
-        u32 ver = omap_iommu_arch_version();
-        char buf[MAXCOLUMN], *p = buf;
-
-        p += sprintf(p, "H/W version: %d.%d\n", (ver >> 4) & 0xf , ver & 0xf);
-
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+        return !obj->domain;
 }
 
 static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct device *dev = file->private_data;
-        struct omap_iommu *obj = dev_to_omap_iommu(dev);
+        struct omap_iommu *obj = file->private_data;
         char *p, *buf;
         ssize_t bytes;
 
+        if (is_omap_iommu_detached(obj))
+                return -EPERM;
+
         buf = kmalloc(count, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -68,11 +58,13 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
 static ssize_t debug_read_tlb(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct device *dev = file->private_data;
-        struct omap_iommu *obj = dev_to_omap_iommu(dev);
+        struct omap_iommu *obj = file->private_data;
         char *p, *buf;
         ssize_t bytes, rest;
 
+        if (is_omap_iommu_detached(obj))
+                return -EPERM;
+
         buf = kmalloc(count, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -93,133 +85,69 @@ static ssize_t debug_read_tlb(struct file *file, char __user *userbuf,
         return bytes;
 }
 
-static ssize_t debug_write_pagetable(struct file *file,
-                     const char __user *userbuf, size_t count, loff_t *ppos)
+static void dump_ioptable(struct seq_file *s)
 {
-        struct iotlb_entry e;
-        struct cr_regs cr;
-        int err;
-        struct device *dev = file->private_data;
-        struct omap_iommu *obj = dev_to_omap_iommu(dev);
-        char buf[MAXCOLUMN], *p = buf;
-
-        count = min(count, sizeof(buf));
-
-        mutex_lock(&iommu_debug_lock);
-        if (copy_from_user(p, userbuf, count)) {
-                mutex_unlock(&iommu_debug_lock);
-                return -EFAULT;
-        }
-
-        sscanf(p, "%x %x", &cr.cam, &cr.ram);
-        if (!cr.cam || !cr.ram) {
-                mutex_unlock(&iommu_debug_lock);
-                return -EINVAL;
-        }
-
-        omap_iotlb_cr_to_e(&cr, &e);
-        err = omap_iopgtable_store_entry(obj, &e);
-        if (err)
-                dev_err(obj->dev, "%s: fail to store cr\n", __func__);
-
-        mutex_unlock(&iommu_debug_lock);
-        return count;
-}
-
-#define dump_ioptable_entry_one(lv, da, val)                    \
-        ({                                                      \
-                int __err = 0;                                  \
-                ssize_t bytes;                                  \
-                const int maxcol = 22;                          \
-                const char *str = "%d: %08x %08x\n";            \
-                bytes = snprintf(p, maxcol, str, lv, da, val);  \
-                p += bytes;                                     \
-                len -= bytes;                                   \
-                if (len < maxcol)                               \
-                        __err = -ENOMEM;                        \
-                __err;                                          \
-        })
-
-static ssize_t dump_ioptable(struct omap_iommu *obj, char *buf, ssize_t len)
-{
-        int i;
-        u32 *iopgd;
-        char *p = buf;
+        int i, j;
+        u32 da;
+        u32 *iopgd, *iopte;
+        struct omap_iommu *obj = s->private;
 
         spin_lock(&obj->page_table_lock);
 
         iopgd = iopgd_offset(obj, 0);
         for (i = 0; i < PTRS_PER_IOPGD; i++, iopgd++) {
-                int j, err;
-                u32 *iopte;
-                u32 da;
-
                 if (!*iopgd)
                         continue;
 
                 if (!(*iopgd & IOPGD_TABLE)) {
                         da = i << IOPGD_SHIFT;
-
-                        err = dump_ioptable_entry_one(1, da, *iopgd);
-                        if (err)
-                                goto out;
+                        seq_printf(s, "1: 0x%08x 0x%08x\n", da, *iopgd);
                         continue;
                 }
 
                 iopte = iopte_offset(iopgd, 0);
-
                 for (j = 0; j < PTRS_PER_IOPTE; j++, iopte++) {
                         if (!*iopte)
                                 continue;
 
                         da = (i << IOPGD_SHIFT) + (j << IOPTE_SHIFT);
-                        err = dump_ioptable_entry_one(2, da, *iopgd);
-                        if (err)
-                                goto out;
+                        seq_printf(s, "2: 0x%08x 0x%08x\n", da, *iopte);
                 }
         }
-out:
-        spin_unlock(&obj->page_table_lock);
 
-        return p - buf;
+        spin_unlock(&obj->page_table_lock);
 }
 
-static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
-                                    size_t count, loff_t *ppos)
+static int debug_read_pagetable(struct seq_file *s, void *data)
 {
-        struct device *dev = file->private_data;
-        struct omap_iommu *obj = dev_to_omap_iommu(dev);
-        char *p, *buf;
-        size_t bytes;
+        struct omap_iommu *obj = s->private;
 
-        buf = (char *)__get_free_page(GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        p = buf;
-
-        p += sprintf(p, "L: %8s %8s\n", "da:", "pa:");
-        p += sprintf(p, "-----------------------------------------\n");
+        if (is_omap_iommu_detached(obj))
+                return -EPERM;
 
         mutex_lock(&iommu_debug_lock);
 
-        bytes = PAGE_SIZE - (p - buf);
-        p += dump_ioptable(obj, p, bytes);
-
-        bytes = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+        seq_printf(s, "L: %8s %8s\n", "da:", "pte:");
+        seq_puts(s, "--------------------------\n");
+        dump_ioptable(s);
 
         mutex_unlock(&iommu_debug_lock);
-        free_page((unsigned long)buf);
 
-        return bytes;
+        return 0;
 }
 
-#define DEBUG_FOPS(name)                                                \
-        static const struct file_operations debug_##name##_fops = {     \
-                .open = simple_open,                                    \
-                .read = debug_read_##name,                              \
-                .write = debug_write_##name,                            \
-                .llseek = generic_file_llseek,                          \
-        };
+#define DEBUG_SEQ_FOPS_RO(name)                                                \
+        static int debug_open_##name(struct inode *inode, struct file *file)   \
+        {                                                                      \
+                return single_open(file, debug_read_##name, inode->i_private); \
+        }                                                                      \
+                                                                               \
+        static const struct file_operations debug_##name##_fops = {            \
+                .open           = debug_open_##name,                           \
+                .read           = seq_read,                                    \
+                .llseek         = seq_lseek,                                   \
+                .release        = single_release,                              \
+        }
 
 #define DEBUG_FOPS_RO(name)                                             \
         static const struct file_operations debug_##name##_fops = {     \
@@ -228,103 +156,63 @@ static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
                 .llseek = generic_file_llseek,                          \
         };
 
-DEBUG_FOPS_RO(ver);
 DEBUG_FOPS_RO(regs);
 DEBUG_FOPS_RO(tlb);
-DEBUG_FOPS(pagetable);
+DEBUG_SEQ_FOPS_RO(pagetable);
 
 #define __DEBUG_ADD_FILE(attr, mode)                                    \
         {                                                               \
                 struct dentry *dent;                                    \
-                dent = debugfs_create_file(#attr, mode, parent,         \
-                                           dev, &debug_##attr##_fops);  \
+                dent = debugfs_create_file(#attr, mode, obj->debug_dir, \
+                                           obj, &debug_##attr##_fops);  \
                 if (!dent)                                              \
-                        return -ENOMEM;                                 \
+                        goto err;                                       \
         }
 
-#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 0600)
 #define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 0400)
 
-static int iommu_debug_register(struct device *dev, void *data)
+void omap_iommu_debugfs_add(struct omap_iommu *obj)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct omap_iommu *obj = platform_get_drvdata(pdev);
-        struct omap_iommu_arch_data *arch_data;
-        struct dentry *d, *parent;
-
-        if (!obj || !obj->dev)
-                return -EINVAL;
-
-        arch_data = kzalloc(sizeof(*arch_data), GFP_KERNEL);
-        if (!arch_data)
-                return -ENOMEM;
-
-        arch_data->iommu_dev = obj;
+        struct dentry *d;
 
-        dev->archdata.iommu = arch_data;
+        if (!iommu_debug_root)
+                return;
 
-        d = debugfs_create_dir(obj->name, iommu_debug_root);
-        if (!d)
-                goto nomem;
-        parent = d;
+        obj->debug_dir = debugfs_create_dir(obj->name, iommu_debug_root);
+        if (!obj->debug_dir)
+                return;
 
-        d = debugfs_create_u8("nr_tlb_entries", 400, parent,
+        d = debugfs_create_u8("nr_tlb_entries", 0400, obj->debug_dir,
                               (u8 *)&obj->nr_tlb_entries);
         if (!d)
-                goto nomem;
+                return;
 
-        DEBUG_ADD_FILE_RO(ver);
         DEBUG_ADD_FILE_RO(regs);
         DEBUG_ADD_FILE_RO(tlb);
-        DEBUG_ADD_FILE(pagetable);
+        DEBUG_ADD_FILE_RO(pagetable);
 
-        return 0;
+        return;
 
-nomem:
-        kfree(arch_data);
-        return -ENOMEM;
+err:
+        debugfs_remove_recursive(obj->debug_dir);
 }
 
-static int iommu_debug_unregister(struct device *dev, void *data)
+void omap_iommu_debugfs_remove(struct omap_iommu *obj)
 {
-        if (!dev->archdata.iommu)
-                return 0;
-
-        kfree(dev->archdata.iommu);
+        if (!obj->debug_dir)
+                return;
 
-        dev->archdata.iommu = NULL;
-
-        return 0;
+        debugfs_remove_recursive(obj->debug_dir);
 }
 
-static int __init iommu_debug_init(void)
+void __init omap_iommu_debugfs_init(void)
 {
-        struct dentry *d;
-        int err;
-
-        d = debugfs_create_dir("iommu", NULL);
-        if (!d)
-                return -ENOMEM;
-        iommu_debug_root = d;
-
-        err = omap_foreach_iommu_device(d, iommu_debug_register);
-        if (err)
-                goto err_out;
-        return 0;
-
-err_out:
-        debugfs_remove_recursive(iommu_debug_root);
-        return err;
+        iommu_debug_root = debugfs_create_dir("omap_iommu", NULL);
+        if (!iommu_debug_root)
+                pr_err("can't create debugfs dir\n");
 }
-module_init(iommu_debug_init)
 
-static void __exit iommu_debugfs_exit(void)
+void __exit omap_iommu_debugfs_exit(void)
 {
-        debugfs_remove_recursive(iommu_debug_root);
-        omap_foreach_iommu_device(NULL, iommu_debug_unregister);
+        debugfs_remove(iommu_debug_root);
 }
-module_exit(iommu_debugfs_exit)
-
-MODULE_DESCRIPTION("omap iommu: debugfs interface");
-MODULE_AUTHOR("Hiroshi DOYU <Hiroshi.DOYU@nokia.com>");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index 18003c044454..bbb7dcef02d3 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -76,53 +76,23 @@ struct iotlb_lock {
         short vict;
 };
 
-/* accommodate the difference between omap1 and omap2/3 */
-static const struct iommu_functions *arch_iommu;
-
 static struct platform_driver omap_iommu_driver;
 static struct kmem_cache *iopte_cachep;
 
 /**
- * omap_install_iommu_arch - Install archtecure specific iommu functions
- * @ops:        a pointer to architecture specific iommu functions
- *
- * There are several kind of iommu algorithm(tlb, pagetable) among
- * omap series. This interface installs such an iommu algorighm.
- **/
-int omap_install_iommu_arch(const struct iommu_functions *ops)
-{
-        if (arch_iommu)
-                return -EBUSY;
-
-        arch_iommu = ops;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(omap_install_iommu_arch);
-
-/**
- * omap_uninstall_iommu_arch - Uninstall archtecure specific iommu functions
- * @ops:        a pointer to architecture specific iommu functions
- *
- * This interface uninstalls the iommu algorighm installed previously.
- **/
-void omap_uninstall_iommu_arch(const struct iommu_functions *ops)
-{
-        if (arch_iommu != ops)
-                pr_err("%s: not your arch\n", __func__);
-
-        arch_iommu = NULL;
-}
-EXPORT_SYMBOL_GPL(omap_uninstall_iommu_arch);
-
-/**
  * omap_iommu_save_ctx - Save registers for pm off-mode support
  * @dev:        client device
  **/
 void omap_iommu_save_ctx(struct device *dev)
 {
         struct omap_iommu *obj = dev_to_omap_iommu(dev);
+        u32 *p = obj->ctx;
+        int i;
 
-        arch_iommu->save_ctx(obj);
+        for (i = 0; i < (MMU_REG_SIZE / sizeof(u32)); i++) {
+                p[i] = iommu_read_reg(obj, i * sizeof(u32));
+                dev_dbg(obj->dev, "%s\t[%02d] %08x\n", __func__, i, p[i]);
+        }
 }
 EXPORT_SYMBOL_GPL(omap_iommu_save_ctx);
 
@@ -133,28 +103,74 @@ EXPORT_SYMBOL_GPL(omap_iommu_save_ctx);
 void omap_iommu_restore_ctx(struct device *dev)
 {
         struct omap_iommu *obj = dev_to_omap_iommu(dev);
+        u32 *p = obj->ctx;
+        int i;
 
-        arch_iommu->restore_ctx(obj);
+        for (i = 0; i < (MMU_REG_SIZE / sizeof(u32)); i++) {
+                iommu_write_reg(obj, p[i], i * sizeof(u32));
+                dev_dbg(obj->dev, "%s\t[%02d] %08x\n", __func__, i, p[i]);
+        }
 }
 EXPORT_SYMBOL_GPL(omap_iommu_restore_ctx);
 
-/**
- * omap_iommu_arch_version - Return running iommu arch version
- **/
-u32 omap_iommu_arch_version(void)
+static void __iommu_set_twl(struct omap_iommu *obj, bool on)
 {
-        return arch_iommu->version;
+        u32 l = iommu_read_reg(obj, MMU_CNTL);
+
+        if (on)
+                iommu_write_reg(obj, MMU_IRQ_TWL_MASK, MMU_IRQENABLE);
+        else
+                iommu_write_reg(obj, MMU_IRQ_TLB_MISS_MASK, MMU_IRQENABLE);
+
+        l &= ~MMU_CNTL_MASK;
+        if (on)
+                l |= (MMU_CNTL_MMU_EN | MMU_CNTL_TWL_EN);
+        else
+                l |= (MMU_CNTL_MMU_EN);
+
+        iommu_write_reg(obj, l, MMU_CNTL);
+}
+
+static int omap2_iommu_enable(struct omap_iommu *obj)
+{
+        u32 l, pa;
+
+        if (!obj->iopgd || !IS_ALIGNED((u32)obj->iopgd,  SZ_16K))
+                return -EINVAL;
+
+        pa = virt_to_phys(obj->iopgd);
+        if (!IS_ALIGNED(pa, SZ_16K))
+                return -EINVAL;
+
+        l = iommu_read_reg(obj, MMU_REVISION);
+        dev_info(obj->dev, "%s: version %d.%d\n", obj->name,
+                 (l >> 4) & 0xf, l & 0xf);
+
+        iommu_write_reg(obj, pa, MMU_TTB);
+
+        if (obj->has_bus_err_back)
+                iommu_write_reg(obj, MMU_GP_REG_BUS_ERR_BACK_EN, MMU_GP_REG);
+
+        __iommu_set_twl(obj, true);
+
+        return 0;
+}
+
+static void omap2_iommu_disable(struct omap_iommu *obj)
+{
+        u32 l = iommu_read_reg(obj, MMU_CNTL);
+
+        l &= ~MMU_CNTL_MASK;
+        iommu_write_reg(obj, l, MMU_CNTL);
+
+        dev_dbg(obj->dev, "%s is shutting down\n", obj->name);
 }
-EXPORT_SYMBOL_GPL(omap_iommu_arch_version);
 
 static int iommu_enable(struct omap_iommu *obj)
 {
         int err;
         struct platform_device *pdev = to_platform_device(obj->dev);
-        struct iommu_platform_data *pdata = pdev->dev.platform_data;
-
-        if (!arch_iommu)
-                return -ENODEV;
+        struct iommu_platform_data *pdata = dev_get_platdata(&pdev->dev);
 
         if (pdata && pdata->deassert_reset) {
                 err = pdata->deassert_reset(pdev, pdata->reset_name);
@@ -166,7 +182,7 @@ static int iommu_enable(struct omap_iommu *obj)
 
         pm_runtime_get_sync(obj->dev);
 
-        err = arch_iommu->enable(obj);
+        err = omap2_iommu_enable(obj);
 
         return err;
 }
@@ -174,9 +190,9 @@ static int iommu_enable(struct omap_iommu *obj)
 static void iommu_disable(struct omap_iommu *obj)
 {
         struct platform_device *pdev = to_platform_device(obj->dev);
-        struct iommu_platform_data *pdata = pdev->dev.platform_data;
+        struct iommu_platform_data *pdata = dev_get_platdata(&pdev->dev);
 
-        arch_iommu->disable(obj);
+        omap2_iommu_disable(obj);
 
         pm_runtime_put_sync(obj->dev);
 
@@ -187,44 +203,51 @@ static void iommu_disable(struct omap_iommu *obj)
 /*
  *      TLB operations
  */
-void omap_iotlb_cr_to_e(struct cr_regs *cr, struct iotlb_entry *e)
-{
-        BUG_ON(!cr || !e);
-
-        arch_iommu->cr_to_e(cr, e);
-}
-EXPORT_SYMBOL_GPL(omap_iotlb_cr_to_e);
-
 static inline int iotlb_cr_valid(struct cr_regs *cr)
 {
         if (!cr)
                 return -EINVAL;
 
-        return arch_iommu->cr_valid(cr);
-}
-
-static inline struct cr_regs *iotlb_alloc_cr(struct omap_iommu *obj,
-                                             struct iotlb_entry *e)
-{
-        if (!e)
-                return NULL;
-
-        return arch_iommu->alloc_cr(obj, e);
+        return cr->cam & MMU_CAM_V;
 }
 
 static u32 iotlb_cr_to_virt(struct cr_regs *cr)
 {
-        return arch_iommu->cr_to_virt(cr);
+        u32 page_size = cr->cam & MMU_CAM_PGSZ_MASK;
+        u32 mask = get_cam_va_mask(cr->cam & page_size);
+
+        return cr->cam & mask;
 }
 
 static u32 get_iopte_attr(struct iotlb_entry *e)
 {
-        return arch_iommu->get_pte_attr(e);
+        u32 attr;
+
+        attr = e->mixed << 5;
+        attr |= e->endian;
+        attr |= e->elsz >> 3;
+        attr <<= (((e->pgsz == MMU_CAM_PGSZ_4K) ||
+                        (e->pgsz == MMU_CAM_PGSZ_64K)) ? 0 : 6);
+        return attr;
 }
 
 static u32 iommu_report_fault(struct omap_iommu *obj, u32 *da)
 {
-        return arch_iommu->fault_isr(obj, da);
+        u32 status, fault_addr;
+
+        status = iommu_read_reg(obj, MMU_IRQSTATUS);
+        status &= MMU_IRQ_MASK;
+        if (!status) {
+                *da = 0;
+                return 0;
+        }
+
+        fault_addr = iommu_read_reg(obj, MMU_FAULT_AD);
+        *da = fault_addr;
+
+        iommu_write_reg(obj, status, MMU_IRQSTATUS);
+
+        return status;
 }
 
 static void iotlb_lock_get(struct omap_iommu *obj, struct iotlb_lock *l)
@@ -250,31 +273,19 @@ static void iotlb_lock_set(struct omap_iommu *obj, struct iotlb_lock *l)
 
 static void iotlb_read_cr(struct omap_iommu *obj, struct cr_regs *cr)
 {
-        arch_iommu->tlb_read_cr(obj, cr);
+        cr->cam = iommu_read_reg(obj, MMU_READ_CAM);
+        cr->ram = iommu_read_reg(obj, MMU_READ_RAM);
 }
 
 static void iotlb_load_cr(struct omap_iommu *obj, struct cr_regs *cr)
 {
-        arch_iommu->tlb_load_cr(obj, cr);
+        iommu_write_reg(obj, cr->cam | MMU_CAM_V, MMU_CAM);
+        iommu_write_reg(obj, cr->ram, MMU_RAM);
 
         iommu_write_reg(obj, 1, MMU_FLUSH_ENTRY);
         iommu_write_reg(obj, 1, MMU_LD_TLB);
 }
 
-/**
- * iotlb_dump_cr - Dump an iommu tlb entry into buf
- * @obj:        target iommu
- * @cr:         contents of cam and ram register
- * @buf:        output buffer
- **/
-static inline ssize_t iotlb_dump_cr(struct omap_iommu *obj, struct cr_regs *cr,
-                                    char *buf)
-{
-        BUG_ON(!cr || !buf);
-
-        return arch_iommu->dump_cr(obj, cr, buf);
-}
-
 /* only used in iotlb iteration for-loop */
 static struct cr_regs __iotlb_read_cr(struct omap_iommu *obj, int n)
 {
@@ -289,12 +300,36 @@ static struct cr_regs __iotlb_read_cr(struct omap_iommu *obj, int n)
         return cr;
 }
 
+#ifdef PREFETCH_IOTLB
+static struct cr_regs *iotlb_alloc_cr(struct omap_iommu *obj,
+                                      struct iotlb_entry *e)
+{
+        struct cr_regs *cr;
+
+        if (!e)
+                return NULL;
+
+        if (e->da & ~(get_cam_va_mask(e->pgsz))) {
+                dev_err(obj->dev, "%s:\twrong alignment: %08x\n", __func__,
+                        e->da);
+                return ERR_PTR(-EINVAL);
+        }
+
+        cr = kmalloc(sizeof(*cr), GFP_KERNEL);
+        if (!cr)
+                return ERR_PTR(-ENOMEM);
+
+        cr->cam = (e->da & MMU_CAM_VATAG_MASK) | e->prsvd | e->pgsz | e->valid;
+        cr->ram = e->pa | e->endian | e->elsz | e->mixed;
+
+        return cr;
+}
+
 /**
  * load_iotlb_entry - Set an iommu tlb entry
  * @obj:        target iommu
  * @e:          an iommu tlb entry info
  **/
-#ifdef PREFETCH_IOTLB
 static int load_iotlb_entry(struct omap_iommu *obj, struct iotlb_entry *e)
 {
         int err = 0;
@@ -423,7 +458,45 @@ static void flush_iotlb_all(struct omap_iommu *obj)
         pm_runtime_put_sync(obj->dev);
 }
 
-#if defined(CONFIG_OMAP_IOMMU_DEBUG) || defined(CONFIG_OMAP_IOMMU_DEBUG_MODULE)
+#ifdef CONFIG_OMAP_IOMMU_DEBUG
+
+#define pr_reg(name)                                                    \
+        do {                                                            \
+                ssize_t bytes;                                          \
+                const char *str = "%20s: %08x\n";                       \
+                const int maxcol = 32;                                  \
+                bytes = snprintf(p, maxcol, str, __stringify(name),     \
+                                 iommu_read_reg(obj, MMU_##name));      \
+                p += bytes;                                             \
+                len -= bytes;                                           \
+                if (len < maxcol)                                       \
+                        goto out;                                       \
+        } while (0)
+
+static ssize_t
+omap2_iommu_dump_ctx(struct omap_iommu *obj, char *buf, ssize_t len)
+{
+        char *p = buf;
+
+        pr_reg(REVISION);
+        pr_reg(IRQSTATUS);
+        pr_reg(IRQENABLE);
+        pr_reg(WALKING_ST);
+        pr_reg(CNTL);
+        pr_reg(FAULT_AD);
+        pr_reg(TTB);
+        pr_reg(LOCK);
+        pr_reg(LD_TLB);
+        pr_reg(CAM);
+        pr_reg(RAM);
+        pr_reg(GFLUSH);
+        pr_reg(FLUSH_ENTRY);
+        pr_reg(READ_CAM);
+        pr_reg(READ_RAM);
+        pr_reg(EMU_FAULT_AD);
+out:
+        return p - buf;
+}
 
 ssize_t omap_iommu_dump_ctx(struct omap_iommu *obj, char *buf, ssize_t bytes)
 {
@@ -432,13 +505,12 @@ ssize_t omap_iommu_dump_ctx(struct omap_iommu *obj, char *buf, ssize_t bytes)
 
         pm_runtime_get_sync(obj->dev);
 
-        bytes = arch_iommu->dump_ctx(obj, buf, bytes);
+        bytes = omap2_iommu_dump_ctx(obj, buf, bytes);
 
         pm_runtime_put_sync(obj->dev);
 
         return bytes;
 }
-EXPORT_SYMBOL_GPL(omap_iommu_dump_ctx);
 
 static int
 __dump_tlb_entries(struct omap_iommu *obj, struct cr_regs *crs, int num)
@@ -464,6 +536,24 @@ __dump_tlb_entries(struct omap_iommu *obj, struct cr_regs *crs, int num)
 }
 
 /**
+ * iotlb_dump_cr - Dump an iommu tlb entry into buf
+ * @obj:        target iommu
+ * @cr:         contents of cam and ram register
+ * @buf:        output buffer
+ **/
+static ssize_t iotlb_dump_cr(struct omap_iommu *obj, struct cr_regs *cr,
+                             char *buf)
+{
+        char *p = buf;
+
+        /* FIXME: Need more detail analysis of cam/ram */
+        p += sprintf(p, "%08x %08x %01x\n", cr->cam, cr->ram,
+                                        (cr->cam & MMU_CAM_P) ? 1 : 0);
+
+        return p - buf;
+}
+
+/**
  * omap_dump_tlb_entries - dump cr arrays to given buffer
  * @obj:        target iommu
  * @buf:        output buffer
@@ -488,16 +578,8 @@ size_t omap_dump_tlb_entries(struct omap_iommu *obj, char *buf, ssize_t bytes)
 
         return p - buf;
 }
-EXPORT_SYMBOL_GPL(omap_dump_tlb_entries);
-
-int omap_foreach_iommu_device(void *data, int (*fn)(struct device *, void *))
-{
-        return driver_for_each_device(&omap_iommu_driver.driver,
-                                      NULL, data, fn);
-}
-EXPORT_SYMBOL_GPL(omap_foreach_iommu_device);
 
-#endif /* CONFIG_OMAP_IOMMU_DEBUG_MODULE */
+#endif /* CONFIG_OMAP_IOMMU_DEBUG */
 
 /*
  *      H/W pagetable operations
@@ -680,7 +762,8 @@ iopgtable_store_entry_core(struct omap_iommu *obj, struct iotlb_entry *e)
  * @obj:        target iommu
  * @e:          an iommu tlb entry info
  **/
-int omap_iopgtable_store_entry(struct omap_iommu *obj, struct iotlb_entry *e)
+static int
+omap_iopgtable_store_entry(struct omap_iommu *obj, struct iotlb_entry *e)
 {
         int err;
 
@@ -690,7 +773,6 @@ int omap_iopgtable_store_entry(struct omap_iommu *obj, struct iotlb_entry *e)
                 prefetch_iotlb_entry(obj, e);
         return err;
 }
-EXPORT_SYMBOL_GPL(omap_iopgtable_store_entry);
 
 /**
  * iopgtable_lookup_entry - Lookup an iommu pte entry
@@ -819,8 +901,9 @@ static irqreturn_t iommu_fault_handler(int irq, void *data)
         u32 *iopgd, *iopte;
         struct omap_iommu *obj = data;
         struct iommu_domain *domain = obj->domain;
+        struct omap_iommu_domain *omap_domain = domain->priv;
 
-        if (!obj->refcount)
+        if (!omap_domain->iommu_dev)
                 return IRQ_NONE;
 
         errs = iommu_report_fault(obj, &da);
@@ -880,13 +963,6 @@ static struct omap_iommu *omap_iommu_attach(const char *name, u32 *iopgd)
 
         spin_lock(&obj->iommu_lock);
 
-        /* an iommu device can only be attached once */
-        if (++obj->refcount > 1) {
-                dev_err(dev, "%s: already attached!\n", obj->name);
-                err = -EBUSY;
-                goto err_enable;
-        }
-
         obj->iopgd = iopgd;
         err = iommu_enable(obj);
         if (err)
@@ -899,7 +975,6 @@ static struct omap_iommu *omap_iommu_attach(const char *name, u32 *iopgd)
         return obj;
 
 err_enable:
-        obj->refcount--;
         spin_unlock(&obj->iommu_lock);
         return ERR_PTR(err);
 }
@@ -915,9 +990,7 @@ static void omap_iommu_detach(struct omap_iommu *obj)
 
         spin_lock(&obj->iommu_lock);
 
-        if (--obj->refcount == 0)
-                iommu_disable(obj);
-
+        iommu_disable(obj);
         obj->iopgd = NULL;
 
         spin_unlock(&obj->iommu_lock);
@@ -934,7 +1007,7 @@ static int omap_iommu_probe(struct platform_device *pdev)
         int irq;
         struct omap_iommu *obj;
         struct resource *res;
-        struct iommu_platform_data *pdata = pdev->dev.platform_data;
+        struct iommu_platform_data *pdata = dev_get_platdata(&pdev->dev);
         struct device_node *of = pdev->dev.of_node;
 
         obj = devm_kzalloc(&pdev->dev, sizeof(*obj) + MMU_REG_SIZE, GFP_KERNEL);
@@ -981,6 +1054,8 @@ static int omap_iommu_probe(struct platform_device *pdev)
         pm_runtime_irq_safe(obj->dev);
         pm_runtime_enable(obj->dev);
 
+        omap_iommu_debugfs_add(obj);
+
         dev_info(&pdev->dev, "%s registered\n", obj->name);
         return 0;
 }
@@ -990,6 +1065,7 @@ static int omap_iommu_remove(struct platform_device *pdev)
         struct omap_iommu *obj = platform_get_drvdata(pdev);
 
         iopgtable_clear_entry_all(obj);
+        omap_iommu_debugfs_remove(obj);
 
         pm_runtime_disable(obj->dev);
 
@@ -1026,7 +1102,6 @@ static u32 iotlb_init_entry(struct iotlb_entry *e, u32 da, u32 pa, int pgsz)
         e->da           = da;
         e->pa           = pa;
         e->valid        = MMU_CAM_V;
-        /* FIXME: add OMAP1 support */
         e->pgsz         = pgsz;
         e->endian       = MMU_RAM_ENDIAN_LITTLE;
         e->elsz         = MMU_RAM_ELSZ_8;
@@ -1131,6 +1206,7 @@ static void _omap_iommu_detach_dev(struct omap_iommu_domain *omap_domain,
 
         omap_domain->iommu_dev = arch_data->iommu_dev = NULL;
         omap_domain->dev = NULL;
+        oiommu->domain = NULL;
 }
 
 static void omap_iommu_detach_dev(struct iommu_domain *domain,
@@ -1309,6 +1385,8 @@ static int __init omap_iommu_init(void)
 
         bus_set_iommu(&platform_bus_type, &omap_iommu_ops);
 
+        omap_iommu_debugfs_init();
+
         return platform_driver_register(&omap_iommu_driver);
 }
 /* must be ready before omap3isp is probed */
@@ -1319,6 +1397,8 @@ static void __exit omap_iommu_exit(void)
         kmem_cache_destroy(iopte_cachep);
 
         platform_driver_unregister(&omap_iommu_driver);
+
+        omap_iommu_debugfs_exit();
 }
 module_exit(omap_iommu_exit);
 
diff --git a/drivers/iommu/omap-iommu.h b/drivers/iommu/omap-iommu.h
index 4f1b68c08c15..d736630df3c8 100644
--- a/drivers/iommu/omap-iommu.h
+++ b/drivers/iommu/omap-iommu.h
@@ -10,9 +10,8 @@
  * published by the Free Software Foundation.
  */
 
-#if defined(CONFIG_ARCH_OMAP1)
-#error "iommu for this processor not implemented yet"
-#endif
+#ifndef _OMAP_IOMMU_H
+#define _OMAP_IOMMU_H
 
 struct iotlb_entry {
         u32 da;
@@ -30,10 +29,9 @@ struct omap_iommu {
         const char      *name;
         void __iomem    *regbase;
         struct device   *dev;
-        void            *isr_priv;
         struct iommu_domain *domain;
+        struct dentry   *debug_dir;
 
-        unsigned int    refcount;
         spinlock_t      iommu_lock;     /* global for this whole object */
 
         /*
@@ -67,34 +65,6 @@ struct cr_regs {
         };
 };
 
-/* architecture specific functions */
-struct iommu_functions {
-        unsigned long   version;
-
-        int (*enable)(struct omap_iommu *obj);
-        void (*disable)(struct omap_iommu *obj);
-        void (*set_twl)(struct omap_iommu *obj, bool on);
-        u32 (*fault_isr)(struct omap_iommu *obj, u32 *ra);
-
-        void (*tlb_read_cr)(struct omap_iommu *obj, struct cr_regs *cr);
-        void (*tlb_load_cr)(struct omap_iommu *obj, struct cr_regs *cr);
-
-        struct cr_regs *(*alloc_cr)(struct omap_iommu *obj,
-                                                        struct iotlb_entry *e);
-        int (*cr_valid)(struct cr_regs *cr);
-        u32 (*cr_to_virt)(struct cr_regs *cr);
-        void (*cr_to_e)(struct cr_regs *cr, struct iotlb_entry *e);
-        ssize_t (*dump_cr)(struct omap_iommu *obj, struct cr_regs *cr,
-                                                        char *buf);
-
-        u32 (*get_pte_attr)(struct iotlb_entry *e);
-
-        void (*save_ctx)(struct omap_iommu *obj);
-        void (*restore_ctx)(struct omap_iommu *obj);
-        ssize_t (*dump_ctx)(struct omap_iommu *obj, char *buf, ssize_t len);
-};
-
-#ifdef CONFIG_IOMMU_API
 /**
  * dev_to_omap_iommu() - retrieves an omap iommu object from a user device
  * @dev: iommu client device
@@ -105,7 +75,6 @@ static inline struct omap_iommu *dev_to_omap_iommu(struct device *dev)
 
         return arch_data->iommu_dev;
 }
-#endif
 
 /*
  * MMU Register offsets
@@ -133,6 +102,28 @@ static inline struct omap_iommu *dev_to_omap_iommu(struct device *dev)
 /*
  * MMU Register bit definitions
  */
+/* IRQSTATUS & IRQENABLE */
+#define MMU_IRQ_MULTIHITFAULT   (1 << 4)
+#define MMU_IRQ_TABLEWALKFAULT  (1 << 3)
+#define MMU_IRQ_EMUMISS         (1 << 2)
+#define MMU_IRQ_TRANSLATIONFAULT        (1 << 1)
+#define MMU_IRQ_TLBMISS         (1 << 0)
+
+#define __MMU_IRQ_FAULT         \
+        (MMU_IRQ_MULTIHITFAULT | MMU_IRQ_EMUMISS | MMU_IRQ_TRANSLATIONFAULT)
+#define MMU_IRQ_MASK            \
+        (__MMU_IRQ_FAULT | MMU_IRQ_TABLEWALKFAULT | MMU_IRQ_TLBMISS)
+#define MMU_IRQ_TWL_MASK        (__MMU_IRQ_FAULT | MMU_IRQ_TABLEWALKFAULT)
+#define MMU_IRQ_TLB_MISS_MASK   (__MMU_IRQ_FAULT | MMU_IRQ_TLBMISS)
+
+/* MMU_CNTL */
+#define MMU_CNTL_SHIFT          1
+#define MMU_CNTL_MASK           (7 << MMU_CNTL_SHIFT)
+#define MMU_CNTL_EML_TLB        (1 << 3)
+#define MMU_CNTL_TWL_EN         (1 << 2)
+#define MMU_CNTL_MMU_EN         (1 << 1)
+
+/* CAM */
 #define MMU_CAM_VATAG_SHIFT     12
 #define MMU_CAM_VATAG_MASK \
         ((~0UL >> MMU_CAM_VATAG_SHIFT) << MMU_CAM_VATAG_SHIFT)
@@ -144,6 +135,7 @@ static inline struct omap_iommu *dev_to_omap_iommu(struct device *dev)
 #define MMU_CAM_PGSZ_4K         (2 << 0)
 #define MMU_CAM_PGSZ_16M        (3 << 0)
 
+/* RAM */
 #define MMU_RAM_PADDR_SHIFT     12
 #define MMU_RAM_PADDR_MASK \
         ((~0UL >> MMU_RAM_PADDR_SHIFT) << MMU_RAM_PADDR_SHIFT)
@@ -165,6 +157,12 @@ static inline struct omap_iommu *dev_to_omap_iommu(struct device *dev)
 
 #define MMU_GP_REG_BUS_ERR_BACK_EN      0x1
 
+#define get_cam_va_mask(pgsz)                           \
+        (((pgsz) == MMU_CAM_PGSZ_16M) ? 0xff000000 :    \
+         ((pgsz) == MMU_CAM_PGSZ_1M)  ? 0xfff00000 :    \
+         ((pgsz) == MMU_CAM_PGSZ_64K) ? 0xffff0000 :    \
+         ((pgsz) == MMU_CAM_PGSZ_4K)  ? 0xfffff000 : 0)
+
 /*
  * utilities for super page(16MB, 1MB, 64KB and 4KB)
  */
@@ -192,27 +190,25 @@ static inline struct omap_iommu *dev_to_omap_iommu(struct device *dev)
 /*
  * global functions
  */
-extern u32 omap_iommu_arch_version(void);
-
-extern void omap_iotlb_cr_to_e(struct cr_regs *cr, struct iotlb_entry *e);
-
-extern int
-omap_iopgtable_store_entry(struct omap_iommu *obj, struct iotlb_entry *e);
-
-extern void omap_iommu_save_ctx(struct device *dev);
-extern void omap_iommu_restore_ctx(struct device *dev);
-
-extern int omap_foreach_iommu_device(void *data,
-                                int (*fn)(struct device *, void *));
-
-extern int omap_install_iommu_arch(const struct iommu_functions *ops);
-extern void omap_uninstall_iommu_arch(const struct iommu_functions *ops);
-
+#ifdef CONFIG_OMAP_IOMMU_DEBUG
 extern ssize_t
 omap_iommu_dump_ctx(struct omap_iommu *obj, char *buf, ssize_t len);
 extern size_t
 omap_dump_tlb_entries(struct omap_iommu *obj, char *buf, ssize_t len);
 
+void omap_iommu_debugfs_init(void);
+void omap_iommu_debugfs_exit(void);
+
+void omap_iommu_debugfs_add(struct omap_iommu *obj);
+void omap_iommu_debugfs_remove(struct omap_iommu *obj);
+#else
+static inline void omap_iommu_debugfs_init(void) { }
+static inline void omap_iommu_debugfs_exit(void) { }
+
+static inline void omap_iommu_debugfs_add(struct omap_iommu *obj) { }
+static inline void omap_iommu_debugfs_remove(struct omap_iommu *obj) { }
+#endif
+
 /*
  * register accessors
  */
@@ -225,3 +221,5 @@ static inline void iommu_write_reg(struct omap_iommu *obj, u32 val, size_t offs)
 {
         __raw_writel(val, obj->regbase + offs);
 }
+
+#endif /* _OMAP_IOMMU_H */
diff --git a/drivers/iommu/omap-iommu2.c b/drivers/iommu/omap-iommu2.c
deleted file mode 100644
index 5e1ea3b0bf16..000000000000
--- a/drivers/iommu/omap-iommu2.c
+++ /dev/null
@@ -1,337 +0,0 @@
-/*
- * omap iommu: omap2/3 architecture specific functions
- *
- * Copyright (C) 2008-2009 Nokia Corporation
- *
- * Written by Hiroshi DOYU <Hiroshi.DOYU@nokia.com>,
- *              Paul Mundt and Toshihiro Kobayashi
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/err.h>
-#include <linux/device.h>
-#include <linux/io.h>
-#include <linux/jiffies.h>
-#include <linux/module.h>
-#include <linux/omap-iommu.h>
-#include <linux/slab.h>
-#include <linux/stringify.h>
-#include <linux/platform_data/iommu-omap.h>
-
-#include "omap-iommu.h"
-
-/*
- * omap2 architecture specific register bit definitions
- */
-#define IOMMU_ARCH_VERSION      0x00000011
-
-/* IRQSTATUS & IRQENABLE */
-#define MMU_IRQ_MULTIHITFAULT   (1 << 4)
-#define MMU_IRQ_TABLEWALKFAULT  (1 << 3)
-#define MMU_IRQ_EMUMISS         (1 << 2)
-#define MMU_IRQ_TRANSLATIONFAULT        (1 << 1)
-#define MMU_IRQ_TLBMISS         (1 << 0)
-
-#define __MMU_IRQ_FAULT         \
-        (MMU_IRQ_MULTIHITFAULT | MMU_IRQ_EMUMISS | MMU_IRQ_TRANSLATIONFAULT)
-#define MMU_IRQ_MASK            \
-        (__MMU_IRQ_FAULT | MMU_IRQ_TABLEWALKFAULT | MMU_IRQ_TLBMISS)
-#define MMU_IRQ_TWL_MASK        (__MMU_IRQ_FAULT | MMU_IRQ_TABLEWALKFAULT)
-#define MMU_IRQ_TLB_MISS_MASK   (__MMU_IRQ_FAULT | MMU_IRQ_TLBMISS)
-
-/* MMU_CNTL */
-#define MMU_CNTL_SHIFT          1
-#define MMU_CNTL_MASK           (7 << MMU_CNTL_SHIFT)
-#define MMU_CNTL_EML_TLB        (1 << 3)
-#define MMU_CNTL_TWL_EN         (1 << 2)
-#define MMU_CNTL_MMU_EN         (1 << 1)
-
-#define get_cam_va_mask(pgsz)                           \
-        (((pgsz) == MMU_CAM_PGSZ_16M) ? 0xff000000 :    \
-         ((pgsz) == MMU_CAM_PGSZ_1M)  ? 0xfff00000 :    \
-         ((pgsz) == MMU_CAM_PGSZ_64K) ? 0xffff0000 :    \
-         ((pgsz) == MMU_CAM_PGSZ_4K)  ? 0xfffff000 : 0)
-
-/* IOMMU errors */
-#define OMAP_IOMMU_ERR_TLB_MISS         (1 << 0)
-#define OMAP_IOMMU_ERR_TRANS_FAULT      (1 << 1)
-#define OMAP_IOMMU_ERR_EMU_MISS         (1 << 2)
-#define OMAP_IOMMU_ERR_TBLWALK_FAULT    (1 << 3)
-#define OMAP_IOMMU_ERR_MULTIHIT_FAULT   (1 << 4)
-
-static void __iommu_set_twl(struct omap_iommu *obj, bool on)
-{
-        u32 l = iommu_read_reg(obj, MMU_CNTL);
-
-        if (on)
-                iommu_write_reg(obj, MMU_IRQ_TWL_MASK, MMU_IRQENABLE);
-        else
-                iommu_write_reg(obj, MMU_IRQ_TLB_MISS_MASK, MMU_IRQENABLE);
-
-        l &= ~MMU_CNTL_MASK;
-        if (on)
-                l |= (MMU_CNTL_MMU_EN | MMU_CNTL_TWL_EN);
-        else
-                l |= (MMU_CNTL_MMU_EN);
-
-        iommu_write_reg(obj, l, MMU_CNTL);
-}
-
-
-static int omap2_iommu_enable(struct omap_iommu *obj)
-{
-        u32 l, pa;
-
-        if (!obj->iopgd || !IS_ALIGNED((u32)obj->iopgd,  SZ_16K))
-                return -EINVAL;
-
-        pa = virt_to_phys(obj->iopgd);
-        if (!IS_ALIGNED(pa, SZ_16K))
-                return -EINVAL;
-
-        l = iommu_read_reg(obj, MMU_REVISION);
-        dev_info(obj->dev, "%s: version %d.%d\n", obj->name,
-                 (l >> 4) & 0xf, l & 0xf);
-
-        iommu_write_reg(obj, pa, MMU_TTB);
-
-        if (obj->has_bus_err_back)
-                iommu_write_reg(obj, MMU_GP_REG_BUS_ERR_BACK_EN, MMU_GP_REG);
-
-        __iommu_set_twl(obj, true);
-
-        return 0;
-}
-
-static void omap2_iommu_disable(struct omap_iommu *obj)
-{
-        u32 l = iommu_read_reg(obj, MMU_CNTL);
-
-        l &= ~MMU_CNTL_MASK;
-        iommu_write_reg(obj, l, MMU_CNTL);
-
-        dev_dbg(obj->dev, "%s is shutting down\n", obj->name);
-}
-
-static void omap2_iommu_set_twl(struct omap_iommu *obj, bool on)
-{
-        __iommu_set_twl(obj, false);
-}
-
-static u32 omap2_iommu_fault_isr(struct omap_iommu *obj, u32 *ra)
-{
-        u32 stat, da;
-        u32 errs = 0;
-
-        stat = iommu_read_reg(obj, MMU_IRQSTATUS);
-        stat &= MMU_IRQ_MASK;
-        if (!stat) {
-                *ra = 0;
-                return 0;
-        }
-
-        da = iommu_read_reg(obj, MMU_FAULT_AD);
-        *ra = da;
-
-        if (stat & MMU_IRQ_TLBMISS)
-                errs |= OMAP_IOMMU_ERR_TLB_MISS;
-        if (stat & MMU_IRQ_TRANSLATIONFAULT)
-                errs |= OMAP_IOMMU_ERR_TRANS_FAULT;
-        if (stat & MMU_IRQ_EMUMISS)
-                errs |= OMAP_IOMMU_ERR_EMU_MISS;
-        if (stat & MMU_IRQ_TABLEWALKFAULT)
-                errs |= OMAP_IOMMU_ERR_TBLWALK_FAULT;
-        if (stat & MMU_IRQ_MULTIHITFAULT)
-                errs |= OMAP_IOMMU_ERR_MULTIHIT_FAULT;
-        iommu_write_reg(obj, stat, MMU_IRQSTATUS);
-
-        return errs;
-}
-
-static void omap2_tlb_read_cr(struct omap_iommu *obj, struct cr_regs *cr)
-{
-        cr->cam = iommu_read_reg(obj, MMU_READ_CAM);
-        cr->ram = iommu_read_reg(obj, MMU_READ_RAM);
-}
-
-static void omap2_tlb_load_cr(struct omap_iommu *obj, struct cr_regs *cr)
-{
-        iommu_write_reg(obj, cr->cam | MMU_CAM_V, MMU_CAM);
-        iommu_write_reg(obj, cr->ram, MMU_RAM);
-}
-
-static u32 omap2_cr_to_virt(struct cr_regs *cr)
-{
-        u32 page_size = cr->cam & MMU_CAM_PGSZ_MASK;
-        u32 mask = get_cam_va_mask(cr->cam & page_size);
-
-        return cr->cam & mask;
-}
-
-static struct cr_regs *omap2_alloc_cr(struct omap_iommu *obj,
-                                                struct iotlb_entry *e)
-{
-        struct cr_regs *cr;
-
-        if (e->da & ~(get_cam_va_mask(e->pgsz))) {
-                dev_err(obj->dev, "%s:\twrong alignment: %08x\n", __func__,
-                        e->da);
-                return ERR_PTR(-EINVAL);
-        }
-
-        cr = kmalloc(sizeof(*cr), GFP_KERNEL);
-        if (!cr)
-                return ERR_PTR(-ENOMEM);
-
-        cr->cam = (e->da & MMU_CAM_VATAG_MASK) | e->prsvd | e->pgsz | e->valid;
-        cr->ram = e->pa | e->endian | e->elsz | e->mixed;
-
-        return cr;
-}
-
-static inline int omap2_cr_valid(struct cr_regs *cr)
-{
-        return cr->cam & MMU_CAM_V;
-}
-
-static u32 omap2_get_pte_attr(struct iotlb_entry *e)
-{
-        u32 attr;
-
-        attr = e->mixed << 5;
-        attr |= e->endian;
-        attr |= e->elsz >> 3;
-        attr <<= (((e->pgsz == MMU_CAM_PGSZ_4K) ||
-                        (e->pgsz == MMU_CAM_PGSZ_64K)) ? 0 : 6);
-        return attr;
-}
-
-static ssize_t
-omap2_dump_cr(struct omap_iommu *obj, struct cr_regs *cr, char *buf)
-{
-        char *p = buf;
-
-        /* FIXME: Need more detail analysis of cam/ram */
-        p += sprintf(p, "%08x %08x %01x\n", cr->cam, cr->ram,
-                                        (cr->cam & MMU_CAM_P) ? 1 : 0);
-
-        return p - buf;
-}
-
-#define pr_reg(name)                                                    \
-        do {                                                            \
-                ssize_t bytes;                                          \
-                const char *str = "%20s: %08x\n";                       \
-                const int maxcol = 32;                                  \
-                bytes = snprintf(p, maxcol, str, __stringify(name),     \
-                                 iommu_read_reg(obj, MMU_##name));      \
-                p += bytes;                                             \
-                len -= bytes;                                           \
-                if (len < maxcol)                                       \
-                        goto out;                                       \
-        } while (0)
-
-static ssize_t
-omap2_iommu_dump_ctx(struct omap_iommu *obj, char *buf, ssize_t len)
-{
-        char *p = buf;
-
-        pr_reg(REVISION);
-        pr_reg(IRQSTATUS);
-        pr_reg(IRQENABLE);
-        pr_reg(WALKING_ST);
-        pr_reg(CNTL);
-        pr_reg(FAULT_AD);
-        pr_reg(TTB);
-        pr_reg(LOCK);
-        pr_reg(LD_TLB);
-        pr_reg(CAM);
-        pr_reg(RAM);
-        pr_reg(GFLUSH);
-        pr_reg(FLUSH_ENTRY);
-        pr_reg(READ_CAM);
-        pr_reg(READ_RAM);
-        pr_reg(EMU_FAULT_AD);
-out:
-        return p - buf;
-}
-
-static void omap2_iommu_save_ctx(struct omap_iommu *obj)
-{
-        int i;
-        u32 *p = obj->ctx;
-
-        for (i = 0; i < (MMU_REG_SIZE / sizeof(u32)); i++) {
-                p[i] = iommu_read_reg(obj, i * sizeof(u32));
-                dev_dbg(obj->dev, "%s\t[%02d] %08x\n", __func__, i, p[i]);
-        }
-
-        BUG_ON(p[0] != IOMMU_ARCH_VERSION);
-}
-
-static void omap2_iommu_restore_ctx(struct omap_iommu *obj)
-{
-        int i;
-        u32 *p = obj->ctx;
-
-        for (i = 0; i < (MMU_REG_SIZE / sizeof(u32)); i++) {
-                iommu_write_reg(obj, p[i], i * sizeof(u32));
-                dev_dbg(obj->dev, "%s\t[%02d] %08x\n", __func__, i, p[i]);
-        }
-
-        BUG_ON(p[0] != IOMMU_ARCH_VERSION);
-}
-
-static void omap2_cr_to_e(struct cr_regs *cr, struct iotlb_entry *e)
-{
-        e->da           = cr->cam & MMU_CAM_VATAG_MASK;
-        e->pa           = cr->ram & MMU_RAM_PADDR_MASK;
-        e->valid        = cr->cam & MMU_CAM_V;
-        e->pgsz         = cr->cam & MMU_CAM_PGSZ_MASK;
-        e->endian       = cr->ram & MMU_RAM_ENDIAN_MASK;
-        e->elsz         = cr->ram & MMU_RAM_ELSZ_MASK;
-        e->mixed        = cr->ram & MMU_RAM_MIXED;
-}
-
-static const struct iommu_functions omap2_iommu_ops = {
-        .version        = IOMMU_ARCH_VERSION,
-
-        .enable         = omap2_iommu_enable,
-        .disable        = omap2_iommu_disable,
-        .set_twl        = omap2_iommu_set_twl,
-        .fault_isr      = omap2_iommu_fault_isr,
-
-        .tlb_read_cr    = omap2_tlb_read_cr,
-        .tlb_load_cr    = omap2_tlb_load_cr,
-
-        .cr_to_e        = omap2_cr_to_e,
-        .cr_to_virt     = omap2_cr_to_virt,
-        .alloc_cr       = omap2_alloc_cr,
-        .cr_valid       = omap2_cr_valid,
-        .dump_cr        = omap2_dump_cr,
-
-        .get_pte_attr   = omap2_get_pte_attr,
-
-        .save_ctx       = omap2_iommu_save_ctx,
-        .restore_ctx    = omap2_iommu_restore_ctx,
-        .dump_ctx       = omap2_iommu_dump_ctx,
-};
-
-static int __init omap2_iommu_init(void)
-{
-        return omap_install_iommu_arch(&omap2_iommu_ops);
-}
-module_init(omap2_iommu_init);
-
-static void __exit omap2_iommu_exit(void)
-{
-        omap_uninstall_iommu_arch(&omap2_iommu_ops);
-}
-module_exit(omap2_iommu_exit);
-
-MODULE_AUTHOR("Hiroshi DOYU, Paul Mundt and Toshihiro Kobayashi");
-MODULE_DESCRIPTION("omap iommu: omap2/3 architecture specific functions");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
new file mode 100644
index 000000000000..b2023af384b9
--- /dev/null
+++ b/drivers/iommu/rockchip-iommu.c
@@ -0,0 +1,1038 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <asm/cacheflush.h>
+#include <asm/pgtable.h>
+#include <linux/compiler.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/iommu.h>
+#include <linux/jiffies.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+
+/** MMU register offsets */
+#define RK_MMU_DTE_ADDR         0x00    /* Directory table address */
+#define RK_MMU_STATUS           0x04
+#define RK_MMU_COMMAND          0x08
+#define RK_MMU_PAGE_FAULT_ADDR  0x0C    /* IOVA of last page fault */
+#define RK_MMU_ZAP_ONE_LINE     0x10    /* Shootdown one IOTLB entry */
+#define RK_MMU_INT_RAWSTAT      0x14    /* IRQ status ignoring mask */
+#define RK_MMU_INT_CLEAR        0x18    /* Acknowledge and re-arm irq */
+#define RK_MMU_INT_MASK         0x1C    /* IRQ enable */
+#define RK_MMU_INT_STATUS       0x20    /* IRQ status after masking */
+#define RK_MMU_AUTO_GATING      0x24
+
+#define DTE_ADDR_DUMMY          0xCAFEBABE
+#define FORCE_RESET_TIMEOUT     100     /* ms */
+
+/* RK_MMU_STATUS fields */
+#define RK_MMU_STATUS_PAGING_ENABLED       BIT(0)
+#define RK_MMU_STATUS_PAGE_FAULT_ACTIVE    BIT(1)
+#define RK_MMU_STATUS_STALL_ACTIVE         BIT(2)
+#define RK_MMU_STATUS_IDLE                 BIT(3)
+#define RK_MMU_STATUS_REPLAY_BUFFER_EMPTY  BIT(4)
+#define RK_MMU_STATUS_PAGE_FAULT_IS_WRITE  BIT(5)
+#define RK_MMU_STATUS_STALL_NOT_ACTIVE     BIT(31)
+
+/* RK_MMU_COMMAND command values */
+#define RK_MMU_CMD_ENABLE_PAGING    0  /* Enable memory translation */
+#define RK_MMU_CMD_DISABLE_PAGING   1  /* Disable memory translation */
+#define RK_MMU_CMD_ENABLE_STALL     2  /* Stall paging to allow other cmds */
+#define RK_MMU_CMD_DISABLE_STALL    3  /* Stop stall re-enables paging */
+#define RK_MMU_CMD_ZAP_CACHE        4  /* Shoot down entire IOTLB */
+#define RK_MMU_CMD_PAGE_FAULT_DONE  5  /* Clear page fault */
+#define RK_MMU_CMD_FORCE_RESET      6  /* Reset all registers */
+
+/* RK_MMU_INT_* register fields */
+#define RK_MMU_IRQ_PAGE_FAULT    0x01  /* page fault */
+#define RK_MMU_IRQ_BUS_ERROR     0x02  /* bus read error */
+#define RK_MMU_IRQ_MASK          (RK_MMU_IRQ_PAGE_FAULT | RK_MMU_IRQ_BUS_ERROR)
+
+#define NUM_DT_ENTRIES 1024
+#define NUM_PT_ENTRIES 1024
+
+#define SPAGE_ORDER 12
+#define SPAGE_SIZE (1 << SPAGE_ORDER)
+
+ /*
+  * Support mapping any size that fits in one page table:
+  *   4 KiB to 4 MiB
+  */
+#define RK_IOMMU_PGSIZE_BITMAP 0x007ff000
+
+#define IOMMU_REG_POLL_COUNT_FAST 1000
+
+struct rk_iommu_domain {
+        struct list_head iommus;
+        u32 *dt; /* page directory table */
+        spinlock_t iommus_lock; /* lock for iommus list */
+        spinlock_t dt_lock; /* lock for modifying page directory table */
+};
+
+struct rk_iommu {
+        struct device *dev;
+        void __iomem *base;
+        int irq;
+        struct list_head node; /* entry in rk_iommu_domain.iommus */
+        struct iommu_domain *domain; /* domain to which iommu is attached */
+};
+
+static inline void rk_table_flush(u32 *va, unsigned int count)
+{
+        phys_addr_t pa_start = virt_to_phys(va);
+        phys_addr_t pa_end = virt_to_phys(va + count);
+        size_t size = pa_end - pa_start;
+
+        __cpuc_flush_dcache_area(va, size);
+        outer_flush_range(pa_start, pa_end);
+}
+
+/**
+ * Inspired by _wait_for in intel_drv.h
+ * This is NOT safe for use in interrupt context.
+ *
+ * Note that it's important that we check the condition again after having
+ * timed out, since the timeout could be due to preemption or similar and
+ * we've never had a chance to check the condition before the timeout.
+ */
+#define rk_wait_for(COND, MS) ({ \
+        unsigned long timeout__ = jiffies + msecs_to_jiffies(MS) + 1;   \
+        int ret__ = 0;                                                  \
+        while (!(COND)) {                                               \
+                if (time_after(jiffies, timeout__)) {                   \
+                        ret__ = (COND) ? 0 : -ETIMEDOUT;                \
+                        break;                                          \
+                }                                                       \
+                usleep_range(50, 100);                                  \
+        }                                                               \
+        ret__;                                                          \
+})
+
+/*
+ * The Rockchip rk3288 iommu uses a 2-level page table.
+ * The first level is the "Directory Table" (DT).
+ * The DT consists of 1024 4-byte Directory Table Entries (DTEs), each pointing
+ * to a "Page Table".
+ * The second level is the 1024 Page Tables (PT).
+ * Each PT consists of 1024 4-byte Page Table Entries (PTEs), each pointing to
+ * a 4 KB page of physical memory.
+ *
+ * The DT and each PT fits in a single 4 KB page (4-bytes * 1024 entries).
+ * Each iommu device has a MMU_DTE_ADDR register that contains the physical
+ * address of the start of the DT page.
+ *
+ * The structure of the page table is as follows:
+ *
+ *                   DT
+ * MMU_DTE_ADDR -> +-----+
+ *                 |     |
+ *                 +-----+     PT
+ *                 | DTE | -> +-----+
+ *                 +-----+    |     |     Memory
+ *                 |     |    +-----+     Page
+ *                 |     |    | PTE | -> +-----+
+ *                 +-----+    +-----+    |     |
+ *                            |     |    |     |
+ *                            |     |    |     |
+ *                            +-----+    |     |
+ *                                       |     |
+ *                                       |     |
+ *                                       +-----+
+ */
+
+/*
+ * Each DTE has a PT address and a valid bit:
+ * +---------------------+-----------+-+
+ * | PT address          | Reserved  |V|
+ * +---------------------+-----------+-+
+ *  31:12 - PT address (PTs always starts on a 4 KB boundary)
+ *  11: 1 - Reserved
+ *      0 - 1 if PT @ PT address is valid
+ */
+#define RK_DTE_PT_ADDRESS_MASK    0xfffff000
+#define RK_DTE_PT_VALID           BIT(0)
+
+static inline phys_addr_t rk_dte_pt_address(u32 dte)
+{
+        return (phys_addr_t)dte & RK_DTE_PT_ADDRESS_MASK;
+}
+
+static inline bool rk_dte_is_pt_valid(u32 dte)
+{
+        return dte & RK_DTE_PT_VALID;
+}
+
+static u32 rk_mk_dte(u32 *pt)
+{
+        phys_addr_t pt_phys = virt_to_phys(pt);
+        return (pt_phys & RK_DTE_PT_ADDRESS_MASK) | RK_DTE_PT_VALID;
+}
+
+/*
+ * Each PTE has a Page address, some flags and a valid bit:
+ * +---------------------+---+-------+-+
+ * | Page address        |Rsv| Flags |V|
+ * +---------------------+---+-------+-+
+ *  31:12 - Page address (Pages always start on a 4 KB boundary)
+ *  11: 9 - Reserved
+ *   8: 1 - Flags
+ *      8 - Read allocate - allocate cache space on read misses
+ *      7 - Read cache - enable cache & prefetch of data
+ *      6 - Write buffer - enable delaying writes on their way to memory
+ *      5 - Write allocate - allocate cache space on write misses
+ *      4 - Write cache - different writes can be merged together
+ *      3 - Override cache attributes
+ *          if 1, bits 4-8 control cache attributes
+ *          if 0, the system bus defaults are used
+ *      2 - Writable
+ *      1 - Readable
+ *      0 - 1 if Page @ Page address is valid
+ */
+#define RK_PTE_PAGE_ADDRESS_MASK  0xfffff000
+#define RK_PTE_PAGE_FLAGS_MASK    0x000001fe
+#define RK_PTE_PAGE_WRITABLE      BIT(2)
+#define RK_PTE_PAGE_READABLE      BIT(1)
+#define RK_PTE_PAGE_VALID         BIT(0)
+
+static inline phys_addr_t rk_pte_page_address(u32 pte)
+{
+        return (phys_addr_t)pte & RK_PTE_PAGE_ADDRESS_MASK;
+}
+
+static inline bool rk_pte_is_page_valid(u32 pte)
+{
+        return pte & RK_PTE_PAGE_VALID;
+}
+
+/* TODO: set cache flags per prot IOMMU_CACHE */
+static u32 rk_mk_pte(phys_addr_t page, int prot)
+{
+        u32 flags = 0;
+        flags |= (prot & IOMMU_READ) ? RK_PTE_PAGE_READABLE : 0;
+        flags |= (prot & IOMMU_WRITE) ? RK_PTE_PAGE_WRITABLE : 0;
+        page &= RK_PTE_PAGE_ADDRESS_MASK;
+        return page | flags | RK_PTE_PAGE_VALID;
+}
+
+static u32 rk_mk_pte_invalid(u32 pte)
+{
+        return pte & ~RK_PTE_PAGE_VALID;
+}
+
+/*
+ * rk3288 iova (IOMMU Virtual Address) format
+ *  31       22.21       12.11          0
+ * +-----------+-----------+-------------+
+ * | DTE index | PTE index | Page offset |
+ * +-----------+-----------+-------------+
+ *  31:22 - DTE index   - index of DTE in DT
+ *  21:12 - PTE index   - index of PTE in PT @ DTE.pt_address
+ *  11: 0 - Page offset - offset into page @ PTE.page_address
+ */
+#define RK_IOVA_DTE_MASK    0xffc00000
+#define RK_IOVA_DTE_SHIFT   22
+#define RK_IOVA_PTE_MASK    0x003ff000
+#define RK_IOVA_PTE_SHIFT   12
+#define RK_IOVA_PAGE_MASK   0x00000fff
+#define RK_IOVA_PAGE_SHIFT  0
+
+static u32 rk_iova_dte_index(dma_addr_t iova)
+{
+        return (u32)(iova & RK_IOVA_DTE_MASK) >> RK_IOVA_DTE_SHIFT;
+}
+
+static u32 rk_iova_pte_index(dma_addr_t iova)
+{
+        return (u32)(iova & RK_IOVA_PTE_MASK) >> RK_IOVA_PTE_SHIFT;
+}
+
+static u32 rk_iova_page_offset(dma_addr_t iova)
+{
+        return (u32)(iova & RK_IOVA_PAGE_MASK) >> RK_IOVA_PAGE_SHIFT;
+}
+
+static u32 rk_iommu_read(struct rk_iommu *iommu, u32 offset)
+{
+        return readl(iommu->base + offset);
+}
+
+static void rk_iommu_write(struct rk_iommu *iommu, u32 offset, u32 value)
+{
+        writel(value, iommu->base + offset);
+}
+
+static void rk_iommu_command(struct rk_iommu *iommu, u32 command)
+{
+        writel(command, iommu->base + RK_MMU_COMMAND);
+}
+
+static void rk_iommu_zap_lines(struct rk_iommu *iommu, dma_addr_t iova,
+                               size_t size)
+{
+        dma_addr_t iova_end = iova + size;
+        /*
+         * TODO(djkurtz): Figure out when it is more efficient to shootdown the
+         * entire iotlb rather than iterate over individual iovas.
+         */
+        for (; iova < iova_end; iova += SPAGE_SIZE)
+                rk_iommu_write(iommu, RK_MMU_ZAP_ONE_LINE, iova);
+}
+
+static bool rk_iommu_is_stall_active(struct rk_iommu *iommu)
+{
+        return rk_iommu_read(iommu, RK_MMU_STATUS) & RK_MMU_STATUS_STALL_ACTIVE;
+}
+
+static bool rk_iommu_is_paging_enabled(struct rk_iommu *iommu)
+{
+        return rk_iommu_read(iommu, RK_MMU_STATUS) &
+                             RK_MMU_STATUS_PAGING_ENABLED;
+}
+
+static int rk_iommu_enable_stall(struct rk_iommu *iommu)
+{
+        int ret;
+
+        if (rk_iommu_is_stall_active(iommu))
+                return 0;
+
+        /* Stall can only be enabled if paging is enabled */
+        if (!rk_iommu_is_paging_enabled(iommu))
+                return 0;
+
+        rk_iommu_command(iommu, RK_MMU_CMD_ENABLE_STALL);
+
+        ret = rk_wait_for(rk_iommu_is_stall_active(iommu), 1);
+        if (ret)
+                dev_err(iommu->dev, "Enable stall request timed out, status: %#08x\n",
+                        rk_iommu_read(iommu, RK_MMU_STATUS));
+
+        return ret;
+}
+
+static int rk_iommu_disable_stall(struct rk_iommu *iommu)
+{
+        int ret;
+
+        if (!rk_iommu_is_stall_active(iommu))
+                return 0;
+
+        rk_iommu_command(iommu, RK_MMU_CMD_DISABLE_STALL);
+
+        ret = rk_wait_for(!rk_iommu_is_stall_active(iommu), 1);
+        if (ret)
+                dev_err(iommu->dev, "Disable stall request timed out, status: %#08x\n",
+                        rk_iommu_read(iommu, RK_MMU_STATUS));
+
+        return ret;
+}
+
+static int rk_iommu_enable_paging(struct rk_iommu *iommu)
+{
+        int ret;
+
+        if (rk_iommu_is_paging_enabled(iommu))
+                return 0;
+
+        rk_iommu_command(iommu, RK_MMU_CMD_ENABLE_PAGING);
+
+        ret = rk_wait_for(rk_iommu_is_paging_enabled(iommu), 1);
+        if (ret)
+                dev_err(iommu->dev, "Enable paging request timed out, status: %#08x\n",
+                        rk_iommu_read(iommu, RK_MMU_STATUS));
+
+        return ret;
+}
+
+static int rk_iommu_disable_paging(struct rk_iommu *iommu)
+{
+        int ret;
+
+        if (!rk_iommu_is_paging_enabled(iommu))
+                return 0;
+
+        rk_iommu_command(iommu, RK_MMU_CMD_DISABLE_PAGING);
+
+        ret = rk_wait_for(!rk_iommu_is_paging_enabled(iommu), 1);
+        if (ret)
+                dev_err(iommu->dev, "Disable paging request timed out, status: %#08x\n",
+                        rk_iommu_read(iommu, RK_MMU_STATUS));
+
+        return ret;
+}
+
+static int rk_iommu_force_reset(struct rk_iommu *iommu)
+{
+        int ret;
+        u32 dte_addr;
+
+        /*
+         * Check if register DTE_ADDR is working by writing DTE_ADDR_DUMMY
+         * and verifying that upper 5 nybbles are read back.
+         */
+        rk_iommu_write(iommu, RK_MMU_DTE_ADDR, DTE_ADDR_DUMMY);
+
+        dte_addr = rk_iommu_read(iommu, RK_MMU_DTE_ADDR);
+        if (dte_addr != (DTE_ADDR_DUMMY & RK_DTE_PT_ADDRESS_MASK)) {
+                dev_err(iommu->dev, "Error during raw reset. MMU_DTE_ADDR is not functioning\n");
+                return -EFAULT;
+        }
+
+        rk_iommu_command(iommu, RK_MMU_CMD_FORCE_RESET);
+
+        ret = rk_wait_for(rk_iommu_read(iommu, RK_MMU_DTE_ADDR) == 0x00000000,
+                          FORCE_RESET_TIMEOUT);
+        if (ret)
+                dev_err(iommu->dev, "FORCE_RESET command timed out\n");
+
+        return ret;
+}
+
+static void log_iova(struct rk_iommu *iommu, dma_addr_t iova)
+{
+        u32 dte_index, pte_index, page_offset;
+        u32 mmu_dte_addr;
+        phys_addr_t mmu_dte_addr_phys, dte_addr_phys;
+        u32 *dte_addr;
+        u32 dte;
+        phys_addr_t pte_addr_phys = 0;
+        u32 *pte_addr = NULL;
+        u32 pte = 0;
+        phys_addr_t page_addr_phys = 0;
+        u32 page_flags = 0;
+
+        dte_index = rk_iova_dte_index(iova);
+        pte_index = rk_iova_pte_index(iova);
+        page_offset = rk_iova_page_offset(iova);
+
+        mmu_dte_addr = rk_iommu_read(iommu, RK_MMU_DTE_ADDR);
+        mmu_dte_addr_phys = (phys_addr_t)mmu_dte_addr;
+
+        dte_addr_phys = mmu_dte_addr_phys + (4 * dte_index);
+        dte_addr = phys_to_virt(dte_addr_phys);
+        dte = *dte_addr;
+
+        if (!rk_dte_is_pt_valid(dte))
+                goto print_it;
+
+        pte_addr_phys = rk_dte_pt_address(dte) + (pte_index * 4);
+        pte_addr = phys_to_virt(pte_addr_phys);
+        pte = *pte_addr;
+
+        if (!rk_pte_is_page_valid(pte))
+                goto print_it;
+
+        page_addr_phys = rk_pte_page_address(pte) + page_offset;
+        page_flags = pte & RK_PTE_PAGE_FLAGS_MASK;
+
+print_it:
+        dev_err(iommu->dev, "iova = %pad: dte_index: %#03x pte_index: %#03x page_offset: %#03x\n",
+                &iova, dte_index, pte_index, page_offset);
+        dev_err(iommu->dev, "mmu_dte_addr: %pa dte@%pa: %#08x valid: %u pte@%pa: %#08x valid: %u page@%pa flags: %#03x\n",
+                &mmu_dte_addr_phys, &dte_addr_phys, dte,
+                rk_dte_is_pt_valid(dte), &pte_addr_phys, pte,
+                rk_pte_is_page_valid(pte), &page_addr_phys, page_flags);
+}
+
+static irqreturn_t rk_iommu_irq(int irq, void *dev_id)
+{
+        struct rk_iommu *iommu = dev_id;
+        u32 status;
+        u32 int_status;
+        dma_addr_t iova;
+
+        int_status = rk_iommu_read(iommu, RK_MMU_INT_STATUS);
+        if (int_status == 0)
+                return IRQ_NONE;
+
+        iova = rk_iommu_read(iommu, RK_MMU_PAGE_FAULT_ADDR);
+
+        if (int_status & RK_MMU_IRQ_PAGE_FAULT) {
+                int flags;
+
+                status = rk_iommu_read(iommu, RK_MMU_STATUS);
+                flags = (status & RK_MMU_STATUS_PAGE_FAULT_IS_WRITE) ?
+                                IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
+
+                dev_err(iommu->dev, "Page fault at %pad of type %s\n",
+                        &iova,
+                        (flags == IOMMU_FAULT_WRITE) ? "write" : "read");
+
+                log_iova(iommu, iova);
+
+                /*
+                 * Report page fault to any installed handlers.
+                 * Ignore the return code, though, since we always zap cache
+                 * and clear the page fault anyway.
+                 */
+                if (iommu->domain)
+                        report_iommu_fault(iommu->domain, iommu->dev, iova,
+                                           flags);
+                else
+                        dev_err(iommu->dev, "Page fault while iommu not attached to domain?\n");
+
+                rk_iommu_command(iommu, RK_MMU_CMD_ZAP_CACHE);
+                rk_iommu_command(iommu, RK_MMU_CMD_PAGE_FAULT_DONE);
+        }
+
+        if (int_status & RK_MMU_IRQ_BUS_ERROR)
+                dev_err(iommu->dev, "BUS_ERROR occurred at %pad\n", &iova);
+
+        if (int_status & ~RK_MMU_IRQ_MASK)
+                dev_err(iommu->dev, "unexpected int_status: %#08x\n",
+                        int_status);
+
+        rk_iommu_write(iommu, RK_MMU_INT_CLEAR, int_status);
+
+        return IRQ_HANDLED;
+}
+
+static phys_addr_t rk_iommu_iova_to_phys(struct iommu_domain *domain,
+                                         dma_addr_t iova)
+{
+        struct rk_iommu_domain *rk_domain = domain->priv;
+        unsigned long flags;
+        phys_addr_t pt_phys, phys = 0;
+        u32 dte, pte;
+        u32 *page_table;
+
+        spin_lock_irqsave(&rk_domain->dt_lock, flags);
+
+        dte = rk_domain->dt[rk_iova_dte_index(iova)];
+        if (!rk_dte_is_pt_valid(dte))
+                goto out;
+
+        pt_phys = rk_dte_pt_address(dte);
+        page_table = (u32 *)phys_to_virt(pt_phys);
+        pte = page_table[rk_iova_pte_index(iova)];
+        if (!rk_pte_is_page_valid(pte))
+                goto out;
+
+        phys = rk_pte_page_address(pte) + rk_iova_page_offset(iova);
+out:
+        spin_unlock_irqrestore(&rk_domain->dt_lock, flags);
+
+        return phys;
+}
+
+static void rk_iommu_zap_iova(struct rk_iommu_domain *rk_domain,
+                              dma_addr_t iova, size_t size)
+{
+        struct list_head *pos;
+        unsigned long flags;
+
+        /* shootdown these iova from all iommus using this domain */
+        spin_lock_irqsave(&rk_domain->iommus_lock, flags);
+        list_for_each(pos, &rk_domain->iommus) {
+                struct rk_iommu *iommu;
+                iommu = list_entry(pos, struct rk_iommu, node);
+                rk_iommu_zap_lines(iommu, iova, size);
+        }
+        spin_unlock_irqrestore(&rk_domain->iommus_lock, flags);
+}
+
+static u32 *rk_dte_get_page_table(struct rk_iommu_domain *rk_domain,
+                                  dma_addr_t iova)
+{
+        u32 *page_table, *dte_addr;
+        u32 dte;
+        phys_addr_t pt_phys;
+
+        assert_spin_locked(&rk_domain->dt_lock);
+
+        dte_addr = &rk_domain->dt[rk_iova_dte_index(iova)];
+        dte = *dte_addr;
+        if (rk_dte_is_pt_valid(dte))
+                goto done;
+
+        page_table = (u32 *)get_zeroed_page(GFP_ATOMIC | GFP_DMA32);
+        if (!page_table)
+                return ERR_PTR(-ENOMEM);
+
+        dte = rk_mk_dte(page_table);
+        *dte_addr = dte;
+
+        rk_table_flush(page_table, NUM_PT_ENTRIES);
+        rk_table_flush(dte_addr, 1);
+
+        /*
+         * Zap the first iova of newly allocated page table so iommu evicts
+         * old cached value of new dte from the iotlb.
+         */
+        rk_iommu_zap_iova(rk_domain, iova, SPAGE_SIZE);
+
+done:
+        pt_phys = rk_dte_pt_address(dte);
+        return (u32 *)phys_to_virt(pt_phys);
+}
+
+static size_t rk_iommu_unmap_iova(struct rk_iommu_domain *rk_domain,
+                                  u32 *pte_addr, dma_addr_t iova, size_t size)
+{
+        unsigned int pte_count;
+        unsigned int pte_total = size / SPAGE_SIZE;
+
+        assert_spin_locked(&rk_domain->dt_lock);
+
+        for (pte_count = 0; pte_count < pte_total; pte_count++) {
+                u32 pte = pte_addr[pte_count];
+                if (!rk_pte_is_page_valid(pte))
+                        break;
+
+                pte_addr[pte_count] = rk_mk_pte_invalid(pte);
+        }
+
+        rk_table_flush(pte_addr, pte_count);
+
+        return pte_count * SPAGE_SIZE;
+}
+
+static int rk_iommu_map_iova(struct rk_iommu_domain *rk_domain, u32 *pte_addr,
+                             dma_addr_t iova, phys_addr_t paddr, size_t size,
+                             int prot)
+{
+        unsigned int pte_count;
+        unsigned int pte_total = size / SPAGE_SIZE;
+        phys_addr_t page_phys;
+
+        assert_spin_locked(&rk_domain->dt_lock);
+
+        for (pte_count = 0; pte_count < pte_total; pte_count++) {
+                u32 pte = pte_addr[pte_count];
+
+                if (rk_pte_is_page_valid(pte))
+                        goto unwind;
+
+                pte_addr[pte_count] = rk_mk_pte(paddr, prot);
+
+                paddr += SPAGE_SIZE;
+        }
+
+        rk_table_flush(pte_addr, pte_count);
+
+        return 0;
+unwind:
+        /* Unmap the range of iovas that we just mapped */
+        rk_iommu_unmap_iova(rk_domain, pte_addr, iova, pte_count * SPAGE_SIZE);
+
+        iova += pte_count * SPAGE_SIZE;
+        page_phys = rk_pte_page_address(pte_addr[pte_count]);
+        pr_err("iova: %pad already mapped to %pa cannot remap to phys: %pa prot: %#x\n",
+               &iova, &page_phys, &paddr, prot);
+
+        return -EADDRINUSE;
+}
+
+static int rk_iommu_map(struct iommu_domain *domain, unsigned long _iova,
+                        phys_addr_t paddr, size_t size, int prot)
+{
+        struct rk_iommu_domain *rk_domain = domain->priv;
+        unsigned long flags;
+        dma_addr_t iova = (dma_addr_t)_iova;
+        u32 *page_table, *pte_addr;
+        int ret;
+
+        spin_lock_irqsave(&rk_domain->dt_lock, flags);
+
+        /*
+         * pgsize_bitmap specifies iova sizes that fit in one page table
+         * (1024 4-KiB pages = 4 MiB).
+         * So, size will always be 4096 <= size <= 4194304.
+         * Since iommu_map() guarantees that both iova and size will be
+         * aligned, we will always only be mapping from a single dte here.
+         */
+        page_table = rk_dte_get_page_table(rk_domain, iova);
+        if (IS_ERR(page_table)) {
+                spin_unlock_irqrestore(&rk_domain->dt_lock, flags);
+                return PTR_ERR(page_table);
+        }
+
+        pte_addr = &page_table[rk_iova_pte_index(iova)];
+        ret = rk_iommu_map_iova(rk_domain, pte_addr, iova, paddr, size, prot);
+        spin_unlock_irqrestore(&rk_domain->dt_lock, flags);
+
+        return ret;
+}
+
+static size_t rk_iommu_unmap(struct iommu_domain *domain, unsigned long _iova,
+                             size_t size)
+{
+        struct rk_iommu_domain *rk_domain = domain->priv;
+        unsigned long flags;
+        dma_addr_t iova = (dma_addr_t)_iova;
+        phys_addr_t pt_phys;
+        u32 dte;
+        u32 *pte_addr;
+        size_t unmap_size;
+
+        spin_lock_irqsave(&rk_domain->dt_lock, flags);
+
+        /*
+         * pgsize_bitmap specifies iova sizes that fit in one page table
+         * (1024 4-KiB pages = 4 MiB).
+         * So, size will always be 4096 <= size <= 4194304.
+         * Since iommu_unmap() guarantees that both iova and size will be
+         * aligned, we will always only be unmapping from a single dte here.
+         */
+        dte = rk_domain->dt[rk_iova_dte_index(iova)];
+        /* Just return 0 if iova is unmapped */
+        if (!rk_dte_is_pt_valid(dte)) {
+                spin_unlock_irqrestore(&rk_domain->dt_lock, flags);
+                return 0;
+        }
+
+        pt_phys = rk_dte_pt_address(dte);
+        pte_addr = (u32 *)phys_to_virt(pt_phys) + rk_iova_pte_index(iova);
+        unmap_size = rk_iommu_unmap_iova(rk_domain, pte_addr, iova, size);
+
+        spin_unlock_irqrestore(&rk_domain->dt_lock, flags);
+
+        /* Shootdown iotlb entries for iova range that was just unmapped */
+        rk_iommu_zap_iova(rk_domain, iova, unmap_size);
+
+        return unmap_size;
+}
+
+static struct rk_iommu *rk_iommu_from_dev(struct device *dev)
+{
+        struct iommu_group *group;
+        struct device *iommu_dev;
+        struct rk_iommu *rk_iommu;
+
+        group = iommu_group_get(dev);
+        if (!group)
+                return NULL;
+        iommu_dev = iommu_group_get_iommudata(group);
+        rk_iommu = dev_get_drvdata(iommu_dev);
+        iommu_group_put(group);
+
+        return rk_iommu;
+}
+
+static int rk_iommu_attach_device(struct iommu_domain *domain,
+                                  struct device *dev)
+{
+        struct rk_iommu *iommu;
+        struct rk_iommu_domain *rk_domain = domain->priv;
+        unsigned long flags;
+        int ret;
+        phys_addr_t dte_addr;
+
+        /*
+         * Allow 'virtual devices' (e.g., drm) to attach to domain.
+         * Such a device does not belong to an iommu group.
+         */
+        iommu = rk_iommu_from_dev(dev);
+        if (!iommu)
+                return 0;
+
+        ret = rk_iommu_enable_stall(iommu);
+        if (ret)
+                return ret;
+
+        ret = rk_iommu_force_reset(iommu);
+        if (ret)
+                return ret;
+
+        iommu->domain = domain;
+
+        ret = devm_request_irq(dev, iommu->irq, rk_iommu_irq,
+                               IRQF_SHARED, dev_name(dev), iommu);
+        if (ret)
+                return ret;
+
+        dte_addr = virt_to_phys(rk_domain->dt);
+        rk_iommu_write(iommu, RK_MMU_DTE_ADDR, dte_addr);
+        rk_iommu_command(iommu, RK_MMU_CMD_ZAP_CACHE);
+        rk_iommu_write(iommu, RK_MMU_INT_MASK, RK_MMU_IRQ_MASK);
+
+        ret = rk_iommu_enable_paging(iommu);
+        if (ret)
+                return ret;
+
+        spin_lock_irqsave(&rk_domain->iommus_lock, flags);
+        list_add_tail(&iommu->node, &rk_domain->iommus);
+        spin_unlock_irqrestore(&rk_domain->iommus_lock, flags);
+
+        dev_info(dev, "Attached to iommu domain\n");
+
+        rk_iommu_disable_stall(iommu);
+
+        return 0;
+}
+
+static void rk_iommu_detach_device(struct iommu_domain *domain,
+                                   struct device *dev)
+{
+        struct rk_iommu *iommu;
+        struct rk_iommu_domain *rk_domain = domain->priv;
+        unsigned long flags;
+
+        /* Allow 'virtual devices' (eg drm) to detach from domain */
+        iommu = rk_iommu_from_dev(dev);
+        if (!iommu)
+                return;
+
+        spin_lock_irqsave(&rk_domain->iommus_lock, flags);
+        list_del_init(&iommu->node);
+        spin_unlock_irqrestore(&rk_domain->iommus_lock, flags);
+
+        /* Ignore error while disabling, just keep going */
+        rk_iommu_enable_stall(iommu);
+        rk_iommu_disable_paging(iommu);
+        rk_iommu_write(iommu, RK_MMU_INT_MASK, 0);
+        rk_iommu_write(iommu, RK_MMU_DTE_ADDR, 0);
+        rk_iommu_disable_stall(iommu);
+
+        devm_free_irq(dev, iommu->irq, iommu);
+
+        iommu->domain = NULL;
+
+        dev_info(dev, "Detached from iommu domain\n");
+}
+
+static int rk_iommu_domain_init(struct iommu_domain *domain)
+{
+        struct rk_iommu_domain *rk_domain;
+
+        rk_domain = kzalloc(sizeof(*rk_domain), GFP_KERNEL);
+        if (!rk_domain)
+                return -ENOMEM;
+
+        /*
+         * rk32xx iommus use a 2 level pagetable.
+         * Each level1 (dt) and level2 (pt) table has 1024 4-byte entries.
+         * Allocate one 4 KiB page for each table.
+         */
+        rk_domain->dt = (u32 *)get_zeroed_page(GFP_KERNEL | GFP_DMA32);
+        if (!rk_domain->dt)
+                goto err_dt;
+
+        rk_table_flush(rk_domain->dt, NUM_DT_ENTRIES);
+
+        spin_lock_init(&rk_domain->iommus_lock);
+        spin_lock_init(&rk_domain->dt_lock);
+        INIT_LIST_HEAD(&rk_domain->iommus);
+
+        domain->priv = rk_domain;
+
+        return 0;
+err_dt:
+        kfree(rk_domain);
+        return -ENOMEM;
+}
+
+static void rk_iommu_domain_destroy(struct iommu_domain *domain)
+{
+        struct rk_iommu_domain *rk_domain = domain->priv;
+        int i;
+
+        WARN_ON(!list_empty(&rk_domain->iommus));
+
+        for (i = 0; i < NUM_DT_ENTRIES; i++) {
+                u32 dte = rk_domain->dt[i];
+                if (rk_dte_is_pt_valid(dte)) {
+                        phys_addr_t pt_phys = rk_dte_pt_address(dte);
+                        u32 *page_table = phys_to_virt(pt_phys);
+                        free_page((unsigned long)page_table);
+                }
+        }
+
+        free_page((unsigned long)rk_domain->dt);
+        kfree(domain->priv);
+        domain->priv = NULL;
+}
+
+static bool rk_iommu_is_dev_iommu_master(struct device *dev)
+{
+        struct device_node *np = dev->of_node;
+        int ret;
+
+        /*
+         * An iommu master has an iommus property containing a list of phandles
+         * to iommu nodes, each with an #iommu-cells property with value 0.
+         */
+        ret = of_count_phandle_with_args(np, "iommus", "#iommu-cells");
+        return (ret > 0);
+}
+
+static int rk_iommu_group_set_iommudata(struct iommu_group *group,
+                                        struct device *dev)
+{
+        struct device_node *np = dev->of_node;
+        struct platform_device *pd;
+        int ret;
+        struct of_phandle_args args;
+
+        /*
+         * An iommu master has an iommus property containing a list of phandles
+         * to iommu nodes, each with an #iommu-cells property with value 0.
+         */
+        ret = of_parse_phandle_with_args(np, "iommus", "#iommu-cells", 0,
+                                         &args);
+        if (ret) {
+                dev_err(dev, "of_parse_phandle_with_args(%s) => %d\n",
+                        np->full_name, ret);
+                return ret;
+        }
+        if (args.args_count != 0) {
+                dev_err(dev, "incorrect number of iommu params found for %s (found %d, expected 0)\n",
+                        args.np->full_name, args.args_count);
+                return -EINVAL;
+        }
+
+        pd = of_find_device_by_node(args.np);
+        of_node_put(args.np);
+        if (!pd) {
+                dev_err(dev, "iommu %s not found\n", args.np->full_name);
+                return -EPROBE_DEFER;
+        }
+
+        /* TODO(djkurtz): handle multiple slave iommus for a single master */
+        iommu_group_set_iommudata(group, &pd->dev, NULL);
+
+        return 0;
+}
+
+static int rk_iommu_add_device(struct device *dev)
+{
+        struct iommu_group *group;
+        int ret;
+
+        if (!rk_iommu_is_dev_iommu_master(dev))
+                return -ENODEV;
+
+        group = iommu_group_get(dev);
+        if (!group) {
+                group = iommu_group_alloc();
+                if (IS_ERR(group)) {
+                        dev_err(dev, "Failed to allocate IOMMU group\n");
+                        return PTR_ERR(group);
+                }
+        }
+
+        ret = iommu_group_add_device(group, dev);
+        if (ret)
+                goto err_put_group;
+
+        ret = rk_iommu_group_set_iommudata(group, dev);
+        if (ret)
+                goto err_remove_device;
+
+        iommu_group_put(group);
+
+        return 0;
+
+err_remove_device:
+        iommu_group_remove_device(dev);
+err_put_group:
+        iommu_group_put(group);
+        return ret;
+}
+
+static void rk_iommu_remove_device(struct device *dev)
+{
+        if (!rk_iommu_is_dev_iommu_master(dev))
+                return;
+
+        iommu_group_remove_device(dev);
+}
+
+static const struct iommu_ops rk_iommu_ops = {
+        .domain_init = rk_iommu_domain_init,
+        .domain_destroy = rk_iommu_domain_destroy,
+        .attach_dev = rk_iommu_attach_device,
+        .detach_dev = rk_iommu_detach_device,
+        .map = rk_iommu_map,
+        .unmap = rk_iommu_unmap,
+        .add_device = rk_iommu_add_device,
+        .remove_device = rk_iommu_remove_device,
+        .iova_to_phys = rk_iommu_iova_to_phys,
+        .pgsize_bitmap = RK_IOMMU_PGSIZE_BITMAP,
+};
+
+static int rk_iommu_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct rk_iommu *iommu;
+        struct resource *res;
+
+        iommu = devm_kzalloc(dev, sizeof(*iommu), GFP_KERNEL);
+        if (!iommu)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, iommu);
+        iommu->dev = dev;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        iommu->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(iommu->base))
+                return PTR_ERR(iommu->base);
+
+        iommu->irq = platform_get_irq(pdev, 0);
+        if (iommu->irq < 0) {
+                dev_err(dev, "Failed to get IRQ, %d\n", iommu->irq);
+                return -ENXIO;
+        }
+
+        return 0;
+}
+
+static int rk_iommu_remove(struct platform_device *pdev)
+{
+        return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rk_iommu_dt_ids[] = {
+        { .compatible = "rockchip,iommu" },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, rk_iommu_dt_ids);
+#endif
+
+static struct platform_driver rk_iommu_driver = {
+        .probe = rk_iommu_probe,
+        .remove = rk_iommu_remove,
+        .driver = {
+                   .name = "rk_iommu",
+                   .owner = THIS_MODULE,
+                   .of_match_table = of_match_ptr(rk_iommu_dt_ids),
+        },
+};
+
+static int __init rk_iommu_init(void)
+{
+        int ret;
+
+        ret = bus_set_iommu(&platform_bus_type, &rk_iommu_ops);
+        if (ret)
+                return ret;
+
+        return platform_driver_register(&rk_iommu_driver);
+}
+static void __exit rk_iommu_exit(void)
+{
+        platform_driver_unregister(&rk_iommu_driver);
+}
+
+subsys_initcall(rk_iommu_init);
+module_exit(rk_iommu_exit);
+
+MODULE_DESCRIPTION("IOMMU API for Rockchip");
+MODULE_AUTHOR("Simon Xue <xxm@rock-chips.com> and Daniel Kurtz <djkurtz@chromium.org>");
+MODULE_ALIAS("platform:rockchip-iommu");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 9efe5f10f97b..e12cb23d786c 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -130,3 +130,7 @@ config KEYSTONE_IRQ
         help
                 Support for Texas Instruments Keystone 2 IRQ controller IP which
                 is part of the Keystone 2 IPC mechanism
+
+config MIPS_GIC
+        bool
+        select MIPS_CM
diff --git a/drivers/irqchip/Makefile b/drivers/irqchip/Makefile
index f0909d05eae3..4954a314c31e 100644
--- a/drivers/irqchip/Makefile
+++ b/drivers/irqchip/Makefile
@@ -38,3 +38,4 @@ obj-$(CONFIG_IRQ_CROSSBAR)		+= irq-crossbar.o
 obj-$(CONFIG_BCM7120_L2_IRQ)            += irq-bcm7120-l2.o
 obj-$(CONFIG_BRCMSTB_L2_IRQ)            += irq-brcmstb-l2.o
 obj-$(CONFIG_KEYSTONE_IRQ)              += irq-keystone.o
+obj-$(CONFIG_MIPS_GIC)                  += irq-mips-gic.o
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
new file mode 100644
index 000000000000..2b0468e3df6a
--- /dev/null
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -0,0 +1,789 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2008 Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 2012 MIPS Technologies, Inc.  All rights reserved.
+ */
+#include <linux/bitmap.h>
+#include <linux/clocksource.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqchip/mips-gic.h>
+#include <linux/of_address.h>
+#include <linux/sched.h>
+#include <linux/smp.h>
+
+#include <asm/mips-cm.h>
+#include <asm/setup.h>
+#include <asm/traps.h>
+
+#include <dt-bindings/interrupt-controller/mips-gic.h>
+
+#include "irqchip.h"
+
+unsigned int gic_present;
+
+struct gic_pcpu_mask {
+        DECLARE_BITMAP(pcpu_mask, GIC_MAX_INTRS);
+};
+
+static void __iomem *gic_base;
+static struct gic_pcpu_mask pcpu_masks[NR_CPUS];
+static DEFINE_SPINLOCK(gic_lock);
+static struct irq_domain *gic_irq_domain;
+static int gic_shared_intrs;
+static int gic_vpes;
+static unsigned int gic_cpu_pin;
+static struct irq_chip gic_level_irq_controller, gic_edge_irq_controller;
+
+static void __gic_irq_dispatch(void);
+
+static inline unsigned int gic_read(unsigned int reg)
+{
+        return __raw_readl(gic_base + reg);
+}
+
+static inline void gic_write(unsigned int reg, unsigned int val)
+{
+        __raw_writel(val, gic_base + reg);
+}
+
+static inline void gic_update_bits(unsigned int reg, unsigned int mask,
+                                   unsigned int val)
+{
+        unsigned int regval;
+
+        regval = gic_read(reg);
+        regval &= ~mask;
+        regval |= val;
+        gic_write(reg, regval);
+}
+
+static inline void gic_reset_mask(unsigned int intr)
+{
+        gic_write(GIC_REG(SHARED, GIC_SH_RMASK) + GIC_INTR_OFS(intr),
+                  1 << GIC_INTR_BIT(intr));
+}
+
+static inline void gic_set_mask(unsigned int intr)
+{
+        gic_write(GIC_REG(SHARED, GIC_SH_SMASK) + GIC_INTR_OFS(intr),
+                  1 << GIC_INTR_BIT(intr));
+}
+
+static inline void gic_set_polarity(unsigned int intr, unsigned int pol)
+{
+        gic_update_bits(GIC_REG(SHARED, GIC_SH_SET_POLARITY) +
+                        GIC_INTR_OFS(intr), 1 << GIC_INTR_BIT(intr),
+                        pol << GIC_INTR_BIT(intr));
+}
+
+static inline void gic_set_trigger(unsigned int intr, unsigned int trig)
+{
+        gic_update_bits(GIC_REG(SHARED, GIC_SH_SET_TRIGGER) +
+                        GIC_INTR_OFS(intr), 1 << GIC_INTR_BIT(intr),
+                        trig << GIC_INTR_BIT(intr));
+}
+
+static inline void gic_set_dual_edge(unsigned int intr, unsigned int dual)
+{
+        gic_update_bits(GIC_REG(SHARED, GIC_SH_SET_DUAL) + GIC_INTR_OFS(intr),
+                        1 << GIC_INTR_BIT(intr),
+                        dual << GIC_INTR_BIT(intr));
+}
+
+static inline void gic_map_to_pin(unsigned int intr, unsigned int pin)
+{
+        gic_write(GIC_REG(SHARED, GIC_SH_INTR_MAP_TO_PIN_BASE) +
+                  GIC_SH_MAP_TO_PIN(intr), GIC_MAP_TO_PIN_MSK | pin);
+}
+
+static inline void gic_map_to_vpe(unsigned int intr, unsigned int vpe)
+{
+        gic_write(GIC_REG(SHARED, GIC_SH_INTR_MAP_TO_VPE_BASE) +
+                  GIC_SH_MAP_TO_VPE_REG_OFF(intr, vpe),
+                  GIC_SH_MAP_TO_VPE_REG_BIT(vpe));
+}
+
+#ifdef CONFIG_CLKSRC_MIPS_GIC
+cycle_t gic_read_count(void)
+{
+        unsigned int hi, hi2, lo;
+
+        do {
+                hi = gic_read(GIC_REG(SHARED, GIC_SH_COUNTER_63_32));
+                lo = gic_read(GIC_REG(SHARED, GIC_SH_COUNTER_31_00));
+                hi2 = gic_read(GIC_REG(SHARED, GIC_SH_COUNTER_63_32));
+        } while (hi2 != hi);
+
+        return (((cycle_t) hi) << 32) + lo;
+}
+
+unsigned int gic_get_count_width(void)
+{
+        unsigned int bits, config;
+
+        config = gic_read(GIC_REG(SHARED, GIC_SH_CONFIG));
+        bits = 32 + 4 * ((config & GIC_SH_CONFIG_COUNTBITS_MSK) >>
+                         GIC_SH_CONFIG_COUNTBITS_SHF);
+
+        return bits;
+}
+
+void gic_write_compare(cycle_t cnt)
+{
+        gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_HI),
+                                (int)(cnt >> 32));
+        gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_LO),
+                                (int)(cnt & 0xffffffff));
+}
+
+void gic_write_cpu_compare(cycle_t cnt, int cpu)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), cpu);
+        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_COMPARE_HI),
+                                (int)(cnt >> 32));
+        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_COMPARE_LO),
+                                (int)(cnt & 0xffffffff));
+
+        local_irq_restore(flags);
+}
+
+cycle_t gic_read_compare(void)
+{
+        unsigned int hi, lo;
+
+        hi = gic_read(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_HI));
+        lo = gic_read(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE_LO));
+
+        return (((cycle_t) hi) << 32) + lo;
+}
+#endif
+
+static bool gic_local_irq_is_routable(int intr)
+{
+        u32 vpe_ctl;
+
+        /* All local interrupts are routable in EIC mode. */
+        if (cpu_has_veic)
+                return true;
+
+        vpe_ctl = gic_read(GIC_REG(VPE_LOCAL, GIC_VPE_CTL));
+        switch (intr) {
+        case GIC_LOCAL_INT_TIMER:
+                return vpe_ctl & GIC_VPE_CTL_TIMER_RTBL_MSK;
+        case GIC_LOCAL_INT_PERFCTR:
+                return vpe_ctl & GIC_VPE_CTL_PERFCNT_RTBL_MSK;
+        case GIC_LOCAL_INT_FDC:
+                return vpe_ctl & GIC_VPE_CTL_FDC_RTBL_MSK;
+        case GIC_LOCAL_INT_SWINT0:
+        case GIC_LOCAL_INT_SWINT1:
+                return vpe_ctl & GIC_VPE_CTL_SWINT_RTBL_MSK;
+        default:
+                return true;
+        }
+}
+
+unsigned int gic_get_timer_pending(void)
+{
+        unsigned int vpe_pending;
+
+        vpe_pending = gic_read(GIC_REG(VPE_LOCAL, GIC_VPE_PEND));
+        return vpe_pending & GIC_VPE_PEND_TIMER_MSK;
+}
+
+static void gic_bind_eic_interrupt(int irq, int set)
+{
+        /* Convert irq vector # to hw int # */
+        irq -= GIC_PIN_TO_VEC_OFFSET;
+
+        /* Set irq to use shadow set */
+        gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_EIC_SHADOW_SET_BASE) +
+                  GIC_VPE_EIC_SS(irq), set);
+}
+
+void gic_send_ipi(unsigned int intr)
+{
+        gic_write(GIC_REG(SHARED, GIC_SH_WEDGE), GIC_SH_WEDGE_SET(intr));
+}
+
+int gic_get_c0_compare_int(void)
+{
+        if (!gic_local_irq_is_routable(GIC_LOCAL_INT_TIMER))
+                return MIPS_CPU_IRQ_BASE + cp0_compare_irq;
+        return irq_create_mapping(gic_irq_domain,
+                                  GIC_LOCAL_TO_HWIRQ(GIC_LOCAL_INT_TIMER));
+}
+
+int gic_get_c0_perfcount_int(void)
+{
+        if (!gic_local_irq_is_routable(GIC_LOCAL_INT_PERFCTR)) {
+                /* Is the erformance counter shared with the timer? */
+                if (cp0_perfcount_irq < 0)
+                        return -1;
+                return MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
+        }
+        return irq_create_mapping(gic_irq_domain,
+                                  GIC_LOCAL_TO_HWIRQ(GIC_LOCAL_INT_PERFCTR));
+}
+
+static unsigned int gic_get_int(void)
+{
+        unsigned int i;
+        unsigned long *pcpu_mask;
+        unsigned long pending_reg, intrmask_reg;
+        DECLARE_BITMAP(pending, GIC_MAX_INTRS);
+        DECLARE_BITMAP(intrmask, GIC_MAX_INTRS);
+
+        /* Get per-cpu bitmaps */
+        pcpu_mask = pcpu_masks[smp_processor_id()].pcpu_mask;
+
+        pending_reg = GIC_REG(SHARED, GIC_SH_PEND);
+        intrmask_reg = GIC_REG(SHARED, GIC_SH_MASK);
+
+        for (i = 0; i < BITS_TO_LONGS(gic_shared_intrs); i++) {
+                pending[i] = gic_read(pending_reg);
+                intrmask[i] = gic_read(intrmask_reg);
+                pending_reg += 0x4;
+                intrmask_reg += 0x4;
+        }
+
+        bitmap_and(pending, pending, intrmask, gic_shared_intrs);
+        bitmap_and(pending, pending, pcpu_mask, gic_shared_intrs);
+
+        return find_first_bit(pending, gic_shared_intrs);
+}
+
+static void gic_mask_irq(struct irq_data *d)
+{
+        gic_reset_mask(GIC_HWIRQ_TO_SHARED(d->hwirq));
+}
+
+static void gic_unmask_irq(struct irq_data *d)
+{
+        gic_set_mask(GIC_HWIRQ_TO_SHARED(d->hwirq));
+}
+
+static void gic_ack_irq(struct irq_data *d)
+{
+        unsigned int irq = GIC_HWIRQ_TO_SHARED(d->hwirq);
+
+        gic_write(GIC_REG(SHARED, GIC_SH_WEDGE), GIC_SH_WEDGE_CLR(irq));
+}
+
+static int gic_set_type(struct irq_data *d, unsigned int type)
+{
+        unsigned int irq = GIC_HWIRQ_TO_SHARED(d->hwirq);
+        unsigned long flags;
+        bool is_edge;
+
+        spin_lock_irqsave(&gic_lock, flags);
+        switch (type & IRQ_TYPE_SENSE_MASK) {
+        case IRQ_TYPE_EDGE_FALLING:
+                gic_set_polarity(irq, GIC_POL_NEG);
+                gic_set_trigger(irq, GIC_TRIG_EDGE);
+                gic_set_dual_edge(irq, GIC_TRIG_DUAL_DISABLE);
+                is_edge = true;
+                break;
+        case IRQ_TYPE_EDGE_RISING:
+                gic_set_polarity(irq, GIC_POL_POS);
+                gic_set_trigger(irq, GIC_TRIG_EDGE);
+                gic_set_dual_edge(irq, GIC_TRIG_DUAL_DISABLE);
+                is_edge = true;
+                break;
+        case IRQ_TYPE_EDGE_BOTH:
+                /* polarity is irrelevant in this case */
+                gic_set_trigger(irq, GIC_TRIG_EDGE);
+                gic_set_dual_edge(irq, GIC_TRIG_DUAL_ENABLE);
+                is_edge = true;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                gic_set_polarity(irq, GIC_POL_NEG);
+                gic_set_trigger(irq, GIC_TRIG_LEVEL);
+                gic_set_dual_edge(irq, GIC_TRIG_DUAL_DISABLE);
+                is_edge = false;
+                break;
+        case IRQ_TYPE_LEVEL_HIGH:
+        default:
+                gic_set_polarity(irq, GIC_POL_POS);
+                gic_set_trigger(irq, GIC_TRIG_LEVEL);
+                gic_set_dual_edge(irq, GIC_TRIG_DUAL_DISABLE);
+                is_edge = false;
+                break;
+        }
+
+        if (is_edge) {
+                __irq_set_chip_handler_name_locked(d->irq,
+                                                   &gic_edge_irq_controller,
+                                                   handle_edge_irq, NULL);
+        } else {
+                __irq_set_chip_handler_name_locked(d->irq,
+                                                   &gic_level_irq_controller,
+                                                   handle_level_irq, NULL);
+        }
+        spin_unlock_irqrestore(&gic_lock, flags);
+
+        return 0;
+}
+
+#ifdef CONFIG_SMP
+static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,
+                            bool force)
+{
+        unsigned int irq = GIC_HWIRQ_TO_SHARED(d->hwirq);
+        cpumask_t       tmp = CPU_MASK_NONE;
+        unsigned long   flags;
+        int             i;
+
+        cpumask_and(&tmp, cpumask, cpu_online_mask);
+        if (cpus_empty(tmp))
+                return -EINVAL;
+
+        /* Assumption : cpumask refers to a single CPU */
+        spin_lock_irqsave(&gic_lock, flags);
+
+        /* Re-route this IRQ */
+        gic_map_to_vpe(irq, first_cpu(tmp));
+
+        /* Update the pcpu_masks */
+        for (i = 0; i < NR_CPUS; i++)
+                clear_bit(irq, pcpu_masks[i].pcpu_mask);
+        set_bit(irq, pcpu_masks[first_cpu(tmp)].pcpu_mask);
+
+        cpumask_copy(d->affinity, cpumask);
+        spin_unlock_irqrestore(&gic_lock, flags);
+
+        return IRQ_SET_MASK_OK_NOCOPY;
+}
+#endif
+
+static struct irq_chip gic_level_irq_controller = {
+        .name                   =       "MIPS GIC",
+        .irq_mask               =       gic_mask_irq,
+        .irq_unmask             =       gic_unmask_irq,
+        .irq_set_type           =       gic_set_type,
+#ifdef CONFIG_SMP
+        .irq_set_affinity       =       gic_set_affinity,
+#endif
+};
+
+static struct irq_chip gic_edge_irq_controller = {
+        .name                   =       "MIPS GIC",
+        .irq_ack                =       gic_ack_irq,
+        .irq_mask               =       gic_mask_irq,
+        .irq_unmask             =       gic_unmask_irq,
+        .irq_set_type           =       gic_set_type,
+#ifdef CONFIG_SMP
+        .irq_set_affinity       =       gic_set_affinity,
+#endif
+};
+
+static unsigned int gic_get_local_int(void)
+{
+        unsigned long pending, masked;
+
+        pending = gic_read(GIC_REG(VPE_LOCAL, GIC_VPE_PEND));
+        masked = gic_read(GIC_REG(VPE_LOCAL, GIC_VPE_MASK));
+
+        bitmap_and(&pending, &pending, &masked, GIC_NUM_LOCAL_INTRS);
+
+        return find_first_bit(&pending, GIC_NUM_LOCAL_INTRS);
+}
+
+static void gic_mask_local_irq(struct irq_data *d)
+{
+        int intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
+
+        gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_RMASK), 1 << intr);
+}
+
+static void gic_unmask_local_irq(struct irq_data *d)
+{
+        int intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
+
+        gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_SMASK), 1 << intr);
+}
+
+static struct irq_chip gic_local_irq_controller = {
+        .name                   =       "MIPS GIC Local",
+        .irq_mask               =       gic_mask_local_irq,
+        .irq_unmask             =       gic_unmask_local_irq,
+};
+
+static void gic_mask_local_irq_all_vpes(struct irq_data *d)
+{
+        int intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
+        int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&gic_lock, flags);
+        for (i = 0; i < gic_vpes; i++) {
+                gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), i);
+                gic_write(GIC_REG(VPE_OTHER, GIC_VPE_RMASK), 1 << intr);
+        }
+        spin_unlock_irqrestore(&gic_lock, flags);
+}
+
+static void gic_unmask_local_irq_all_vpes(struct irq_data *d)
+{
+        int intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
+        int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&gic_lock, flags);
+        for (i = 0; i < gic_vpes; i++) {
+                gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), i);
+                gic_write(GIC_REG(VPE_OTHER, GIC_VPE_SMASK), 1 << intr);
+        }
+        spin_unlock_irqrestore(&gic_lock, flags);
+}
+
+static struct irq_chip gic_all_vpes_local_irq_controller = {
+        .name                   =       "MIPS GIC Local",
+        .irq_mask               =       gic_mask_local_irq_all_vpes,
+        .irq_unmask             =       gic_unmask_local_irq_all_vpes,
+};
+
+static void __gic_irq_dispatch(void)
+{
+        unsigned int intr, virq;
+
+        while ((intr = gic_get_local_int()) != GIC_NUM_LOCAL_INTRS) {
+                virq = irq_linear_revmap(gic_irq_domain,
+                                         GIC_LOCAL_TO_HWIRQ(intr));
+                do_IRQ(virq);
+        }
+
+        while ((intr = gic_get_int()) != gic_shared_intrs) {
+                virq = irq_linear_revmap(gic_irq_domain,
+                                         GIC_SHARED_TO_HWIRQ(intr));
+                do_IRQ(virq);
+        }
+}
+
+static void gic_irq_dispatch(unsigned int irq, struct irq_desc *desc)
+{
+        __gic_irq_dispatch();
+}
+
+#ifdef CONFIG_MIPS_GIC_IPI
+static int gic_resched_int_base;
+static int gic_call_int_base;
+
+unsigned int plat_ipi_resched_int_xlate(unsigned int cpu)
+{
+        return gic_resched_int_base + cpu;
+}
+
+unsigned int plat_ipi_call_int_xlate(unsigned int cpu)
+{
+        return gic_call_int_base + cpu;
+}
+
+static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
+{
+        scheduler_ipi();
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t ipi_call_interrupt(int irq, void *dev_id)
+{
+        smp_call_function_interrupt();
+
+        return IRQ_HANDLED;
+}
+
+static struct irqaction irq_resched = {
+        .handler        = ipi_resched_interrupt,
+        .flags          = IRQF_PERCPU,
+        .name           = "IPI resched"
+};
+
+static struct irqaction irq_call = {
+        .handler        = ipi_call_interrupt,
+        .flags          = IRQF_PERCPU,
+        .name           = "IPI call"
+};
+
+static __init void gic_ipi_init_one(unsigned int intr, int cpu,
+                                    struct irqaction *action)
+{
+        int virq = irq_create_mapping(gic_irq_domain,
+                                      GIC_SHARED_TO_HWIRQ(intr));
+        int i;
+
+        gic_map_to_vpe(intr, cpu);
+        for (i = 0; i < NR_CPUS; i++)
+                clear_bit(intr, pcpu_masks[i].pcpu_mask);
+        set_bit(intr, pcpu_masks[cpu].pcpu_mask);
+
+        irq_set_irq_type(virq, IRQ_TYPE_EDGE_RISING);
+
+        irq_set_handler(virq, handle_percpu_irq);
+        setup_irq(virq, action);
+}
+
+static __init void gic_ipi_init(void)
+{
+        int i;
+
+        /* Use last 2 * NR_CPUS interrupts as IPIs */
+        gic_resched_int_base = gic_shared_intrs - nr_cpu_ids;
+        gic_call_int_base = gic_resched_int_base - nr_cpu_ids;
+
+        for (i = 0; i < nr_cpu_ids; i++) {
+                gic_ipi_init_one(gic_call_int_base + i, i, &irq_call);
+                gic_ipi_init_one(gic_resched_int_base + i, i, &irq_resched);
+        }
+}
+#else
+static inline void gic_ipi_init(void)
+{
+}
+#endif
+
+static void __init gic_basic_init(void)
+{
+        unsigned int i;
+
+        board_bind_eic_interrupt = &gic_bind_eic_interrupt;
+
+        /* Setup defaults */
+        for (i = 0; i < gic_shared_intrs; i++) {
+                gic_set_polarity(i, GIC_POL_POS);
+                gic_set_trigger(i, GIC_TRIG_LEVEL);
+                gic_reset_mask(i);
+        }
+
+        for (i = 0; i < gic_vpes; i++) {
+                unsigned int j;
+
+                gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), i);
+                for (j = 0; j < GIC_NUM_LOCAL_INTRS; j++) {
+                        if (!gic_local_irq_is_routable(j))
+                                continue;
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_RMASK), 1 << j);
+                }
+        }
+}
+
+static int gic_local_irq_domain_map(struct irq_domain *d, unsigned int virq,
+                                    irq_hw_number_t hw)
+{
+        int intr = GIC_HWIRQ_TO_LOCAL(hw);
+        int ret = 0;
+        int i;
+        unsigned long flags;
+
+        if (!gic_local_irq_is_routable(intr))
+                return -EPERM;
+
+        /*
+         * HACK: These are all really percpu interrupts, but the rest
+         * of the MIPS kernel code does not use the percpu IRQ API for
+         * the CP0 timer and performance counter interrupts.
+         */
+        if (intr != GIC_LOCAL_INT_TIMER && intr != GIC_LOCAL_INT_PERFCTR) {
+                irq_set_chip_and_handler(virq,
+                                         &gic_local_irq_controller,
+                                         handle_percpu_devid_irq);
+                irq_set_percpu_devid(virq);
+        } else {
+                irq_set_chip_and_handler(virq,
+                                         &gic_all_vpes_local_irq_controller,
+                                         handle_percpu_irq);
+        }
+
+        spin_lock_irqsave(&gic_lock, flags);
+        for (i = 0; i < gic_vpes; i++) {
+                u32 val = GIC_MAP_TO_PIN_MSK | gic_cpu_pin;
+
+                gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_OTHER_ADDR), i);
+
+                switch (intr) {
+                case GIC_LOCAL_INT_WD:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_WD_MAP), val);
+                        break;
+                case GIC_LOCAL_INT_COMPARE:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_COMPARE_MAP), val);
+                        break;
+                case GIC_LOCAL_INT_TIMER:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_TIMER_MAP), val);
+                        break;
+                case GIC_LOCAL_INT_PERFCTR:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_PERFCTR_MAP), val);
+                        break;
+                case GIC_LOCAL_INT_SWINT0:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_SWINT0_MAP), val);
+                        break;
+                case GIC_LOCAL_INT_SWINT1:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_SWINT1_MAP), val);
+                        break;
+                case GIC_LOCAL_INT_FDC:
+                        gic_write(GIC_REG(VPE_OTHER, GIC_VPE_FDC_MAP), val);
+                        break;
+                default:
+                        pr_err("Invalid local IRQ %d\n", intr);
+                        ret = -EINVAL;
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(&gic_lock, flags);
+
+        return ret;
+}
+
+static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
+                                     irq_hw_number_t hw)
+{
+        int intr = GIC_HWIRQ_TO_SHARED(hw);
+        unsigned long flags;
+
+        irq_set_chip_and_handler(virq, &gic_level_irq_controller,
+                                 handle_level_irq);
+
+        spin_lock_irqsave(&gic_lock, flags);
+        gic_map_to_pin(intr, gic_cpu_pin);
+        /* Map to VPE 0 by default */
+        gic_map_to_vpe(intr, 0);
+        set_bit(intr, pcpu_masks[0].pcpu_mask);
+        spin_unlock_irqrestore(&gic_lock, flags);
+
+        return 0;
+}
+
+static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
+                              irq_hw_number_t hw)
+{
+        if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
+                return gic_local_irq_domain_map(d, virq, hw);
+        return gic_shared_irq_domain_map(d, virq, hw);
+}
+
+static int gic_irq_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
+                                const u32 *intspec, unsigned int intsize,
+                                irq_hw_number_t *out_hwirq,
+                                unsigned int *out_type)
+{
+        if (intsize != 3)
+                return -EINVAL;
+
+        if (intspec[0] == GIC_SHARED)
+                *out_hwirq = GIC_SHARED_TO_HWIRQ(intspec[1]);
+        else if (intspec[0] == GIC_LOCAL)
+                *out_hwirq = GIC_LOCAL_TO_HWIRQ(intspec[1]);
+        else
+                return -EINVAL;
+        *out_type = intspec[2] & IRQ_TYPE_SENSE_MASK;
+
+        return 0;
+}
+
+static struct irq_domain_ops gic_irq_domain_ops = {
+        .map = gic_irq_domain_map,
+        .xlate = gic_irq_domain_xlate,
+};
+
+static void __init __gic_init(unsigned long gic_base_addr,
+                              unsigned long gic_addrspace_size,
+                              unsigned int cpu_vec, unsigned int irqbase,
+                              struct device_node *node)
+{
+        unsigned int gicconfig;
+
+        gic_base = ioremap_nocache(gic_base_addr, gic_addrspace_size);
+
+        gicconfig = gic_read(GIC_REG(SHARED, GIC_SH_CONFIG));
+        gic_shared_intrs = (gicconfig & GIC_SH_CONFIG_NUMINTRS_MSK) >>
+                   GIC_SH_CONFIG_NUMINTRS_SHF;
+        gic_shared_intrs = ((gic_shared_intrs + 1) * 8);
+
+        gic_vpes = (gicconfig & GIC_SH_CONFIG_NUMVPES_MSK) >>
+                  GIC_SH_CONFIG_NUMVPES_SHF;
+        gic_vpes = gic_vpes + 1;
+
+        if (cpu_has_veic) {
+                /* Always use vector 1 in EIC mode */
+                gic_cpu_pin = 0;
+                set_vi_handler(gic_cpu_pin + GIC_PIN_TO_VEC_OFFSET,
+                               __gic_irq_dispatch);
+        } else {
+                gic_cpu_pin = cpu_vec - GIC_CPU_PIN_OFFSET;
+                irq_set_chained_handler(MIPS_CPU_IRQ_BASE + cpu_vec,
+                                        gic_irq_dispatch);
+        }
+
+        gic_irq_domain = irq_domain_add_simple(node, GIC_NUM_LOCAL_INTRS +
+                                               gic_shared_intrs, irqbase,
+                                               &gic_irq_domain_ops, NULL);
+        if (!gic_irq_domain)
+                panic("Failed to add GIC IRQ domain");
+
+        gic_basic_init();
+
+        gic_ipi_init();
+}
+
+void __init gic_init(unsigned long gic_base_addr,
+                     unsigned long gic_addrspace_size,
+                     unsigned int cpu_vec, unsigned int irqbase)
+{
+        __gic_init(gic_base_addr, gic_addrspace_size, cpu_vec, irqbase, NULL);
+}
+
+static int __init gic_of_init(struct device_node *node,
+                              struct device_node *parent)
+{
+        struct resource res;
+        unsigned int cpu_vec, i = 0, reserved = 0;
+        phys_addr_t gic_base;
+        size_t gic_len;
+
+        /* Find the first available CPU vector. */
+        while (!of_property_read_u32_index(node, "mti,reserved-cpu-vectors",
+                                           i++, &cpu_vec))
+                reserved |= BIT(cpu_vec);
+        for (cpu_vec = 2; cpu_vec < 8; cpu_vec++) {
+                if (!(reserved & BIT(cpu_vec)))
+                        break;
+        }
+        if (cpu_vec == 8) {
+                pr_err("No CPU vectors available for GIC\n");
+                return -ENODEV;
+        }
+
+        if (of_address_to_resource(node, 0, &res)) {
+                /*
+                 * Probe the CM for the GIC base address if not specified
+                 * in the device-tree.
+                 */
+                if (mips_cm_present()) {
+                        gic_base = read_gcr_gic_base() &
+                                ~CM_GCR_GIC_BASE_GICEN_MSK;
+                        gic_len = 0x20000;
+                } else {
+                        pr_err("Failed to get GIC memory range\n");
+                        return -ENODEV;
+                }
+        } else {
+                gic_base = res.start;
+                gic_len = resource_size(&res);
+        }
+
+        if (mips_cm_present())
+                write_gcr_gic_base(gic_base | CM_GCR_GIC_BASE_GICEN_MSK);
+        gic_present = true;
+
+        __gic_init(gic_base, gic_len, cpu_vec, 0, node);
+
+        return 0;
+}
+IRQCHIP_DECLARE(mips_gic, "mti,gic", gic_of_init);
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 9f454d76cc06..67c21876c35f 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -1334,7 +1334,7 @@ init_card(struct l1oip *hc, int pri, int bundle)
         if (id[l1oip_cnt] == 0) {
                 printk(KERN_WARNING "Warning: No 'id' value given or "
                        "0, this is highly unsecure. Please use 32 "
-                       "bit randmom number 0x...\n");
+                       "bit random number 0x...\n");
         }
         hc->id = id[l1oip_cnt];
         if (debug & DEBUG_L1OIP_INIT)
diff --git a/drivers/media/pci/cx18/cx18-driver.h b/drivers/media/pci/cx18/cx18-driver.h
index dcfd7a1d317e..207d6e82403b 100644
--- a/drivers/media/pci/cx18/cx18-driver.h
+++ b/drivers/media/pci/cx18/cx18-driver.h
@@ -290,7 +290,7 @@ struct cx18_options {
  * list_entry_is_past_end - check if a previous loop cursor is off list end
  * @pos:        the type * previously used as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Check if the entry's list_head is the head of the list, thus it's not a
  * real entry but was the loop cursor that walked past the end
diff --git a/drivers/media/pci/ttpci/budget-patch.c b/drivers/media/pci/ttpci/budget-patch.c
index 2cb35c23d2ac..a4d8867e1d7b 100644
--- a/drivers/media/pci/ttpci/budget-patch.c
+++ b/drivers/media/pci/ttpci/budget-patch.c
@@ -490,7 +490,7 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
 
         if(detected == 0)
                 printk("budget-patch not detected or saa7146 in non-default state.\n"
-                       "try enabling ressetting of 7146 with MASK_31 in MC1 register\n");
+                       "try enabling resetting of 7146 with MASK_31 in MC1 register\n");
 
         else
                 printk("BUDGET-PATCH DETECTED.\n");
diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index 3d2b8677ec8a..b5b6bda44a00 100644
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -336,6 +336,8 @@ struct cxl_sste {
 struct cxl_afu {
         irq_hw_number_t psl_hwirq;
         irq_hw_number_t serr_hwirq;
+        char *err_irq_name;
+        char *psl_irq_name;
         unsigned int serr_virq;
         void __iomem *p1n_mmio;
         void __iomem *p2n_mmio;
@@ -379,6 +381,12 @@ struct cxl_afu {
         bool enabled;
 };
 
+
+struct cxl_irq_name {
+        struct list_head list;
+        char *name;
+};
+
 /*
  * This is a cxl context.  If the PSL is in dedicated mode, there will be one
  * of these per AFU.  If in AFU directed there can be lots of these.
@@ -403,6 +411,7 @@ struct cxl_context {
 
         unsigned long *irq_bitmap; /* Accessed from IRQ context */
         struct cxl_irq_ranges irqs;
+        struct list_head irq_names;
         u64 fault_addr;
         u64 fault_dsisr;
         u64 afu_err;
@@ -444,6 +453,7 @@ struct cxl {
         struct dentry *trace;
         struct dentry *psl_err_chk;
         struct dentry *debugfs;
+        char *irq_name;
         struct bin_attribute cxl_attr;
         int adapter_num;
         int user_irqs;
@@ -563,9 +573,6 @@ int _cxl_afu_deactivate_mode(struct cxl_afu *afu, int mode);
 int cxl_afu_deactivate_mode(struct cxl_afu *afu);
 int cxl_afu_select_best_mode(struct cxl_afu *afu);
 
-unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq,
-                         irq_handler_t handler, void *cookie);
-void cxl_unmap_irq(unsigned int virq, void *cookie);
 int cxl_register_psl_irq(struct cxl_afu *afu);
 void cxl_release_psl_irq(struct cxl_afu *afu);
 int cxl_register_psl_err_irq(struct cxl *adapter);
@@ -612,7 +619,7 @@ int cxl_attach_process(struct cxl_context *ctx, bool kernel, u64 wed,
                             u64 amr);
 int cxl_detach_process(struct cxl_context *ctx);
 
-int cxl_get_irq(struct cxl_context *ctx, struct cxl_irq_info *info);
+int cxl_get_irq(struct cxl_afu *afu, struct cxl_irq_info *info);
 int cxl_ack_irq(struct cxl_context *ctx, u64 tfc, u64 psl_reset_mask);
 
 int cxl_check_error(struct cxl_afu *afu);
diff --git a/drivers/misc/cxl/fault.c b/drivers/misc/cxl/fault.c
index c99e896604ee..f8684bca2d79 100644
--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -133,7 +133,7 @@ static void cxl_handle_page_fault(struct cxl_context *ctx,
 {
         unsigned flt = 0;
         int result;
-        unsigned long access, flags;
+        unsigned long access, flags, inv_flags = 0;
 
         if ((result = copro_handle_mm_fault(mm, dar, dsisr, &flt))) {
                 pr_devel("copro_handle_mm_fault failed: %#x\n", result);
@@ -149,8 +149,12 @@ static void cxl_handle_page_fault(struct cxl_context *ctx,
                 access |= _PAGE_RW;
         if ((!ctx->kernel) || ~(dar & (1ULL << 63)))
                 access |= _PAGE_USER;
+
+        if (dsisr & DSISR_NOHPTE)
+                inv_flags |= HPTE_NOHPTE_UPDATE;
+
         local_irq_save(flags);
-        hash_page_mm(mm, dar, access, 0x300);
+        hash_page_mm(mm, dar, access, 0x300, inv_flags);
         local_irq_restore(flags);
 
         pr_devel("Page fault successfully handled for pe: %i!\n", ctx->pe);
diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
index 336020c8e1af..c294925f73ee 100644
--- a/drivers/misc/cxl/irq.c
+++ b/drivers/misc/cxl/irq.c
@@ -92,20 +92,13 @@ static irqreturn_t schedule_cxl_fault(struct cxl_context *ctx, u64 dsisr, u64 da
         return IRQ_HANDLED;
 }
 
-static irqreturn_t cxl_irq(int irq, void *data)
+static irqreturn_t cxl_irq(int irq, void *data, struct cxl_irq_info *irq_info)
 {
         struct cxl_context *ctx = data;
-        struct cxl_irq_info irq_info;
         u64 dsisr, dar;
-        int result;
-
-        if ((result = cxl_get_irq(ctx, &irq_info))) {
-                WARN(1, "Unable to get CXL IRQ Info: %i\n", result);
-                return IRQ_HANDLED;
-        }
 
-        dsisr = irq_info.dsisr;
-        dar = irq_info.dar;
+        dsisr = irq_info->dsisr;
+        dar = irq_info->dar;
 
         pr_devel("CXL interrupt %i for afu pe: %i DSISR: %#llx DAR: %#llx\n", irq, ctx->pe, dsisr, dar);
 
@@ -149,9 +142,9 @@ static irqreturn_t cxl_irq(int irq, void *data)
         if (dsisr & CXL_PSL_DSISR_An_UR)
                 pr_devel("CXL interrupt: AURP PTE not found\n");
         if (dsisr & CXL_PSL_DSISR_An_PE)
-                return handle_psl_slice_error(ctx, dsisr, irq_info.errstat);
+                return handle_psl_slice_error(ctx, dsisr, irq_info->errstat);
         if (dsisr & CXL_PSL_DSISR_An_AE) {
-                pr_devel("CXL interrupt: AFU Error %.llx\n", irq_info.afu_err);
+                pr_devel("CXL interrupt: AFU Error %.llx\n", irq_info->afu_err);
 
                 if (ctx->pending_afu_err) {
                         /*
@@ -163,10 +156,10 @@ static irqreturn_t cxl_irq(int irq, void *data)
                          */
                         dev_err_ratelimited(&ctx->afu->dev, "CXL AFU Error "
                                             "undelivered to pe %i: %.llx\n",
-                                            ctx->pe, irq_info.afu_err);
+                                            ctx->pe, irq_info->afu_err);
                 } else {
                         spin_lock(&ctx->lock);
-                        ctx->afu_err = irq_info.afu_err;
+                        ctx->afu_err = irq_info->afu_err;
                         ctx->pending_afu_err = 1;
                         spin_unlock(&ctx->lock);
 
@@ -182,24 +175,43 @@ static irqreturn_t cxl_irq(int irq, void *data)
         return IRQ_HANDLED;
 }
 
+static irqreturn_t fail_psl_irq(struct cxl_afu *afu, struct cxl_irq_info *irq_info)
+{
+        if (irq_info->dsisr & CXL_PSL_DSISR_TRANS)
+                cxl_p2n_write(afu, CXL_PSL_TFC_An, CXL_PSL_TFC_An_AE);
+        else
+                cxl_p2n_write(afu, CXL_PSL_TFC_An, CXL_PSL_TFC_An_A);
+
+        return IRQ_HANDLED;
+}
+
 static irqreturn_t cxl_irq_multiplexed(int irq, void *data)
 {
         struct cxl_afu *afu = data;
         struct cxl_context *ctx;
+        struct cxl_irq_info irq_info;
         int ph = cxl_p2n_read(afu, CXL_PSL_PEHandle_An) & 0xffff;
         int ret;
 
+        if ((ret = cxl_get_irq(afu, &irq_info))) {
+                WARN(1, "Unable to get CXL IRQ Info: %i\n", ret);
+                return fail_psl_irq(afu, &irq_info);
+        }
+
         rcu_read_lock();
         ctx = idr_find(&afu->contexts_idr, ph);
         if (ctx) {
-                ret = cxl_irq(irq, ctx);
+                ret = cxl_irq(irq, ctx, &irq_info);
                 rcu_read_unlock();
                 return ret;
         }
         rcu_read_unlock();
 
-        WARN(1, "Unable to demultiplex CXL PSL IRQ\n");
-        return IRQ_HANDLED;
+        WARN(1, "Unable to demultiplex CXL PSL IRQ for PE %i DSISR %.16llx DAR"
+                " %.16llx\n(Possible AFU HW issue - was a term/remove acked"
+                " with outstanding transactions?)\n", ph, irq_info.dsisr,
+                irq_info.dar);
+        return fail_psl_irq(afu, &irq_info);
 }
 
 static irqreturn_t cxl_irq_afu(int irq, void *data)
@@ -243,7 +255,7 @@ static irqreturn_t cxl_irq_afu(int irq, void *data)
 }
 
 unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq,
-                         irq_handler_t handler, void *cookie)
+                         irq_handler_t handler, void *cookie, const char *name)
 {
         unsigned int virq;
         int result;
@@ -259,7 +271,7 @@ unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq,
 
         pr_devel("hwirq %#lx mapped to virq %u\n", hwirq, virq);
 
-        result = request_irq(virq, handler, 0, "cxl", cookie);
+        result = request_irq(virq, handler, 0, name, cookie);
         if (result) {
                 dev_warn(&adapter->dev, "cxl_map_irq: request_irq failed: %i\n", result);
                 return 0;
@@ -278,14 +290,15 @@ static int cxl_register_one_irq(struct cxl *adapter,
                                 irq_handler_t handler,
                                 void *cookie,
                                 irq_hw_number_t *dest_hwirq,
-                                unsigned int *dest_virq)
+                                unsigned int *dest_virq,
+                                const char *name)
 {
         int hwirq, virq;
 
         if ((hwirq = cxl_alloc_one_irq(adapter)) < 0)
                 return hwirq;
 
-        if (!(virq = cxl_map_irq(adapter, hwirq, handler, cookie)))
+        if (!(virq = cxl_map_irq(adapter, hwirq, handler, cookie, name)))
                 goto err;
 
         *dest_hwirq = hwirq;
@@ -302,10 +315,19 @@ int cxl_register_psl_err_irq(struct cxl *adapter)
 {
         int rc;
 
+        adapter->irq_name = kasprintf(GFP_KERNEL, "cxl-%s-err",
+                                      dev_name(&adapter->dev));
+        if (!adapter->irq_name)
+                return -ENOMEM;
+
         if ((rc = cxl_register_one_irq(adapter, cxl_irq_err, adapter,
                                        &adapter->err_hwirq,
-                                       &adapter->err_virq)))
+                                       &adapter->err_virq,
+                                       adapter->irq_name))) {
+                kfree(adapter->irq_name);
+                adapter->irq_name = NULL;
                 return rc;
+        }
 
         cxl_p1_write(adapter, CXL_PSL_ErrIVTE, adapter->err_hwirq & 0xffff);
 
@@ -317,6 +339,7 @@ void cxl_release_psl_err_irq(struct cxl *adapter)
         cxl_p1_write(adapter, CXL_PSL_ErrIVTE, 0x0000000000000000);
         cxl_unmap_irq(adapter->err_virq, adapter);
         cxl_release_one_irq(adapter, adapter->err_hwirq);
+        kfree(adapter->irq_name);
 }
 
 int cxl_register_serr_irq(struct cxl_afu *afu)
@@ -324,10 +347,18 @@ int cxl_register_serr_irq(struct cxl_afu *afu)
         u64 serr;
         int rc;
 
+        afu->err_irq_name = kasprintf(GFP_KERNEL, "cxl-%s-err",
+                                      dev_name(&afu->dev));
+        if (!afu->err_irq_name)
+                return -ENOMEM;
+
         if ((rc = cxl_register_one_irq(afu->adapter, cxl_slice_irq_err, afu,
                                        &afu->serr_hwirq,
-                                       &afu->serr_virq)))
+                                       &afu->serr_virq, afu->err_irq_name))) {
+                kfree(afu->err_irq_name);
+                afu->err_irq_name = NULL;
                 return rc;
+        }
 
         serr = cxl_p1n_read(afu, CXL_PSL_SERR_An);
         serr = (serr & 0x00ffffffffff0000ULL) | (afu->serr_hwirq & 0xffff);
@@ -341,24 +372,50 @@ void cxl_release_serr_irq(struct cxl_afu *afu)
         cxl_p1n_write(afu, CXL_PSL_SERR_An, 0x0000000000000000);
         cxl_unmap_irq(afu->serr_virq, afu);
         cxl_release_one_irq(afu->adapter, afu->serr_hwirq);
+        kfree(afu->err_irq_name);
 }
 
 int cxl_register_psl_irq(struct cxl_afu *afu)
 {
-        return cxl_register_one_irq(afu->adapter, cxl_irq_multiplexed, afu,
-                        &afu->psl_hwirq, &afu->psl_virq);
+        int rc;
+
+        afu->psl_irq_name = kasprintf(GFP_KERNEL, "cxl-%s",
+                                      dev_name(&afu->dev));
+        if (!afu->psl_irq_name)
+                return -ENOMEM;
+
+        if ((rc = cxl_register_one_irq(afu->adapter, cxl_irq_multiplexed, afu,
+                                    &afu->psl_hwirq, &afu->psl_virq,
+                                    afu->psl_irq_name))) {
+                kfree(afu->psl_irq_name);
+                afu->psl_irq_name = NULL;
+        }
+        return rc;
 }
 
 void cxl_release_psl_irq(struct cxl_afu *afu)
 {
         cxl_unmap_irq(afu->psl_virq, afu);
         cxl_release_one_irq(afu->adapter, afu->psl_hwirq);
+        kfree(afu->psl_irq_name);
+}
+
+void afu_irq_name_free(struct cxl_context *ctx)
+{
+        struct cxl_irq_name *irq_name, *tmp;
+
+        list_for_each_entry_safe(irq_name, tmp, &ctx->irq_names, list) {
+                kfree(irq_name->name);
+                list_del(&irq_name->list);
+                kfree(irq_name);
+        }
 }
 
 int afu_register_irqs(struct cxl_context *ctx, u32 count)
 {
         irq_hw_number_t hwirq;
-        int rc, r, i;
+        int rc, r, i, j = 1;
+        struct cxl_irq_name *irq_name;
 
         if ((rc = cxl_alloc_irq_ranges(&ctx->irqs, ctx->afu->adapter, count)))
                 return rc;
@@ -372,15 +429,47 @@ int afu_register_irqs(struct cxl_context *ctx, u32 count)
                                   sizeof(*ctx->irq_bitmap), GFP_KERNEL);
         if (!ctx->irq_bitmap)
                 return -ENOMEM;
+
+        /*
+         * Allocate names first.  If any fail, bail out before allocating
+         * actual hardware IRQs.
+         */
+        INIT_LIST_HEAD(&ctx->irq_names);
+        for (r = 1; r < CXL_IRQ_RANGES; r++) {
+                for (i = 0; i < ctx->irqs.range[r]; hwirq++, i++) {
+                        irq_name = kmalloc(sizeof(struct cxl_irq_name),
+                                           GFP_KERNEL);
+                        if (!irq_name)
+                                goto out;
+                        irq_name->name = kasprintf(GFP_KERNEL, "cxl-%s-pe%i-%i",
+                                                   dev_name(&ctx->afu->dev),
+                                                   ctx->pe, j);
+                        if (!irq_name->name) {
+                                kfree(irq_name);
+                                goto out;
+                        }
+                        /* Add to tail so next look get the correct order */
+                        list_add_tail(&irq_name->list, &ctx->irq_names);
+                        j++;
+                }
+        }
+
+        /* We've allocated all memory now, so let's do the irq allocations */
+        irq_name = list_first_entry(&ctx->irq_names, struct cxl_irq_name, list);
         for (r = 1; r < CXL_IRQ_RANGES; r++) {
                 hwirq = ctx->irqs.offset[r];
                 for (i = 0; i < ctx->irqs.range[r]; hwirq++, i++) {
                         cxl_map_irq(ctx->afu->adapter, hwirq,
-                                     cxl_irq_afu, ctx);
+                                    cxl_irq_afu, ctx, irq_name->name);
+                        irq_name = list_next_entry(irq_name, list);
                 }
         }
 
         return 0;
+
+out:
+        afu_irq_name_free(ctx);
+        return -ENOMEM;
 }
 
 void afu_release_irqs(struct cxl_context *ctx)
@@ -398,5 +487,6 @@ void afu_release_irqs(struct cxl_context *ctx)
                 }
         }
 
+        afu_irq_name_free(ctx);
         cxl_release_irq_ranges(&ctx->irqs, ctx->afu->adapter);
 }
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index d47532e8f4f1..9a5a442269a8 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -637,18 +637,18 @@ int cxl_detach_process(struct cxl_context *ctx)
         return detach_process_native_afu_directed(ctx);
 }
 
-int cxl_get_irq(struct cxl_context *ctx, struct cxl_irq_info *info)
+int cxl_get_irq(struct cxl_afu *afu, struct cxl_irq_info *info)
 {
         u64 pidtid;
 
-        info->dsisr = cxl_p2n_read(ctx->afu, CXL_PSL_DSISR_An);
-        info->dar = cxl_p2n_read(ctx->afu, CXL_PSL_DAR_An);
-        info->dsr = cxl_p2n_read(ctx->afu, CXL_PSL_DSR_An);
-        pidtid = cxl_p2n_read(ctx->afu, CXL_PSL_PID_TID_An);
+        info->dsisr = cxl_p2n_read(afu, CXL_PSL_DSISR_An);
+        info->dar = cxl_p2n_read(afu, CXL_PSL_DAR_An);
+        info->dsr = cxl_p2n_read(afu, CXL_PSL_DSR_An);
+        pidtid = cxl_p2n_read(afu, CXL_PSL_PID_TID_An);
         info->pid = pidtid >> 32;
         info->tid = pidtid & 0xffffffff;
-        info->afu_err = cxl_p2n_read(ctx->afu, CXL_AFU_ERR_An);
-        info->errstat = cxl_p2n_read(ctx->afu, CXL_PSL_ErrStat_An);
+        info->afu_err = cxl_p2n_read(afu, CXL_AFU_ERR_An);
+        info->errstat = cxl_p2n_read(afu, CXL_PSL_ErrStat_An);
 
         return 0;
 }
diff --git a/drivers/mtd/ubi/attach.c b/drivers/mtd/ubi/attach.c
index 6f27d9a1be3b..9d2e16f3150a 100644
--- a/drivers/mtd/ubi/attach.c
+++ b/drivers/mtd/ubi/attach.c
@@ -176,6 +176,7 @@ static int add_corrupted(struct ubi_attach_info *ai, int pnum, int ec)
 
 /**
  * validate_vid_hdr - check volume identifier header.
+ * @ubi: UBI device description object
  * @vid_hdr: the volume identifier header to check
  * @av: information about the volume this logical eraseblock belongs to
  * @pnum: physical eraseblock number the VID header came from
@@ -188,7 +189,8 @@ static int add_corrupted(struct ubi_attach_info *ai, int pnum, int ec)
  * information in the VID header is consistent to the information in other VID
  * headers of the same volume.
  */
-static int validate_vid_hdr(const struct ubi_vid_hdr *vid_hdr,
+static int validate_vid_hdr(const struct ubi_device *ubi,
+                            const struct ubi_vid_hdr *vid_hdr,
                             const struct ubi_ainf_volume *av, int pnum)
 {
         int vol_type = vid_hdr->vol_type;
@@ -206,7 +208,7 @@ static int validate_vid_hdr(const struct ubi_vid_hdr *vid_hdr,
                  */
 
                 if (vol_id != av->vol_id) {
-                        ubi_err("inconsistent vol_id");
+                        ubi_err(ubi, "inconsistent vol_id");
                         goto bad;
                 }
 
@@ -216,17 +218,17 @@ static int validate_vid_hdr(const struct ubi_vid_hdr *vid_hdr,
                         av_vol_type = UBI_VID_DYNAMIC;
 
                 if (vol_type != av_vol_type) {
-                        ubi_err("inconsistent vol_type");
+                        ubi_err(ubi, "inconsistent vol_type");
                         goto bad;
                 }
 
                 if (used_ebs != av->used_ebs) {
-                        ubi_err("inconsistent used_ebs");
+                        ubi_err(ubi, "inconsistent used_ebs");
                         goto bad;
                 }
 
                 if (data_pad != av->data_pad) {
-                        ubi_err("inconsistent data_pad");
+                        ubi_err(ubi, "inconsistent data_pad");
                         goto bad;
                 }
         }
@@ -234,7 +236,7 @@ static int validate_vid_hdr(const struct ubi_vid_hdr *vid_hdr,
         return 0;
 
 bad:
-        ubi_err("inconsistent VID header at PEB %d", pnum);
+        ubi_err(ubi, "inconsistent VID header at PEB %d", pnum);
         ubi_dump_vid_hdr(vid_hdr);
         ubi_dump_av(av);
         return -EINVAL;
@@ -336,7 +338,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb,
                  * support these images anymore. Well, those images still work,
                  * but only if no unclean reboots happened.
                  */
-                ubi_err("unsupported on-flash UBI format");
+                ubi_err(ubi, "unsupported on-flash UBI format");
                 return -EINVAL;
         }
 
@@ -377,7 +379,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb,
                         if (err == UBI_IO_BITFLIPS)
                                 bitflips = 1;
                         else {
-                                ubi_err("VID of PEB %d header is bad, but it was OK earlier, err %d",
+                                ubi_err(ubi, "VID of PEB %d header is bad, but it was OK earlier, err %d",
                                         pnum, err);
                                 if (err > 0)
                                         err = -EIO;
@@ -507,7 +509,7 @@ int ubi_add_to_av(struct ubi_device *ubi, struct ubi_attach_info *ai, int pnum,
                  * logical eraseblocks because there was an unclean reboot.
                  */
                 if (aeb->sqnum == sqnum && sqnum != 0) {
-                        ubi_err("two LEBs with same sequence number %llu",
+                        ubi_err(ubi, "two LEBs with same sequence number %llu",
                                 sqnum);
                         ubi_dump_aeb(aeb, 0);
                         ubi_dump_vid_hdr(vid_hdr);
@@ -527,7 +529,7 @@ int ubi_add_to_av(struct ubi_device *ubi, struct ubi_attach_info *ai, int pnum,
                          * This logical eraseblock is newer than the one
                          * found earlier.
                          */
-                        err = validate_vid_hdr(vid_hdr, av, pnum);
+                        err = validate_vid_hdr(ubi, vid_hdr, av, pnum);
                         if (err)
                                 return err;
 
@@ -565,7 +567,7 @@ int ubi_add_to_av(struct ubi_device *ubi, struct ubi_attach_info *ai, int pnum,
          * attaching information.
          */
 
-        err = validate_vid_hdr(vid_hdr, av, pnum);
+        err = validate_vid_hdr(ubi, vid_hdr, av, pnum);
         if (err)
                 return err;
 
@@ -668,7 +670,8 @@ static int early_erase_peb(struct ubi_device *ubi,
                  * Erase counter overflow. Upgrade UBI and use 64-bit
                  * erase counters internally.
                  */
-                ubi_err("erase counter overflow at PEB %d, EC %d", pnum, ec);
+                ubi_err(ubi, "erase counter overflow at PEB %d, EC %d",
+                        pnum, ec);
                 return -EINVAL;
         }
 
@@ -736,7 +739,7 @@ struct ubi_ainf_peb *ubi_early_get_peb(struct ubi_device *ubi,
                 return aeb;
         }
 
-        ubi_err("no free eraseblocks");
+        ubi_err(ubi, "no free eraseblocks");
         return ERR_PTR(-ENOSPC);
 }
 
@@ -785,9 +788,9 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
         if (ubi_check_pattern(ubi->peb_buf, 0xFF, ubi->leb_size))
                 goto out_unlock;
 
-        ubi_err("PEB %d contains corrupted VID header, and the data does not contain all 0xFF",
+        ubi_err(ubi, "PEB %d contains corrupted VID header, and the data does not contain all 0xFF",
                 pnum);
-        ubi_err("this may be a non-UBI PEB or a severe VID header corruption which requires manual inspection");
+        ubi_err(ubi, "this may be a non-UBI PEB or a severe VID header corruption which requires manual inspection");
         ubi_dump_vid_hdr(vid_hdr);
         pr_err("hexdump of PEB %d offset %d, length %d",
                pnum, ubi->leb_start, ubi->leb_size);
@@ -859,7 +862,8 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 bitflips = 1;
                 break;
         default:
-                ubi_err("'ubi_io_read_ec_hdr()' returned unknown code %d", err);
+                ubi_err(ubi, "'ubi_io_read_ec_hdr()' returned unknown code %d",
+                        err);
                 return -EINVAL;
         }
 
@@ -868,7 +872,7 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
 
                 /* Make sure UBI version is OK */
                 if (ech->version != UBI_VERSION) {
-                        ubi_err("this UBI version is %d, image version is %d",
+                        ubi_err(ubi, "this UBI version is %d, image version is %d",
                                 UBI_VERSION, (int)ech->version);
                         return -EINVAL;
                 }
@@ -882,7 +886,7 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                          * flash. Upgrade UBI and use 64-bit erase counters
                          * internally.
                          */
-                        ubi_err("erase counter overflow, max is %d",
+                        ubi_err(ubi, "erase counter overflow, max is %d",
                                 UBI_MAX_ERASECOUNTER);
                         ubi_dump_ec_hdr(ech);
                         return -EINVAL;
@@ -903,7 +907,7 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 if (!ubi->image_seq)
                         ubi->image_seq = image_seq;
                 if (image_seq && ubi->image_seq != image_seq) {
-                        ubi_err("bad image sequence number %d in PEB %d, expected %d",
+                        ubi_err(ubi, "bad image sequence number %d in PEB %d, expected %d",
                                 image_seq, pnum, ubi->image_seq);
                         ubi_dump_ec_hdr(ech);
                         return -EINVAL;
@@ -981,7 +985,7 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                         return err;
                 goto adjust_mean_ec;
         default:
-                ubi_err("'ubi_io_read_vid_hdr()' returned unknown code %d",
+                ubi_err(ubi, "'ubi_io_read_vid_hdr()' returned unknown code %d",
                         err);
                 return -EINVAL;
         }
@@ -999,7 +1003,7 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 case UBI_COMPAT_DELETE:
                         if (vol_id != UBI_FM_SB_VOLUME_ID
                             && vol_id != UBI_FM_DATA_VOLUME_ID) {
-                                ubi_msg("\"delete\" compatible internal volume %d:%d found, will remove it",
+                                ubi_msg(ubi, "\"delete\" compatible internal volume %d:%d found, will remove it",
                                         vol_id, lnum);
                         }
                         err = add_to_list(ai, pnum, vol_id, lnum,
@@ -1009,13 +1013,13 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                         return 0;
 
                 case UBI_COMPAT_RO:
-                        ubi_msg("read-only compatible internal volume %d:%d found, switch to read-only mode",
+                        ubi_msg(ubi, "read-only compatible internal volume %d:%d found, switch to read-only mode",
                                 vol_id, lnum);
                         ubi->ro_mode = 1;
                         break;
 
                 case UBI_COMPAT_PRESERVE:
-                        ubi_msg("\"preserve\" compatible internal volume %d:%d found",
+                        ubi_msg(ubi, "\"preserve\" compatible internal volume %d:%d found",
                                 vol_id, lnum);
                         err = add_to_list(ai, pnum, vol_id, lnum,
                                           ec, 0, &ai->alien);
@@ -1024,14 +1028,14 @@ static int scan_peb(struct ubi_device *ubi, struct ubi_attach_info *ai,
                         return 0;
 
                 case UBI_COMPAT_REJECT:
-                        ubi_err("incompatible internal volume %d:%d found",
+                        ubi_err(ubi, "incompatible internal volume %d:%d found",
                                 vol_id, lnum);
                         return -EINVAL;
                 }
         }
 
         if (ec_err)
-                ubi_warn("valid VID header but corrupted EC header at PEB %d",
+                ubi_warn(ubi, "valid VID header but corrupted EC header at PEB %d",
                          pnum);
         err = ubi_add_to_av(ubi, ai, pnum, ec, vidh, bitflips);
         if (err)
@@ -1075,7 +1079,7 @@ static int late_analysis(struct ubi_device *ubi, struct ubi_attach_info *ai)
          * with the flash HW or driver.
          */
         if (ai->corr_peb_count) {
-                ubi_err("%d PEBs are corrupted and preserved",
+                ubi_err(ubi, "%d PEBs are corrupted and preserved",
                         ai->corr_peb_count);
                 pr_err("Corrupted PEBs are:");
                 list_for_each_entry(aeb, &ai->corr, u.list)
@@ -1087,7 +1091,7 @@ static int late_analysis(struct ubi_device *ubi, struct ubi_attach_info *ai)
                  * otherwise, only print a warning.
                  */
                 if (ai->corr_peb_count >= max_corr) {
-                        ubi_err("too many corrupted PEBs, refusing");
+                        ubi_err(ubi, "too many corrupted PEBs, refusing");
                         return -EINVAL;
                 }
         }
@@ -1110,11 +1114,11 @@ static int late_analysis(struct ubi_device *ubi, struct ubi_attach_info *ai)
                  */
                 if (ai->maybe_bad_peb_count <= 2) {
                         ai->is_empty = 1;
-                        ubi_msg("empty MTD device detected");
+                        ubi_msg(ubi, "empty MTD device detected");
                         get_random_bytes(&ubi->image_seq,
                                          sizeof(ubi->image_seq));
                 } else {
-                        ubi_err("MTD device is not UBI-formatted and possibly contains non-UBI data - refusing it");
+                        ubi_err(ubi, "MTD device is not UBI-formatted and possibly contains non-UBI data - refusing it");
                         return -EINVAL;
                 }
 
@@ -1248,7 +1252,7 @@ static int scan_all(struct ubi_device *ubi, struct ubi_attach_info *ai,
                         goto out_vidh;
         }
 
-        ubi_msg("scanning is finished");
+        ubi_msg(ubi, "scanning is finished");
 
         /* Calculate mean erase counter */
         if (ai->ec_count)
@@ -1515,37 +1519,37 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
                 vols_found += 1;
 
                 if (ai->is_empty) {
-                        ubi_err("bad is_empty flag");
+                        ubi_err(ubi, "bad is_empty flag");
                         goto bad_av;
                 }
 
                 if (av->vol_id < 0 || av->highest_lnum < 0 ||
                     av->leb_count < 0 || av->vol_type < 0 || av->used_ebs < 0 ||
                     av->data_pad < 0 || av->last_data_size < 0) {
-                        ubi_err("negative values");
+                        ubi_err(ubi, "negative values");
                         goto bad_av;
                 }
 
                 if (av->vol_id >= UBI_MAX_VOLUMES &&
                     av->vol_id < UBI_INTERNAL_VOL_START) {
-                        ubi_err("bad vol_id");
+                        ubi_err(ubi, "bad vol_id");
                         goto bad_av;
                 }
 
                 if (av->vol_id > ai->highest_vol_id) {
-                        ubi_err("highest_vol_id is %d, but vol_id %d is there",
+                        ubi_err(ubi, "highest_vol_id is %d, but vol_id %d is there",
                                 ai->highest_vol_id, av->vol_id);
                         goto out;
                 }
 
                 if (av->vol_type != UBI_DYNAMIC_VOLUME &&
                     av->vol_type != UBI_STATIC_VOLUME) {
-                        ubi_err("bad vol_type");
+                        ubi_err(ubi, "bad vol_type");
                         goto bad_av;
                 }
 
                 if (av->data_pad > ubi->leb_size / 2) {
-                        ubi_err("bad data_pad");
+                        ubi_err(ubi, "bad data_pad");
                         goto bad_av;
                 }
 
@@ -1557,48 +1561,48 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
                         leb_count += 1;
 
                         if (aeb->pnum < 0 || aeb->ec < 0) {
-                                ubi_err("negative values");
+                                ubi_err(ubi, "negative values");
                                 goto bad_aeb;
                         }
 
                         if (aeb->ec < ai->min_ec) {
-                                ubi_err("bad ai->min_ec (%d), %d found",
+                                ubi_err(ubi, "bad ai->min_ec (%d), %d found",
                                         ai->min_ec, aeb->ec);
                                 goto bad_aeb;
                         }
 
                         if (aeb->ec > ai->max_ec) {
-                                ubi_err("bad ai->max_ec (%d), %d found",
+                                ubi_err(ubi, "bad ai->max_ec (%d), %d found",
                                         ai->max_ec, aeb->ec);
                                 goto bad_aeb;
                         }
 
                         if (aeb->pnum >= ubi->peb_count) {
-                                ubi_err("too high PEB number %d, total PEBs %d",
+                                ubi_err(ubi, "too high PEB number %d, total PEBs %d",
                                         aeb->pnum, ubi->peb_count);
                                 goto bad_aeb;
                         }
 
                         if (av->vol_type == UBI_STATIC_VOLUME) {
                                 if (aeb->lnum >= av->used_ebs) {
-                                        ubi_err("bad lnum or used_ebs");
+                                        ubi_err(ubi, "bad lnum or used_ebs");
                                         goto bad_aeb;
                                 }
                         } else {
                                 if (av->used_ebs != 0) {
-                                        ubi_err("non-zero used_ebs");
+                                        ubi_err(ubi, "non-zero used_ebs");
                                         goto bad_aeb;
                                 }
                         }
 
                         if (aeb->lnum > av->highest_lnum) {
-                                ubi_err("incorrect highest_lnum or lnum");
+                                ubi_err(ubi, "incorrect highest_lnum or lnum");
                                 goto bad_aeb;
                         }
                 }
 
                 if (av->leb_count != leb_count) {
-                        ubi_err("bad leb_count, %d objects in the tree",
+                        ubi_err(ubi, "bad leb_count, %d objects in the tree",
                                 leb_count);
                         goto bad_av;
                 }
@@ -1609,13 +1613,13 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
                 aeb = last_aeb;
 
                 if (aeb->lnum != av->highest_lnum) {
-                        ubi_err("bad highest_lnum");
+                        ubi_err(ubi, "bad highest_lnum");
                         goto bad_aeb;
                 }
         }
 
         if (vols_found != ai->vols_found) {
-                ubi_err("bad ai->vols_found %d, should be %d",
+                ubi_err(ubi, "bad ai->vols_found %d, should be %d",
                         ai->vols_found, vols_found);
                 goto out;
         }
@@ -1632,7 +1636,8 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
 
                         err = ubi_io_read_vid_hdr(ubi, aeb->pnum, vidh, 1);
                         if (err && err != UBI_IO_BITFLIPS) {
-                                ubi_err("VID header is not OK (%d)", err);
+                                ubi_err(ubi, "VID header is not OK (%d)",
+                                        err);
                                 if (err > 0)
                                         err = -EIO;
                                 return err;
@@ -1641,37 +1646,37 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
                         vol_type = vidh->vol_type == UBI_VID_DYNAMIC ?
                                    UBI_DYNAMIC_VOLUME : UBI_STATIC_VOLUME;
                         if (av->vol_type != vol_type) {
-                                ubi_err("bad vol_type");
+                                ubi_err(ubi, "bad vol_type");
                                 goto bad_vid_hdr;
                         }
 
                         if (aeb->sqnum != be64_to_cpu(vidh->sqnum)) {
-                                ubi_err("bad sqnum %llu", aeb->sqnum);
+                                ubi_err(ubi, "bad sqnum %llu", aeb->sqnum);
                                 goto bad_vid_hdr;
                         }
 
                         if (av->vol_id != be32_to_cpu(vidh->vol_id)) {
-                                ubi_err("bad vol_id %d", av->vol_id);
+                                ubi_err(ubi, "bad vol_id %d", av->vol_id);
                                 goto bad_vid_hdr;
                         }
 
                         if (av->compat != vidh->compat) {
-                                ubi_err("bad compat %d", vidh->compat);
+                                ubi_err(ubi, "bad compat %d", vidh->compat);
                                 goto bad_vid_hdr;
                         }
 
                         if (aeb->lnum != be32_to_cpu(vidh->lnum)) {
-                                ubi_err("bad lnum %d", aeb->lnum);
+                                ubi_err(ubi, "bad lnum %d", aeb->lnum);
                                 goto bad_vid_hdr;
                         }
 
                         if (av->used_ebs != be32_to_cpu(vidh->used_ebs)) {
-                                ubi_err("bad used_ebs %d", av->used_ebs);
+                                ubi_err(ubi, "bad used_ebs %d", av->used_ebs);
                                 goto bad_vid_hdr;
                         }
 
                         if (av->data_pad != be32_to_cpu(vidh->data_pad)) {
-                                ubi_err("bad data_pad %d", av->data_pad);
+                                ubi_err(ubi, "bad data_pad %d", av->data_pad);
                                 goto bad_vid_hdr;
                         }
                 }
@@ -1680,12 +1685,13 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
                         continue;
 
                 if (av->highest_lnum != be32_to_cpu(vidh->lnum)) {
-                        ubi_err("bad highest_lnum %d", av->highest_lnum);
+                        ubi_err(ubi, "bad highest_lnum %d", av->highest_lnum);
                         goto bad_vid_hdr;
                 }
 
                 if (av->last_data_size != be32_to_cpu(vidh->data_size)) {
-                        ubi_err("bad last_data_size %d", av->last_data_size);
+                        ubi_err(ubi, "bad last_data_size %d",
+                                av->last_data_size);
                         goto bad_vid_hdr;
                 }
         }
@@ -1726,7 +1732,7 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
         err = 0;
         for (pnum = 0; pnum < ubi->peb_count; pnum++)
                 if (!buf[pnum]) {
-                        ubi_err("PEB %d is not referred", pnum);
+                        ubi_err(ubi, "PEB %d is not referred", pnum);
                         err = 1;
                 }
 
@@ -1736,18 +1742,18 @@ static int self_check_ai(struct ubi_device *ubi, struct ubi_attach_info *ai)
         return 0;
 
 bad_aeb:
-        ubi_err("bad attaching information about LEB %d", aeb->lnum);
+        ubi_err(ubi, "bad attaching information about LEB %d", aeb->lnum);
         ubi_dump_aeb(aeb, 0);
         ubi_dump_av(av);
         goto out;
 
 bad_av:
-        ubi_err("bad attaching information about volume %d", av->vol_id);
+        ubi_err(ubi, "bad attaching information about volume %d", av->vol_id);
         ubi_dump_av(av);
         goto out;
 
 bad_vid_hdr:
-        ubi_err("bad attaching information about volume %d", av->vol_id);
+        ubi_err(ubi, "bad attaching information about volume %d", av->vol_id);
         ubi_dump_av(av);
         ubi_dump_vid_hdr(vidh);
 
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index 8876c7d3d712..6b6bce28bd63 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -111,13 +111,13 @@ static int __init ubiblock_set_param(const char *val,
 
         len = strnlen(val, UBIBLOCK_PARAM_LEN);
         if (len == 0) {
-                ubi_warn("block: empty 'block=' parameter - ignored\n");
+                pr_warn("UBI: block: empty 'block=' parameter - ignored\n");
                 return 0;
         }
 
         if (len == UBIBLOCK_PARAM_LEN) {
-                ubi_err("block: parameter \"%s\" is too long, max. is %d\n",
-                        val, UBIBLOCK_PARAM_LEN);
+                pr_err("UBI: block: parameter \"%s\" is too long, max. is %d\n",
+                       val, UBIBLOCK_PARAM_LEN);
                 return -EINVAL;
         }
 
@@ -188,9 +188,8 @@ static int ubiblock_read_to_buf(struct ubiblock *dev, char *buffer,
 
         ret = ubi_read(dev->desc, leb, buffer, offset, len);
         if (ret) {
-                ubi_err("%s: error %d while reading from LEB %d (offset %d, "
-                        "length %d)", dev->gd->disk_name, ret, leb, offset,
-                        len);
+                dev_err(disk_to_dev(dev->gd), "%d while reading from LEB %d (offset %d, length %d)",
+                        ret, leb, offset, len);
                 return ret;
         }
         return 0;
@@ -328,8 +327,8 @@ static int ubiblock_open(struct block_device *bdev, fmode_t mode)
 
         dev->desc = ubi_open_volume(dev->ubi_num, dev->vol_id, UBI_READONLY);
         if (IS_ERR(dev->desc)) {
-                ubi_err("%s failed to open ubi volume %d_%d",
-                        dev->gd->disk_name, dev->ubi_num, dev->vol_id);
+                dev_err(disk_to_dev(dev->gd), "failed to open ubi volume %d_%d",
+                        dev->ubi_num, dev->vol_id);
                 ret = PTR_ERR(dev->desc);
                 dev->desc = NULL;
                 goto out_unlock;
@@ -405,7 +404,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
         /* Initialize the gendisk of this ubiblock device */
         gd = alloc_disk(1);
         if (!gd) {
-                ubi_err("block: alloc_disk failed");
+                pr_err("UBI: block: alloc_disk failed");
                 ret = -ENODEV;
                 goto out_free_dev;
         }
@@ -421,7 +420,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
         spin_lock_init(&dev->queue_lock);
         dev->rq = blk_init_queue(ubiblock_request, &dev->queue_lock);
         if (!dev->rq) {
-                ubi_err("block: blk_init_queue failed");
+                dev_err(disk_to_dev(gd), "blk_init_queue failed");
                 ret = -ENODEV;
                 goto out_put_disk;
         }
@@ -446,8 +445,8 @@ int ubiblock_create(struct ubi_volume_info *vi)
 
         /* Must be the last step: anyone can call file ops from now on */
         add_disk(dev->gd);
-        ubi_msg("%s created from ubi%d:%d(%s)",
-                dev->gd->disk_name, dev->ubi_num, dev->vol_id, vi->name);
+        dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)",
+                 dev->ubi_num, dev->vol_id, vi->name);
         return 0;
 
 out_free_queue:
@@ -464,7 +463,7 @@ static void ubiblock_cleanup(struct ubiblock *dev)
 {
         del_gendisk(dev->gd);
         blk_cleanup_queue(dev->rq);
-        ubi_msg("%s released", dev->gd->disk_name);
+        dev_info(disk_to_dev(dev->gd), "released");
         put_disk(dev->gd);
 }
 
@@ -518,8 +517,8 @@ static int ubiblock_resize(struct ubi_volume_info *vi)
         }
         if ((sector_t)disk_capacity != disk_capacity) {
                 mutex_unlock(&devices_mutex);
-                ubi_warn("%s: the volume is too big (%d LEBs), cannot resize",
-                         dev->gd->disk_name, vi->size);
+                dev_warn(disk_to_dev(dev->gd), "the volume is too big (%d LEBs), cannot resize",
+                         vi->size);
                 return -EFBIG;
         }
 
@@ -527,8 +526,8 @@ static int ubiblock_resize(struct ubi_volume_info *vi)
 
         if (get_capacity(dev->gd) != disk_capacity) {
                 set_capacity(dev->gd, disk_capacity);
-                ubi_msg("%s resized to %lld bytes", dev->gd->disk_name,
-                        vi->used_bytes);
+                dev_info(disk_to_dev(dev->gd), "resized to %lld bytes",
+                         vi->used_bytes);
         }
         mutex_unlock(&dev->dev_mutex);
         mutex_unlock(&devices_mutex);
@@ -596,8 +595,8 @@ static int __init ubiblock_create_from_param(void)
 
                 desc = open_volume_desc(p->name, p->ubi_num, p->vol_id);
                 if (IS_ERR(desc)) {
-                        ubi_err("block: can't open volume, err=%ld\n",
-                                PTR_ERR(desc));
+                        pr_err("UBI: block: can't open volume, err=%ld\n",
+                               PTR_ERR(desc));
                         ret = PTR_ERR(desc);
                         break;
                 }
@@ -607,8 +606,8 @@ static int __init ubiblock_create_from_param(void)
 
                 ret = ubiblock_create(&vi);
                 if (ret) {
-                        ubi_err("block: can't add '%s' volume, err=%d\n",
-                                vi.name, ret);
+                        pr_err("UBI: block: can't add '%s' volume, err=%d\n",
+                               vi.name, ret);
                         break;
                 }
         }
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 6e30a3c280d0..3405be46ebe9 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -166,7 +166,7 @@ int ubi_volume_notify(struct ubi_device *ubi, struct ubi_volume *vol, int ntype)
         case UBI_VOLUME_RESIZED:
         case UBI_VOLUME_RENAMED:
                 if (ubi_update_fastmap(ubi)) {
-                        ubi_err("Unable to update fastmap!");
+                        ubi_err(ubi, "Unable to update fastmap!");
                         ubi_ro_mode(ubi);
                 }
         }
@@ -517,7 +517,7 @@ static int uif_init(struct ubi_device *ubi, int *ref)
          */
         err = alloc_chrdev_region(&dev, 0, ubi->vtbl_slots + 1, ubi->ubi_name);
         if (err) {
-                ubi_err("cannot register UBI character devices");
+                ubi_err(ubi, "cannot register UBI character devices");
                 return err;
         }
 
@@ -528,7 +528,7 @@ static int uif_init(struct ubi_device *ubi, int *ref)
 
         err = cdev_add(&ubi->cdev, dev, 1);
         if (err) {
-                ubi_err("cannot add character device");
+                ubi_err(ubi, "cannot add character device");
                 goto out_unreg;
         }
 
@@ -540,7 +540,7 @@ static int uif_init(struct ubi_device *ubi, int *ref)
                 if (ubi->volumes[i]) {
                         err = ubi_add_volume(ubi, ubi->volumes[i]);
                         if (err) {
-                                ubi_err("cannot add volume %d", i);
+                                ubi_err(ubi, "cannot add volume %d", i);
                                 goto out_volumes;
                         }
                 }
@@ -556,7 +556,8 @@ out_sysfs:
         cdev_del(&ubi->cdev);
 out_unreg:
         unregister_chrdev_region(ubi->cdev.dev, ubi->vtbl_slots + 1);
-        ubi_err("cannot initialize UBI %s, error %d", ubi->ubi_name, err);
+        ubi_err(ubi, "cannot initialize UBI %s, error %d",
+                ubi->ubi_name, err);
         return err;
 }
 
@@ -650,7 +651,7 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
                  * guess we should just pick the largest region. But this is
                  * not implemented.
                  */
-                ubi_err("multiple regions, not implemented");
+                ubi_err(ubi, "multiple regions, not implemented");
                 return -EINVAL;
         }
 
@@ -685,7 +686,7 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
          * which allows us to avoid costly division operations.
          */
         if (!is_power_of_2(ubi->min_io_size)) {
-                ubi_err("min. I/O unit (%d) is not power of 2",
+                ubi_err(ubi, "min. I/O unit (%d) is not power of 2",
                         ubi->min_io_size);
                 return -EINVAL;
         }
@@ -702,7 +703,7 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
         if (ubi->max_write_size < ubi->min_io_size ||
             ubi->max_write_size % ubi->min_io_size ||
             !is_power_of_2(ubi->max_write_size)) {
-                ubi_err("bad write buffer size %d for %d min. I/O unit",
+                ubi_err(ubi, "bad write buffer size %d for %d min. I/O unit",
                         ubi->max_write_size, ubi->min_io_size);
                 return -EINVAL;
         }
@@ -739,7 +740,7 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
 
         /* The shift must be aligned to 32-bit boundary */
         if (ubi->vid_hdr_shift % 4) {
-                ubi_err("unaligned VID header shift %d",
+                ubi_err(ubi, "unaligned VID header shift %d",
                         ubi->vid_hdr_shift);
                 return -EINVAL;
         }
@@ -749,7 +750,7 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
             ubi->leb_start < ubi->vid_hdr_offset + UBI_VID_HDR_SIZE ||
             ubi->leb_start > ubi->peb_size - UBI_VID_HDR_SIZE ||
             ubi->leb_start & (ubi->min_io_size - 1)) {
-                ubi_err("bad VID header (%d) or data offsets (%d)",
+                ubi_err(ubi, "bad VID header (%d) or data offsets (%d)",
                         ubi->vid_hdr_offset, ubi->leb_start);
                 return -EINVAL;
         }
@@ -769,14 +770,14 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
          * read-only mode.
          */
         if (ubi->vid_hdr_offset + UBI_VID_HDR_SIZE <= ubi->hdrs_min_io_size) {
-                ubi_warn("EC and VID headers are in the same minimal I/O unit, switch to read-only mode");
+                ubi_warn(ubi, "EC and VID headers are in the same minimal I/O unit, switch to read-only mode");
                 ubi->ro_mode = 1;
         }
 
         ubi->leb_size = ubi->peb_size - ubi->leb_start;
 
         if (!(ubi->mtd->flags & MTD_WRITEABLE)) {
-                ubi_msg("MTD device %d is write-protected, attach in read-only mode",
+                ubi_msg(ubi, "MTD device %d is write-protected, attach in read-only mode",
                         ubi->mtd->index);
                 ubi->ro_mode = 1;
         }
@@ -809,7 +810,7 @@ static int autoresize(struct ubi_device *ubi, int vol_id)
         int err, old_reserved_pebs = vol->reserved_pebs;
 
         if (ubi->ro_mode) {
-                ubi_warn("skip auto-resize because of R/O mode");
+                ubi_warn(ubi, "skip auto-resize because of R/O mode");
                 return 0;
         }
 
@@ -830,21 +831,22 @@ static int autoresize(struct ubi_device *ubi, int vol_id)
                 vtbl_rec = ubi->vtbl[vol_id];
                 err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
                 if (err)
-                        ubi_err("cannot clean auto-resize flag for volume %d",
+                        ubi_err(ubi, "cannot clean auto-resize flag for volume %d",
                                 vol_id);
         } else {
                 desc.vol = vol;
                 err = ubi_resize_volume(&desc,
                                         old_reserved_pebs + ubi->avail_pebs);
                 if (err)
-                        ubi_err("cannot auto-resize volume %d", vol_id);
+                        ubi_err(ubi, "cannot auto-resize volume %d",
+                                vol_id);
         }
 
         if (err)
                 return err;
 
-        ubi_msg("volume %d (\"%s\") re-sized from %d to %d LEBs", vol_id,
-                vol->name, old_reserved_pebs, vol->reserved_pebs);
+        ubi_msg(ubi, "volume %d (\"%s\") re-sized from %d to %d LEBs",
+                vol_id, vol->name, old_reserved_pebs, vol->reserved_pebs);
         return 0;
 }
 
@@ -885,7 +887,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
         for (i = 0; i < UBI_MAX_DEVICES; i++) {
                 ubi = ubi_devices[i];
                 if (ubi && mtd->index == ubi->mtd->index) {
-                        ubi_err("mtd%d is already attached to ubi%d",
+                        ubi_err(ubi, "mtd%d is already attached to ubi%d",
                                 mtd->index, i);
                         return -EEXIST;
                 }
@@ -900,7 +902,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
          * no sense to attach emulated MTD devices, so we prohibit this.
          */
         if (mtd->type == MTD_UBIVOLUME) {
-                ubi_err("refuse attaching mtd%d - it is already emulated on top of UBI",
+                ubi_err(ubi, "refuse attaching mtd%d - it is already emulated on top of UBI",
                         mtd->index);
                 return -EINVAL;
         }
@@ -911,7 +913,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
                         if (!ubi_devices[ubi_num])
                                 break;
                 if (ubi_num == UBI_MAX_DEVICES) {
-                        ubi_err("only %d UBI devices may be created",
+                        ubi_err(ubi, "only %d UBI devices may be created",
                                 UBI_MAX_DEVICES);
                         return -ENFILE;
                 }
@@ -921,7 +923,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
 
                 /* Make sure ubi_num is not busy */
                 if (ubi_devices[ubi_num]) {
-                        ubi_err("ubi%d already exists", ubi_num);
+                        ubi_err(ubi, "ubi%d already exists", ubi_num);
                         return -EEXIST;
                 }
         }
@@ -953,13 +955,14 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
 
         if (!ubi->fm_disabled && (int)mtd_div_by_eb(ubi->mtd->size, ubi->mtd)
             <= UBI_FM_MAX_START) {
-                ubi_err("More than %i PEBs are needed for fastmap, sorry.",
+                ubi_err(ubi, "More than %i PEBs are needed for fastmap, sorry.",
                         UBI_FM_MAX_START);
                 ubi->fm_disabled = 1;
         }
 
-        ubi_msg("default fastmap pool size: %d", ubi->fm_pool.max_size);
-        ubi_msg("default fastmap WL pool size: %d", ubi->fm_wl_pool.max_size);
+        ubi_msg(ubi, "default fastmap pool size: %d", ubi->fm_pool.max_size);
+        ubi_msg(ubi, "default fastmap WL pool size: %d",
+                ubi->fm_wl_pool.max_size);
 #else
         ubi->fm_disabled = 1;
 #endif
@@ -970,7 +973,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
         mutex_init(&ubi->fm_mutex);
         init_rwsem(&ubi->fm_sem);
 
-        ubi_msg("attaching mtd%d to ubi%d", mtd->index, ubi_num);
+        ubi_msg(ubi, "attaching mtd%d to ubi%d", mtd->index, ubi_num);
 
         err = io_init(ubi, max_beb_per1024);
         if (err)
@@ -989,7 +992,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
 #endif
         err = ubi_attach(ubi, 0);
         if (err) {
-                ubi_err("failed to attach mtd%d, error %d", mtd->index, err);
+                ubi_err(ubi, "failed to attach mtd%d, error %d",
+                        mtd->index, err);
                 goto out_free;
         }
 
@@ -1010,28 +1014,28 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
         ubi->bgt_thread = kthread_create(ubi_thread, ubi, "%s", ubi->bgt_name);
         if (IS_ERR(ubi->bgt_thread)) {
                 err = PTR_ERR(ubi->bgt_thread);
-                ubi_err("cannot spawn \"%s\", error %d", ubi->bgt_name,
-                        err);
+                ubi_err(ubi, "cannot spawn \"%s\", error %d",
+                        ubi->bgt_name, err);
                 goto out_debugfs;
         }
 
-        ubi_msg("attached mtd%d (name \"%s\", size %llu MiB) to ubi%d",
-                mtd->index, mtd->name, ubi->flash_size >> 20, ubi_num);
-        ubi_msg("PEB size: %d bytes (%d KiB), LEB size: %d bytes",
+        ubi_msg(ubi, "attached mtd%d (name \"%s\", size %llu MiB)",
+                mtd->index, mtd->name, ubi->flash_size >> 20);
+        ubi_msg(ubi, "PEB size: %d bytes (%d KiB), LEB size: %d bytes",
                 ubi->peb_size, ubi->peb_size >> 10, ubi->leb_size);
-        ubi_msg("min./max. I/O unit sizes: %d/%d, sub-page size %d",
+        ubi_msg(ubi, "min./max. I/O unit sizes: %d/%d, sub-page size %d",
                 ubi->min_io_size, ubi->max_write_size, ubi->hdrs_min_io_size);
-        ubi_msg("VID header offset: %d (aligned %d), data offset: %d",
+        ubi_msg(ubi, "VID header offset: %d (aligned %d), data offset: %d",
                 ubi->vid_hdr_offset, ubi->vid_hdr_aloffset, ubi->leb_start);
-        ubi_msg("good PEBs: %d, bad PEBs: %d, corrupted PEBs: %d",
+        ubi_msg(ubi, "good PEBs: %d, bad PEBs: %d, corrupted PEBs: %d",
                 ubi->good_peb_count, ubi->bad_peb_count, ubi->corr_peb_count);
-        ubi_msg("user volume: %d, internal volumes: %d, max. volumes count: %d",
+        ubi_msg(ubi, "user volume: %d, internal volumes: %d, max. volumes count: %d",
                 ubi->vol_count - UBI_INT_VOL_COUNT, UBI_INT_VOL_COUNT,
                 ubi->vtbl_slots);
-        ubi_msg("max/mean erase counter: %d/%d, WL threshold: %d, image sequence number: %u",
+        ubi_msg(ubi, "max/mean erase counter: %d/%d, WL threshold: %d, image sequence number: %u",
                 ubi->max_ec, ubi->mean_ec, CONFIG_MTD_UBI_WL_THRESHOLD,
                 ubi->image_seq);
-        ubi_msg("available PEBs: %d, total reserved PEBs: %d, PEBs reserved for bad PEB handling: %d",
+        ubi_msg(ubi, "available PEBs: %d, total reserved PEBs: %d, PEBs reserved for bad PEB handling: %d",
                 ubi->avail_pebs, ubi->rsvd_pebs, ubi->beb_rsvd_pebs);
 
         /*
@@ -1100,7 +1104,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
                         return -EBUSY;
                 }
                 /* This may only happen if there is a bug */
-                ubi_err("%s reference count %d, destroy anyway",
+                ubi_err(ubi, "%s reference count %d, destroy anyway",
                         ubi->ubi_name, ubi->ref_count);
         }
         ubi_devices[ubi_num] = NULL;
@@ -1108,7 +1112,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
 
         ubi_assert(ubi_num == ubi->ubi_num);
         ubi_notify_all(ubi, UBI_VOLUME_REMOVED, NULL);
-        ubi_msg("detaching mtd%d from ubi%d", ubi->mtd->index, ubi_num);
+        ubi_msg(ubi, "detaching mtd%d", ubi->mtd->index);
 #ifdef CONFIG_MTD_UBI_FASTMAP
         /* If we don't write a new fastmap at detach time we lose all
          * EC updates that have been made since the last written fastmap. */
@@ -1136,7 +1140,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
         put_mtd_device(ubi->mtd);
         vfree(ubi->peb_buf);
         vfree(ubi->fm_buf);
-        ubi_msg("mtd%d is detached from ubi%d", ubi->mtd->index, ubi->ubi_num);
+        ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
         put_device(&ubi->dev);
         return 0;
 }
@@ -1218,7 +1222,8 @@ static int __init ubi_init(void)
         BUILD_BUG_ON(sizeof(struct ubi_vid_hdr) != 64);
 
         if (mtd_devs > UBI_MAX_DEVICES) {
-                ubi_err("too many MTD devices, maximum is %d", UBI_MAX_DEVICES);
+                pr_err("UBI error: too many MTD devices, maximum is %d",
+                       UBI_MAX_DEVICES);
                 return -EINVAL;
         }
 
@@ -1226,19 +1231,19 @@ static int __init ubi_init(void)
         ubi_class = class_create(THIS_MODULE, UBI_NAME_STR);
         if (IS_ERR(ubi_class)) {
                 err = PTR_ERR(ubi_class);
-                ubi_err("cannot create UBI class");
+                pr_err("UBI error: cannot create UBI class");
                 goto out;
         }
 
         err = class_create_file(ubi_class, &ubi_version);
         if (err) {
-                ubi_err("cannot create sysfs file");
+                pr_err("UBI error: cannot create sysfs file");
                 goto out_class;
         }
 
         err = misc_register(&ubi_ctrl_cdev);
         if (err) {
-                ubi_err("cannot register device");
+                pr_err("UBI error: cannot register device");
                 goto out_version;
         }
 
@@ -1265,7 +1270,8 @@ static int __init ubi_init(void)
                 mtd = open_mtd_device(p->name);
                 if (IS_ERR(mtd)) {
                         err = PTR_ERR(mtd);
-                        ubi_err("cannot open mtd %s, error %d", p->name, err);
+                        pr_err("UBI error: cannot open mtd %s, error %d",
+                               p->name, err);
                         /* See comment below re-ubi_is_module(). */
                         if (ubi_is_module())
                                 goto out_detach;
@@ -1277,7 +1283,8 @@ static int __init ubi_init(void)
                                          p->vid_hdr_offs, p->max_beb_per1024);
                 mutex_unlock(&ubi_devices_mutex);
                 if (err < 0) {
-                        ubi_err("cannot attach mtd%d", mtd->index);
+                        pr_err("UBI error: cannot attach mtd%d",
+                               mtd->index);
                         put_mtd_device(mtd);
 
                         /*
@@ -1300,7 +1307,7 @@ static int __init ubi_init(void)
 
         err = ubiblock_init();
         if (err) {
-                ubi_err("block: cannot initialize, error %d", err);
+                pr_err("UBI error: block: cannot initialize, error %d", err);
 
                 /* See comment above re-ubi_is_module(). */
                 if (ubi_is_module())
@@ -1326,7 +1333,7 @@ out_version:
 out_class:
         class_destroy(ubi_class);
 out:
-        ubi_err("cannot initialize UBI, error %d", err);
+        pr_err("UBI error: cannot initialize UBI, error %d", err);
         return err;
 }
 late_initcall(ubi_init);
@@ -1365,7 +1372,7 @@ static int __init bytes_str_to_int(const char *str)
 
         result = simple_strtoul(str, &endp, 0);
         if (str == endp || result >= INT_MAX) {
-                ubi_err("incorrect bytes count: \"%s\"\n", str);
+                pr_err("UBI error: incorrect bytes count: \"%s\"\n", str);
                 return -EINVAL;
         }
 
@@ -1381,7 +1388,7 @@ static int __init bytes_str_to_int(const char *str)
         case '\0':
                 break;
         default:
-                ubi_err("incorrect bytes count: \"%s\"\n", str);
+                pr_err("UBI error: incorrect bytes count: \"%s\"\n", str);
                 return -EINVAL;
         }
 
@@ -1408,20 +1415,20 @@ static int __init ubi_mtd_param_parse(const char *val, struct kernel_param *kp)
                 return -EINVAL;
 
         if (mtd_devs == UBI_MAX_DEVICES) {
-                ubi_err("too many parameters, max. is %d\n",
-                        UBI_MAX_DEVICES);
+                pr_err("UBI error: too many parameters, max. is %d\n",
+                       UBI_MAX_DEVICES);
                 return -EINVAL;
         }
 
         len = strnlen(val, MTD_PARAM_LEN_MAX);
         if (len == MTD_PARAM_LEN_MAX) {
-                ubi_err("parameter \"%s\" is too long, max. is %d\n",
-                        val, MTD_PARAM_LEN_MAX);
+                pr_err("UBI error: parameter \"%s\" is too long, max. is %d\n",
+                       val, MTD_PARAM_LEN_MAX);
                 return -EINVAL;
         }
 
         if (len == 0) {
-                pr_warn("UBI warning: empty 'mtd=' parameter - ignored\n");
+                pr_err("UBI warning: empty 'mtd=' parameter - ignored\n");
                 return 0;
         }
 
@@ -1435,7 +1442,7 @@ static int __init ubi_mtd_param_parse(const char *val, struct kernel_param *kp)
                 tokens[i] = strsep(&pbuf, ",");
 
         if (pbuf) {
-                ubi_err("too many arguments at \"%s\"\n", val);
+                pr_err("UBI error: too many arguments at \"%s\"\n", val);
                 return -EINVAL;
         }
 
@@ -1455,8 +1462,8 @@ static int __init ubi_mtd_param_parse(const char *val, struct kernel_param *kp)
                 int err = kstrtoint(token, 10, &p->max_beb_per1024);
 
                 if (err) {
-                        ubi_err("bad value for max_beb_per1024 parameter: %s",
-                                token);
+                        pr_err("UBI error: bad value for max_beb_per1024 parameter: %s",
+                               token);
                         return -EINVAL;
                 }
         }
@@ -1466,7 +1473,8 @@ static int __init ubi_mtd_param_parse(const char *val, struct kernel_param *kp)
                 int err = kstrtoint(token, 10, &p->ubi_num);
 
                 if (err) {
-                        ubi_err("bad value for ubi_num parameter: %s", token);
+                        pr_err("UBI error: bad value for ubi_num parameter: %s",
+                               token);
                         return -EINVAL;
                 }
         } else
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index 59de69a24e40..3410ea8109f8 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -48,13 +48,14 @@
 
 /**
  * get_exclusive - get exclusive access to an UBI volume.
+ * @ubi: UBI device description object
  * @desc: volume descriptor
  *
  * This function changes UBI volume open mode to "exclusive". Returns previous
  * mode value (positive integer) in case of success and a negative error code
  * in case of failure.
  */
-static int get_exclusive(struct ubi_volume_desc *desc)
+static int get_exclusive(struct ubi_device *ubi, struct ubi_volume_desc *desc)
 {
         int users, err;
         struct ubi_volume *vol = desc->vol;
@@ -63,7 +64,7 @@ static int get_exclusive(struct ubi_volume_desc *desc)
         users = vol->readers + vol->writers + vol->exclusive;
         ubi_assert(users > 0);
         if (users > 1) {
-                ubi_err("%d users for volume %d", users, vol->vol_id);
+                ubi_err(ubi, "%d users for volume %d", users, vol->vol_id);
                 err = -EBUSY;
         } else {
                 vol->readers = vol->writers = 0;
@@ -134,7 +135,7 @@ static int vol_cdev_release(struct inode *inode, struct file *file)
                 vol->ubi->ubi_num, vol->vol_id, desc->mode);
 
         if (vol->updating) {
-                ubi_warn("update of volume %d not finished, volume is damaged",
+                ubi_warn(vol->ubi, "update of volume %d not finished, volume is damaged",
                          vol->vol_id);
                 ubi_assert(!vol->changing_leb);
                 vol->updating = 0;
@@ -158,7 +159,7 @@ static loff_t vol_cdev_llseek(struct file *file, loff_t offset, int origin)
 
         if (vol->updating) {
                 /* Update is in progress, seeking is prohibited */
-                ubi_err("updating");
+                ubi_err(vol->ubi, "updating");
                 return -EBUSY;
         }
 
@@ -193,11 +194,11 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
                 count, *offp, vol->vol_id);
 
         if (vol->updating) {
-                ubi_err("updating");
+                ubi_err(vol->ubi, "updating");
                 return -EBUSY;
         }
         if (vol->upd_marker) {
-                ubi_err("damaged volume, update marker is set");
+                ubi_err(vol->ubi, "damaged volume, update marker is set");
                 return -EBADF;
         }
         if (*offp == vol->used_bytes || count == 0)
@@ -277,7 +278,7 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
 
         lnum = div_u64_rem(*offp, vol->usable_leb_size, &off);
         if (off & (ubi->min_io_size - 1)) {
-                ubi_err("unaligned position");
+                ubi_err(ubi, "unaligned position");
                 return -EINVAL;
         }
 
@@ -286,7 +287,7 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
 
         /* We can write only in fractions of the minimum I/O unit */
         if (count & (ubi->min_io_size - 1)) {
-                ubi_err("unaligned write length");
+                ubi_err(ubi, "unaligned write length");
                 return -EINVAL;
         }
 
@@ -348,7 +349,7 @@ static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
                 err = ubi_more_leb_change_data(ubi, vol, buf, count);
 
         if (err < 0) {
-                ubi_err("cannot accept more %zd bytes of data, error %d",
+                ubi_err(ubi, "cannot accept more %zd bytes of data, error %d",
                         count, err);
                 return err;
         }
@@ -370,7 +371,7 @@ static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
                         return err;
 
                 if (err) {
-                        ubi_warn("volume %d on UBI device %d is corrupted",
+                        ubi_warn(ubi, "volume %d on UBI device %d is corrupted",
                                  vol->vol_id, ubi->ubi_num);
                         vol->corrupted = 1;
                 }
@@ -420,7 +421,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
                         break;
                 }
 
-                err = get_exclusive(desc);
+                err = get_exclusive(ubi, desc);
                 if (err < 0)
                         break;
 
@@ -456,7 +457,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
                     req.bytes < 0 || req.lnum >= vol->usable_leb_size)
                         break;
 
-                err = get_exclusive(desc);
+                err = get_exclusive(ubi, desc);
                 if (err < 0)
                         break;
 
@@ -642,7 +643,7 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
         return 0;
 
 bad:
-        ubi_err("bad volume creation request");
+        ubi_err(ubi, "bad volume creation request");
         ubi_dump_mkvol_req(req);
         return err;
 }
@@ -708,12 +709,12 @@ static int rename_volumes(struct ubi_device *ubi,
         for (i = 0; i < req->count - 1; i++) {
                 for (n = i + 1; n < req->count; n++) {
                         if (req->ents[i].vol_id == req->ents[n].vol_id) {
-                                ubi_err("duplicated volume id %d",
+                                ubi_err(ubi, "duplicated volume id %d",
                                         req->ents[i].vol_id);
                                 return -EINVAL;
                         }
                         if (!strcmp(req->ents[i].name, req->ents[n].name)) {
-                                ubi_err("duplicated volume name \"%s\"",
+                                ubi_err(ubi, "duplicated volume name \"%s\"",
                                         req->ents[i].name);
                                 return -EINVAL;
                         }
@@ -736,7 +737,8 @@ static int rename_volumes(struct ubi_device *ubi,
                 re->desc = ubi_open_volume(ubi->ubi_num, vol_id, UBI_READWRITE);
                 if (IS_ERR(re->desc)) {
                         err = PTR_ERR(re->desc);
-                        ubi_err("cannot open volume %d, error %d", vol_id, err);
+                        ubi_err(ubi, "cannot open volume %d, error %d",
+                                vol_id, err);
                         kfree(re);
                         goto out_free;
                 }
@@ -795,7 +797,7 @@ static int rename_volumes(struct ubi_device *ubi,
                                 continue;
 
                         /* The volume exists but busy, or an error occurred */
-                        ubi_err("cannot open volume \"%s\", error %d",
+                        ubi_err(ubi, "cannot open volume \"%s\", error %d",
                                 re->new_name, err);
                         goto out_free;
                 }
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index 63cb1d7236ce..7335c9ff9d99 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -43,12 +43,12 @@ void ubi_dump_flash(struct ubi_device *ubi, int pnum, int offset, int len)
                 return;
         err = mtd_read(ubi->mtd, addr, len, &read, buf);
         if (err && err != -EUCLEAN) {
-                ubi_err("error %d while reading %d bytes from PEB %d:%d, read %zd bytes",
+                ubi_err(ubi, "err %d while reading %d bytes from PEB %d:%d, read %zd bytes",
                         err, len, pnum, offset, read);
                 goto out;
         }
 
-        ubi_msg("dumping %d bytes of data from PEB %d, offset %d",
+        ubi_msg(ubi, "dumping %d bytes of data from PEB %d, offset %d",
                 len, pnum, offset);
         print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1, buf, len, 1);
 out:
@@ -238,8 +238,8 @@ int ubi_debugfs_init(void)
         if (IS_ERR_OR_NULL(dfs_rootdir)) {
                 int err = dfs_rootdir ? -ENODEV : PTR_ERR(dfs_rootdir);
 
-                ubi_err("cannot create \"ubi\" debugfs directory, error %d\n",
-                        err);
+                pr_err("UBI error: cannot create \"ubi\" debugfs directory, error %d\n",
+                       err);
                 return err;
         }
 
@@ -433,7 +433,7 @@ out_remove:
         debugfs_remove_recursive(d->dfs_dir);
 out:
         err = dent ? PTR_ERR(dent) : -ENODEV;
-        ubi_err("cannot create \"%s\" debugfs file or directory, error %d\n",
+        ubi_err(ubi, "cannot create \"%s\" debugfs file or directory, error %d\n",
                 fname, err);
         return err;
 }
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 2402d3b50171..a40020cf0923 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -422,7 +422,7 @@ retry:
                                  */
                                 if (err == UBI_IO_BAD_HDR_EBADMSG ||
                                     err == UBI_IO_BAD_HDR) {
-                                        ubi_warn("corrupted VID header at PEB %d, LEB %d:%d",
+                                        ubi_warn(ubi, "corrupted VID header at PEB %d, LEB %d:%d",
                                                  pnum, vol_id, lnum);
                                         err = -EBADMSG;
                                 } else
@@ -448,7 +448,7 @@ retry:
                                 goto out_unlock;
                         scrub = 1;
                         if (!check) {
-                                ubi_msg("force data checking");
+                                ubi_msg(ubi, "force data checking");
                                 check = 1;
                                 goto retry;
                         }
@@ -459,7 +459,7 @@ retry:
         if (check) {
                 uint32_t crc1 = crc32(UBI_CRC32_INIT, buf, len);
                 if (crc1 != crc) {
-                        ubi_warn("CRC error: calculated %#08x, must be %#08x",
+                        ubi_warn(ubi, "CRC error: calculated %#08x, must be %#08x",
                                  crc1, crc);
                         err = -EBADMSG;
                         goto out_unlock;
@@ -513,7 +513,8 @@ retry:
                 return new_pnum;
         }
 
-        ubi_msg("recover PEB %d, move data to PEB %d", pnum, new_pnum);
+        ubi_msg(ubi, "recover PEB %d, move data to PEB %d",
+                pnum, new_pnum);
 
         err = ubi_io_read_vid_hdr(ubi, pnum, vid_hdr, 1);
         if (err && err != UBI_IO_BITFLIPS) {
@@ -554,7 +555,7 @@ retry:
         up_read(&ubi->fm_sem);
         ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1);
 
-        ubi_msg("data was successfully recovered");
+        ubi_msg(ubi, "data was successfully recovered");
         return 0;
 
 out_unlock:
@@ -569,13 +570,13 @@ write_error:
          * Bad luck? This physical eraseblock is bad too? Crud. Let's try to
          * get another one.
          */
-        ubi_warn("failed to write to PEB %d", new_pnum);
+        ubi_warn(ubi, "failed to write to PEB %d", new_pnum);
         ubi_wl_put_peb(ubi, vol_id, lnum, new_pnum, 1);
         if (++tries > UBI_IO_RETRIES) {
                 ubi_free_vid_hdr(ubi, vid_hdr);
                 return err;
         }
-        ubi_msg("try again");
+        ubi_msg(ubi, "try again");
         goto retry;
 }
 
@@ -613,7 +614,7 @@ int ubi_eba_write_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
 
                 err = ubi_io_write_data(ubi, buf, pnum, offset, len);
                 if (err) {
-                        ubi_warn("failed to write data to PEB %d", pnum);
+                        ubi_warn(ubi, "failed to write data to PEB %d", pnum);
                         if (err == -EIO && ubi->bad_allowed)
                                 err = recover_peb(ubi, pnum, vol_id, lnum, buf,
                                                   offset, len);
@@ -654,7 +655,7 @@ retry:
 
         err = ubi_io_write_vid_hdr(ubi, pnum, vid_hdr);
         if (err) {
-                ubi_warn("failed to write VID header to LEB %d:%d, PEB %d",
+                ubi_warn(ubi, "failed to write VID header to LEB %d:%d, PEB %d",
                          vol_id, lnum, pnum);
                 goto write_error;
         }
@@ -662,7 +663,7 @@ retry:
         if (len) {
                 err = ubi_io_write_data(ubi, buf, pnum, offset, len);
                 if (err) {
-                        ubi_warn("failed to write %d bytes at offset %d of LEB %d:%d, PEB %d",
+                        ubi_warn(ubi, "failed to write %d bytes at offset %d of LEB %d:%d, PEB %d",
                                  len, offset, vol_id, lnum, pnum);
                         goto write_error;
                 }
@@ -698,7 +699,7 @@ write_error:
         }
 
         vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
-        ubi_msg("try another PEB");
+        ubi_msg(ubi, "try another PEB");
         goto retry;
 }
 
@@ -775,14 +776,14 @@ retry:
 
         err = ubi_io_write_vid_hdr(ubi, pnum, vid_hdr);
         if (err) {
-                ubi_warn("failed to write VID header to LEB %d:%d, PEB %d",
+                ubi_warn(ubi, "failed to write VID header to LEB %d:%d, PEB %d",
                          vol_id, lnum, pnum);
                 goto write_error;
         }
 
         err = ubi_io_write_data(ubi, buf, pnum, 0, len);
         if (err) {
-                ubi_warn("failed to write %d bytes of data to PEB %d",
+                ubi_warn(ubi, "failed to write %d bytes of data to PEB %d",
                          len, pnum);
                 goto write_error;
         }
@@ -818,7 +819,7 @@ write_error:
         }
 
         vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
-        ubi_msg("try another PEB");
+        ubi_msg(ubi, "try another PEB");
         goto retry;
 }
 
@@ -893,14 +894,14 @@ retry:
 
         err = ubi_io_write_vid_hdr(ubi, pnum, vid_hdr);
         if (err) {
-                ubi_warn("failed to write VID header to LEB %d:%d, PEB %d",
+                ubi_warn(ubi, "failed to write VID header to LEB %d:%d, PEB %d",
                          vol_id, lnum, pnum);
                 goto write_error;
         }
 
         err = ubi_io_write_data(ubi, buf, pnum, 0, len);
         if (err) {
-                ubi_warn("failed to write %d bytes of data to PEB %d",
+                ubi_warn(ubi, "failed to write %d bytes of data to PEB %d",
                          len, pnum);
                 goto write_error;
         }
@@ -940,7 +941,7 @@ write_error:
         }
 
         vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
-        ubi_msg("try another PEB");
+        ubi_msg(ubi, "try another PEB");
         goto retry;
 }
 
@@ -1063,7 +1064,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
         dbg_wl("read %d bytes of data", aldata_size);
         err = ubi_io_read_data(ubi, ubi->peb_buf, from, 0, aldata_size);
         if (err && err != UBI_IO_BITFLIPS) {
-                ubi_warn("error %d while reading data from PEB %d",
+                ubi_warn(ubi, "error %d while reading data from PEB %d",
                          err, from);
                 err = MOVE_SOURCE_RD_ERR;
                 goto out_unlock_buf;
@@ -1113,7 +1114,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
         err = ubi_io_read_vid_hdr(ubi, to, vid_hdr, 1);
         if (err) {
                 if (err != UBI_IO_BITFLIPS) {
-                        ubi_warn("error %d while reading VID header back from PEB %d",
+                        ubi_warn(ubi, "error %d while reading VID header back from PEB %d",
                                  err, to);
                         if (is_error_sane(err))
                                 err = MOVE_TARGET_RD_ERR;
@@ -1140,7 +1141,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
                 err = ubi_io_read_data(ubi, ubi->peb_buf, to, 0, aldata_size);
                 if (err) {
                         if (err != UBI_IO_BITFLIPS) {
-                                ubi_warn("error %d while reading data back from PEB %d",
+                                ubi_warn(ubi, "error %d while reading data back from PEB %d",
                                          err, to);
                                 if (is_error_sane(err))
                                         err = MOVE_TARGET_RD_ERR;
@@ -1152,7 +1153,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
                 cond_resched();
 
                 if (crc != crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size)) {
-                        ubi_warn("read data back from PEB %d and it is different",
+                        ubi_warn(ubi, "read data back from PEB %d and it is different",
                                  to);
                         err = -EINVAL;
                         goto out_unlock_buf;
@@ -1205,10 +1206,10 @@ static void print_rsvd_warning(struct ubi_device *ubi,
                         return;
         }
 
-        ubi_warn("cannot reserve enough PEBs for bad PEB handling, reserved %d, need %d",
+        ubi_warn(ubi, "cannot reserve enough PEBs for bad PEB handling, reserved %d, need %d",
                  ubi->beb_rsvd_pebs, ubi->beb_rsvd_level);
         if (ubi->corr_peb_count)
-                ubi_warn("%d PEBs are corrupted and not used",
+                ubi_warn(ubi, "%d PEBs are corrupted and not used",
                          ubi->corr_peb_count);
 }
 
@@ -1286,7 +1287,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
                                         fm_eba[i][j] == UBI_LEB_UNMAPPED)
                                         continue;
 
-                                ubi_err("LEB:%i:%i is PEB:%i instead of %i!",
+                                ubi_err(ubi, "LEB:%i:%i is PEB:%i instead of %i!",
                                         vol->vol_id, i, fm_eba[i][j],
                                         scan_eba[i][j]);
                                 ubi_assert(0);
@@ -1366,10 +1367,10 @@ int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
         }
 
         if (ubi->avail_pebs < EBA_RESERVED_PEBS) {
-                ubi_err("no enough physical eraseblocks (%d, need %d)",
+                ubi_err(ubi, "no enough physical eraseblocks (%d, need %d)",
                         ubi->avail_pebs, EBA_RESERVED_PEBS);
                 if (ubi->corr_peb_count)
-                        ubi_err("%d PEBs are corrupted and not used",
+                        ubi_err(ubi, "%d PEBs are corrupted and not used",
                                 ubi->corr_peb_count);
                 err = -ENOSPC;
                 goto out_free;
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index cfd5b5e90156..b56672bf3294 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -330,7 +330,7 @@ static int process_pool_aeb(struct ubi_device *ubi, struct ubi_attach_info *ai,
         if (found)
                 av = tmp_av;
         else {
-                ubi_err("orphaned volume in fastmap pool!");
+                ubi_err(ubi, "orphaned volume in fastmap pool!");
                 kmem_cache_free(ai->aeb_slab_cache, new_aeb);
                 return UBI_BAD_FASTMAP;
         }
@@ -414,14 +414,14 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 pnum = be32_to_cpu(pebs[i]);
 
                 if (ubi_io_is_bad(ubi, pnum)) {
-                        ubi_err("bad PEB in fastmap pool!");
+                        ubi_err(ubi, "bad PEB in fastmap pool!");
                         ret = UBI_BAD_FASTMAP;
                         goto out;
                 }
 
                 err = ubi_io_read_ec_hdr(ubi, pnum, ech, 0);
                 if (err && err != UBI_IO_BITFLIPS) {
-                        ubi_err("unable to read EC header! PEB:%i err:%i",
+                        ubi_err(ubi, "unable to read EC header! PEB:%i err:%i",
                                 pnum, err);
                         ret = err > 0 ? UBI_BAD_FASTMAP : err;
                         goto out;
@@ -435,7 +435,7 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 image_seq = be32_to_cpu(ech->image_seq);
 
                 if (image_seq && (image_seq != ubi->image_seq)) {
-                        ubi_err("bad image seq: 0x%x, expected: 0x%x",
+                        ubi_err(ubi, "bad image seq: 0x%x, expected: 0x%x",
                                 be32_to_cpu(ech->image_seq), ubi->image_seq);
                         ret = UBI_BAD_FASTMAP;
                         goto out;
@@ -493,7 +493,7 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                         }
                 } else {
                         /* We are paranoid and fall back to scanning mode */
-                        ubi_err("fastmap pool PEBs contains damaged PEBs!");
+                        ubi_err(ubi, "fastmap pool PEBs contains damaged PEBs!");
                         ret = err > 0 ? UBI_BAD_FASTMAP : err;
                         goto out;
                 }
@@ -588,7 +588,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
                 goto fail_bad;
 
         if (be32_to_cpu(fmhdr->magic) != UBI_FM_HDR_MAGIC) {
-                ubi_err("bad fastmap header magic: 0x%x, expected: 0x%x",
+                ubi_err(ubi, "bad fastmap header magic: 0x%x, expected: 0x%x",
                         be32_to_cpu(fmhdr->magic), UBI_FM_HDR_MAGIC);
                 goto fail_bad;
         }
@@ -598,7 +598,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
         if (fm_pos >= fm_size)
                 goto fail_bad;
         if (be32_to_cpu(fmpl1->magic) != UBI_FM_POOL_MAGIC) {
-                ubi_err("bad fastmap pool magic: 0x%x, expected: 0x%x",
+                ubi_err(ubi, "bad fastmap pool magic: 0x%x, expected: 0x%x",
                         be32_to_cpu(fmpl1->magic), UBI_FM_POOL_MAGIC);
                 goto fail_bad;
         }
@@ -608,7 +608,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
         if (fm_pos >= fm_size)
                 goto fail_bad;
         if (be32_to_cpu(fmpl2->magic) != UBI_FM_POOL_MAGIC) {
-                ubi_err("bad fastmap pool magic: 0x%x, expected: 0x%x",
+                ubi_err(ubi, "bad fastmap pool magic: 0x%x, expected: 0x%x",
                         be32_to_cpu(fmpl2->magic), UBI_FM_POOL_MAGIC);
                 goto fail_bad;
         }
@@ -619,25 +619,26 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
         fm->max_wl_pool_size = be16_to_cpu(fmpl2->max_size);
 
         if (pool_size > UBI_FM_MAX_POOL_SIZE || pool_size < 0) {
-                ubi_err("bad pool size: %i", pool_size);
+                ubi_err(ubi, "bad pool size: %i", pool_size);
                 goto fail_bad;
         }
 
         if (wl_pool_size > UBI_FM_MAX_POOL_SIZE || wl_pool_size < 0) {
-                ubi_err("bad WL pool size: %i", wl_pool_size);
+                ubi_err(ubi, "bad WL pool size: %i", wl_pool_size);
                 goto fail_bad;
         }
 
 
         if (fm->max_pool_size > UBI_FM_MAX_POOL_SIZE ||
             fm->max_pool_size < 0) {
-                ubi_err("bad maximal pool size: %i", fm->max_pool_size);
+                ubi_err(ubi, "bad maximal pool size: %i", fm->max_pool_size);
                 goto fail_bad;
         }
 
         if (fm->max_wl_pool_size > UBI_FM_MAX_POOL_SIZE ||
             fm->max_wl_pool_size < 0) {
-                ubi_err("bad maximal WL pool size: %i", fm->max_wl_pool_size);
+                ubi_err(ubi, "bad maximal WL pool size: %i",
+                        fm->max_wl_pool_size);
                 goto fail_bad;
         }
 
@@ -696,8 +697,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
                         goto fail_bad;
 
                 if (be32_to_cpu(fmvhdr->magic) != UBI_FM_VHDR_MAGIC) {
-                        ubi_err("bad fastmap vol header magic: 0x%x, " \
-                                "expected: 0x%x",
+                        ubi_err(ubi, "bad fastmap vol header magic: 0x%x, expected: 0x%x",
                                 be32_to_cpu(fmvhdr->magic), UBI_FM_VHDR_MAGIC);
                         goto fail_bad;
                 }
@@ -722,8 +722,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
                         goto fail_bad;
 
                 if (be32_to_cpu(fm_eba->magic) != UBI_FM_EBA_MAGIC) {
-                        ubi_err("bad fastmap EBA header magic: 0x%x, " \
-                                "expected: 0x%x",
+                        ubi_err(ubi, "bad fastmap EBA header magic: 0x%x, expected: 0x%x",
                                 be32_to_cpu(fm_eba->magic), UBI_FM_EBA_MAGIC);
                         goto fail_bad;
                 }
@@ -788,7 +787,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
                         int err;
 
                         if (ubi_io_is_bad(ubi, tmp_aeb->pnum)) {
-                                ubi_err("bad PEB in fastmap EBA orphan list");
+                                ubi_err(ubi, "bad PEB in fastmap EBA orphan list");
                                 ret = UBI_BAD_FASTMAP;
                                 kfree(ech);
                                 goto fail;
@@ -796,8 +795,8 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 
                         err = ubi_io_read_ec_hdr(ubi, tmp_aeb->pnum, ech, 0);
                         if (err && err != UBI_IO_BITFLIPS) {
-                                ubi_err("unable to read EC header! PEB:%i " \
-                                        "err:%i", tmp_aeb->pnum, err);
+                                ubi_err(ubi, "unable to read EC header! PEB:%i err:%i",
+                                        tmp_aeb->pnum, err);
                                 ret = err > 0 ? UBI_BAD_FASTMAP : err;
                                 kfree(ech);
 
@@ -908,14 +907,14 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 fm->to_be_tortured[0] = 1;
 
         if (be32_to_cpu(fmsb->magic) != UBI_FM_SB_MAGIC) {
-                ubi_err("bad super block magic: 0x%x, expected: 0x%x",
+                ubi_err(ubi, "bad super block magic: 0x%x, expected: 0x%x",
                         be32_to_cpu(fmsb->magic), UBI_FM_SB_MAGIC);
                 ret = UBI_BAD_FASTMAP;
                 goto free_fm_sb;
         }
 
         if (fmsb->version != UBI_FM_FMT_VERSION) {
-                ubi_err("bad fastmap version: %i, expected: %i",
+                ubi_err(ubi, "bad fastmap version: %i, expected: %i",
                         fmsb->version, UBI_FM_FMT_VERSION);
                 ret = UBI_BAD_FASTMAP;
                 goto free_fm_sb;
@@ -923,15 +922,16 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
 
         used_blocks = be32_to_cpu(fmsb->used_blocks);
         if (used_blocks > UBI_FM_MAX_BLOCKS || used_blocks < 1) {
-                ubi_err("number of fastmap blocks is invalid: %i", used_blocks);
+                ubi_err(ubi, "number of fastmap blocks is invalid: %i",
+                        used_blocks);
                 ret = UBI_BAD_FASTMAP;
                 goto free_fm_sb;
         }
 
         fm_size = ubi->leb_size * used_blocks;
         if (fm_size != ubi->fm_size) {
-                ubi_err("bad fastmap size: %zi, expected: %zi", fm_size,
-                        ubi->fm_size);
+                ubi_err(ubi, "bad fastmap size: %zi, expected: %zi",
+                        fm_size, ubi->fm_size);
                 ret = UBI_BAD_FASTMAP;
                 goto free_fm_sb;
         }
@@ -960,7 +960,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
 
                 ret = ubi_io_read_ec_hdr(ubi, pnum, ech, 0);
                 if (ret && ret != UBI_IO_BITFLIPS) {
-                        ubi_err("unable to read fastmap block# %i EC (PEB: %i)",
+                        ubi_err(ubi, "unable to read fastmap block# %i EC (PEB: %i)",
                                 i, pnum);
                         if (ret > 0)
                                 ret = UBI_BAD_FASTMAP;
@@ -977,7 +977,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
                  * we shouldn't fail if image_seq == 0.
                  */
                 if (image_seq && (image_seq != ubi->image_seq)) {
-                        ubi_err("wrong image seq:%d instead of %d",
+                        ubi_err(ubi, "wrong image seq:%d instead of %d",
                                 be32_to_cpu(ech->image_seq), ubi->image_seq);
                         ret = UBI_BAD_FASTMAP;
                         goto free_hdr;
@@ -985,15 +985,14 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
 
                 ret = ubi_io_read_vid_hdr(ubi, pnum, vh, 0);
                 if (ret && ret != UBI_IO_BITFLIPS) {
-                        ubi_err("unable to read fastmap block# %i (PEB: %i)",
+                        ubi_err(ubi, "unable to read fastmap block# %i (PEB: %i)",
                                 i, pnum);
                         goto free_hdr;
                 }
 
                 if (i == 0) {
                         if (be32_to_cpu(vh->vol_id) != UBI_FM_SB_VOLUME_ID) {
-                                ubi_err("bad fastmap anchor vol_id: 0x%x," \
-                                        " expected: 0x%x",
+                                ubi_err(ubi, "bad fastmap anchor vol_id: 0x%x, expected: 0x%x",
                                         be32_to_cpu(vh->vol_id),
                                         UBI_FM_SB_VOLUME_ID);
                                 ret = UBI_BAD_FASTMAP;
@@ -1001,8 +1000,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
                         }
                 } else {
                         if (be32_to_cpu(vh->vol_id) != UBI_FM_DATA_VOLUME_ID) {
-                                ubi_err("bad fastmap data vol_id: 0x%x," \
-                                        " expected: 0x%x",
+                                ubi_err(ubi, "bad fastmap data vol_id: 0x%x, expected: 0x%x",
                                         be32_to_cpu(vh->vol_id),
                                         UBI_FM_DATA_VOLUME_ID);
                                 ret = UBI_BAD_FASTMAP;
@@ -1016,7 +1014,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
                 ret = ubi_io_read(ubi, ubi->fm_buf + (ubi->leb_size * i), pnum,
                                   ubi->leb_start, ubi->leb_size);
                 if (ret && ret != UBI_IO_BITFLIPS) {
-                        ubi_err("unable to read fastmap block# %i (PEB: %i, " \
+                        ubi_err(ubi, "unable to read fastmap block# %i (PEB: %i, "
                                 "err: %i)", i, pnum, ret);
                         goto free_hdr;
                 }
@@ -1030,8 +1028,9 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
         fmsb2->data_crc = 0;
         crc = crc32(UBI_CRC32_INIT, ubi->fm_buf, fm_size);
         if (crc != tmp_crc) {
-                ubi_err("fastmap data CRC is invalid");
-                ubi_err("CRC should be: 0x%x, calc: 0x%x", tmp_crc, crc);
+                ubi_err(ubi, "fastmap data CRC is invalid");
+                ubi_err(ubi, "CRC should be: 0x%x, calc: 0x%x",
+                        tmp_crc, crc);
                 ret = UBI_BAD_FASTMAP;
                 goto free_hdr;
         }
@@ -1067,9 +1066,10 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
         ubi->fm = fm;
         ubi->fm_pool.max_size = ubi->fm->max_pool_size;
         ubi->fm_wl_pool.max_size = ubi->fm->max_wl_pool_size;
-        ubi_msg("attached by fastmap");
-        ubi_msg("fastmap pool size: %d", ubi->fm_pool.max_size);
-        ubi_msg("fastmap WL pool size: %d", ubi->fm_wl_pool.max_size);
+        ubi_msg(ubi, "attached by fastmap");
+        ubi_msg(ubi, "fastmap pool size: %d", ubi->fm_pool.max_size);
+        ubi_msg(ubi, "fastmap WL pool size: %d",
+                ubi->fm_wl_pool.max_size);
         ubi->fm_disabled = 0;
 
         ubi_free_vid_hdr(ubi, vh);
@@ -1077,7 +1077,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
 out:
         mutex_unlock(&ubi->fm_mutex);
         if (ret == UBI_BAD_FASTMAP)
-                ubi_err("Attach by fastmap failed, doing a full scan!");
+                ubi_err(ubi, "Attach by fastmap failed, doing a full scan!");
         return ret;
 
 free_hdr:
@@ -1273,7 +1273,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
         dbg_bld("writing fastmap SB to PEB %i", new_fm->e[0]->pnum);
         ret = ubi_io_write_vid_hdr(ubi, new_fm->e[0]->pnum, avhdr);
         if (ret) {
-                ubi_err("unable to write vid_hdr to fastmap SB!");
+                ubi_err(ubi, "unable to write vid_hdr to fastmap SB!");
                 goto out_kfree;
         }
 
@@ -1293,7 +1293,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
                         new_fm->e[i]->pnum, be64_to_cpu(dvhdr->sqnum));
                 ret = ubi_io_write_vid_hdr(ubi, new_fm->e[i]->pnum, dvhdr);
                 if (ret) {
-                        ubi_err("unable to write vid_hdr to PEB %i!",
+                        ubi_err(ubi, "unable to write vid_hdr to PEB %i!",
                                 new_fm->e[i]->pnum);
                         goto out_kfree;
                 }
@@ -1303,7 +1303,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
                 ret = ubi_io_write(ubi, fm_raw + (i * ubi->leb_size),
                         new_fm->e[i]->pnum, ubi->leb_start, ubi->leb_size);
                 if (ret) {
-                        ubi_err("unable to write fastmap to PEB %i!",
+                        ubi_err(ubi, "unable to write fastmap to PEB %i!",
                                 new_fm->e[i]->pnum);
                         goto out_kfree;
                 }
@@ -1450,7 +1450,7 @@ int ubi_update_fastmap(struct ubi_device *ubi)
         ubi->fm = NULL;
 
         if (new_fm->used_blocks > UBI_FM_MAX_BLOCKS) {
-                ubi_err("fastmap too large");
+                ubi_err(ubi, "fastmap too large");
                 ret = -ENOSPC;
                 goto err;
         }
@@ -1462,7 +1462,7 @@ int ubi_update_fastmap(struct ubi_device *ubi)
 
                 if (!tmp_e && !old_fm) {
                         int j;
-                        ubi_err("could not get any free erase block");
+                        ubi_err(ubi, "could not get any free erase block");
 
                         for (j = 1; j < i; j++)
                                 ubi_wl_put_fm_peb(ubi, new_fm->e[j], j, 0);
@@ -1478,7 +1478,7 @@ int ubi_update_fastmap(struct ubi_device *ubi)
                                         ubi_wl_put_fm_peb(ubi, new_fm->e[j],
                                                           j, 0);
 
-                                ubi_err("could not erase old fastmap PEB");
+                                ubi_err(ubi, "could not erase old fastmap PEB");
                                 goto err;
                         }
 
@@ -1504,7 +1504,7 @@ int ubi_update_fastmap(struct ubi_device *ubi)
                         ret = erase_block(ubi, old_fm->e[0]->pnum);
                         if (ret < 0) {
                                 int i;
-                                ubi_err("could not erase old anchor PEB");
+                                ubi_err(ubi, "could not erase old anchor PEB");
 
                                 for (i = 1; i < new_fm->used_blocks; i++)
                                         ubi_wl_put_fm_peb(ubi, new_fm->e[i],
@@ -1525,7 +1525,7 @@ int ubi_update_fastmap(struct ubi_device *ubi)
         } else {
                 if (!tmp_e) {
                         int i;
-                        ubi_err("could not find any anchor PEB");
+                        ubi_err(ubi, "could not find any anchor PEB");
 
                         for (i = 1; i < new_fm->used_blocks; i++)
                                 ubi_wl_put_fm_peb(ubi, new_fm->e[i], i, 0);
@@ -1555,13 +1555,13 @@ out_unlock:
 err:
         kfree(new_fm);
 
-        ubi_warn("Unable to write new fastmap, err=%i", ret);
+        ubi_warn(ubi, "Unable to write new fastmap, err=%i", ret);
 
         ret = 0;
         if (old_fm) {
                 ret = invalidate_fastmap(ubi, old_fm);
                 if (ret < 0)
-                        ubi_err("Unable to invalidiate current fastmap!");
+                        ubi_err(ubi, "Unable to invalidiate current fastmap!");
                 else if (ret)
                         ret = 0;
         }
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index d36134925d31..396aaa543362 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -177,19 +177,20 @@ retry:
                          * enabled. A corresponding message will be printed
                          * later, when it is has been scrubbed.
                          */
-                        ubi_msg("fixable bit-flip detected at PEB %d", pnum);
+                        ubi_msg(ubi, "fixable bit-flip detected at PEB %d",
+                                pnum);
                         ubi_assert(len == read);
                         return UBI_IO_BITFLIPS;
                 }
 
                 if (retries++ < UBI_IO_RETRIES) {
-                        ubi_warn("error %d%s while reading %d bytes from PEB %d:%d, read only %zd bytes, retry",
+                        ubi_warn(ubi, "error %d%s while reading %d bytes from PEB %d:%d, read only %zd bytes, retry",
                                  err, errstr, len, pnum, offset, read);
                         yield();
                         goto retry;
                 }
 
-                ubi_err("error %d%s while reading %d bytes from PEB %d:%d, read %zd bytes",
+                ubi_err(ubi, "error %d%s while reading %d bytes from PEB %d:%d, read %zd bytes",
                         err, errstr, len, pnum, offset, read);
                 dump_stack();
 
@@ -246,7 +247,7 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
         ubi_assert(len > 0 && len % ubi->hdrs_min_io_size == 0);
 
         if (ubi->ro_mode) {
-                ubi_err("read-only mode");
+                ubi_err(ubi, "read-only mode");
                 return -EROFS;
         }
 
@@ -273,7 +274,7 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
         }
 
         if (ubi_dbg_is_write_failure(ubi)) {
-                ubi_err("cannot write %d bytes to PEB %d:%d (emulated)",
+                ubi_err(ubi, "cannot write %d bytes to PEB %d:%d (emulated)",
                         len, pnum, offset);
                 dump_stack();
                 return -EIO;
@@ -282,7 +283,7 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
         addr = (loff_t)pnum * ubi->peb_size + offset;
         err = mtd_write(ubi->mtd, addr, len, &written, buf);
         if (err) {
-                ubi_err("error %d while writing %d bytes to PEB %d:%d, written %zd bytes",
+                ubi_err(ubi, "error %d while writing %d bytes to PEB %d:%d, written %zd bytes",
                         err, len, pnum, offset, written);
                 dump_stack();
                 ubi_dump_flash(ubi, pnum, offset, len);
@@ -338,7 +339,7 @@ static int do_sync_erase(struct ubi_device *ubi, int pnum)
         ubi_assert(pnum >= 0 && pnum < ubi->peb_count);
 
         if (ubi->ro_mode) {
-                ubi_err("read-only mode");
+                ubi_err(ubi, "read-only mode");
                 return -EROFS;
         }
 
@@ -355,12 +356,12 @@ retry:
         err = mtd_erase(ubi->mtd, &ei);
         if (err) {
                 if (retries++ < UBI_IO_RETRIES) {
-                        ubi_warn("error %d while erasing PEB %d, retry",
+                        ubi_warn(ubi, "error %d while erasing PEB %d, retry",
                                  err, pnum);
                         yield();
                         goto retry;
                 }
-                ubi_err("cannot erase PEB %d, error %d", pnum, err);
+                ubi_err(ubi, "cannot erase PEB %d, error %d", pnum, err);
                 dump_stack();
                 return err;
         }
@@ -368,17 +369,18 @@ retry:
         err = wait_event_interruptible(wq, ei.state == MTD_ERASE_DONE ||
                                            ei.state == MTD_ERASE_FAILED);
         if (err) {
-                ubi_err("interrupted PEB %d erasure", pnum);
+                ubi_err(ubi, "interrupted PEB %d erasure", pnum);
                 return -EINTR;
         }
 
         if (ei.state == MTD_ERASE_FAILED) {
                 if (retries++ < UBI_IO_RETRIES) {
-                        ubi_warn("error while erasing PEB %d, retry", pnum);
+                        ubi_warn(ubi, "error while erasing PEB %d, retry",
+                                 pnum);
                         yield();
                         goto retry;
                 }
-                ubi_err("cannot erase PEB %d", pnum);
+                ubi_err(ubi, "cannot erase PEB %d", pnum);
                 dump_stack();
                 return -EIO;
         }
@@ -388,7 +390,7 @@ retry:
                 return err;
 
         if (ubi_dbg_is_erase_failure(ubi)) {
-                ubi_err("cannot erase PEB %d (emulated)", pnum);
+                ubi_err(ubi, "cannot erase PEB %d (emulated)", pnum);
                 return -EIO;
         }
 
@@ -411,7 +413,7 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
 {
         int err, i, patt_count;
 
-        ubi_msg("run torture test for PEB %d", pnum);
+        ubi_msg(ubi, "run torture test for PEB %d", pnum);
         patt_count = ARRAY_SIZE(patterns);
         ubi_assert(patt_count > 0);
 
@@ -428,7 +430,7 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
 
                 err = ubi_check_pattern(ubi->peb_buf, 0xFF, ubi->peb_size);
                 if (err == 0) {
-                        ubi_err("erased PEB %d, but a non-0xFF byte found",
+                        ubi_err(ubi, "erased PEB %d, but a non-0xFF byte found",
                                 pnum);
                         err = -EIO;
                         goto out;
@@ -448,7 +450,7 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
                 err = ubi_check_pattern(ubi->peb_buf, patterns[i],
                                         ubi->peb_size);
                 if (err == 0) {
-                        ubi_err("pattern %x checking failed for PEB %d",
+                        ubi_err(ubi, "pattern %x checking failed for PEB %d",
                                 patterns[i], pnum);
                         err = -EIO;
                         goto out;
@@ -456,7 +458,7 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
         }
 
         err = patt_count;
-        ubi_msg("PEB %d passed torture test, do not mark it as bad", pnum);
+        ubi_msg(ubi, "PEB %d passed torture test, do not mark it as bad", pnum);
 
 out:
         mutex_unlock(&ubi->buf_mutex);
@@ -466,7 +468,7 @@ out:
                  * has not passed because it happened on a freshly erased
                  * physical eraseblock which means something is wrong with it.
                  */
-                ubi_err("read problems on freshly erased PEB %d, must be bad",
+                ubi_err(ubi, "read problems on freshly erased PEB %d, must be bad",
                         pnum);
                 err = -EIO;
         }
@@ -542,7 +544,7 @@ error:
          * it. Supposedly the flash media or the driver is screwed up, so
          * return an error.
          */
-        ubi_err("cannot invalidate PEB %d, write returned %d", pnum, err);
+        ubi_err(ubi, "cannot invalidate PEB %d, write returned %d", pnum, err);
         ubi_dump_flash(ubi, pnum, 0, ubi->peb_size);
         return -EIO;
 }
@@ -574,7 +576,7 @@ int ubi_io_sync_erase(struct ubi_device *ubi, int pnum, int torture)
                 return err;
 
         if (ubi->ro_mode) {
-                ubi_err("read-only mode");
+                ubi_err(ubi, "read-only mode");
                 return -EROFS;
         }
 
@@ -616,7 +618,7 @@ int ubi_io_is_bad(const struct ubi_device *ubi, int pnum)
 
                 ret = mtd_block_isbad(mtd, (loff_t)pnum * ubi->peb_size);
                 if (ret < 0)
-                        ubi_err("error %d while checking if PEB %d is bad",
+                        ubi_err(ubi, "error %d while checking if PEB %d is bad",
                                 ret, pnum);
                 else if (ret)
                         dbg_io("PEB %d is bad", pnum);
@@ -642,7 +644,7 @@ int ubi_io_mark_bad(const struct ubi_device *ubi, int pnum)
         ubi_assert(pnum >= 0 && pnum < ubi->peb_count);
 
         if (ubi->ro_mode) {
-                ubi_err("read-only mode");
+                ubi_err(ubi, "read-only mode");
                 return -EROFS;
         }
 
@@ -651,7 +653,7 @@ int ubi_io_mark_bad(const struct ubi_device *ubi, int pnum)
 
         err = mtd_block_markbad(mtd, (loff_t)pnum * ubi->peb_size);
         if (err)
-                ubi_err("cannot mark PEB %d bad, error %d", pnum, err);
+                ubi_err(ubi, "cannot mark PEB %d bad, error %d", pnum, err);
         return err;
 }
 
@@ -674,32 +676,32 @@ static int validate_ec_hdr(const struct ubi_device *ubi,
         leb_start = be32_to_cpu(ec_hdr->data_offset);
 
         if (ec_hdr->version != UBI_VERSION) {
-                ubi_err("node with incompatible UBI version found: this UBI version is %d, image version is %d",
+                ubi_err(ubi, "node with incompatible UBI version found: this UBI version is %d, image version is %d",
                         UBI_VERSION, (int)ec_hdr->version);
                 goto bad;
         }
 
         if (vid_hdr_offset != ubi->vid_hdr_offset) {
-                ubi_err("bad VID header offset %d, expected %d",
+                ubi_err(ubi, "bad VID header offset %d, expected %d",
                         vid_hdr_offset, ubi->vid_hdr_offset);
                 goto bad;
         }
 
         if (leb_start != ubi->leb_start) {
-                ubi_err("bad data offset %d, expected %d",
+                ubi_err(ubi, "bad data offset %d, expected %d",
                         leb_start, ubi->leb_start);
                 goto bad;
         }
 
         if (ec < 0 || ec > UBI_MAX_ERASECOUNTER) {
-                ubi_err("bad erase counter %lld", ec);
+                ubi_err(ubi, "bad erase counter %lld", ec);
                 goto bad;
         }
 
         return 0;
 
 bad:
-        ubi_err("bad EC header");
+        ubi_err(ubi, "bad EC header");
         ubi_dump_ec_hdr(ec_hdr);
         dump_stack();
         return 1;
@@ -765,7 +767,7 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
                 if (ubi_check_pattern(ec_hdr, 0xFF, UBI_EC_HDR_SIZE)) {
                         /* The physical eraseblock is supposedly empty */
                         if (verbose)
-                                ubi_warn("no EC header found at PEB %d, only 0xFF bytes",
+                                ubi_warn(ubi, "no EC header found at PEB %d, only 0xFF bytes",
                                          pnum);
                         dbg_bld("no EC header found at PEB %d, only 0xFF bytes",
                                 pnum);
@@ -780,7 +782,7 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
                  * 0xFF bytes. Report that the header is corrupted.
                  */
                 if (verbose) {
-                        ubi_warn("bad magic number at PEB %d: %08x instead of %08x",
+                        ubi_warn(ubi, "bad magic number at PEB %d: %08x instead of %08x",
                                  pnum, magic, UBI_EC_HDR_MAGIC);
                         ubi_dump_ec_hdr(ec_hdr);
                 }
@@ -794,7 +796,7 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
 
         if (hdr_crc != crc) {
                 if (verbose) {
-                        ubi_warn("bad EC header CRC at PEB %d, calculated %#08x, read %#08x",
+                        ubi_warn(ubi, "bad EC header CRC at PEB %d, calculated %#08x, read %#08x",
                                  pnum, crc, hdr_crc);
                         ubi_dump_ec_hdr(ec_hdr);
                 }
@@ -810,7 +812,7 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
         /* And of course validate what has just been read from the media */
         err = validate_ec_hdr(ubi, ec_hdr);
         if (err) {
-                ubi_err("validation failed for PEB %d", pnum);
+                ubi_err(ubi, "validation failed for PEB %d", pnum);
                 return -EINVAL;
         }
 
@@ -884,40 +886,40 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
         int usable_leb_size = ubi->leb_size - data_pad;
 
         if (copy_flag != 0 && copy_flag != 1) {
-                ubi_err("bad copy_flag");
+                ubi_err(ubi, "bad copy_flag");
                 goto bad;
         }
 
         if (vol_id < 0 || lnum < 0 || data_size < 0 || used_ebs < 0 ||
             data_pad < 0) {
-                ubi_err("negative values");
+                ubi_err(ubi, "negative values");
                 goto bad;
         }
 
         if (vol_id >= UBI_MAX_VOLUMES && vol_id < UBI_INTERNAL_VOL_START) {
-                ubi_err("bad vol_id");
+                ubi_err(ubi, "bad vol_id");
                 goto bad;
         }
 
         if (vol_id < UBI_INTERNAL_VOL_START && compat != 0) {
-                ubi_err("bad compat");
+                ubi_err(ubi, "bad compat");
                 goto bad;
         }
 
         if (vol_id >= UBI_INTERNAL_VOL_START && compat != UBI_COMPAT_DELETE &&
             compat != UBI_COMPAT_RO && compat != UBI_COMPAT_PRESERVE &&
             compat != UBI_COMPAT_REJECT) {
-                ubi_err("bad compat");
+                ubi_err(ubi, "bad compat");
                 goto bad;
         }
 
         if (vol_type != UBI_VID_DYNAMIC && vol_type != UBI_VID_STATIC) {
-                ubi_err("bad vol_type");
+                ubi_err(ubi, "bad vol_type");
                 goto bad;
         }
 
         if (data_pad >= ubi->leb_size / 2) {
-                ubi_err("bad data_pad");
+                ubi_err(ubi, "bad data_pad");
                 goto bad;
         }
 
@@ -929,45 +931,45 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
                  * mapped logical eraseblocks.
                  */
                 if (used_ebs == 0) {
-                        ubi_err("zero used_ebs");
+                        ubi_err(ubi, "zero used_ebs");
                         goto bad;
                 }
                 if (data_size == 0) {
-                        ubi_err("zero data_size");
+                        ubi_err(ubi, "zero data_size");
                         goto bad;
                 }
                 if (lnum < used_ebs - 1) {
                         if (data_size != usable_leb_size) {
-                                ubi_err("bad data_size");
+                                ubi_err(ubi, "bad data_size");
                                 goto bad;
                         }
                 } else if (lnum == used_ebs - 1) {
                         if (data_size == 0) {
-                                ubi_err("bad data_size at last LEB");
+                                ubi_err(ubi, "bad data_size at last LEB");
                                 goto bad;
                         }
                 } else {
-                        ubi_err("too high lnum");
+                        ubi_err(ubi, "too high lnum");
                         goto bad;
                 }
         } else {
                 if (copy_flag == 0) {
                         if (data_crc != 0) {
-                                ubi_err("non-zero data CRC");
+                                ubi_err(ubi, "non-zero data CRC");
                                 goto bad;
                         }
                         if (data_size != 0) {
-                                ubi_err("non-zero data_size");
+                                ubi_err(ubi, "non-zero data_size");
                                 goto bad;
                         }
                 } else {
                         if (data_size == 0) {
-                                ubi_err("zero data_size of copy");
+                                ubi_err(ubi, "zero data_size of copy");
                                 goto bad;
                         }
                 }
                 if (used_ebs != 0) {
-                        ubi_err("bad used_ebs");
+                        ubi_err(ubi, "bad used_ebs");
                         goto bad;
                 }
         }
@@ -975,7 +977,7 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
         return 0;
 
 bad:
-        ubi_err("bad VID header");
+        ubi_err(ubi, "bad VID header");
         ubi_dump_vid_hdr(vid_hdr);
         dump_stack();
         return 1;
@@ -1020,7 +1022,7 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
 
                 if (ubi_check_pattern(vid_hdr, 0xFF, UBI_VID_HDR_SIZE)) {
                         if (verbose)
-                                ubi_warn("no VID header found at PEB %d, only 0xFF bytes",
+                                ubi_warn(ubi, "no VID header found at PEB %d, only 0xFF bytes",
                                          pnum);
                         dbg_bld("no VID header found at PEB %d, only 0xFF bytes",
                                 pnum);
@@ -1031,7 +1033,7 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
                 }
 
                 if (verbose) {
-                        ubi_warn("bad magic number at PEB %d: %08x instead of %08x",
+                        ubi_warn(ubi, "bad magic number at PEB %d: %08x instead of %08x",
                                  pnum, magic, UBI_VID_HDR_MAGIC);
                         ubi_dump_vid_hdr(vid_hdr);
                 }
@@ -1045,7 +1047,7 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
 
         if (hdr_crc != crc) {
                 if (verbose) {
-                        ubi_warn("bad CRC at PEB %d, calculated %#08x, read %#08x",
+                        ubi_warn(ubi, "bad CRC at PEB %d, calculated %#08x, read %#08x",
                                  pnum, crc, hdr_crc);
                         ubi_dump_vid_hdr(vid_hdr);
                 }
@@ -1059,7 +1061,7 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
 
         err = validate_vid_hdr(ubi, vid_hdr);
         if (err) {
-                ubi_err("validation failed for PEB %d", pnum);
+                ubi_err(ubi, "validation failed for PEB %d", pnum);
                 return -EINVAL;
         }
 
@@ -1129,7 +1131,7 @@ static int self_check_not_bad(const struct ubi_device *ubi, int pnum)
         if (!err)
                 return err;
 
-        ubi_err("self-check failed for PEB %d", pnum);
+        ubi_err(ubi, "self-check failed for PEB %d", pnum);
         dump_stack();
         return err > 0 ? -EINVAL : err;
 }
@@ -1154,14 +1156,14 @@ static int self_check_ec_hdr(const struct ubi_device *ubi, int pnum,
 
         magic = be32_to_cpu(ec_hdr->magic);
         if (magic != UBI_EC_HDR_MAGIC) {
-                ubi_err("bad magic %#08x, must be %#08x",
+                ubi_err(ubi, "bad magic %#08x, must be %#08x",
                         magic, UBI_EC_HDR_MAGIC);
                 goto fail;
         }
 
         err = validate_ec_hdr(ubi, ec_hdr);
         if (err) {
-                ubi_err("self-check failed for PEB %d", pnum);
+                ubi_err(ubi, "self-check failed for PEB %d", pnum);
                 goto fail;
         }
 
@@ -1201,8 +1203,9 @@ static int self_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum)
         crc = crc32(UBI_CRC32_INIT, ec_hdr, UBI_EC_HDR_SIZE_CRC);
         hdr_crc = be32_to_cpu(ec_hdr->hdr_crc);
         if (hdr_crc != crc) {
-                ubi_err("bad CRC, calculated %#08x, read %#08x", crc, hdr_crc);
-                ubi_err("self-check failed for PEB %d", pnum);
+                ubi_err(ubi, "bad CRC, calculated %#08x, read %#08x",
+                        crc, hdr_crc);
+                ubi_err(ubi, "self-check failed for PEB %d", pnum);
                 ubi_dump_ec_hdr(ec_hdr);
                 dump_stack();
                 err = -EINVAL;
@@ -1236,21 +1239,21 @@ static int self_check_vid_hdr(const struct ubi_device *ubi, int pnum,
 
         magic = be32_to_cpu(vid_hdr->magic);
         if (magic != UBI_VID_HDR_MAGIC) {
-                ubi_err("bad VID header magic %#08x at PEB %d, must be %#08x",
+                ubi_err(ubi, "bad VID header magic %#08x at PEB %d, must be %#08x",
                         magic, pnum, UBI_VID_HDR_MAGIC);
                 goto fail;
         }
 
         err = validate_vid_hdr(ubi, vid_hdr);
         if (err) {
-                ubi_err("self-check failed for PEB %d", pnum);
+                ubi_err(ubi, "self-check failed for PEB %d", pnum);
                 goto fail;
         }
 
         return err;
 
 fail:
-        ubi_err("self-check failed for PEB %d", pnum);
+        ubi_err(ubi, "self-check failed for PEB %d", pnum);
         ubi_dump_vid_hdr(vid_hdr);
         dump_stack();
         return -EINVAL;
@@ -1288,9 +1291,9 @@ static int self_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
         crc = crc32(UBI_CRC32_INIT, vid_hdr, UBI_EC_HDR_SIZE_CRC);
         hdr_crc = be32_to_cpu(vid_hdr->hdr_crc);
         if (hdr_crc != crc) {
-                ubi_err("bad VID header CRC at PEB %d, calculated %#08x, read %#08x",
+                ubi_err(ubi, "bad VID header CRC at PEB %d, calculated %#08x, read %#08x",
                         pnum, crc, hdr_crc);
-                ubi_err("self-check failed for PEB %d", pnum);
+                ubi_err(ubi, "self-check failed for PEB %d", pnum);
                 ubi_dump_vid_hdr(vid_hdr);
                 dump_stack();
                 err = -EINVAL;
@@ -1329,7 +1332,7 @@ static int self_check_write(struct ubi_device *ubi, const void *buf, int pnum,
 
         buf1 = __vmalloc(len, GFP_NOFS, PAGE_KERNEL);
         if (!buf1) {
-                ubi_err("cannot allocate memory to check writes");
+                ubi_err(ubi, "cannot allocate memory to check writes");
                 return 0;
         }
 
@@ -1345,15 +1348,15 @@ static int self_check_write(struct ubi_device *ubi, const void *buf, int pnum,
                 if (c == c1)
                         continue;
 
-                ubi_err("self-check failed for PEB %d:%d, len %d",
+                ubi_err(ubi, "self-check failed for PEB %d:%d, len %d",
                         pnum, offset, len);
-                ubi_msg("data differ at position %d", i);
+                ubi_msg(ubi, "data differ at position %d", i);
                 dump_len = max_t(int, 128, len - i);
-                ubi_msg("hex dump of the original buffer from %d to %d",
+                ubi_msg(ubi, "hex dump of the original buffer from %d to %d",
                         i, i + dump_len);
                 print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
                                buf + i, dump_len, 1);
-                ubi_msg("hex dump of the read buffer from %d to %d",
+                ubi_msg(ubi, "hex dump of the read buffer from %d to %d",
                         i, i + dump_len);
                 print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
                                buf1 + i, dump_len, 1);
@@ -1393,20 +1396,20 @@ int ubi_self_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len)
 
         buf = __vmalloc(len, GFP_NOFS, PAGE_KERNEL);
         if (!buf) {
-                ubi_err("cannot allocate memory to check for 0xFFs");
+                ubi_err(ubi, "cannot allocate memory to check for 0xFFs");
                 return 0;
         }
 
         err = mtd_read(ubi->mtd, addr, len, &read, buf);
         if (err && !mtd_is_bitflip(err)) {
-                ubi_err("error %d while reading %d bytes from PEB %d:%d, read %zd bytes",
+                ubi_err(ubi, "err %d while reading %d bytes from PEB %d:%d, read %zd bytes",
                         err, len, pnum, offset, read);
                 goto error;
         }
 
         err = ubi_check_pattern(buf, 0xFF, len);
         if (err == 0) {
-                ubi_err("flash region at PEB %d:%d, length %d does not contain all 0xFF bytes",
+                ubi_err(ubi, "flash region at PEB %d:%d, length %d does not contain all 0xFF bytes",
                         pnum, offset, len);
                 goto fail;
         }
@@ -1415,8 +1418,9 @@ int ubi_self_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len)
         return 0;
 
 fail:
-        ubi_err("self-check failed for PEB %d", pnum);
-        ubi_msg("hex dump of the %d-%d region", offset, offset + len);
+        ubi_err(ubi, "self-check failed for PEB %d", pnum);
+        ubi_msg(ubi, "hex dump of the %d-%d region",
+                 offset, offset + len);
         print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1, buf, len, 1);
         err = -EINVAL;
 error:
diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
index 3aac1acceeb4..f3bab669f6bb 100644
--- a/drivers/mtd/ubi/kapi.c
+++ b/drivers/mtd/ubi/kapi.c
@@ -204,7 +204,7 @@ struct ubi_volume_desc *ubi_open_volume(int ubi_num, int vol_id, int mode)
                         return ERR_PTR(err);
                 }
                 if (err == 1) {
-                        ubi_warn("volume %d on UBI device %d is corrupted",
+                        ubi_warn(ubi, "volume %d on UBI device %d is corrupted",
                                  vol_id, ubi->ubi_num);
                         vol->corrupted = 1;
                 }
@@ -221,7 +221,7 @@ out_free:
         kfree(desc);
 out_put_ubi:
         ubi_put_device(ubi);
-        ubi_err("cannot open device %d, volume %d, error %d",
+        ubi_err(ubi, "cannot open device %d, volume %d, error %d",
                 ubi_num, vol_id, err);
         return ERR_PTR(err);
 }
@@ -411,7 +411,7 @@ int ubi_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
 
         err = ubi_eba_read_leb(ubi, vol, lnum, buf, offset, len, check);
         if (err && mtd_is_eccerr(err) && vol->vol_type == UBI_STATIC_VOLUME) {
-                ubi_warn("mark volume %d as corrupted", vol_id);
+                ubi_warn(ubi, "mark volume %d as corrupted", vol_id);
                 vol->corrupted = 1;
         }
 
diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
index f913d701a5b3..dbda77e556cb 100644
--- a/drivers/mtd/ubi/misc.c
+++ b/drivers/mtd/ubi/misc.c
@@ -111,7 +111,7 @@ void ubi_update_reserved(struct ubi_device *ubi)
         ubi->avail_pebs -= need;
         ubi->rsvd_pebs += need;
         ubi->beb_rsvd_pebs += need;
-        ubi_msg("reserved more %d PEBs for bad PEB handling", need);
+        ubi_msg(ubi, "reserved more %d PEBs for bad PEB handling", need);
 }
 
 /**
@@ -128,7 +128,7 @@ void ubi_calculate_reserved(struct ubi_device *ubi)
         ubi->beb_rsvd_level = ubi->bad_peb_limit - ubi->bad_peb_count;
         if (ubi->beb_rsvd_level < 0) {
                 ubi->beb_rsvd_level = 0;
-                ubi_warn("number of bad PEBs (%d) is above the expected limit (%d), not reserving any PEBs for bad PEB handling, will use available PEBs (if any)",
+                ubi_warn(ubi, "number of bad PEBs (%d) is above the expected limit (%d), not reserving any PEBs for bad PEB handling, will use available PEBs (if any)",
                          ubi->bad_peb_count, ubi->bad_peb_limit);
         }
 }
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 320fc38fa2a1..f80ffaba9058 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -50,13 +50,14 @@
 #define UBI_NAME_STR "ubi"
 
 /* Normal UBI messages */
-#define ubi_msg(fmt, ...) pr_notice("UBI: " fmt "\n", ##__VA_ARGS__)
+#define ubi_msg(ubi, fmt, ...) pr_notice("UBI-%d: %s:" fmt "\n", \
+                                         ubi->ubi_num, __func__, ##__VA_ARGS__)
 /* UBI warning messages */
-#define ubi_warn(fmt, ...) pr_warn("UBI warning: %s: " fmt "\n",  \
-                                   __func__, ##__VA_ARGS__)
+#define ubi_warn(ubi, fmt, ...) pr_warn("UBI-%d warning: %s: " fmt "\n", \
+                                        ubi->ubi_num, __func__, ##__VA_ARGS__)
 /* UBI error messages */
-#define ubi_err(fmt, ...) pr_err("UBI error: %s: " fmt "\n",      \
-                                 __func__, ##__VA_ARGS__)
+#define ubi_err(ubi, fmt, ...) pr_err("UBI-%d error: %s: " fmt "\n", \
+                                      ubi->ubi_num, __func__, ##__VA_ARGS__)
 
 /* Background thread name pattern */
 #define UBI_BGT_NAME_PATTERN "ubi_bgt%dd"
@@ -987,7 +988,7 @@ static inline void ubi_ro_mode(struct ubi_device *ubi)
 {
         if (!ubi->ro_mode) {
                 ubi->ro_mode = 1;
-                ubi_warn("switch to read-only mode");
+                ubi_warn(ubi, "switch to read-only mode");
                 dump_stack();
         }
 }
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index ec2c2dc1c1ca..2a1b6e037e1a 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -133,6 +133,10 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
         ubi_assert(!vol->updating && !vol->changing_leb);
         vol->updating = 1;
 
+        vol->upd_buf = vmalloc(ubi->leb_size);
+        if (!vol->upd_buf)
+                return -ENOMEM;
+
         err = set_update_marker(ubi, vol);
         if (err)
                 return err;
@@ -152,14 +156,12 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
                 err = clear_update_marker(ubi, vol, 0);
                 if (err)
                         return err;
+
+                vfree(vol->upd_buf);
                 vol->updating = 0;
                 return 0;
         }
 
-        vol->upd_buf = vmalloc(ubi->leb_size);
-        if (!vol->upd_buf)
-                return -ENOMEM;
-
         vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
                                vol->usable_leb_size);
         vol->upd_bytes = bytes;
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index 8330703c098f..ff4d97848d1c 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -223,7 +223,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
                         }
 
                 if (vol_id == UBI_VOL_NUM_AUTO) {
-                        ubi_err("out of volume IDs");
+                        ubi_err(ubi, "out of volume IDs");
                         err = -ENFILE;
                         goto out_unlock;
                 }
@@ -237,7 +237,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
         /* Ensure that this volume does not exist */
         err = -EEXIST;
         if (ubi->volumes[vol_id]) {
-                ubi_err("volume %d already exists", vol_id);
+                ubi_err(ubi, "volume %d already exists", vol_id);
                 goto out_unlock;
         }
 
@@ -246,7 +246,8 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
                 if (ubi->volumes[i] &&
                     ubi->volumes[i]->name_len == req->name_len &&
                     !strcmp(ubi->volumes[i]->name, req->name)) {
-                        ubi_err("volume \"%s\" exists (ID %d)", req->name, i);
+                        ubi_err(ubi, "volume \"%s\" exists (ID %d)",
+                                req->name, i);
                         goto out_unlock;
                 }
 
@@ -257,9 +258,10 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
 
         /* Reserve physical eraseblocks */
         if (vol->reserved_pebs > ubi->avail_pebs) {
-                ubi_err("not enough PEBs, only %d available", ubi->avail_pebs);
+                ubi_err(ubi, "not enough PEBs, only %d available",
+                        ubi->avail_pebs);
                 if (ubi->corr_peb_count)
-                        ubi_err("%d PEBs are corrupted and not used",
+                        ubi_err(ubi, "%d PEBs are corrupted and not used",
                                 ubi->corr_peb_count);
                 err = -ENOSPC;
                 goto out_unlock;
@@ -314,7 +316,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
         dev = MKDEV(MAJOR(ubi->cdev.dev), vol_id + 1);
         err = cdev_add(&vol->cdev, dev, 1);
         if (err) {
-                ubi_err("cannot add character device");
+                ubi_err(ubi, "cannot add character device");
                 goto out_mapping;
         }
 
@@ -326,7 +328,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
         dev_set_name(&vol->dev, "%s_%d", ubi->ubi_name, vol->vol_id);
         err = device_register(&vol->dev);
         if (err) {
-                ubi_err("cannot register device");
+                ubi_err(ubi, "cannot register device");
                 goto out_cdev;
         }
 
@@ -386,7 +388,7 @@ out_unlock:
                 kfree(vol);
         else
                 put_device(&vol->dev);
-        ubi_err("cannot create volume %d, error %d", vol_id, err);
+        ubi_err(ubi, "cannot create volume %d, error %d", vol_id, err);
         return err;
 }
 
@@ -454,7 +456,7 @@ int ubi_remove_volume(struct ubi_volume_desc *desc, int no_vtbl)
         return err;
 
 out_err:
-        ubi_err("cannot remove volume %d, error %d", vol_id, err);
+        ubi_err(ubi, "cannot remove volume %d, error %d", vol_id, err);
         spin_lock(&ubi->volumes_lock);
         ubi->volumes[vol_id] = vol;
 out_unlock:
@@ -487,7 +489,7 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
 
         if (vol->vol_type == UBI_STATIC_VOLUME &&
             reserved_pebs < vol->used_ebs) {
-                ubi_err("too small size %d, %d LEBs contain data",
+                ubi_err(ubi, "too small size %d, %d LEBs contain data",
                         reserved_pebs, vol->used_ebs);
                 return -EINVAL;
         }
@@ -516,10 +518,10 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
         if (pebs > 0) {
                 spin_lock(&ubi->volumes_lock);
                 if (pebs > ubi->avail_pebs) {
-                        ubi_err("not enough PEBs: requested %d, available %d",
+                        ubi_err(ubi, "not enough PEBs: requested %d, available %d",
                                 pebs, ubi->avail_pebs);
                         if (ubi->corr_peb_count)
-                                ubi_err("%d PEBs are corrupted and not used",
+                                ubi_err(ubi, "%d PEBs are corrupted and not used",
                                         ubi->corr_peb_count);
                         spin_unlock(&ubi->volumes_lock);
                         err = -ENOSPC;
@@ -643,7 +645,7 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol)
         dev = MKDEV(MAJOR(ubi->cdev.dev), vol->vol_id + 1);
         err = cdev_add(&vol->cdev, dev, 1);
         if (err) {
-                ubi_err("cannot add character device for volume %d, error %d",
+                ubi_err(ubi, "cannot add character device for volume %d, error %d",
                         vol_id, err);
                 return err;
         }
@@ -710,7 +712,7 @@ static int self_check_volume(struct ubi_device *ubi, int vol_id)
 
         if (!vol) {
                 if (reserved_pebs) {
-                        ubi_err("no volume info, but volume exists");
+                        ubi_err(ubi, "no volume info, but volume exists");
                         goto fail;
                 }
                 spin_unlock(&ubi->volumes_lock);
@@ -719,90 +721,91 @@ static int self_check_volume(struct ubi_device *ubi, int vol_id)
 
         if (vol->reserved_pebs < 0 || vol->alignment < 0 || vol->data_pad < 0 ||
             vol->name_len < 0) {
-                ubi_err("negative values");
+                ubi_err(ubi, "negative values");
                 goto fail;
         }
         if (vol->alignment > ubi->leb_size || vol->alignment == 0) {
-                ubi_err("bad alignment");
+                ubi_err(ubi, "bad alignment");
                 goto fail;
         }
 
         n = vol->alignment & (ubi->min_io_size - 1);
         if (vol->alignment != 1 && n) {
-                ubi_err("alignment is not multiple of min I/O unit");
+                ubi_err(ubi, "alignment is not multiple of min I/O unit");
                 goto fail;
         }
 
         n = ubi->leb_size % vol->alignment;
         if (vol->data_pad != n) {
-                ubi_err("bad data_pad, has to be %lld", n);
+                ubi_err(ubi, "bad data_pad, has to be %lld", n);
                 goto fail;
         }
 
         if (vol->vol_type != UBI_DYNAMIC_VOLUME &&
             vol->vol_type != UBI_STATIC_VOLUME) {
-                ubi_err("bad vol_type");
+                ubi_err(ubi, "bad vol_type");
                 goto fail;
         }
 
         if (vol->upd_marker && vol->corrupted) {
-                ubi_err("update marker and corrupted simultaneously");
+                ubi_err(ubi, "update marker and corrupted simultaneously");
                 goto fail;
         }
 
         if (vol->reserved_pebs > ubi->good_peb_count) {
-                ubi_err("too large reserved_pebs");
+                ubi_err(ubi, "too large reserved_pebs");
                 goto fail;
         }
 
         n = ubi->leb_size - vol->data_pad;
         if (vol->usable_leb_size != ubi->leb_size - vol->data_pad) {
-                ubi_err("bad usable_leb_size, has to be %lld", n);
+                ubi_err(ubi, "bad usable_leb_size, has to be %lld", n);
                 goto fail;
         }
 
         if (vol->name_len > UBI_VOL_NAME_MAX) {
-                ubi_err("too long volume name, max is %d", UBI_VOL_NAME_MAX);
+                ubi_err(ubi, "too long volume name, max is %d",
+                        UBI_VOL_NAME_MAX);
                 goto fail;
         }
 
         n = strnlen(vol->name, vol->name_len + 1);
         if (n != vol->name_len) {
-                ubi_err("bad name_len %lld", n);
+                ubi_err(ubi, "bad name_len %lld", n);
                 goto fail;
         }
 
         n = (long long)vol->used_ebs * vol->usable_leb_size;
         if (vol->vol_type == UBI_DYNAMIC_VOLUME) {
                 if (vol->corrupted) {
-                        ubi_err("corrupted dynamic volume");
+                        ubi_err(ubi, "corrupted dynamic volume");
                         goto fail;
                 }
                 if (vol->used_ebs != vol->reserved_pebs) {
-                        ubi_err("bad used_ebs");
+                        ubi_err(ubi, "bad used_ebs");
                         goto fail;
                 }
                 if (vol->last_eb_bytes != vol->usable_leb_size) {
-                        ubi_err("bad last_eb_bytes");
+                        ubi_err(ubi, "bad last_eb_bytes");
                         goto fail;
                 }
                 if (vol->used_bytes != n) {
-                        ubi_err("bad used_bytes");
+                        ubi_err(ubi, "bad used_bytes");
                         goto fail;
                 }
         } else {
                 if (vol->used_ebs < 0 || vol->used_ebs > vol->reserved_pebs) {
-                        ubi_err("bad used_ebs");
+                        ubi_err(ubi, "bad used_ebs");
                         goto fail;
                 }
                 if (vol->last_eb_bytes < 0 ||
                     vol->last_eb_bytes > vol->usable_leb_size) {
-                        ubi_err("bad last_eb_bytes");
+                        ubi_err(ubi, "bad last_eb_bytes");
                         goto fail;
                 }
                 if (vol->used_bytes < 0 || vol->used_bytes > n ||
                     vol->used_bytes < n - vol->usable_leb_size) {
-                        ubi_err("bad used_bytes");
+                        ubi_err(ubi, "bad used_bytes");
                         goto fail;
                 }
         }
@@ -820,7 +823,7 @@ static int self_check_volume(struct ubi_device *ubi, int vol_id)
         if (alignment != vol->alignment || data_pad != vol->data_pad ||
             upd_marker != vol->upd_marker || vol_type != vol->vol_type ||
             name_len != vol->name_len || strncmp(name, vol->name, name_len)) {
-                ubi_err("volume info is different");
+                ubi_err(ubi, "volume info is different");
                 goto fail;
         }
 
@@ -828,7 +831,7 @@ static int self_check_volume(struct ubi_device *ubi, int vol_id)
         return 0;
 
 fail:
-        ubi_err("self-check failed for volume %d", vol_id);
+        ubi_err(ubi, "self-check failed for volume %d", vol_id);
         if (vol)
                 ubi_dump_vol_info(vol);
         ubi_dump_vtbl_record(&ubi->vtbl[vol_id], vol_id);
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 07cac5f9ffb8..f8fc3081bbb4 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -30,9 +30,12 @@
  * eraseblock stores one volume table copy, i.e. LEB 0 and LEB 1 duplicate each
  * other. This redundancy guarantees robustness to unclean reboots. The volume
  * table is basically an array of volume table records. Each record contains
- * full information about the volume and protected by a CRC checksum.
+ * full information about the volume and protected by a CRC checksum. Note,
+ * nowadays we use the atomic LEB change operation when updating the volume
+ * table, so we do not really need 2 LEBs anymore, but we preserve the older
+ * design for the backward compatibility reasons.
  *
- * The volume table is changed, it is first changed in RAM. Then LEB 0 is
+ * When the volume table is changed, it is first changed in RAM. Then LEB 0 is
  * erased, and the updated volume table is written back to LEB 0. Then same for
  * LEB 1. This scheme guarantees recoverability from unclean reboots.
  *
@@ -96,12 +99,8 @@ int ubi_change_vtbl_record(struct ubi_device *ubi, int idx,
 
         memcpy(&ubi->vtbl[idx], vtbl_rec, sizeof(struct ubi_vtbl_record));
         for (i = 0; i < UBI_LAYOUT_VOLUME_EBS; i++) {
-                err = ubi_eba_unmap_leb(ubi, layout_vol, i);
-                if (err)
-                        return err;
-
-                err = ubi_eba_write_leb(ubi, layout_vol, i, ubi->vtbl, 0,
-                                        ubi->vtbl_size);
+                err = ubi_eba_atomic_leb_change(ubi, layout_vol, i, ubi->vtbl,
+                                                ubi->vtbl_size);
                 if (err)
                         return err;
         }
@@ -148,12 +147,8 @@ int ubi_vtbl_rename_volumes(struct ubi_device *ubi,
 
         layout_vol = ubi->volumes[vol_id2idx(ubi, UBI_LAYOUT_VOLUME_ID)];
         for (i = 0; i < UBI_LAYOUT_VOLUME_EBS; i++) {
-                err = ubi_eba_unmap_leb(ubi, layout_vol, i);
-                if (err)
-                        return err;
-
-                err = ubi_eba_write_leb(ubi, layout_vol, i, ubi->vtbl, 0,
-                                        ubi->vtbl_size);
+                err = ubi_eba_atomic_leb_change(ubi, layout_vol, i, ubi->vtbl,
+                                                ubi->vtbl_size);
                 if (err)
                         return err;
         }
@@ -190,7 +185,7 @@ static int vtbl_check(const struct ubi_device *ubi,
 
                 crc = crc32(UBI_CRC32_INIT, &vtbl[i], UBI_VTBL_RECORD_SIZE_CRC);
                 if (be32_to_cpu(vtbl[i].crc) != crc) {
-                        ubi_err("bad CRC at record %u: %#08x, not %#08x",
+                        ubi_err(ubi, "bad CRC at record %u: %#08x, not %#08x",
                                  i, crc, be32_to_cpu(vtbl[i].crc));
                         ubi_dump_vtbl_record(&vtbl[i], i);
                         return 1;
@@ -224,7 +219,7 @@ static int vtbl_check(const struct ubi_device *ubi,
 
                 n = ubi->leb_size % alignment;
                 if (data_pad != n) {
-                        ubi_err("bad data_pad, has to be %d", n);
+                        ubi_err(ubi, "bad data_pad, has to be %d", n);
                         err = 6;
                         goto bad;
                 }
@@ -240,7 +235,7 @@ static int vtbl_check(const struct ubi_device *ubi,
                 }
 
                 if (reserved_pebs > ubi->good_peb_count) {
-                        ubi_err("too large reserved_pebs %d, good PEBs %d",
+                        ubi_err(ubi, "too large reserved_pebs %d, good PEBs %d",
                                 reserved_pebs, ubi->good_peb_count);
                         err = 9;
                         goto bad;
@@ -270,7 +265,7 @@ static int vtbl_check(const struct ubi_device *ubi,
 
                         if (len1 > 0 && len1 == len2 &&
                             !strncmp(vtbl[i].name, vtbl[n].name, len1)) {
-                                ubi_err("volumes %d and %d have the same name \"%s\"",
+                                ubi_err(ubi, "volumes %d and %d have the same name \"%s\"",
                                         i, n, vtbl[i].name);
                                 ubi_dump_vtbl_record(&vtbl[i], i);
                                 ubi_dump_vtbl_record(&vtbl[n], n);
@@ -282,7 +277,7 @@ static int vtbl_check(const struct ubi_device *ubi,
         return 0;
 
 bad:
-        ubi_err("volume table check failed: record %d, error %d", i, err);
+        ubi_err(ubi, "volume table check failed: record %d, error %d", i, err);
         ubi_dump_vtbl_record(&vtbl[i], i);
         return -EINVAL;
 }
@@ -446,11 +441,11 @@ static struct ubi_vtbl_record *process_lvol(struct ubi_device *ubi,
                         leb_corrupted[1] = memcmp(leb[0], leb[1],
                                                   ubi->vtbl_size);
                 if (leb_corrupted[1]) {
-                        ubi_warn("volume table copy #2 is corrupted");
+                        ubi_warn(ubi, "volume table copy #2 is corrupted");
                         err = create_vtbl(ubi, ai, 1, leb[0]);
                         if (err)
                                 goto out_free;
-                        ubi_msg("volume table was restored");
+                        ubi_msg(ubi, "volume table was restored");
                 }
 
                 /* Both LEB 1 and LEB 2 are OK and consistent */
@@ -465,15 +460,15 @@ static struct ubi_vtbl_record *process_lvol(struct ubi_device *ubi,
                 }
                 if (leb_corrupted[1]) {
                         /* Both LEB 0 and LEB 1 are corrupted */
-                        ubi_err("both volume tables are corrupted");
+                        ubi_err(ubi, "both volume tables are corrupted");
                         goto out_free;
                 }
 
-                ubi_warn("volume table copy #1 is corrupted");
+                ubi_warn(ubi, "volume table copy #1 is corrupted");
                 err = create_vtbl(ubi, ai, 0, leb[1]);
                 if (err)
                         goto out_free;
-                ubi_msg("volume table was restored");
+                ubi_msg(ubi, "volume table was restored");
 
                 vfree(leb[0]);
                 return leb[1];
@@ -562,7 +557,7 @@ static int init_volumes(struct ubi_device *ubi,
                 if (vtbl[i].flags & UBI_VTBL_AUTORESIZE_FLG) {
                         /* Auto re-size flag may be set only for one volume */
                         if (ubi->autoresize_vol_id != -1) {
-                                ubi_err("more than one auto-resize volume (%d and %d)",
+                                ubi_err(ubi, "more than one auto-resize volume (%d and %d)",
                                         ubi->autoresize_vol_id, i);
                                 kfree(vol);
                                 return -EINVAL;
@@ -608,7 +603,7 @@ static int init_volumes(struct ubi_device *ubi,
                          * We found a static volume which misses several
                          * eraseblocks. Treat it as corrupted.
                          */
-                        ubi_warn("static volume %d misses %d LEBs - corrupted",
+                        ubi_warn(ubi, "static volume %d misses %d LEBs - corrupted",
                                  av->vol_id, av->used_ebs - av->leb_count);
                         vol->corrupted = 1;
                         continue;
@@ -646,10 +641,10 @@ static int init_volumes(struct ubi_device *ubi,
         vol->ubi = ubi;
 
         if (reserved_pebs > ubi->avail_pebs) {
-                ubi_err("not enough PEBs, required %d, available %d",
+                ubi_err(ubi, "not enough PEBs, required %d, available %d",
                         reserved_pebs, ubi->avail_pebs);
                 if (ubi->corr_peb_count)
-                        ubi_err("%d PEBs are corrupted and not used",
+                        ubi_err(ubi, "%d PEBs are corrupted and not used",
                                 ubi->corr_peb_count);
         }
         ubi->rsvd_pebs += reserved_pebs;
@@ -660,13 +655,14 @@ static int init_volumes(struct ubi_device *ubi,
 
 /**
  * check_av - check volume attaching information.
+ * @ubi: UBI device description object
  * @vol: UBI volume description object
  * @av: volume attaching information
  *
  * This function returns zero if the volume attaching information is consistent
  * to the data read from the volume tabla, and %-EINVAL if not.
  */
-static int check_av(const struct ubi_volume *vol,
+static int check_av(const struct ubi_device *ubi, const struct ubi_volume *vol,
                     const struct ubi_ainf_volume *av)
 {
         int err;
@@ -694,7 +690,7 @@ static int check_av(const struct ubi_volume *vol,
         return 0;
 
 bad:
-        ubi_err("bad attaching information, error %d", err);
+        ubi_err(ubi, "bad attaching information, error %d", err);
         ubi_dump_av(av);
         ubi_dump_vol_info(vol);
         return -EINVAL;
@@ -718,14 +714,15 @@ static int check_attaching_info(const struct ubi_device *ubi,
         struct ubi_volume *vol;
 
         if (ai->vols_found > UBI_INT_VOL_COUNT + ubi->vtbl_slots) {
-                ubi_err("found %d volumes while attaching, maximum is %d + %d",
+                ubi_err(ubi, "found %d volumes while attaching, maximum is %d + %d",
                         ai->vols_found, UBI_INT_VOL_COUNT, ubi->vtbl_slots);
                 return -EINVAL;
         }
 
         if (ai->highest_vol_id >= ubi->vtbl_slots + UBI_INT_VOL_COUNT &&
             ai->highest_vol_id < UBI_INTERNAL_VOL_START) {
-                ubi_err("too large volume ID %d found", ai->highest_vol_id);
+                ubi_err(ubi, "too large volume ID %d found",
+                        ai->highest_vol_id);
                 return -EINVAL;
         }
 
@@ -753,10 +750,10 @@ static int check_attaching_info(const struct ubi_device *ubi,
                          * reboot while the volume was being removed. Discard
                          * these eraseblocks.
                          */
-                        ubi_msg("finish volume %d removal", av->vol_id);
+                        ubi_msg(ubi, "finish volume %d removal", av->vol_id);
                         ubi_remove_av(ai, av);
                 } else if (av) {
-                        err = check_av(vol, av);
+                        err = check_av(ubi, vol, av);
                         if (err)
                                 return err;
                 }
@@ -807,13 +804,13 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai)
                         if (IS_ERR(ubi->vtbl))
                                 return PTR_ERR(ubi->vtbl);
                 } else {
-                        ubi_err("the layout volume was not found");
+                        ubi_err(ubi, "the layout volume was not found");
                         return -EINVAL;
                 }
         } else {
                 if (av->leb_count > UBI_LAYOUT_VOLUME_EBS) {
                         /* This must not happen with proper UBI images */
-                        ubi_err("too many LEBs (%d) in layout volume",
+                        ubi_err(ubi, "too many LEBs (%d) in layout volume",
                                 av->leb_count);
                         return -EINVAL;
                 }
@@ -862,7 +859,7 @@ static void self_vtbl_check(const struct ubi_device *ubi)
                 return;
 
         if (vtbl_check(ubi, ubi->vtbl)) {
-                ubi_err("self-check failed");
+                ubi_err(ubi, "self-check failed");
                 BUG();
         }
 }
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 6654f191868e..834f6fe1f5fa 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -253,7 +253,7 @@ static int do_work(struct ubi_device *ubi)
          */
         err = wrk->func(ubi, wrk, 0);
         if (err)
-                ubi_err("work failed with error code %d", err);
+                ubi_err(ubi, "work failed with error code %d", err);
         up_read(&ubi->work_sem);
 
         return err;
@@ -470,8 +470,11 @@ struct ubi_wl_entry *ubi_wl_get_fm_peb(struct ubi_device *ubi, int anchor)
 {
         struct ubi_wl_entry *e = NULL;
 
-        if (!ubi->free.rb_node || (ubi->free_count - ubi->beb_rsvd_pebs < 1))
+        if (!ubi->free.rb_node || (ubi->free_count - ubi->beb_rsvd_pebs < 1)) {
+                ubi_warn(ubi, "Can't get peb for fastmap:anchor=%d, free_cnt=%d, reserved=%d",
+                         anchor, ubi->free_count, ubi->beb_rsvd_pebs);
                 goto out;
+        }
 
         if (anchor)
                 e = find_anchor_wl_entry(&ubi->free);
@@ -507,7 +510,7 @@ static int __wl_get_peb(struct ubi_device *ubi)
 retry:
         if (!ubi->free.rb_node) {
                 if (ubi->works_count == 0) {
-                        ubi_err("no free eraseblocks");
+                        ubi_err(ubi, "no free eraseblocks");
                         ubi_assert(list_empty(&ubi->works));
                         return -ENOSPC;
                 }
@@ -520,7 +523,7 @@ retry:
 
         e = find_mean_wl_entry(ubi, &ubi->free);
         if (!e) {
-                ubi_err("no free eraseblocks");
+                ubi_err(ubi, "no free eraseblocks");
                 return -ENOSPC;
         }
 
@@ -692,7 +695,8 @@ int ubi_wl_get_peb(struct ubi_device *ubi)
         err = ubi_self_check_all_ff(ubi, peb, ubi->vid_hdr_aloffset,
                                     ubi->peb_size - ubi->vid_hdr_aloffset);
         if (err) {
-                ubi_err("new PEB %d does not contain all 0xFF bytes", peb);
+                ubi_err(ubi, "new PEB %d does not contain all 0xFF bytes",
+                        peb);
                 return err;
         }
 
@@ -760,7 +764,7 @@ static int sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
                  * Erase counter overflow. Upgrade UBI and use 64-bit
                  * erase counters internally.
                  */
-                ubi_err("erase counter overflow at PEB %d, EC %llu",
+                ubi_err(ubi, "erase counter overflow at PEB %d, EC %llu",
                         e->pnum, ec);
                 err = -EINVAL;
                 goto out_free;
@@ -1137,7 +1141,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                         goto out_not_moved;
                 }
 
-                ubi_err("error %d while reading VID header from PEB %d",
+                ubi_err(ubi, "error %d while reading VID header from PEB %d",
                         err, e1->pnum);
                 goto out_error;
         }
@@ -1181,7 +1185,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                          * UBI from trying to move it over and over again.
                          */
                         if (ubi->erroneous_peb_count > ubi->max_erroneous) {
-                                ubi_err("too many erroneous eraseblocks (%d)",
+                                ubi_err(ubi, "too many erroneous eraseblocks (%d)",
                                         ubi->erroneous_peb_count);
                                 goto out_error;
                         }
@@ -1197,7 +1201,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
 
         /* The PEB has been successfully moved */
         if (scrubbing)
-                ubi_msg("scrubbed PEB %d (LEB %d:%d), data moved to PEB %d",
+                ubi_msg(ubi, "scrubbed PEB %d (LEB %d:%d), data moved to PEB %d",
                         e1->pnum, vol_id, lnum, e2->pnum);
         ubi_free_vid_hdr(ubi, vid_hdr);
 
@@ -1212,7 +1216,6 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
 
         err = do_sync_erase(ubi, e1, vol_id, lnum, 0);
         if (err) {
-                kmem_cache_free(ubi_wl_entry_slab, e1);
                 if (e2)
                         kmem_cache_free(ubi_wl_entry_slab, e2);
                 goto out_ro;
@@ -1226,10 +1229,8 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                 dbg_wl("PEB %d (LEB %d:%d) was put meanwhile, erase",
                        e2->pnum, vol_id, lnum);
                 err = do_sync_erase(ubi, e2, vol_id, lnum, 0);
-                if (err) {
-                        kmem_cache_free(ubi_wl_entry_slab, e2);
+                if (err)
                         goto out_ro;
-                }
         }
 
         dbg_wl("done");
@@ -1265,19 +1266,18 @@ out_not_moved:
 
         ubi_free_vid_hdr(ubi, vid_hdr);
         err = do_sync_erase(ubi, e2, vol_id, lnum, torture);
-        if (err) {
-                kmem_cache_free(ubi_wl_entry_slab, e2);
+        if (err)
                 goto out_ro;
-        }
+
         mutex_unlock(&ubi->move_mutex);
         return 0;
 
 out_error:
         if (vol_id != -1)
-                ubi_err("error %d while moving PEB %d to PEB %d",
+                ubi_err(ubi, "error %d while moving PEB %d to PEB %d",
                         err, e1->pnum, e2->pnum);
         else
-                ubi_err("error %d while moving PEB %d (LEB %d:%d) to PEB %d",
+                ubi_err(ubi, "error %d while moving PEB %d (LEB %d:%d) to PEB %d",
                         err, e1->pnum, vol_id, lnum, e2->pnum);
         spin_lock(&ubi->wl_lock);
         ubi->move_from = ubi->move_to = NULL;
@@ -1458,7 +1458,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
                 return err;
         }
 
-        ubi_err("failed to erase PEB %d, error %d", pnum, err);
+        ubi_err(ubi, "failed to erase PEB %d, error %d", pnum, err);
         kfree(wl_wrk);
 
         if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
@@ -1486,7 +1486,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         /* It is %-EIO, the PEB went bad */
 
         if (!ubi->bad_allowed) {
-                ubi_err("bad physical eraseblock %d detected", pnum);
+                ubi_err(ubi, "bad physical eraseblock %d detected", pnum);
                 goto out_ro;
         }
 
@@ -1494,7 +1494,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         if (ubi->beb_rsvd_pebs == 0) {
                 if (ubi->avail_pebs == 0) {
                         spin_unlock(&ubi->volumes_lock);
-                        ubi_err("no reserved/available physical eraseblocks");
+                        ubi_err(ubi, "no reserved/available physical eraseblocks");
                         goto out_ro;
                 }
                 ubi->avail_pebs -= 1;
@@ -1502,7 +1502,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         }
         spin_unlock(&ubi->volumes_lock);
 
-        ubi_msg("mark PEB %d as bad", pnum);
+        ubi_msg(ubi, "mark PEB %d as bad", pnum);
         err = ubi_io_mark_bad(ubi, pnum);
         if (err)
                 goto out_ro;
@@ -1523,11 +1523,12 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         ubi->good_peb_count -= 1;
         ubi_calculate_reserved(ubi);
         if (available_consumed)
-                ubi_warn("no PEBs in the reserved pool, used an available PEB");
+                ubi_warn(ubi, "no PEBs in the reserved pool, used an available PEB");
         else if (ubi->beb_rsvd_pebs)
-                ubi_msg("%d PEBs left in the reserve", ubi->beb_rsvd_pebs);
+                ubi_msg(ubi, "%d PEBs left in the reserve",
+                        ubi->beb_rsvd_pebs);
         else
-                ubi_warn("last PEB from the reserve was used");
+                ubi_warn(ubi, "last PEB from the reserve was used");
         spin_unlock(&ubi->volumes_lock);
 
         return err;
@@ -1613,7 +1614,7 @@ retry:
                 } else {
                         err = prot_queue_del(ubi, e->pnum);
                         if (err) {
-                                ubi_err("PEB %d not found", pnum);
+                                ubi_err(ubi, "PEB %d not found", pnum);
                                 ubi_ro_mode(ubi);
                                 spin_unlock(&ubi->wl_lock);
                                 return err;
@@ -1646,7 +1647,7 @@ int ubi_wl_scrub_peb(struct ubi_device *ubi, int pnum)
 {
         struct ubi_wl_entry *e;
 
-        ubi_msg("schedule PEB %d for scrubbing", pnum);
+        ubi_msg(ubi, "schedule PEB %d for scrubbing", pnum);
 
 retry:
         spin_lock(&ubi->wl_lock);
@@ -1678,7 +1679,7 @@ retry:
 
                 err = prot_queue_del(ubi, e->pnum);
                 if (err) {
-                        ubi_err("PEB %d not found", pnum);
+                        ubi_err(ubi, "PEB %d not found", pnum);
                         ubi_ro_mode(ubi);
                         spin_unlock(&ubi->wl_lock);
                         return err;
@@ -1798,15 +1799,18 @@ int ubi_thread(void *u)
         int failures = 0;
         struct ubi_device *ubi = u;
 
-        ubi_msg("background thread \"%s\" started, PID %d",
+        ubi_msg(ubi, "background thread \"%s\" started, PID %d",
                 ubi->bgt_name, task_pid_nr(current));
 
         set_freezable();
         for (;;) {
                 int err;
 
-                if (kthread_should_stop())
+                if (kthread_should_stop()) {
+                        ubi_msg(ubi, "background thread \"%s\" should stop, PID %d",
+                                ubi->bgt_name, task_pid_nr(current));
                         break;
+                }
 
                 if (try_to_freeze())
                         continue;
@@ -1823,14 +1827,14 @@ int ubi_thread(void *u)
 
                 err = do_work(ubi);
                 if (err) {
-                        ubi_err("%s: work failed with error code %d",
+                        ubi_err(ubi, "%s: work failed with error code %d",
                                 ubi->bgt_name, err);
                         if (failures++ > WL_MAX_FAILURES) {
                                 /*
                                  * Too many failures, disable the thread and
                                  * switch to read-only mode.
                                  */
-                                ubi_msg("%s: %d consecutive failures",
+                                ubi_msg(ubi, "%s: %d consecutive failures",
                                         ubi->bgt_name, WL_MAX_FAILURES);
                                 ubi_ro_mode(ubi);
                                 ubi->thread_enabled = 0;
@@ -1981,10 +1985,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
 #endif
 
         if (ubi->avail_pebs < reserved_pebs) {
-                ubi_err("no enough physical eraseblocks (%d, need %d)",
+                ubi_err(ubi, "no enough physical eraseblocks (%d, need %d)",
                         ubi->avail_pebs, reserved_pebs);
                 if (ubi->corr_peb_count)
-                        ubi_err("%d PEBs are corrupted and not used",
+                        ubi_err(ubi, "%d PEBs are corrupted and not used",
                                 ubi->corr_peb_count);
                 goto out_free;
         }
@@ -2072,8 +2076,8 @@ static int self_check_ec(struct ubi_device *ubi, int pnum, int ec)
 
         read_ec = be64_to_cpu(ec_hdr->ec);
         if (ec != read_ec && read_ec - ec > 1) {
-                ubi_err("self-check failed for PEB %d", pnum);
-                ubi_err("read EC is %lld, should be %d", read_ec, ec);
+                ubi_err(ubi, "self-check failed for PEB %d", pnum);
+                ubi_err(ubi, "read EC is %lld, should be %d", read_ec, ec);
                 dump_stack();
                 err = 1;
         } else
@@ -2102,7 +2106,7 @@ static int self_check_in_wl_tree(const struct ubi_device *ubi,
         if (in_wl_tree(e, root))
                 return 0;
 
-        ubi_err("self-check failed for PEB %d, EC %d, RB-tree %p ",
+        ubi_err(ubi, "self-check failed for PEB %d, EC %d, RB-tree %p ",
                 e->pnum, e->ec, root);
         dump_stack();
         return -EINVAL;
@@ -2130,7 +2134,7 @@ static int self_check_in_pq(const struct ubi_device *ubi,
                         if (p == e)
                                 return 0;
 
-        ubi_err("self-check failed for PEB %d, EC %d, Protect queue",
+        ubi_err(ubi, "self-check failed for PEB %d, EC %d, Protect queue",
                 e->pnum, e->ec);
         dump_stack();
         return -EINVAL;
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 72fb86b9aa24..c9946c6c119e 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -48,7 +48,7 @@ MODULE_DEVICE_TABLE(pci, atl1c_pci_tbl);
 
 MODULE_AUTHOR("Jie Yang");
 MODULE_AUTHOR("Qualcomm Atheros Inc., <nic-devel@qualcomm.com>");
-MODULE_DESCRIPTION("Qualcom Atheros 100/1000M Ethernet Network Driver");
+MODULE_DESCRIPTION("Qualcomm Atheros 100/1000M Ethernet Network Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(ATL1C_DRV_VERSION);
 
diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
index 93caf8e68901..2399a3921762 100644
--- a/drivers/net/wireless/ath/ath5k/Kconfig
+++ b/drivers/net/wireless/ath/ath5k/Kconfig
@@ -1,12 +1,13 @@
 config ATH5K
         tristate "Atheros 5xxx wireless cards support"
-        depends on PCI && MAC80211
+        depends on (PCI || ATH25) && MAC80211
         select ATH_COMMON
         select MAC80211_LEDS
         select LEDS_CLASS
         select NEW_LEDS
         select AVERAGE
-        select ATH5K_PCI
+        select ATH5K_AHB if ATH25
+        select ATH5K_PCI if !ATH25
         ---help---
           This module adds support for wireless adapters based on
           Atheros 5xxx chipset.
@@ -51,9 +52,16 @@ config ATH5K_TRACER
 
           If unsure, say N.
 
+config ATH5K_AHB
+        bool "Atheros 5xxx AHB bus support"
+        depends on ATH25
+        ---help---
+          This adds support for WiSoC type chipsets of the 5xxx Atheros
+          family.
+
 config ATH5K_PCI
         bool "Atheros 5xxx PCI bus support"
-        depends on PCI
+        depends on (!ATH25 && PCI)
         ---help---
           This adds support for PCI type chipsets of the 5xxx Atheros
           family.
diff --git a/drivers/net/wireless/ath/ath5k/Makefile b/drivers/net/wireless/ath/ath5k/Makefile
index 51e2d8668041..1b3a34f7f224 100644
--- a/drivers/net/wireless/ath/ath5k/Makefile
+++ b/drivers/net/wireless/ath/ath5k/Makefile
@@ -17,5 +17,6 @@ ath5k-y				+= ani.o
 ath5k-y                         += sysfs.o
 ath5k-y                         += mac80211-ops.o
 ath5k-$(CONFIG_ATH5K_DEBUG)     += debug.o
+ath5k-$(CONFIG_ATH5K_AHB)       += ahb.o
 ath5k-$(CONFIG_ATH5K_PCI)       += pci.o
 obj-$(CONFIG_ATH5K)             += ath5k.o
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
new file mode 100644
index 000000000000..8f387cf67340
--- /dev/null
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ * Copyright (c) 2009 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (c) 2009 Imre Kaloz <kaloz@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/nl80211.h>
+#include <linux/platform_device.h>
+#include <linux/etherdevice.h>
+#include <linux/export.h>
+#include <ath25_platform.h>
+#include "ath5k.h"
+#include "debug.h"
+#include "base.h"
+#include "reg.h"
+
+/* return bus cachesize in 4B word units */
+static void ath5k_ahb_read_cachesize(struct ath_common *common, int *csz)
+{
+        *csz = L1_CACHE_BYTES >> 2;
+}
+
+static bool
+ath5k_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
+{
+        struct ath5k_hw *ah = common->priv;
+        struct platform_device *pdev = to_platform_device(ah->dev);
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
+        u16 *eeprom, *eeprom_end;
+
+        eeprom = (u16 *) bcfg->radio;
+        eeprom_end = ((void *) bcfg->config) + BOARD_CONFIG_BUFSZ;
+
+        eeprom += off;
+        if (eeprom > eeprom_end)
+                return false;
+
+        *data = *eeprom;
+        return true;
+}
+
+int ath5k_hw_read_srev(struct ath5k_hw *ah)
+{
+        struct platform_device *pdev = to_platform_device(ah->dev);
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
+        ah->ah_mac_srev = bcfg->devid;
+        return 0;
+}
+
+static int ath5k_ahb_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
+{
+        struct platform_device *pdev = to_platform_device(ah->dev);
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
+        u8 *cfg_mac;
+
+        if (to_platform_device(ah->dev)->id == 0)
+                cfg_mac = bcfg->config->wlan0_mac;
+        else
+                cfg_mac = bcfg->config->wlan1_mac;
+
+        memcpy(mac, cfg_mac, ETH_ALEN);
+        return 0;
+}
+
+static const struct ath_bus_ops ath_ahb_bus_ops = {
+        .ath_bus_type = ATH_AHB,
+        .read_cachesize = ath5k_ahb_read_cachesize,
+        .eeprom_read = ath5k_ahb_eeprom_read,
+        .eeprom_read_mac = ath5k_ahb_eeprom_read_mac,
+};
+
+/*Initialization*/
+static int ath_ahb_probe(struct platform_device *pdev)
+{
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
+        struct ath5k_hw *ah;
+        struct ieee80211_hw *hw;
+        struct resource *res;
+        void __iomem *mem;
+        int irq;
+        int ret = 0;
+        u32 reg;
+
+        if (!dev_get_platdata(&pdev->dev)) {
+                dev_err(&pdev->dev, "no platform data specified\n");
+                ret = -EINVAL;
+                goto err_out;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "no memory resource found\n");
+                ret = -ENXIO;
+                goto err_out;
+        }
+
+        mem = ioremap_nocache(res->start, resource_size(res));
+        if (mem == NULL) {
+                dev_err(&pdev->dev, "ioremap failed\n");
+                ret = -ENOMEM;
+                goto err_out;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "no IRQ resource found\n");
+                ret = -ENXIO;
+                goto err_iounmap;
+        }
+
+        irq = res->start;
+
+        hw = ieee80211_alloc_hw(sizeof(struct ath5k_hw), &ath5k_hw_ops);
+        if (hw == NULL) {
+                dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
+                ret = -ENOMEM;
+                goto err_iounmap;
+        }
+
+        ah = hw->priv;
+        ah->hw = hw;
+        ah->dev = &pdev->dev;
+        ah->iobase = mem;
+        ah->irq = irq;
+        ah->devid = bcfg->devid;
+
+        if (bcfg->devid >= AR5K_SREV_AR2315_R6) {
+                /* Enable WMAC AHB arbitration */
+                reg = ioread32((void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
+                reg |= AR5K_AR2315_AHB_ARB_CTL_WLAN;
+                iowrite32(reg, (void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
+
+                /* Enable global WMAC swapping */
+                reg = ioread32((void __iomem *) AR5K_AR2315_BYTESWAP);
+                reg |= AR5K_AR2315_BYTESWAP_WMAC;
+                iowrite32(reg, (void __iomem *) AR5K_AR2315_BYTESWAP);
+        } else {
+                /* Enable WMAC DMA access (assuming 5312 or 231x*/
+                /* TODO: check other platforms */
+                reg = ioread32((void __iomem *) AR5K_AR5312_ENABLE);
+                if (to_platform_device(ah->dev)->id == 0)
+                        reg |= AR5K_AR5312_ENABLE_WLAN0;
+                else
+                        reg |= AR5K_AR5312_ENABLE_WLAN1;
+                iowrite32(reg, (void __iomem *) AR5K_AR5312_ENABLE);
+
+                /*
+                 * On a dual-band AR5312, the multiband radio is only
+                 * used as pass-through. Disable 2 GHz support in the
+                 * driver for it
+                 */
+                if (to_platform_device(ah->dev)->id == 0 &&
+                    (bcfg->config->flags & (BD_WLAN0 | BD_WLAN1)) ==
+                     (BD_WLAN1 | BD_WLAN0))
+                        ah->ah_capabilities.cap_needs_2GHz_ovr = true;
+                else
+                        ah->ah_capabilities.cap_needs_2GHz_ovr = false;
+        }
+
+        ret = ath5k_init_ah(ah, &ath_ahb_bus_ops);
+        if (ret != 0) {
+                dev_err(&pdev->dev, "failed to attach device, err=%d\n", ret);
+                ret = -ENODEV;
+                goto err_free_hw;
+        }
+
+        platform_set_drvdata(pdev, hw);
+
+        return 0;
+
+ err_free_hw:
+        ieee80211_free_hw(hw);
+ err_iounmap:
+        iounmap(mem);
+ err_out:
+        return ret;
+}
+
+static int ath_ahb_remove(struct platform_device *pdev)
+{
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct ath5k_hw *ah;
+        u32 reg;
+
+        if (!hw)
+                return 0;
+
+        ah = hw->priv;
+
+        if (bcfg->devid >= AR5K_SREV_AR2315_R6) {
+                /* Disable WMAC AHB arbitration */
+                reg = ioread32((void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
+                reg &= ~AR5K_AR2315_AHB_ARB_CTL_WLAN;
+                iowrite32(reg, (void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
+        } else {
+                /*Stop DMA access */
+                reg = ioread32((void __iomem *) AR5K_AR5312_ENABLE);
+                if (to_platform_device(ah->dev)->id == 0)
+                        reg &= ~AR5K_AR5312_ENABLE_WLAN0;
+                else
+                        reg &= ~AR5K_AR5312_ENABLE_WLAN1;
+                iowrite32(reg, (void __iomem *) AR5K_AR5312_ENABLE);
+        }
+
+        ath5k_deinit_ah(ah);
+        iounmap(ah->iobase);
+        ieee80211_free_hw(hw);
+
+        return 0;
+}
+
+static struct platform_driver ath_ahb_driver = {
+        .probe      = ath_ahb_probe,
+        .remove     = ath_ahb_remove,
+        .driver         = {
+                .name   = "ar231x-wmac",
+                .owner  = THIS_MODULE,
+        },
+};
+
+module_platform_driver(ath_ahb_driver);
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index ed2468220216..1ed7a88aeea9 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -1647,6 +1647,32 @@ static inline struct ath_regulatory *ath5k_hw_regulatory(struct ath5k_hw *ah)
         return &(ath5k_hw_common(ah)->regulatory);
 }
 
+#ifdef CONFIG_ATH5K_AHB
+#define AR5K_AR2315_PCI_BASE    ((void __iomem *)0xb0100000)
+
+static inline void __iomem *ath5k_ahb_reg(struct ath5k_hw *ah, u16 reg)
+{
+        /* On AR2315 and AR2317 the PCI clock domain registers
+         * are outside of the WMAC register space */
+        if (unlikely((reg >= 0x4000) && (reg < 0x5000) &&
+            (ah->ah_mac_srev >= AR5K_SREV_AR2315_R6)))
+                return AR5K_AR2315_PCI_BASE + reg;
+
+        return ah->iobase + reg;
+}
+
+static inline u32 ath5k_hw_reg_read(struct ath5k_hw *ah, u16 reg)
+{
+        return ioread32(ath5k_ahb_reg(ah, reg));
+}
+
+static inline void ath5k_hw_reg_write(struct ath5k_hw *ah, u32 val, u16 reg)
+{
+        iowrite32(val, ath5k_ahb_reg(ah, reg));
+}
+
+#else
+
 static inline u32 ath5k_hw_reg_read(struct ath5k_hw *ah, u16 reg)
 {
         return ioread32(ah->iobase + reg);
@@ -1657,6 +1683,8 @@ static inline void ath5k_hw_reg_write(struct ath5k_hw *ah, u32 val, u16 reg)
         iowrite32(val, ah->iobase + reg);
 }
 
+#endif
+
 static inline enum ath_bus_type ath5k_get_bus_type(struct ath5k_hw *ah)
 {
         return ath5k_hw_common(ah)->bus_ops->ath_bus_type;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index a4a09bb8f2f3..bc9cb356fa69 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -99,6 +99,15 @@ static int ath5k_reset(struct ath5k_hw *ah, struct ieee80211_channel *chan,
 
 /* Known SREVs */
 static const struct ath5k_srev_name srev_names[] = {
+#ifdef CONFIG_ATH5K_AHB
+        { "5312",       AR5K_VERSION_MAC,       AR5K_SREV_AR5312_R2 },
+        { "5312",       AR5K_VERSION_MAC,       AR5K_SREV_AR5312_R7 },
+        { "2313",       AR5K_VERSION_MAC,       AR5K_SREV_AR2313_R8 },
+        { "2315",       AR5K_VERSION_MAC,       AR5K_SREV_AR2315_R6 },
+        { "2315",       AR5K_VERSION_MAC,       AR5K_SREV_AR2315_R7 },
+        { "2317",       AR5K_VERSION_MAC,       AR5K_SREV_AR2317_R1 },
+        { "2317",       AR5K_VERSION_MAC,       AR5K_SREV_AR2317_R2 },
+#else
         { "5210",       AR5K_VERSION_MAC,       AR5K_SREV_AR5210 },
         { "5311",       AR5K_VERSION_MAC,       AR5K_SREV_AR5311 },
         { "5311A",      AR5K_VERSION_MAC,       AR5K_SREV_AR5311A },
@@ -117,6 +126,7 @@ static const struct ath5k_srev_name srev_names[] = {
         { "5418",       AR5K_VERSION_MAC,       AR5K_SREV_AR5418 },
         { "2425",       AR5K_VERSION_MAC,       AR5K_SREV_AR2425 },
         { "2417",       AR5K_VERSION_MAC,       AR5K_SREV_AR2417 },
+#endif
         { "xxxxx",      AR5K_VERSION_MAC,       AR5K_SREV_UNKNOWN },
         { "5110",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5110 },
         { "5111",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5111 },
@@ -132,6 +142,10 @@ static const struct ath5k_srev_name srev_names[] = {
         { "5413",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5413 },
         { "5424",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5424 },
         { "5133",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5133 },
+#ifdef CONFIG_ATH5K_AHB
+        { "2316",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_2316 },
+        { "2317",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_2317 },
+#endif
         { "xxxxx",      AR5K_VERSION_RAD,       AR5K_SREV_UNKNOWN },
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index 0beb7e7d6075..ca4b7ccd697f 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -163,14 +163,20 @@ int ath5k_init_leds(struct ath5k_hw *ah)
 {
         int ret = 0;
         struct ieee80211_hw *hw = ah->hw;
+#ifndef CONFIG_ATH5K_AHB
         struct pci_dev *pdev = ah->pdev;
+#endif
         char name[ATH5K_LED_MAX_NAME_LEN + 1];
         const struct pci_device_id *match;
 
         if (!ah->pdev)
                 return 0;
 
+#ifdef CONFIG_ATH5K_AHB
+        match = NULL;
+#else
         match = pci_match_id(&ath5k_led_devices[0], pdev);
+#endif
         if (match) {
                 __set_bit(ATH_STAT_LEDSOFT, ah->status);
                 ah->led_pin = ATH_PIN(match->driver_data);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a7ac72639c52..cab05f31223f 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1138,8 +1138,8 @@ EXPORT_SYMBOL_GPL(pci_store_saved_state);
  * @dev: PCI device that we're dealing with
  * @state: Saved state returned from pci_store_saved_state()
  */
-static int pci_load_saved_state(struct pci_dev *dev,
-                                struct pci_saved_state *state)
+int pci_load_saved_state(struct pci_dev *dev,
+                         struct pci_saved_state *state)
 {
         struct pci_cap_saved_data *cap;
 
@@ -1167,6 +1167,7 @@ static int pci_load_saved_state(struct pci_dev *dev,
         dev->state_saved = true;
         return 0;
 }
+EXPORT_SYMBOL_GPL(pci_load_saved_state);
 
 /**
  * pci_load_and_free_saved_state - Reload the save state pointed to by state,
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index b0ce7cdee0c2..910e90bf16c6 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -147,7 +147,6 @@ config TCIC
 config PCMCIA_ALCHEMY_DEVBOARD
         tristate "Alchemy Db/Pb1xxx PCMCIA socket services"
         depends on MIPS_ALCHEMY && PCMCIA
-        select 64BIT_PHYS_ADDR
         help
           Enable this driver of you want PCMCIA support on your Alchemy
           Db1000, Db/Pb1100, Db/Pb1500, Db/Pb1550, Db/Pb1200, DB1300
@@ -158,7 +157,6 @@ config PCMCIA_ALCHEMY_DEVBOARD
 config PCMCIA_XXS1500
         tristate "MyCable XXS1500 PCMCIA socket support"
         depends on PCMCIA && MIPS_XXS1500
-        select 64BIT_PHYS_ADDR
         help
           Support for the PCMCIA/CF socket interface on MyCable XXS1500
           systems.
diff --git a/drivers/pcmcia/sa1100_generic.c b/drivers/pcmcia/sa1100_generic.c
index ff8a027a4afb..d2ab06048169 100644
--- a/drivers/pcmcia/sa1100_generic.c
+++ b/drivers/pcmcia/sa1100_generic.c
@@ -93,6 +93,7 @@ static int sa11x0_drv_pcmcia_remove(struct platform_device *dev)
         for (i = 0; i < sinfo->nskt; i++)
                 soc_pcmcia_remove_one(&sinfo->skt[i]);
 
+        clk_put(sinfo->clk);
         kfree(sinfo);
         return 0;
 }
diff --git a/drivers/pcmcia/sa1111_generic.c b/drivers/pcmcia/sa1111_generic.c
index 65b02c3e14ce..7bae7e549d8b 100644
--- a/drivers/pcmcia/sa1111_generic.c
+++ b/drivers/pcmcia/sa1111_generic.c
@@ -145,6 +145,12 @@ int sa1111_pcmcia_add(struct sa1111_dev *dev, struct pcmcia_low_level *ops,
                         return -ENOMEM;
 
                 s->soc.nr = ops->first + i;
+                s->soc.clk = clk_get(&dev->dev, NULL);
+                if (IS_ERR(s->soc.clk)) {
+                        ret = PTR_ERR(s->soc.clk);
+                        kfree(s);
+                        return ret;
+                }
                 soc_pcmcia_init_one(&s->soc, ops, &dev->dev);
                 s->dev = dev;
                 if (s->soc.nr) {
@@ -220,6 +226,7 @@ static int pcmcia_remove(struct sa1111_dev *dev)
         for (; s; s = next) {
                 next = s->next;
                 soc_pcmcia_remove_one(&s->soc);
+                clk_put(s->soc.clk);
                 kfree(s);
         }
 
diff --git a/drivers/pcmcia/sa11xx_base.c b/drivers/pcmcia/sa11xx_base.c
index 54d3089d157b..cf6de2c2b329 100644
--- a/drivers/pcmcia/sa11xx_base.c
+++ b/drivers/pcmcia/sa11xx_base.c
@@ -135,14 +135,16 @@ sa1100_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 static int
 sa1100_pcmcia_set_timing(struct soc_pcmcia_socket *skt)
 {
-        return sa1100_pcmcia_set_mecr(skt, cpufreq_get(0));
+        unsigned long clk = clk_get_rate(skt->clk);
+
+        return sa1100_pcmcia_set_mecr(skt, clk / 1000);
 }
 
 static int
 sa1100_pcmcia_show_timing(struct soc_pcmcia_socket *skt, char *buf)
 {
         struct soc_pcmcia_timing timing;
-        unsigned int clock = cpufreq_get(0);
+        unsigned int clock = clk_get_rate(skt->clk);
         unsigned long mecr = MECR;
         char *p = buf;
 
@@ -218,6 +220,11 @@ int sa11xx_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops,
         struct skt_dev_info *sinfo;
         struct soc_pcmcia_socket *skt;
         int i, ret = 0;
+        struct clk *clk;
+
+        clk = clk_get(dev, NULL);
+        if (IS_ERR(clk))
+                return PTR_ERR(clk);
 
         sa11xx_drv_pcmcia_ops(ops);
 
@@ -226,12 +233,14 @@ int sa11xx_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops,
                 return -ENOMEM;
 
         sinfo->nskt = nr;
+        sinfo->clk = clk;
 
         /* Initialize processor specific parameters */
         for (i = 0; i < nr; i++) {
                 skt = &sinfo->skt[i];
 
                 skt->nr = first + i;
+                skt->clk = clk;
                 soc_pcmcia_init_one(skt, ops, dev);
 
                 ret = sa11xx_drv_pcmcia_add_one(skt);
@@ -242,6 +251,7 @@ int sa11xx_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops,
         if (ret) {
                 while (--i >= 0)
                         soc_pcmcia_remove_one(&sinfo->skt[i]);
+                clk_put(clk);
                 kfree(sinfo);
         } else {
                 dev_set_drvdata(dev, sinfo);
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index a2bc6ee1702e..933f4657515b 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -120,6 +120,8 @@ static void __soc_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt,
 
         if (skt->ops->hw_shutdown)
                 skt->ops->hw_shutdown(skt);
+
+        clk_disable_unprepare(skt->clk);
 }
 
 static void soc_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
@@ -131,6 +133,8 @@ static int soc_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 {
         int ret = 0, i;
 
+        clk_prepare_enable(skt->clk);
+
         if (skt->ops->hw_init) {
                 ret = skt->ops->hw_init(skt);
                 if (ret)
diff --git a/drivers/pinctrl/spear/pinctrl-plgpio.c b/drivers/pinctrl/spear/pinctrl-plgpio.c
index bddb79105d67..ce5f22c4151d 100644
--- a/drivers/pinctrl/spear/pinctrl-plgpio.c
+++ b/drivers/pinctrl/spear/pinctrl-plgpio.c
@@ -724,5 +724,5 @@ static int __init plgpio_init(void)
 subsys_initcall(plgpio_init);
 
 MODULE_AUTHOR("Viresh Kumar <viresh.kumar@linaro.org>");
-MODULE_DESCRIPTION("ST Microlectronics SPEAr PLGPIO driver");
+MODULE_DESCRIPTION("STMicroelectronics SPEAr PLGPIO driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index c0242ed13d9e..ecd36e332c3c 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -593,7 +593,7 @@ static void ips_disable_gpu_turbo(struct ips_driver *ips)
                 return;
 
         if (!ips->gpu_turbo_disable())
-                dev_err(&ips->dev->dev, "failed to disable graphis turbo\n");
+                dev_err(&ips->dev->dev, "failed to disable graphics turbo\n");
         else
                 ips->__gpu_turbo_on = false;
 }
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 4511ddc1ac31..f15cddfeb897 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -987,6 +987,17 @@ config RTC_DRV_NUC900
           If you say yes here you get support for the RTC subsystem of the
           NUC910/NUC920 used in embedded systems.
 
+config RTC_DRV_OPAL
+        tristate "IBM OPAL RTC driver"
+        depends on PPC_POWERNV
+        default y
+        help
+          If you say yes here you get support for the PowerNV platform RTC
+          driver based on OPAL interfaces.
+
+          This driver can also be built as a module. If so, the module
+          will be called rtc-opal.
+
 comment "on-CPU RTC drivers"
 
 config RTC_DRV_DAVINCI
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index b188323c096a..c8ef3e1e6ccd 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -92,6 +92,7 @@ obj-$(CONFIG_RTC_DRV_MSM6242)	+= rtc-msm6242.o
 obj-$(CONFIG_RTC_DRV_MPC5121)   += rtc-mpc5121.o
 obj-$(CONFIG_RTC_DRV_MV)        += rtc-mv.o
 obj-$(CONFIG_RTC_DRV_NUC900)    += rtc-nuc900.o
+obj-$(CONFIG_RTC_DRV_OPAL)      += rtc-opal.o
 obj-$(CONFIG_RTC_DRV_OMAP)      += rtc-omap.o
 obj-$(CONFIG_RTC_DRV_PALMAS)    += rtc-palmas.o
 obj-$(CONFIG_RTC_DRV_PCAP)      += rtc-pcap.o
diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c
new file mode 100644
index 000000000000..95f652165fe9
--- /dev/null
+++ b/drivers/rtc/rtc-opal.c
@@ -0,0 +1,261 @@
+/*
+ * IBM OPAL RTC driver
+ * Copyright (C) 2014 IBM
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.
+ */
+
+#define DRVNAME         "rtc-opal"
+#define pr_fmt(fmt)     DRVNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/rtc.h>
+#include <linux/delay.h>
+#include <linux/bcd.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <asm/opal.h>
+#include <asm/firmware.h>
+
+static void opal_to_tm(u32 y_m_d, u64 h_m_s_ms, struct rtc_time *tm)
+{
+        tm->tm_year = ((bcd2bin(y_m_d >> 24) * 100) +
+                       bcd2bin((y_m_d >> 16) & 0xff)) - 1900;
+        tm->tm_mon  = bcd2bin((y_m_d >> 8) & 0xff) - 1;
+        tm->tm_mday = bcd2bin(y_m_d & 0xff);
+        tm->tm_hour = bcd2bin((h_m_s_ms >> 56) & 0xff);
+        tm->tm_min  = bcd2bin((h_m_s_ms >> 48) & 0xff);
+        tm->tm_sec  = bcd2bin((h_m_s_ms >> 40) & 0xff);
+
+        GregorianDay(tm);
+}
+
+static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms)
+{
+        *y_m_d |= ((u32)bin2bcd((tm->tm_year + 1900) / 100)) << 24;
+        *y_m_d |= ((u32)bin2bcd((tm->tm_year + 1900) % 100)) << 16;
+        *y_m_d |= ((u32)bin2bcd((tm->tm_mon + 1))) << 8;
+        *y_m_d |= ((u32)bin2bcd(tm->tm_mday));
+
+        *h_m_s_ms |= ((u64)bin2bcd(tm->tm_hour)) << 56;
+        *h_m_s_ms |= ((u64)bin2bcd(tm->tm_min)) << 48;
+        *h_m_s_ms |= ((u64)bin2bcd(tm->tm_sec)) << 40;
+}
+
+static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
+{
+        long rc = OPAL_BUSY;
+        u32 y_m_d;
+        u64 h_m_s_ms;
+        __be32 __y_m_d;
+        __be64 __h_m_s_ms;
+
+        while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
+                rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
+                if (rc == OPAL_BUSY_EVENT)
+                        opal_poll_events(NULL);
+                else
+                        msleep(10);
+        }
+
+        if (rc != OPAL_SUCCESS)
+                return -EIO;
+
+        y_m_d = be32_to_cpu(__y_m_d);
+        h_m_s_ms = be64_to_cpu(__h_m_s_ms);
+        opal_to_tm(y_m_d, h_m_s_ms, tm);
+
+        return 0;
+}
+
+static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm)
+{
+        long rc = OPAL_BUSY;
+        u32 y_m_d = 0;
+        u64 h_m_s_ms = 0;
+
+        tm_to_opal(tm, &y_m_d, &h_m_s_ms);
+        while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
+                rc = opal_rtc_write(y_m_d, h_m_s_ms);
+                if (rc == OPAL_BUSY_EVENT)
+                        opal_poll_events(NULL);
+                else
+                        msleep(10);
+        }
+
+        return rc == OPAL_SUCCESS ? 0 : -EIO;
+}
+
+/*
+ * TPO  Timed Power-On
+ *
+ * TPO get/set OPAL calls care about the hour and min and to make it consistent
+ * with the rtc utility time conversion functions, we use the 'u64' to store
+ * its value and perform bit shift by 32 before use..
+ */
+static int opal_get_tpo_time(struct device *dev, struct rtc_wkalrm *alarm)
+{
+        __be32 __y_m_d, __h_m;
+        struct opal_msg msg;
+        int rc, token;
+        u64 h_m_s_ms;
+        u32 y_m_d;
+
+        token = opal_async_get_token_interruptible();
+        if (token < 0) {
+                if (token != -ERESTARTSYS)
+                        pr_err("Failed to get the async token\n");
+
+                return token;
+        }
+
+        rc = opal_tpo_read(token, &__y_m_d, &__h_m);
+        if (rc != OPAL_ASYNC_COMPLETION) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        rc = opal_async_wait_response(token, &msg);
+        if (rc) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        rc = be64_to_cpu(msg.params[1]);
+        if (rc != OPAL_SUCCESS) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        y_m_d = be32_to_cpu(__y_m_d);
+        h_m_s_ms = ((u64)be32_to_cpu(__h_m) << 32);
+        opal_to_tm(y_m_d, h_m_s_ms, &alarm->time);
+
+exit:
+        opal_async_release_token(token);
+        return rc;
+}
+
+/* Set Timed Power-On */
+static int opal_set_tpo_time(struct device *dev, struct rtc_wkalrm *alarm)
+{
+        u64 h_m_s_ms = 0, token;
+        struct opal_msg msg;
+        u32 y_m_d = 0;
+        int rc;
+
+        tm_to_opal(&alarm->time, &y_m_d, &h_m_s_ms);
+
+        token = opal_async_get_token_interruptible();
+        if (token < 0) {
+                if (token != -ERESTARTSYS)
+                        pr_err("Failed to get the async token\n");
+
+                return token;
+        }
+
+        /* TPO, we care about hour and minute */
+        rc = opal_tpo_write(token, y_m_d,
+                            (u32)((h_m_s_ms >> 32) & 0xffff0000));
+        if (rc != OPAL_ASYNC_COMPLETION) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        rc = opal_async_wait_response(token, &msg);
+        if (rc) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        rc = be64_to_cpu(msg.params[1]);
+        if (rc != OPAL_SUCCESS)
+                rc = -EIO;
+
+exit:
+        opal_async_release_token(token);
+        return rc;
+}
+
+static const struct rtc_class_ops opal_rtc_ops = {
+        .read_time      = opal_get_rtc_time,
+        .set_time       = opal_set_rtc_time,
+        .read_alarm     = opal_get_tpo_time,
+        .set_alarm      = opal_set_tpo_time,
+};
+
+static int opal_rtc_probe(struct platform_device *pdev)
+{
+        struct rtc_device *rtc;
+
+        if (pdev->dev.of_node && of_get_property(pdev->dev.of_node, "has-tpo",
+                                                 NULL))
+                device_set_wakeup_capable(&pdev->dev, true);
+
+        rtc = devm_rtc_device_register(&pdev->dev, DRVNAME, &opal_rtc_ops,
+                                       THIS_MODULE);
+        if (IS_ERR(rtc))
+                return PTR_ERR(rtc);
+
+        rtc->uie_unsupported = 1;
+
+        return 0;
+}
+
+static const struct of_device_id opal_rtc_match[] = {
+        {
+                .compatible     = "ibm,opal-rtc",
+        },
+        { }
+};
+MODULE_DEVICE_TABLE(of, opal_rtc_match);
+
+static const struct platform_device_id opal_rtc_driver_ids[] = {
+        {
+                .name           = "opal-rtc",
+        },
+        { }
+};
+MODULE_DEVICE_TABLE(platform, opal_rtc_driver_ids);
+
+static struct platform_driver opal_rtc_driver = {
+        .probe          = opal_rtc_probe,
+        .id_table       = opal_rtc_driver_ids,
+        .driver         = {
+                .name           = DRVNAME,
+                .owner          = THIS_MODULE,
+                .of_match_table = opal_rtc_match,
+        },
+};
+
+static int __init opal_rtc_init(void)
+{
+        if (!firmware_has_feature(FW_FEATURE_OPAL))
+                return -ENODEV;
+
+        return platform_driver_register(&opal_rtc_driver);
+}
+
+static void __exit opal_rtc_exit(void)
+{
+        platform_driver_unregister(&opal_rtc_driver);
+}
+
+MODULE_AUTHOR("Neelesh Gupta <neelegup@linux.vnet.ibm.com>");
+MODULE_DESCRIPTION("IBM OPAL RTC driver");
+MODULE_LICENSE("GPL");
+
+module_init(opal_rtc_init);
+module_exit(opal_rtc_exit);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 329db997ee66..4abf11965484 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1377,6 +1377,20 @@ int dasd_term_IO(struct dasd_ccw_req *cqr)
                                       "I/O error, retry");
                         break;
                 case -EINVAL:
+                        /*
+                         * device not valid so no I/O could be running
+                         * handle CQR as termination successful
+                         */
+                        cqr->status = DASD_CQR_CLEARED;
+                        cqr->stopclk = get_tod_clock();
+                        cqr->starttime = 0;
+                        /* no retries for invalid devices */
+                        cqr->retries = -1;
+                        DBF_DEV_EVENT(DBF_ERR, device, "%s",
+                                      "EINVAL, handle as terminated");
+                        /* fake rc to success */
+                        rc = 0;
+                        break;
                 case -EBUSY:
                         DBF_DEV_EVENT(DBF_ERR, device, "%s",
                                       "device busy, retry later");
@@ -1683,11 +1697,8 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         if (cqr->status == DASD_CQR_CLEAR_PENDING &&
             scsw_fctl(&irb->scsw) & SCSW_FCTL_CLEAR_FUNC) {
                 cqr->status = DASD_CQR_CLEARED;
-                if (cqr->callback_data == DASD_SLEEPON_START_TAG)
-                        cqr->callback_data = DASD_SLEEPON_END_TAG;
                 dasd_device_clear_timer(device);
                 wake_up(&dasd_flush_wq);
-                wake_up(&generic_waitq);
                 dasd_schedule_device_bh(device);
                 return;
         }
@@ -2326,21 +2337,11 @@ retry:
                         return -EAGAIN;
 
                 /* normal recovery for basedev IO */
-                if (__dasd_sleep_on_erp(cqr)) {
+                if (__dasd_sleep_on_erp(cqr))
+                        /* handle erp first */
                         goto retry;
-                        /* remember that ERP was needed */
-                        rc = 1;
-                        /* skip processing for active cqr */
-                        if (cqr->status != DASD_CQR_TERMINATED &&
-                            cqr->status != DASD_CQR_NEED_ERP)
-                                break;
-                }
         }
 
-        /* start ERP requests in upper loop */
-        if (rc)
-                goto retry;
-
         return 0;
 }
 
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index f224d59c4b6b..90f39f79f5d7 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -99,15 +99,37 @@ void dasd_gendisk_free(struct dasd_block *block)
 int dasd_scan_partitions(struct dasd_block *block)
 {
         struct block_device *bdev;
+        int retry, rc;
 
+        retry = 5;
         bdev = bdget_disk(block->gdp, 0);
-        if (!bdev || blkdev_get(bdev, FMODE_READ, NULL) < 0)
+        if (!bdev) {
+                DBF_DEV_EVENT(DBF_ERR, block->base, "%s",
+                              "scan partitions error, bdget returned NULL");
                 return -ENODEV;
+        }
+
+        rc = blkdev_get(bdev, FMODE_READ, NULL);
+        if (rc < 0) {
+                DBF_DEV_EVENT(DBF_ERR, block->base,
+                              "scan partitions error, blkdev_get returned %d",
+                              rc);
+                return -ENODEV;
+        }
         /*
          * See fs/partition/check.c:register_disk,rescan_partitions
          * Can't call rescan_partitions directly. Use ioctl.
          */
-        ioctl_by_bdev(bdev, BLKRRPART, 0);
+        rc = ioctl_by_bdev(bdev, BLKRRPART, 0);
+        while (rc == -EBUSY && retry > 0) {
+                schedule();
+                rc = ioctl_by_bdev(bdev, BLKRRPART, 0);
+                retry--;
+                DBF_DEV_EVENT(DBF_ERR, block->base,
+                              "scan partitions error, retry %d rc %d",
+                              retry, rc);
+        }
+
         /*
          * Since the matching blkdev_put call to the blkdev_get in
          * this function is not called before dasd_destroy_partitions
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 56046ab39629..75d9896deccb 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -10,6 +10,7 @@
 
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
+#include <linux/mempool.h>
 #include <linux/module.h>
 #include <linux/blkdev.h>
 #include <linux/genhd.h>
@@ -20,13 +21,18 @@
 
 debug_info_t *scm_debug;
 static int scm_major;
+static mempool_t *aidaw_pool;
 static DEFINE_SPINLOCK(list_lock);
 static LIST_HEAD(inactive_requests);
 static unsigned int nr_requests = 64;
+static unsigned int nr_requests_per_io = 8;
 static atomic_t nr_devices = ATOMIC_INIT(0);
 module_param(nr_requests, uint, S_IRUGO);
 MODULE_PARM_DESC(nr_requests, "Number of parallel requests.");
 
+module_param(nr_requests_per_io, uint, S_IRUGO);
+MODULE_PARM_DESC(nr_requests_per_io, "Number of requests per IO.");
+
 MODULE_DESCRIPTION("Block driver for s390 storage class memory.");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("scm:scmdev*");
@@ -36,8 +42,8 @@ static void __scm_free_rq(struct scm_request *scmrq)
         struct aob_rq_header *aobrq = to_aobrq(scmrq);
 
         free_page((unsigned long) scmrq->aob);
-        free_page((unsigned long) scmrq->aidaw);
         __scm_free_rq_cluster(scmrq);
+        kfree(scmrq->request);
         kfree(aobrq);
 }
 
@@ -53,6 +59,8 @@ static void scm_free_rqs(void)
                 __scm_free_rq(scmrq);
         }
         spin_unlock_irq(&list_lock);
+
+        mempool_destroy(aidaw_pool);
 }
 
 static int __scm_alloc_rq(void)
@@ -65,17 +73,17 @@ static int __scm_alloc_rq(void)
                 return -ENOMEM;
 
         scmrq = (void *) aobrq->data;
-        scmrq->aidaw = (void *) get_zeroed_page(GFP_DMA);
         scmrq->aob = (void *) get_zeroed_page(GFP_DMA);
-        if (!scmrq->aob || !scmrq->aidaw) {
-                __scm_free_rq(scmrq);
-                return -ENOMEM;
-        }
+        if (!scmrq->aob)
+                goto free;
 
-        if (__scm_alloc_rq_cluster(scmrq)) {
-                __scm_free_rq(scmrq);
-                return -ENOMEM;
-        }
+        scmrq->request = kcalloc(nr_requests_per_io, sizeof(scmrq->request[0]),
+                                 GFP_KERNEL);
+        if (!scmrq->request)
+                goto free;
+
+        if (__scm_alloc_rq_cluster(scmrq))
+                goto free;
 
         INIT_LIST_HEAD(&scmrq->list);
         spin_lock_irq(&list_lock);
@@ -83,12 +91,19 @@ static int __scm_alloc_rq(void)
         spin_unlock_irq(&list_lock);
 
         return 0;
+free:
+        __scm_free_rq(scmrq);
+        return -ENOMEM;
 }
 
 static int scm_alloc_rqs(unsigned int nrqs)
 {
         int ret = 0;
 
+        aidaw_pool = mempool_create_page_pool(max(nrqs/8, 1U), 0);
+        if (!aidaw_pool)
+                return -ENOMEM;
+
         while (nrqs-- && !ret)
                 ret = __scm_alloc_rq();
 
@@ -112,6 +127,18 @@ out:
 static void scm_request_done(struct scm_request *scmrq)
 {
         unsigned long flags;
+        struct msb *msb;
+        u64 aidaw;
+        int i;
+
+        for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
+                msb = &scmrq->aob->msb[i];
+                aidaw = msb->data_addr;
+
+                if ((msb->flags & MSB_FLAG_IDA) && aidaw &&
+                    IS_ALIGNED(aidaw, PAGE_SIZE))
+                        mempool_free(virt_to_page(aidaw), aidaw_pool);
+        }
 
         spin_lock_irqsave(&list_lock, flags);
         list_add(&scmrq->list, &inactive_requests);
@@ -123,48 +150,90 @@ static bool scm_permit_request(struct scm_blk_dev *bdev, struct request *req)
         return rq_data_dir(req) != WRITE || bdev->state != SCM_WR_PROHIBIT;
 }
 
-static void scm_request_prepare(struct scm_request *scmrq)
+static inline struct aidaw *scm_aidaw_alloc(void)
+{
+        struct page *page = mempool_alloc(aidaw_pool, GFP_ATOMIC);
+
+        return page ? page_address(page) : NULL;
+}
+
+static inline unsigned long scm_aidaw_bytes(struct aidaw *aidaw)
+{
+        unsigned long _aidaw = (unsigned long) aidaw;
+        unsigned long bytes = ALIGN(_aidaw, PAGE_SIZE) - _aidaw;
+
+        return (bytes / sizeof(*aidaw)) * PAGE_SIZE;
+}
+
+struct aidaw *scm_aidaw_fetch(struct scm_request *scmrq, unsigned int bytes)
+{
+        struct aidaw *aidaw;
+
+        if (scm_aidaw_bytes(scmrq->next_aidaw) >= bytes)
+                return scmrq->next_aidaw;
+
+        aidaw = scm_aidaw_alloc();
+        if (aidaw)
+                memset(aidaw, 0, PAGE_SIZE);
+        return aidaw;
+}
+
+static int scm_request_prepare(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
         struct scm_device *scmdev = bdev->gendisk->private_data;
-        struct aidaw *aidaw = scmrq->aidaw;
-        struct msb *msb = &scmrq->aob->msb[0];
+        int pos = scmrq->aob->request.msb_count;
+        struct msb *msb = &scmrq->aob->msb[pos];
+        struct request *req = scmrq->request[pos];
         struct req_iterator iter;
+        struct aidaw *aidaw;
         struct bio_vec bv;
 
+        aidaw = scm_aidaw_fetch(scmrq, blk_rq_bytes(req));
+        if (!aidaw)
+                return -ENOMEM;
+
         msb->bs = MSB_BS_4K;
-        scmrq->aob->request.msb_count = 1;
-        msb->scm_addr = scmdev->address +
-                ((u64) blk_rq_pos(scmrq->request) << 9);
-        msb->oc = (rq_data_dir(scmrq->request) == READ) ?
-                MSB_OC_READ : MSB_OC_WRITE;
+        scmrq->aob->request.msb_count++;
+        msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
+        msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE;
         msb->flags |= MSB_FLAG_IDA;
         msb->data_addr = (u64) aidaw;
 
-        rq_for_each_segment(bv, scmrq->request, iter) {
+        rq_for_each_segment(bv, req, iter) {
                 WARN_ON(bv.bv_offset);
                 msb->blk_count += bv.bv_len >> 12;
                 aidaw->data_addr = (u64) page_address(bv.bv_page);
                 aidaw++;
         }
+
+        scmrq->next_aidaw = aidaw;
+        return 0;
+}
+
+static inline void scm_request_set(struct scm_request *scmrq,
+                                   struct request *req)
+{
+        scmrq->request[scmrq->aob->request.msb_count] = req;
 }
 
 static inline void scm_request_init(struct scm_blk_dev *bdev,
-                                    struct scm_request *scmrq,
-                                    struct request *req)
+                                    struct scm_request *scmrq)
 {
         struct aob_rq_header *aobrq = to_aobrq(scmrq);
         struct aob *aob = scmrq->aob;
 
+        memset(scmrq->request, 0,
+               nr_requests_per_io * sizeof(scmrq->request[0]));
         memset(aob, 0, sizeof(*aob));
-        memset(scmrq->aidaw, 0, PAGE_SIZE);
         aobrq->scmdev = bdev->scmdev;
         aob->request.cmd_code = ARQB_CMD_MOVE;
         aob->request.data = (u64) aobrq;
-        scmrq->request = req;
         scmrq->bdev = bdev;
         scmrq->retries = 4;
         scmrq->error = 0;
+        /* We don't use all msbs - place aidaws at the end of the aob page. */
+        scmrq->next_aidaw = (void *) &aob->msb[nr_requests_per_io];
         scm_request_cluster_init(scmrq);
 }
 
@@ -180,9 +249,12 @@ static void scm_ensure_queue_restart(struct scm_blk_dev *bdev)
 void scm_request_requeue(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
+        int i;
 
         scm_release_cluster(scmrq);
-        blk_requeue_request(bdev->rq, scmrq->request);
+        for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++)
+                blk_requeue_request(bdev->rq, scmrq->request[i]);
+
         atomic_dec(&bdev->queued_reqs);
         scm_request_done(scmrq);
         scm_ensure_queue_restart(bdev);
@@ -191,20 +263,41 @@ void scm_request_requeue(struct scm_request *scmrq)
 void scm_request_finish(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
+        int i;
 
         scm_release_cluster(scmrq);
-        blk_end_request_all(scmrq->request, scmrq->error);
+        for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++)
+                blk_end_request_all(scmrq->request[i], scmrq->error);
+
         atomic_dec(&bdev->queued_reqs);
         scm_request_done(scmrq);
 }
 
+static int scm_request_start(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        int ret;
+
+        atomic_inc(&bdev->queued_reqs);
+        if (!scmrq->aob->request.msb_count) {
+                scm_request_requeue(scmrq);
+                return -EINVAL;
+        }
+
+        ret = eadm_start_aob(scmrq->aob);
+        if (ret) {
+                SCM_LOG(5, "no subchannel");
+                scm_request_requeue(scmrq);
+        }
+        return ret;
+}
+
 static void scm_blk_request(struct request_queue *rq)
 {
         struct scm_device *scmdev = rq->queuedata;
         struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
-        struct scm_request *scmrq;
+        struct scm_request *scmrq = NULL;
         struct request *req;
-        int ret;
 
         while ((req = blk_peek_request(rq))) {
                 if (req->cmd_type != REQ_TYPE_FS) {
@@ -214,39 +307,64 @@ static void scm_blk_request(struct request_queue *rq)
                         continue;
                 }
 
-                if (!scm_permit_request(bdev, req)) {
-                        scm_ensure_queue_restart(bdev);
-                        return;
-                }
-                scmrq = scm_request_fetch();
+                if (!scm_permit_request(bdev, req))
+                        goto out;
+
                 if (!scmrq) {
-                        SCM_LOG(5, "no request");
-                        scm_ensure_queue_restart(bdev);
-                        return;
+                        scmrq = scm_request_fetch();
+                        if (!scmrq) {
+                                SCM_LOG(5, "no request");
+                                goto out;
+                        }
+                        scm_request_init(bdev, scmrq);
                 }
-                scm_request_init(bdev, scmrq, req);
+                scm_request_set(scmrq, req);
+
                 if (!scm_reserve_cluster(scmrq)) {
                         SCM_LOG(5, "cluster busy");
+                        scm_request_set(scmrq, NULL);
+                        if (scmrq->aob->request.msb_count)
+                                goto out;
+
                         scm_request_done(scmrq);
                         return;
                 }
+
                 if (scm_need_cluster_request(scmrq)) {
-                        atomic_inc(&bdev->queued_reqs);
-                        blk_start_request(req);
-                        scm_initiate_cluster_request(scmrq);
-                        return;
+                        if (scmrq->aob->request.msb_count) {
+                                /* Start cluster requests separately. */
+                                scm_request_set(scmrq, NULL);
+                                if (scm_request_start(scmrq))
+                                        return;
+                        } else {
+                                atomic_inc(&bdev->queued_reqs);
+                                blk_start_request(req);
+                                scm_initiate_cluster_request(scmrq);
+                        }
+                        scmrq = NULL;
+                        continue;
+                }
+
+                if (scm_request_prepare(scmrq)) {
+                        SCM_LOG(5, "aidaw alloc failed");
+                        scm_request_set(scmrq, NULL);
+                        goto out;
                 }
-                scm_request_prepare(scmrq);
-                atomic_inc(&bdev->queued_reqs);
                 blk_start_request(req);
 
-                ret = eadm_start_aob(scmrq->aob);
-                if (ret) {
-                        SCM_LOG(5, "no subchannel");
-                        scm_request_requeue(scmrq);
+                if (scmrq->aob->request.msb_count < nr_requests_per_io)
+                        continue;
+
+                if (scm_request_start(scmrq))
                         return;
-                }
+
+                scmrq = NULL;
         }
+out:
+        if (scmrq)
+                scm_request_start(scmrq);
+        else
+                scm_ensure_queue_restart(bdev);
 }
 
 static void __scmrq_log_error(struct scm_request *scmrq)
@@ -443,11 +561,19 @@ void scm_blk_set_available(struct scm_blk_dev *bdev)
         spin_unlock_irqrestore(&bdev->lock, flags);
 }
 
+static bool __init scm_blk_params_valid(void)
+{
+        if (!nr_requests_per_io || nr_requests_per_io > 64)
+                return false;
+
+        return scm_cluster_size_valid();
+}
+
 static int __init scm_blk_init(void)
 {
         int ret = -EINVAL;
 
-        if (!scm_cluster_size_valid())
+        if (!scm_blk_params_valid())
                 goto out;
 
         ret = register_blkdev(0, "scm");
diff --git a/drivers/s390/block/scm_blk.h b/drivers/s390/block/scm_blk.h
index e59331e6c2e5..09218cdc5129 100644
--- a/drivers/s390/block/scm_blk.h
+++ b/drivers/s390/block/scm_blk.h
@@ -30,8 +30,8 @@ struct scm_blk_dev {
 
 struct scm_request {
         struct scm_blk_dev *bdev;
-        struct request *request;
-        struct aidaw *aidaw;
+        struct aidaw *next_aidaw;
+        struct request **request;
         struct aob *aob;
         struct list_head list;
         u8 retries;
@@ -55,6 +55,8 @@ void scm_blk_irq(struct scm_device *, void *, int);
 void scm_request_finish(struct scm_request *);
 void scm_request_requeue(struct scm_request *);
 
+struct aidaw *scm_aidaw_fetch(struct scm_request *scmrq, unsigned int bytes);
+
 int scm_drv_init(void);
 void scm_drv_cleanup(void);
 
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
index 9aae909d47a5..09db45296eed 100644
--- a/drivers/s390/block/scm_blk_cluster.c
+++ b/drivers/s390/block/scm_blk_cluster.c
@@ -57,39 +57,52 @@ void scm_request_cluster_init(struct scm_request *scmrq)
         scmrq->cluster.state = CLUSTER_NONE;
 }
 
-static bool clusters_intersect(struct scm_request *A, struct scm_request *B)
+static bool clusters_intersect(struct request *A, struct request *B)
 {
         unsigned long firstA, lastA, firstB, lastB;
 
-        firstA = ((u64) blk_rq_pos(A->request) << 9) / CLUSTER_SIZE;
-        lastA = (((u64) blk_rq_pos(A->request) << 9) +
-                    blk_rq_bytes(A->request) - 1) / CLUSTER_SIZE;
+        firstA = ((u64) blk_rq_pos(A) << 9) / CLUSTER_SIZE;
+        lastA = (((u64) blk_rq_pos(A) << 9) +
+                    blk_rq_bytes(A) - 1) / CLUSTER_SIZE;
 
-        firstB = ((u64) blk_rq_pos(B->request) << 9) / CLUSTER_SIZE;
-        lastB = (((u64) blk_rq_pos(B->request) << 9) +
-                    blk_rq_bytes(B->request) - 1) / CLUSTER_SIZE;
+        firstB = ((u64) blk_rq_pos(B) << 9) / CLUSTER_SIZE;
+        lastB = (((u64) blk_rq_pos(B) << 9) +
+                    blk_rq_bytes(B) - 1) / CLUSTER_SIZE;
 
         return (firstB <= lastA && firstA <= lastB);
 }
 
 bool scm_reserve_cluster(struct scm_request *scmrq)
 {
+        struct request *req = scmrq->request[scmrq->aob->request.msb_count];
         struct scm_blk_dev *bdev = scmrq->bdev;
         struct scm_request *iter;
+        int pos, add = 1;
 
         if (write_cluster_size == 0)
                 return true;
 
         spin_lock(&bdev->lock);
         list_for_each_entry(iter, &bdev->cluster_list, cluster.list) {
-                if (clusters_intersect(scmrq, iter) &&
-                    (rq_data_dir(scmrq->request) == WRITE ||
-                     rq_data_dir(iter->request) == WRITE)) {
-                        spin_unlock(&bdev->lock);
-                        return false;
+                if (iter == scmrq) {
+                        /*
+                         * We don't have to use clusters_intersect here, since
+                         * cluster requests are always started separately.
+                         */
+                        add = 0;
+                        continue;
+                }
+                for (pos = 0; pos <= iter->aob->request.msb_count; pos++) {
+                        if (clusters_intersect(req, iter->request[pos]) &&
+                            (rq_data_dir(req) == WRITE ||
+                             rq_data_dir(iter->request[pos]) == WRITE)) {
+                                spin_unlock(&bdev->lock);
+                                return false;
+                        }
                 }
         }
-        list_add(&scmrq->cluster.list, &bdev->cluster_list);
+        if (add)
+                list_add(&scmrq->cluster.list, &bdev->cluster_list);
         spin_unlock(&bdev->lock);
 
         return true;
@@ -114,14 +127,14 @@ void scm_blk_dev_cluster_setup(struct scm_blk_dev *bdev)
         blk_queue_io_opt(bdev->rq, CLUSTER_SIZE);
 }
 
-static void scm_prepare_cluster_request(struct scm_request *scmrq)
+static int scm_prepare_cluster_request(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
         struct scm_device *scmdev = bdev->gendisk->private_data;
-        struct request *req = scmrq->request;
-        struct aidaw *aidaw = scmrq->aidaw;
+        struct request *req = scmrq->request[0];
         struct msb *msb = &scmrq->aob->msb[0];
         struct req_iterator iter;
+        struct aidaw *aidaw;
         struct bio_vec bv;
         int i = 0;
         u64 addr;
@@ -131,11 +144,9 @@ static void scm_prepare_cluster_request(struct scm_request *scmrq)
                 scmrq->cluster.state = CLUSTER_READ;
                 /* fall through */
         case CLUSTER_READ:
-                scmrq->aob->request.msb_count = 1;
                 msb->bs = MSB_BS_4K;
                 msb->oc = MSB_OC_READ;
                 msb->flags = MSB_FLAG_IDA;
-                msb->data_addr = (u64) aidaw;
                 msb->blk_count = write_cluster_size;
 
                 addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
@@ -146,6 +157,12 @@ static void scm_prepare_cluster_request(struct scm_request *scmrq)
                                CLUSTER_SIZE))
                         msb->blk_count = 2 * write_cluster_size;
 
+                aidaw = scm_aidaw_fetch(scmrq, msb->blk_count * PAGE_SIZE);
+                if (!aidaw)
+                        return -ENOMEM;
+
+                scmrq->aob->request.msb_count = 1;
+                msb->data_addr = (u64) aidaw;
                 for (i = 0; i < msb->blk_count; i++) {
                         aidaw->data_addr = (u64) scmrq->cluster.buf[i];
                         aidaw++;
@@ -153,6 +170,7 @@ static void scm_prepare_cluster_request(struct scm_request *scmrq)
 
                 break;
         case CLUSTER_WRITE:
+                aidaw = (void *) msb->data_addr;
                 msb->oc = MSB_OC_WRITE;
 
                 for (addr = msb->scm_addr;
@@ -173,22 +191,29 @@ static void scm_prepare_cluster_request(struct scm_request *scmrq)
                 }
                 break;
         }
+        return 0;
 }
 
 bool scm_need_cluster_request(struct scm_request *scmrq)
 {
-        if (rq_data_dir(scmrq->request) == READ)
+        int pos = scmrq->aob->request.msb_count;
+
+        if (rq_data_dir(scmrq->request[pos]) == READ)
                 return false;
 
-        return blk_rq_bytes(scmrq->request) < CLUSTER_SIZE;
+        return blk_rq_bytes(scmrq->request[pos]) < CLUSTER_SIZE;
 }
 
 /* Called with queue lock held. */
 void scm_initiate_cluster_request(struct scm_request *scmrq)
 {
-        scm_prepare_cluster_request(scmrq);
+        if (scm_prepare_cluster_request(scmrq))
+                goto requeue;
         if (eadm_start_aob(scmrq->aob))
-                scm_request_requeue(scmrq);
+                goto requeue;
+        return;
+requeue:
+        scm_request_requeue(scmrq);
 }
 
 bool scm_test_cluster_request(struct scm_request *scmrq)
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index db2cb1f8a1b5..a5c6f7e157aa 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -102,6 +102,16 @@ config SCLP_ASYNC
           want for inform other people about your kernel panics,
           need this feature and intend to run your kernel in LPAR.
 
+config SCLP_ASYNC_ID
+       string "Component ID for Call Home"
+       depends on SCLP_ASYNC
+       default "000000000"
+       help
+         The Component ID for Call Home is used to identify the correct
+         problem reporting queue the call home records should be sent to.
+
+         If your are unsure, please use the default value "000000000".
+
 config HMC_DRV
         def_tristate m
         prompt "Support for file transfers from HMC drive CD/DVD-ROM"
diff --git a/drivers/s390/char/sclp_async.c b/drivers/s390/char/sclp_async.c
index 5f9f929e891c..19c25427f27f 100644
--- a/drivers/s390/char/sclp_async.c
+++ b/drivers/s390/char/sclp_async.c
@@ -137,7 +137,8 @@ static int sclp_async_send_wait(char *message)
          * Retain Queue
          * e.g. 5639CC140 500 Red Hat RHEL5 Linux for zSeries (RHEL AS)
          */
-        strncpy(sccb->evbuf.comp_id, "000000000", sizeof(sccb->evbuf.comp_id));
+        strncpy(sccb->evbuf.comp_id, CONFIG_SCLP_ASYNC_ID,
+                sizeof(sccb->evbuf.comp_id));
         sccb->evbuf.header.length = sizeof(sccb->evbuf);
         sccb->header.length = sizeof(sccb->evbuf) + sizeof(sccb->header);
         sccb->header.function_code = SCLP_NORMAL_WRITE;
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index 327cb19ad0b0..d3d1936057b4 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -1090,7 +1090,7 @@ tape_3590_print_io_sim_msg_f1(struct tape_device *device, struct irb *irb)
                                 "channel path 0x%x on CU",
                                 sense->fmt.f71.md[1]);
                 else
-                        snprintf(service, BUFSIZE, "Repair will disable cannel"
+                        snprintf(service, BUFSIZE, "Repair will disable channel"
                                 " paths (0x%x-0x%x) on CU",
                                 sense->fmt.f71.md[1], sense->fmt.f71.md[2]);
                 break;
@@ -1481,7 +1481,7 @@ tape_3590_irq(struct tape_device *device, struct tape_request *request,
         }
 
         if (irb->scsw.cmd.dstat & DEV_STAT_CHN_END) {
-                DBF_EVENT(2, "cannel end\n");
+                DBF_EVENT(2, "channel end\n");
                 return TAPE_IO_PENDING;
         }
 
diff --git a/drivers/s390/cio/eadm_sch.c b/drivers/s390/cio/eadm_sch.c
index 37f0834300ea..bee8c11cd086 100644
--- a/drivers/s390/cio/eadm_sch.c
+++ b/drivers/s390/cio/eadm_sch.c
@@ -31,7 +31,7 @@
 MODULE_DESCRIPTION("driver for s390 eadm subchannels");
 MODULE_LICENSE("GPL");
 
-#define EADM_TIMEOUT (5 * HZ)
+#define EADM_TIMEOUT (7 * HZ)
 static DEFINE_SPINLOCK(list_lock);
 static LIST_HEAD(eadm_list);
 
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index 5ff1ce7ba1f4..cdd4ab683be9 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -373,10 +373,10 @@ static int asd_build_ata_ascb(struct asd_ascb *ascb, struct sas_task *task,
 
         if (unlikely(task->ata_task.device_control_reg_update))
                 scb->header.opcode = CONTROL_ATA_DEV;
-        else if (dev->sata_dev.command_set == ATA_COMMAND_SET)
-                scb->header.opcode = INITIATE_ATA_TASK;
-        else
+        else if (dev->sata_dev.class == ATA_DEV_ATAPI)
                 scb->header.opcode = INITIATE_ATAPI_TASK;
+        else
+                scb->header.opcode = INITIATE_ATA_TASK;
 
         scb->ata_task.proto_conn_rate = (1 << 5); /* STP */
         if (dev->port->oob_mode == SAS_OOB_MODE)
@@ -387,7 +387,7 @@ static int asd_build_ata_ascb(struct asd_ascb *ascb, struct sas_task *task,
         if (likely(!task->ata_task.device_control_reg_update))
                 scb->ata_task.fis.flags |= 0x80; /* C=1: update ATA cmd reg */
         scb->ata_task.fis.flags &= 0xF0; /* PM_PORT field shall be 0 */
-        if (dev->sata_dev.command_set == ATAPI_COMMAND_SET)
+        if (dev->sata_dev.class == ATA_DEV_ATAPI)
                 memcpy(scb->ata_task.atapi_packet, task->ata_task.atapi_packet,
                        16);
         scb->ata_task.sister_scb = cpu_to_le16(0xFFFF);
@@ -399,7 +399,7 @@ static int asd_build_ata_ascb(struct asd_ascb *ascb, struct sas_task *task,
                 if (task->ata_task.dma_xfer)
                         flags |= DATA_XFER_MODE_DMA;
                 if (task->ata_task.use_ncq &&
-                    dev->sata_dev.command_set != ATAPI_COMMAND_SET)
+                    dev->sata_dev.class != ATA_DEV_ATAPI)
                         flags |= ATA_Q_TYPE_NCQ;
                 flags |= data_dir_flags[task->data_dir];
                 scb->ata_task.ata_flags = flags;
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 56e38096f0c4..cfd0084f1cd2 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -694,7 +694,7 @@ sci_io_request_construct_sata(struct isci_request *ireq,
         }
 
         /* ATAPI */
-        if (dev->sata_dev.command_set == ATAPI_COMMAND_SET &&
+        if (dev->sata_dev.class == ATA_DEV_ATAPI &&
             task->ata_task.fis.command == ATA_CMD_PACKET) {
                 sci_atapi_construct(ireq);
                 return SCI_SUCCESS;
@@ -2980,7 +2980,7 @@ static void sci_request_started_state_enter(struct sci_base_state_machine *sm)
                 state = SCI_REQ_SMP_WAIT_RESP;
         } else if (task && sas_protocol_ata(task->task_proto) &&
                    !task->ata_task.use_ncq) {
-                if (dev->sata_dev.command_set == ATAPI_COMMAND_SET &&
+                if (dev->sata_dev.class == ATA_DEV_ATAPI &&
                         task->ata_task.fis.command == ATA_CMD_PACKET) {
                         state = SCI_REQ_ATAPI_WAIT_H2D;
                 } else if (task->data_dir == DMA_NONE) {
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 3f63c6318b0d..6dcaed0c1fc8 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -588,7 +588,7 @@ int isci_task_abort_task(struct sas_task *task)
 
                 ret = TMF_RESP_FUNC_COMPLETE;
         } else {
-                /* Fill in the tmf stucture */
+                /* Fill in the tmf structure */
                 isci_task_build_abort_task_tmf(&tmf, isci_tmf_ssp_task_abort,
                                                old_request);
 
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 577770fdee86..932d9cc98d2f 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -138,7 +138,7 @@ static void sas_ata_task_done(struct sas_task *task)
 
         if (stat->stat == SAS_PROTO_RESPONSE || stat->stat == SAM_STAT_GOOD ||
             ((stat->stat == SAM_STAT_CHECK_CONDITION &&
-              dev->sata_dev.command_set == ATAPI_COMMAND_SET))) {
+              dev->sata_dev.class == ATA_DEV_ATAPI))) {
                 memcpy(dev->sata_dev.fis, resp->ending_fis, ATA_RESP_FIS_SIZE);
 
                 if (!link->sactive) {
@@ -272,7 +272,7 @@ static struct sas_internal *dev_to_sas_internal(struct domain_device *dev)
         return to_sas_internal(dev->port->ha->core.shost->transportt);
 }
 
-static void sas_get_ata_command_set(struct domain_device *dev);
+static int sas_get_ata_command_set(struct domain_device *dev);
 
 int sas_get_ata_info(struct domain_device *dev, struct ex_phy *phy)
 {
@@ -297,8 +297,7 @@ int sas_get_ata_info(struct domain_device *dev, struct ex_phy *phy)
                 }
                 memcpy(dev->frame_rcvd, &dev->sata_dev.rps_resp.rps.fis,
                        sizeof(struct dev_to_host_fis));
-                /* TODO switch to ata_dev_classify() */
-                sas_get_ata_command_set(dev);
+                dev->sata_dev.class = sas_get_ata_command_set(dev);
         }
         return 0;
 }
@@ -419,18 +418,7 @@ static int sas_ata_hard_reset(struct ata_link *link, unsigned int *class,
         if (ret && ret != -EAGAIN)
                 sas_ata_printk(KERN_ERR, dev, "reset failed (errno=%d)\n", ret);
 
-        /* XXX: if the class changes during the reset the upper layer
-         * should be informed, if the device has gone away we assume
-         * libsas will eventually delete it
-         */
-        switch (dev->sata_dev.command_set) {
-        case ATA_COMMAND_SET:
-                *class = ATA_DEV_ATA;
-                break;
-        case ATAPI_COMMAND_SET:
-                *class = ATA_DEV_ATAPI;
-                break;
-        }
+        *class = dev->sata_dev.class;
 
         ap->cbl = ATA_CBL_SATA;
         return ret;
@@ -619,50 +607,18 @@ void sas_ata_task_abort(struct sas_task *task)
         complete(waiting);
 }
 
-static void sas_get_ata_command_set(struct domain_device *dev)
+static int sas_get_ata_command_set(struct domain_device *dev)
 {
         struct dev_to_host_fis *fis =
                 (struct dev_to_host_fis *) dev->frame_rcvd;
+        struct ata_taskfile tf;
 
         if (dev->dev_type == SAS_SATA_PENDING)
-                return;
+                return ATA_DEV_UNKNOWN;
+
+        ata_tf_from_fis((const u8 *)fis, &tf);
 
-        if ((fis->sector_count == 1 && /* ATA */
-             fis->lbal         == 1 &&
-             fis->lbam         == 0 &&
-             fis->lbah         == 0 &&
-             fis->device       == 0)
-            ||
-            (fis->sector_count == 0 && /* CE-ATA (mATA) */
-             fis->lbal         == 0 &&
-             fis->lbam         == 0xCE &&
-             fis->lbah         == 0xAA &&
-             (fis->device & ~0x10) == 0))
-
-                dev->sata_dev.command_set = ATA_COMMAND_SET;
-
-        else if ((fis->interrupt_reason == 1 && /* ATAPI */
-                  fis->lbal             == 1 &&
-                  fis->byte_count_low   == 0x14 &&
-                  fis->byte_count_high  == 0xEB &&
-                  (fis->device & ~0x10) == 0))
-
-                dev->sata_dev.command_set = ATAPI_COMMAND_SET;
-
-        else if ((fis->sector_count == 1 && /* SEMB */
-                  fis->lbal         == 1 &&
-                  fis->lbam         == 0x3C &&
-                  fis->lbah         == 0xC3 &&
-                  fis->device       == 0)
-                ||
-                 (fis->interrupt_reason == 1 && /* SATA PM */
-                  fis->lbal             == 1 &&
-                  fis->byte_count_low   == 0x69 &&
-                  fis->byte_count_high  == 0x96 &&
-                  (fis->device & ~0x10) == 0))
-
-                /* Treat it as a superset? */
-                dev->sata_dev.command_set = ATAPI_COMMAND_SET;
+        return ata_dev_classify(&tf);
 }
 
 void sas_probe_sata(struct asd_sas_port *port)
@@ -768,7 +724,7 @@ int sas_discover_sata(struct domain_device *dev)
         if (dev->dev_type == SAS_SATA_PM)
                 return -ENODEV;
 
-        sas_get_ata_command_set(dev);
+        dev->sata_dev.class = sas_get_ata_command_set(dev);
         sas_fill_in_rphy(dev, dev->rphy);
 
         res = sas_notify_lldd_dev_found(dev);
diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
index 953fd9b953c7..1e85c07e3b62 100644
--- a/drivers/scsi/mac_scsi.c
+++ b/drivers/scsi/mac_scsi.c
@@ -166,7 +166,7 @@ static void mac_scsi_reset_boot(struct Scsi_Host *instance)
    XXX: Since bus errors in the PDMA routines never happen on my 
    computer, the bus error code is untested. 
    If the code works as intended, a bus error results in Pseudo-DMA 
-   beeing disabled, meaning that the driver switches to slow handshake. 
+   being disabled, meaning that the driver switches to slow handshake.
    If bus errors are NOT extremely rare, this has to be changed. 
 */
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index f05580e693d0..ff283d23788a 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6783,7 +6783,7 @@ static int __init megasas_init(void)
         rval = pci_register_driver(&megasas_pci_driver);
 
         if (rval) {
-                printk(KERN_DEBUG "megasas: PCI hotplug regisration failed \n");
+                printk(KERN_DEBUG "megasas: PCI hotplug registration failed \n");
                 goto err_pcidrv;
         }
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.h b/drivers/scsi/mpt2sas/mpt2sas_ctl.h
index fa0567c96050..7f842c88abd2 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.h
@@ -224,7 +224,7 @@ struct mpt2_ioctl_eventreport {
 };
 
 /**
- * struct mpt2_ioctl_command - generic mpt firmware passthru ioclt
+ * struct mpt2_ioctl_command - generic mpt firmware passthru ioctl
  * @hdr - generic header
  * @timeout - command timeout in seconds. (if zero then use driver default
  *  value).
diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
index 85d86a5cdb60..2d5ab6d969ec 100644
--- a/drivers/scsi/mvsas/mv_sas.c
+++ b/drivers/scsi/mvsas/mv_sas.c
@@ -479,7 +479,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi,
 
         if (task->ata_task.use_ncq)
                 flags |= MCH_FPDMA;
-        if (dev->sata_dev.command_set == ATAPI_COMMAND_SET) {
+        if (dev->sata_dev.class == ATA_DEV_ATAPI) {
                 if (task->ata_task.fis.command != ATA_CMD_ID_ATAPI)
                         flags |= MCH_ATAPI;
         }
@@ -546,7 +546,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi,
                 task->ata_task.fis.flags |= 0x80; /* C=1: update ATA cmd reg */
         /* fill in command FIS and ATAPI CDB */
         memcpy(buf_cmd, &task->ata_task.fis, sizeof(struct host_to_dev_fis));
-        if (dev->sata_dev.command_set == ATAPI_COMMAND_SET)
+        if (dev->sata_dev.class == ATA_DEV_ATAPI)
                 memcpy(buf_cmd + STP_ATAPI_CMD,
                         task->ata_task.atapi_packet, 16);
 
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 933f21471951..96dcc097a463 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -4367,7 +4367,7 @@ static int pm8001_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
                         PM8001_IO_DBG(pm8001_ha, pm8001_printk("PIO\n"));
                 }
                 if (task->ata_task.use_ncq &&
-                        dev->sata_dev.command_set != ATAPI_COMMAND_SET) {
+                        dev->sata_dev.class != ATA_DEV_ATAPI) {
                         ATAP = 0x07; /* FPDMA */
                         PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA\n"));
                 }
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index b06443a0db2d..05cce463ab01 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -4077,7 +4077,7 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
                         PM8001_IO_DBG(pm8001_ha, pm8001_printk("PIO\n"));
                 }
                 if (task->ata_task.use_ncq &&
-                        dev->sata_dev.command_set != ATAPI_COMMAND_SET) {
+                    dev->sata_dev.class != ATA_DEV_ATAPI) {
                         ATAP = 0x07; /* FPDMA */
                         PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA\n"));
                 }
diff --git a/drivers/scsi/ps3rom.c b/drivers/scsi/ps3rom.c
index b3b48b5a984c..5298def33733 100644
--- a/drivers/scsi/ps3rom.c
+++ b/drivers/scsi/ps3rom.c
@@ -383,6 +383,7 @@ static int ps3rom_probe(struct ps3_system_bus_device *_dev)
         if (!host) {
                 dev_err(&dev->sbd.core, "%s:%u: scsi_host_alloc failed\n",
                         __func__, __LINE__);
+                error = -ENOMEM;
                 goto fail_teardown;
         }
 
diff --git a/drivers/ssb/driver_mipscore.c b/drivers/ssb/driver_mipscore.c
index 09077067b0c8..7b986f9f213f 100644
--- a/drivers/ssb/driver_mipscore.c
+++ b/drivers/ssb/driver_mipscore.c
@@ -15,6 +15,9 @@
 #include <linux/serial_core.h>
 #include <linux/serial_reg.h>
 #include <linux/time.h>
+#ifdef CONFIG_BCM47XX
+#include <bcm47xx_nvram.h>
+#endif
 
 #include "ssb_private.h"
 
@@ -210,6 +213,7 @@ static void ssb_mips_serial_init(struct ssb_mipscore *mcore)
 static void ssb_mips_flash_detect(struct ssb_mipscore *mcore)
 {
         struct ssb_bus *bus = mcore->dev->bus;
+        struct ssb_sflash *sflash = &mcore->sflash;
         struct ssb_pflash *pflash = &mcore->pflash;
 
         /* When there is no chipcommon on the bus there is 4MB flash */
@@ -242,7 +246,15 @@ static void ssb_mips_flash_detect(struct ssb_mipscore *mcore)
         }
 
 ssb_pflash:
-        if (pflash->present) {
+        if (sflash->present) {
+#ifdef CONFIG_BCM47XX
+                bcm47xx_nvram_init_from_mem(sflash->window, sflash->size);
+#endif
+        } else if (pflash->present) {
+#ifdef CONFIG_BCM47XX
+                bcm47xx_nvram_init_from_mem(pflash->window, pflash->window_size);
+#endif
+
                 ssb_pflash_data.width = pflash->buswidth;
                 ssb_pflash_resource.start = pflash->window;
                 ssb_pflash_resource.end = pflash->window + pflash->window_size;
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index e9186cdf35e9..33ac39bf75e5 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -335,7 +335,7 @@ static int target_xcopy_parse_segment_descriptors(struct se_cmd *se_cmd,
                         desc += XCOPY_SEGMENT_DESC_LEN;
                         break;
                 default:
-                        pr_err("XCOPY unspported segment descriptor"
+                        pr_err("XCOPY unsupported segment descriptor"
                                 "type: 0x%02x\n", desc[0]);
                         goto out;
                 }
diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
index 946562389ca8..3be9519654e5 100644
--- a/drivers/tc/tc.c
+++ b/drivers/tc/tc.c
@@ -83,8 +83,7 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
                 /* Found a board, allocate it an entry in the list */
                 tdev = kzalloc(sizeof(*tdev), GFP_KERNEL);
                 if (!tdev) {
-                        printk(KERN_ERR "tc%x: unable to allocate tc_dev\n",
-                               slot);
+                        pr_err("tc%x: unable to allocate tc_dev\n", slot);
                         goto out_err;
                 }
                 dev_set_name(&tdev->dev, "tc%x", slot);
@@ -117,10 +116,10 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
                         tdev->resource.start = extslotaddr;
                         tdev->resource.end = extslotaddr + devsize - 1;
                 } else {
-                        printk(KERN_ERR "%s: Cannot provide slot space "
-                               "(%dMiB required, up to %dMiB supported)\n",
-                               dev_name(&tdev->dev), devsize >> 20,
-                               max(slotsize, extslotsize) >> 20);
+                        pr_err("%s: Cannot provide slot space "
+                               "(%ldMiB required, up to %ldMiB supported)\n",
+                               dev_name(&tdev->dev), (long)(devsize >> 20),
+                               (long)(max(slotsize, extslotsize) >> 20));
                         kfree(tdev);
                         goto out_err;
                 }
@@ -147,14 +146,12 @@ static int __init tc_init(void)
 {
         /* Initialize the TURBOchannel bus */
         if (tc_bus_get_info(&tc_bus))
-                return 0;
+                goto out_err;
 
         INIT_LIST_HEAD(&tc_bus.devices);
         dev_set_name(&tc_bus.dev, "tc");
-        if (device_register(&tc_bus.dev)) {
-                put_device(&tc_bus.dev);
-                return 0;
-        }
+        if (device_register(&tc_bus.dev))
+                goto out_err_device;
 
         if (tc_bus.info.slot_size) {
                 unsigned int tc_clock = tc_get_speed(&tc_bus) / 100000;
@@ -172,8 +169,8 @@ static int __init tc_init(void)
                 tc_bus.resource[0].flags = IORESOURCE_MEM;
                 if (request_resource(&iomem_resource,
                                      &tc_bus.resource[0]) < 0) {
-                        printk(KERN_ERR "tc: Cannot reserve resource\n");
-                        return 0;
+                        pr_err("tc: Cannot reserve resource\n");
+                        goto out_err_device;
                 }
                 if (tc_bus.ext_slot_size) {
                         tc_bus.resource[1].start = tc_bus.ext_slot_base;
@@ -184,10 +181,8 @@ static int __init tc_init(void)
                         tc_bus.resource[1].flags = IORESOURCE_MEM;
                         if (request_resource(&iomem_resource,
                                              &tc_bus.resource[1]) < 0) {
-                                printk(KERN_ERR
-                                       "tc: Cannot reserve resource\n");
-                                release_resource(&tc_bus.resource[0]);
-                                return 0;
+                                pr_err("tc: Cannot reserve resource\n");
+                                goto out_err_resource;
                         }
                 }
 
@@ -195,6 +190,13 @@ static int __init tc_init(void)
         }
 
         return 0;
+
+out_err_resource:
+        release_resource(&tc_bus.resource[0]);
+out_err_device:
+        put_device(&tc_bus.dev);
+out_err:
+        return 0;
 }
 
 subsys_initcall(tc_init);
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 98f8bcaf3e7e..a26653fe788c 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -701,7 +701,7 @@ config PDC_CONSOLE
           Saying Y here will enable the software based PDC console to be 
           used as the system console.  This is useful for machines in 
           which the hardware based console has not been written yet.  The
-          following steps must be competed to use the PDC console:
+          following steps must be completed to use the PDC console:
 
             1. create the device entry (mknod /dev/ttyB0 c 11 0)
             2. Edit the /etc/inittab to start a getty listening on /dev/ttyB0
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 96fafed92b76..0ffb4ed0a945 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -103,6 +103,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04f3, 0x009b), .driver_info =
                         USB_QUIRK_DEVICE_QUALIFIER },
 
+        { USB_DEVICE(0x04f3, 0x010c), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
         { USB_DEVICE(0x04f3, 0x016f), .driver_info =
                         USB_QUIRK_DEVICE_QUALIFIER },
 
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 59ab62c92b66..ea2b9c374305 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -396,7 +396,7 @@ static int hidg_setup(struct usb_function *f,
 
         case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
                   | HID_REQ_SET_REPORT):
-                VDBG(cdev, "set_report | wLenght=%d\n", ctrl->wLength);
+                VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength);
                 goto stall;
                 break;
 
diff --git a/drivers/usb/gadget/legacy/zero.c b/drivers/usb/gadget/legacy/zero.c
index ebf09f439f3a..ff97ac93ac03 100644
--- a/drivers/usb/gadget/legacy/zero.c
+++ b/drivers/usb/gadget/legacy/zero.c
@@ -28,7 +28,7 @@
  *
  * Why is *this* driver using two configurations, rather than setting up
  * two interfaces with different functions?  To help verify that multiple
- * configuration infrastucture is working correctly; also, so that it can
+ * configuration infrastructure is working correctly; also, so that it can
  * work with low capability USB controllers without four bulk endpoints.
  */
 
diff --git a/drivers/usb/host/ehci-sysfs.c b/drivers/usb/host/ehci-sysfs.c
index f6459dfb6f54..5e44407aa099 100644
--- a/drivers/usb/host/ehci-sysfs.c
+++ b/drivers/usb/host/ehci-sysfs.c
@@ -132,7 +132,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
 
                 if (allocated_max > uframe_periodic_max) {
                         ehci_info(ehci,
-                                "cannot decrease uframe_periodic_max becase "
+                                "cannot decrease uframe_periodic_max because "
                                 "periodic bandwidth is already allocated "
                                 "(%u > %u)\n",
                                 allocated_max, uframe_periodic_max);
diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 3de1278677d0..ecf02b2623e8 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -4958,7 +4958,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
 
                 if (allocated_max > uframe_periodic_max) {
                         fotg210_info(fotg210,
-                                "cannot decrease uframe_periodic_max becase "
+                                "cannot decrease uframe_periodic_max because "
                                 "periodic bandwidth is already allocated "
                                 "(%u > %u)\n",
                                 allocated_max, uframe_periodic_max);
diff --git a/drivers/usb/host/fusbh200-hcd.c b/drivers/usb/host/fusbh200-hcd.c
index abe42f31559f..664d2aa1239c 100644
--- a/drivers/usb/host/fusbh200-hcd.c
+++ b/drivers/usb/host/fusbh200-hcd.c
@@ -4893,7 +4893,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
 
                 if (allocated_max > uframe_periodic_max) {
                         fusbh200_info(fusbh200,
-                                "cannot decrease uframe_periodic_max becase "
+                                "cannot decrease uframe_periodic_max because "
                                 "periodic bandwidth is already allocated "
                                 "(%u > %u)\n",
                                 allocated_max, uframe_periodic_max);
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 7064eb8d6142..8bfc47c29828 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -64,7 +64,7 @@ DEVICE(vivopay, VIVOPAY_IDS);
 /* Motorola USB Phone driver */
 #define MOTO_IDS()                      \
         { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */    \
-        { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Mororola phone */    \
+        { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Motorola phone */    \
         { USB_DEVICE(0x22b8, 0x2a64) }, /* Motorola KRZR K1m */         \
         { USB_DEVICE(0x22b8, 0x2c84) }, /* Motorola VE240 phone */      \
         { USB_DEVICE(0x22b8, 0x2c64) }  /* Motorola V950 phone */
diff --git a/drivers/video/fbdev/exynos/exynos_mipi_dsi.c b/drivers/video/fbdev/exynos/exynos_mipi_dsi.c
index cee9602f9a7b..716bfad6a1c0 100644
--- a/drivers/video/fbdev/exynos/exynos_mipi_dsi.c
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi.c
@@ -570,5 +570,5 @@ static struct platform_driver exynos_mipi_dsi_driver = {
 module_platform_driver(exynos_mipi_dsi_driver);
 
 MODULE_AUTHOR("InKi Dae <inki.dae@samsung.com>");
-MODULE_DESCRIPTION("Samusung SoC MIPI-DSI driver");
+MODULE_DESCRIPTION("Samsung SoC MIPI-DSI driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.c b/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.c
index 85edabfdef5a..2358a2fbbbcd 100644
--- a/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.c
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.c
@@ -876,5 +876,5 @@ int exynos_mipi_dsi_fifo_clear(struct mipi_dsim_device *dsim,
 }
 
 MODULE_AUTHOR("InKi Dae <inki.dae@samsung.com>");
-MODULE_DESCRIPTION("Samusung SoC MIPI-DSI common driver");
+MODULE_DESCRIPTION("Samsung SoC MIPI-DSI common driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbdev/sa1100fb.c b/drivers/video/fbdev/sa1100fb.c
index 9690216d38ff..c0abe276ee55 100644
--- a/drivers/video/fbdev/sa1100fb.c
+++ b/drivers/video/fbdev/sa1100fb.c
@@ -178,6 +178,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mutex.h>
 #include <linux/io.h>
+#include <linux/clk.h>
 
 #include <video/sa1100fb.h>
 
@@ -416,9 +417,9 @@ sa1100fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
                 var->transp.offset);
 
 #ifdef CONFIG_CPU_FREQ
-        dev_dbg(fbi->dev, "dma period = %d ps, clock = %d kHz\n",
+        dev_dbg(fbi->dev, "dma period = %d ps, clock = %ld kHz\n",
                 sa1100fb_display_dma_period(var),
-                cpufreq_get(smp_processor_id()));
+                clk_get_rate(fbi->clk) / 1000);
 #endif
 
         return 0;
@@ -592,9 +593,10 @@ static struct fb_ops sa1100fb_ops = {
  * Calculate the PCD value from the clock rate (in picoseconds).
  * We take account of the PPCR clock setting.
  */
-static inline unsigned int get_pcd(unsigned int pixclock, unsigned int cpuclock)
+static inline unsigned int get_pcd(struct sa1100fb_info *fbi,
+                unsigned int pixclock)
 {
-        unsigned int pcd = cpuclock / 100;
+        unsigned int pcd = clk_get_rate(fbi->clk) / 100 / 1000;
 
         pcd *= pixclock;
         pcd /= 10000000;
@@ -673,7 +675,7 @@ static int sa1100fb_activate_var(struct fb_var_screeninfo *var, struct sa1100fb_
                 LCCR2_BegFrmDel(var->upper_margin) +
                 LCCR2_EndFrmDel(var->lower_margin);
 
-        pcd = get_pcd(var->pixclock, cpufreq_get(0));
+        pcd = get_pcd(fbi, var->pixclock);
         new_regs.lccr3 = LCCR3_PixClkDiv(pcd) | fbi->inf->lccr3 |
                 (var->sync & FB_SYNC_HOR_HIGH_ACT ? LCCR3_HorSnchH : LCCR3_HorSnchL) |
                 (var->sync & FB_SYNC_VERT_HIGH_ACT ? LCCR3_VrtSnchH : LCCR3_VrtSnchL);
@@ -787,6 +789,9 @@ static void sa1100fb_enable_controller(struct sa1100fb_info *fbi)
         fbi->palette_cpu[0] &= 0xcfff;
         fbi->palette_cpu[0] |= palette_pbs(&fbi->fb.var);
 
+        /* enable LCD controller clock */
+        clk_prepare_enable(fbi->clk);
+
         /* Sequence from 11.7.10 */
         writel_relaxed(fbi->reg_lccr3, fbi->base + LCCR3);
         writel_relaxed(fbi->reg_lccr2, fbi->base + LCCR2);
@@ -831,6 +836,9 @@ static void sa1100fb_disable_controller(struct sa1100fb_info *fbi)
 
         schedule_timeout(20 * HZ / 1000);
         remove_wait_queue(&fbi->ctrlr_wait, &wait);
+
+        /* disable LCD controller clock */
+        clk_disable_unprepare(fbi->clk);
 }
 
 /*
@@ -1009,7 +1017,6 @@ sa1100fb_freq_transition(struct notifier_block *nb, unsigned long val,
                          void *data)
 {
         struct sa1100fb_info *fbi = TO_INF(nb, freq_transition);
-        struct cpufreq_freqs *f = data;
         u_int pcd;
 
         switch (val) {
@@ -1018,7 +1025,7 @@ sa1100fb_freq_transition(struct notifier_block *nb, unsigned long val,
                 break;
 
         case CPUFREQ_POSTCHANGE:
-                pcd = get_pcd(fbi->fb.var.pixclock, f->new);
+                pcd = get_pcd(fbi, fbi->fb.var.pixclock);
                 fbi->reg_lccr3 = (fbi->reg_lccr3 & ~0xff) | LCCR3_PixClkDiv(pcd);
                 set_ctrlr_state(fbi, C_ENABLE_CLKCHANGE);
                 break;
@@ -1225,6 +1232,13 @@ static int sa1100fb_probe(struct platform_device *pdev)
         if (!fbi)
                 goto failed;
 
+        fbi->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(fbi->clk)) {
+                ret = PTR_ERR(fbi->clk);
+                fbi->clk = NULL;
+                goto failed;
+        }
+
         fbi->base = ioremap(res->start, resource_size(res));
         if (!fbi->base)
                 goto failed;
@@ -1277,6 +1291,8 @@ static int sa1100fb_probe(struct platform_device *pdev)
  failed:
         if (fbi)
                 iounmap(fbi->base);
+        if (fbi->clk)
+                clk_put(fbi->clk);
         kfree(fbi);
         release_mem_region(res->start, resource_size(res));
         return ret;
diff --git a/drivers/video/fbdev/sa1100fb.h b/drivers/video/fbdev/sa1100fb.h
index fc5d4292fad6..0139d13377a5 100644
--- a/drivers/video/fbdev/sa1100fb.h
+++ b/drivers/video/fbdev/sa1100fb.h
@@ -68,6 +68,7 @@ struct sa1100fb_info {
 #endif
 
         const struct sa1100fb_mach_info *inf;
+        struct clk *clk;
 };
 
 #define TO_INF(ptr,member)      container_of(ptr,struct sa1100fb_info,member)
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index ebd8f218a788..810ad419e34c 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -96,8 +96,6 @@ static inline phys_addr_t xen_bus_to_phys(dma_addr_t baddr)
         dma_addr_t dma = (dma_addr_t)pfn << PAGE_SHIFT;
         phys_addr_t paddr = dma;
 
-        BUG_ON(paddr != dma); /* truncation has occurred, should never happen */
-
         paddr |= baddr & ~PAGE_MASK;
 
         return paddr;
@@ -399,11 +397,13 @@ dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page,
          * buffering it.
          */
         if (dma_capable(dev, dev_addr, size) &&
-            !range_straddles_page_boundary(phys, size) && !swiotlb_force) {
+            !range_straddles_page_boundary(phys, size) &&
+                !xen_arch_need_swiotlb(dev, PFN_DOWN(phys), PFN_DOWN(dev_addr)) &&
+                !swiotlb_force) {
                 /* we are not interested in the dma_addr returned by
                  * xen_dma_map_page, only in the potential cache flushes executed
                  * by the function. */
-                xen_dma_map_page(dev, page, offset, size, dir, attrs);
+                xen_dma_map_page(dev, page, dev_addr, offset, size, dir, attrs);
                 return dev_addr;
         }
 
@@ -417,7 +417,7 @@ dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page,
                 return DMA_ERROR_CODE;
 
         xen_dma_map_page(dev, pfn_to_page(map >> PAGE_SHIFT),
-                                        map & ~PAGE_MASK, size, dir, attrs);
+                                        dev_addr, map & ~PAGE_MASK, size, dir, attrs);
         dev_addr = xen_phys_to_bus(map);
 
         /*
@@ -447,7 +447,7 @@ static void xen_unmap_single(struct device *hwdev, dma_addr_t dev_addr,
 
         BUG_ON(dir == DMA_NONE);
 
-        xen_dma_unmap_page(hwdev, paddr, size, dir, attrs);
+        xen_dma_unmap_page(hwdev, dev_addr, size, dir, attrs);
 
         /* NOTE: We use dev_addr here, not paddr! */
         if (is_xen_swiotlb_buffer(dev_addr)) {
@@ -495,14 +495,14 @@ xen_swiotlb_sync_single(struct device *hwdev, dma_addr_t dev_addr,
         BUG_ON(dir == DMA_NONE);
 
         if (target == SYNC_FOR_CPU)
-                xen_dma_sync_single_for_cpu(hwdev, paddr, size, dir);
+                xen_dma_sync_single_for_cpu(hwdev, dev_addr, size, dir);
 
         /* NOTE: We use dev_addr here, not paddr! */
         if (is_xen_swiotlb_buffer(dev_addr))
                 swiotlb_tbl_sync_single(hwdev, paddr, size, dir, target);
 
         if (target == SYNC_FOR_DEVICE)
-                xen_dma_sync_single_for_cpu(hwdev, paddr, size, dir);
+                xen_dma_sync_single_for_device(hwdev, dev_addr, size, dir);
 
         if (dir != DMA_FROM_DEVICE)
                 return;
@@ -557,6 +557,7 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                 dma_addr_t dev_addr = xen_phys_to_bus(paddr);
 
                 if (swiotlb_force ||
+                    xen_arch_need_swiotlb(hwdev, PFN_DOWN(paddr), PFN_DOWN(dev_addr)) ||
                     !dma_capable(hwdev, dev_addr, sg->length) ||
                     range_straddles_page_boundary(paddr, sg->length)) {
                         phys_addr_t map = swiotlb_tbl_map_single(hwdev,
@@ -574,6 +575,7 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                                 return 0;
                         }
                         xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT),
+                                                dev_addr,
                                                 map & ~PAGE_MASK,
                                                 sg->length,
                                                 dir,
@@ -584,6 +586,7 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                          * xen_dma_map_page, only in the potential cache flushes executed
                          * by the function. */
                         xen_dma_map_page(hwdev, pfn_to_page(paddr >> PAGE_SHIFT),
+                                                dev_addr,
                                                 paddr & ~PAGE_MASK,
                                                 sg->length,
                                                 dir,
diff --git a/drivers/xen/xen-pciback/passthrough.c b/drivers/xen/xen-pciback/passthrough.c
index 828dddc360df..f16a30e2a110 100644
--- a/drivers/xen/xen-pciback/passthrough.c
+++ b/drivers/xen/xen-pciback/passthrough.c
@@ -69,7 +69,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 }
 
 static void __xen_pcibk_release_pci_dev(struct xen_pcibk_device *pdev,
-                                        struct pci_dev *dev)
+                                        struct pci_dev *dev, bool lock)
 {
         struct passthrough_dev_data *dev_data = pdev->pci_dev_data;
         struct pci_dev_entry *dev_entry, *t;
@@ -87,8 +87,13 @@ static void __xen_pcibk_release_pci_dev(struct xen_pcibk_device *pdev,
 
         mutex_unlock(&dev_data->lock);
 
-        if (found_dev)
+        if (found_dev) {
+                if (lock)
+                        device_lock(&found_dev->dev);
                 pcistub_put_pci_dev(found_dev);
+                if (lock)
+                        device_unlock(&found_dev->dev);
+        }
 }
 
 static int __xen_pcibk_init_devices(struct xen_pcibk_device *pdev)
@@ -156,8 +161,11 @@ static void __xen_pcibk_release_devices(struct xen_pcibk_device *pdev)
         struct pci_dev_entry *dev_entry, *t;
 
         list_for_each_entry_safe(dev_entry, t, &dev_data->dev_list, list) {
+                struct pci_dev *dev = dev_entry->dev;
                 list_del(&dev_entry->list);
-                pcistub_put_pci_dev(dev_entry->dev);
+                device_lock(&dev->dev);
+                pcistub_put_pci_dev(dev);
+                device_unlock(&dev->dev);
                 kfree(dev_entry);
         }
 
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 017069a455d4..cc3cbb4435f8 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -105,7 +105,7 @@ static void pcistub_device_release(struct kref *kref)
          */
         __pci_reset_function_locked(dev);
         if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
-                dev_dbg(&dev->dev, "Could not reload PCI state\n");
+                dev_info(&dev->dev, "Could not reload PCI state\n");
         else
                 pci_restore_state(dev);
 
@@ -250,11 +250,15 @@ struct pci_dev *pcistub_get_pci_dev(struct xen_pcibk_device *pdev,
  *  - 'echo BDF > unbind' with a guest still using it. See pcistub_remove
  *
  *  As such we have to be careful.
+ *
+ *  To make this easier, the caller has to hold the device lock.
  */
 void pcistub_put_pci_dev(struct pci_dev *dev)
 {
         struct pcistub_device *psdev, *found_psdev = NULL;
         unsigned long flags;
+        struct xen_pcibk_dev_data *dev_data;
+        int ret;
 
         spin_lock_irqsave(&pcistub_devices_lock, flags);
 
@@ -276,13 +280,20 @@ void pcistub_put_pci_dev(struct pci_dev *dev)
         /* Cleanup our device
          * (so it's ready for the next domain)
          */
+        device_lock_assert(&dev->dev);
+        __pci_reset_function_locked(dev);
 
-        /* This is OK - we are running from workqueue context
-         * and want to inhibit the user from fiddling with 'reset'
-         */
-        pci_reset_function(dev);
-        pci_restore_state(dev);
-
+        dev_data = pci_get_drvdata(dev);
+        ret = pci_load_saved_state(dev, dev_data->pci_saved_state);
+        if (!ret) {
+                /*
+                 * The usual sequence is pci_save_state & pci_restore_state
+                 * but the guest might have messed the configuration space up.
+                 * Use the initial version (when device was bound to us).
+                 */
+                pci_restore_state(dev);
+        } else
+                dev_info(&dev->dev, "Could not reload PCI state\n");
         /* This disables the device. */
         xen_pcibk_reset_device(dev);
 
@@ -554,12 +565,14 @@ static void pcistub_remove(struct pci_dev *dev)
         spin_unlock_irqrestore(&pcistub_devices_lock, flags);
 
         if (found_psdev) {
-                dev_dbg(&dev->dev, "found device to remove - in use? %p\n",
-                        found_psdev->pdev);
+                dev_dbg(&dev->dev, "found device to remove %s\n",
+                        found_psdev->pdev ? "- in-use" : "");
 
                 if (found_psdev->pdev) {
-                        pr_warn("****** removing device %s while still in-use! ******\n",
-                               pci_name(found_psdev->dev));
+                        int domid = xen_find_device_domain_owner(dev);
+
+                        pr_warn("****** removing device %s while still in-use by domain %d! ******\n",
+                               pci_name(found_psdev->dev), domid);
                         pr_warn("****** driver domain may still access this device's i/o resources!\n");
                         pr_warn("****** shutdown driver domain before binding device\n");
                         pr_warn("****** to other drivers or domains\n");
@@ -567,7 +580,8 @@ static void pcistub_remove(struct pci_dev *dev)
                         /* N.B. This ends up calling pcistub_put_pci_dev which ends up
                          * doing the FLR. */
                         xen_pcibk_release_pci_dev(found_psdev->pdev,
-                                                found_psdev->dev);
+                                                found_psdev->dev,
+                                                false /* caller holds the lock. */);
                 }
 
                 spin_lock_irqsave(&pcistub_devices_lock, flags);
@@ -629,10 +643,12 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev,
 {
         pci_ers_result_t res = result;
         struct xen_pcie_aer_op *aer_op;
+        struct xen_pcibk_device *pdev = psdev->pdev;
+        struct xen_pci_sharedinfo *sh_info = pdev->sh_info;
         int ret;
 
         /*with PV AER drivers*/
-        aer_op = &(psdev->pdev->sh_info->aer_op);
+        aer_op = &(sh_info->aer_op);
         aer_op->cmd = aer_cmd ;
         /*useful for error_detected callback*/
         aer_op->err = state;
@@ -653,36 +669,36 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev,
         * this flag to judge whether we need to check pci-front give aer
         * service ack signal
         */
-        set_bit(_PCIB_op_pending, (unsigned long *)&psdev->pdev->flags);
+        set_bit(_PCIB_op_pending, (unsigned long *)&pdev->flags);
 
         /*It is possible that a pcifront conf_read_write ops request invokes
         * the callback which cause the spurious execution of wake_up.
         * Yet it is harmless and better than a spinlock here
         */
         set_bit(_XEN_PCIB_active,
-                (unsigned long *)&psdev->pdev->sh_info->flags);
+                (unsigned long *)&sh_info->flags);
         wmb();
-        notify_remote_via_irq(psdev->pdev->evtchn_irq);
+        notify_remote_via_irq(pdev->evtchn_irq);
 
         ret = wait_event_timeout(xen_pcibk_aer_wait_queue,
                                  !(test_bit(_XEN_PCIB_active, (unsigned long *)
-                                 &psdev->pdev->sh_info->flags)), 300*HZ);
+                                 &sh_info->flags)), 300*HZ);
 
         if (!ret) {
                 if (test_bit(_XEN_PCIB_active,
-                        (unsigned long *)&psdev->pdev->sh_info->flags)) {
+                        (unsigned long *)&sh_info->flags)) {
                         dev_err(&psdev->dev->dev,
                                 "pcifront aer process not responding!\n");
                         clear_bit(_XEN_PCIB_active,
-                          (unsigned long *)&psdev->pdev->sh_info->flags);
+                          (unsigned long *)&sh_info->flags);
                         aer_op->err = PCI_ERS_RESULT_NONE;
                         return res;
                 }
         }
-        clear_bit(_PCIB_op_pending, (unsigned long *)&psdev->pdev->flags);
+        clear_bit(_PCIB_op_pending, (unsigned long *)&pdev->flags);
 
         if (test_bit(_XEN_PCIF_active,
-                (unsigned long *)&psdev->pdev->sh_info->flags)) {
+                (unsigned long *)&sh_info->flags)) {
                 dev_dbg(&psdev->dev->dev,
                         "schedule pci_conf service in " DRV_NAME "\n");
                 xen_pcibk_test_and_schedule_op(psdev->pdev);
@@ -1502,6 +1518,53 @@ parse_error:
 fs_initcall(pcistub_init);
 #endif
 
+#ifdef CONFIG_PCI_IOV
+static struct pcistub_device *find_vfs(const struct pci_dev *pdev)
+{
+        struct pcistub_device *psdev = NULL;
+        unsigned long flags;
+        bool found = false;
+
+        spin_lock_irqsave(&pcistub_devices_lock, flags);
+        list_for_each_entry(psdev, &pcistub_devices, dev_list) {
+                if (!psdev->pdev && psdev->dev != pdev
+                    && pci_physfn(psdev->dev) == pdev) {
+                        found = true;
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(&pcistub_devices_lock, flags);
+        if (found)
+                return psdev;
+        return NULL;
+}
+
+static int pci_stub_notifier(struct notifier_block *nb,
+                             unsigned long action, void *data)
+{
+        struct device *dev = data;
+        const struct pci_dev *pdev = to_pci_dev(dev);
+
+        if (action != BUS_NOTIFY_UNBIND_DRIVER)
+                return NOTIFY_DONE;
+
+        if (!pdev->is_physfn)
+                return NOTIFY_DONE;
+
+        for (;;) {
+                struct pcistub_device *psdev = find_vfs(pdev);
+                if (!psdev)
+                        break;
+                device_release_driver(&psdev->dev->dev);
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block pci_stub_nb = {
+        .notifier_call = pci_stub_notifier,
+};
+#endif
+
 static int __init xen_pcibk_init(void)
 {
         int err;
@@ -1523,12 +1586,19 @@ static int __init xen_pcibk_init(void)
         err = xen_pcibk_xenbus_register();
         if (err)
                 pcistub_exit();
+#ifdef CONFIG_PCI_IOV
+        else
+                bus_register_notifier(&pci_bus_type, &pci_stub_nb);
+#endif
 
         return err;
 }
 
 static void __exit xen_pcibk_cleanup(void)
 {
+#ifdef CONFIG_PCI_IOV
+        bus_unregister_notifier(&pci_bus_type, &pci_stub_nb);
+#endif
         xen_pcibk_xenbus_unregister();
         pcistub_exit();
 }
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index f72af87640e0..58e38d586f52 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -99,7 +99,8 @@ struct xen_pcibk_backend {
                     unsigned int *domain, unsigned int *bus,
                     unsigned int *devfn);
         int (*publish)(struct xen_pcibk_device *pdev, publish_pci_root_cb cb);
-        void (*release)(struct xen_pcibk_device *pdev, struct pci_dev *dev);
+        void (*release)(struct xen_pcibk_device *pdev, struct pci_dev *dev,
+                        bool lock);
         int (*add)(struct xen_pcibk_device *pdev, struct pci_dev *dev,
                    int devid, publish_pci_dev_cb publish_cb);
         struct pci_dev *(*get)(struct xen_pcibk_device *pdev,
@@ -122,10 +123,10 @@ static inline int xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 }
 
 static inline void xen_pcibk_release_pci_dev(struct xen_pcibk_device *pdev,
-                                             struct pci_dev *dev)
+                                             struct pci_dev *dev, bool lock)
 {
         if (xen_pcibk_backend && xen_pcibk_backend->release)
-                return xen_pcibk_backend->release(pdev, dev);
+                return xen_pcibk_backend->release(pdev, dev, lock);
 }
 
 static inline struct pci_dev *
diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c
index 51afff96c515..c99f8bb1c56c 100644
--- a/drivers/xen/xen-pciback/vpci.c
+++ b/drivers/xen/xen-pciback/vpci.c
@@ -145,7 +145,7 @@ out:
 }
 
 static void __xen_pcibk_release_pci_dev(struct xen_pcibk_device *pdev,
-                                        struct pci_dev *dev)
+                                        struct pci_dev *dev, bool lock)
 {
         int slot;
         struct vpci_dev_data *vpci_dev = pdev->pci_dev_data;
@@ -169,8 +169,13 @@ static void __xen_pcibk_release_pci_dev(struct xen_pcibk_device *pdev,
 out:
         mutex_unlock(&vpci_dev->lock);
 
-        if (found_dev)
+        if (found_dev) {
+                if (lock)
+                        device_lock(&found_dev->dev);
                 pcistub_put_pci_dev(found_dev);
+                if (lock)
+                        device_unlock(&found_dev->dev);
+        }
 }
 
 static int __xen_pcibk_init_devices(struct xen_pcibk_device *pdev)
@@ -208,8 +213,11 @@ static void __xen_pcibk_release_devices(struct xen_pcibk_device *pdev)
                 struct pci_dev_entry *e, *tmp;
                 list_for_each_entry_safe(e, tmp, &vpci_dev->dev_list[slot],
                                          list) {
+                        struct pci_dev *dev = e->dev;
                         list_del(&e->list);
-                        pcistub_put_pci_dev(e->dev);
+                        device_lock(&dev->dev);
+                        pcistub_put_pci_dev(dev);
+                        device_unlock(&dev->dev);
                         kfree(e);
                 }
         }
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index ad8d30c088fe..fe17c80ff4b7 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -247,7 +247,7 @@ static int xen_pcibk_export_device(struct xen_pcibk_device *pdev,
         if (err)
                 goto out;
 
-        dev_dbg(&dev->dev, "registering for %d\n", pdev->xdev->otherend_id);
+        dev_info(&dev->dev, "registering for %d\n", pdev->xdev->otherend_id);
         if (xen_register_device_domain_owner(dev,
                                              pdev->xdev->otherend_id) != 0) {
                 dev_err(&dev->dev, "Stealing ownership from dom%d.\n",
@@ -291,7 +291,7 @@ static int xen_pcibk_remove_device(struct xen_pcibk_device *pdev,
 
         /* N.B. This ends up calling pcistub_put_pci_dev which ends up
          * doing the FLR. */
-        xen_pcibk_release_pci_dev(pdev, dev);
+        xen_pcibk_release_pci_dev(pdev, dev, true /* use the lock. */);
 
 out:
         return err;
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 370b24cee4d8..c055d56ec63d 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -30,6 +30,9 @@ config COMPAT_BINFMT_ELF
 config ARCH_BINFMT_ELF_RANDOMIZE_PIE
         bool
 
+config ARCH_BINFMT_ELF_STATE
+        bool
+
 config BINFMT_ELF_FDPIC
         bool "Kernel support for FDPIC ELF binaries"
         default y
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 3a6175fe10c0..02b16910f4c9 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -386,6 +386,127 @@ static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 }
 
+/**
+ * load_elf_phdrs() - load ELF program headers
+ * @elf_ex:   ELF header of the binary whose program headers should be loaded
+ * @elf_file: the opened ELF binary file
+ *
+ * Loads ELF program headers from the binary file elf_file, which has the ELF
+ * header pointed to by elf_ex, into a newly allocated array. The caller is
+ * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
+ */
+static struct elf_phdr *load_elf_phdrs(struct elfhdr *elf_ex,
+                                       struct file *elf_file)
+{
+        struct elf_phdr *elf_phdata = NULL;
+        int retval, size, err = -1;
+
+        /*
+         * If the size of this structure has changed, then punt, since
+         * we will be doing the wrong thing.
+         */
+        if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
+                goto out;
+
+        /* Sanity check the number of program headers... */
+        if (elf_ex->e_phnum < 1 ||
+                elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
+                goto out;
+
+        /* ...and their total size. */
+        size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
+        if (size > ELF_MIN_ALIGN)
+                goto out;
+
+        elf_phdata = kmalloc(size, GFP_KERNEL);
+        if (!elf_phdata)
+                goto out;
+
+        /* Read in the program headers */
+        retval = kernel_read(elf_file, elf_ex->e_phoff,
+                             (char *)elf_phdata, size);
+        if (retval != size) {
+                err = (retval < 0) ? retval : -EIO;
+                goto out;
+        }
+
+        /* Success! */
+        err = 0;
+out:
+        if (err) {
+                kfree(elf_phdata);
+                elf_phdata = NULL;
+        }
+        return elf_phdata;
+}
+
+#ifndef CONFIG_ARCH_BINFMT_ELF_STATE
+
+/**
+ * struct arch_elf_state - arch-specific ELF loading state
+ *
+ * This structure is used to preserve architecture specific data during
+ * the loading of an ELF file, throughout the checking of architecture
+ * specific ELF headers & through to the point where the ELF load is
+ * known to be proceeding (ie. SET_PERSONALITY).
+ *
+ * This implementation is a dummy for architectures which require no
+ * specific state.
+ */
+struct arch_elf_state {
+};
+
+#define INIT_ARCH_ELF_STATE {}
+
+/**
+ * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
+ * @ehdr:       The main ELF header
+ * @phdr:       The program header to check
+ * @elf:        The open ELF file
+ * @is_interp:  True if the phdr is from the interpreter of the ELF being
+ *              loaded, else false.
+ * @state:      Architecture-specific state preserved throughout the process
+ *              of loading the ELF.
+ *
+ * Inspects the program header phdr to validate its correctness and/or
+ * suitability for the system. Called once per ELF program header in the
+ * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
+ * interpreter.
+ *
+ * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
+ *         with that return code.
+ */
+static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
+                                   struct elf_phdr *phdr,
+                                   struct file *elf, bool is_interp,
+                                   struct arch_elf_state *state)
+{
+        /* Dummy implementation, always proceed */
+        return 0;
+}
+
+/**
+ * arch_check_elf() - check a PT_LOPROC..PT_HIPROC ELF program header
+ * @ehdr:       The main ELF header
+ * @has_interp: True if the ELF has an interpreter, else false.
+ * @state:      Architecture-specific state preserved throughout the process
+ *              of loading the ELF.
+ *
+ * Provides a final opportunity for architecture code to reject the loading
+ * of the ELF & cause an exec syscall to return an error. This is called after
+ * all program headers to be checked by arch_elf_pt_proc have been.
+ *
+ * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
+ *         with that return code.
+ */
+static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
+                                 struct arch_elf_state *state)
+{
+        /* Dummy implementation, always proceed */
+        return 0;
+}
+
+#endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
 
 /* This is much more generalized than the library routine read function,
    so we keep this separate.  Technically the library read function
@@ -394,16 +515,15 @@ static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 
 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                 struct file *interpreter, unsigned long *interp_map_addr,
-                unsigned long no_base)
+                unsigned long no_base, struct elf_phdr *interp_elf_phdata)
 {
-        struct elf_phdr *elf_phdata;
         struct elf_phdr *eppnt;
         unsigned long load_addr = 0;
         int load_addr_set = 0;
         unsigned long last_bss = 0, elf_bss = 0;
         unsigned long error = ~0UL;
         unsigned long total_size;
-        int retval, i, size;
+        int i;
 
         /* First of all, some simple consistency checks */
         if (interp_elf_ex->e_type != ET_EXEC &&
@@ -414,40 +534,14 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
         if (!interpreter->f_op->mmap)
                 goto out;
 
-        /*
-         * If the size of this structure has changed, then punt, since
-         * we will be doing the wrong thing.
-         */
-        if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
-                goto out;
-        if (interp_elf_ex->e_phnum < 1 ||
-                interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
-                goto out;
-
-        /* Now read in all of the header information */
-        size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
-        if (size > ELF_MIN_ALIGN)
-                goto out;
-        elf_phdata = kmalloc(size, GFP_KERNEL);
-        if (!elf_phdata)
-                goto out;
-
-        retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
-                             (char *)elf_phdata, size);
-        error = -EIO;
-        if (retval != size) {
-                if (retval < 0)
-                        error = retval; 
-                goto out_close;
-        }
-
-        total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
+        total_size = total_mapping_size(interp_elf_phdata,
+                                        interp_elf_ex->e_phnum);
         if (!total_size) {
                 error = -EINVAL;
-                goto out_close;
+                goto out;
         }
 
-        eppnt = elf_phdata;
+        eppnt = interp_elf_phdata;
         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
                 if (eppnt->p_type == PT_LOAD) {
                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
@@ -474,7 +568,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                                 *interp_map_addr = map_addr;
                         error = map_addr;
                         if (BAD_ADDR(map_addr))
-                                goto out_close;
+                                goto out;
 
                         if (!load_addr_set &&
                             interp_elf_ex->e_type == ET_DYN) {
@@ -493,7 +587,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                             eppnt->p_memsz > TASK_SIZE ||
                             TASK_SIZE - eppnt->p_memsz < k) {
                                 error = -ENOMEM;
-                                goto out_close;
+                                goto out;
                         }
 
                         /*
@@ -523,7 +617,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                  */
                 if (padzero(elf_bss)) {
                         error = -EFAULT;
-                        goto out_close;
+                        goto out;
                 }
 
                 /* What we have mapped so far */
@@ -532,13 +626,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                 /* Map the last of the bss segment */
                 error = vm_brk(elf_bss, last_bss - elf_bss);
                 if (BAD_ADDR(error))
-                        goto out_close;
+                        goto out;
         }
 
         error = load_addr;
-
-out_close:
-        kfree(elf_phdata);
 out:
         return error;
 }
@@ -575,10 +666,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
         int load_addr_set = 0;
         char * elf_interpreter = NULL;
         unsigned long error;
-        struct elf_phdr *elf_ppnt, *elf_phdata;
+        struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
         unsigned long elf_bss, elf_brk;
         int retval, i;
-        unsigned int size;
         unsigned long elf_entry;
         unsigned long interp_load_addr = 0;
         unsigned long start_code, end_code, start_data, end_data;
@@ -589,6 +679,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 struct elfhdr elf_ex;
                 struct elfhdr interp_elf_ex;
         } *loc;
+        struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
 
         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
         if (!loc) {
@@ -611,26 +702,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
         if (!bprm->file->f_op->mmap)
                 goto out;
 
-        /* Now read in all of the header information */
-        if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
-                goto out;
-        if (loc->elf_ex.e_phnum < 1 ||
-                loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
-                goto out;
-        size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
-        retval = -ENOMEM;
-        elf_phdata = kmalloc(size, GFP_KERNEL);
+        elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file);
         if (!elf_phdata)
                 goto out;
 
-        retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
-                             (char *)elf_phdata, size);
-        if (retval != size) {
-                if (retval >= 0)
-                        retval = -EIO;
-                goto out_free_ph;
-        }
-
         elf_ppnt = elf_phdata;
         elf_bss = 0;
         elf_brk = 0;
@@ -699,12 +774,21 @@ static int load_elf_binary(struct linux_binprm *bprm)
 
         elf_ppnt = elf_phdata;
         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
-                if (elf_ppnt->p_type == PT_GNU_STACK) {
+                switch (elf_ppnt->p_type) {
+                case PT_GNU_STACK:
                         if (elf_ppnt->p_flags & PF_X)
                                 executable_stack = EXSTACK_ENABLE_X;
                         else
                                 executable_stack = EXSTACK_DISABLE_X;
                         break;
+
+                case PT_LOPROC ... PT_HIPROC:
+                        retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt,
+                                                  bprm->file, false,
+                                                  &arch_state);
+                        if (retval)
+                                goto out_free_dentry;
+                        break;
                 }
 
         /* Some simple consistency checks for the interpreter */
@@ -716,8 +800,36 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 /* Verify the interpreter has a valid arch */
                 if (!elf_check_arch(&loc->interp_elf_ex))
                         goto out_free_dentry;
+
+                /* Load the interpreter program headers */
+                interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex,
+                                                   interpreter);
+                if (!interp_elf_phdata)
+                        goto out_free_dentry;
+
+                /* Pass PT_LOPROC..PT_HIPROC headers to arch code */
+                elf_ppnt = interp_elf_phdata;
+                for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++)
+                        switch (elf_ppnt->p_type) {
+                        case PT_LOPROC ... PT_HIPROC:
+                                retval = arch_elf_pt_proc(&loc->interp_elf_ex,
+                                                          elf_ppnt, interpreter,
+                                                          true, &arch_state);
+                                if (retval)
+                                        goto out_free_dentry;
+                                break;
+                        }
         }
 
+        /*
+         * Allow arch code to reject the ELF at this point, whilst it's
+         * still possible to return an error to the code that invoked
+         * the exec syscall.
+         */
+        retval = arch_check_elf(&loc->elf_ex, !!interpreter, &arch_state);
+        if (retval)
+                goto out_free_dentry;
+
         /* Flush all traces of the currently running executable */
         retval = flush_old_exec(bprm);
         if (retval)
@@ -725,7 +837,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
 
         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
            may depend on the personality.  */
-        SET_PERSONALITY(loc->elf_ex);
+        SET_PERSONALITY2(loc->elf_ex, &arch_state);
         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
                 current->personality |= READ_IMPLIES_EXEC;
 
@@ -890,7 +1002,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
                                             interpreter,
                                             &interp_map_addr,
-                                            load_bias);
+                                            load_bias, interp_elf_phdata);
                 if (!IS_ERR((void *)elf_entry)) {
                         /*
                          * load_elf_interp() returns relocation
@@ -917,6 +1029,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 }
         }
 
+        kfree(interp_elf_phdata);
         kfree(elf_phdata);
 
         set_binfmt(&elf_format);
@@ -981,6 +1094,7 @@ out_ret:
 
         /* error cleanup */
 out_free_dentry:
+        kfree(interp_elf_phdata);
         allow_write_access(interpreter);
         if (interpreter)
                 fput(interpreter);
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index cb7f3fe9c9f6..d897ef803b3b 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -94,6 +94,7 @@
 #include <linux/mutex.h>
 #include <linux/genhd.h>
 #include <linux/blkdev.h>
+#include <linux/vmalloc.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "hash.h"
@@ -326,9 +327,6 @@ static int btrfsic_handle_extent_data(struct btrfsic_state *state,
 static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len,
                              struct btrfsic_block_data_ctx *block_ctx_out,
                              int mirror_num);
-static int btrfsic_map_superblock(struct btrfsic_state *state, u64 bytenr,
-                                  u32 len, struct block_device *bdev,
-                                  struct btrfsic_block_data_ctx *block_ctx_out);
 static void btrfsic_release_block_ctx(struct btrfsic_block_data_ctx *block_ctx);
 static int btrfsic_read_block(struct btrfsic_state *state,
                               struct btrfsic_block_data_ctx *block_ctx);
@@ -1326,24 +1324,25 @@ static int btrfsic_create_link_to_next_block(
                 l = NULL;
                 next_block->generation = BTRFSIC_GENERATION_UNKNOWN;
         } else {
-                if (next_block->logical_bytenr != next_bytenr &&
-                    !(!next_block->is_metadata &&
-                      0 == next_block->logical_bytenr)) {
-                        printk(KERN_INFO
-                               "Referenced block @%llu (%s/%llu/%d)"
-                               " found in hash table, %c,"
-                               " bytenr mismatch (!= stored %llu).\n",
-                               next_bytenr, next_block_ctx->dev->name,
-                               next_block_ctx->dev_bytenr, *mirror_nump,
-                               btrfsic_get_block_type(state, next_block),
-                               next_block->logical_bytenr);
-                } else if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
-                        printk(KERN_INFO
-                               "Referenced block @%llu (%s/%llu/%d)"
-                               " found in hash table, %c.\n",
-                               next_bytenr, next_block_ctx->dev->name,
-                               next_block_ctx->dev_bytenr, *mirror_nump,
-                               btrfsic_get_block_type(state, next_block));
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE) {
+                        if (next_block->logical_bytenr != next_bytenr &&
+                            !(!next_block->is_metadata &&
+                              0 == next_block->logical_bytenr))
+                                printk(KERN_INFO
+                                       "Referenced block @%llu (%s/%llu/%d) found in hash table, %c, bytenr mismatch (!= stored %llu).\n",
+                                       next_bytenr, next_block_ctx->dev->name,
+                                       next_block_ctx->dev_bytenr, *mirror_nump,
+                                       btrfsic_get_block_type(state,
+                                                              next_block),
+                                       next_block->logical_bytenr);
+                        else
+                                printk(KERN_INFO
+                                       "Referenced block @%llu (%s/%llu/%d) found in hash table, %c.\n",
+                                       next_bytenr, next_block_ctx->dev->name,
+                                       next_block_ctx->dev_bytenr, *mirror_nump,
+                                       btrfsic_get_block_type(state,
+                                                              next_block));
+                }
                 next_block->logical_bytenr = next_bytenr;
 
                 next_block->mirror_num = *mirror_nump;
@@ -1529,7 +1528,9 @@ static int btrfsic_handle_extent_data(
                                 return -1;
                         }
                         if (!block_was_created) {
-                                if (next_block->logical_bytenr != next_bytenr &&
+                                if ((state->print_mask &
+                                     BTRFSIC_PRINT_MASK_VERBOSE) &&
+                                    next_block->logical_bytenr != next_bytenr &&
                                     !(!next_block->is_metadata &&
                                       0 == next_block->logical_bytenr)) {
                                         printk(KERN_INFO
@@ -1607,25 +1608,6 @@ static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len,
         return ret;
 }
 
-static int btrfsic_map_superblock(struct btrfsic_state *state, u64 bytenr,
-                                  u32 len, struct block_device *bdev,
-                                  struct btrfsic_block_data_ctx *block_ctx_out)
-{
-        block_ctx_out->dev = btrfsic_dev_state_lookup(bdev);
-        block_ctx_out->dev_bytenr = bytenr;
-        block_ctx_out->start = bytenr;
-        block_ctx_out->len = len;
-        block_ctx_out->datav = NULL;
-        block_ctx_out->pagev = NULL;
-        block_ctx_out->mem_to_free = NULL;
-        if (NULL != block_ctx_out->dev) {
-                return 0;
-        } else {
-                printk(KERN_INFO "btrfsic: error, cannot lookup dev (#2)!\n");
-                return -ENXIO;
-        }
-}
-
 static void btrfsic_release_block_ctx(struct btrfsic_block_data_ctx *block_ctx)
 {
         if (block_ctx->mem_to_free) {
@@ -1901,25 +1883,26 @@ again:
                                                                dev_state,
                                                                dev_bytenr);
                         }
-                        if (block->logical_bytenr != bytenr &&
-                            !(!block->is_metadata &&
-                              block->logical_bytenr == 0))
-                                printk(KERN_INFO
-                                       "Written block @%llu (%s/%llu/%d)"
-                                       " found in hash table, %c,"
-                                       " bytenr mismatch"
-                                       " (!= stored %llu).\n",
-                                       bytenr, dev_state->name, dev_bytenr,
-                                       block->mirror_num,
-                                       btrfsic_get_block_type(state, block),
-                                       block->logical_bytenr);
-                        else if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
-                                printk(KERN_INFO
-                                       "Written block @%llu (%s/%llu/%d)"
-                                       " found in hash table, %c.\n",
-                                       bytenr, dev_state->name, dev_bytenr,
-                                       block->mirror_num,
-                                       btrfsic_get_block_type(state, block));
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE) {
+                                if (block->logical_bytenr != bytenr &&
+                                    !(!block->is_metadata &&
+                                      block->logical_bytenr == 0))
+                                        printk(KERN_INFO
+                                               "Written block @%llu (%s/%llu/%d) found in hash table, %c, bytenr mismatch (!= stored %llu).\n",
+                                               bytenr, dev_state->name,
+                                               dev_bytenr,
+                                               block->mirror_num,
+                                               btrfsic_get_block_type(state,
+                                                                      block),
+                                               block->logical_bytenr);
+                                else
+                                        printk(KERN_INFO
+                                               "Written block @%llu (%s/%llu/%d) found in hash table, %c.\n",
+                                               bytenr, dev_state->name,
+                                               dev_bytenr, block->mirror_num,
+                                               btrfsic_get_block_type(state,
+                                                                      block));
+                        }
                         block->logical_bytenr = bytenr;
                 } else {
                         if (num_pages * PAGE_CACHE_SIZE <
@@ -2002,24 +1985,13 @@ again:
                         }
                 }
 
-                if (block->is_superblock)
-                        ret = btrfsic_map_superblock(state, bytenr,
-                                                     processed_len,
-                                                     bdev, &block_ctx);
-                else
-                        ret = btrfsic_map_block(state, bytenr, processed_len,
-                                                &block_ctx, 0);
-                if (ret) {
-                        printk(KERN_INFO
-                               "btrfsic: btrfsic_map_block(root @%llu)"
-                               " failed!\n", bytenr);
-                        goto continue_loop;
-                }
-                block_ctx.datav = mapped_datav;
-                /* the following is required in case of writes to mirrors,
-                 * use the same that was used for the lookup */
                 block_ctx.dev = dev_state;
                 block_ctx.dev_bytenr = dev_bytenr;
+                block_ctx.start = bytenr;
+                block_ctx.len = processed_len;
+                block_ctx.pagev = NULL;
+                block_ctx.mem_to_free = NULL;
+                block_ctx.datav = mapped_datav;
 
                 if (is_metadata || state->include_extent_data) {
                         block->never_written = 0;
@@ -2133,10 +2105,6 @@ again:
                         /* this is getting ugly for the
                          * include_extent_data case... */
                         bytenr = 0;     /* unknown */
-                        block_ctx.start = bytenr;
-                        block_ctx.len = processed_len;
-                        block_ctx.mem_to_free = NULL;
-                        block_ctx.pagev = NULL;
                 } else {
                         processed_len = state->metablock_size;
                         bytenr = btrfs_stack_header_bytenr(
@@ -2149,22 +2117,15 @@ again:
                                        "Written block @%llu (%s/%llu/?)"
                                        " !found in hash table, M.\n",
                                        bytenr, dev_state->name, dev_bytenr);
-
-                        ret = btrfsic_map_block(state, bytenr, processed_len,
-                                                &block_ctx, 0);
-                        if (ret) {
-                                printk(KERN_INFO
-                                       "btrfsic: btrfsic_map_block(root @%llu)"
-                                       " failed!\n",
-                                       dev_bytenr);
-                                goto continue_loop;
-                        }
                 }
-                block_ctx.datav = mapped_datav;
-                /* the following is required in case of writes to mirrors,
-                 * use the same that was used for the lookup */
+
                 block_ctx.dev = dev_state;
                 block_ctx.dev_bytenr = dev_bytenr;
+                block_ctx.start = bytenr;
+                block_ctx.len = processed_len;
+                block_ctx.pagev = NULL;
+                block_ctx.mem_to_free = NULL;
+                block_ctx.datav = mapped_datav;
 
                 block = btrfsic_block_alloc();
                 if (NULL == block) {
@@ -3130,10 +3091,13 @@ int btrfsic_mount(struct btrfs_root *root,
                        root->sectorsize, PAGE_CACHE_SIZE);
                 return -1;
         }
-        state = kzalloc(sizeof(*state), GFP_NOFS);
-        if (NULL == state) {
-                printk(KERN_INFO "btrfs check-integrity: kmalloc() failed!\n");
-                return -1;
+        state = kzalloc(sizeof(*state), GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+        if (!state) {
+                state = vzalloc(sizeof(*state));
+                if (!state) {
+                        printk(KERN_INFO "btrfs check-integrity: vzalloc() failed!\n");
+                        return -1;
+                }
         }
 
         if (!btrfsic_is_initialized) {
@@ -3277,5 +3241,8 @@ void btrfsic_unmount(struct btrfs_root *root,
 
         mutex_unlock(&btrfsic_mutex);
 
-        kfree(state);
+        if (is_vmalloc_addr(state))
+                vfree(state);
+        else
+                kfree(state);
 }
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index dcd9be32ac57..e9df8862012c 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -224,16 +224,19 @@ out:
  * Clear the writeback bits on all of the file
  * pages for a compressed write
  */
-static noinline void end_compressed_writeback(struct inode *inode, u64 start,
-                                              unsigned long ram_size)
+static noinline void end_compressed_writeback(struct inode *inode,
+                                              const struct compressed_bio *cb)
 {
-        unsigned long index = start >> PAGE_CACHE_SHIFT;
-        unsigned long end_index = (start + ram_size - 1) >> PAGE_CACHE_SHIFT;
+        unsigned long index = cb->start >> PAGE_CACHE_SHIFT;
+        unsigned long end_index = (cb->start + cb->len - 1) >> PAGE_CACHE_SHIFT;
         struct page *pages[16];
         unsigned long nr_pages = end_index - index + 1;
         int i;
         int ret;
 
+        if (cb->errors)
+                mapping_set_error(inode->i_mapping, -EIO);
+
         while (nr_pages > 0) {
                 ret = find_get_pages_contig(inode->i_mapping, index,
                                      min_t(unsigned long,
@@ -244,6 +247,8 @@ static noinline void end_compressed_writeback(struct inode *inode, u64 start,
                         continue;
                 }
                 for (i = 0; i < ret; i++) {
+                        if (cb->errors)
+                                SetPageError(pages[i]);
                         end_page_writeback(pages[i]);
                         page_cache_release(pages[i]);
                 }
@@ -287,10 +292,11 @@ static void end_compressed_bio_write(struct bio *bio, int err)
         tree->ops->writepage_end_io_hook(cb->compressed_pages[0],
                                          cb->start,
                                          cb->start + cb->len - 1,
-                                         NULL, 1);
+                                         NULL,
+                                         err ? 0 : 1);
         cb->compressed_pages[0]->mapping = NULL;
 
-        end_compressed_writeback(inode, cb->start, cb->len);
+        end_compressed_writeback(inode, cb);
         /* note, our inode could be gone now */
 
         /*
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 150822ee0a0b..14a72ed14ef7 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2929,7 +2929,7 @@ done:
          */
         if (!p->leave_spinning)
                 btrfs_set_path_blocking(p);
-        if (ret < 0)
+        if (ret < 0 && !p->skip_release_on_error)
                 btrfs_release_path(p);
         return ret;
 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index fe69edda11fb..e6fbbd74b716 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -607,6 +607,7 @@ struct btrfs_path {
         unsigned int leave_spinning:1;
         unsigned int search_commit_root:1;
         unsigned int need_commit_sem:1;
+        unsigned int skip_release_on_error:1;
 };
 
 /*
@@ -1170,6 +1171,7 @@ struct btrfs_space_info {
         struct percpu_counter total_bytes_pinned;
 
         struct list_head list;
+        struct list_head ro_bgs;
 
         struct rw_semaphore groups_sem;
         /* for block groups in our same type */
@@ -1276,6 +1278,8 @@ struct btrfs_block_group_cache {
         unsigned int ro:1;
         unsigned int dirty:1;
         unsigned int iref:1;
+        unsigned int has_caching_ctl:1;
+        unsigned int removed:1;
 
         int disk_cache_state;
 
@@ -1305,6 +1309,11 @@ struct btrfs_block_group_cache {
 
         /* For delayed block group creation or deletion of empty block groups */
         struct list_head bg_list;
+
+        /* For read-only block groups */
+        struct list_head ro_list;
+
+        atomic_t trimming;
 };
 
 /* delayed seq elem */
@@ -1402,6 +1411,11 @@ struct btrfs_fs_info {
          */
         u64 last_trans_log_full_commit;
         unsigned long mount_opt;
+        /*
+         * Track requests for actions that need to be done during transaction
+         * commit (like for some mount options).
+         */
+        unsigned long pending_changes;
         unsigned long compress_type:4;
         int commit_interval;
         /*
@@ -1729,6 +1743,12 @@ struct btrfs_fs_info {
 
         /* For btrfs to record security options */
         struct security_mnt_opts security_opts;
+
+        /*
+         * Chunks that can't be freed yet (under a trim/discard operation)
+         * and will be latter freed. Protected by fs_info->chunk_mutex.
+         */
+        struct list_head pinned_chunks;
 };
 
 struct btrfs_subvolume_writers {
@@ -2093,7 +2113,6 @@ struct btrfs_ioctl_defrag_range_args {
 #define BTRFS_MOUNT_CHECK_INTEGRITY_INCLUDING_EXTENT_DATA (1 << 21)
 #define BTRFS_MOUNT_PANIC_ON_FATAL_ERROR        (1 << 22)
 #define BTRFS_MOUNT_RESCAN_UUID_TREE    (1 << 23)
-#define BTRFS_MOUNT_CHANGE_INODE_CACHE  (1 << 24)
 
 #define BTRFS_DEFAULT_COMMIT_INTERVAL   (30)
 #define BTRFS_DEFAULT_MAX_INLINE        (8192)
@@ -2103,6 +2122,7 @@ struct btrfs_ioctl_defrag_range_args {
 #define btrfs_raw_test_opt(o, opt)      ((o) & BTRFS_MOUNT_##opt)
 #define btrfs_test_opt(root, opt)       ((root)->fs_info->mount_opt & \
                                          BTRFS_MOUNT_##opt)
+
 #define btrfs_set_and_info(root, opt, fmt, args...)                     \
 {                                                                       \
         if (!btrfs_test_opt(root, opt))                                 \
@@ -2118,6 +2138,49 @@ struct btrfs_ioctl_defrag_range_args {
 }
 
 /*
+ * Requests for changes that need to be done during transaction commit.
+ *
+ * Internal mount options that are used for special handling of the real
+ * mount options (eg. cannot be set during remount and have to be set during
+ * transaction commit)
+ */
+
+#define BTRFS_PENDING_SET_INODE_MAP_CACHE       (0)
+#define BTRFS_PENDING_CLEAR_INODE_MAP_CACHE     (1)
+#define BTRFS_PENDING_COMMIT                    (2)
+
+#define btrfs_test_pending(info, opt)   \
+        test_bit(BTRFS_PENDING_##opt, &(info)->pending_changes)
+#define btrfs_set_pending(info, opt)    \
+        set_bit(BTRFS_PENDING_##opt, &(info)->pending_changes)
+#define btrfs_clear_pending(info, opt)  \
+        clear_bit(BTRFS_PENDING_##opt, &(info)->pending_changes)
+
+/*
+ * Helpers for setting pending mount option changes.
+ *
+ * Expects corresponding macros
+ * BTRFS_PENDING_SET_ and CLEAR_ + short mount option name
+ */
+#define btrfs_set_pending_and_info(info, opt, fmt, args...)            \
+do {                                                                   \
+       if (!btrfs_raw_test_opt((info)->mount_opt, opt)) {              \
+               btrfs_info((info), fmt, ##args);                        \
+               btrfs_set_pending((info), SET_##opt);                   \
+               btrfs_clear_pending((info), CLEAR_##opt);               \
+       }                                                               \
+} while(0)
+
+#define btrfs_clear_pending_and_info(info, opt, fmt, args...)          \
+do {                                                                   \
+       if (btrfs_raw_test_opt((info)->mount_opt, opt)) {               \
+               btrfs_info((info), fmt, ##args);                        \
+               btrfs_set_pending((info), CLEAR_##opt);                 \
+               btrfs_clear_pending((info), SET_##opt);                 \
+       }                                                               \
+} while(0)
+
+/*
  * Inode flags
  */
 #define BTRFS_INODE_NODATASUM           (1 << 0)
@@ -3351,7 +3414,8 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
                            u64 type, u64 chunk_objectid, u64 chunk_offset,
                            u64 size);
 int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
-                             struct btrfs_root *root, u64 group_start);
+                             struct btrfs_root *root, u64 group_start,
+                             struct extent_map *em);
 void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info);
 void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
                                        struct btrfs_root *root);
@@ -3427,8 +3491,8 @@ int btrfs_init_space_info(struct btrfs_fs_info *fs_info);
 int btrfs_delayed_refs_qgroup_accounting(struct btrfs_trans_handle *trans,
                                          struct btrfs_fs_info *fs_info);
 int __get_raid_index(u64 flags);
-int btrfs_start_nocow_write(struct btrfs_root *root);
-void btrfs_end_nocow_write(struct btrfs_root *root);
+int btrfs_start_write_no_snapshoting(struct btrfs_root *root);
+void btrfs_end_write_no_snapshoting(struct btrfs_root *root);
 /* ctree.c */
 int btrfs_bin_search(struct extent_buffer *eb, struct btrfs_key *key,
                      int level, int *slot);
@@ -3686,6 +3750,10 @@ struct btrfs_dir_item *btrfs_lookup_xattr(struct btrfs_trans_handle *trans,
 int verify_dir_item(struct btrfs_root *root,
                     struct extent_buffer *leaf,
                     struct btrfs_dir_item *dir_item);
+struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
+                                                 struct btrfs_path *path,
+                                                 const char *name,
+                                                 int name_len);
 
 /* orphan.c */
 int btrfs_insert_orphan_item(struct btrfs_trans_handle *trans,
@@ -3857,6 +3925,7 @@ int btrfs_prealloc_file_range_trans(struct inode *inode,
                                     struct btrfs_trans_handle *trans, int mode,
                                     u64 start, u64 num_bytes, u64 min_size,
                                     loff_t actual_len, u64 *alloc_hint);
+int btrfs_inode_check_errors(struct inode *inode);
 extern const struct dentry_operations btrfs_dentry_operations;
 
 /* ioctl.c */
@@ -3901,6 +3970,7 @@ int btrfs_dirty_pages(struct btrfs_root *root, struct inode *inode,
                       struct page **pages, size_t num_pages,
                       loff_t pos, size_t write_bytes,
                       struct extent_state **cached);
+int btrfs_fdatawrite_range(struct inode *inode, loff_t start, loff_t end);
 
 /* tree-defrag.c */
 int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
@@ -4097,7 +4167,12 @@ int btrfs_scrub_progress(struct btrfs_root *root, u64 devid,
 /* dev-replace.c */
 void btrfs_bio_counter_inc_blocked(struct btrfs_fs_info *fs_info);
 void btrfs_bio_counter_inc_noblocked(struct btrfs_fs_info *fs_info);
-void btrfs_bio_counter_dec(struct btrfs_fs_info *fs_info);
+void btrfs_bio_counter_sub(struct btrfs_fs_info *fs_info, s64 amount);
+
+static inline void btrfs_bio_counter_dec(struct btrfs_fs_info *fs_info)
+{
+        btrfs_bio_counter_sub(fs_info, 1);
+}
 
 /* reada.c */
 struct reada_control {
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 6f662b34ba0e..ca6a3a3b6b6c 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -316,11 +316,6 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
         struct btrfs_device *tgt_device = NULL;
         struct btrfs_device *src_device = NULL;
 
-        if (btrfs_fs_incompat(fs_info, RAID56)) {
-                btrfs_warn(fs_info, "dev_replace cannot yet handle RAID5/RAID6");
-                return -EOPNOTSUPP;
-        }
-
         switch (args->start.cont_reading_from_srcdev_mode) {
         case BTRFS_IOCTL_DEV_REPLACE_CONT_READING_FROM_SRCDEV_MODE_ALWAYS:
         case BTRFS_IOCTL_DEV_REPLACE_CONT_READING_FROM_SRCDEV_MODE_AVOID:
@@ -422,9 +417,15 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
                               &dev_replace->scrub_progress, 0, 1);
 
         ret = btrfs_dev_replace_finishing(root->fs_info, ret);
-        WARN_ON(ret);
+        /* don't warn if EINPROGRESS, someone else might be running scrub */
+        if (ret == -EINPROGRESS) {
+                args->result = BTRFS_IOCTL_DEV_REPLACE_RESULT_SCRUB_INPROGRESS;
+                ret = 0;
+        } else {
+                WARN_ON(ret);
+        }
 
-        return 0;
+        return ret;
 
 leave:
         dev_replace->srcdev = NULL;
@@ -542,7 +543,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                         btrfs_destroy_dev_replace_tgtdev(fs_info, tgt_device);
                 mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
 
-                return 0;
+                return scrub_ret;
         }
 
         printk_in_rcu(KERN_INFO
@@ -571,15 +572,11 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
         list_add(&tgt_device->dev_alloc_list, &fs_info->fs_devices->alloc_list);
         fs_info->fs_devices->rw_devices++;
 
-        /* replace the sysfs entry */
-        btrfs_kobj_rm_device(fs_info, src_device);
-        btrfs_kobj_add_device(fs_info, tgt_device);
-
         btrfs_dev_replace_unlock(dev_replace);
 
         btrfs_rm_dev_replace_blocked(fs_info);
 
-        btrfs_rm_dev_replace_srcdev(fs_info, src_device);
+        btrfs_rm_dev_replace_remove_srcdev(fs_info, src_device);
 
         btrfs_rm_dev_replace_unblocked(fs_info);
 
@@ -594,6 +591,11 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
         mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
         mutex_unlock(&uuid_mutex);
 
+        /* replace the sysfs entry */
+        btrfs_kobj_rm_device(fs_info, src_device);
+        btrfs_kobj_add_device(fs_info, tgt_device);
+        btrfs_rm_dev_replace_free_srcdev(fs_info, src_device);
+
         /* write back the superblocks */
         trans = btrfs_start_transaction(root, 0);
         if (!IS_ERR(trans))
@@ -920,9 +922,9 @@ void btrfs_bio_counter_inc_noblocked(struct btrfs_fs_info *fs_info)
         percpu_counter_inc(&fs_info->bio_counter);
 }
 
-void btrfs_bio_counter_dec(struct btrfs_fs_info *fs_info)
+void btrfs_bio_counter_sub(struct btrfs_fs_info *fs_info, s64 amount)
 {
-        percpu_counter_dec(&fs_info->bio_counter);
+        percpu_counter_sub(&fs_info->bio_counter, amount);
 
         if (waitqueue_active(&fs_info->replace_wait))
                 wake_up(&fs_info->replace_wait);
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
index fc8df866e919..1752625fb4dd 100644
--- a/fs/btrfs/dir-item.c
+++ b/fs/btrfs/dir-item.c
@@ -21,10 +21,6 @@
 #include "hash.h"
 #include "transaction.h"
 
-static struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
-                              struct btrfs_path *path,
-                              const char *name, int name_len);
-
 /*
  * insert a name into a directory, doing overflow properly if there is a hash
  * collision.  data_size indicates how big the item inserted should be.  On
@@ -383,9 +379,9 @@ struct btrfs_dir_item *btrfs_lookup_xattr(struct btrfs_trans_handle *trans,
  * this walks through all the entries in a dir item and finds one
  * for a specific name.
  */
-static struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
-                              struct btrfs_path *path,
-                              const char *name, int name_len)
+struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root,
+                                                 struct btrfs_path *path,
+                                                 const char *name, int name_len)
 {
         struct btrfs_dir_item *dir_item;
         unsigned long name_ptr;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 1bf9f897065d..30965120772b 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2384,6 +2384,8 @@ int open_ctree(struct super_block *sb,
         init_waitqueue_head(&fs_info->transaction_blocked_wait);
         init_waitqueue_head(&fs_info->async_submit_wait);
 
+        INIT_LIST_HEAD(&fs_info->pinned_chunks);
+
         ret = btrfs_alloc_stripe_hash_table(fs_info);
         if (ret) {
                 err = ret;
@@ -2830,9 +2832,11 @@ retry_root_backup:
                 btrfs_set_opt(fs_info->mount_opt, SSD);
         }
 
-        /* Set the real inode map cache flag */
-        if (btrfs_test_opt(tree_root, CHANGE_INODE_CACHE))
-                btrfs_set_opt(tree_root->fs_info->mount_opt, INODE_MAP_CACHE);
+        /*
+         * Mount does not set all options immediatelly, we can do it now and do
+         * not have to wait for transaction commit
+         */
+        btrfs_apply_pending_changes(fs_info);
 
 #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
         if (btrfs_test_opt(tree_root, CHECK_INTEGRITY)) {
@@ -3713,6 +3717,17 @@ void close_ctree(struct btrfs_root *root)
 
         btrfs_free_block_rsv(root, root->orphan_block_rsv);
         root->orphan_block_rsv = NULL;
+
+        lock_chunks(root);
+        while (!list_empty(&fs_info->pinned_chunks)) {
+                struct extent_map *em;
+
+                em = list_first_entry(&fs_info->pinned_chunks,
+                                      struct extent_map, list);
+                list_del_init(&em->list);
+                free_extent_map(em);
+        }
+        unlock_chunks(root);
 }
 
 int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid,
@@ -3839,12 +3854,12 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
          */
         if (!IS_ALIGNED(btrfs_super_root(sb), 4096))
                 printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
-                                sb->root);
+                                btrfs_super_root(sb));
         if (!IS_ALIGNED(btrfs_super_chunk_root(sb), 4096))
-                printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
-                                sb->chunk_root);
+                printk(KERN_WARNING "BTRFS: chunk_root block unaligned: %llu\n",
+                                btrfs_super_chunk_root(sb));
         if (!IS_ALIGNED(btrfs_super_log_root(sb), 4096))
-                printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
+                printk(KERN_WARNING "BTRFS: log_root block unaligned: %llu\n",
                                 btrfs_super_log_root(sb));
 
         if (memcmp(fs_info->fsid, sb->dev_item.fsid, BTRFS_UUID_SIZE) != 0) {
@@ -4129,6 +4144,25 @@ again:
         return 0;
 }
 
+static void btrfs_free_pending_ordered(struct btrfs_transaction *cur_trans,
+                                       struct btrfs_fs_info *fs_info)
+{
+        struct btrfs_ordered_extent *ordered;
+
+        spin_lock(&fs_info->trans_lock);
+        while (!list_empty(&cur_trans->pending_ordered)) {
+                ordered = list_first_entry(&cur_trans->pending_ordered,
+                                           struct btrfs_ordered_extent,
+                                           trans_list);
+                list_del_init(&ordered->trans_list);
+                spin_unlock(&fs_info->trans_lock);
+
+                btrfs_put_ordered_extent(ordered);
+                spin_lock(&fs_info->trans_lock);
+        }
+        spin_unlock(&fs_info->trans_lock);
+}
+
 void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
                                    struct btrfs_root *root)
 {
@@ -4140,6 +4174,7 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
         cur_trans->state = TRANS_STATE_UNBLOCKED;
         wake_up(&root->fs_info->transaction_wait);
 
+        btrfs_free_pending_ordered(cur_trans, root->fs_info);
         btrfs_destroy_delayed_inodes(root);
         btrfs_assert_delayed_root_empty(root);
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 47c1ba141082..222d6aea4a8a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -315,12 +315,6 @@ get_caching_control(struct btrfs_block_group_cache *cache)
         struct btrfs_caching_control *ctl;
 
         spin_lock(&cache->lock);
-        if (cache->cached != BTRFS_CACHE_STARTED) {
-                spin_unlock(&cache->lock);
-                return NULL;
-        }
-
-        /* We're loading it the fast way, so we don't have a caching_ctl. */
         if (!cache->caching_ctl) {
                 spin_unlock(&cache->lock);
                 return NULL;
@@ -594,6 +588,7 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
         spin_unlock(&cache->lock);
 
         if (fs_info->mount_opt & BTRFS_MOUNT_SPACE_CACHE) {
+                mutex_lock(&caching_ctl->mutex);
                 ret = load_free_space_cache(fs_info, cache);
 
                 spin_lock(&cache->lock);
@@ -601,15 +596,19 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
                         cache->caching_ctl = NULL;
                         cache->cached = BTRFS_CACHE_FINISHED;
                         cache->last_byte_to_unpin = (u64)-1;
+                        caching_ctl->progress = (u64)-1;
                 } else {
                         if (load_cache_only) {
                                 cache->caching_ctl = NULL;
                                 cache->cached = BTRFS_CACHE_NO;
                         } else {
                                 cache->cached = BTRFS_CACHE_STARTED;
+                                cache->has_caching_ctl = 1;
                         }
                 }
                 spin_unlock(&cache->lock);
+                mutex_unlock(&caching_ctl->mutex);
+
                 wake_up(&caching_ctl->wait);
                 if (ret == 1) {
                         put_caching_control(caching_ctl);
@@ -627,6 +626,7 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
                         cache->cached = BTRFS_CACHE_NO;
                 } else {
                         cache->cached = BTRFS_CACHE_STARTED;
+                        cache->has_caching_ctl = 1;
                 }
                 spin_unlock(&cache->lock);
                 wake_up(&caching_ctl->wait);
@@ -3162,7 +3162,19 @@ next_block_group(struct btrfs_root *root,
                  struct btrfs_block_group_cache *cache)
 {
         struct rb_node *node;
+
         spin_lock(&root->fs_info->block_group_cache_lock);
+
+        /* If our block group was removed, we need a full search. */
+        if (RB_EMPTY_NODE(&cache->cache_node)) {
+                const u64 next_bytenr = cache->key.objectid + cache->key.offset;
+
+                spin_unlock(&root->fs_info->block_group_cache_lock);
+                btrfs_put_block_group(cache);
+                cache = btrfs_lookup_first_block_group(root->fs_info,
+                                                       next_bytenr);
+                return cache;
+        }
         node = rb_next(&cache->cache_node);
         btrfs_put_block_group(cache);
         if (node) {
@@ -3504,6 +3516,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->chunk_alloc = 0;
         found->flush = 0;
         init_waitqueue_head(&found->wait);
+        INIT_LIST_HEAD(&found->ro_bgs);
 
         ret = kobject_init_and_add(&found->kobj, &space_info_ktype,
                                     info->space_info_kobj, "%s",
@@ -5425,7 +5438,17 @@ static int update_block_group(struct btrfs_root *root,
                         spin_unlock(&cache->space_info->lock);
                 } else {
                         old_val -= num_bytes;
+                        btrfs_set_block_group_used(&cache->item, old_val);
+                        cache->pinned += num_bytes;
+                        cache->space_info->bytes_pinned += num_bytes;
+                        cache->space_info->bytes_used -= num_bytes;
+                        cache->space_info->disk_used -= num_bytes * factor;
+                        spin_unlock(&cache->lock);
+                        spin_unlock(&cache->space_info->lock);
 
+                        set_extent_dirty(info->pinned_extents,
+                                         bytenr, bytenr + num_bytes - 1,
+                                         GFP_NOFS | __GFP_NOFAIL);
                         /*
                          * No longer have used bytes in this block group, queue
                          * it for deletion.
@@ -5439,17 +5462,6 @@ static int update_block_group(struct btrfs_root *root,
                                 }
                                 spin_unlock(&info->unused_bgs_lock);
                         }
-                        btrfs_set_block_group_used(&cache->item, old_val);
-                        cache->pinned += num_bytes;
-                        cache->space_info->bytes_pinned += num_bytes;
-                        cache->space_info->bytes_used -= num_bytes;
-                        cache->space_info->disk_used -= num_bytes * factor;
-                        spin_unlock(&cache->lock);
-                        spin_unlock(&cache->space_info->lock);
-
-                        set_extent_dirty(info->pinned_extents,
-                                         bytenr, bytenr + num_bytes - 1,
-                                         GFP_NOFS | __GFP_NOFAIL);
                 }
                 btrfs_put_block_group(cache);
                 total -= num_bytes;
@@ -8511,6 +8523,7 @@ static int set_block_group_ro(struct btrfs_block_group_cache *cache, int force)
             min_allocable_bytes <= sinfo->total_bytes) {
                 sinfo->bytes_readonly += num_bytes;
                 cache->ro = 1;
+                list_add_tail(&cache->ro_list, &sinfo->ro_bgs);
                 ret = 0;
         }
 out:
@@ -8565,15 +8578,20 @@ int btrfs_force_chunk_alloc(struct btrfs_trans_handle *trans,
 
 /*
  * helper to account the unused space of all the readonly block group in the
- * list. takes mirrors into account.
+ * space_info. takes mirrors into account.
  */
-static u64 __btrfs_get_ro_block_group_free_space(struct list_head *groups_list)
+u64 btrfs_account_ro_block_groups_free_space(struct btrfs_space_info *sinfo)
 {
         struct btrfs_block_group_cache *block_group;
         u64 free_bytes = 0;
         int factor;
 
-        list_for_each_entry(block_group, groups_list, list) {
+        /* It's df, we don't care if it's racey */
+        if (list_empty(&sinfo->ro_bgs))
+                return 0;
+
+        spin_lock(&sinfo->lock);
+        list_for_each_entry(block_group, &sinfo->ro_bgs, ro_list) {
                 spin_lock(&block_group->lock);
 
                 if (!block_group->ro) {
@@ -8594,26 +8612,6 @@ static u64 __btrfs_get_ro_block_group_free_space(struct list_head *groups_list)
 
                 spin_unlock(&block_group->lock);
         }
-
-        return free_bytes;
-}
-
-/*
- * helper to account the unused space of all the readonly block group in the
- * space_info. takes mirrors into account.
- */
-u64 btrfs_account_ro_block_groups_free_space(struct btrfs_space_info *sinfo)
-{
-        int i;
-        u64 free_bytes = 0;
-
-        spin_lock(&sinfo->lock);
-
-        for (i = 0; i < BTRFS_NR_RAID_TYPES; i++)
-                if (!list_empty(&sinfo->block_groups[i]))
-                        free_bytes += __btrfs_get_ro_block_group_free_space(
-                                                &sinfo->block_groups[i]);
-
         spin_unlock(&sinfo->lock);
 
         return free_bytes;
@@ -8633,6 +8631,7 @@ void btrfs_set_block_group_rw(struct btrfs_root *root,
                     cache->bytes_super - btrfs_block_group_used(&cache->item);
         sinfo->bytes_readonly -= num_bytes;
         cache->ro = 0;
+        list_del_init(&cache->ro_list);
         spin_unlock(&cache->lock);
         spin_unlock(&sinfo->lock);
 }
@@ -9002,7 +9001,9 @@ btrfs_create_block_group_cache(struct btrfs_root *root, u64 start, u64 size)
         INIT_LIST_HEAD(&cache->list);
         INIT_LIST_HEAD(&cache->cluster_list);
         INIT_LIST_HEAD(&cache->bg_list);
+        INIT_LIST_HEAD(&cache->ro_list);
         btrfs_init_free_space_ctl(cache);
+        atomic_set(&cache->trimming, 0);
 
         return cache;
 }
@@ -9195,9 +9196,8 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
         int ret = 0;
 
         list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
-                list_del_init(&block_group->bg_list);
                 if (ret)
-                        continue;
+                        goto next;
 
                 spin_lock(&block_group->lock);
                 memcpy(&item, &block_group->item, sizeof(item));
@@ -9212,6 +9212,8 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
                                                key.objectid, key.offset);
                 if (ret)
                         btrfs_abort_transaction(trans, extent_root, ret);
+next:
+                list_del_init(&block_group->bg_list);
         }
 }
 
@@ -9304,7 +9306,8 @@ static void clear_avail_alloc_bits(struct btrfs_fs_info *fs_info, u64 flags)
 }
 
 int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
-                             struct btrfs_root *root, u64 group_start)
+                             struct btrfs_root *root, u64 group_start,
+                             struct extent_map *em)
 {
         struct btrfs_path *path;
         struct btrfs_block_group_cache *block_group;
@@ -9316,6 +9319,8 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         int ret;
         int index;
         int factor;
+        struct btrfs_caching_control *caching_ctl = NULL;
+        bool remove_em;
 
         root = root->fs_info->extent_root;
 
@@ -9400,6 +9405,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         spin_lock(&root->fs_info->block_group_cache_lock);
         rb_erase(&block_group->cache_node,
                  &root->fs_info->block_group_cache_tree);
+        RB_CLEAR_NODE(&block_group->cache_node);
 
         if (root->fs_info->first_logical_byte == block_group->key.objectid)
                 root->fs_info->first_logical_byte = (u64)-1;
@@ -9411,6 +9417,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
          * are still on the list after taking the semaphore
          */
         list_del_init(&block_group->list);
+        list_del_init(&block_group->ro_list);
         if (list_empty(&block_group->space_info->block_groups[index])) {
                 kobj = block_group->space_info->block_group_kobjs[index];
                 block_group->space_info->block_group_kobjs[index] = NULL;
@@ -9422,8 +9429,32 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
                 kobject_put(kobj);
         }
 
+        if (block_group->has_caching_ctl)
+                caching_ctl = get_caching_control(block_group);
         if (block_group->cached == BTRFS_CACHE_STARTED)
                 wait_block_group_cache_done(block_group);
+        if (block_group->has_caching_ctl) {
+                down_write(&root->fs_info->commit_root_sem);
+                if (!caching_ctl) {
+                        struct btrfs_caching_control *ctl;
+
+                        list_for_each_entry(ctl,
+                                    &root->fs_info->caching_block_groups, list)
+                                if (ctl->block_group == block_group) {
+                                        caching_ctl = ctl;
+                                        atomic_inc(&caching_ctl->count);
+                                        break;
+                                }
+                }
+                if (caching_ctl)
+                        list_del_init(&caching_ctl->list);
+                up_write(&root->fs_info->commit_root_sem);
+                if (caching_ctl) {
+                        /* Once for the caching bgs list and once for us. */
+                        put_caching_control(caching_ctl);
+                        put_caching_control(caching_ctl);
+                }
+        }
 
         btrfs_remove_free_space_cache(block_group);
 
@@ -9435,6 +9466,71 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
 
         memcpy(&key, &block_group->key, sizeof(key));
 
+        lock_chunks(root);
+        if (!list_empty(&em->list)) {
+                /* We're in the transaction->pending_chunks list. */
+                free_extent_map(em);
+        }
+        spin_lock(&block_group->lock);
+        block_group->removed = 1;
+        /*
+         * At this point trimming can't start on this block group, because we
+         * removed the block group from the tree fs_info->block_group_cache_tree
+         * so no one can't find it anymore and even if someone already got this
+         * block group before we removed it from the rbtree, they have already
+         * incremented block_group->trimming - if they didn't, they won't find
+         * any free space entries because we already removed them all when we
+         * called btrfs_remove_free_space_cache().
+         *
+         * And we must not remove the extent map from the fs_info->mapping_tree
+         * to prevent the same logical address range and physical device space
+         * ranges from being reused for a new block group. This is because our
+         * fs trim operation (btrfs_trim_fs() / btrfs_ioctl_fitrim()) is
+         * completely transactionless, so while it is trimming a range the
+         * currently running transaction might finish and a new one start,
+         * allowing for new block groups to be created that can reuse the same
+         * physical device locations unless we take this special care.
+         */
+        remove_em = (atomic_read(&block_group->trimming) == 0);
+        /*
+         * Make sure a trimmer task always sees the em in the pinned_chunks list
+         * if it sees block_group->removed == 1 (needs to lock block_group->lock
+         * before checking block_group->removed).
+         */
+        if (!remove_em) {
+                /*
+                 * Our em might be in trans->transaction->pending_chunks which
+                 * is protected by fs_info->chunk_mutex ([lock|unlock]_chunks),
+                 * and so is the fs_info->pinned_chunks list.
+                 *
+                 * So at this point we must be holding the chunk_mutex to avoid
+                 * any races with chunk allocation (more specifically at
+                 * volumes.c:contains_pending_extent()), to ensure it always
+                 * sees the em, either in the pending_chunks list or in the
+                 * pinned_chunks list.
+                 */
+                list_move_tail(&em->list, &root->fs_info->pinned_chunks);
+        }
+        spin_unlock(&block_group->lock);
+
+        if (remove_em) {
+                struct extent_map_tree *em_tree;
+
+                em_tree = &root->fs_info->mapping_tree.map_tree;
+                write_lock(&em_tree->lock);
+                /*
+                 * The em might be in the pending_chunks list, so make sure the
+                 * chunk mutex is locked, since remove_extent_mapping() will
+                 * delete us from that list.
+                 */
+                remove_extent_mapping(em_tree, em);
+                write_unlock(&em_tree->lock);
+                /* once for the tree */
+                free_extent_map(em);
+        }
+
+        unlock_chunks(root);
+
         btrfs_put_block_group(block_group);
         btrfs_put_block_group(block_group);
 
@@ -9523,10 +9619,18 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
                  */
                 start = block_group->key.objectid;
                 end = start + block_group->key.offset - 1;
-                clear_extent_bits(&fs_info->freed_extents[0], start, end,
+                ret = clear_extent_bits(&fs_info->freed_extents[0], start, end,
                                   EXTENT_DIRTY, GFP_NOFS);
-                clear_extent_bits(&fs_info->freed_extents[1], start, end,
+                if (ret) {
+                        btrfs_set_block_group_rw(root, block_group);
+                        goto end_trans;
+                }
+                ret = clear_extent_bits(&fs_info->freed_extents[1], start, end,
                                   EXTENT_DIRTY, GFP_NOFS);
+                if (ret) {
+                        btrfs_set_block_group_rw(root, block_group);
+                        goto end_trans;
+                }
 
                 /* Reset pinned so btrfs_put_block_group doesn't complain */
                 block_group->pinned = 0;
@@ -9537,6 +9641,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
                  */
                 ret = btrfs_remove_chunk(trans, root,
                                          block_group->key.objectid);
+end_trans:
                 btrfs_end_transaction(trans, root);
 next:
                 btrfs_put_block_group(block_group);
@@ -9657,12 +9762,14 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range)
 }
 
 /*
- * btrfs_{start,end}_write() is similar to mnt_{want, drop}_write(),
- * they are used to prevent the some tasks writing data into the page cache
- * by nocow before the subvolume is snapshoted, but flush the data into
- * the disk after the snapshot creation.
+ * btrfs_{start,end}_write_no_snapshoting() are similar to
+ * mnt_{want,drop}_write(), they are used to prevent some tasks from writing
+ * data into the page cache through nocow before the subvolume is snapshoted,
+ * but flush the data into disk after the snapshot creation, or to prevent
+ * operations while snapshoting is ongoing and that cause the snapshot to be
+ * inconsistent (writes followed by expanding truncates for example).
  */
-void btrfs_end_nocow_write(struct btrfs_root *root)
+void btrfs_end_write_no_snapshoting(struct btrfs_root *root)
 {
         percpu_counter_dec(&root->subv_writers->counter);
         /*
@@ -9674,7 +9781,7 @@ void btrfs_end_nocow_write(struct btrfs_root *root)
                 wake_up(&root->subv_writers->wait);
 }
 
-int btrfs_start_nocow_write(struct btrfs_root *root)
+int btrfs_start_write_no_snapshoting(struct btrfs_root *root)
 {
         if (atomic_read(&root->will_be_snapshoted))
                 return 0;
@@ -9685,7 +9792,7 @@ int btrfs_start_nocow_write(struct btrfs_root *root)
          */
         smp_mb();
         if (atomic_read(&root->will_be_snapshoted)) {
-                btrfs_end_nocow_write(root);
+                btrfs_end_write_no_snapshoting(root);
                 return 0;
         }
         return 1;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index bf3f424e0013..4ebabd237153 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -595,9 +595,14 @@ int clear_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
                 clear = 1;
 again:
         if (!prealloc && (mask & __GFP_WAIT)) {
+                /*
+                 * Don't care for allocation failure here because we might end
+                 * up not needing the pre-allocated extent state at all, which
+                 * is the case if we only have in the tree extent states that
+                 * cover our input range and don't cover too any other range.
+                 * If we end up needing a new extent state we allocate it later.
+                 */
                 prealloc = alloc_extent_state(mask);
-                if (!prealloc)
-                        return -ENOMEM;
         }
 
         spin_lock(&tree->lock);
@@ -796,17 +801,25 @@ static void set_state_bits(struct extent_io_tree *tree,
         state->state |= bits_to_set;
 }
 
-static void cache_state(struct extent_state *state,
-                        struct extent_state **cached_ptr)
+static void cache_state_if_flags(struct extent_state *state,
+                                 struct extent_state **cached_ptr,
+                                 const u64 flags)
 {
         if (cached_ptr && !(*cached_ptr)) {
-                if (state->state & (EXTENT_IOBITS | EXTENT_BOUNDARY)) {
+                if (!flags || (state->state & flags)) {
                         *cached_ptr = state;
                         atomic_inc(&state->refs);
                 }
         }
 }
 
+static void cache_state(struct extent_state *state,
+                        struct extent_state **cached_ptr)
+{
+        return cache_state_if_flags(state, cached_ptr,
+                                    EXTENT_IOBITS | EXTENT_BOUNDARY);
+}
+
 /*
  * set some bits on a range in the tree.  This may require allocations or
  * sleeping, so the gfp mask is used to indicate what is allowed.
@@ -1058,13 +1071,21 @@ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
         int err = 0;
         u64 last_start;
         u64 last_end;
+        bool first_iteration = true;
 
         btrfs_debug_check_extent_io_range(tree, start, end);
 
 again:
         if (!prealloc && (mask & __GFP_WAIT)) {
+                /*
+                 * Best effort, don't worry if extent state allocation fails
+                 * here for the first iteration. We might have a cached state
+                 * that matches exactly the target range, in which case no
+                 * extent state allocations are needed. We'll only know this
+                 * after locking the tree.
+                 */
                 prealloc = alloc_extent_state(mask);
-                if (!prealloc)
+                if (!prealloc && !first_iteration)
                         return -ENOMEM;
         }
 
@@ -1234,6 +1255,7 @@ search_again:
         spin_unlock(&tree->lock);
         if (mask & __GFP_WAIT)
                 cond_resched();
+        first_iteration = false;
         goto again;
 }
 
@@ -1482,7 +1504,7 @@ int find_first_extent_bit(struct extent_io_tree *tree, u64 start,
         state = find_first_extent_bit_state(tree, start, bits);
 got_it:
         if (state) {
-                cache_state(state, cached_state);
+                cache_state_if_flags(state, cached_state, 0);
                 *start_ret = state->start;
                 *end_ret = state->end;
                 ret = 0;
@@ -1746,6 +1768,9 @@ int extent_clear_unlock_delalloc(struct inode *inode, u64 start, u64 end,
         if (page_ops == 0)
                 return 0;
 
+        if ((page_ops & PAGE_SET_ERROR) && nr_pages > 0)
+                mapping_set_error(inode->i_mapping, -EIO);
+
         while (nr_pages > 0) {
                 ret = find_get_pages_contig(inode->i_mapping, index,
                                      min_t(unsigned long,
@@ -1763,6 +1788,8 @@ int extent_clear_unlock_delalloc(struct inode *inode, u64 start, u64 end,
                                 clear_page_dirty_for_io(pages[i]);
                         if (page_ops & PAGE_SET_WRITEBACK)
                                 set_page_writeback(pages[i]);
+                        if (page_ops & PAGE_SET_ERROR)
+                                SetPageError(pages[i]);
                         if (page_ops & PAGE_END_WRITEBACK)
                                 end_page_writeback(pages[i]);
                         if (page_ops & PAGE_UNLOCK)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 6d4b938be986..ece9ce87edff 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -49,6 +49,7 @@
 #define PAGE_SET_WRITEBACK      (1 << 2)
 #define PAGE_END_WRITEBACK      (1 << 3)
 #define PAGE_SET_PRIVATE2       (1 << 4)
+#define PAGE_SET_ERROR          (1 << 5)
 
 /*
  * page->private values.  Every page that is controlled by the extent
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 225302b39afb..6a98bddd8f33 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -287,8 +287,6 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len,
         if (!em)
                 goto out;
 
-        if (!test_bit(EXTENT_FLAG_LOGGING, &em->flags))
-                list_move(&em->list, &tree->modified_extents);
         em->generation = gen;
         clear_bit(EXTENT_FLAG_PINNED, &em->flags);
         em->mod_start = em->start;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a18ceabd99a8..e4090259569b 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1428,7 +1428,7 @@ static noinline int check_can_nocow(struct inode *inode, loff_t pos,
         u64 num_bytes;
         int ret;
 
-        ret = btrfs_start_nocow_write(root);
+        ret = btrfs_start_write_no_snapshoting(root);
         if (!ret)
                 return -ENOSPC;
 
@@ -1451,7 +1451,7 @@ static noinline int check_can_nocow(struct inode *inode, loff_t pos,
         ret = can_nocow_extent(inode, lockstart, &num_bytes, NULL, NULL, NULL);
         if (ret <= 0) {
                 ret = 0;
-                btrfs_end_nocow_write(root);
+                btrfs_end_write_no_snapshoting(root);
         } else {
                 *write_bytes = min_t(size_t, *write_bytes ,
                                      num_bytes - pos + lockstart);
@@ -1543,7 +1543,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                                 btrfs_free_reserved_data_space(inode,
                                                                reserve_bytes);
                         else
-                                btrfs_end_nocow_write(root);
+                                btrfs_end_write_no_snapshoting(root);
                         break;
                 }
 
@@ -1632,7 +1632,7 @@ again:
 
                 release_bytes = 0;
                 if (only_release_metadata)
-                        btrfs_end_nocow_write(root);
+                        btrfs_end_write_no_snapshoting(root);
 
                 if (only_release_metadata && copied > 0) {
                         u64 lockstart = round_down(pos, root->sectorsize);
@@ -1661,7 +1661,7 @@ again:
 
         if (release_bytes) {
                 if (only_release_metadata) {
-                        btrfs_end_nocow_write(root);
+                        btrfs_end_write_no_snapshoting(root);
                         btrfs_delalloc_release_metadata(inode, release_bytes);
                 } else {
                         btrfs_delalloc_release_space(inode, release_bytes);
@@ -1676,6 +1676,7 @@ static ssize_t __btrfs_direct_write(struct kiocb *iocb,
                                     loff_t pos)
 {
         struct file *file = iocb->ki_filp;
+        struct inode *inode = file_inode(file);
         ssize_t written;
         ssize_t written_buffered;
         loff_t endbyte;
@@ -1692,8 +1693,15 @@ static ssize_t __btrfs_direct_write(struct kiocb *iocb,
                 err = written_buffered;
                 goto out;
         }
+        /*
+         * Ensure all data is persisted. We want the next direct IO read to be
+         * able to read what was just written.
+         */
         endbyte = pos + written_buffered - 1;
-        err = filemap_write_and_wait_range(file->f_mapping, pos, endbyte);
+        err = btrfs_fdatawrite_range(inode, pos, endbyte);
+        if (err)
+                goto out;
+        err = filemap_fdatawait_range(inode->i_mapping, pos, endbyte);
         if (err)
                 goto out;
         written += written_buffered;
@@ -1854,10 +1862,7 @@ static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end)
         int ret;
 
         atomic_inc(&BTRFS_I(inode)->sync_writers);
-        ret = filemap_fdatawrite_range(inode->i_mapping, start, end);
-        if (!ret && test_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
-                             &BTRFS_I(inode)->runtime_flags))
-                ret = filemap_fdatawrite_range(inode->i_mapping, start, end);
+        ret = btrfs_fdatawrite_range(inode, start, end);
         atomic_dec(&BTRFS_I(inode)->sync_writers);
 
         return ret;
@@ -2810,3 +2815,29 @@ int btrfs_auto_defrag_init(void)
 
         return 0;
 }
+
+int btrfs_fdatawrite_range(struct inode *inode, loff_t start, loff_t end)
+{
+        int ret;
+
+        /*
+         * So with compression we will find and lock a dirty page and clear the
+         * first one as dirty, setup an async extent, and immediately return
+         * with the entire range locked but with nobody actually marked with
+         * writeback.  So we can't just filemap_write_and_wait_range() and
+         * expect it to work since it will just kick off a thread to do the
+         * actual work.  So we need to call filemap_fdatawrite_range _again_
+         * since it will wait on the page lock, which won't be unlocked until
+         * after the pages have been marked as writeback and so we're good to go
+         * from there.  We have to do this otherwise we'll miss the ordered
+         * extents and that results in badness.  Please Josef, do not think you
+         * know better and pull this out at some point in the future, it is
+         * right and you are wrong.
+         */
+        ret = filemap_fdatawrite_range(inode->i_mapping, start, end);
+        if (!ret && test_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
+                             &BTRFS_I(inode)->runtime_flags))
+                ret = filemap_fdatawrite_range(inode->i_mapping, start, end);
+
+        return ret;
+}
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 33848196550e..030847bf7cec 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -27,10 +27,17 @@
 #include "disk-io.h"
 #include "extent_io.h"
 #include "inode-map.h"
+#include "volumes.h"
 
 #define BITS_PER_BITMAP         (PAGE_CACHE_SIZE * 8)
 #define MAX_CACHE_BYTES_PER_GIG (32 * 1024)
 
+struct btrfs_trim_range {
+        u64 start;
+        u64 bytes;
+        struct list_head list;
+};
+
 static int link_free_space(struct btrfs_free_space_ctl *ctl,
                            struct btrfs_free_space *info);
 static void unlink_free_space(struct btrfs_free_space_ctl *ctl,
@@ -881,6 +888,7 @@ int write_cache_extent_entries(struct io_ctl *io_ctl,
         int ret;
         struct btrfs_free_cluster *cluster = NULL;
         struct rb_node *node = rb_first(&ctl->free_space_offset);
+        struct btrfs_trim_range *trim_entry;
 
         /* Get the cluster for this block_group if it exists */
         if (block_group && !list_empty(&block_group->cluster_list)) {
@@ -916,6 +924,21 @@ int write_cache_extent_entries(struct io_ctl *io_ctl,
                         cluster = NULL;
                 }
         }
+
+        /*
+         * Make sure we don't miss any range that was removed from our rbtree
+         * because trimming is running. Otherwise after a umount+mount (or crash
+         * after committing the transaction) we would leak free space and get
+         * an inconsistent free space cache report from fsck.
+         */
+        list_for_each_entry(trim_entry, &ctl->trimming_ranges, list) {
+                ret = io_ctl_add_entry(io_ctl, trim_entry->start,
+                                       trim_entry->bytes, NULL);
+                if (ret)
+                        goto fail;
+                *entries += 1;
+        }
+
         return 0;
 fail:
         return -ENOSPC;
@@ -1135,12 +1158,15 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
 
         io_ctl_set_generation(&io_ctl, trans->transid);
 
+        mutex_lock(&ctl->cache_writeout_mutex);
         /* Write out the extent entries in the free space cache */
         ret = write_cache_extent_entries(&io_ctl, ctl,
                                          block_group, &entries, &bitmaps,
                                          &bitmap_list);
-        if (ret)
+        if (ret) {
+                mutex_unlock(&ctl->cache_writeout_mutex);
                 goto out_nospc;
+        }
 
         /*
          * Some spaces that are freed in the current transaction are pinned,
@@ -1148,11 +1174,18 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
          * committed, we shouldn't lose them.
          */
         ret = write_pinned_extent_entries(root, block_group, &io_ctl, &entries);
-        if (ret)
+        if (ret) {
+                mutex_unlock(&ctl->cache_writeout_mutex);
                 goto out_nospc;
+        }
 
-        /* At last, we write out all the bitmaps. */
+        /*
+         * At last, we write out all the bitmaps and keep cache_writeout_mutex
+         * locked while doing it because a concurrent trim can be manipulating
+         * or freeing the bitmap.
+         */
         ret = write_bitmap_entries(&io_ctl, &bitmap_list);
+        mutex_unlock(&ctl->cache_writeout_mutex);
         if (ret)
                 goto out_nospc;
 
@@ -2295,6 +2328,8 @@ void btrfs_init_free_space_ctl(struct btrfs_block_group_cache *block_group)
         ctl->start = block_group->key.objectid;
         ctl->private = block_group;
         ctl->op = &free_space_op;
+        INIT_LIST_HEAD(&ctl->trimming_ranges);
+        mutex_init(&ctl->cache_writeout_mutex);
 
         /*
          * we only want to have 32k of ram per block group for keeping
@@ -2911,10 +2946,12 @@ void btrfs_init_free_cluster(struct btrfs_free_cluster *cluster)
 
 static int do_trimming(struct btrfs_block_group_cache *block_group,
                        u64 *total_trimmed, u64 start, u64 bytes,
-                       u64 reserved_start, u64 reserved_bytes)
+                       u64 reserved_start, u64 reserved_bytes,
+                       struct btrfs_trim_range *trim_entry)
 {
         struct btrfs_space_info *space_info = block_group->space_info;
         struct btrfs_fs_info *fs_info = block_group->fs_info;
+        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
         int ret;
         int update = 0;
         u64 trimmed = 0;
@@ -2934,7 +2971,10 @@ static int do_trimming(struct btrfs_block_group_cache *block_group,
         if (!ret)
                 *total_trimmed += trimmed;
 
+        mutex_lock(&ctl->cache_writeout_mutex);
         btrfs_add_free_space(block_group, reserved_start, reserved_bytes);
+        list_del(&trim_entry->list);
+        mutex_unlock(&ctl->cache_writeout_mutex);
 
         if (update) {
                 spin_lock(&space_info->lock);
@@ -2962,16 +3002,21 @@ static int trim_no_bitmap(struct btrfs_block_group_cache *block_group,
         u64 bytes;
 
         while (start < end) {
+                struct btrfs_trim_range trim_entry;
+
+                mutex_lock(&ctl->cache_writeout_mutex);
                 spin_lock(&ctl->tree_lock);
 
                 if (ctl->free_space < minlen) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         break;
                 }
 
                 entry = tree_search_offset(ctl, start, 0, 1);
                 if (!entry) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         break;
                 }
 
@@ -2980,6 +3025,7 @@ static int trim_no_bitmap(struct btrfs_block_group_cache *block_group,
                         node = rb_next(&entry->offset_index);
                         if (!node) {
                                 spin_unlock(&ctl->tree_lock);
+                                mutex_unlock(&ctl->cache_writeout_mutex);
                                 goto out;
                         }
                         entry = rb_entry(node, struct btrfs_free_space,
@@ -2988,6 +3034,7 @@ static int trim_no_bitmap(struct btrfs_block_group_cache *block_group,
 
                 if (entry->offset >= end) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         break;
                 }
 
@@ -2997,6 +3044,7 @@ static int trim_no_bitmap(struct btrfs_block_group_cache *block_group,
                 bytes = min(extent_start + extent_bytes, end) - start;
                 if (bytes < minlen) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         goto next;
                 }
 
@@ -3004,9 +3052,13 @@ static int trim_no_bitmap(struct btrfs_block_group_cache *block_group,
                 kmem_cache_free(btrfs_free_space_cachep, entry);
 
                 spin_unlock(&ctl->tree_lock);
+                trim_entry.start = extent_start;
+                trim_entry.bytes = extent_bytes;
+                list_add_tail(&trim_entry.list, &ctl->trimming_ranges);
+                mutex_unlock(&ctl->cache_writeout_mutex);
 
                 ret = do_trimming(block_group, total_trimmed, start, bytes,
-                                  extent_start, extent_bytes);
+                                  extent_start, extent_bytes, &trim_entry);
                 if (ret)
                         break;
 next:
@@ -3035,17 +3087,21 @@ static int trim_bitmaps(struct btrfs_block_group_cache *block_group,
 
         while (offset < end) {
                 bool next_bitmap = false;
+                struct btrfs_trim_range trim_entry;
 
+                mutex_lock(&ctl->cache_writeout_mutex);
                 spin_lock(&ctl->tree_lock);
 
                 if (ctl->free_space < minlen) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         break;
                 }
 
                 entry = tree_search_offset(ctl, offset, 1, 0);
                 if (!entry) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         next_bitmap = true;
                         goto next;
                 }
@@ -3054,6 +3110,7 @@ static int trim_bitmaps(struct btrfs_block_group_cache *block_group,
                 ret2 = search_bitmap(ctl, entry, &start, &bytes);
                 if (ret2 || start >= end) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         next_bitmap = true;
                         goto next;
                 }
@@ -3061,6 +3118,7 @@ static int trim_bitmaps(struct btrfs_block_group_cache *block_group,
                 bytes = min(bytes, end - start);
                 if (bytes < minlen) {
                         spin_unlock(&ctl->tree_lock);
+                        mutex_unlock(&ctl->cache_writeout_mutex);
                         goto next;
                 }
 
@@ -3069,9 +3127,13 @@ static int trim_bitmaps(struct btrfs_block_group_cache *block_group,
                         free_bitmap(ctl, entry);
 
                 spin_unlock(&ctl->tree_lock);
+                trim_entry.start = start;
+                trim_entry.bytes = bytes;
+                list_add_tail(&trim_entry.list, &ctl->trimming_ranges);
+                mutex_unlock(&ctl->cache_writeout_mutex);
 
                 ret = do_trimming(block_group, total_trimmed, start, bytes,
-                                  start, bytes);
+                                  start, bytes, &trim_entry);
                 if (ret)
                         break;
 next:
@@ -3101,11 +3163,52 @@ int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
 
         *trimmed = 0;
 
+        spin_lock(&block_group->lock);
+        if (block_group->removed) {
+                spin_unlock(&block_group->lock);
+                return 0;
+        }
+        atomic_inc(&block_group->trimming);
+        spin_unlock(&block_group->lock);
+
         ret = trim_no_bitmap(block_group, trimmed, start, end, minlen);
         if (ret)
-                return ret;
+                goto out;
 
         ret = trim_bitmaps(block_group, trimmed, start, end, minlen);
+out:
+        spin_lock(&block_group->lock);
+        if (atomic_dec_and_test(&block_group->trimming) &&
+            block_group->removed) {
+                struct extent_map_tree *em_tree;
+                struct extent_map *em;
+
+                spin_unlock(&block_group->lock);
+
+                em_tree = &block_group->fs_info->mapping_tree.map_tree;
+                write_lock(&em_tree->lock);
+                em = lookup_extent_mapping(em_tree, block_group->key.objectid,
+                                           1);
+                BUG_ON(!em); /* logic error, can't happen */
+                remove_extent_mapping(em_tree, em);
+                write_unlock(&em_tree->lock);
+
+                lock_chunks(block_group->fs_info->chunk_root);
+                list_del_init(&em->list);
+                unlock_chunks(block_group->fs_info->chunk_root);
+
+                /* once for us and once for the tree */
+                free_extent_map(em);
+                free_extent_map(em);
+
+                /*
+                 * We've left one free space entry and other tasks trimming
+                 * this block group have left 1 entry each one. Free them.
+                 */
+                __btrfs_remove_free_space_cache(block_group->free_space_ctl);
+        } else {
+                spin_unlock(&block_group->lock);
+        }
 
         return ret;
 }
diff --git a/fs/btrfs/free-space-cache.h b/fs/btrfs/free-space-cache.h
index 0cf4977ef70d..88b2238a0aed 100644
--- a/fs/btrfs/free-space-cache.h
+++ b/fs/btrfs/free-space-cache.h
@@ -38,6 +38,8 @@ struct btrfs_free_space_ctl {
         u64 start;
         struct btrfs_free_space_op *op;
         void *private;
+        struct mutex cache_writeout_mutex;
+        struct list_head trimming_ranges;
 };
 
 struct btrfs_free_space_op {
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 83d646bd2e4b..74faea3a516e 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -178,7 +178,7 @@ static void start_caching(struct btrfs_root *root)
                           root->root_key.objectid);
         if (IS_ERR(tsk)) {
                 btrfs_warn(root->fs_info, "failed to start inode caching task");
-                btrfs_clear_and_info(root, CHANGE_INODE_CACHE,
+                btrfs_clear_pending_and_info(root->fs_info, INODE_MAP_CACHE,
                                 "disabling inode map caching");
         }
 }
@@ -364,6 +364,8 @@ void btrfs_init_free_ino_ctl(struct btrfs_root *root)
         ctl->start = 0;
         ctl->private = NULL;
         ctl->op = &free_ino_op;
+        INIT_LIST_HEAD(&ctl->trimming_ranges);
+        mutex_init(&ctl->cache_writeout_mutex);
 
         /*
          * Initially we allow to use 16K of ram to cache chunks of
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ff0dcc016b71..e687bb0dc73a 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -382,7 +382,7 @@ static inline int inode_need_compress(struct inode *inode)
  * are written in the same order that the flusher thread sent them
  * down.
  */
-static noinline int compress_file_range(struct inode *inode,
+static noinline void compress_file_range(struct inode *inode,
                                         struct page *locked_page,
                                         u64 start, u64 end,
                                         struct async_cow *async_cow,
@@ -411,14 +411,6 @@ static noinline int compress_file_range(struct inode *inode,
             (start > 0 || end + 1 < BTRFS_I(inode)->disk_i_size))
                 btrfs_add_inode_defrag(NULL, inode);
 
-        /*
-         * skip compression for a small file range(<=blocksize) that
-         * isn't an inline extent, since it dosen't save disk space at all.
-         */
-        if ((end - start + 1) <= blocksize &&
-            (start > 0 || end + 1 < BTRFS_I(inode)->disk_i_size))
-                goto cleanup_and_bail_uncompressed;
-
         actual_end = min_t(u64, isize, end + 1);
 again:
         will_compress = 0;
@@ -440,6 +432,14 @@ again:
 
         total_compressed = actual_end - start;
 
+        /*
+         * skip compression for a small file range(<=blocksize) that
+         * isn't an inline extent, since it dosen't save disk space at all.
+         */
+        if (total_compressed <= blocksize &&
+           (start > 0 || end + 1 < BTRFS_I(inode)->disk_i_size))
+                goto cleanup_and_bail_uncompressed;
+
         /* we want to make sure that amount of ram required to uncompress
          * an extent is reasonable, so we limit the total size in ram
          * of a compressed extent to 128k.  This is a crucial number
@@ -527,7 +527,10 @@ cont:
                 if (ret <= 0) {
                         unsigned long clear_flags = EXTENT_DELALLOC |
                                 EXTENT_DEFRAG;
+                        unsigned long page_error_op;
+
                         clear_flags |= (ret < 0) ? EXTENT_DO_ACCOUNTING : 0;
+                        page_error_op = ret < 0 ? PAGE_SET_ERROR : 0;
 
                         /*
                          * inline extent creation worked or returned error,
@@ -538,6 +541,7 @@ cont:
                                                      clear_flags, PAGE_UNLOCK |
                                                      PAGE_CLEAR_DIRTY |
                                                      PAGE_SET_WRITEBACK |
+                                                     page_error_op |
                                                      PAGE_END_WRITEBACK);
                         goto free_pages_out;
                 }
@@ -620,8 +624,7 @@ cleanup_and_bail_uncompressed:
                 *num_added += 1;
         }
 
-out:
-        return ret;
+        return;
 
 free_pages_out:
         for (i = 0; i < nr_pages_ret; i++) {
@@ -629,8 +632,22 @@ free_pages_out:
                 page_cache_release(pages[i]);
         }
         kfree(pages);
+}
 
-        goto out;
+static void free_async_extent_pages(struct async_extent *async_extent)
+{
+        int i;
+
+        if (!async_extent->pages)
+                return;
+
+        for (i = 0; i < async_extent->nr_pages; i++) {
+                WARN_ON(async_extent->pages[i]->mapping);
+                page_cache_release(async_extent->pages[i]);
+        }
+        kfree(async_extent->pages);
+        async_extent->nr_pages = 0;
+        async_extent->pages = NULL;
 }
 
 /*
@@ -639,7 +656,7 @@ free_pages_out:
  * queued.  We walk all the async extents created by compress_file_range
  * and send them down to the disk.
  */
-static noinline int submit_compressed_extents(struct inode *inode,
+static noinline void submit_compressed_extents(struct inode *inode,
                                               struct async_cow *async_cow)
 {
         struct async_extent *async_extent;
@@ -651,9 +668,6 @@ static noinline int submit_compressed_extents(struct inode *inode,
         struct extent_io_tree *io_tree;
         int ret = 0;
 
-        if (list_empty(&async_cow->extents))
-                return 0;
-
 again:
         while (!list_empty(&async_cow->extents)) {
                 async_extent = list_entry(async_cow->extents.next,
@@ -709,15 +723,7 @@ retry:
                                            async_extent->compressed_size,
                                            0, alloc_hint, &ins, 1, 1);
                 if (ret) {
-                        int i;
-
-                        for (i = 0; i < async_extent->nr_pages; i++) {
-                                WARN_ON(async_extent->pages[i]->mapping);
-                                page_cache_release(async_extent->pages[i]);
-                        }
-                        kfree(async_extent->pages);
-                        async_extent->nr_pages = 0;
-                        async_extent->pages = NULL;
+                        free_async_extent_pages(async_extent);
 
                         if (ret == -ENOSPC) {
                                 unlock_extent(io_tree, async_extent->start,
@@ -814,15 +820,26 @@ retry:
                                     ins.objectid,
                                     ins.offset, async_extent->pages,
                                     async_extent->nr_pages);
+                if (ret) {
+                        struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
+                        struct page *p = async_extent->pages[0];
+                        const u64 start = async_extent->start;
+                        const u64 end = start + async_extent->ram_size - 1;
+
+                        p->mapping = inode->i_mapping;
+                        tree->ops->writepage_end_io_hook(p, start, end,
+                                                         NULL, 0);
+                        p->mapping = NULL;
+                        extent_clear_unlock_delalloc(inode, start, end, NULL, 0,
+                                                     PAGE_END_WRITEBACK |
+                                                     PAGE_SET_ERROR);
+                        free_async_extent_pages(async_extent);
+                }
                 alloc_hint = ins.objectid + ins.offset;
                 kfree(async_extent);
-                if (ret)
-                        goto out;
                 cond_resched();
         }
-        ret = 0;
-out:
-        return ret;
+        return;
 out_free_reserve:
         btrfs_free_reserved_extent(root, ins.objectid, ins.offset, 1);
 out_free:
@@ -832,7 +849,9 @@ out_free:
                                      NULL, EXTENT_LOCKED | EXTENT_DELALLOC |
                                      EXTENT_DEFRAG | EXTENT_DO_ACCOUNTING,
                                      PAGE_UNLOCK | PAGE_CLEAR_DIRTY |
-                                     PAGE_SET_WRITEBACK | PAGE_END_WRITEBACK);
+                                     PAGE_SET_WRITEBACK | PAGE_END_WRITEBACK |
+                                     PAGE_SET_ERROR);
+        free_async_extent_pages(async_extent);
         kfree(async_extent);
         goto again;
 }
@@ -1318,7 +1337,7 @@ next_slot:
                          * we fall into common COW way.
                          */
                         if (!nolock) {
-                                err = btrfs_start_nocow_write(root);
+                                err = btrfs_start_write_no_snapshoting(root);
                                 if (!err)
                                         goto out_check;
                         }
@@ -1342,7 +1361,7 @@ out_check:
                 if (extent_end <= start) {
                         path->slots[0]++;
                         if (!nolock && nocow)
-                                btrfs_end_nocow_write(root);
+                                btrfs_end_write_no_snapshoting(root);
                         goto next_slot;
                 }
                 if (!nocow) {
@@ -1362,7 +1381,7 @@ out_check:
                                              page_started, nr_written, 1);
                         if (ret) {
                                 if (!nolock && nocow)
-                                        btrfs_end_nocow_write(root);
+                                        btrfs_end_write_no_snapshoting(root);
                                 goto error;
                         }
                         cow_start = (u64)-1;
@@ -1413,7 +1432,7 @@ out_check:
                                                       num_bytes);
                         if (ret) {
                                 if (!nolock && nocow)
-                                        btrfs_end_nocow_write(root);
+                                        btrfs_end_write_no_snapshoting(root);
                                 goto error;
                         }
                 }
@@ -1424,7 +1443,7 @@ out_check:
                                              EXTENT_DELALLOC, PAGE_UNLOCK |
                                              PAGE_SET_PRIVATE2);
                 if (!nolock && nocow)
-                        btrfs_end_nocow_write(root);
+                        btrfs_end_write_no_snapshoting(root);
                 cur_offset = extent_end;
                 if (cur_offset > end)
                         break;
@@ -4580,6 +4599,26 @@ next:
         return err;
 }
 
+static int wait_snapshoting_atomic_t(atomic_t *a)
+{
+        schedule();
+        return 0;
+}
+
+static void wait_for_snapshot_creation(struct btrfs_root *root)
+{
+        while (true) {
+                int ret;
+
+                ret = btrfs_start_write_no_snapshoting(root);
+                if (ret)
+                        break;
+                wait_on_atomic_t(&root->will_be_snapshoted,
+                                 wait_snapshoting_atomic_t,
+                                 TASK_UNINTERRUPTIBLE);
+        }
+}
+
 static int btrfs_setsize(struct inode *inode, struct iattr *attr)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -4604,17 +4643,30 @@ static int btrfs_setsize(struct inode *inode, struct iattr *attr)
 
         if (newsize > oldsize) {
                 truncate_pagecache(inode, newsize);
+                /*
+                 * Don't do an expanding truncate while snapshoting is ongoing.
+                 * This is to ensure the snapshot captures a fully consistent
+                 * state of this file - if the snapshot captures this expanding
+                 * truncation, it must capture all writes that happened before
+                 * this truncation.
+                 */
+                wait_for_snapshot_creation(root);
                 ret = btrfs_cont_expand(inode, oldsize, newsize);
-                if (ret)
+                if (ret) {
+                        btrfs_end_write_no_snapshoting(root);
                         return ret;
+                }
 
                 trans = btrfs_start_transaction(root, 1);
-                if (IS_ERR(trans))
+                if (IS_ERR(trans)) {
+                        btrfs_end_write_no_snapshoting(root);
                         return PTR_ERR(trans);
+                }
 
                 i_size_write(inode, newsize);
                 btrfs_ordered_update_i_size(inode, i_size_read(inode), NULL);
                 ret = btrfs_update_inode(trans, root, inode);
+                btrfs_end_write_no_snapshoting(root);
                 btrfs_end_transaction(trans, root);
         } else {
 
@@ -7000,9 +7052,12 @@ static int lock_extent_direct(struct inode *inode, u64 lockstart, u64 lockend,
                         btrfs_put_ordered_extent(ordered);
                 } else {
                         /* Screw you mmap */
-                        ret = filemap_write_and_wait_range(inode->i_mapping,
-                                                           lockstart,
-                                                           lockend);
+                        ret = btrfs_fdatawrite_range(inode, lockstart, lockend);
+                        if (ret)
+                                break;
+                        ret = filemap_fdatawait_range(inode->i_mapping,
+                                                      lockstart,
+                                                      lockend);
                         if (ret)
                                 break;
 
@@ -9442,6 +9497,21 @@ out_inode:
 
 }
 
+/* Inspired by filemap_check_errors() */
+int btrfs_inode_check_errors(struct inode *inode)
+{
+        int ret = 0;
+
+        if (test_bit(AS_ENOSPC, &inode->i_mapping->flags) &&
+            test_and_clear_bit(AS_ENOSPC, &inode->i_mapping->flags))
+                ret = -ENOSPC;
+        if (test_bit(AS_EIO, &inode->i_mapping->flags) &&
+            test_and_clear_bit(AS_EIO, &inode->i_mapping->flags))
+                ret = -EIO;
+
+        return ret;
+}
+
 static const struct inode_operations btrfs_dir_inode_operations = {
         .getattr        = btrfs_getattr,
         .lookup         = btrfs_lookup,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 080fe66c0349..d49fe8a0f6b5 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -617,7 +617,7 @@ fail:
         return ret;
 }
 
-static void btrfs_wait_nocow_write(struct btrfs_root *root)
+static void btrfs_wait_for_no_snapshoting_writes(struct btrfs_root *root)
 {
         s64 writers;
         DEFINE_WAIT(wait);
@@ -649,7 +649,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
 
         atomic_inc(&root->will_be_snapshoted);
         smp_mb__after_atomic();
-        btrfs_wait_nocow_write(root);
+        btrfs_wait_for_no_snapshoting_writes(root);
 
         ret = btrfs_start_delalloc_inodes(root, 0);
         if (ret)
@@ -717,35 +717,6 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
         if (ret)
                 goto fail;
 
-        /*
-         * If orphan cleanup did remove any orphans, it means the tree was
-         * modified and therefore the commit root is not the same as the
-         * current root anymore. This is a problem, because send uses the
-         * commit root and therefore can see inode items that don't exist
-         * in the current root anymore, and for example make calls to
-         * btrfs_iget, which will do tree lookups based on the current root
-         * and not on the commit root. Those lookups will fail, returning a
-         * -ESTALE error, and making send fail with that error. So make sure
-         * a send does not see any orphans we have just removed, and that it
-         * will see the same inodes regardless of whether a transaction
-         * commit happened before it started (meaning that the commit root
-         * will be the same as the current root) or not.
-         */
-        if (readonly && pending_snapshot->snap->node !=
-            pending_snapshot->snap->commit_root) {
-                trans = btrfs_join_transaction(pending_snapshot->snap);
-                if (IS_ERR(trans) && PTR_ERR(trans) != -ENOENT) {
-                        ret = PTR_ERR(trans);
-                        goto fail;
-                }
-                if (!IS_ERR(trans)) {
-                        ret = btrfs_commit_transaction(trans,
-                                                       pending_snapshot->snap);
-                        if (ret)
-                                goto fail;
-                }
-        }
-
         inode = btrfs_lookup_dentry(dentry->d_parent->d_inode, dentry);
         if (IS_ERR(inode)) {
                 ret = PTR_ERR(inode);
@@ -761,7 +732,8 @@ fail:
 free:
         kfree(pending_snapshot);
 out:
-        atomic_dec(&root->will_be_snapshoted);
+        if (atomic_dec_and_test(&root->will_be_snapshoted))
+                wake_up_atomic_t(&root->will_be_snapshoted);
         return ret;
 }
 
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index ac734ec4cc20..534544e08f76 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -220,6 +220,7 @@ static int __btrfs_add_ordered_extent(struct inode *inode, u64 file_offset,
         INIT_LIST_HEAD(&entry->work_list);
         init_completion(&entry->completion);
         INIT_LIST_HEAD(&entry->log_list);
+        INIT_LIST_HEAD(&entry->trans_list);
 
         trace_btrfs_ordered_extent_add(inode, entry);
 
@@ -431,19 +432,31 @@ out:
 
 /* Needs to either be called under a log transaction or the log_mutex */
 void btrfs_get_logged_extents(struct inode *inode,
-                              struct list_head *logged_list)
+                              struct list_head *logged_list,
+                              const loff_t start,
+                              const loff_t end)
 {
         struct btrfs_ordered_inode_tree *tree;
         struct btrfs_ordered_extent *ordered;
         struct rb_node *n;
+        struct rb_node *prev;
 
         tree = &BTRFS_I(inode)->ordered_tree;
         spin_lock_irq(&tree->lock);
-        for (n = rb_first(&tree->tree); n; n = rb_next(n)) {
+        n = __tree_search(&tree->tree, end, &prev);
+        if (!n)
+                n = prev;
+        for (; n; n = rb_prev(n)) {
                 ordered = rb_entry(n, struct btrfs_ordered_extent, rb_node);
+                if (ordered->file_offset > end)
+                        continue;
+                if (entry_end(ordered) <= start)
+                        break;
                 if (!list_empty(&ordered->log_list))
                         continue;
-                list_add_tail(&ordered->log_list, logged_list);
+                if (test_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
+                        continue;
+                list_add(&ordered->log_list, logged_list);
                 atomic_inc(&ordered->refs);
         }
         spin_unlock_irq(&tree->lock);
@@ -472,7 +485,8 @@ void btrfs_submit_logged_extents(struct list_head *logged_list,
         spin_unlock_irq(&log->log_extents_lock[index]);
 }
 
-void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid)
+void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
+                               struct btrfs_root *log, u64 transid)
 {
         struct btrfs_ordered_extent *ordered;
         int index = transid % 2;
@@ -497,7 +511,8 @@ void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid)
                 wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
                                                    &ordered->flags));
 
-                btrfs_put_ordered_extent(ordered);
+                if (!test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
+                        list_add_tail(&ordered->trans_list, &trans->ordered);
                 spin_lock_irq(&log->log_extents_lock[index]);
         }
         spin_unlock_irq(&log->log_extents_lock[index]);
@@ -725,30 +740,10 @@ int btrfs_wait_ordered_range(struct inode *inode, u64 start, u64 len)
         /* start IO across the range first to instantiate any delalloc
          * extents
          */
-        ret = filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
+        ret = btrfs_fdatawrite_range(inode, start, orig_end);
         if (ret)
                 return ret;
-        /*
-         * So with compression we will find and lock a dirty page and clear the
-         * first one as dirty, setup an async extent, and immediately return
-         * with the entire range locked but with nobody actually marked with
-         * writeback.  So we can't just filemap_write_and_wait_range() and
-         * expect it to work since it will just kick off a thread to do the
-         * actual work.  So we need to call filemap_fdatawrite_range _again_
-         * since it will wait on the page lock, which won't be unlocked until
-         * after the pages have been marked as writeback and so we're good to go
-         * from there.  We have to do this otherwise we'll miss the ordered
-         * extents and that results in badness.  Please Josef, do not think you
-         * know better and pull this out at some point in the future, it is
-         * right and you are wrong.
-         */
-        if (test_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
-                     &BTRFS_I(inode)->runtime_flags)) {
-                ret = filemap_fdatawrite_range(inode->i_mapping, start,
-                                               orig_end);
-                if (ret)
-                        return ret;
-        }
+
         ret = filemap_fdatawait_range(inode->i_mapping, start, orig_end);
         if (ret)
                 return ret;
diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
index d81a274d621e..e96cd4ccd805 100644
--- a/fs/btrfs/ordered-data.h
+++ b/fs/btrfs/ordered-data.h
@@ -71,6 +71,8 @@ struct btrfs_ordered_sum {
                                        ordered extent */
 #define BTRFS_ORDERED_TRUNCATED 9 /* Set when we have to truncate an extent */
 
+#define BTRFS_ORDERED_LOGGED 10 /* Set when we've waited on this ordered extent
+                                 * in the logging code. */
 struct btrfs_ordered_extent {
         /* logical offset in the file */
         u64 file_offset;
@@ -121,6 +123,9 @@ struct btrfs_ordered_extent {
         /* If we need to wait on this to be done */
         struct list_head log_list;
 
+        /* If the transaction needs to wait on this ordered extent */
+        struct list_head trans_list;
+
         /* used to wait for the BTRFS_ORDERED_COMPLETE bit */
         wait_queue_head_t wait;
 
@@ -193,11 +198,14 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
 int btrfs_wait_ordered_extents(struct btrfs_root *root, int nr);
 void btrfs_wait_ordered_roots(struct btrfs_fs_info *fs_info, int nr);
 void btrfs_get_logged_extents(struct inode *inode,
-                              struct list_head *logged_list);
+                              struct list_head *logged_list,
+                              const loff_t start,
+                              const loff_t end);
 void btrfs_put_logged_extents(struct list_head *logged_list);
 void btrfs_submit_logged_extents(struct list_head *logged_list,
                                  struct btrfs_root *log);
-void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid);
+void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
+                               struct btrfs_root *log, u64 transid);
 void btrfs_free_logged_extents(struct btrfs_root *log, u64 transid);
 int __init ordered_data_init(void);
 void ordered_data_exit(void);
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 6a41631cb959..8ab2a17bbba8 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -58,9 +58,23 @@
  */
 #define RBIO_CACHE_READY_BIT    3
 
+/*
+ * bbio and raid_map is managed by the caller, so we shouldn't free
+ * them here. And besides that, all rbios with this flag should not
+ * be cached, because we need raid_map to check the rbios' stripe
+ * is the same or not, but it is very likely that the caller has
+ * free raid_map, so don't cache those rbios.
+ */
+#define RBIO_HOLD_BBIO_MAP_BIT  4
 
 #define RBIO_CACHE_SIZE 1024
 
+enum btrfs_rbio_ops {
+        BTRFS_RBIO_WRITE        = 0,
+        BTRFS_RBIO_READ_REBUILD = 1,
+        BTRFS_RBIO_PARITY_SCRUB = 2,
+};
+
 struct btrfs_raid_bio {
         struct btrfs_fs_info *fs_info;
         struct btrfs_bio *bbio;
@@ -117,13 +131,16 @@ struct btrfs_raid_bio {
         /* number of data stripes (no p/q) */
         int nr_data;
 
+        int real_stripes;
+
+        int stripe_npages;
         /*
          * set if we're doing a parity rebuild
          * for a read from higher up, which is handled
          * differently from a parity rebuild as part of
          * rmw
          */
-        int read_rebuild;
+        enum btrfs_rbio_ops operation;
 
         /* first bad stripe */
         int faila;
@@ -131,6 +148,7 @@ struct btrfs_raid_bio {
         /* second bad stripe (for raid6 use) */
         int failb;
 
+        int scrubp;
         /*
          * number of pages needed to represent the full
          * stripe
@@ -144,8 +162,13 @@ struct btrfs_raid_bio {
          */
         int bio_list_bytes;
 
+        int generic_bio_cnt;
+
         atomic_t refs;
 
+        atomic_t stripes_pending;
+
+        atomic_t error;
         /*
          * these are two arrays of pointers.  We allocate the
          * rbio big enough to hold them both and setup their
@@ -162,6 +185,11 @@ struct btrfs_raid_bio {
          * here for faster lookup
          */
         struct page **bio_pages;
+
+        /*
+         * bitmap to record which horizontal stripe has data
+         */
+        unsigned long *dbitmap;
 };
 
 static int __raid56_parity_recover(struct btrfs_raid_bio *rbio);
@@ -176,6 +204,10 @@ static void __free_raid_bio(struct btrfs_raid_bio *rbio);
 static void index_rbio_pages(struct btrfs_raid_bio *rbio);
 static int alloc_rbio_pages(struct btrfs_raid_bio *rbio);
 
+static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+                                         int need_check);
+static void async_scrub_parity(struct btrfs_raid_bio *rbio);
+
 /*
  * the stripe hash table is used for locking, and to collect
  * bios in hopes of making a full stripe
@@ -324,6 +356,7 @@ static void merge_rbio(struct btrfs_raid_bio *dest,
 {
         bio_list_merge(&dest->bio_list, &victim->bio_list);
         dest->bio_list_bytes += victim->bio_list_bytes;
+        dest->generic_bio_cnt += victim->generic_bio_cnt;
         bio_list_init(&victim->bio_list);
 }
 
@@ -577,11 +610,20 @@ static int rbio_can_merge(struct btrfs_raid_bio *last,
             cur->raid_map[0])
                 return 0;
 
-        /* reads can't merge with writes */
-        if (last->read_rebuild !=
-            cur->read_rebuild) {
+        /* we can't merge with different operations */
+        if (last->operation != cur->operation)
+                return 0;
+        /*
+         * We've need read the full stripe from the drive.
+         * check and repair the parity and write the new results.
+         *
+         * We're not allowed to add any new bios to the
+         * bio list here, anyone else that wants to
+         * change this stripe needs to do their own rmw.
+         */
+        if (last->operation == BTRFS_RBIO_PARITY_SCRUB ||
+            cur->operation == BTRFS_RBIO_PARITY_SCRUB)
                 return 0;
-        }
 
         return 1;
 }
@@ -601,7 +643,7 @@ static struct page *rbio_pstripe_page(struct btrfs_raid_bio *rbio, int index)
  */
 static struct page *rbio_qstripe_page(struct btrfs_raid_bio *rbio, int index)
 {
-        if (rbio->nr_data + 1 == rbio->bbio->num_stripes)
+        if (rbio->nr_data + 1 == rbio->real_stripes)
                 return NULL;
 
         index += ((rbio->nr_data + 1) * rbio->stripe_len) >>
@@ -772,11 +814,14 @@ static noinline void unlock_stripe(struct btrfs_raid_bio *rbio)
                         spin_unlock(&rbio->bio_list_lock);
                         spin_unlock_irqrestore(&h->lock, flags);
 
-                        if (next->read_rebuild)
+                        if (next->operation == BTRFS_RBIO_READ_REBUILD)
                                 async_read_rebuild(next);
-                        else {
+                        else if (next->operation == BTRFS_RBIO_WRITE) {
                                 steal_rbio(rbio, next);
                                 async_rmw_stripe(next);
+                        } else if (next->operation == BTRFS_RBIO_PARITY_SCRUB) {
+                                steal_rbio(rbio, next);
+                                async_scrub_parity(next);
                         }
 
                         goto done_nolock;
@@ -796,6 +841,21 @@ done_nolock:
                 remove_rbio_from_cache(rbio);
 }
 
+static inline void
+__free_bbio_and_raid_map(struct btrfs_bio *bbio, u64 *raid_map, int need)
+{
+        if (need) {
+                kfree(raid_map);
+                kfree(bbio);
+        }
+}
+
+static inline void free_bbio_and_raid_map(struct btrfs_raid_bio *rbio)
+{
+        __free_bbio_and_raid_map(rbio->bbio, rbio->raid_map,
+                        !test_bit(RBIO_HOLD_BBIO_MAP_BIT, &rbio->flags));
+}
+
 static void __free_raid_bio(struct btrfs_raid_bio *rbio)
 {
         int i;
@@ -814,8 +874,9 @@ static void __free_raid_bio(struct btrfs_raid_bio *rbio)
                         rbio->stripe_pages[i] = NULL;
                 }
         }
-        kfree(rbio->raid_map);
-        kfree(rbio->bbio);
+
+        free_bbio_and_raid_map(rbio);
+
         kfree(rbio);
 }
 
@@ -833,6 +894,10 @@ static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, int err, int uptodate)
 {
         struct bio *cur = bio_list_get(&rbio->bio_list);
         struct bio *next;
+
+        if (rbio->generic_bio_cnt)
+                btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt);
+
         free_raid_bio(rbio);
 
         while (cur) {
@@ -858,13 +923,13 @@ static void raid_write_end_io(struct bio *bio, int err)
 
         bio_put(bio);
 
-        if (!atomic_dec_and_test(&rbio->bbio->stripes_pending))
+        if (!atomic_dec_and_test(&rbio->stripes_pending))
                 return;
 
         err = 0;
 
         /* OK, we have read all the stripes we need to. */
-        if (atomic_read(&rbio->bbio->error) > rbio->bbio->max_errors)
+        if (atomic_read(&rbio->error) > rbio->bbio->max_errors)
                 err = -EIO;
 
         rbio_orig_end_io(rbio, err, 0);
@@ -925,16 +990,16 @@ static struct btrfs_raid_bio *alloc_rbio(struct btrfs_root *root,
 {
         struct btrfs_raid_bio *rbio;
         int nr_data = 0;
-        int num_pages = rbio_nr_pages(stripe_len, bbio->num_stripes);
+        int real_stripes = bbio->num_stripes - bbio->num_tgtdevs;
+        int num_pages = rbio_nr_pages(stripe_len, real_stripes);
+        int stripe_npages = DIV_ROUND_UP(stripe_len, PAGE_SIZE);
         void *p;
 
-        rbio = kzalloc(sizeof(*rbio) + num_pages * sizeof(struct page *) * 2,
+        rbio = kzalloc(sizeof(*rbio) + num_pages * sizeof(struct page *) * 2 +
+                       DIV_ROUND_UP(stripe_npages, BITS_PER_LONG / 8),
                         GFP_NOFS);
-        if (!rbio) {
-                kfree(raid_map);
-                kfree(bbio);
+        if (!rbio)
                 return ERR_PTR(-ENOMEM);
-        }
 
         bio_list_init(&rbio->bio_list);
         INIT_LIST_HEAD(&rbio->plug_list);
@@ -946,9 +1011,13 @@ static struct btrfs_raid_bio *alloc_rbio(struct btrfs_root *root,
         rbio->fs_info = root->fs_info;
         rbio->stripe_len = stripe_len;
         rbio->nr_pages = num_pages;
+        rbio->real_stripes = real_stripes;
+        rbio->stripe_npages = stripe_npages;
         rbio->faila = -1;
         rbio->failb = -1;
         atomic_set(&rbio->refs, 1);
+        atomic_set(&rbio->error, 0);
+        atomic_set(&rbio->stripes_pending, 0);
 
         /*
          * the stripe_pages and bio_pages array point to the extra
@@ -957,11 +1026,12 @@ static struct btrfs_raid_bio *alloc_rbio(struct btrfs_root *root,
         p = rbio + 1;
         rbio->stripe_pages = p;
         rbio->bio_pages = p + sizeof(struct page *) * num_pages;
+        rbio->dbitmap = p + sizeof(struct page *) * num_pages * 2;
 
-        if (raid_map[bbio->num_stripes - 1] == RAID6_Q_STRIPE)
-                nr_data = bbio->num_stripes - 2;
+        if (raid_map[real_stripes - 1] == RAID6_Q_STRIPE)
+                nr_data = real_stripes - 2;
         else
-                nr_data = bbio->num_stripes - 1;
+                nr_data = real_stripes - 1;
 
         rbio->nr_data = nr_data;
         return rbio;
@@ -1073,7 +1143,7 @@ static int rbio_add_io_page(struct btrfs_raid_bio *rbio,
 static void validate_rbio_for_rmw(struct btrfs_raid_bio *rbio)
 {
         if (rbio->faila >= 0 || rbio->failb >= 0) {
-                BUG_ON(rbio->faila == rbio->bbio->num_stripes - 1);
+                BUG_ON(rbio->faila == rbio->real_stripes - 1);
                 __raid56_parity_recover(rbio);
         } else {
                 finish_rmw(rbio);
@@ -1134,7 +1204,7 @@ static void index_rbio_pages(struct btrfs_raid_bio *rbio)
 static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
 {
         struct btrfs_bio *bbio = rbio->bbio;
-        void *pointers[bbio->num_stripes];
+        void *pointers[rbio->real_stripes];
         int stripe_len = rbio->stripe_len;
         int nr_data = rbio->nr_data;
         int stripe;
@@ -1148,11 +1218,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
 
         bio_list_init(&bio_list);
 
-        if (bbio->num_stripes - rbio->nr_data == 1) {
-                p_stripe = bbio->num_stripes - 1;
-        } else if (bbio->num_stripes - rbio->nr_data == 2) {
-                p_stripe = bbio->num_stripes - 2;
-                q_stripe = bbio->num_stripes - 1;
+        if (rbio->real_stripes - rbio->nr_data == 1) {
+                p_stripe = rbio->real_stripes - 1;
+        } else if (rbio->real_stripes - rbio->nr_data == 2) {
+                p_stripe = rbio->real_stripes - 2;
+                q_stripe = rbio->real_stripes - 1;
         } else {
                 BUG();
         }
@@ -1169,7 +1239,7 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
         set_bit(RBIO_RMW_LOCKED_BIT, &rbio->flags);
         spin_unlock_irq(&rbio->bio_list_lock);
 
-        atomic_set(&rbio->bbio->error, 0);
+        atomic_set(&rbio->error, 0);
 
         /*
          * now that we've set rmw_locked, run through the
@@ -1209,7 +1279,7 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
                         SetPageUptodate(p);
                         pointers[stripe++] = kmap(p);
 
-                        raid6_call.gen_syndrome(bbio->num_stripes, PAGE_SIZE,
+                        raid6_call.gen_syndrome(rbio->real_stripes, PAGE_SIZE,
                                                 pointers);
                 } else {
                         /* raid5 */
@@ -1218,7 +1288,7 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
                 }
 
 
-                for (stripe = 0; stripe < bbio->num_stripes; stripe++)
+                for (stripe = 0; stripe < rbio->real_stripes; stripe++)
                         kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
         }
 
@@ -1227,7 +1297,7 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
          * higher layers (the bio_list in our rbio) and our p/q.  Ignore
          * everything else.
          */
-        for (stripe = 0; stripe < bbio->num_stripes; stripe++) {
+        for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
                 for (pagenr = 0; pagenr < pages_per_stripe; pagenr++) {
                         struct page *page;
                         if (stripe < rbio->nr_data) {
@@ -1245,8 +1315,34 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
                 }
         }
 
-        atomic_set(&bbio->stripes_pending, bio_list_size(&bio_list));
-        BUG_ON(atomic_read(&bbio->stripes_pending) == 0);
+        if (likely(!bbio->num_tgtdevs))
+                goto write_data;
+
+        for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
+                if (!bbio->tgtdev_map[stripe])
+                        continue;
+
+                for (pagenr = 0; pagenr < pages_per_stripe; pagenr++) {
+                        struct page *page;
+                        if (stripe < rbio->nr_data) {
+                                page = page_in_rbio(rbio, stripe, pagenr, 1);
+                                if (!page)
+                                        continue;
+                        } else {
+                               page = rbio_stripe_page(rbio, stripe, pagenr);
+                        }
+
+                        ret = rbio_add_io_page(rbio, &bio_list, page,
+                                               rbio->bbio->tgtdev_map[stripe],
+                                               pagenr, rbio->stripe_len);
+                        if (ret)
+                                goto cleanup;
+                }
+        }
+
+write_data:
+        atomic_set(&rbio->stripes_pending, bio_list_size(&bio_list));
+        BUG_ON(atomic_read(&rbio->stripes_pending) == 0);
 
         while (1) {
                 bio = bio_list_pop(&bio_list);
@@ -1283,7 +1379,8 @@ static int find_bio_stripe(struct btrfs_raid_bio *rbio,
                 stripe = &rbio->bbio->stripes[i];
                 stripe_start = stripe->physical;
                 if (physical >= stripe_start &&
-                    physical < stripe_start + rbio->stripe_len) {
+                    physical < stripe_start + rbio->stripe_len &&
+                    bio->bi_bdev == stripe->dev->bdev) {
                         return i;
                 }
         }
@@ -1331,11 +1428,11 @@ static int fail_rbio_index(struct btrfs_raid_bio *rbio, int failed)
         if (rbio->faila == -1) {
                 /* first failure on this rbio */
                 rbio->faila = failed;
-                atomic_inc(&rbio->bbio->error);
+                atomic_inc(&rbio->error);
         } else if (rbio->failb == -1) {
                 /* second failure on this rbio */
                 rbio->failb = failed;
-                atomic_inc(&rbio->bbio->error);
+                atomic_inc(&rbio->error);
         } else {
                 ret = -EIO;
         }
@@ -1394,11 +1491,11 @@ static void raid_rmw_end_io(struct bio *bio, int err)
 
         bio_put(bio);
 
-        if (!atomic_dec_and_test(&rbio->bbio->stripes_pending))
+        if (!atomic_dec_and_test(&rbio->stripes_pending))
                 return;
 
         err = 0;
-        if (atomic_read(&rbio->bbio->error) > rbio->bbio->max_errors)
+        if (atomic_read(&rbio->error) > rbio->bbio->max_errors)
                 goto cleanup;
 
         /*
@@ -1439,7 +1536,6 @@ static void async_read_rebuild(struct btrfs_raid_bio *rbio)
 static int raid56_rmw_stripe(struct btrfs_raid_bio *rbio)
 {
         int bios_to_read = 0;
-        struct btrfs_bio *bbio = rbio->bbio;
         struct bio_list bio_list;
         int ret;
         int nr_pages = DIV_ROUND_UP(rbio->stripe_len, PAGE_CACHE_SIZE);
@@ -1455,7 +1551,7 @@ static int raid56_rmw_stripe(struct btrfs_raid_bio *rbio)
 
         index_rbio_pages(rbio);
 
-        atomic_set(&rbio->bbio->error, 0);
+        atomic_set(&rbio->error, 0);
         /*
          * build a list of bios to read all the missing parts of this
          * stripe
@@ -1503,7 +1599,7 @@ static int raid56_rmw_stripe(struct btrfs_raid_bio *rbio)
          * the bbio may be freed once we submit the last bio.  Make sure
          * not to touch it after that
          */
-        atomic_set(&bbio->stripes_pending, bios_to_read);
+        atomic_set(&rbio->stripes_pending, bios_to_read);
         while (1) {
                 bio = bio_list_pop(&bio_list);
                 if (!bio)
@@ -1686,19 +1782,30 @@ int raid56_parity_write(struct btrfs_root *root, struct bio *bio,
         struct btrfs_raid_bio *rbio;
         struct btrfs_plug_cb *plug = NULL;
         struct blk_plug_cb *cb;
+        int ret;
 
         rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
-        if (IS_ERR(rbio))
+        if (IS_ERR(rbio)) {
+                __free_bbio_and_raid_map(bbio, raid_map, 1);
                 return PTR_ERR(rbio);
+        }
         bio_list_add(&rbio->bio_list, bio);
         rbio->bio_list_bytes = bio->bi_iter.bi_size;
+        rbio->operation = BTRFS_RBIO_WRITE;
+
+        btrfs_bio_counter_inc_noblocked(root->fs_info);
+        rbio->generic_bio_cnt = 1;
 
         /*
          * don't plug on full rbios, just get them out the door
          * as quickly as we can
          */
-        if (rbio_is_full(rbio))
-                return full_stripe_write(rbio);
+        if (rbio_is_full(rbio)) {
+                ret = full_stripe_write(rbio);
+                if (ret)
+                        btrfs_bio_counter_dec(root->fs_info);
+                return ret;
+        }
 
         cb = blk_check_plugged(btrfs_raid_unplug, root->fs_info,
                                sizeof(*plug));
@@ -1709,10 +1816,13 @@ int raid56_parity_write(struct btrfs_root *root, struct bio *bio,
                         INIT_LIST_HEAD(&plug->rbio_list);
                 }
                 list_add_tail(&rbio->plug_list, &plug->rbio_list);
+                ret = 0;
         } else {
-                return __raid56_parity_write(rbio);
+                ret = __raid56_parity_write(rbio);
+                if (ret)
+                        btrfs_bio_counter_dec(root->fs_info);
         }
-        return 0;
+        return ret;
 }
 
 /*
@@ -1730,7 +1840,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
         int err;
         int i;
 
-        pointers = kzalloc(rbio->bbio->num_stripes * sizeof(void *),
+        pointers = kzalloc(rbio->real_stripes * sizeof(void *),
                            GFP_NOFS);
         if (!pointers) {
                 err = -ENOMEM;
@@ -1740,7 +1850,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
         faila = rbio->faila;
         failb = rbio->failb;
 
-        if (rbio->read_rebuild) {
+        if (rbio->operation == BTRFS_RBIO_READ_REBUILD) {
                 spin_lock_irq(&rbio->bio_list_lock);
                 set_bit(RBIO_RMW_LOCKED_BIT, &rbio->flags);
                 spin_unlock_irq(&rbio->bio_list_lock);
@@ -1749,15 +1859,23 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
         index_rbio_pages(rbio);
 
         for (pagenr = 0; pagenr < nr_pages; pagenr++) {
+                /*
+                 * Now we just use bitmap to mark the horizontal stripes in
+                 * which we have data when doing parity scrub.
+                 */
+                if (rbio->operation == BTRFS_RBIO_PARITY_SCRUB &&
+                    !test_bit(pagenr, rbio->dbitmap))
+                        continue;
+
                 /* setup our array of pointers with pages
                  * from each stripe
                  */
-                for (stripe = 0; stripe < rbio->bbio->num_stripes; stripe++) {
+                for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
                         /*
                          * if we're rebuilding a read, we have to use
                          * pages from the bio list
                          */
-                        if (rbio->read_rebuild &&
+                        if (rbio->operation == BTRFS_RBIO_READ_REBUILD &&
                             (stripe == faila || stripe == failb)) {
                                 page = page_in_rbio(rbio, stripe, pagenr, 0);
                         } else {
@@ -1767,7 +1885,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
                 }
 
                 /* all raid6 handling here */
-                if (rbio->raid_map[rbio->bbio->num_stripes - 1] ==
+                if (rbio->raid_map[rbio->real_stripes - 1] ==
                     RAID6_Q_STRIPE) {
 
                         /*
@@ -1817,10 +1935,10 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
                         }
 
                         if (rbio->raid_map[failb] == RAID5_P_STRIPE) {
-                                raid6_datap_recov(rbio->bbio->num_stripes,
+                                raid6_datap_recov(rbio->real_stripes,
                                                   PAGE_SIZE, faila, pointers);
                         } else {
-                                raid6_2data_recov(rbio->bbio->num_stripes,
+                                raid6_2data_recov(rbio->real_stripes,
                                                   PAGE_SIZE, faila, failb,
                                                   pointers);
                         }
@@ -1850,7 +1968,7 @@ pstripe:
                  * know they can be trusted.  If this was a read reconstruction,
                  * other endio functions will fiddle the uptodate bits
                  */
-                if (!rbio->read_rebuild) {
+                if (rbio->operation == BTRFS_RBIO_WRITE) {
                         for (i = 0;  i < nr_pages; i++) {
                                 if (faila != -1) {
                                         page = rbio_stripe_page(rbio, faila, i);
@@ -1862,12 +1980,12 @@ pstripe:
                                 }
                         }
                 }
-                for (stripe = 0; stripe < rbio->bbio->num_stripes; stripe++) {
+                for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
                         /*
                          * if we're rebuilding a read, we have to use
                          * pages from the bio list
                          */
-                        if (rbio->read_rebuild &&
+                        if (rbio->operation == BTRFS_RBIO_READ_REBUILD &&
                             (stripe == faila || stripe == failb)) {
                                 page = page_in_rbio(rbio, stripe, pagenr, 0);
                         } else {
@@ -1882,9 +2000,9 @@ cleanup:
         kfree(pointers);
 
 cleanup_io:
-
-        if (rbio->read_rebuild) {
-                if (err == 0)
+        if (rbio->operation == BTRFS_RBIO_READ_REBUILD) {
+                if (err == 0 &&
+                    !test_bit(RBIO_HOLD_BBIO_MAP_BIT, &rbio->flags))
                         cache_rbio_pages(rbio);
                 else
                         clear_bit(RBIO_CACHE_READY_BIT, &rbio->flags);
@@ -1893,7 +2011,13 @@ cleanup_io:
         } else if (err == 0) {
                 rbio->faila = -1;
                 rbio->failb = -1;
-                finish_rmw(rbio);
+
+                if (rbio->operation == BTRFS_RBIO_WRITE)
+                        finish_rmw(rbio);
+                else if (rbio->operation == BTRFS_RBIO_PARITY_SCRUB)
+                        finish_parity_scrub(rbio, 0);
+                else
+                        BUG();
         } else {
                 rbio_orig_end_io(rbio, err, 0);
         }
@@ -1917,10 +2041,10 @@ static void raid_recover_end_io(struct bio *bio, int err)
                 set_bio_pages_uptodate(bio);
         bio_put(bio);
 
-        if (!atomic_dec_and_test(&rbio->bbio->stripes_pending))
+        if (!atomic_dec_and_test(&rbio->stripes_pending))
                 return;
 
-        if (atomic_read(&rbio->bbio->error) > rbio->bbio->max_errors)
+        if (atomic_read(&rbio->error) > rbio->bbio->max_errors)
                 rbio_orig_end_io(rbio, -EIO, 0);
         else
                 __raid_recover_end_io(rbio);
@@ -1937,7 +2061,6 @@ static void raid_recover_end_io(struct bio *bio, int err)
 static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
 {
         int bios_to_read = 0;
-        struct btrfs_bio *bbio = rbio->bbio;
         struct bio_list bio_list;
         int ret;
         int nr_pages = DIV_ROUND_UP(rbio->stripe_len, PAGE_CACHE_SIZE);
@@ -1951,16 +2074,16 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
         if (ret)
                 goto cleanup;
 
-        atomic_set(&rbio->bbio->error, 0);
+        atomic_set(&rbio->error, 0);
 
         /*
          * read everything that hasn't failed.  Thanks to the
          * stripe cache, it is possible that some or all of these
          * pages are going to be uptodate.
          */
-        for (stripe = 0; stripe < bbio->num_stripes; stripe++) {
+        for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
                 if (rbio->faila == stripe || rbio->failb == stripe) {
-                        atomic_inc(&rbio->bbio->error);
+                        atomic_inc(&rbio->error);
                         continue;
                 }
 
@@ -1990,7 +2113,7 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
                  * were up to date, or we might have no bios to read because
                  * the devices were gone.
                  */
-                if (atomic_read(&rbio->bbio->error) <= rbio->bbio->max_errors) {
+                if (atomic_read(&rbio->error) <= rbio->bbio->max_errors) {
                         __raid_recover_end_io(rbio);
                         goto out;
                 } else {
@@ -2002,7 +2125,7 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
          * the bbio may be freed once we submit the last bio.  Make sure
          * not to touch it after that
          */
-        atomic_set(&bbio->stripes_pending, bios_to_read);
+        atomic_set(&rbio->stripes_pending, bios_to_read);
         while (1) {
                 bio = bio_list_pop(&bio_list);
                 if (!bio)
@@ -2021,7 +2144,7 @@ out:
         return 0;
 
 cleanup:
-        if (rbio->read_rebuild)
+        if (rbio->operation == BTRFS_RBIO_READ_REBUILD)
                 rbio_orig_end_io(rbio, -EIO, 0);
         return -EIO;
 }
@@ -2034,34 +2157,42 @@ cleanup:
  */
 int raid56_parity_recover(struct btrfs_root *root, struct bio *bio,
                           struct btrfs_bio *bbio, u64 *raid_map,
-                          u64 stripe_len, int mirror_num)
+                          u64 stripe_len, int mirror_num, int generic_io)
 {
         struct btrfs_raid_bio *rbio;
         int ret;
 
         rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
-        if (IS_ERR(rbio))
+        if (IS_ERR(rbio)) {
+                __free_bbio_and_raid_map(bbio, raid_map, generic_io);
                 return PTR_ERR(rbio);
+        }
 
-        rbio->read_rebuild = 1;
+        rbio->operation = BTRFS_RBIO_READ_REBUILD;
         bio_list_add(&rbio->bio_list, bio);
         rbio->bio_list_bytes = bio->bi_iter.bi_size;
 
         rbio->faila = find_logical_bio_stripe(rbio, bio);
         if (rbio->faila == -1) {
                 BUG();
-                kfree(raid_map);
-                kfree(bbio);
+                __free_bbio_and_raid_map(bbio, raid_map, generic_io);
                 kfree(rbio);
                 return -EIO;
         }
 
+        if (generic_io) {
+                btrfs_bio_counter_inc_noblocked(root->fs_info);
+                rbio->generic_bio_cnt = 1;
+        } else {
+                set_bit(RBIO_HOLD_BBIO_MAP_BIT, &rbio->flags);
+        }
+
         /*
          * reconstruct from the q stripe if they are
          * asking for mirror 3
          */
         if (mirror_num == 3)
-                rbio->failb = bbio->num_stripes - 2;
+                rbio->failb = rbio->real_stripes - 2;
 
         ret = lock_stripe_add(rbio);
 
@@ -2098,3 +2229,483 @@ static void read_rebuild_work(struct btrfs_work *work)
         rbio = container_of(work, struct btrfs_raid_bio, work);
         __raid56_parity_recover(rbio);
 }
+
+/*
+ * The following code is used to scrub/replace the parity stripe
+ *
+ * Note: We need make sure all the pages that add into the scrub/replace
+ * raid bio are correct and not be changed during the scrub/replace. That
+ * is those pages just hold metadata or file data with checksum.
+ */
+
+struct btrfs_raid_bio *
+raid56_parity_alloc_scrub_rbio(struct btrfs_root *root, struct bio *bio,
+                               struct btrfs_bio *bbio, u64 *raid_map,
+                               u64 stripe_len, struct btrfs_device *scrub_dev,
+                               unsigned long *dbitmap, int stripe_nsectors)
+{
+        struct btrfs_raid_bio *rbio;
+        int i;
+
+        rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
+        if (IS_ERR(rbio))
+                return NULL;
+        bio_list_add(&rbio->bio_list, bio);
+        /*
+         * This is a special bio which is used to hold the completion handler
+         * and make the scrub rbio is similar to the other types
+         */
+        ASSERT(!bio->bi_iter.bi_size);
+        rbio->operation = BTRFS_RBIO_PARITY_SCRUB;
+
+        for (i = 0; i < rbio->real_stripes; i++) {
+                if (bbio->stripes[i].dev == scrub_dev) {
+                        rbio->scrubp = i;
+                        break;
+                }
+        }
+
+        /* Now we just support the sectorsize equals to page size */
+        ASSERT(root->sectorsize == PAGE_SIZE);
+        ASSERT(rbio->stripe_npages == stripe_nsectors);
+        bitmap_copy(rbio->dbitmap, dbitmap, stripe_nsectors);
+
+        return rbio;
+}
+
+void raid56_parity_add_scrub_pages(struct btrfs_raid_bio *rbio,
+                                   struct page *page, u64 logical)
+{
+        int stripe_offset;
+        int index;
+
+        ASSERT(logical >= rbio->raid_map[0]);
+        ASSERT(logical + PAGE_SIZE <= rbio->raid_map[0] +
+                                rbio->stripe_len * rbio->nr_data);
+        stripe_offset = (int)(logical - rbio->raid_map[0]);
+        index = stripe_offset >> PAGE_CACHE_SHIFT;
+        rbio->bio_pages[index] = page;
+}
+
+/*
+ * We just scrub the parity that we have correct data on the same horizontal,
+ * so we needn't allocate all pages for all the stripes.
+ */
+static int alloc_rbio_essential_pages(struct btrfs_raid_bio *rbio)
+{
+        int i;
+        int bit;
+        int index;
+        struct page *page;
+
+        for_each_set_bit(bit, rbio->dbitmap, rbio->stripe_npages) {
+                for (i = 0; i < rbio->real_stripes; i++) {
+                        index = i * rbio->stripe_npages + bit;
+                        if (rbio->stripe_pages[index])
+                                continue;
+
+                        page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
+                        if (!page)
+                                return -ENOMEM;
+                        rbio->stripe_pages[index] = page;
+                        ClearPageUptodate(page);
+                }
+        }
+        return 0;
+}
+
+/*
+ * end io function used by finish_rmw.  When we finally
+ * get here, we've written a full stripe
+ */
+static void raid_write_parity_end_io(struct bio *bio, int err)
+{
+        struct btrfs_raid_bio *rbio = bio->bi_private;
+
+        if (err)
+                fail_bio_stripe(rbio, bio);
+
+        bio_put(bio);
+
+        if (!atomic_dec_and_test(&rbio->stripes_pending))
+                return;
+
+        err = 0;
+
+        if (atomic_read(&rbio->error))
+                err = -EIO;
+
+        rbio_orig_end_io(rbio, err, 0);
+}
+
+static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+                                         int need_check)
+{
+        struct btrfs_bio *bbio = rbio->bbio;
+        void *pointers[rbio->real_stripes];
+        DECLARE_BITMAP(pbitmap, rbio->stripe_npages);
+        int nr_data = rbio->nr_data;
+        int stripe;
+        int pagenr;
+        int p_stripe = -1;
+        int q_stripe = -1;
+        struct page *p_page = NULL;
+        struct page *q_page = NULL;
+        struct bio_list bio_list;
+        struct bio *bio;
+        int is_replace = 0;
+        int ret;
+
+        bio_list_init(&bio_list);
+
+        if (rbio->real_stripes - rbio->nr_data == 1) {
+                p_stripe = rbio->real_stripes - 1;
+        } else if (rbio->real_stripes - rbio->nr_data == 2) {
+                p_stripe = rbio->real_stripes - 2;
+                q_stripe = rbio->real_stripes - 1;
+        } else {
+                BUG();
+        }
+
+        if (bbio->num_tgtdevs && bbio->tgtdev_map[rbio->scrubp]) {
+                is_replace = 1;
+                bitmap_copy(pbitmap, rbio->dbitmap, rbio->stripe_npages);
+        }
+
+        /*
+         * Because the higher layers(scrubber) are unlikely to
+         * use this area of the disk again soon, so don't cache
+         * it.
+         */
+        clear_bit(RBIO_CACHE_READY_BIT, &rbio->flags);
+
+        if (!need_check)
+                goto writeback;
+
+        p_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
+        if (!p_page)
+                goto cleanup;
+        SetPageUptodate(p_page);
+
+        if (q_stripe != -1) {
+                q_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
+                if (!q_page) {
+                        __free_page(p_page);
+                        goto cleanup;
+                }
+                SetPageUptodate(q_page);
+        }
+
+        atomic_set(&rbio->error, 0);
+
+        for_each_set_bit(pagenr, rbio->dbitmap, rbio->stripe_npages) {
+                struct page *p;
+                void *parity;
+                /* first collect one page from each data stripe */
+                for (stripe = 0; stripe < nr_data; stripe++) {
+                        p = page_in_rbio(rbio, stripe, pagenr, 0);
+                        pointers[stripe] = kmap(p);
+                }
+
+                /* then add the parity stripe */
+                pointers[stripe++] = kmap(p_page);
+
+                if (q_stripe != -1) {
+
+                        /*
+                         * raid6, add the qstripe and call the
+                         * library function to fill in our p/q
+                         */
+                        pointers[stripe++] = kmap(q_page);
+
+                        raid6_call.gen_syndrome(rbio->real_stripes, PAGE_SIZE,
+                                                pointers);
+                } else {
+                        /* raid5 */
+                        memcpy(pointers[nr_data], pointers[0], PAGE_SIZE);
+                        run_xor(pointers + 1, nr_data - 1, PAGE_CACHE_SIZE);
+                }
+
+                /* Check scrubbing pairty and repair it */
+                p = rbio_stripe_page(rbio, rbio->scrubp, pagenr);
+                parity = kmap(p);
+                if (memcmp(parity, pointers[rbio->scrubp], PAGE_CACHE_SIZE))
+                        memcpy(parity, pointers[rbio->scrubp], PAGE_CACHE_SIZE);
+                else
+                        /* Parity is right, needn't writeback */
+                        bitmap_clear(rbio->dbitmap, pagenr, 1);
+                kunmap(p);
+
+                for (stripe = 0; stripe < rbio->real_stripes; stripe++)
+                        kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
+        }
+
+        __free_page(p_page);
+        if (q_page)
+                __free_page(q_page);
+
+writeback:
+        /*
+         * time to start writing.  Make bios for everything from the
+         * higher layers (the bio_list in our rbio) and our p/q.  Ignore
+         * everything else.
+         */
+        for_each_set_bit(pagenr, rbio->dbitmap, rbio->stripe_npages) {
+                struct page *page;
+
+                page = rbio_stripe_page(rbio, rbio->scrubp, pagenr);
+                ret = rbio_add_io_page(rbio, &bio_list,
+                               page, rbio->scrubp, pagenr, rbio->stripe_len);
+                if (ret)
+                        goto cleanup;
+        }
+
+        if (!is_replace)
+                goto submit_write;
+
+        for_each_set_bit(pagenr, pbitmap, rbio->stripe_npages) {
+                struct page *page;
+
+                page = rbio_stripe_page(rbio, rbio->scrubp, pagenr);
+                ret = rbio_add_io_page(rbio, &bio_list, page,
+                                       bbio->tgtdev_map[rbio->scrubp],
+                                       pagenr, rbio->stripe_len);
+                if (ret)
+                        goto cleanup;
+        }
+
+submit_write:
+        nr_data = bio_list_size(&bio_list);
+        if (!nr_data) {
+                /* Every parity is right */
+                rbio_orig_end_io(rbio, 0, 0);
+                return;
+        }
+
+        atomic_set(&rbio->stripes_pending, nr_data);
+
+        while (1) {
+                bio = bio_list_pop(&bio_list);
+                if (!bio)
+                        break;
+
+                bio->bi_private = rbio;
+                bio->bi_end_io = raid_write_parity_end_io;
+                BUG_ON(!test_bit(BIO_UPTODATE, &bio->bi_flags));
+                submit_bio(WRITE, bio);
+        }
+        return;
+
+cleanup:
+        rbio_orig_end_io(rbio, -EIO, 0);
+}
+
+static inline int is_data_stripe(struct btrfs_raid_bio *rbio, int stripe)
+{
+        if (stripe >= 0 && stripe < rbio->nr_data)
+                return 1;
+        return 0;
+}
+
+/*
+ * While we're doing the parity check and repair, we could have errors
+ * in reading pages off the disk.  This checks for errors and if we're
+ * not able to read the page it'll trigger parity reconstruction.  The
+ * parity scrub will be finished after we've reconstructed the failed
+ * stripes
+ */
+static void validate_rbio_for_parity_scrub(struct btrfs_raid_bio *rbio)
+{
+        if (atomic_read(&rbio->error) > rbio->bbio->max_errors)
+                goto cleanup;
+
+        if (rbio->faila >= 0 || rbio->failb >= 0) {
+                int dfail = 0, failp = -1;
+
+                if (is_data_stripe(rbio, rbio->faila))
+                        dfail++;
+                else if (is_parity_stripe(rbio->faila))
+                        failp = rbio->faila;
+
+                if (is_data_stripe(rbio, rbio->failb))
+                        dfail++;
+                else if (is_parity_stripe(rbio->failb))
+                        failp = rbio->failb;
+
+                /*
+                 * Because we can not use a scrubbing parity to repair
+                 * the data, so the capability of the repair is declined.
+                 * (In the case of RAID5, we can not repair anything)
+                 */
+                if (dfail > rbio->bbio->max_errors - 1)
+                        goto cleanup;
+
+                /*
+                 * If all data is good, only parity is correctly, just
+                 * repair the parity.
+                 */
+                if (dfail == 0) {
+                        finish_parity_scrub(rbio, 0);
+                        return;
+                }
+
+                /*
+                 * Here means we got one corrupted data stripe and one
+                 * corrupted parity on RAID6, if the corrupted parity
+                 * is scrubbing parity, luckly, use the other one to repair
+                 * the data, or we can not repair the data stripe.
+                 */
+                if (failp != rbio->scrubp)
+                        goto cleanup;
+
+                __raid_recover_end_io(rbio);
+        } else {
+                finish_parity_scrub(rbio, 1);
+        }
+        return;
+
+cleanup:
+        rbio_orig_end_io(rbio, -EIO, 0);
+}
+
+/*
+ * end io for the read phase of the rmw cycle.  All the bios here are physical
+ * stripe bios we've read from the disk so we can recalculate the parity of the
+ * stripe.
+ *
+ * This will usually kick off finish_rmw once all the bios are read in, but it
+ * may trigger parity reconstruction if we had any errors along the way
+ */
+static void raid56_parity_scrub_end_io(struct bio *bio, int err)
+{
+        struct btrfs_raid_bio *rbio = bio->bi_private;
+
+        if (err)
+                fail_bio_stripe(rbio, bio);
+        else
+                set_bio_pages_uptodate(bio);
+
+        bio_put(bio);
+
+        if (!atomic_dec_and_test(&rbio->stripes_pending))
+                return;
+
+        /*
+         * this will normally call finish_rmw to start our write
+         * but if there are any failed stripes we'll reconstruct
+         * from parity first
+         */
+        validate_rbio_for_parity_scrub(rbio);
+}
+
+static void raid56_parity_scrub_stripe(struct btrfs_raid_bio *rbio)
+{
+        int bios_to_read = 0;
+        struct bio_list bio_list;
+        int ret;
+        int pagenr;
+        int stripe;
+        struct bio *bio;
+
+        ret = alloc_rbio_essential_pages(rbio);
+        if (ret)
+                goto cleanup;
+
+        bio_list_init(&bio_list);
+
+        atomic_set(&rbio->error, 0);
+        /*
+         * build a list of bios to read all the missing parts of this
+         * stripe
+         */
+        for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
+                for_each_set_bit(pagenr, rbio->dbitmap, rbio->stripe_npages) {
+                        struct page *page;
+                        /*
+                         * we want to find all the pages missing from
+                         * the rbio and read them from the disk.  If
+                         * page_in_rbio finds a page in the bio list
+                         * we don't need to read it off the stripe.
+                         */
+                        page = page_in_rbio(rbio, stripe, pagenr, 1);
+                        if (page)
+                                continue;
+
+                        page = rbio_stripe_page(rbio, stripe, pagenr);
+                        /*
+                         * the bio cache may have handed us an uptodate
+                         * page.  If so, be happy and use it
+                         */
+                        if (PageUptodate(page))
+                                continue;
+
+                        ret = rbio_add_io_page(rbio, &bio_list, page,
+                                       stripe, pagenr, rbio->stripe_len);
+                        if (ret)
+                                goto cleanup;
+                }
+        }
+
+        bios_to_read = bio_list_size(&bio_list);
+        if (!bios_to_read) {
+                /*
+                 * this can happen if others have merged with
+                 * us, it means there is nothing left to read.
+                 * But if there are missing devices it may not be
+                 * safe to do the full stripe write yet.
+                 */
+                goto finish;
+        }
+
+        /*
+         * the bbio may be freed once we submit the last bio.  Make sure
+         * not to touch it after that
+         */
+        atomic_set(&rbio->stripes_pending, bios_to_read);
+        while (1) {
+                bio = bio_list_pop(&bio_list);
+                if (!bio)
+                        break;
+
+                bio->bi_private = rbio;
+                bio->bi_end_io = raid56_parity_scrub_end_io;
+
+                btrfs_bio_wq_end_io(rbio->fs_info, bio,
+                                    BTRFS_WQ_ENDIO_RAID56);
+
+                BUG_ON(!test_bit(BIO_UPTODATE, &bio->bi_flags));
+                submit_bio(READ, bio);
+        }
+        /* the actual write will happen once the reads are done */
+        return;
+
+cleanup:
+        rbio_orig_end_io(rbio, -EIO, 0);
+        return;
+
+finish:
+        validate_rbio_for_parity_scrub(rbio);
+}
+
+static void scrub_parity_work(struct btrfs_work *work)
+{
+        struct btrfs_raid_bio *rbio;
+
+        rbio = container_of(work, struct btrfs_raid_bio, work);
+        raid56_parity_scrub_stripe(rbio);
+}
+
+static void async_scrub_parity(struct btrfs_raid_bio *rbio)
+{
+        btrfs_init_work(&rbio->work, btrfs_rmw_helper,
+                        scrub_parity_work, NULL, NULL);
+
+        btrfs_queue_work(rbio->fs_info->rmw_workers,
+                         &rbio->work);
+}
+
+void raid56_parity_submit_scrub_rbio(struct btrfs_raid_bio *rbio)
+{
+        if (!lock_stripe_add(rbio))
+                async_scrub_parity(rbio);
+}
diff --git a/fs/btrfs/raid56.h b/fs/btrfs/raid56.h
index ea5d73bfdfbe..31d4a157b5e3 100644
--- a/fs/btrfs/raid56.h
+++ b/fs/btrfs/raid56.h
@@ -39,13 +39,25 @@ static inline int nr_data_stripes(struct map_lookup *map)
 #define is_parity_stripe(x) (((x) == RAID5_P_STRIPE) ||         \
                              ((x) == RAID6_Q_STRIPE))
 
+struct btrfs_raid_bio;
+struct btrfs_device;
+
 int raid56_parity_recover(struct btrfs_root *root, struct bio *bio,
-                                 struct btrfs_bio *bbio, u64 *raid_map,
-                                 u64 stripe_len, int mirror_num);
+                          struct btrfs_bio *bbio, u64 *raid_map,
+                          u64 stripe_len, int mirror_num, int generic_io);
 int raid56_parity_write(struct btrfs_root *root, struct bio *bio,
                                struct btrfs_bio *bbio, u64 *raid_map,
                                u64 stripe_len);
 
+struct btrfs_raid_bio *
+raid56_parity_alloc_scrub_rbio(struct btrfs_root *root, struct bio *bio,
+                               struct btrfs_bio *bbio, u64 *raid_map,
+                               u64 stripe_len, struct btrfs_device *scrub_dev,
+                               unsigned long *dbitmap, int stripe_nsectors);
+void raid56_parity_add_scrub_pages(struct btrfs_raid_bio *rbio,
+                                   struct page *page, u64 logical);
+void raid56_parity_submit_scrub_rbio(struct btrfs_raid_bio *rbio);
+
 int btrfs_alloc_stripe_hash_table(struct btrfs_fs_info *info);
 void btrfs_free_stripe_hash_table(struct btrfs_fs_info *info);
 #endif
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index efa083113827..f2bb13a23f86 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -63,10 +63,18 @@ struct scrub_ctx;
  */
 #define SCRUB_MAX_PAGES_PER_BLOCK       16      /* 64k per node/leaf/sector */
 
+struct scrub_recover {
+        atomic_t                refs;
+        struct btrfs_bio        *bbio;
+        u64                     *raid_map;
+        u64                     map_length;
+};
+
 struct scrub_page {
         struct scrub_block      *sblock;
         struct page             *page;
         struct btrfs_device     *dev;
+        struct list_head        list;
         u64                     flags;  /* extent flags */
         u64                     generation;
         u64                     logical;
@@ -79,6 +87,8 @@ struct scrub_page {
                 unsigned int    io_error:1;
         };
         u8                      csum[BTRFS_CSUM_SIZE];
+
+        struct scrub_recover    *recover;
 };
 
 struct scrub_bio {
@@ -105,14 +115,52 @@ struct scrub_block {
         atomic_t                outstanding_pages;
         atomic_t                ref_count; /* free mem on transition to zero */
         struct scrub_ctx        *sctx;
+        struct scrub_parity     *sparity;
         struct {
                 unsigned int    header_error:1;
                 unsigned int    checksum_error:1;
                 unsigned int    no_io_error_seen:1;
                 unsigned int    generation_error:1; /* also sets header_error */
+
+                /* The following is for the data used to check parity */
+                /* It is for the data with checksum */
+                unsigned int    data_corrected:1;
         };
 };
 
+/* Used for the chunks with parity stripe such RAID5/6 */
+struct scrub_parity {
+        struct scrub_ctx        *sctx;
+
+        struct btrfs_device     *scrub_dev;
+
+        u64                     logic_start;
+
+        u64                     logic_end;
+
+        int                     nsectors;
+
+        int                     stripe_len;
+
+        atomic_t                ref_count;
+
+        struct list_head        spages;
+
+        /* Work of parity check and repair */
+        struct btrfs_work       work;
+
+        /* Mark the parity blocks which have data */
+        unsigned long           *dbitmap;
+
+        /*
+         * Mark the parity blocks which have data, but errors happen when
+         * read data or check data
+         */
+        unsigned long           *ebitmap;
+
+        unsigned long           bitmap[0];
+};
+
 struct scrub_wr_ctx {
         struct scrub_bio *wr_curr_bio;
         struct btrfs_device *tgtdev;
@@ -196,7 +244,7 @@ static int scrub_setup_recheck_block(struct scrub_ctx *sctx,
 static void scrub_recheck_block(struct btrfs_fs_info *fs_info,
                                 struct scrub_block *sblock, int is_metadata,
                                 int have_csum, u8 *csum, u64 generation,
-                                u16 csum_size);
+                                u16 csum_size, int retry_failed_mirror);
 static void scrub_recheck_block_checksum(struct btrfs_fs_info *fs_info,
                                          struct scrub_block *sblock,
                                          int is_metadata, int have_csum,
@@ -218,6 +266,8 @@ static void scrub_block_get(struct scrub_block *sblock);
 static void scrub_block_put(struct scrub_block *sblock);
 static void scrub_page_get(struct scrub_page *spage);
 static void scrub_page_put(struct scrub_page *spage);
+static void scrub_parity_get(struct scrub_parity *sparity);
+static void scrub_parity_put(struct scrub_parity *sparity);
 static int scrub_add_page_to_rd_bio(struct scrub_ctx *sctx,
                                     struct scrub_page *spage);
 static int scrub_pages(struct scrub_ctx *sctx, u64 logical, u64 len,
@@ -790,6 +840,20 @@ out:
         scrub_pending_trans_workers_dec(sctx);
 }
 
+static inline void scrub_get_recover(struct scrub_recover *recover)
+{
+        atomic_inc(&recover->refs);
+}
+
+static inline void scrub_put_recover(struct scrub_recover *recover)
+{
+        if (atomic_dec_and_test(&recover->refs)) {
+                kfree(recover->bbio);
+                kfree(recover->raid_map);
+                kfree(recover);
+        }
+}
+
 /*
  * scrub_handle_errored_block gets called when either verification of the
  * pages failed or the bio failed to read, e.g. with EIO. In the latter
@@ -906,7 +970,7 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
 
         /* build and submit the bios for the failed mirror, check checksums */
         scrub_recheck_block(fs_info, sblock_bad, is_metadata, have_csum,
-                            csum, generation, sctx->csum_size);
+                            csum, generation, sctx->csum_size, 1);
 
         if (!sblock_bad->header_error && !sblock_bad->checksum_error &&
             sblock_bad->no_io_error_seen) {
@@ -920,6 +984,7 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
                  */
                 spin_lock(&sctx->stat_lock);
                 sctx->stat.unverified_errors++;
+                sblock_to_check->data_corrected = 1;
                 spin_unlock(&sctx->stat_lock);
 
                 if (sctx->is_dev_replace)
@@ -1019,7 +1084,7 @@ nodatasum_case:
                 /* build and submit the bios, check checksums */
                 scrub_recheck_block(fs_info, sblock_other, is_metadata,
                                     have_csum, csum, generation,
-                                    sctx->csum_size);
+                                    sctx->csum_size, 0);
 
                 if (!sblock_other->header_error &&
                     !sblock_other->checksum_error &&
@@ -1169,7 +1234,7 @@ nodatasum_case:
                          */
                         scrub_recheck_block(fs_info, sblock_bad,
                                             is_metadata, have_csum, csum,
-                                            generation, sctx->csum_size);
+                                            generation, sctx->csum_size, 1);
                         if (!sblock_bad->header_error &&
                             !sblock_bad->checksum_error &&
                             sblock_bad->no_io_error_seen)
@@ -1180,6 +1245,7 @@ nodatasum_case:
 corrected_error:
                         spin_lock(&sctx->stat_lock);
                         sctx->stat.corrected_errors++;
+                        sblock_to_check->data_corrected = 1;
                         spin_unlock(&sctx->stat_lock);
                         printk_ratelimited_in_rcu(KERN_ERR
                                 "BTRFS: fixed up error at logical %llu on dev %s\n",
@@ -1201,11 +1267,18 @@ out:
                      mirror_index++) {
                         struct scrub_block *sblock = sblocks_for_recheck +
                                                      mirror_index;
+                        struct scrub_recover *recover;
                         int page_index;
 
                         for (page_index = 0; page_index < sblock->page_count;
                              page_index++) {
                                 sblock->pagev[page_index]->sblock = NULL;
+                                recover = sblock->pagev[page_index]->recover;
+                                if (recover) {
+                                        scrub_put_recover(recover);
+                                        sblock->pagev[page_index]->recover =
+                                                                        NULL;
+                                }
                                 scrub_page_put(sblock->pagev[page_index]);
                         }
                 }
@@ -1215,14 +1288,63 @@ out:
         return 0;
 }
 
+static inline int scrub_nr_raid_mirrors(struct btrfs_bio *bbio, u64 *raid_map)
+{
+        if (raid_map) {
+                if (raid_map[bbio->num_stripes - 1] == RAID6_Q_STRIPE)
+                        return 3;
+                else
+                        return 2;
+        } else {
+                return (int)bbio->num_stripes;
+        }
+}
+
+static inline void scrub_stripe_index_and_offset(u64 logical, u64 *raid_map,
+                                                 u64 mapped_length,
+                                                 int nstripes, int mirror,
+                                                 int *stripe_index,
+                                                 u64 *stripe_offset)
+{
+        int i;
+
+        if (raid_map) {
+                /* RAID5/6 */
+                for (i = 0; i < nstripes; i++) {
+                        if (raid_map[i] == RAID6_Q_STRIPE ||
+                            raid_map[i] == RAID5_P_STRIPE)
+                                continue;
+
+                        if (logical >= raid_map[i] &&
+                            logical < raid_map[i] + mapped_length)
+                                break;
+                }
+
+                *stripe_index = i;
+                *stripe_offset = logical - raid_map[i];
+        } else {
+                /* The other RAID type */
+                *stripe_index = mirror;
+                *stripe_offset = 0;
+        }
+}
+
 static int scrub_setup_recheck_block(struct scrub_ctx *sctx,
                                      struct btrfs_fs_info *fs_info,
                                      struct scrub_block *original_sblock,
                                      u64 length, u64 logical,
                                      struct scrub_block *sblocks_for_recheck)
 {
+        struct scrub_recover *recover;
+        struct btrfs_bio *bbio;
+        u64 *raid_map;
+        u64 sublen;
+        u64 mapped_length;
+        u64 stripe_offset;
+        int stripe_index;
         int page_index;
         int mirror_index;
+        int nmirrors;
         int ret;
 
         /*
@@ -1233,23 +1355,39 @@ static int scrub_setup_recheck_block(struct scrub_ctx *sctx,
 
         page_index = 0;
         while (length > 0) {
-                u64 sublen = min_t(u64, length, PAGE_SIZE);
-                u64 mapped_length = sublen;
-                struct btrfs_bio *bbio = NULL;
+                sublen = min_t(u64, length, PAGE_SIZE);
+                mapped_length = sublen;
+                bbio = NULL;
+                raid_map = NULL;
 
                 /*
                  * with a length of PAGE_SIZE, each returned stripe
                  * represents one mirror
                  */
-                ret = btrfs_map_block(fs_info, REQ_GET_READ_MIRRORS, logical,
-                                      &mapped_length, &bbio, 0);
+                ret = btrfs_map_sblock(fs_info, REQ_GET_READ_MIRRORS, logical,
+                                       &mapped_length, &bbio, 0, &raid_map);
                 if (ret || !bbio || mapped_length < sublen) {
                         kfree(bbio);
+                        kfree(raid_map);
                         return -EIO;
                 }
 
+                recover = kzalloc(sizeof(struct scrub_recover), GFP_NOFS);
+                if (!recover) {
+                        kfree(bbio);
+                        kfree(raid_map);
+                        return -ENOMEM;
+                }
+
+                atomic_set(&recover->refs, 1);
+                recover->bbio = bbio;
+                recover->raid_map = raid_map;
+                recover->map_length = mapped_length;
+
                 BUG_ON(page_index >= SCRUB_PAGES_PER_RD_BIO);
-                for (mirror_index = 0; mirror_index < (int)bbio->num_stripes;
+
+                nmirrors = scrub_nr_raid_mirrors(bbio, raid_map);
+                for (mirror_index = 0; mirror_index < nmirrors;
                      mirror_index++) {
                         struct scrub_block *sblock;
                         struct scrub_page *page;
@@ -1265,26 +1403,38 @@ leave_nomem:
                                 spin_lock(&sctx->stat_lock);
                                 sctx->stat.malloc_errors++;
                                 spin_unlock(&sctx->stat_lock);
-                                kfree(bbio);
+                                scrub_put_recover(recover);
                                 return -ENOMEM;
                         }
                         scrub_page_get(page);
                         sblock->pagev[page_index] = page;
                         page->logical = logical;
-                        page->physical = bbio->stripes[mirror_index].physical;
+
+                        scrub_stripe_index_and_offset(logical, raid_map,
+                                                      mapped_length,
+                                                      bbio->num_stripes,
+                                                      mirror_index,
+                                                      &stripe_index,
+                                                      &stripe_offset);
+                        page->physical = bbio->stripes[stripe_index].physical +
+                                         stripe_offset;
+                        page->dev = bbio->stripes[stripe_index].dev;
+
                         BUG_ON(page_index >= original_sblock->page_count);
                         page->physical_for_dev_replace =
                                 original_sblock->pagev[page_index]->
                                 physical_for_dev_replace;
                         /* for missing devices, dev->bdev is NULL */
-                        page->dev = bbio->stripes[mirror_index].dev;
                         page->mirror_num = mirror_index + 1;
                         sblock->page_count++;
                         page->page = alloc_page(GFP_NOFS);
                         if (!page->page)
                                 goto leave_nomem;
+
+                        scrub_get_recover(recover);
+                        page->recover = recover;
                 }
-                kfree(bbio);
+                scrub_put_recover(recover);
                 length -= sublen;
                 logical += sublen;
                 page_index++;
@@ -1293,6 +1443,51 @@ leave_nomem:
         return 0;
 }
 
+struct scrub_bio_ret {
+        struct completion event;
+        int error;
+};
+
+static void scrub_bio_wait_endio(struct bio *bio, int error)
+{
+        struct scrub_bio_ret *ret = bio->bi_private;
+
+        ret->error = error;
+        complete(&ret->event);
+}
+
+static inline int scrub_is_page_on_raid56(struct scrub_page *page)
+{
+        return page->recover && page->recover->raid_map;
+}
+
+static int scrub_submit_raid56_bio_wait(struct btrfs_fs_info *fs_info,
+                                        struct bio *bio,
+                                        struct scrub_page *page)
+{
+        struct scrub_bio_ret done;
+        int ret;
+
+        init_completion(&done.event);
+        done.error = 0;
+        bio->bi_iter.bi_sector = page->logical >> 9;
+        bio->bi_private = &done;
+        bio->bi_end_io = scrub_bio_wait_endio;
+
+        ret = raid56_parity_recover(fs_info->fs_root, bio, page->recover->bbio,
+                                    page->recover->raid_map,
+                                    page->recover->map_length,
+                                    page->mirror_num, 0);
+        if (ret)
+                return ret;
+
+        wait_for_completion(&done.event);
+        if (done.error)
+                return -EIO;
+
+        return 0;
+}
+
 /*
  * this function will check the on disk data for checksum errors, header
  * errors and read I/O errors. If any I/O errors happen, the exact pages
@@ -1303,7 +1498,7 @@ leave_nomem:
 static void scrub_recheck_block(struct btrfs_fs_info *fs_info,
                                 struct scrub_block *sblock, int is_metadata,
                                 int have_csum, u8 *csum, u64 generation,
-                                u16 csum_size)
+                                u16 csum_size, int retry_failed_mirror)
 {
         int page_num;
 
@@ -1329,11 +1524,17 @@ static void scrub_recheck_block(struct btrfs_fs_info *fs_info,
                         continue;
                 }
                 bio->bi_bdev = page->dev->bdev;
-                bio->bi_iter.bi_sector = page->physical >> 9;
 
                 bio_add_page(bio, page->page, PAGE_SIZE, 0);
-                if (btrfsic_submit_bio_wait(READ, bio))
-                        sblock->no_io_error_seen = 0;
+                if (!retry_failed_mirror && scrub_is_page_on_raid56(page)) {
+                        if (scrub_submit_raid56_bio_wait(fs_info, bio, page))
+                                sblock->no_io_error_seen = 0;
+                } else {
+                        bio->bi_iter.bi_sector = page->physical >> 9;
+
+                        if (btrfsic_submit_bio_wait(READ, bio))
+                                sblock->no_io_error_seen = 0;
+                }
 
                 bio_put(bio);
         }
@@ -1486,6 +1687,13 @@ static void scrub_write_block_to_dev_replace(struct scrub_block *sblock)
 {
         int page_num;
 
+        /*
+         * This block is used for the check of the parity on the source device,
+         * so the data needn't be written into the destination device.
+         */
+        if (sblock->sparity)
+                return;
+
         for (page_num = 0; page_num < sblock->page_count; page_num++) {
                 int ret;
 
@@ -1867,6 +2075,9 @@ static void scrub_block_put(struct scrub_block *sblock)
         if (atomic_dec_and_test(&sblock->ref_count)) {
                 int i;
 
+                if (sblock->sparity)
+                        scrub_parity_put(sblock->sparity);
+
                 for (i = 0; i < sblock->page_count; i++)
                         scrub_page_put(sblock->pagev[i]);
                 kfree(sblock);
@@ -2124,9 +2335,51 @@ static void scrub_bio_end_io_worker(struct btrfs_work *work)
         scrub_pending_bio_dec(sctx);
 }
 
+static inline void __scrub_mark_bitmap(struct scrub_parity *sparity,
+                                       unsigned long *bitmap,
+                                       u64 start, u64 len)
+{
+        int offset;
+        int nsectors;
+        int sectorsize = sparity->sctx->dev_root->sectorsize;
+
+        if (len >= sparity->stripe_len) {
+                bitmap_set(bitmap, 0, sparity->nsectors);
+                return;
+        }
+
+        start -= sparity->logic_start;
+        offset = (int)do_div(start, sparity->stripe_len);
+        offset /= sectorsize;
+        nsectors = (int)len / sectorsize;
+
+        if (offset + nsectors <= sparity->nsectors) {
+                bitmap_set(bitmap, offset, nsectors);
+                return;
+        }
+
+        bitmap_set(bitmap, offset, sparity->nsectors - offset);
+        bitmap_set(bitmap, 0, nsectors - (sparity->nsectors - offset));
+}
+
+static inline void scrub_parity_mark_sectors_error(struct scrub_parity *sparity,
+                                                   u64 start, u64 len)
+{
+        __scrub_mark_bitmap(sparity, sparity->ebitmap, start, len);
+}
+
+static inline void scrub_parity_mark_sectors_data(struct scrub_parity *sparity,
+                                                  u64 start, u64 len)
+{
+        __scrub_mark_bitmap(sparity, sparity->dbitmap, start, len);
+}
+
 static void scrub_block_complete(struct scrub_block *sblock)
 {
+        int corrupted = 0;
+
         if (!sblock->no_io_error_seen) {
+                corrupted = 1;
                 scrub_handle_errored_block(sblock);
         } else {
                 /*
@@ -2134,9 +2387,19 @@ static void scrub_block_complete(struct scrub_block *sblock)
                  * dev replace case, otherwise write here in dev replace
                  * case.
                  */
-                if (!scrub_checksum(sblock) && sblock->sctx->is_dev_replace)
+                corrupted = scrub_checksum(sblock);
+                if (!corrupted && sblock->sctx->is_dev_replace)
                         scrub_write_block_to_dev_replace(sblock);
         }
+
+        if (sblock->sparity && corrupted && !sblock->data_corrected) {
+                u64 start = sblock->pagev[0]->logical;
+                u64 end = sblock->pagev[sblock->page_count - 1]->logical +
+                          PAGE_SIZE;
+
+                scrub_parity_mark_sectors_error(sblock->sparity,
+                                                start, end - start);
+        }
 }
 
 static int scrub_find_csum(struct scrub_ctx *sctx, u64 logical, u64 len,
@@ -2228,6 +2491,132 @@ behind_scrub_pages:
         return 0;
 }
 
+static int scrub_pages_for_parity(struct scrub_parity *sparity,
+                                  u64 logical, u64 len,
+                                  u64 physical, struct btrfs_device *dev,
+                                  u64 flags, u64 gen, int mirror_num, u8 *csum)
+{
+        struct scrub_ctx *sctx = sparity->sctx;
+        struct scrub_block *sblock;
+        int index;
+
+        sblock = kzalloc(sizeof(*sblock), GFP_NOFS);
+        if (!sblock) {
+                spin_lock(&sctx->stat_lock);
+                sctx->stat.malloc_errors++;
+                spin_unlock(&sctx->stat_lock);
+                return -ENOMEM;
+        }
+
+        /* one ref inside this function, plus one for each page added to
+         * a bio later on */
+        atomic_set(&sblock->ref_count, 1);
+        sblock->sctx = sctx;
+        sblock->no_io_error_seen = 1;
+        sblock->sparity = sparity;
+        scrub_parity_get(sparity);
+
+        for (index = 0; len > 0; index++) {
+                struct scrub_page *spage;
+                u64 l = min_t(u64, len, PAGE_SIZE);
+
+                spage = kzalloc(sizeof(*spage), GFP_NOFS);
+                if (!spage) {
+leave_nomem:
+                        spin_lock(&sctx->stat_lock);
+                        sctx->stat.malloc_errors++;
+                        spin_unlock(&sctx->stat_lock);
+                        scrub_block_put(sblock);
+                        return -ENOMEM;
+                }
+                BUG_ON(index >= SCRUB_MAX_PAGES_PER_BLOCK);
+                /* For scrub block */
+                scrub_page_get(spage);
+                sblock->pagev[index] = spage;
+                /* For scrub parity */
+                scrub_page_get(spage);
+                list_add_tail(&spage->list, &sparity->spages);
+                spage->sblock = sblock;
+                spage->dev = dev;
+                spage->flags = flags;
+                spage->generation = gen;
+                spage->logical = logical;
+                spage->physical = physical;
+                spage->mirror_num = mirror_num;
+                if (csum) {
+                        spage->have_csum = 1;
+                        memcpy(spage->csum, csum, sctx->csum_size);
+                } else {
+                        spage->have_csum = 0;
+                }
+                sblock->page_count++;
+                spage->page = alloc_page(GFP_NOFS);
+                if (!spage->page)
+                        goto leave_nomem;
+                len -= l;
+                logical += l;
+                physical += l;
+        }
+
+        WARN_ON(sblock->page_count == 0);
+        for (index = 0; index < sblock->page_count; index++) {
+                struct scrub_page *spage = sblock->pagev[index];
+                int ret;
+
+                ret = scrub_add_page_to_rd_bio(sctx, spage);
+                if (ret) {
+                        scrub_block_put(sblock);
+                        return ret;
+                }
+        }
+
+        /* last one frees, either here or in bio completion for last page */
+        scrub_block_put(sblock);
+        return 0;
+}
+
+static int scrub_extent_for_parity(struct scrub_parity *sparity,
+                                   u64 logical, u64 len,
+                                   u64 physical, struct btrfs_device *dev,
+                                   u64 flags, u64 gen, int mirror_num)
+{
+        struct scrub_ctx *sctx = sparity->sctx;
+        int ret;
+        u8 csum[BTRFS_CSUM_SIZE];
+        u32 blocksize;
+
+        if (flags & BTRFS_EXTENT_FLAG_DATA) {
+                blocksize = sctx->sectorsize;
+        } else if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
+                blocksize = sctx->nodesize;
+        } else {
+                blocksize = sctx->sectorsize;
+                WARN_ON(1);
+        }
+
+        while (len) {
+                u64 l = min_t(u64, len, blocksize);
+                int have_csum = 0;
+
+                if (flags & BTRFS_EXTENT_FLAG_DATA) {
+                        /* push csums to sbio */
+                        have_csum = scrub_find_csum(sctx, logical, l, csum);
+                        if (have_csum == 0)
+                                goto skip;
+                }
+                ret = scrub_pages_for_parity(sparity, logical, l, physical, dev,
+                                             flags, gen, mirror_num,
+                                             have_csum ? csum : NULL);
+skip:
+                if (ret)
+                        return ret;
+                len -= l;
+                logical += l;
+                physical += l;
+        }
+        return 0;
+}
+
 /*
  * Given a physical address, this will calculate it's
  * logical offset. if this is a parity stripe, it will return
@@ -2236,7 +2625,8 @@ behind_scrub_pages:
  * return 0 if it is a data stripe, 1 means parity stripe.
  */
 static int get_raid56_logic_offset(u64 physical, int num,
-                                   struct map_lookup *map, u64 *offset)
+                                   struct map_lookup *map, u64 *offset,
+                                   u64 *stripe_start)
 {
         int i;
         int j = 0;
@@ -2247,6 +2637,9 @@ static int get_raid56_logic_offset(u64 physical, int num,
 
         last_offset = (physical - map->stripes[num].physical) *
                       nr_data_stripes(map);
+        if (stripe_start)
+                *stripe_start = last_offset;
+
         *offset = last_offset;
         for (i = 0; i < nr_data_stripes(map); i++) {
                 *offset = last_offset + i * map->stripe_len;
@@ -2269,13 +2662,330 @@ static int get_raid56_logic_offset(u64 physical, int num,
         return 1;
 }
 
+static void scrub_free_parity(struct scrub_parity *sparity)
+{
+        struct scrub_ctx *sctx = sparity->sctx;
+        struct scrub_page *curr, *next;
+        int nbits;
+
+        nbits = bitmap_weight(sparity->ebitmap, sparity->nsectors);
+        if (nbits) {
+                spin_lock(&sctx->stat_lock);
+                sctx->stat.read_errors += nbits;
+                sctx->stat.uncorrectable_errors += nbits;
+                spin_unlock(&sctx->stat_lock);
+        }
+
+        list_for_each_entry_safe(curr, next, &sparity->spages, list) {
+                list_del_init(&curr->list);
+                scrub_page_put(curr);
+        }
+
+        kfree(sparity);
+}
+
+static void scrub_parity_bio_endio(struct bio *bio, int error)
+{
+        struct scrub_parity *sparity = (struct scrub_parity *)bio->bi_private;
+        struct scrub_ctx *sctx = sparity->sctx;
+
+        if (error)
+                bitmap_or(sparity->ebitmap, sparity->ebitmap, sparity->dbitmap,
+                          sparity->nsectors);
+
+        scrub_free_parity(sparity);
+        scrub_pending_bio_dec(sctx);
+        bio_put(bio);
+}
+
+static void scrub_parity_check_and_repair(struct scrub_parity *sparity)
+{
+        struct scrub_ctx *sctx = sparity->sctx;
+        struct bio *bio;
+        struct btrfs_raid_bio *rbio;
+        struct scrub_page *spage;
+        struct btrfs_bio *bbio = NULL;
+        u64 *raid_map = NULL;
+        u64 length;
+        int ret;
+
+        if (!bitmap_andnot(sparity->dbitmap, sparity->dbitmap, sparity->ebitmap,
+                           sparity->nsectors))
+                goto out;
+
+        length = sparity->logic_end - sparity->logic_start + 1;
+        ret = btrfs_map_sblock(sctx->dev_root->fs_info, WRITE,
+                               sparity->logic_start,
+                               &length, &bbio, 0, &raid_map);
+        if (ret || !bbio || !raid_map)
+                goto bbio_out;
+
+        bio = btrfs_io_bio_alloc(GFP_NOFS, 0);
+        if (!bio)
+                goto bbio_out;
+
+        bio->bi_iter.bi_sector = sparity->logic_start >> 9;
+        bio->bi_private = sparity;
+        bio->bi_end_io = scrub_parity_bio_endio;
+
+        rbio = raid56_parity_alloc_scrub_rbio(sctx->dev_root, bio, bbio,
+                                              raid_map, length,
+                                              sparity->scrub_dev,
+                                              sparity->dbitmap,
+                                              sparity->nsectors);
+        if (!rbio)
+                goto rbio_out;
+
+        list_for_each_entry(spage, &sparity->spages, list)
+                raid56_parity_add_scrub_pages(rbio, spage->page,
+                                              spage->logical);
+
+        scrub_pending_bio_inc(sctx);
+        raid56_parity_submit_scrub_rbio(rbio);
+        return;
+
+rbio_out:
+        bio_put(bio);
+bbio_out:
+        kfree(bbio);
+        kfree(raid_map);
+        bitmap_or(sparity->ebitmap, sparity->ebitmap, sparity->dbitmap,
+                  sparity->nsectors);
+        spin_lock(&sctx->stat_lock);
+        sctx->stat.malloc_errors++;
+        spin_unlock(&sctx->stat_lock);
+out:
+        scrub_free_parity(sparity);
+}
+
+static inline int scrub_calc_parity_bitmap_len(int nsectors)
+{
+        return DIV_ROUND_UP(nsectors, BITS_PER_LONG) * (BITS_PER_LONG / 8);
+}
+
+static void scrub_parity_get(struct scrub_parity *sparity)
+{
+        atomic_inc(&sparity->ref_count);
+}
+
+static void scrub_parity_put(struct scrub_parity *sparity)
+{
+        if (!atomic_dec_and_test(&sparity->ref_count))
+                return;
+
+        scrub_parity_check_and_repair(sparity);
+}
+
+static noinline_for_stack int scrub_raid56_parity(struct scrub_ctx *sctx,
+                                                  struct map_lookup *map,
+                                                  struct btrfs_device *sdev,
+                                                  struct btrfs_path *path,
+                                                  u64 logic_start,
+                                                  u64 logic_end)
+{
+        struct btrfs_fs_info *fs_info = sctx->dev_root->fs_info;
+        struct btrfs_root *root = fs_info->extent_root;
+        struct btrfs_root *csum_root = fs_info->csum_root;
+        struct btrfs_extent_item *extent;
+        u64 flags;
+        int ret;
+        int slot;
+        struct extent_buffer *l;
+        struct btrfs_key key;
+        u64 generation;
+        u64 extent_logical;
+        u64 extent_physical;
+        u64 extent_len;
+        struct btrfs_device *extent_dev;
+        struct scrub_parity *sparity;
+        int nsectors;
+        int bitmap_len;
+        int extent_mirror_num;
+        int stop_loop = 0;
+
+        nsectors = map->stripe_len / root->sectorsize;
+        bitmap_len = scrub_calc_parity_bitmap_len(nsectors);
+        sparity = kzalloc(sizeof(struct scrub_parity) + 2 * bitmap_len,
+                          GFP_NOFS);
+        if (!sparity) {
+                spin_lock(&sctx->stat_lock);
+                sctx->stat.malloc_errors++;
+                spin_unlock(&sctx->stat_lock);
+                return -ENOMEM;
+        }
+
+        sparity->stripe_len = map->stripe_len;
+        sparity->nsectors = nsectors;
+        sparity->sctx = sctx;
+        sparity->scrub_dev = sdev;
+        sparity->logic_start = logic_start;
+        sparity->logic_end = logic_end;
+        atomic_set(&sparity->ref_count, 1);
+        INIT_LIST_HEAD(&sparity->spages);
+        sparity->dbitmap = sparity->bitmap;
+        sparity->ebitmap = (void *)sparity->bitmap + bitmap_len;
+
+        ret = 0;
+        while (logic_start < logic_end) {
+                if (btrfs_fs_incompat(fs_info, SKINNY_METADATA))
+                        key.type = BTRFS_METADATA_ITEM_KEY;
+                else
+                        key.type = BTRFS_EXTENT_ITEM_KEY;
+                key.objectid = logic_start;
+                key.offset = (u64)-1;
+
+                ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+                if (ret < 0)
+                        goto out;
+
+                if (ret > 0) {
+                        ret = btrfs_previous_extent_item(root, path, 0);
+                        if (ret < 0)
+                                goto out;
+                        if (ret > 0) {
+                                btrfs_release_path(path);
+                                ret = btrfs_search_slot(NULL, root, &key,
+                                                        path, 0, 0);
+                                if (ret < 0)
+                                        goto out;
+                        }
+                }
+
+                stop_loop = 0;
+                while (1) {
+                        u64 bytes;
+
+                        l = path->nodes[0];
+                        slot = path->slots[0];
+                        if (slot >= btrfs_header_nritems(l)) {
+                                ret = btrfs_next_leaf(root, path);
+                                if (ret == 0)
+                                        continue;
+                                if (ret < 0)
+                                        goto out;
+
+                                stop_loop = 1;
+                                break;
+                        }
+                        btrfs_item_key_to_cpu(l, &key, slot);
+
+                        if (key.type == BTRFS_METADATA_ITEM_KEY)
+                                bytes = root->nodesize;
+                        else
+                                bytes = key.offset;
+
+                        if (key.objectid + bytes <= logic_start)
+                                goto next;
+
+                        if (key.type != BTRFS_EXTENT_ITEM_KEY &&
+                            key.type != BTRFS_METADATA_ITEM_KEY)
+                                goto next;
+
+                        if (key.objectid > logic_end) {
+                                stop_loop = 1;
+                                break;
+                        }
+
+                        while (key.objectid >= logic_start + map->stripe_len)
+                                logic_start += map->stripe_len;
+
+                        extent = btrfs_item_ptr(l, slot,
+                                                struct btrfs_extent_item);
+                        flags = btrfs_extent_flags(l, extent);
+                        generation = btrfs_extent_generation(l, extent);
+
+                        if (key.objectid < logic_start &&
+                            (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK)) {
+                                btrfs_err(fs_info,
+                                          "scrub: tree block %llu spanning stripes, ignored. logical=%llu",
+                                           key.objectid, logic_start);
+                                goto next;
+                        }
+again:
+                        extent_logical = key.objectid;
+                        extent_len = bytes;
+
+                        if (extent_logical < logic_start) {
+                                extent_len -= logic_start - extent_logical;
+                                extent_logical = logic_start;
+                        }
+
+                        if (extent_logical + extent_len >
+                            logic_start + map->stripe_len)
+                                extent_len = logic_start + map->stripe_len -
+                                             extent_logical;
+
+                        scrub_parity_mark_sectors_data(sparity, extent_logical,
+                                                       extent_len);
+
+                        scrub_remap_extent(fs_info, extent_logical,
+                                           extent_len, &extent_physical,
+                                           &extent_dev,
+                                           &extent_mirror_num);
+
+                        ret = btrfs_lookup_csums_range(csum_root,
+                                                extent_logical,
+                                                extent_logical + extent_len - 1,
+                                                &sctx->csum_list, 1);
+                        if (ret)
+                                goto out;
+
+                        ret = scrub_extent_for_parity(sparity, extent_logical,
+                                                      extent_len,
+                                                      extent_physical,
+                                                      extent_dev, flags,
+                                                      generation,
+                                                      extent_mirror_num);
+                        if (ret)
+                                goto out;
+
+                        scrub_free_csums(sctx);
+                        if (extent_logical + extent_len <
+                            key.objectid + bytes) {
+                                logic_start += map->stripe_len;
+
+                                if (logic_start >= logic_end) {
+                                        stop_loop = 1;
+                                        break;
+                                }
+
+                                if (logic_start < key.objectid + bytes) {
+                                        cond_resched();
+                                        goto again;
+                                }
+                        }
+next:
+                        path->slots[0]++;
+                }
+
+                btrfs_release_path(path);
+
+                if (stop_loop)
+                        break;
+
+                logic_start += map->stripe_len;
+        }
+out:
+        if (ret < 0)
+                scrub_parity_mark_sectors_error(sparity, logic_start,
+                                                logic_end - logic_start + 1);
+        scrub_parity_put(sparity);
+        scrub_submit(sctx);
+        mutex_lock(&sctx->wr_ctx.wr_lock);
+        scrub_wr_submit(sctx);
+        mutex_unlock(&sctx->wr_ctx.wr_lock);
+
+        btrfs_release_path(path);
+        return ret < 0 ? ret : 0;
+}
+
 static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
                                            struct map_lookup *map,
                                            struct btrfs_device *scrub_dev,
                                            int num, u64 base, u64 length,
                                            int is_dev_replace)
 {
-        struct btrfs_path *path;
+        struct btrfs_path *path, *ppath;
         struct btrfs_fs_info *fs_info = sctx->dev_root->fs_info;
         struct btrfs_root *root = fs_info->extent_root;
         struct btrfs_root *csum_root = fs_info->csum_root;
@@ -2302,6 +3012,8 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
         u64 extent_logical;
         u64 extent_physical;
         u64 extent_len;
+        u64 stripe_logical;
+        u64 stripe_end;
         struct btrfs_device *extent_dev;
         int extent_mirror_num;
         int stop_loop = 0;
@@ -2327,7 +3039,7 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
                 mirror_num = num % map->num_stripes + 1;
         } else if (map->type & (BTRFS_BLOCK_GROUP_RAID5 |
                                 BTRFS_BLOCK_GROUP_RAID6)) {
-                get_raid56_logic_offset(physical, num, map, &offset);
+                get_raid56_logic_offset(physical, num, map, &offset, NULL);
                 increment = map->stripe_len * nr_data_stripes(map);
                 mirror_num = 1;
         } else {
@@ -2339,6 +3051,12 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
         if (!path)
                 return -ENOMEM;
 
+        ppath = btrfs_alloc_path();
+        if (!ppath) {
+                btrfs_free_path(ppath);
+                return -ENOMEM;
+        }
+
         /*
          * work on commit root. The related disk blocks are static as
          * long as COW is applied. This means, it is save to rewrite
@@ -2357,7 +3075,7 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
         if (map->type & (BTRFS_BLOCK_GROUP_RAID5 |
                          BTRFS_BLOCK_GROUP_RAID6)) {
                 get_raid56_logic_offset(physical_end, num,
-                                        map, &logic_end);
+                                        map, &logic_end, NULL);
                 logic_end += base;
         } else {
                 logic_end = logical + increment * nstripes;
@@ -2404,10 +3122,18 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
                 if (map->type & (BTRFS_BLOCK_GROUP_RAID5 |
                                 BTRFS_BLOCK_GROUP_RAID6)) {
                         ret = get_raid56_logic_offset(physical, num,
-                                        map, &logical);
+                                        map, &logical, &stripe_logical);
                         logical += base;
-                        if (ret)
+                        if (ret) {
+                                stripe_logical += base;
+                                stripe_end = stripe_logical + increment - 1;
+                                ret = scrub_raid56_parity(sctx, map, scrub_dev,
+                                                ppath, stripe_logical,
+                                                stripe_end);
+                                if (ret)
+                                        goto out;
                                 goto skip;
+                        }
                 }
                 /*
                  * canceled?
@@ -2558,13 +3284,25 @@ again:
                                          * loop until we find next data stripe
                                          * or we have finished all stripes.
                                          */
-                                        do {
-                                                physical += map->stripe_len;
-                                                ret = get_raid56_logic_offset(
-                                                                physical, num,
-                                                                map, &logical);
-                                                logical += base;
-                                        } while (physical < physical_end && ret);
+loop:
+                                        physical += map->stripe_len;
+                                        ret = get_raid56_logic_offset(physical,
+                                                        num, map, &logical,
+                                                        &stripe_logical);
+                                        logical += base;
+
+                                        if (ret && physical < physical_end) {
+                                                stripe_logical += base;
+                                                stripe_end = stripe_logical +
+                                                                increment - 1;
+                                                ret = scrub_raid56_parity(sctx,
+                                                        map, scrub_dev, ppath,
+                                                        stripe_logical,
+                                                        stripe_end);
+                                                if (ret)
+                                                        goto out;
+                                                goto loop;
+                                        }
                                 } else {
                                         physical += map->stripe_len;
                                         logical += increment;
@@ -2605,6 +3343,7 @@ out:
 
         blk_finish_plug(&plug);
         btrfs_free_path(path);
+        btrfs_free_path(ppath);
         return ret < 0 ? ret : 0;
 }
 
@@ -3310,6 +4049,50 @@ out:
         scrub_pending_trans_workers_dec(sctx);
 }
 
+static int check_extent_to_block(struct inode *inode, u64 start, u64 len,
+                                 u64 logical)
+{
+        struct extent_state *cached_state = NULL;
+        struct btrfs_ordered_extent *ordered;
+        struct extent_io_tree *io_tree;
+        struct extent_map *em;
+        u64 lockstart = start, lockend = start + len - 1;
+        int ret = 0;
+
+        io_tree = &BTRFS_I(inode)->io_tree;
+
+        lock_extent_bits(io_tree, lockstart, lockend, 0, &cached_state);
+        ordered = btrfs_lookup_ordered_range(inode, lockstart, len);
+        if (ordered) {
+                btrfs_put_ordered_extent(ordered);
+                ret = 1;
+                goto out_unlock;
+        }
+
+        em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
+        if (IS_ERR(em)) {
+                ret = PTR_ERR(em);
+                goto out_unlock;
+        }
+
+        /*
+         * This extent does not actually cover the logical extent anymore,
+         * move on to the next inode.
+         */
+        if (em->block_start > logical ||
+            em->block_start + em->block_len < logical + len) {
+                free_extent_map(em);
+                ret = 1;
+                goto out_unlock;
+        }
+        free_extent_map(em);
+
+out_unlock:
+        unlock_extent_cached(io_tree, lockstart, lockend, &cached_state,
+                             GFP_NOFS);
+        return ret;
+}
+
 static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root,
                                       struct scrub_copy_nocow_ctx *nocow_ctx)
 {
@@ -3318,13 +4101,10 @@ static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root,
         struct inode *inode;
         struct page *page;
         struct btrfs_root *local_root;
-        struct btrfs_ordered_extent *ordered;
-        struct extent_map *em;
-        struct extent_state *cached_state = NULL;
         struct extent_io_tree *io_tree;
         u64 physical_for_dev_replace;
+        u64 nocow_ctx_logical;
         u64 len = nocow_ctx->len;
-        u64 lockstart = offset, lockend = offset + len - 1;
         unsigned long index;
         int srcu_index;
         int ret = 0;
@@ -3356,30 +4136,13 @@ static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root,
 
         physical_for_dev_replace = nocow_ctx->physical_for_dev_replace;
         io_tree = &BTRFS_I(inode)->io_tree;
+        nocow_ctx_logical = nocow_ctx->logical;
 
-        lock_extent_bits(io_tree, lockstart, lockend, 0, &cached_state);
-        ordered = btrfs_lookup_ordered_range(inode, lockstart, len);
-        if (ordered) {
-                btrfs_put_ordered_extent(ordered);
-                goto out_unlock;
-        }
-
-        em = btrfs_get_extent(inode, NULL, 0, lockstart, len, 0);
-        if (IS_ERR(em)) {
-                ret = PTR_ERR(em);
-                goto out_unlock;
-        }
-
-        /*
-         * This extent does not actually cover the logical extent anymore,
-         * move on to the next inode.
-         */
-        if (em->block_start > nocow_ctx->logical ||
-            em->block_start + em->block_len < nocow_ctx->logical + len) {
-                free_extent_map(em);
-                goto out_unlock;
+        ret = check_extent_to_block(inode, offset, len, nocow_ctx_logical);
+        if (ret) {
+                ret = ret > 0 ? 0 : ret;
+                goto out;
         }
-        free_extent_map(em);
 
         while (len >= PAGE_CACHE_SIZE) {
                 index = offset >> PAGE_CACHE_SHIFT;
@@ -3396,7 +4159,7 @@ again:
                                 goto next_page;
                 } else {
                         ClearPageError(page);
-                        err = extent_read_full_page_nolock(io_tree, page,
+                        err = extent_read_full_page(io_tree, page,
                                                            btrfs_get_extent,
                                                            nocow_ctx->mirror_num);
                         if (err) {
@@ -3421,6 +4184,14 @@ again:
                                 goto next_page;
                         }
                 }
+
+                ret = check_extent_to_block(inode, offset, len,
+                                            nocow_ctx_logical);
+                if (ret) {
+                        ret = ret > 0 ? 0 : ret;
+                        goto next_page;
+                }
+
                 err = write_page_nocow(nocow_ctx->sctx,
                                        physical_for_dev_replace, page);
                 if (err)
@@ -3434,12 +4205,10 @@ next_page:
 
                 offset += PAGE_CACHE_SIZE;
                 physical_for_dev_replace += PAGE_CACHE_SIZE;
+                nocow_ctx_logical += PAGE_CACHE_SIZE;
                 len -= PAGE_CACHE_SIZE;
         }
         ret = COPY_COMPLETE;
-out_unlock:
-        unlock_extent_cached(io_tree, lockstart, lockend, &cached_state,
-                             GFP_NOFS);
 out:
         mutex_unlock(&inode->i_mutex);
         iput(inode);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 874828dd0a86..804432dbc351 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5507,6 +5507,51 @@ out:
         return ret;
 }
 
+/*
+ * If orphan cleanup did remove any orphans from a root, it means the tree
+ * was modified and therefore the commit root is not the same as the current
+ * root anymore. This is a problem, because send uses the commit root and
+ * therefore can see inode items that don't exist in the current root anymore,
+ * and for example make calls to btrfs_iget, which will do tree lookups based
+ * on the current root and not on the commit root. Those lookups will fail,
+ * returning a -ESTALE error, and making send fail with that error. So make
+ * sure a send does not see any orphans we have just removed, and that it will
+ * see the same inodes regardless of whether a transaction commit happened
+ * before it started (meaning that the commit root will be the same as the
+ * current root) or not.
+ */
+static int ensure_commit_roots_uptodate(struct send_ctx *sctx)
+{
+        int i;
+        struct btrfs_trans_handle *trans = NULL;
+
+again:
+        if (sctx->parent_root &&
+            sctx->parent_root->node != sctx->parent_root->commit_root)
+                goto commit_trans;
+
+        for (i = 0; i < sctx->clone_roots_cnt; i++)
+                if (sctx->clone_roots[i].root->node !=
+                    sctx->clone_roots[i].root->commit_root)
+                        goto commit_trans;
+
+        if (trans)
+                return btrfs_end_transaction(trans, sctx->send_root);
+
+        return 0;
+
+commit_trans:
+        /* Use any root, all fs roots will get their commit roots updated. */
+        if (!trans) {
+                trans = btrfs_join_transaction(sctx->send_root);
+                if (IS_ERR(trans))
+                        return PTR_ERR(trans);
+                goto again;
+        }
+
+        return btrfs_commit_transaction(trans, sctx->send_root);
+}
+
 static void btrfs_root_dec_send_in_progress(struct btrfs_root* root)
 {
         spin_lock(&root->root_item_lock);
@@ -5728,6 +5773,10 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                         NULL);
         sort_clone_roots = 1;
 
+        ret = ensure_commit_roots_uptodate(sctx);
+        if (ret)
+                goto out;
+
         current->journal_info = BTRFS_SEND_TRANS_STUB;
         ret = send_subvol(sctx);
         current->journal_info = NULL;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 54bd91ece35b..60f7cbe815e9 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -262,7 +262,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
         trans->aborted = errno;
         /* Nothing used. The other threads that have joined this
          * transaction may be able to continue. */
-        if (!trans->blocks_used) {
+        if (!trans->blocks_used && list_empty(&trans->new_bgs)) {
                 const char *errstr;
 
                 errstr = btrfs_decode_error(errno);
@@ -642,11 +642,11 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                              "disabling disk space caching");
                         break;
                 case Opt_inode_cache:
-                        btrfs_set_and_info(root, CHANGE_INODE_CACHE,
+                        btrfs_set_pending_and_info(info, INODE_MAP_CACHE,
                                            "enabling inode map caching");
                         break;
                 case Opt_noinode_cache:
-                        btrfs_clear_and_info(root, CHANGE_INODE_CACHE,
+                        btrfs_clear_pending_and_info(info, INODE_MAP_CACHE,
                                              "disabling inode map caching");
                         break;
                 case Opt_clear_cache:
@@ -993,9 +993,17 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
         trans = btrfs_attach_transaction_barrier(root);
         if (IS_ERR(trans)) {
                 /* no transaction, don't bother */
-                if (PTR_ERR(trans) == -ENOENT)
-                        return 0;
-                return PTR_ERR(trans);
+                if (PTR_ERR(trans) == -ENOENT) {
+                        /*
+                         * Exit unless we have some pending changes
+                         * that need to go through commit
+                         */
+                        if (fs_info->pending_changes == 0)
+                                return 0;
+                        trans = btrfs_start_transaction(root, 0);
+                } else {
+                        return PTR_ERR(trans);
+                }
         }
         return btrfs_commit_transaction(trans, root);
 }
@@ -1644,8 +1652,20 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
         int i = 0, nr_devices;
         int ret;
 
+        /*
+         * We aren't under the device list lock, so this is racey-ish, but good
+         * enough for our purposes.
+         */
         nr_devices = fs_info->fs_devices->open_devices;
-        BUG_ON(!nr_devices);
+        if (!nr_devices) {
+                smp_mb();
+                nr_devices = fs_info->fs_devices->open_devices;
+                ASSERT(nr_devices);
+                if (!nr_devices) {
+                        *free_bytes = 0;
+                        return 0;
+                }
+        }
 
         devices_info = kmalloc_array(nr_devices, sizeof(*devices_info),
                                GFP_NOFS);
@@ -1670,11 +1690,17 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
         else
                 min_stripe_size = BTRFS_STRIPE_LEN;
 
-        list_for_each_entry(device, &fs_devices->devices, dev_list) {
+        if (fs_info->alloc_start)
+                mutex_lock(&fs_devices->device_list_mutex);
+        rcu_read_lock();
+        list_for_each_entry_rcu(device, &fs_devices->devices, dev_list) {
                 if (!device->in_fs_metadata || !device->bdev ||
                     device->is_tgtdev_for_dev_replace)
                         continue;
 
+                if (i >= nr_devices)
+                        break;
+
                 avail_space = device->total_bytes - device->bytes_used;
 
                 /* align with stripe_len */
@@ -1689,24 +1715,32 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
                 skip_space = 1024 * 1024;
 
                 /* user can set the offset in fs_info->alloc_start. */
-                if (fs_info->alloc_start + BTRFS_STRIPE_LEN <=
-                    device->total_bytes)
+                if (fs_info->alloc_start &&
+                    fs_info->alloc_start + BTRFS_STRIPE_LEN <=
+                    device->total_bytes) {
+                        rcu_read_unlock();
                         skip_space = max(fs_info->alloc_start, skip_space);
 
-                /*
-                 * btrfs can not use the free space in [0, skip_space - 1],
-                 * we must subtract it from the total. In order to implement
-                 * it, we account the used space in this range first.
-                 */
-                ret = btrfs_account_dev_extents_size(device, 0, skip_space - 1,
-                                                     &used_space);
-                if (ret) {
-                        kfree(devices_info);
-                        return ret;
-                }
+                        /*
+                         * btrfs can not use the free space in
+                         * [0, skip_space - 1], we must subtract it from the
+                         * total. In order to implement it, we account the used
+                         * space in this range first.
+                         */
+                        ret = btrfs_account_dev_extents_size(device, 0,
+                                                             skip_space - 1,
+                                                             &used_space);
+                        if (ret) {
+                                kfree(devices_info);
+                                mutex_unlock(&fs_devices->device_list_mutex);
+                                return ret;
+                        }
 
-                /* calc the free space in [0, skip_space - 1] */
-                skip_space -= used_space;
+                        rcu_read_lock();
+
+                        /* calc the free space in [0, skip_space - 1] */
+                        skip_space -= used_space;
+                }
 
                 /*
                  * we can use the free space in [0, skip_space - 1], subtract
@@ -1725,6 +1759,9 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
 
                 i++;
         }
+        rcu_read_unlock();
+        if (fs_info->alloc_start)
+                mutex_unlock(&fs_devices->device_list_mutex);
 
         nr_devices = i;
 
@@ -1787,8 +1824,6 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
          * holding chunk_muext to avoid allocating new chunks, holding
          * device_list_mutex to avoid the device being removed
          */
-        mutex_lock(&fs_info->fs_devices->device_list_mutex);
-        mutex_lock(&fs_info->chunk_mutex);
         rcu_read_lock();
         list_for_each_entry_rcu(found, head, list) {
                 if (found->flags & BTRFS_BLOCK_GROUP_DATA) {
@@ -1824,17 +1859,12 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bfree -= block_rsv->size >> bits;
         spin_unlock(&block_rsv->lock);
 
-        buf->f_bavail = total_free_data;
+        buf->f_bavail = div_u64(total_free_data, factor);
         ret = btrfs_calc_avail_data_space(fs_info->tree_root, &total_free_data);
-        if (ret) {
-                mutex_unlock(&fs_info->chunk_mutex);
-                mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+        if (ret)
                 return ret;
-        }
         buf->f_bavail += div_u64(total_free_data, factor);
         buf->f_bavail = buf->f_bavail >> bits;
-        mutex_unlock(&fs_info->chunk_mutex);
-        mutex_unlock(&fs_info->fs_devices->device_list_mutex);
 
         buf->f_type = BTRFS_SUPER_MAGIC;
         buf->f_bsize = dentry->d_sb->s_blocksize;
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index b2e7bb4393f6..92db3f648df4 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -111,7 +111,6 @@ static ssize_t btrfs_feature_attr_store(struct kobject *kobj,
 {
         struct btrfs_fs_info *fs_info;
         struct btrfs_feature_attr *fa = to_btrfs_feature_attr(a);
-        struct btrfs_trans_handle *trans;
         u64 features, set, clear;
         unsigned long val;
         int ret;
@@ -153,10 +152,6 @@ static ssize_t btrfs_feature_attr_store(struct kobject *kobj,
         btrfs_info(fs_info, "%s %s feature flag",
                    val ? "Setting" : "Clearing", fa->kobj_attr.attr.name);
 
-        trans = btrfs_start_transaction(fs_info->fs_root, 0);
-        if (IS_ERR(trans))
-                return PTR_ERR(trans);
-
         spin_lock(&fs_info->super_lock);
         features = get_features(fs_info, fa->feature_set);
         if (val)
@@ -166,9 +161,11 @@ static ssize_t btrfs_feature_attr_store(struct kobject *kobj,
         set_features(fs_info, fa->feature_set, features);
         spin_unlock(&fs_info->super_lock);
 
-        ret = btrfs_commit_transaction(trans, fs_info->fs_root);
-        if (ret)
-                return ret;
+        /*
+         * We don't want to do full transaction commit from inside sysfs
+         */
+        btrfs_set_pending(fs_info, COMMIT);
+        wake_up_process(fs_info->transaction_kthread);
 
         return count;
 }
@@ -372,9 +369,6 @@ static ssize_t btrfs_label_store(struct kobject *kobj,
                                  const char *buf, size_t len)
 {
         struct btrfs_fs_info *fs_info = to_fs_info(kobj);
-        struct btrfs_trans_handle *trans;
-        struct btrfs_root *root = fs_info->fs_root;
-        int ret;
         size_t p_len;
 
         if (fs_info->sb->s_flags & MS_RDONLY)
@@ -389,20 +383,18 @@ static ssize_t btrfs_label_store(struct kobject *kobj,
         if (p_len >= BTRFS_LABEL_SIZE)
                 return -EINVAL;
 
-        trans = btrfs_start_transaction(root, 0);
-        if (IS_ERR(trans))
-                return PTR_ERR(trans);
-
-        spin_lock(&root->fs_info->super_lock);
+        spin_lock(&fs_info->super_lock);
         memset(fs_info->super_copy->label, 0, BTRFS_LABEL_SIZE);
         memcpy(fs_info->super_copy->label, buf, p_len);
-        spin_unlock(&root->fs_info->super_lock);
-        ret = btrfs_commit_transaction(trans, root);
+        spin_unlock(&fs_info->super_lock);
 
-        if (!ret)
-                return len;
+        /*
+         * We don't want to do full transaction commit from inside sysfs
+         */
+        btrfs_set_pending(fs_info, COMMIT);
+        wake_up_process(fs_info->transaction_kthread);
 
-        return ret;
+        return len;
 }
 BTRFS_ATTR_RW(label, btrfs_label_show, btrfs_label_store);
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index dcaae3616728..a605d4e2f2bc 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -76,6 +76,32 @@ void btrfs_put_transaction(struct btrfs_transaction *transaction)
         }
 }
 
+static void clear_btree_io_tree(struct extent_io_tree *tree)
+{
+        spin_lock(&tree->lock);
+        while (!RB_EMPTY_ROOT(&tree->state)) {
+                struct rb_node *node;
+                struct extent_state *state;
+
+                node = rb_first(&tree->state);
+                state = rb_entry(node, struct extent_state, rb_node);
+                rb_erase(&state->rb_node, &tree->state);
+                RB_CLEAR_NODE(&state->rb_node);
+                /*
+                 * btree io trees aren't supposed to have tasks waiting for
+                 * changes in the flags of extent states ever.
+                 */
+                ASSERT(!waitqueue_active(&state->wq));
+                free_extent_state(state);
+                if (need_resched()) {
+                        spin_unlock(&tree->lock);
+                        cond_resched();
+                        spin_lock(&tree->lock);
+                }
+        }
+        spin_unlock(&tree->lock);
+}
+
 static noinline void switch_commit_roots(struct btrfs_transaction *trans,
                                          struct btrfs_fs_info *fs_info)
 {
@@ -89,6 +115,7 @@ static noinline void switch_commit_roots(struct btrfs_transaction *trans,
                 root->commit_root = btrfs_root_node(root);
                 if (is_fstree(root->objectid))
                         btrfs_unpin_free_ino(root);
+                clear_btree_io_tree(&root->dirty_log_pages);
         }
         up_write(&fs_info->commit_root_sem);
 }
@@ -220,6 +247,7 @@ loop:
         INIT_LIST_HEAD(&cur_trans->pending_snapshots);
         INIT_LIST_HEAD(&cur_trans->pending_chunks);
         INIT_LIST_HEAD(&cur_trans->switch_commits);
+        INIT_LIST_HEAD(&cur_trans->pending_ordered);
         list_add_tail(&cur_trans->list, &fs_info->trans_list);
         extent_io_tree_init(&cur_trans->dirty_pages,
                              fs_info->btree_inode->i_mapping);
@@ -488,6 +516,7 @@ again:
         h->sync = false;
         INIT_LIST_HEAD(&h->qgroup_ref_list);
         INIT_LIST_HEAD(&h->new_bgs);
+        INIT_LIST_HEAD(&h->ordered);
 
         smp_mb();
         if (cur_trans->state >= TRANS_STATE_BLOCKED &&
@@ -719,6 +748,12 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
         if (!list_empty(&trans->new_bgs))
                 btrfs_create_pending_block_groups(trans, root);
 
+        if (!list_empty(&trans->ordered)) {
+                spin_lock(&info->trans_lock);
+                list_splice(&trans->ordered, &cur_trans->pending_ordered);
+                spin_unlock(&info->trans_lock);
+        }
+
         trans->delayed_ref_updates = 0;
         if (!trans->sync) {
                 must_run_delayed_refs =
@@ -828,17 +863,39 @@ int btrfs_write_marked_extents(struct btrfs_root *root,
 
         while (!find_first_extent_bit(dirty_pages, start, &start, &end,
                                       mark, &cached_state)) {
-                convert_extent_bit(dirty_pages, start, end, EXTENT_NEED_WAIT,
-                                   mark, &cached_state, GFP_NOFS);
-                cached_state = NULL;
-                err = filemap_fdatawrite_range(mapping, start, end);
+                bool wait_writeback = false;
+
+                err = convert_extent_bit(dirty_pages, start, end,
+                                         EXTENT_NEED_WAIT,
+                                         mark, &cached_state, GFP_NOFS);
+                /*
+                 * convert_extent_bit can return -ENOMEM, which is most of the
+                 * time a temporary error. So when it happens, ignore the error
+                 * and wait for writeback of this range to finish - because we
+                 * failed to set the bit EXTENT_NEED_WAIT for the range, a call
+                 * to btrfs_wait_marked_extents() would not know that writeback
+                 * for this range started and therefore wouldn't wait for it to
+                 * finish - we don't want to commit a superblock that points to
+                 * btree nodes/leafs for which writeback hasn't finished yet
+                 * (and without errors).
+                 * We cleanup any entries left in the io tree when committing
+                 * the transaction (through clear_btree_io_tree()).
+                 */
+                if (err == -ENOMEM) {
+                        err = 0;
+                        wait_writeback = true;
+                }
+                if (!err)
+                        err = filemap_fdatawrite_range(mapping, start, end);
                 if (err)
                         werr = err;
+                else if (wait_writeback)
+                        werr = filemap_fdatawait_range(mapping, start, end);
+                free_extent_state(cached_state);
+                cached_state = NULL;
                 cond_resched();
                 start = end + 1;
         }
-        if (err)
-                werr = err;
         return werr;
 }
 
@@ -862,11 +919,25 @@ int btrfs_wait_marked_extents(struct btrfs_root *root,
 
         while (!find_first_extent_bit(dirty_pages, start, &start, &end,
                                       EXTENT_NEED_WAIT, &cached_state)) {
-                clear_extent_bit(dirty_pages, start, end, EXTENT_NEED_WAIT,
-                                 0, 0, &cached_state, GFP_NOFS);
-                err = filemap_fdatawait_range(mapping, start, end);
+                /*
+                 * Ignore -ENOMEM errors returned by clear_extent_bit().
+                 * When committing the transaction, we'll remove any entries
+                 * left in the io tree. For a log commit, we don't remove them
+                 * after committing the log because the tree can be accessed
+                 * concurrently - we do it only at transaction commit time when
+                 * it's safe to do it (through clear_btree_io_tree()).
+                 */
+                err = clear_extent_bit(dirty_pages, start, end,
+                                       EXTENT_NEED_WAIT,
+                                       0, 0, &cached_state, GFP_NOFS);
+                if (err == -ENOMEM)
+                        err = 0;
+                if (!err)
+                        err = filemap_fdatawait_range(mapping, start, end);
                 if (err)
                         werr = err;
+                free_extent_state(cached_state);
+                cached_state = NULL;
                 cond_resched();
                 start = end + 1;
         }
@@ -919,17 +990,17 @@ static int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
         return 0;
 }
 
-int btrfs_write_and_wait_transaction(struct btrfs_trans_handle *trans,
+static int btrfs_write_and_wait_transaction(struct btrfs_trans_handle *trans,
                                      struct btrfs_root *root)
 {
-        if (!trans || !trans->transaction) {
-                struct inode *btree_inode;
-                btree_inode = root->fs_info->btree_inode;
-                return filemap_write_and_wait(btree_inode->i_mapping);
-        }
-        return btrfs_write_and_wait_marked_extents(root,
+        int ret;
+
+        ret = btrfs_write_and_wait_marked_extents(root,
                                            &trans->transaction->dirty_pages,
                                            EXTENT_DIRTY);
+        clear_btree_io_tree(&trans->transaction->dirty_pages);
+
+        return ret;
 }
 
 /*
@@ -1652,6 +1723,28 @@ static inline void btrfs_wait_delalloc_flush(struct btrfs_fs_info *fs_info)
                 btrfs_wait_ordered_roots(fs_info, -1);
 }
 
+static inline void
+btrfs_wait_pending_ordered(struct btrfs_transaction *cur_trans,
+                           struct btrfs_fs_info *fs_info)
+{
+        struct btrfs_ordered_extent *ordered;
+
+        spin_lock(&fs_info->trans_lock);
+        while (!list_empty(&cur_trans->pending_ordered)) {
+                ordered = list_first_entry(&cur_trans->pending_ordered,
+                                           struct btrfs_ordered_extent,
+                                           trans_list);
+                list_del_init(&ordered->trans_list);
+                spin_unlock(&fs_info->trans_lock);
+
+                wait_event(ordered->wait, test_bit(BTRFS_ORDERED_COMPLETE,
+                                                   &ordered->flags));
+                btrfs_put_ordered_extent(ordered);
+                spin_lock(&fs_info->trans_lock);
+        }
+        spin_unlock(&fs_info->trans_lock);
+}
+
 int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
                              struct btrfs_root *root)
 {
@@ -1702,6 +1795,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         }
 
         spin_lock(&root->fs_info->trans_lock);
+        list_splice(&trans->ordered, &cur_trans->pending_ordered);
         if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
                 spin_unlock(&root->fs_info->trans_lock);
                 atomic_inc(&cur_trans->use_count);
@@ -1754,6 +1848,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_wait_delalloc_flush(root->fs_info);
 
+        btrfs_wait_pending_ordered(cur_trans, root->fs_info);
+
         btrfs_scrub_pause(root);
         /*
          * Ok now we need to make sure to block out any other joins while we
@@ -1842,13 +1938,10 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         }
 
         /*
-         * Since the transaction is done, we should set the inode map cache flag
-         * before any other comming transaction.
+         * Since the transaction is done, we can apply the pending changes
+         * before the next transaction.
          */
-        if (btrfs_test_opt(root, CHANGE_INODE_CACHE))
-                btrfs_set_opt(root->fs_info->mount_opt, INODE_MAP_CACHE);
-        else
-                btrfs_clear_opt(root->fs_info->mount_opt, INODE_MAP_CACHE);
+        btrfs_apply_pending_changes(root->fs_info);
 
         /* commit_fs_roots gets rid of all the tree log roots, it is now
          * safe to free the root of tree log roots
@@ -2019,3 +2112,32 @@ int btrfs_clean_one_deleted_snapshot(struct btrfs_root *root)
 
         return (ret < 0) ? 0 : 1;
 }
+
+void btrfs_apply_pending_changes(struct btrfs_fs_info *fs_info)
+{
+        unsigned long prev;
+        unsigned long bit;
+
+        prev = cmpxchg(&fs_info->pending_changes, 0, 0);
+        if (!prev)
+                return;
+
+        bit = 1 << BTRFS_PENDING_SET_INODE_MAP_CACHE;
+        if (prev & bit)
+                btrfs_set_opt(fs_info->mount_opt, INODE_MAP_CACHE);
+        prev &= ~bit;
+
+        bit = 1 << BTRFS_PENDING_CLEAR_INODE_MAP_CACHE;
+        if (prev & bit)
+                btrfs_clear_opt(fs_info->mount_opt, INODE_MAP_CACHE);
+        prev &= ~bit;
+
+        bit = 1 << BTRFS_PENDING_COMMIT;
+        if (prev & bit)
+                btrfs_debug(fs_info, "pending commit done");
+        prev &= ~bit;
+
+        if (prev)
+                btrfs_warn(fs_info,
+                        "unknown pending changes left 0x%lx, ignoring", prev);
+}
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index d8f40e1a5d2d..00ed29c4b3f9 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -56,6 +56,7 @@ struct btrfs_transaction {
         wait_queue_head_t commit_wait;
         struct list_head pending_snapshots;
         struct list_head pending_chunks;
+        struct list_head pending_ordered;
         struct list_head switch_commits;
         struct btrfs_delayed_ref_root delayed_refs;
         int aborted;
@@ -105,6 +106,7 @@ struct btrfs_trans_handle {
          */
         struct btrfs_root *root;
         struct seq_list delayed_ref_elem;
+        struct list_head ordered;
         struct list_head qgroup_ref_list;
         struct list_head new_bgs;
 };
@@ -145,8 +147,6 @@ struct btrfs_trans_handle *btrfs_attach_transaction_barrier(
                                         struct btrfs_root *root);
 struct btrfs_trans_handle *btrfs_start_ioctl_transaction(struct btrfs_root *root);
 int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid);
-int btrfs_write_and_wait_transaction(struct btrfs_trans_handle *trans,
-                                     struct btrfs_root *root);
 
 void btrfs_add_dead_root(struct btrfs_root *root);
 int btrfs_defrag_root(struct btrfs_root *root);
@@ -170,4 +170,6 @@ int btrfs_wait_marked_extents(struct btrfs_root *root,
 int btrfs_transaction_blocked(struct btrfs_fs_info *info);
 int btrfs_transaction_in_commit(struct btrfs_fs_info *info);
 void btrfs_put_transaction(struct btrfs_transaction *transaction);
+void btrfs_apply_pending_changes(struct btrfs_fs_info *fs_info);
+
 #endif
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 286213cec861..9a02da16f2be 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2599,12 +2599,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
         index2 = root_log_ctx.log_transid % 2;
         if (atomic_read(&log_root_tree->log_commit[index2])) {
                 blk_finish_plug(&plug);
-                btrfs_wait_marked_extents(log, &log->dirty_log_pages, mark);
+                ret = btrfs_wait_marked_extents(log, &log->dirty_log_pages,
+                                                mark);
+                btrfs_wait_logged_extents(trans, log, log_transid);
                 wait_log_commit(trans, log_root_tree,
                                 root_log_ctx.log_transid);
-                btrfs_free_logged_extents(log, log_transid);
                 mutex_unlock(&log_root_tree->log_mutex);
-                ret = root_log_ctx.log_ret;
+                if (!ret)
+                        ret = root_log_ctx.log_ret;
                 goto out;
         }
         ASSERT(root_log_ctx.log_transid == log_root_tree->log_transid);
@@ -2641,11 +2643,18 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
                 mutex_unlock(&log_root_tree->log_mutex);
                 goto out_wake_log_root;
         }
-        btrfs_wait_marked_extents(log, &log->dirty_log_pages, mark);
-        btrfs_wait_marked_extents(log_root_tree,
-                                  &log_root_tree->dirty_log_pages,
-                                  EXTENT_NEW | EXTENT_DIRTY);
-        btrfs_wait_logged_extents(log, log_transid);
+        ret = btrfs_wait_marked_extents(log, &log->dirty_log_pages, mark);
+        if (!ret)
+                ret = btrfs_wait_marked_extents(log_root_tree,
+                                                &log_root_tree->dirty_log_pages,
+                                                EXTENT_NEW | EXTENT_DIRTY);
+        if (ret) {
+                btrfs_set_log_full_commit(root->fs_info, trans);
+                btrfs_free_logged_extents(log, log_transid);
+                mutex_unlock(&log_root_tree->log_mutex);
+                goto out_wake_log_root;
+        }
+        btrfs_wait_logged_extents(trans, log, log_transid);
 
         btrfs_set_super_log_root(root->fs_info->super_for_commit,
                                 log_root_tree->node->start);
@@ -3626,6 +3635,12 @@ static int wait_ordered_extents(struct btrfs_trans_handle *trans,
                             test_bit(BTRFS_ORDERED_IOERR, &ordered->flags)));
 
                 if (test_bit(BTRFS_ORDERED_IOERR, &ordered->flags)) {
+                        /*
+                         * Clear the AS_EIO/AS_ENOSPC flags from the inode's
+                         * i_mapping flags, so that the next fsync won't get
+                         * an outdated io error too.
+                         */
+                        btrfs_inode_check_errors(inode);
                         *ordered_io_error = true;
                         break;
                 }
@@ -3766,7 +3781,7 @@ static int log_one_extent(struct btrfs_trans_handle *trans,
         fi = btrfs_item_ptr(leaf, path->slots[0],
                             struct btrfs_file_extent_item);
 
-        btrfs_set_token_file_extent_generation(leaf, fi, em->generation,
+        btrfs_set_token_file_extent_generation(leaf, fi, trans->transid,
                                                &token);
         if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
                 btrfs_set_token_file_extent_type(leaf, fi,
@@ -3963,7 +3978,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
 
         mutex_lock(&BTRFS_I(inode)->log_mutex);
 
-        btrfs_get_logged_extents(inode, &logged_list);
+        btrfs_get_logged_extents(inode, &logged_list, start, end);
 
         /*
          * a brute force approach to making sure we get the most uptodate
@@ -4089,6 +4104,21 @@ log_extents:
         btrfs_release_path(path);
         btrfs_release_path(dst_path);
         if (fast_search) {
+                /*
+                 * Some ordered extents started by fsync might have completed
+                 * before we collected the ordered extents in logged_list, which
+                 * means they're gone, not in our logged_list nor in the inode's
+                 * ordered tree. We want the application/user space to know an
+                 * error happened while attempting to persist file data so that
+                 * it can take proper action. If such error happened, we leave
+                 * without writing to the log tree and the fsync must report the
+                 * file data write error and not commit the current transaction.
+                 */
+                err = btrfs_inode_check_errors(inode);
+                if (err) {
+                        ctx->io_err = err;
+                        goto out_unlock;
+                }
                 ret = btrfs_log_changed_extents(trans, root, inode, dst_path,
                                                 &logged_list, ctx);
                 if (ret) {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d47289c715c8..0144790e296e 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -53,16 +53,6 @@ static void btrfs_dev_stat_print_on_load(struct btrfs_device *device);
 DEFINE_MUTEX(uuid_mutex);
 static LIST_HEAD(fs_uuids);
 
-static void lock_chunks(struct btrfs_root *root)
-{
-        mutex_lock(&root->fs_info->chunk_mutex);
-}
-
-static void unlock_chunks(struct btrfs_root *root)
-{
-        mutex_unlock(&root->fs_info->chunk_mutex);
-}
-
 static struct btrfs_fs_devices *__alloc_fs_devices(void)
 {
         struct btrfs_fs_devices *fs_devs;
@@ -1068,9 +1058,11 @@ static int contains_pending_extent(struct btrfs_trans_handle *trans,
                                    u64 *start, u64 len)
 {
         struct extent_map *em;
+        struct list_head *search_list = &trans->transaction->pending_chunks;
         int ret = 0;
 
-        list_for_each_entry(em, &trans->transaction->pending_chunks, list) {
+again:
+        list_for_each_entry(em, search_list, list) {
                 struct map_lookup *map;
                 int i;
 
@@ -1087,6 +1079,10 @@ static int contains_pending_extent(struct btrfs_trans_handle *trans,
                         ret = 1;
                 }
         }
+        if (search_list == &trans->transaction->pending_chunks) {
+                search_list = &trans->root->fs_info->pinned_chunks;
+                goto again;
+        }
 
         return ret;
 }
@@ -1800,8 +1796,8 @@ error_undo:
         goto error_brelse;
 }
 
-void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
-                                 struct btrfs_device *srcdev)
+void btrfs_rm_dev_replace_remove_srcdev(struct btrfs_fs_info *fs_info,
+                                        struct btrfs_device *srcdev)
 {
         struct btrfs_fs_devices *fs_devices;
 
@@ -1829,6 +1825,12 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
 
         if (srcdev->bdev)
                 fs_devices->open_devices--;
+}
+
+void btrfs_rm_dev_replace_free_srcdev(struct btrfs_fs_info *fs_info,
+                                      struct btrfs_device *srcdev)
+{
+        struct btrfs_fs_devices *fs_devices = srcdev->fs_devices;
 
         call_rcu(&srcdev->rcu, free_device);
 
@@ -2647,18 +2649,12 @@ int btrfs_remove_chunk(struct btrfs_trans_handle *trans,
                 }
         }
 
-        ret = btrfs_remove_block_group(trans, extent_root, chunk_offset);
+        ret = btrfs_remove_block_group(trans, extent_root, chunk_offset, em);
         if (ret) {
                 btrfs_abort_transaction(trans, extent_root, ret);
                 goto out;
         }
 
-        write_lock(&em_tree->lock);
-        remove_extent_mapping(em_tree, em);
-        write_unlock(&em_tree->lock);
-
-        /* once for the tree */
-        free_extent_map(em);
 out:
         /* once for us */
         free_extent_map(em);
@@ -4505,6 +4501,8 @@ error_del_extent:
         free_extent_map(em);
         /* One for the tree reference */
         free_extent_map(em);
+        /* One for the pending_chunks list reference */
+        free_extent_map(em);
 error:
         kfree(devices_info);
         return ret;
@@ -4881,13 +4879,15 @@ static inline int parity_smaller(u64 a, u64 b)
 static void sort_parity_stripes(struct btrfs_bio *bbio, u64 *raid_map)
 {
         struct btrfs_bio_stripe s;
+        int real_stripes = bbio->num_stripes - bbio->num_tgtdevs;
         int i;
         u64 l;
         int again = 1;
+        int m;
 
         while (again) {
                 again = 0;
-                for (i = 0; i < bbio->num_stripes - 1; i++) {
+                for (i = 0; i < real_stripes - 1; i++) {
                         if (parity_smaller(raid_map[i], raid_map[i+1])) {
                                 s = bbio->stripes[i];
                                 l = raid_map[i];
@@ -4895,6 +4895,14 @@ static void sort_parity_stripes(struct btrfs_bio *bbio, u64 *raid_map)
                                 raid_map[i] = raid_map[i+1];
                                 bbio->stripes[i+1] = s;
                                 raid_map[i+1] = l;
+
+                                if (bbio->tgtdev_map) {
+                                        m = bbio->tgtdev_map[i];
+                                        bbio->tgtdev_map[i] =
+                                                        bbio->tgtdev_map[i + 1];
+                                        bbio->tgtdev_map[i + 1] = m;
+                                }
+
                                 again = 1;
                         }
                 }
@@ -4923,6 +4931,7 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
         int ret = 0;
         int num_stripes;
         int max_errors = 0;
+        int tgtdev_indexes = 0;
         struct btrfs_bio *bbio = NULL;
         struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
         int dev_replace_is_ongoing = 0;
@@ -5161,15 +5170,14 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
                                 BTRFS_BLOCK_GROUP_RAID6)) {
                 u64 tmp;
 
-                if (bbio_ret && ((rw & REQ_WRITE) || mirror_num > 1)
-                    && raid_map_ret) {
+                if (raid_map_ret &&
+                    ((rw & (REQ_WRITE | REQ_GET_READ_MIRRORS)) ||
+                     mirror_num > 1)) {
                         int i, rot;
 
                         /* push stripe_nr back to the start of the full stripe */
                         stripe_nr = raid56_full_stripe_start;
-                        do_div(stripe_nr, stripe_len);
-
-                        stripe_index = do_div(stripe_nr, nr_data_stripes(map));
+                        do_div(stripe_nr, stripe_len * nr_data_stripes(map));
 
                         /* RAID[56] write or recovery. Return all stripes */
                         num_stripes = map->num_stripes;
@@ -5235,14 +5243,19 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
                         num_alloc_stripes <<= 1;
                 if (rw & REQ_GET_READ_MIRRORS)
                         num_alloc_stripes++;
+                tgtdev_indexes = num_stripes;
         }
-        bbio = kzalloc(btrfs_bio_size(num_alloc_stripes), GFP_NOFS);
+
+        bbio = kzalloc(btrfs_bio_size(num_alloc_stripes, tgtdev_indexes),
+                       GFP_NOFS);
         if (!bbio) {
                 kfree(raid_map);
                 ret = -ENOMEM;
                 goto out;
         }
         atomic_set(&bbio->error, 0);
+        if (dev_replace_is_ongoing)
+                bbio->tgtdev_map = (int *)(bbio->stripes + num_alloc_stripes);
 
         if (rw & REQ_DISCARD) {
                 int factor = 0;
@@ -5327,6 +5340,7 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
         if (rw & (REQ_WRITE | REQ_GET_READ_MIRRORS))
                 max_errors = btrfs_chunk_max_errors(map);
 
+        tgtdev_indexes = 0;
         if (dev_replace_is_ongoing && (rw & (REQ_WRITE | REQ_DISCARD)) &&
             dev_replace->tgtdev != NULL) {
                 int index_where_to_add;
@@ -5355,8 +5369,10 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
                                 new->physical = old->physical;
                                 new->length = old->length;
                                 new->dev = dev_replace->tgtdev;
+                                bbio->tgtdev_map[i] = index_where_to_add;
                                 index_where_to_add++;
                                 max_errors++;
+                                tgtdev_indexes++;
                         }
                 }
                 num_stripes = index_where_to_add;
@@ -5402,7 +5418,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
                                 tgtdev_stripe->length =
                                         bbio->stripes[index_srcdev].length;
                                 tgtdev_stripe->dev = dev_replace->tgtdev;
+                                bbio->tgtdev_map[index_srcdev] = num_stripes;
 
+                                tgtdev_indexes++;
                                 num_stripes++;
                         }
                 }
@@ -5412,6 +5430,7 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
         bbio->num_stripes = num_stripes;
         bbio->max_errors = max_errors;
         bbio->mirror_num = mirror_num;
+        bbio->num_tgtdevs = tgtdev_indexes;
 
         /*
          * this is the case that REQ_READ && dev_replace_is_ongoing &&
@@ -5443,6 +5462,16 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
                                  mirror_num, NULL);
 }
 
+/* For Scrub/replace */
+int btrfs_map_sblock(struct btrfs_fs_info *fs_info, int rw,
+                     u64 logical, u64 *length,
+                     struct btrfs_bio **bbio_ret, int mirror_num,
+                     u64 **raid_map_ret)
+{
+        return __btrfs_map_block(fs_info, rw, logical, length, bbio_ret,
+                                 mirror_num, raid_map_ret);
+}
+
 int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
                      u64 chunk_start, u64 physical, u64 devid,
                      u64 **logical, int *naddrs, int *stripe_len)
@@ -5812,12 +5841,9 @@ int btrfs_map_bio(struct btrfs_root *root, int rw, struct bio *bio,
                 } else {
                         ret = raid56_parity_recover(root, bio, bbio,
                                                     raid_map, map_length,
-                                                    mirror_num);
+                                                    mirror_num, 1);
                 }
-                /*
-                 * FIXME, replace dosen't support raid56 yet, please fix
-                 * it in the future.
-                 */
+
                 btrfs_bio_counter_dec(root->fs_info);
                 return ret;
         }
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 08980fa23039..d6fe73c0f4a2 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -292,7 +292,7 @@ struct btrfs_bio_stripe {
 struct btrfs_bio;
 typedef void (btrfs_bio_end_io_t) (struct btrfs_bio *bio, int err);
 
-#define BTRFS_BIO_ORIG_BIO_SUBMITTED    0x1
+#define BTRFS_BIO_ORIG_BIO_SUBMITTED    (1 << 0)
 
 struct btrfs_bio {
         atomic_t stripes_pending;
@@ -305,6 +305,8 @@ struct btrfs_bio {
         int max_errors;
         int num_stripes;
         int mirror_num;
+        int num_tgtdevs;
+        int *tgtdev_map;
         struct btrfs_bio_stripe stripes[];
 };
 
@@ -387,12 +389,18 @@ struct btrfs_balance_control {
 int btrfs_account_dev_extents_size(struct btrfs_device *device, u64 start,
                                    u64 end, u64 *length);
 
-#define btrfs_bio_size(n) (sizeof(struct btrfs_bio) + \
-                            (sizeof(struct btrfs_bio_stripe) * (n)))
+#define btrfs_bio_size(total_stripes, real_stripes)             \
+        (sizeof(struct btrfs_bio) +                             \
+         (sizeof(struct btrfs_bio_stripe) * (total_stripes)) +  \
+         (sizeof(int) * (real_stripes)))
 
 int btrfs_map_block(struct btrfs_fs_info *fs_info, int rw,
                     u64 logical, u64 *length,
                     struct btrfs_bio **bbio_ret, int mirror_num);
+int btrfs_map_sblock(struct btrfs_fs_info *fs_info, int rw,
+                     u64 logical, u64 *length,
+                     struct btrfs_bio **bbio_ret, int mirror_num,
+                     u64 **raid_map_ret);
 int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
                      u64 chunk_start, u64 physical, u64 devid,
                      u64 **logical, int *naddrs, int *stripe_len);
@@ -448,8 +456,10 @@ void btrfs_init_devices_late(struct btrfs_fs_info *fs_info);
 int btrfs_init_dev_stats(struct btrfs_fs_info *fs_info);
 int btrfs_run_dev_stats(struct btrfs_trans_handle *trans,
                         struct btrfs_fs_info *fs_info);
-void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
-                                 struct btrfs_device *srcdev);
+void btrfs_rm_dev_replace_remove_srcdev(struct btrfs_fs_info *fs_info,
+                                        struct btrfs_device *srcdev);
+void btrfs_rm_dev_replace_free_srcdev(struct btrfs_fs_info *fs_info,
+                                      struct btrfs_device *srcdev);
 void btrfs_destroy_dev_replace_tgtdev(struct btrfs_fs_info *fs_info,
                                       struct btrfs_device *tgtdev);
 void btrfs_init_dev_replace_tgtdev_for_resume(struct btrfs_fs_info *fs_info,
@@ -513,4 +523,16 @@ static inline void btrfs_dev_stat_reset(struct btrfs_device *dev,
 void btrfs_update_commit_device_size(struct btrfs_fs_info *fs_info);
 void btrfs_update_commit_device_bytes_used(struct btrfs_root *root,
                                         struct btrfs_transaction *transaction);
+
+static inline void lock_chunks(struct btrfs_root *root)
+{
+        mutex_lock(&root->fs_info->chunk_mutex);
+}
+
+static inline void unlock_chunks(struct btrfs_root *root)
+{
+        mutex_unlock(&root->fs_info->chunk_mutex);
+}
+
+
 #endif
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index dcf20131fbe4..47b19465f0dc 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -29,6 +29,7 @@
 #include "xattr.h"
 #include "disk-io.h"
 #include "props.h"
+#include "locking.h"
 
 
 ssize_t __btrfs_getxattr(struct inode *inode, const char *name,
@@ -91,7 +92,7 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
                        struct inode *inode, const char *name,
                        const void *value, size_t size, int flags)
 {
-        struct btrfs_dir_item *di;
+        struct btrfs_dir_item *di = NULL;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_path *path;
         size_t name_len = strlen(name);
@@ -103,84 +104,119 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         if (!path)
                 return -ENOMEM;
+        path->skip_release_on_error = 1;
+
+        if (!value) {
+                di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode),
+                                        name, name_len, -1);
+                if (!di && (flags & XATTR_REPLACE))
+                        ret = -ENODATA;
+                else if (di)
+                        ret = btrfs_delete_one_dir_name(trans, root, path, di);
+                goto out;
+        }
 
+        /*
+         * For a replace we can't just do the insert blindly.
+         * Do a lookup first (read-only btrfs_search_slot), and return if xattr
+         * doesn't exist. If it exists, fall down below to the insert/replace
+         * path - we can't race with a concurrent xattr delete, because the VFS
+         * locks the inode's i_mutex before calling setxattr or removexattr.
+         */
         if (flags & XATTR_REPLACE) {
-                di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode), name,
-                                        name_len, -1);
-                if (IS_ERR(di)) {
-                        ret = PTR_ERR(di);
-                        goto out;
-                } else if (!di) {
+                ASSERT(mutex_is_locked(&inode->i_mutex));
+                di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
+                                        name, name_len, 0);
+                if (!di) {
                         ret = -ENODATA;
                         goto out;
                 }
-                ret = btrfs_delete_one_dir_name(trans, root, path, di);
-                if (ret)
-                        goto out;
                 btrfs_release_path(path);
+                di = NULL;
+        }
 
+        ret = btrfs_insert_xattr_item(trans, root, path, btrfs_ino(inode),
+                                      name, name_len, value, size);
+        if (ret == -EOVERFLOW) {
                 /*
-                 * remove the attribute
+                 * We have an existing item in a leaf, split_leaf couldn't
+                 * expand it. That item might have or not a dir_item that
+                 * matches our target xattr, so lets check.
                  */
-                if (!value)
-                        goto out;
-        } else {
-                di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
-                                        name, name_len, 0);
-                if (IS_ERR(di)) {
-                        ret = PTR_ERR(di);
+                ret = 0;
+                btrfs_assert_tree_locked(path->nodes[0]);
+                di = btrfs_match_dir_item_name(root, path, name, name_len);
+                if (!di && !(flags & XATTR_REPLACE)) {
+                        ret = -ENOSPC;
                         goto out;
                 }
-                if (!di && !value)
-                        goto out;
-                btrfs_release_path(path);
+        } else if (ret == -EEXIST) {
+                ret = 0;
+                di = btrfs_match_dir_item_name(root, path, name, name_len);
+                ASSERT(di); /* logic error */
+        } else if (ret) {
+                goto out;
         }
 
-again:
-        ret = btrfs_insert_xattr_item(trans, root, path, btrfs_ino(inode),
-                                      name, name_len, value, size);
-        /*
-         * If we're setting an xattr to a new value but the new value is say
-         * exactly BTRFS_MAX_XATTR_SIZE, we could end up with EOVERFLOW getting
-         * back from split_leaf.  This is because it thinks we'll be extending
-         * the existing item size, but we're asking for enough space to add the
-         * item itself.  So if we get EOVERFLOW just set ret to EEXIST and let
-         * the rest of the function figure it out.
-         */
-        if (ret == -EOVERFLOW)
+        if (di && (flags & XATTR_CREATE)) {
                 ret = -EEXIST;
+                goto out;
+        }
 
-        if (ret == -EEXIST) {
-                if (flags & XATTR_CREATE)
-                        goto out;
+        if (di) {
                 /*
-                 * We can't use the path we already have since we won't have the
-                 * proper locking for a delete, so release the path and
-                 * re-lookup to delete the thing.
+                 * We're doing a replace, and it must be atomic, that is, at
+                 * any point in time we have either the old or the new xattr
+                 * value in the tree. We don't want readers (getxattr and
+                 * listxattrs) to miss a value, this is specially important
+                 * for ACLs.
                  */
-                btrfs_release_path(path);
-                di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode),
-                                        name, name_len, -1);
-                if (IS_ERR(di)) {
-                        ret = PTR_ERR(di);
-                        goto out;
-                } else if (!di) {
-                        /* Shouldn't happen but just in case... */
-                        btrfs_release_path(path);
-                        goto again;
+                const int slot = path->slots[0];
+                struct extent_buffer *leaf = path->nodes[0];
+                const u16 old_data_len = btrfs_dir_data_len(leaf, di);
+                const u32 item_size = btrfs_item_size_nr(leaf, slot);
+                const u32 data_size = sizeof(*di) + name_len + size;
+                struct btrfs_item *item;
+                unsigned long data_ptr;
+                char *ptr;
+
+                if (size > old_data_len) {
+                        if (btrfs_leaf_free_space(root, leaf) <
+                            (size - old_data_len)) {
+                                ret = -ENOSPC;
+                                goto out;
+                        }
                 }
 
-                ret = btrfs_delete_one_dir_name(trans, root, path, di);
-                if (ret)
-                        goto out;
+                if (old_data_len + name_len + sizeof(*di) == item_size) {
+                        /* No other xattrs packed in the same leaf item. */
+                        if (size > old_data_len)
+                                btrfs_extend_item(root, path,
+                                                  size - old_data_len);
+                        else if (size < old_data_len)
+                                btrfs_truncate_item(root, path, data_size, 1);
+                } else {
+                        /* There are other xattrs packed in the same item. */
+                        ret = btrfs_delete_one_dir_name(trans, root, path, di);
+                        if (ret)
+                                goto out;
+                        btrfs_extend_item(root, path, data_size);
+                }
 
+                item = btrfs_item_nr(slot);
+                ptr = btrfs_item_ptr(leaf, slot, char);
+                ptr += btrfs_item_size(leaf, item) - data_size;
+                di = (struct btrfs_dir_item *)ptr;
+                btrfs_set_dir_data_len(leaf, di, size);
+                data_ptr = ((unsigned long)(di + 1)) + name_len;
+                write_extent_buffer(leaf, value, data_ptr, size);
+                btrfs_mark_buffer_dirty(leaf);
+        } else {
                 /*
-                 * We have a value to set, so go back and try to insert it now.
+                 * Insert, and we had space for the xattr, so path->slots[0] is
+                 * where our xattr dir_item is and btrfs_insert_xattr_item()
+                 * filled it.
                  */
-                if (value) {
-                        btrfs_release_path(path);
-                        goto again;
-                }
         }
 out:
         btrfs_free_path(path);
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index db3f772e57ae..a75fba67bb1f 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -158,17 +158,8 @@ struct ext4_allocation_request {
 #define EXT4_MAP_MAPPED         (1 << BH_Mapped)
 #define EXT4_MAP_UNWRITTEN      (1 << BH_Unwritten)
 #define EXT4_MAP_BOUNDARY       (1 << BH_Boundary)
-/* Sometimes (in the bigalloc case, from ext4_da_get_block_prep) the caller of
- * ext4_map_blocks wants to know whether or not the underlying cluster has
- * already been accounted for. EXT4_MAP_FROM_CLUSTER conveys to the caller that
- * the requested mapping was from previously mapped (or delayed allocated)
- * cluster. We use BH_AllocFromCluster only for this flag. BH_AllocFromCluster
- * should never appear on buffer_head's state flags.
- */
-#define EXT4_MAP_FROM_CLUSTER   (1 << BH_AllocFromCluster)
 #define EXT4_MAP_FLAGS          (EXT4_MAP_NEW | EXT4_MAP_MAPPED |\
-                                 EXT4_MAP_UNWRITTEN | EXT4_MAP_BOUNDARY |\
-                                 EXT4_MAP_FROM_CLUSTER)
+                                 EXT4_MAP_UNWRITTEN | EXT4_MAP_BOUNDARY)
 
 struct ext4_map_blocks {
         ext4_fsblk_t m_pblk;
@@ -565,10 +556,8 @@ enum {
 #define EXT4_GET_BLOCKS_KEEP_SIZE               0x0080
         /* Do not take i_data_sem locking in ext4_map_blocks */
 #define EXT4_GET_BLOCKS_NO_LOCK                 0x0100
-        /* Do not put hole in extent cache */
-#define EXT4_GET_BLOCKS_NO_PUT_HOLE             0x0200
         /* Convert written extents to unwritten */
-#define EXT4_GET_BLOCKS_CONVERT_UNWRITTEN       0x0400
+#define EXT4_GET_BLOCKS_CONVERT_UNWRITTEN       0x0200
 
 /*
  * The bit position of these flags must not overlap with any of the
@@ -889,10 +878,12 @@ struct ext4_inode_info {
         /* extents status tree */
         struct ext4_es_tree i_es_tree;
         rwlock_t i_es_lock;
-        struct list_head i_es_lru;
+        struct list_head i_es_list;
         unsigned int i_es_all_nr;       /* protected by i_es_lock */
-        unsigned int i_es_lru_nr;       /* protected by i_es_lock */
-        unsigned long i_touch_when;     /* jiffies of last accessing */
+        unsigned int i_es_shk_nr;       /* protected by i_es_lock */
+        ext4_lblk_t i_es_shrink_lblk;   /* Offset where we start searching for
+                                           extents to shrink. Protected by
+                                           i_es_lock  */
 
         /* ialloc */
         ext4_group_t    i_last_alloc_group;
@@ -1337,10 +1328,11 @@ struct ext4_sb_info {
 
         /* Reclaim extents from extent status tree */
         struct shrinker s_es_shrinker;
-        struct list_head s_es_lru;
+        struct list_head s_es_list;     /* List of inodes with reclaimable extents */
+        long s_es_nr_inode;
         struct ext4_es_stats s_es_stats;
         struct mb_cache *s_mb_cache;
-        spinlock_t s_es_lru_lock ____cacheline_aligned_in_smp;
+        spinlock_t s_es_lock ____cacheline_aligned_in_smp;
 
         /* Ratelimit ext4 messages. */
         struct ratelimit_state s_err_ratelimit_state;
@@ -2196,7 +2188,6 @@ extern int ext4_calculate_overhead(struct super_block *sb);
 extern void ext4_superblock_csum_set(struct super_block *sb);
 extern void *ext4_kvmalloc(size_t size, gfp_t flags);
 extern void *ext4_kvzalloc(size_t size, gfp_t flags);
-extern void ext4_kvfree(void *ptr);
 extern int ext4_alloc_flex_bg_array(struct super_block *sb,
                                     ext4_group_t ngroup);
 extern const char *ext4_decode_error(struct super_block *sb, int errno,
@@ -2647,7 +2638,7 @@ extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode,
                                         int *retval);
 extern int ext4_inline_data_fiemap(struct inode *inode,
                                    struct fiemap_extent_info *fieinfo,
-                                   int *has_inline);
+                                   int *has_inline, __u64 start, __u64 len);
 extern int ext4_try_to_evict_inline_data(handle_t *handle,
                                          struct inode *inode,
                                          int needed);
@@ -2795,16 +2786,6 @@ extern int ext4_bio_write_page(struct ext4_io_submit *io,
 extern int ext4_multi_mount_protect(struct super_block *, ext4_fsblk_t);
 
 /*
- * Note that these flags will never ever appear in a buffer_head's state flag.
- * See EXT4_MAP_... to see where this is used.
- */
-enum ext4_state_bits {
-        BH_AllocFromCluster     /* allocated blocks were part of already
-                                 * allocated cluster. */
-        = BH_JBDPrivateStart
-};
-
-/*
  * Add new method to test whether block and inode bitmaps are properly
  * initialized. With uninit_bg reading the block from disk is not enough
  * to mark the bitmap uptodate. We need to also zero-out the bitmap
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 0b16fb4c06d3..e5d3eadf47b1 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2306,16 +2306,16 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
                                 ext4_lblk_t block)
 {
         int depth = ext_depth(inode);
-        unsigned long len = 0;
-        ext4_lblk_t lblock = 0;
+        ext4_lblk_t len;
+        ext4_lblk_t lblock;
         struct ext4_extent *ex;
+        struct extent_status es;
 
         ex = path[depth].p_ext;
         if (ex == NULL) {
-                /*
-                 * there is no extent yet, so gap is [0;-] and we
-                 * don't cache it
-                 */
+                /* there is no extent yet, so gap is [0;-] */
+                lblock = 0;
+                len = EXT_MAX_BLOCKS;
                 ext_debug("cache gap(whole file):");
         } else if (block < le32_to_cpu(ex->ee_block)) {
                 lblock = block;
@@ -2324,9 +2324,6 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
                                 block,
                                 le32_to_cpu(ex->ee_block),
                                  ext4_ext_get_actual_len(ex));
-                if (!ext4_find_delalloc_range(inode, lblock, lblock + len - 1))
-                        ext4_es_insert_extent(inode, lblock, len, ~0,
-                                              EXTENT_STATUS_HOLE);
         } else if (block >= le32_to_cpu(ex->ee_block)
                         + ext4_ext_get_actual_len(ex)) {
                 ext4_lblk_t next;
@@ -2340,14 +2337,19 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
                                 block);
                 BUG_ON(next == lblock);
                 len = next - lblock;
-                if (!ext4_find_delalloc_range(inode, lblock, lblock + len - 1))
-                        ext4_es_insert_extent(inode, lblock, len, ~0,
-                                              EXTENT_STATUS_HOLE);
         } else {
                 BUG();
         }
 
-        ext_debug(" -> %u:%lu\n", lblock, len);
+        ext4_es_find_delayed_extent_range(inode, lblock, lblock + len - 1, &es);
+        if (es.es_len) {
+                /* There's delayed extent containing lblock? */
+                if (es.es_lblk <= lblock)
+                        return;
+                len = min(es.es_lblk - lblock, len);
+        }
+        ext_debug(" -> %u:%u\n", lblock, len);
+        ext4_es_insert_extent(inode, lblock, len, ~0, EXTENT_STATUS_HOLE);
 }
 
 /*
@@ -2481,7 +2483,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                               ext4_lblk_t from, ext4_lblk_t to)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        unsigned short ee_len =  ext4_ext_get_actual_len(ex);
+        unsigned short ee_len = ext4_ext_get_actual_len(ex);
         ext4_fsblk_t pblk;
         int flags = get_default_free_blocks_flags(inode);
 
@@ -2490,7 +2492,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
          * at the beginning of the extent.  Instead, we make a note
          * that we tried freeing the cluster, and check to see if we
          * need to free it on a subsequent call to ext4_remove_blocks,
-         * or at the end of the ext4_truncate() operation.
+         * or at the end of ext4_ext_rm_leaf or ext4_ext_remove_space.
          */
         flags |= EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER;
 
@@ -2501,8 +2503,8 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
          * partial cluster here.
          */
         pblk = ext4_ext_pblock(ex) + ee_len - 1;
-        if ((*partial_cluster > 0) &&
-            (EXT4_B2C(sbi, pblk) != *partial_cluster)) {
+        if (*partial_cluster > 0 &&
+            *partial_cluster != (long long) EXT4_B2C(sbi, pblk)) {
                 ext4_free_blocks(handle, inode, NULL,
                                  EXT4_C2B(sbi, *partial_cluster),
                                  sbi->s_cluster_ratio, flags);
@@ -2528,7 +2530,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
             && to == le32_to_cpu(ex->ee_block) + ee_len - 1) {
                 /* tail removal */
                 ext4_lblk_t num;
-                unsigned int unaligned;
+                long long first_cluster;
 
                 num = le32_to_cpu(ex->ee_block) + ee_len - from;
                 pblk = ext4_ext_pblock(ex) + ee_len - num;
@@ -2538,7 +2540,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                  * used by any other extent (partial_cluster is negative).
                  */
                 if (*partial_cluster < 0 &&
-                    -(*partial_cluster) == EXT4_B2C(sbi, pblk + num - 1))
+                    *partial_cluster == -(long long) EXT4_B2C(sbi, pblk+num-1))
                         flags |= EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER;
 
                 ext_debug("free last %u blocks starting %llu partial %lld\n",
@@ -2549,21 +2551,24 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                  * beginning of a cluster, and we removed the entire
                  * extent and the cluster is not used by any other extent,
                  * save the partial cluster here, since we might need to
-                 * delete if we determine that the truncate operation has
-                 * removed all of the blocks in the cluster.
+                 * delete if we determine that the truncate or punch hole
+                 * operation has removed all of the blocks in the cluster.
+                 * If that cluster is used by another extent, preserve its
+                 * negative value so it isn't freed later on.
                  *
-                 * On the other hand, if we did not manage to free the whole
-                 * extent, we have to mark the cluster as used (store negative
-                 * cluster number in partial_cluster).
+                 * If the whole extent wasn't freed, we've reached the
+                 * start of the truncated/punched region and have finished
+                 * removing blocks.  If there's a partial cluster here it's
+                 * shared with the remainder of the extent and is no longer
+                 * a candidate for removal.
                  */
-                unaligned = EXT4_PBLK_COFF(sbi, pblk);
-                if (unaligned && (ee_len == num) &&
-                    (*partial_cluster != -((long long)EXT4_B2C(sbi, pblk))))
-                        *partial_cluster = EXT4_B2C(sbi, pblk);
-                else if (unaligned)
-                        *partial_cluster = -((long long)EXT4_B2C(sbi, pblk));
-                else if (*partial_cluster > 0)
+                if (EXT4_PBLK_COFF(sbi, pblk) && ee_len == num) {
+                        first_cluster = (long long) EXT4_B2C(sbi, pblk);
+                        if (first_cluster != -*partial_cluster)
+                                *partial_cluster = first_cluster;
+                } else {
                         *partial_cluster = 0;
+                }
         } else
                 ext4_error(sbi->s_sb, "strange request: removal(2) "
                            "%u-%u from %u:%u\n",
@@ -2574,15 +2579,16 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
 
 /*
  * ext4_ext_rm_leaf() Removes the extents associated with the
- * blocks appearing between "start" and "end", and splits the extents
- * if "start" and "end" appear in the same extent
+ * blocks appearing between "start" and "end".  Both "start"
+ * and "end" must appear in the same extent or EIO is returned.
  *
  * @handle: The journal handle
  * @inode:  The files inode
  * @path:   The path to the leaf
  * @partial_cluster: The cluster which we'll have to free if all extents
- *                   has been released from it. It gets negative in case
- *                   that the cluster is still used.
+ *                   has been released from it.  However, if this value is
+ *                   negative, it's a cluster just to the right of the
+ *                   punched region and it must not be freed.
  * @start:  The first block to remove
  * @end:   The last block to remove
  */
@@ -2621,27 +2627,6 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
         ex_ee_block = le32_to_cpu(ex->ee_block);
         ex_ee_len = ext4_ext_get_actual_len(ex);
 
-        /*
-         * If we're starting with an extent other than the last one in the
-         * node, we need to see if it shares a cluster with the extent to
-         * the right (towards the end of the file). If its leftmost cluster
-         * is this extent's rightmost cluster and it is not cluster aligned,
-         * we'll mark it as a partial that is not to be deallocated.
-         */
-
-        if (ex != EXT_LAST_EXTENT(eh)) {
-                ext4_fsblk_t current_pblk, right_pblk;
-                long long current_cluster, right_cluster;
-
-                current_pblk = ext4_ext_pblock(ex) + ex_ee_len - 1;
-                current_cluster = (long long)EXT4_B2C(sbi, current_pblk);
-                right_pblk = ext4_ext_pblock(ex + 1);
-                right_cluster = (long long)EXT4_B2C(sbi, right_pblk);
-                if (current_cluster == right_cluster &&
-                        EXT4_PBLK_COFF(sbi, right_pblk))
-                        *partial_cluster = -right_cluster;
-        }
-
         trace_ext4_ext_rm_leaf(inode, start, ex, *partial_cluster);
 
         while (ex >= EXT_FIRST_EXTENT(eh) &&
@@ -2666,14 +2651,16 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                 if (end < ex_ee_block) {
                         /*
                          * We're going to skip this extent and move to another,
-                         * so if this extent is not cluster aligned we have
-                         * to mark the current cluster as used to avoid
-                         * accidentally freeing it later on
+                         * so note that its first cluster is in use to avoid
+                         * freeing it when removing blocks.  Eventually, the
+                         * right edge of the truncated/punched region will
+                         * be just to the left.
                          */
-                        pblk = ext4_ext_pblock(ex);
-                        if (EXT4_PBLK_COFF(sbi, pblk))
+                        if (sbi->s_cluster_ratio > 1) {
+                                pblk = ext4_ext_pblock(ex);
                                 *partial_cluster =
-                                        -((long long)EXT4_B2C(sbi, pblk));
+                                        -(long long) EXT4_B2C(sbi, pblk);
+                        }
                         ex--;
                         ex_ee_block = le32_to_cpu(ex->ee_block);
                         ex_ee_len = ext4_ext_get_actual_len(ex);
@@ -2749,8 +2736,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                                         sizeof(struct ext4_extent));
                         }
                         le16_add_cpu(&eh->eh_entries, -1);
-                } else if (*partial_cluster > 0)
-                        *partial_cluster = 0;
+                }
 
                 err = ext4_ext_dirty(handle, inode, path + depth);
                 if (err)
@@ -2769,20 +2755,18 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
         /*
          * If there's a partial cluster and at least one extent remains in
          * the leaf, free the partial cluster if it isn't shared with the
-         * current extent.  If there's a partial cluster and no extents
-         * remain in the leaf, it can't be freed here.  It can only be
-         * freed when it's possible to determine if it's not shared with
-         * any other extent - when the next leaf is processed or when space
-         * removal is complete.
+         * current extent.  If it is shared with the current extent
+         * we zero partial_cluster because we've reached the start of the
+         * truncated/punched region and we're done removing blocks.
          */
-        if (*partial_cluster > 0 && eh->eh_entries &&
-            (EXT4_B2C(sbi, ext4_ext_pblock(ex) + ex_ee_len - 1) !=
-             *partial_cluster)) {
-                int flags = get_default_free_blocks_flags(inode);
-
-                ext4_free_blocks(handle, inode, NULL,
-                                 EXT4_C2B(sbi, *partial_cluster),
-                                 sbi->s_cluster_ratio, flags);
+        if (*partial_cluster > 0 && ex >= EXT_FIRST_EXTENT(eh)) {
+                pblk = ext4_ext_pblock(ex) + ex_ee_len - 1;
+                if (*partial_cluster != (long long) EXT4_B2C(sbi, pblk)) {
+                        ext4_free_blocks(handle, inode, NULL,
+                                         EXT4_C2B(sbi, *partial_cluster),
+                                         sbi->s_cluster_ratio,
+                                         get_default_free_blocks_flags(inode));
+                }
                 *partial_cluster = 0;
         }
 
@@ -2819,7 +2803,7 @@ ext4_ext_more_to_rm(struct ext4_ext_path *path)
 int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
                           ext4_lblk_t end)
 {
-        struct super_block *sb = inode->i_sb;
+        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         int depth = ext_depth(inode);
         struct ext4_ext_path *path = NULL;
         long long partial_cluster = 0;
@@ -2845,9 +2829,10 @@ again:
          */
         if (end < EXT_MAX_BLOCKS - 1) {
                 struct ext4_extent *ex;
-                ext4_lblk_t ee_block;
+                ext4_lblk_t ee_block, ex_end, lblk;
+                ext4_fsblk_t pblk;
 
-                /* find extent for this block */
+                /* find extent for or closest extent to this block */
                 path = ext4_find_extent(inode, end, NULL, EXT4_EX_NOCACHE);
                 if (IS_ERR(path)) {
                         ext4_journal_stop(handle);
@@ -2867,6 +2852,7 @@ again:
                 }
 
                 ee_block = le32_to_cpu(ex->ee_block);
+                ex_end = ee_block + ext4_ext_get_actual_len(ex) - 1;
 
                 /*
                  * See if the last block is inside the extent, if so split
@@ -2874,8 +2860,19 @@ again:
                  * tail of the first part of the split extent in
                  * ext4_ext_rm_leaf().
                  */
-                if (end >= ee_block &&
-                    end < ee_block + ext4_ext_get_actual_len(ex) - 1) {
+                if (end >= ee_block && end < ex_end) {
+
+                        /*
+                         * If we're going to split the extent, note that
+                         * the cluster containing the block after 'end' is
+                         * in use to avoid freeing it when removing blocks.
+                         */
+                        if (sbi->s_cluster_ratio > 1) {
+                                pblk = ext4_ext_pblock(ex) + end - ee_block + 2;
+                                partial_cluster =
+                                        -(long long) EXT4_B2C(sbi, pblk);
+                        }
+
                         /*
                          * Split the extent in two so that 'end' is the last
                          * block in the first new extent. Also we should not
@@ -2886,6 +2883,24 @@ again:
                                                          end + 1, 1);
                         if (err < 0)
                                 goto out;
+
+                } else if (sbi->s_cluster_ratio > 1 && end >= ex_end) {
+                        /*
+                         * If there's an extent to the right its first cluster
+                         * contains the immediate right boundary of the
+                         * truncated/punched region.  Set partial_cluster to
+                         * its negative value so it won't be freed if shared
+                         * with the current extent.  The end < ee_block case
+                         * is handled in ext4_ext_rm_leaf().
+                         */
+                        lblk = ex_end + 1;
+                        err = ext4_ext_search_right(inode, path, &lblk, &pblk,
+                                                    &ex);
+                        if (err)
+                                goto out;
+                        if (pblk)
+                                partial_cluster =
+                                        -(long long) EXT4_B2C(sbi, pblk);
                 }
         }
         /*
@@ -2996,16 +3011,18 @@ again:
         trace_ext4_ext_remove_space_done(inode, start, end, depth,
                         partial_cluster, path->p_hdr->eh_entries);
 
-        /* If we still have something in the partial cluster and we have removed
+        /*
+         * If we still have something in the partial cluster and we have removed
          * even the first extent, then we should free the blocks in the partial
-         * cluster as well. */
-        if (partial_cluster > 0 && path->p_hdr->eh_entries == 0) {
-                int flags = get_default_free_blocks_flags(inode);
-
+         * cluster as well.  (This code will only run when there are no leaves
+         * to the immediate left of the truncated/punched region.)
+         */
+        if (partial_cluster > 0 && err == 0) {
+                /* don't zero partial_cluster since it's not used afterwards */
                 ext4_free_blocks(handle, inode, NULL,
-                                 EXT4_C2B(EXT4_SB(sb), partial_cluster),
-                                 EXT4_SB(sb)->s_cluster_ratio, flags);
-                partial_cluster = 0;
+                                 EXT4_C2B(sbi, partial_cluster),
+                                 sbi->s_cluster_ratio,
+                                 get_default_free_blocks_flags(inode));
         }
 
         /* TODO: flexible tree reduction should be here */
@@ -4267,6 +4284,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
         ext4_io_end_t *io = ext4_inode_aio(inode);
         ext4_lblk_t cluster_offset;
         int set_unwritten = 0;
+        bool map_from_cluster = false;
 
         ext_debug("blocks %u/%u requested for inode %lu\n",
                   map->m_lblk, map->m_len, inode->i_ino);
@@ -4343,10 +4361,6 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
                 }
         }
 
-        if ((sbi->s_cluster_ratio > 1) &&
-            ext4_find_delalloc_cluster(inode, map->m_lblk))
-                map->m_flags |= EXT4_MAP_FROM_CLUSTER;
-
         /*
          * requested block isn't allocated yet;
          * we couldn't try to create block if create flag is zero
@@ -4356,15 +4370,13 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
                  * put just found gap into cache to speed up
                  * subsequent requests
                  */
-                if ((flags & EXT4_GET_BLOCKS_NO_PUT_HOLE) == 0)
-                        ext4_ext_put_gap_in_cache(inode, path, map->m_lblk);
+                ext4_ext_put_gap_in_cache(inode, path, map->m_lblk);
                 goto out2;
         }
 
         /*
          * Okay, we need to do block allocation.
          */
-        map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
         newex.ee_block = cpu_to_le32(map->m_lblk);
         cluster_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
 
@@ -4376,7 +4388,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
             get_implied_cluster_alloc(inode->i_sb, map, ex, path)) {
                 ar.len = allocated = map->m_len;
                 newblock = map->m_pblk;
-                map->m_flags |= EXT4_MAP_FROM_CLUSTER;
+                map_from_cluster = true;
                 goto got_allocated_blocks;
         }
 
@@ -4397,7 +4409,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
             get_implied_cluster_alloc(inode->i_sb, map, ex2, path)) {
                 ar.len = allocated = map->m_len;
                 newblock = map->m_pblk;
-                map->m_flags |= EXT4_MAP_FROM_CLUSTER;
+                map_from_cluster = true;
                 goto got_allocated_blocks;
         }
 
@@ -4523,7 +4535,7 @@ got_allocated_blocks:
                  */
                 reserved_clusters = get_reserved_cluster_alloc(inode,
                                                 map->m_lblk, allocated);
-                if (map->m_flags & EXT4_MAP_FROM_CLUSTER) {
+                if (map_from_cluster) {
                         if (reserved_clusters) {
                                 /*
                                  * We have clusters reserved for this range.
@@ -4620,7 +4632,6 @@ out2:
 
         trace_ext4_ext_map_blocks_exit(inode, flags, map,
                                        err ? err : allocated);
-        ext4_es_lru_add(inode);
         return err ? err : allocated;
 }
 
@@ -5140,7 +5151,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         if (ext4_has_inline_data(inode)) {
                 int has_inline = 1;
 
-                error = ext4_inline_data_fiemap(inode, fieinfo, &has_inline);
+                error = ext4_inline_data_fiemap(inode, fieinfo, &has_inline,
+                                                start, len);
 
                 if (has_inline)
                         return error;
@@ -5154,8 +5166,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 
         /* fallback to generic here if not in extents fmt */
         if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
-                return generic_block_fiemap(inode, fieinfo, start, len,
-                        ext4_get_block);
+                return __generic_block_fiemap(inode, fieinfo, start, len,
+                                              ext4_get_block);
 
         if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS))
                 return -EBADR;
@@ -5179,7 +5191,6 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 error = ext4_fill_fiemap_extents(inode, start_blk,
                                                  len_blks, fieinfo);
         }
-        ext4_es_lru_add(inode);
         return error;
 }
 
@@ -5239,8 +5250,6 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift,
                                 return -EIO;
 
                         ex_last = EXT_LAST_EXTENT(path[depth].p_hdr);
-                        if (!ex_last)
-                                return -EIO;
 
                         err = ext4_access_path(handle, inode, path + depth);
                         if (err)
diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 94e7855ae71b..e04d45733976 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -147,10 +147,9 @@ static struct kmem_cache *ext4_es_cachep;
 static int __es_insert_extent(struct inode *inode, struct extent_status *newes);
 static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
                               ext4_lblk_t end);
-static int __es_try_to_reclaim_extents(struct ext4_inode_info *ei,
-                                       int nr_to_scan);
-static int __ext4_es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
-                            struct ext4_inode_info *locked_ei);
+static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
+static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
+                       struct ext4_inode_info *locked_ei);
 
 int __init ext4_init_es(void)
 {
@@ -298,6 +297,36 @@ out:
         trace_ext4_es_find_delayed_extent_range_exit(inode, es);
 }
 
+static void ext4_es_list_add(struct inode *inode)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+
+        if (!list_empty(&ei->i_es_list))
+                return;
+
+        spin_lock(&sbi->s_es_lock);
+        if (list_empty(&ei->i_es_list)) {
+                list_add_tail(&ei->i_es_list, &sbi->s_es_list);
+                sbi->s_es_nr_inode++;
+        }
+        spin_unlock(&sbi->s_es_lock);
+}
+
+static void ext4_es_list_del(struct inode *inode)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+
+        spin_lock(&sbi->s_es_lock);
+        if (!list_empty(&ei->i_es_list)) {
+                list_del_init(&ei->i_es_list);
+                sbi->s_es_nr_inode--;
+                WARN_ON_ONCE(sbi->s_es_nr_inode < 0);
+        }
+        spin_unlock(&sbi->s_es_lock);
+}
+
 static struct extent_status *
 ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
                      ext4_fsblk_t pblk)
@@ -314,9 +343,10 @@ ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
          * We don't count delayed extent because we never try to reclaim them
          */
         if (!ext4_es_is_delayed(es)) {
-                EXT4_I(inode)->i_es_lru_nr++;
+                if (!EXT4_I(inode)->i_es_shk_nr++)
+                        ext4_es_list_add(inode);
                 percpu_counter_inc(&EXT4_SB(inode->i_sb)->
-                                        s_es_stats.es_stats_lru_cnt);
+                                        s_es_stats.es_stats_shk_cnt);
         }
 
         EXT4_I(inode)->i_es_all_nr++;
@@ -330,12 +360,13 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
         EXT4_I(inode)->i_es_all_nr--;
         percpu_counter_dec(&EXT4_SB(inode->i_sb)->s_es_stats.es_stats_all_cnt);
 
-        /* Decrease the lru counter when this es is not delayed */
+        /* Decrease the shrink counter when this es is not delayed */
         if (!ext4_es_is_delayed(es)) {
-                BUG_ON(EXT4_I(inode)->i_es_lru_nr == 0);
-                EXT4_I(inode)->i_es_lru_nr--;
+                BUG_ON(EXT4_I(inode)->i_es_shk_nr == 0);
+                if (!--EXT4_I(inode)->i_es_shk_nr)
+                        ext4_es_list_del(inode);
                 percpu_counter_dec(&EXT4_SB(inode->i_sb)->
-                                        s_es_stats.es_stats_lru_cnt);
+                                        s_es_stats.es_stats_shk_cnt);
         }
 
         kmem_cache_free(ext4_es_cachep, es);
@@ -351,7 +382,7 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
 static int ext4_es_can_be_merged(struct extent_status *es1,
                                  struct extent_status *es2)
 {
-        if (ext4_es_status(es1) != ext4_es_status(es2))
+        if (ext4_es_type(es1) != ext4_es_type(es2))
                 return 0;
 
         if (((__u64) es1->es_len) + es2->es_len > EXT_MAX_BLOCKS) {
@@ -394,6 +425,8 @@ ext4_es_try_to_merge_left(struct inode *inode, struct extent_status *es)
         es1 = rb_entry(node, struct extent_status, rb_node);
         if (ext4_es_can_be_merged(es1, es)) {
                 es1->es_len += es->es_len;
+                if (ext4_es_is_referenced(es))
+                        ext4_es_set_referenced(es1);
                 rb_erase(&es->rb_node, &tree->root);
                 ext4_es_free_extent(inode, es);
                 es = es1;
@@ -416,6 +449,8 @@ ext4_es_try_to_merge_right(struct inode *inode, struct extent_status *es)
         es1 = rb_entry(node, struct extent_status, rb_node);
         if (ext4_es_can_be_merged(es, es1)) {
                 es->es_len += es1->es_len;
+                if (ext4_es_is_referenced(es1))
+                        ext4_es_set_referenced(es);
                 rb_erase(node, &tree->root);
                 ext4_es_free_extent(inode, es1);
         }
@@ -683,8 +718,8 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
                 goto error;
 retry:
         err = __es_insert_extent(inode, &newes);
-        if (err == -ENOMEM && __ext4_es_shrink(EXT4_SB(inode->i_sb), 1,
-                                               EXT4_I(inode)))
+        if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+                                          128, EXT4_I(inode)))
                 goto retry;
         if (err == -ENOMEM && !ext4_es_is_delayed(&newes))
                 err = 0;
@@ -782,6 +817,8 @@ out:
                 es->es_lblk = es1->es_lblk;
                 es->es_len = es1->es_len;
                 es->es_pblk = es1->es_pblk;
+                if (!ext4_es_is_referenced(es))
+                        ext4_es_set_referenced(es);
                 stats->es_stats_cache_hits++;
         } else {
                 stats->es_stats_cache_misses++;
@@ -841,8 +878,8 @@ retry:
                                 es->es_lblk = orig_es.es_lblk;
                                 es->es_len = orig_es.es_len;
                                 if ((err == -ENOMEM) &&
-                                    __ext4_es_shrink(EXT4_SB(inode->i_sb), 1,
-                                                     EXT4_I(inode)))
+                                    __es_shrink(EXT4_SB(inode->i_sb),
+                                                        128, EXT4_I(inode)))
                                         goto retry;
                                 goto out;
                         }
@@ -914,6 +951,11 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
         end = lblk + len - 1;
         BUG_ON(end < lblk);
 
+        /*
+         * ext4_clear_inode() depends on us taking i_es_lock unconditionally
+         * so that we are sure __es_shrink() is done with the inode before it
+         * is reclaimed.
+         */
         write_lock(&EXT4_I(inode)->i_es_lock);
         err = __es_remove_extent(inode, lblk, end);
         write_unlock(&EXT4_I(inode)->i_es_lock);
@@ -921,114 +963,75 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
         return err;
 }
 
-static int ext4_inode_touch_time_cmp(void *priv, struct list_head *a,
-                                     struct list_head *b)
-{
-        struct ext4_inode_info *eia, *eib;
-        eia = list_entry(a, struct ext4_inode_info, i_es_lru);
-        eib = list_entry(b, struct ext4_inode_info, i_es_lru);
-
-        if (ext4_test_inode_state(&eia->vfs_inode, EXT4_STATE_EXT_PRECACHED) &&
-            !ext4_test_inode_state(&eib->vfs_inode, EXT4_STATE_EXT_PRECACHED))
-                return 1;
-        if (!ext4_test_inode_state(&eia->vfs_inode, EXT4_STATE_EXT_PRECACHED) &&
-            ext4_test_inode_state(&eib->vfs_inode, EXT4_STATE_EXT_PRECACHED))
-                return -1;
-        if (eia->i_touch_when == eib->i_touch_when)
-                return 0;
-        if (time_after(eia->i_touch_when, eib->i_touch_when))
-                return 1;
-        else
-                return -1;
-}
-
-static int __ext4_es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
-                            struct ext4_inode_info *locked_ei)
+static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
+                       struct ext4_inode_info *locked_ei)
 {
         struct ext4_inode_info *ei;
         struct ext4_es_stats *es_stats;
-        struct list_head *cur, *tmp;
-        LIST_HEAD(skipped);
         ktime_t start_time;
         u64 scan_time;
+        int nr_to_walk;
         int nr_shrunk = 0;
-        int retried = 0, skip_precached = 1, nr_skipped = 0;
+        int retried = 0, nr_skipped = 0;
 
         es_stats = &sbi->s_es_stats;
         start_time = ktime_get();
-        spin_lock(&sbi->s_es_lru_lock);
 
 retry:
-        list_for_each_safe(cur, tmp, &sbi->s_es_lru) {
-                int shrunk;
-
-                /*
-                 * If we have already reclaimed all extents from extent
-                 * status tree, just stop the loop immediately.
-                 */
-                if (percpu_counter_read_positive(
-                                &es_stats->es_stats_lru_cnt) == 0)
-                        break;
-
-                ei = list_entry(cur, struct ext4_inode_info, i_es_lru);
+        spin_lock(&sbi->s_es_lock);
+        nr_to_walk = sbi->s_es_nr_inode;
+        while (nr_to_walk-- > 0) {
+                if (list_empty(&sbi->s_es_list)) {
+                        spin_unlock(&sbi->s_es_lock);
+                        goto out;
+                }
+                ei = list_first_entry(&sbi->s_es_list, struct ext4_inode_info,
+                                      i_es_list);
+                /* Move the inode to the tail */
+                list_move_tail(&ei->i_es_list, &sbi->s_es_list);
 
                 /*
-                 * Skip the inode that is newer than the last_sorted
-                 * time.  Normally we try hard to avoid shrinking
-                 * precached inodes, but we will as a last resort.
+                 * Normally we try hard to avoid shrinking precached inodes,
+                 * but we will as a last resort.
                  */
-                if ((es_stats->es_stats_last_sorted < ei->i_touch_when) ||
-                    (skip_precached && ext4_test_inode_state(&ei->vfs_inode,
-                                                EXT4_STATE_EXT_PRECACHED))) {
+                if (!retried && ext4_test_inode_state(&ei->vfs_inode,
+                                                EXT4_STATE_EXT_PRECACHED)) {
                         nr_skipped++;
-                        list_move_tail(cur, &skipped);
                         continue;
                 }
 
-                if (ei->i_es_lru_nr == 0 || ei == locked_ei ||
-                    !write_trylock(&ei->i_es_lock))
+                if (ei == locked_ei || !write_trylock(&ei->i_es_lock)) {
+                        nr_skipped++;
                         continue;
+                }
+                /*
+                 * Now we hold i_es_lock which protects us from inode reclaim
+                 * freeing inode under us
+                 */
+                spin_unlock(&sbi->s_es_lock);
 
-                shrunk = __es_try_to_reclaim_extents(ei, nr_to_scan);
-                if (ei->i_es_lru_nr == 0)
-                        list_del_init(&ei->i_es_lru);
+                nr_shrunk += es_reclaim_extents(ei, &nr_to_scan);
                 write_unlock(&ei->i_es_lock);
 
-                nr_shrunk += shrunk;
-                nr_to_scan -= shrunk;
-                if (nr_to_scan == 0)
-                        break;
+                if (nr_to_scan <= 0)
+                        goto out;
+                spin_lock(&sbi->s_es_lock);
         }
-
-        /* Move the newer inodes into the tail of the LRU list. */
-        list_splice_tail(&skipped, &sbi->s_es_lru);
-        INIT_LIST_HEAD(&skipped);
+        spin_unlock(&sbi->s_es_lock);
 
         /*
          * If we skipped any inodes, and we weren't able to make any
-         * forward progress, sort the list and try again.
+         * forward progress, try again to scan precached inodes.
          */
         if ((nr_shrunk == 0) && nr_skipped && !retried) {
                 retried++;
-                list_sort(NULL, &sbi->s_es_lru, ext4_inode_touch_time_cmp);
-                es_stats->es_stats_last_sorted = jiffies;
-                ei = list_first_entry(&sbi->s_es_lru, struct ext4_inode_info,
-                                      i_es_lru);
-                /*
-                 * If there are no non-precached inodes left on the
-                 * list, start releasing precached extents.
-                 */
-                if (ext4_test_inode_state(&ei->vfs_inode,
-                                          EXT4_STATE_EXT_PRECACHED))
-                        skip_precached = 0;
                 goto retry;
         }
 
-        spin_unlock(&sbi->s_es_lru_lock);
-
         if (locked_ei && nr_shrunk == 0)
-                nr_shrunk = __es_try_to_reclaim_extents(locked_ei, nr_to_scan);
+                nr_shrunk = es_reclaim_extents(locked_ei, &nr_to_scan);
 
+out:
         scan_time = ktime_to_ns(ktime_sub(ktime_get(), start_time));
         if (likely(es_stats->es_stats_scan_time))
                 es_stats->es_stats_scan_time = (scan_time +
@@ -1043,7 +1046,7 @@ retry:
         else
                 es_stats->es_stats_shrunk = nr_shrunk;
 
-        trace_ext4_es_shrink(sbi->s_sb, nr_shrunk, scan_time, skip_precached,
+        trace_ext4_es_shrink(sbi->s_sb, nr_shrunk, scan_time,
                              nr_skipped, retried);
         return nr_shrunk;
 }
@@ -1055,7 +1058,7 @@ static unsigned long ext4_es_count(struct shrinker *shrink,
         struct ext4_sb_info *sbi;
 
         sbi = container_of(shrink, struct ext4_sb_info, s_es_shrinker);
-        nr = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_lru_cnt);
+        nr = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);
         trace_ext4_es_shrink_count(sbi->s_sb, sc->nr_to_scan, nr);
         return nr;
 }
@@ -1068,13 +1071,13 @@ static unsigned long ext4_es_scan(struct shrinker *shrink,
         int nr_to_scan = sc->nr_to_scan;
         int ret, nr_shrunk;
 
-        ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_lru_cnt);
+        ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);
         trace_ext4_es_shrink_scan_enter(sbi->s_sb, nr_to_scan, ret);
 
         if (!nr_to_scan)
                 return ret;
 
-        nr_shrunk = __ext4_es_shrink(sbi, nr_to_scan, NULL);
+        nr_shrunk = __es_shrink(sbi, nr_to_scan, NULL);
 
         trace_ext4_es_shrink_scan_exit(sbi->s_sb, nr_shrunk, ret);
         return nr_shrunk;
@@ -1102,28 +1105,24 @@ static int ext4_es_seq_shrinker_info_show(struct seq_file *seq, void *v)
                 return 0;
 
         /* here we just find an inode that has the max nr. of objects */
-        spin_lock(&sbi->s_es_lru_lock);
-        list_for_each_entry(ei, &sbi->s_es_lru, i_es_lru) {
+        spin_lock(&sbi->s_es_lock);
+        list_for_each_entry(ei, &sbi->s_es_list, i_es_list) {
                 inode_cnt++;
                 if (max && max->i_es_all_nr < ei->i_es_all_nr)
                         max = ei;
                 else if (!max)
                         max = ei;
         }
-        spin_unlock(&sbi->s_es_lru_lock);
+        spin_unlock(&sbi->s_es_lock);
 
         seq_printf(seq, "stats:\n  %lld objects\n  %lld reclaimable objects\n",
                    percpu_counter_sum_positive(&es_stats->es_stats_all_cnt),
-                   percpu_counter_sum_positive(&es_stats->es_stats_lru_cnt));
+                   percpu_counter_sum_positive(&es_stats->es_stats_shk_cnt));
         seq_printf(seq, "  %lu/%lu cache hits/misses\n",
                    es_stats->es_stats_cache_hits,
                    es_stats->es_stats_cache_misses);
-        if (es_stats->es_stats_last_sorted != 0)
-                seq_printf(seq, "  %u ms last sorted interval\n",
-                           jiffies_to_msecs(jiffies -
-                                            es_stats->es_stats_last_sorted));
         if (inode_cnt)
-                seq_printf(seq, "  %d inodes on lru list\n", inode_cnt);
+                seq_printf(seq, "  %d inodes on list\n", inode_cnt);
 
         seq_printf(seq, "average:\n  %llu us scan time\n",
             div_u64(es_stats->es_stats_scan_time, 1000));
@@ -1132,7 +1131,7 @@ static int ext4_es_seq_shrinker_info_show(struct seq_file *seq, void *v)
                 seq_printf(seq,
                     "maximum:\n  %lu inode (%u objects, %u reclaimable)\n"
                     "  %llu us max scan time\n",
-                    max->vfs_inode.i_ino, max->i_es_all_nr, max->i_es_lru_nr,
+                    max->vfs_inode.i_ino, max->i_es_all_nr, max->i_es_shk_nr,
                     div_u64(es_stats->es_stats_max_scan_time, 1000));
 
         return 0;
@@ -1181,9 +1180,11 @@ int ext4_es_register_shrinker(struct ext4_sb_info *sbi)
 {
         int err;
 
-        INIT_LIST_HEAD(&sbi->s_es_lru);
-        spin_lock_init(&sbi->s_es_lru_lock);
-        sbi->s_es_stats.es_stats_last_sorted = 0;
+        /* Make sure we have enough bits for physical block number */
+        BUILD_BUG_ON(ES_SHIFT < 48);
+        INIT_LIST_HEAD(&sbi->s_es_list);
+        sbi->s_es_nr_inode = 0;
+        spin_lock_init(&sbi->s_es_lock);
         sbi->s_es_stats.es_stats_shrunk = 0;
         sbi->s_es_stats.es_stats_cache_hits = 0;
         sbi->s_es_stats.es_stats_cache_misses = 0;
@@ -1192,7 +1193,7 @@ int ext4_es_register_shrinker(struct ext4_sb_info *sbi)
         err = percpu_counter_init(&sbi->s_es_stats.es_stats_all_cnt, 0, GFP_KERNEL);
         if (err)
                 return err;
-        err = percpu_counter_init(&sbi->s_es_stats.es_stats_lru_cnt, 0, GFP_KERNEL);
+        err = percpu_counter_init(&sbi->s_es_stats.es_stats_shk_cnt, 0, GFP_KERNEL);
         if (err)
                 goto err1;
 
@@ -1210,7 +1211,7 @@ int ext4_es_register_shrinker(struct ext4_sb_info *sbi)
         return 0;
 
 err2:
-        percpu_counter_destroy(&sbi->s_es_stats.es_stats_lru_cnt);
+        percpu_counter_destroy(&sbi->s_es_stats.es_stats_shk_cnt);
 err1:
         percpu_counter_destroy(&sbi->s_es_stats.es_stats_all_cnt);
         return err;
@@ -1221,71 +1222,83 @@ void ext4_es_unregister_shrinker(struct ext4_sb_info *sbi)
         if (sbi->s_proc)
                 remove_proc_entry("es_shrinker_info", sbi->s_proc);
         percpu_counter_destroy(&sbi->s_es_stats.es_stats_all_cnt);
-        percpu_counter_destroy(&sbi->s_es_stats.es_stats_lru_cnt);
+        percpu_counter_destroy(&sbi->s_es_stats.es_stats_shk_cnt);
         unregister_shrinker(&sbi->s_es_shrinker);
 }
 
-void ext4_es_lru_add(struct inode *inode)
+/*
+ * Shrink extents in given inode from ei->i_es_shrink_lblk till end. Scan at
+ * most *nr_to_scan extents, update *nr_to_scan accordingly.
+ *
+ * Return 0 if we hit end of tree / interval, 1 if we exhausted nr_to_scan.
+ * Increment *nr_shrunk by the number of reclaimed extents. Also update
+ * ei->i_es_shrink_lblk to where we should continue scanning.
+ */
+static int es_do_reclaim_extents(struct ext4_inode_info *ei, ext4_lblk_t end,
+                                 int *nr_to_scan, int *nr_shrunk)
 {
-        struct ext4_inode_info *ei = EXT4_I(inode);
-        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-
-        ei->i_touch_when = jiffies;
-
-        if (!list_empty(&ei->i_es_lru))
-                return;
+        struct inode *inode = &ei->vfs_inode;
+        struct ext4_es_tree *tree = &ei->i_es_tree;
+        struct extent_status *es;
+        struct rb_node *node;
 
-        spin_lock(&sbi->s_es_lru_lock);
-        if (list_empty(&ei->i_es_lru))
-                list_add_tail(&ei->i_es_lru, &sbi->s_es_lru);
-        spin_unlock(&sbi->s_es_lru_lock);
-}
+        es = __es_tree_search(&tree->root, ei->i_es_shrink_lblk);
+        if (!es)
+                goto out_wrap;
+        node = &es->rb_node;
+        while (*nr_to_scan > 0) {
+                if (es->es_lblk > end) {
+                        ei->i_es_shrink_lblk = end + 1;
+                        return 0;
+                }
 
-void ext4_es_lru_del(struct inode *inode)
-{
-        struct ext4_inode_info *ei = EXT4_I(inode);
-        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+                (*nr_to_scan)--;
+                node = rb_next(&es->rb_node);
+                /*
+                 * We can't reclaim delayed extent from status tree because
+                 * fiemap, bigallic, and seek_data/hole need to use it.
+                 */
+                if (ext4_es_is_delayed(es))
+                        goto next;
+                if (ext4_es_is_referenced(es)) {
+                        ext4_es_clear_referenced(es);
+                        goto next;
+                }
 
-        spin_lock(&sbi->s_es_lru_lock);
-        if (!list_empty(&ei->i_es_lru))
-                list_del_init(&ei->i_es_lru);
-        spin_unlock(&sbi->s_es_lru_lock);
+                rb_erase(&es->rb_node, &tree->root);
+                ext4_es_free_extent(inode, es);
+                (*nr_shrunk)++;
+next:
+                if (!node)
+                        goto out_wrap;
+                es = rb_entry(node, struct extent_status, rb_node);
+        }
+        ei->i_es_shrink_lblk = es->es_lblk;
+        return 1;
+out_wrap:
+        ei->i_es_shrink_lblk = 0;
+        return 0;
 }
 
-static int __es_try_to_reclaim_extents(struct ext4_inode_info *ei,
-                                       int nr_to_scan)
+static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan)
 {
         struct inode *inode = &ei->vfs_inode;
-        struct ext4_es_tree *tree = &ei->i_es_tree;
-        struct rb_node *node;
-        struct extent_status *es;
-        unsigned long nr_shrunk = 0;
+        int nr_shrunk = 0;
+        ext4_lblk_t start = ei->i_es_shrink_lblk;
         static DEFINE_RATELIMIT_STATE(_rs, DEFAULT_RATELIMIT_INTERVAL,
                                       DEFAULT_RATELIMIT_BURST);
 
-        if (ei->i_es_lru_nr == 0)
+        if (ei->i_es_shk_nr == 0)
                 return 0;
 
         if (ext4_test_inode_state(inode, EXT4_STATE_EXT_PRECACHED) &&
             __ratelimit(&_rs))
                 ext4_warning(inode->i_sb, "forced shrink of precached extents");
 
-        node = rb_first(&tree->root);
-        while (node != NULL) {
-                es = rb_entry(node, struct extent_status, rb_node);
-                node = rb_next(&es->rb_node);
-                /*
-                 * We can't reclaim delayed extent from status tree because
-                 * fiemap, bigallic, and seek_data/hole need to use it.
-                 */
-                if (!ext4_es_is_delayed(es)) {
-                        rb_erase(&es->rb_node, &tree->root);
-                        ext4_es_free_extent(inode, es);
-                        nr_shrunk++;
-                        if (--nr_to_scan == 0)
-                                break;
-                }
-        }
-        tree->cache_es = NULL;
+        if (!es_do_reclaim_extents(ei, EXT_MAX_BLOCKS, nr_to_scan, &nr_shrunk) &&
+            start != 0)
+                es_do_reclaim_extents(ei, start - 1, nr_to_scan, &nr_shrunk);
+
+        ei->i_es_tree.cache_es = NULL;
         return nr_shrunk;
 }
diff --git a/fs/ext4/extents_status.h b/fs/ext4/extents_status.h
index efd5f970b501..691b52613ce4 100644
--- a/fs/ext4/extents_status.h
+++ b/fs/ext4/extents_status.h
@@ -29,25 +29,28 @@
 /*
  * These flags live in the high bits of extent_status.es_pblk
  */
-#define ES_SHIFT        60
-
-#define EXTENT_STATUS_WRITTEN   (1 << 3)
-#define EXTENT_STATUS_UNWRITTEN (1 << 2)
-#define EXTENT_STATUS_DELAYED   (1 << 1)
-#define EXTENT_STATUS_HOLE      (1 << 0)
+enum {
+        ES_WRITTEN_B,
+        ES_UNWRITTEN_B,
+        ES_DELAYED_B,
+        ES_HOLE_B,
+        ES_REFERENCED_B,
+        ES_FLAGS
+};
 
-#define EXTENT_STATUS_FLAGS     (EXTENT_STATUS_WRITTEN | \
-                                 EXTENT_STATUS_UNWRITTEN | \
-                                 EXTENT_STATUS_DELAYED | \
-                                 EXTENT_STATUS_HOLE)
+#define ES_SHIFT (sizeof(ext4_fsblk_t)*8 - ES_FLAGS)
+#define ES_MASK (~((ext4_fsblk_t)0) << ES_SHIFT)
 
-#define ES_WRITTEN              (1ULL << 63)
-#define ES_UNWRITTEN            (1ULL << 62)
-#define ES_DELAYED              (1ULL << 61)
-#define ES_HOLE                 (1ULL << 60)
+#define EXTENT_STATUS_WRITTEN   (1 << ES_WRITTEN_B)
+#define EXTENT_STATUS_UNWRITTEN (1 << ES_UNWRITTEN_B)
+#define EXTENT_STATUS_DELAYED   (1 << ES_DELAYED_B)
+#define EXTENT_STATUS_HOLE      (1 << ES_HOLE_B)
+#define EXTENT_STATUS_REFERENCED        (1 << ES_REFERENCED_B)
 
-#define ES_MASK                 (ES_WRITTEN | ES_UNWRITTEN | \
-                                 ES_DELAYED | ES_HOLE)
+#define ES_TYPE_MASK    ((ext4_fsblk_t)(EXTENT_STATUS_WRITTEN | \
+                          EXTENT_STATUS_UNWRITTEN | \
+                          EXTENT_STATUS_DELAYED | \
+                          EXTENT_STATUS_HOLE) << ES_SHIFT)
 
 struct ext4_sb_info;
 struct ext4_extent;
@@ -65,14 +68,13 @@ struct ext4_es_tree {
 };
 
 struct ext4_es_stats {
-        unsigned long es_stats_last_sorted;
         unsigned long es_stats_shrunk;
         unsigned long es_stats_cache_hits;
         unsigned long es_stats_cache_misses;
         u64 es_stats_scan_time;
         u64 es_stats_max_scan_time;
         struct percpu_counter es_stats_all_cnt;
-        struct percpu_counter es_stats_lru_cnt;
+        struct percpu_counter es_stats_shk_cnt;
 };
 
 extern int __init ext4_init_es(void);
@@ -93,29 +95,49 @@ extern void ext4_es_find_delayed_extent_range(struct inode *inode,
 extern int ext4_es_lookup_extent(struct inode *inode, ext4_lblk_t lblk,
                                  struct extent_status *es);
 
+static inline unsigned int ext4_es_status(struct extent_status *es)
+{
+        return es->es_pblk >> ES_SHIFT;
+}
+
+static inline unsigned int ext4_es_type(struct extent_status *es)
+{
+        return (es->es_pblk & ES_TYPE_MASK) >> ES_SHIFT;
+}
+
 static inline int ext4_es_is_written(struct extent_status *es)
 {
-        return (es->es_pblk & ES_WRITTEN) != 0;
+        return (ext4_es_type(es) & EXTENT_STATUS_WRITTEN) != 0;
 }
 
 static inline int ext4_es_is_unwritten(struct extent_status *es)
 {
-        return (es->es_pblk & ES_UNWRITTEN) != 0;
+        return (ext4_es_type(es) & EXTENT_STATUS_UNWRITTEN) != 0;
 }
 
 static inline int ext4_es_is_delayed(struct extent_status *es)
 {
-        return (es->es_pblk & ES_DELAYED) != 0;
+        return (ext4_es_type(es) & EXTENT_STATUS_DELAYED) != 0;
 }
 
 static inline int ext4_es_is_hole(struct extent_status *es)
 {
-        return (es->es_pblk & ES_HOLE) != 0;
+        return (ext4_es_type(es) & EXTENT_STATUS_HOLE) != 0;
 }
 
-static inline unsigned int ext4_es_status(struct extent_status *es)
+static inline void ext4_es_set_referenced(struct extent_status *es)
 {
-        return es->es_pblk >> ES_SHIFT;
+        es->es_pblk |= ((ext4_fsblk_t)EXTENT_STATUS_REFERENCED) << ES_SHIFT;
+}
+
+static inline void ext4_es_clear_referenced(struct extent_status *es)
+{
+        es->es_pblk &= ~(((ext4_fsblk_t)EXTENT_STATUS_REFERENCED) << ES_SHIFT);
+}
+
+static inline int ext4_es_is_referenced(struct extent_status *es)
+{
+        return (ext4_es_status(es) & EXTENT_STATUS_REFERENCED) != 0;
 }
 
 static inline ext4_fsblk_t ext4_es_pblock(struct extent_status *es)
@@ -135,23 +157,19 @@ static inline void ext4_es_store_pblock(struct extent_status *es,
 static inline void ext4_es_store_status(struct extent_status *es,
                                         unsigned int status)
 {
-        es->es_pblk = (((ext4_fsblk_t)
-                        (status & EXTENT_STATUS_FLAGS) << ES_SHIFT) |
-                       (es->es_pblk & ~ES_MASK));
+        es->es_pblk = (((ext4_fsblk_t)status << ES_SHIFT) & ES_MASK) |
+                      (es->es_pblk & ~ES_MASK);
 }
 
 static inline void ext4_es_store_pblock_status(struct extent_status *es,
                                                ext4_fsblk_t pb,
                                                unsigned int status)
 {
-        es->es_pblk = (((ext4_fsblk_t)
-                        (status & EXTENT_STATUS_FLAGS) << ES_SHIFT) |
-                       (pb & ~ES_MASK));
+        es->es_pblk = (((ext4_fsblk_t)status << ES_SHIFT) & ES_MASK) |
+                      (pb & ~ES_MASK);
 }
 
 extern int ext4_es_register_shrinker(struct ext4_sb_info *sbi);
 extern void ext4_es_unregister_shrinker(struct ext4_sb_info *sbi);
-extern void ext4_es_lru_add(struct inode *inode);
-extern void ext4_es_lru_del(struct inode *inode);
 
 #endif /* _EXT4_EXTENTS_STATUS_H */
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 8131be8c0af3..513c12cf444c 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -273,24 +273,19 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
  * we determine this extent as a data or a hole according to whether the
  * page cache has data or not.
  */
-static int ext4_find_unwritten_pgoff(struct inode *inode,
-                                     int whence,
-                                     struct ext4_map_blocks *map,
-                                     loff_t *offset)
+static int ext4_find_unwritten_pgoff(struct inode *inode, int whence,
+                                     loff_t endoff, loff_t *offset)
 {
         struct pagevec pvec;
-        unsigned int blkbits;
         pgoff_t index;
         pgoff_t end;
-        loff_t endoff;
         loff_t startoff;
         loff_t lastoff;
         int found = 0;
 
-        blkbits = inode->i_sb->s_blocksize_bits;
         startoff = *offset;
         lastoff = startoff;
-        endoff = (loff_t)(map->m_lblk + map->m_len) << blkbits;
+
 
         index = startoff >> PAGE_CACHE_SHIFT;
         end = endoff >> PAGE_CACHE_SHIFT;
@@ -408,147 +403,144 @@ out:
 static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
 {
         struct inode *inode = file->f_mapping->host;
-        struct ext4_map_blocks map;
-        struct extent_status es;
-        ext4_lblk_t start, last, end;
-        loff_t dataoff, isize;
-        int blkbits;
-        int ret = 0;
+        struct fiemap_extent_info fie;
+        struct fiemap_extent ext[2];
+        loff_t next;
+        int i, ret = 0;
 
         mutex_lock(&inode->i_mutex);
-
-        isize = i_size_read(inode);
-        if (offset >= isize) {
+        if (offset >= inode->i_size) {
                 mutex_unlock(&inode->i_mutex);
                 return -ENXIO;
         }
-
-        blkbits = inode->i_sb->s_blocksize_bits;
-        start = offset >> blkbits;
-        last = start;
-        end = isize >> blkbits;
-        dataoff = offset;
-
-        do {
-                map.m_lblk = last;
-                map.m_len = end - last + 1;
-                ret = ext4_map_blocks(NULL, inode, &map, 0);
-                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
-                        if (last != start)
-                                dataoff = (loff_t)last << blkbits;
+        fie.fi_flags = 0;
+        fie.fi_extents_max = 2;
+        fie.fi_extents_start = (struct fiemap_extent __user *) &ext;
+        while (1) {
+                mm_segment_t old_fs = get_fs();
+
+                fie.fi_extents_mapped = 0;
+                memset(ext, 0, sizeof(*ext) * fie.fi_extents_max);
+
+                set_fs(get_ds());
+                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
+                set_fs(old_fs);
+                if (ret)
                         break;
-                }
 
-                /*
-                 * If there is a delay extent at this offset,
-                 * it will be as a data.
-                 */
-                ext4_es_find_delayed_extent_range(inode, last, last, &es);
-                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
-                        if (last != start)
-                                dataoff = (loff_t)last << blkbits;
+                /* No extents found, EOF */
+                if (!fie.fi_extents_mapped) {
+                        ret = -ENXIO;
                         break;
                 }
+                for (i = 0; i < fie.fi_extents_mapped; i++) {
+                        next = (loff_t)(ext[i].fe_length + ext[i].fe_logical);
 
-                /*
-                 * If there is a unwritten extent at this offset,
-                 * it will be as a data or a hole according to page
-                 * cache that has data or not.
-                 */
-                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
-                        int unwritten;
-                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_DATA,
-                                                              &map, &dataoff);
-                        if (unwritten)
-                                break;
-                }
+                        if (offset < (loff_t)ext[i].fe_logical)
+                                offset = (loff_t)ext[i].fe_logical;
+                        /*
+                         * If extent is not unwritten, then it contains valid
+                         * data, mapped or delayed.
+                         */
+                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN))
+                                goto out;
 
-                last++;
-                dataoff = (loff_t)last << blkbits;
-        } while (last <= end);
+                        /*
+                         * If there is a unwritten extent at this offset,
+                         * it will be as a data or a hole according to page
+                         * cache that has data or not.
+                         */
+                        if (ext4_find_unwritten_pgoff(inode, SEEK_DATA,
+                                                      next, &offset))
+                                goto out;
 
+                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST) {
+                                ret = -ENXIO;
+                                goto out;
+                        }
+                        offset = next;
+                }
+        }
+        if (offset > inode->i_size)
+                offset = inode->i_size;
+out:
         mutex_unlock(&inode->i_mutex);
+        if (ret)
+                return ret;
 
-        if (dataoff > isize)
-                return -ENXIO;
-
-        return vfs_setpos(file, dataoff, maxsize);
+        return vfs_setpos(file, offset, maxsize);
 }
 
 /*
- * ext4_seek_hole() retrieves the offset for SEEK_HOLE.
+ * ext4_seek_hole() retrieves the offset for SEEK_HOLE
  */
 static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
 {
         struct inode *inode = file->f_mapping->host;
-        struct ext4_map_blocks map;
-        struct extent_status es;
-        ext4_lblk_t start, last, end;
-        loff_t holeoff, isize;
-        int blkbits;
-        int ret = 0;
+        struct fiemap_extent_info fie;
+        struct fiemap_extent ext[2];
+        loff_t next;
+        int i, ret = 0;
 
         mutex_lock(&inode->i_mutex);
-
-        isize = i_size_read(inode);
-        if (offset >= isize) {
+        if (offset >= inode->i_size) {
                 mutex_unlock(&inode->i_mutex);
                 return -ENXIO;
         }
 
-        blkbits = inode->i_sb->s_blocksize_bits;
-        start = offset >> blkbits;
-        last = start;
-        end = isize >> blkbits;
-        holeoff = offset;
+        fie.fi_flags = 0;
+        fie.fi_extents_max = 2;
+        fie.fi_extents_start = (struct fiemap_extent __user *)&ext;
+        while (1) {
+                mm_segment_t old_fs = get_fs();
 
-        do {
-                map.m_lblk = last;
-                map.m_len = end - last + 1;
-                ret = ext4_map_blocks(NULL, inode, &map, 0);
-                if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
-                        last += ret;
-                        holeoff = (loff_t)last << blkbits;
-                        continue;
-                }
+                fie.fi_extents_mapped = 0;
+                memset(ext, 0, sizeof(*ext));
 
-                /*
-                 * If there is a delay extent at this offset,
-                 * we will skip this extent.
-                 */
-                ext4_es_find_delayed_extent_range(inode, last, last, &es);
-                if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
-                        last = es.es_lblk + es.es_len;
-                        holeoff = (loff_t)last << blkbits;
-                        continue;
-                }
+                set_fs(get_ds());
+                ret = ext4_fiemap(inode, &fie, offset, maxsize - offset);
+                set_fs(old_fs);
+                if (ret)
+                        break;
 
-                /*
-                 * If there is a unwritten extent at this offset,
-                 * it will be as a data or a hole according to page
-                 * cache that has data or not.
-                 */
-                if (map.m_flags & EXT4_MAP_UNWRITTEN) {
-                        int unwritten;
-                        unwritten = ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
-                                                              &map, &holeoff);
-                        if (!unwritten) {
-                                last += ret;
-                                holeoff = (loff_t)last << blkbits;
+                /* No extents found */
+                if (!fie.fi_extents_mapped)
+                        break;
+
+                for (i = 0; i < fie.fi_extents_mapped; i++) {
+                        next = (loff_t)(ext[i].fe_logical + ext[i].fe_length);
+                        /*
+                         * If extent is not unwritten, then it contains valid
+                         * data, mapped or delayed.
+                         */
+                        if (!(ext[i].fe_flags & FIEMAP_EXTENT_UNWRITTEN)) {
+                                if (offset < (loff_t)ext[i].fe_logical)
+                                        goto out;
+                                offset = next;
                                 continue;
                         }
-                }
-
-                /* find a hole */
-                break;
-        } while (last <= end);
+                        /*
+                         * If there is a unwritten extent at this offset,
+                         * it will be as a data or a hole according to page
+                         * cache that has data or not.
+                         */
+                        if (ext4_find_unwritten_pgoff(inode, SEEK_HOLE,
+                                                      next, &offset))
+                                goto out;
 
+                        offset = next;
+                        if (ext[i].fe_flags & FIEMAP_EXTENT_LAST)
+                                goto out;
+                }
+        }
+        if (offset > inode->i_size)
+                offset = inode->i_size;
+out:
         mutex_unlock(&inode->i_mutex);
+        if (ret)
+                return ret;
 
-        if (holeoff > isize)
-                holeoff = isize;
-
-        return vfs_setpos(file, holeoff, maxsize);
+        return vfs_setpos(file, offset, maxsize);
 }
 
 /*
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 3ea62695abce..4b143febf21f 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -811,8 +811,11 @@ static int ext4_da_convert_inline_data_to_extent(struct address_space *mapping,
         ret = __block_write_begin(page, 0, inline_size,
                                   ext4_da_get_block_prep);
         if (ret) {
+                up_read(&EXT4_I(inode)->xattr_sem);
+                unlock_page(page);
+                page_cache_release(page);
                 ext4_truncate_failed_write(inode);
-                goto out;
+                return ret;
         }
 
         SetPageDirty(page);
@@ -870,6 +873,12 @@ retry_journal:
                         goto out_journal;
         }
 
+        /*
+         * We cannot recurse into the filesystem as the transaction
+         * is already started.
+         */
+        flags |= AOP_FLAG_NOFS;
+
         if (ret == -ENOSPC) {
                 ret = ext4_da_convert_inline_data_to_extent(mapping,
                                                             inode,
@@ -882,11 +891,6 @@ retry_journal:
                 goto out;
         }
 
-        /*
-         * We cannot recurse into the filesystem as the transaction
-         * is already started.
-         */
-        flags |= AOP_FLAG_NOFS;
 
         page = grab_cache_page_write_begin(mapping, 0, flags);
         if (!page) {
@@ -1807,11 +1811,12 @@ int ext4_destroy_inline_data(handle_t *handle, struct inode *inode)
 
 int ext4_inline_data_fiemap(struct inode *inode,
                             struct fiemap_extent_info *fieinfo,
-                            int *has_inline)
+                            int *has_inline, __u64 start, __u64 len)
 {
         __u64 physical = 0;
-        __u64 length;
-        __u32 flags = FIEMAP_EXTENT_DATA_INLINE | FIEMAP_EXTENT_LAST;
+        __u64 inline_len;
+        __u32 flags = FIEMAP_EXTENT_DATA_INLINE | FIEMAP_EXTENT_NOT_ALIGNED |
+                FIEMAP_EXTENT_LAST;
         int error = 0;
         struct ext4_iloc iloc;
 
@@ -1820,6 +1825,13 @@ int ext4_inline_data_fiemap(struct inode *inode,
                 *has_inline = 0;
                 goto out;
         }
+        inline_len = min_t(size_t, ext4_get_inline_size(inode),
+                           i_size_read(inode));
+        if (start >= inline_len)
+                goto out;
+        if (start + len < inline_len)
+                inline_len = start + len;
+        inline_len -= start;
 
         error = ext4_get_inode_loc(inode, &iloc);
         if (error)
@@ -1828,11 +1840,10 @@ int ext4_inline_data_fiemap(struct inode *inode,
         physical = (__u64)iloc.bh->b_blocknr << inode->i_sb->s_blocksize_bits;
         physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data;
         physical += offsetof(struct ext4_inode, i_block);
-        length = i_size_read(inode);
 
         if (physical)
-                error = fiemap_fill_next_extent(fieinfo, 0, physical,
-                                                length, flags);
+                error = fiemap_fill_next_extent(fieinfo, start, physical,
+                                                inline_len, flags);
         brelse(iloc.bh);
 out:
         up_read(&EXT4_I(inode)->xattr_sem);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3356ab5395f4..5653fa42930b 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -416,11 +416,6 @@ static void ext4_map_blocks_es_recheck(handle_t *handle,
         }
         if (!(flags & EXT4_GET_BLOCKS_NO_LOCK))
                 up_read((&EXT4_I(inode)->i_data_sem));
-        /*
-         * Clear EXT4_MAP_FROM_CLUSTER and EXT4_MAP_BOUNDARY flag
-         * because it shouldn't be marked in es_map->m_flags.
-         */
-        map->m_flags &= ~(EXT4_MAP_FROM_CLUSTER | EXT4_MAP_BOUNDARY);
 
         /*
          * We don't check m_len because extent will be collpased in status
@@ -491,7 +486,6 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
 
         /* Lookup extent status tree firstly */
         if (ext4_es_lookup_extent(inode, map->m_lblk, &es)) {
-                ext4_es_lru_add(inode);
                 if (ext4_es_is_written(&es) || ext4_es_is_unwritten(&es)) {
                         map->m_pblk = ext4_es_pblock(&es) +
                                         map->m_lblk - es.es_lblk;
@@ -1393,7 +1387,6 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
 
         /* Lookup extent status tree firstly */
         if (ext4_es_lookup_extent(inode, iblock, &es)) {
-                ext4_es_lru_add(inode);
                 if (ext4_es_is_hole(&es)) {
                         retval = 0;
                         down_read(&EXT4_I(inode)->i_data_sem);
@@ -1434,24 +1427,12 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
          * file system block.
          */
         down_read(&EXT4_I(inode)->i_data_sem);
-        if (ext4_has_inline_data(inode)) {
-                /*
-                 * We will soon create blocks for this page, and let
-                 * us pretend as if the blocks aren't allocated yet.
-                 * In case of clusters, we have to handle the work
-                 * of mapping from cluster so that the reserved space
-                 * is calculated properly.
-                 */
-                if ((EXT4_SB(inode->i_sb)->s_cluster_ratio > 1) &&
-                    ext4_find_delalloc_cluster(inode, map->m_lblk))
-                        map->m_flags |= EXT4_MAP_FROM_CLUSTER;
+        if (ext4_has_inline_data(inode))
                 retval = 0;
-        } else if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
-                retval = ext4_ext_map_blocks(NULL, inode, map,
-                                             EXT4_GET_BLOCKS_NO_PUT_HOLE);
+        else if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+                retval = ext4_ext_map_blocks(NULL, inode, map, 0);
         else
-                retval = ext4_ind_map_blocks(NULL, inode, map,
-                                             EXT4_GET_BLOCKS_NO_PUT_HOLE);
+                retval = ext4_ind_map_blocks(NULL, inode, map, 0);
 
 add_delayed:
         if (retval == 0) {
@@ -1465,7 +1446,8 @@ add_delayed:
                  * then we don't need to reserve it again. However we still need
                  * to reserve metadata for every block we're going to write.
                  */
-                if (!(map->m_flags & EXT4_MAP_FROM_CLUSTER)) {
+                if (EXT4_SB(inode->i_sb)->s_cluster_ratio <= 1 ||
+                    !ext4_find_delalloc_cluster(inode, map->m_lblk)) {
                         ret = ext4_da_reserve_space(inode, iblock);
                         if (ret) {
                                 /* not enough space to reserve */
@@ -1481,11 +1463,6 @@ add_delayed:
                         goto out_unlock;
                 }
 
-                /* Clear EXT4_MAP_FROM_CLUSTER flag since its purpose is served
-                 * and it should not appear on the bh->b_state.
-                 */
-                map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
-
                 map_bh(bh, inode->i_sb, invalid_block);
                 set_buffer_new(bh);
                 set_buffer_delay(bh);
@@ -3643,7 +3620,7 @@ out_stop:
          * If this was a simple ftruncate() and the file will remain alive,
          * then we need to clear up the orphan record which we created above.
          * However, if this was a real unlink then we were called by
-         * ext4_delete_inode(), and we allow that function to clean up the
+         * ext4_evict_inode(), and we allow that function to clean up the
          * orphan info for us.
          */
         if (inode->i_nlink)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index bfda18a15592..f58a0d106726 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -78,8 +78,6 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
         memswap(&ei1->i_disksize, &ei2->i_disksize, sizeof(ei1->i_disksize));
         ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS);
         ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS);
-        ext4_es_lru_del(inode1);
-        ext4_es_lru_del(inode2);
 
         isize = i_size_read(inode1);
         i_size_write(inode1, i_size_read(inode2));
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index dbfe15c2533c..8d1e60214ef0 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2358,7 +2358,7 @@ int ext4_mb_alloc_groupinfo(struct super_block *sb, ext4_group_t ngroups)
         if (sbi->s_group_info) {
                 memcpy(new_groupinfo, sbi->s_group_info,
                        sbi->s_group_info_size * sizeof(*sbi->s_group_info));
-                ext4_kvfree(sbi->s_group_info);
+                kvfree(sbi->s_group_info);
         }
         sbi->s_group_info = new_groupinfo;
         sbi->s_group_info_size = size / sizeof(*sbi->s_group_info);
@@ -2385,7 +2385,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
         if (group % EXT4_DESC_PER_BLOCK(sb) == 0) {
                 metalen = sizeof(*meta_group_info) <<
                         EXT4_DESC_PER_BLOCK_BITS(sb);
-                meta_group_info = kmalloc(metalen, GFP_KERNEL);
+                meta_group_info = kmalloc(metalen, GFP_NOFS);
                 if (meta_group_info == NULL) {
                         ext4_msg(sb, KERN_ERR, "can't allocate mem "
                                  "for a buddy group");
@@ -2399,7 +2399,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
                 sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)];
         i = group & (EXT4_DESC_PER_BLOCK(sb) - 1);
 
-        meta_group_info[i] = kmem_cache_zalloc(cachep, GFP_KERNEL);
+        meta_group_info[i] = kmem_cache_zalloc(cachep, GFP_NOFS);
         if (meta_group_info[i] == NULL) {
                 ext4_msg(sb, KERN_ERR, "can't allocate buddy mem");
                 goto exit_group_info;
@@ -2428,7 +2428,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
         {
                 struct buffer_head *bh;
                 meta_group_info[i]->bb_bitmap =
-                        kmalloc(sb->s_blocksize, GFP_KERNEL);
+                        kmalloc(sb->s_blocksize, GFP_NOFS);
                 BUG_ON(meta_group_info[i]->bb_bitmap == NULL);
                 bh = ext4_read_block_bitmap(sb, group);
                 BUG_ON(bh == NULL);
@@ -2495,7 +2495,7 @@ err_freebuddy:
                 kfree(sbi->s_group_info[i]);
         iput(sbi->s_buddy_cache);
 err_freesgi:
-        ext4_kvfree(sbi->s_group_info);
+        kvfree(sbi->s_group_info);
         return -ENOMEM;
 }
 
@@ -2708,12 +2708,11 @@ int ext4_mb_release(struct super_block *sb)
                         EXT4_DESC_PER_BLOCK_BITS(sb);
                 for (i = 0; i < num_meta_group_infos; i++)
                         kfree(sbi->s_group_info[i]);
-                ext4_kvfree(sbi->s_group_info);
+                kvfree(sbi->s_group_info);
         }
         kfree(sbi->s_mb_offsets);
         kfree(sbi->s_mb_maxs);
-        if (sbi->s_buddy_cache)
-                iput(sbi->s_buddy_cache);
+        iput(sbi->s_buddy_cache);
         if (sbi->s_mb_stats) {
                 ext4_msg(sb, KERN_INFO,
                        "mballoc: %u blocks %u reqs (%u success)",
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index a432634f2e6a..3cb267aee802 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -592,7 +592,7 @@ err_out:
 
         /*
          * set the  i_blocks count to zero
-         * so that the ext4_delete_inode does the
+         * so that the ext4_evict_inode() does the
          * right job
          *
          * We don't need to take the i_lock because
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 9f2311bc9c4f..503ea15dc5db 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -273,6 +273,7 @@ move_extent_per_page(struct file *o_filp, struct inode *donor_inode,
         int replaced_count = 0;
         int from = data_offset_in_page << orig_inode->i_blkbits;
         int blocks_per_page = PAGE_CACHE_SIZE >> orig_inode->i_blkbits;
+        struct super_block *sb = orig_inode->i_sb;
 
         /*
          * It needs twice the amount of ordinary journal buffers because
@@ -405,10 +406,13 @@ unlock_pages:
         page_cache_release(pagep[1]);
 stop_journal:
         ext4_journal_stop(handle);
+        if (*err == -ENOSPC &&
+            ext4_should_retry_alloc(sb, &retries))
+                goto again;
         /* Buffer was busy because probably is pinned to journal transaction,
          * force transaction commit may help to free it. */
-        if (*err == -EBUSY && ext4_should_retry_alloc(orig_inode->i_sb,
-                                                      &retries))
+        if (*err == -EBUSY && retries++ < 4 && EXT4_SB(sb)->s_journal &&
+            jbd2_journal_force_commit_nested(EXT4_SB(sb)->s_journal))
                 goto again;
         return replaced_count;
 
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 426211882f72..2291923dae4e 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2814,7 +2814,6 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
                 ext4_orphan_add(handle, inode);
         inode->i_ctime = ext4_current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
-        retval = 0;
 
 end_unlink:
         brelse(bh);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index ca4588388fc3..bf76f405a5f9 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -856,7 +856,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
         n_group_desc[gdb_num] = gdb_bh;
         EXT4_SB(sb)->s_group_desc = n_group_desc;
         EXT4_SB(sb)->s_gdb_count++;
-        ext4_kvfree(o_group_desc);
+        kvfree(o_group_desc);
 
         le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
         err = ext4_handle_dirty_super(handle, sb);
@@ -866,7 +866,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
         return err;
 
 exit_inode:
-        ext4_kvfree(n_group_desc);
+        kvfree(n_group_desc);
         brelse(iloc.bh);
 exit_dind:
         brelse(dind);
@@ -909,7 +909,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
         n_group_desc[gdb_num] = gdb_bh;
         EXT4_SB(sb)->s_group_desc = n_group_desc;
         EXT4_SB(sb)->s_gdb_count++;
-        ext4_kvfree(o_group_desc);
+        kvfree(o_group_desc);
         BUFFER_TRACE(gdb_bh, "get_write_access");
         err = ext4_journal_get_write_access(handle, gdb_bh);
         if (unlikely(err))
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 63e802b8ec68..43c92b1685cb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -176,15 +176,6 @@ void *ext4_kvzalloc(size_t size, gfp_t flags)
         return ret;
 }
 
-void ext4_kvfree(void *ptr)
-{
-        if (is_vmalloc_addr(ptr))
-                vfree(ptr);
-        else
-                kfree(ptr);
-
-}
-
 ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
                                struct ext4_group_desc *bg)
 {
@@ -811,8 +802,8 @@ static void ext4_put_super(struct super_block *sb)
 
         for (i = 0; i < sbi->s_gdb_count; i++)
                 brelse(sbi->s_group_desc[i]);
-        ext4_kvfree(sbi->s_group_desc);
-        ext4_kvfree(sbi->s_flex_groups);
+        kvfree(sbi->s_group_desc);
+        kvfree(sbi->s_flex_groups);
         percpu_counter_destroy(&sbi->s_freeclusters_counter);
         percpu_counter_destroy(&sbi->s_freeinodes_counter);
         percpu_counter_destroy(&sbi->s_dirs_counter);
@@ -880,10 +871,10 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
         spin_lock_init(&ei->i_prealloc_lock);
         ext4_es_init_tree(&ei->i_es_tree);
         rwlock_init(&ei->i_es_lock);
-        INIT_LIST_HEAD(&ei->i_es_lru);
+        INIT_LIST_HEAD(&ei->i_es_list);
         ei->i_es_all_nr = 0;
-        ei->i_es_lru_nr = 0;
-        ei->i_touch_when = 0;
+        ei->i_es_shk_nr = 0;
+        ei->i_es_shrink_lblk = 0;
         ei->i_reserved_data_blocks = 0;
         ei->i_reserved_meta_blocks = 0;
         ei->i_allocated_meta_blocks = 0;
@@ -973,7 +964,6 @@ void ext4_clear_inode(struct inode *inode)
         dquot_drop(inode);
         ext4_discard_preallocations(inode);
         ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS);
-        ext4_es_lru_del(inode);
         if (EXT4_I(inode)->jinode) {
                 jbd2_journal_release_jbd_inode(EXT4_JOURNAL(inode),
                                                EXT4_I(inode)->jinode);
@@ -1153,7 +1143,7 @@ enum {
         Opt_inode_readahead_blks, Opt_journal_ioprio,
         Opt_dioread_nolock, Opt_dioread_lock,
         Opt_discard, Opt_nodiscard, Opt_init_itable, Opt_noinit_itable,
-        Opt_max_dir_size_kb,
+        Opt_max_dir_size_kb, Opt_nojournal_checksum,
 };
 
 static const match_table_t tokens = {
@@ -1187,6 +1177,7 @@ static const match_table_t tokens = {
         {Opt_journal_dev, "journal_dev=%u"},
         {Opt_journal_path, "journal_path=%s"},
         {Opt_journal_checksum, "journal_checksum"},
+        {Opt_nojournal_checksum, "nojournal_checksum"},
         {Opt_journal_async_commit, "journal_async_commit"},
         {Opt_abort, "abort"},
         {Opt_data_journal, "data=journal"},
@@ -1368,6 +1359,8 @@ static const struct mount_opts {
          MOPT_EXT4_ONLY | MOPT_SET | MOPT_EXPLICIT},
         {Opt_nodelalloc, EXT4_MOUNT_DELALLOC,
          MOPT_EXT4_ONLY | MOPT_CLEAR},
+        {Opt_nojournal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
+         MOPT_EXT4_ONLY | MOPT_CLEAR},
         {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
          MOPT_EXT4_ONLY | MOPT_SET},
         {Opt_journal_async_commit, (EXT4_MOUNT_JOURNAL_ASYNC_COMMIT |
@@ -1709,6 +1702,12 @@ static int parse_options(char *options, struct super_block *sb,
                         return 0;
                 }
         }
+        if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA &&
+            test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+                ext4_msg(sb, KERN_ERR, "can't mount with journal_async_commit "
+                         "in data=ordered mode");
+                return 0;
+        }
         return 1;
 }
 
@@ -1946,7 +1945,7 @@ int ext4_alloc_flex_bg_array(struct super_block *sb, ext4_group_t ngroup)
                 memcpy(new_groups, sbi->s_flex_groups,
                        (sbi->s_flex_groups_allocated *
                         sizeof(struct flex_groups)));
-                ext4_kvfree(sbi->s_flex_groups);
+                kvfree(sbi->s_flex_groups);
         }
         sbi->s_flex_groups = new_groups;
         sbi->s_flex_groups_allocated = size / sizeof(struct flex_groups);
@@ -3317,7 +3316,7 @@ int ext4_calculate_overhead(struct super_block *sb)
         struct ext4_super_block *es = sbi->s_es;
         ext4_group_t i, ngroups = ext4_get_groups_count(sb);
         ext4_fsblk_t overhead = 0;
-        char *buf = (char *) get_zeroed_page(GFP_KERNEL);
+        char *buf = (char *) get_zeroed_page(GFP_NOFS);
 
         if (!buf)
                 return -ENOMEM;
@@ -3345,8 +3344,8 @@ int ext4_calculate_overhead(struct super_block *sb)
                         memset(buf, 0, PAGE_SIZE);
                 cond_resched();
         }
-        /* Add the journal blocks as well */
-        if (sbi->s_journal)
+        /* Add the internal journal blocks as well */
+        if (sbi->s_journal && !sbi->journal_bdev)
                 overhead += EXT4_NUM_B2C(sbi, sbi->s_journal->j_maxlen);
 
         sbi->s_overhead = overhead;
@@ -4232,7 +4231,7 @@ failed_mount7:
 failed_mount6:
         ext4_mb_release(sb);
         if (sbi->s_flex_groups)
-                ext4_kvfree(sbi->s_flex_groups);
+                kvfree(sbi->s_flex_groups);
         percpu_counter_destroy(&sbi->s_freeclusters_counter);
         percpu_counter_destroy(&sbi->s_freeinodes_counter);
         percpu_counter_destroy(&sbi->s_dirs_counter);
@@ -4261,7 +4260,7 @@ failed_mount3:
 failed_mount2:
         for (i = 0; i < db_count; i++)
                 brelse(sbi->s_group_desc[i]);
-        ext4_kvfree(sbi->s_group_desc);
+        kvfree(sbi->s_group_desc);
 failed_mount:
         if (sbi->s_chksum_driver)
                 crypto_free_shash(sbi->s_chksum_driver);
@@ -4862,6 +4861,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                 goto restore_opts;
         }
 
+        if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+            test_opt(sb, JOURNAL_CHECKSUM)) {
+                ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+                         "during remount not supported");
+                err = -EINVAL;
+                goto restore_opts;
+        }
+
         if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
                 if (test_opt2(sb, EXPLICIT_DELALLOC)) {
                         ext4_msg(sb, KERN_ERR, "can't mount with "
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 1df94fabe4eb..b96bd8076b70 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1714,8 +1714,7 @@ int jbd2_journal_destroy(journal_t *journal)
 
         if (journal->j_proc_entry)
                 jbd2_stats_proc_exit(journal);
-        if (journal->j_inode)
-                iput(journal->j_inode);
+        iput(journal->j_inode);
         if (journal->j_revoke)
                 jbd2_journal_destroy_revoke(journal);
         if (journal->j_chksum_driver)
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index ec881b312700..2f389ce5023c 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -61,6 +61,11 @@ module_param(mem_size, ulong, 0400);
 MODULE_PARM_DESC(mem_size,
                 "size of reserved RAM used to store oops/panic logs");
 
+static unsigned int mem_type;
+module_param(mem_type, uint, 0600);
+MODULE_PARM_DESC(mem_type,
+                "set to 1 to try to use unbuffered memory (default 0)");
+
 static int dump_oops = 1;
 module_param(dump_oops, int, 0600);
 MODULE_PARM_DESC(dump_oops,
@@ -79,6 +84,7 @@ struct ramoops_context {
         struct persistent_ram_zone *fprz;
         phys_addr_t phys_addr;
         unsigned long size;
+        unsigned int memtype;
         size_t record_size;
         size_t console_size;
         size_t ftrace_size;
@@ -366,7 +372,8 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
                 size_t sz = cxt->record_size;
 
                 cxt->przs[i] = persistent_ram_new(*paddr, sz, 0,
-                                                  &cxt->ecc_info);
+                                                  &cxt->ecc_info,
+                                                  cxt->memtype);
                 if (IS_ERR(cxt->przs[i])) {
                         err = PTR_ERR(cxt->przs[i]);
                         dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
@@ -396,7 +403,7 @@ static int ramoops_init_prz(struct device *dev, struct ramoops_context *cxt,
                 return -ENOMEM;
         }
 
-        *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info);
+        *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, cxt->memtype);
         if (IS_ERR(*prz)) {
                 int err = PTR_ERR(*prz);
 
@@ -443,6 +450,7 @@ static int ramoops_probe(struct platform_device *pdev)
 
         cxt->size = pdata->mem_size;
         cxt->phys_addr = pdata->mem_address;
+        cxt->memtype = pdata->mem_type;
         cxt->record_size = pdata->record_size;
         cxt->console_size = pdata->console_size;
         cxt->ftrace_size = pdata->ftrace_size;
@@ -572,6 +580,7 @@ static void ramoops_register_dummy(void)
 
         dummy_data->mem_size = mem_size;
         dummy_data->mem_address = mem_address;
+        dummy_data->mem_type = 0;
         dummy_data->record_size = record_size;
         dummy_data->console_size = ramoops_console_size;
         dummy_data->ftrace_size = ramoops_ftrace_size;
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index 9d7b9a83699e..76c3f80efdfa 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -380,7 +380,8 @@ void persistent_ram_zap(struct persistent_ram_zone *prz)
         persistent_ram_update_header_ecc(prz);
 }
 
-static void *persistent_ram_vmap(phys_addr_t start, size_t size)
+static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+                unsigned int memtype)
 {
         struct page **pages;
         phys_addr_t page_start;
@@ -392,7 +393,10 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size)
         page_start = start - offset_in_page(start);
         page_count = DIV_ROUND_UP(size + offset_in_page(start), PAGE_SIZE);
 
-        prot = pgprot_noncached(PAGE_KERNEL);
+        if (memtype)
+                prot = pgprot_noncached(PAGE_KERNEL);
+        else
+                prot = pgprot_writecombine(PAGE_KERNEL);
 
         pages = kmalloc_array(page_count, sizeof(struct page *), GFP_KERNEL);
         if (!pages) {
@@ -411,8 +415,11 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size)
         return vaddr;
 }
 
-static void *persistent_ram_iomap(phys_addr_t start, size_t size)
+static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+                unsigned int memtype)
 {
+        void *va;
+
         if (!request_mem_region(start, size, "persistent_ram")) {
                 pr_err("request mem region (0x%llx@0x%llx) failed\n",
                         (unsigned long long)size, (unsigned long long)start);
@@ -422,19 +429,24 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size)
         buffer_start_add = buffer_start_add_locked;
         buffer_size_add = buffer_size_add_locked;
 
-        return ioremap(start, size);
+        if (memtype)
+                va = ioremap(start, size);
+        else
+                va = ioremap_wc(start, size);
+
+        return va;
 }
 
 static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
-                struct persistent_ram_zone *prz)
+                struct persistent_ram_zone *prz, int memtype)
 {
         prz->paddr = start;
         prz->size = size;
 
         if (pfn_valid(start >> PAGE_SHIFT))
-                prz->vaddr = persistent_ram_vmap(start, size);
+                prz->vaddr = persistent_ram_vmap(start, size, memtype);
         else
-                prz->vaddr = persistent_ram_iomap(start, size);
+                prz->vaddr = persistent_ram_iomap(start, size, memtype);
 
         if (!prz->vaddr) {
                 pr_err("%s: Failed to map 0x%llx pages at 0x%llx\n", __func__,
@@ -500,7 +512,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
 }
 
 struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
-                        u32 sig, struct persistent_ram_ecc_info *ecc_info)
+                        u32 sig, struct persistent_ram_ecc_info *ecc_info,
+                        unsigned int memtype)
 {
         struct persistent_ram_zone *prz;
         int ret = -ENOMEM;
@@ -511,7 +524,7 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
                 goto err;
         }
 
-        ret = persistent_ram_buffer_map(start, size, prz);
+        ret = persistent_ram_buffer_map(start, size, prz, memtype);
         if (ret)
                 goto err;
 
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index d571e173a990..9d6486d416a3 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2772,7 +2772,7 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
 
         if (journal_init_dev(sb, journal, j_dev_name) != 0) {
                 reiserfs_warning(sb, "sh-462",
-                                 "unable to initialize jornal device");
+                                 "unable to initialize journal device");
                 goto free_and_return;
         }
 
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index b5b593c45270..538519ee37d9 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -262,6 +262,7 @@ static int write_begin_slow(struct address_space *mapping,
                         if (err) {
                                 unlock_page(page);
                                 page_cache_release(page);
+                                ubifs_release_budget(c, &req);
                                 return err;
                         }
                 }
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index fb166e204441..f6ac3f29323c 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -571,7 +571,11 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
 
         aligned_dlen = ALIGN(dlen, 8);
         aligned_ilen = ALIGN(ilen, 8);
+
         len = aligned_dlen + aligned_ilen + UBIFS_INO_NODE_SZ;
+        /* Make sure to also account for extended attributes */
+        len += host_ui->data_len;
+
         dent = kmalloc(len, GFP_NOFS);
         if (!dent)
                 return -ENOMEM;
@@ -648,7 +652,8 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
 
         ino_key_init(c, &ino_key, dir->i_ino);
         ino_offs += aligned_ilen;
-        err = ubifs_tnc_add(c, &ino_key, lnum, ino_offs, UBIFS_INO_NODE_SZ);
+        err = ubifs_tnc_add(c, &ino_key, lnum, ino_offs,
+                            UBIFS_INO_NODE_SZ + host_ui->data_len);
         if (err)
                 goto out_ro;
 
diff --git a/fs/xfs/libxfs/xfs_ag.h b/fs/xfs/libxfs/xfs_ag.h
deleted file mode 100644
index 6e247a99f5db..000000000000
--- a/fs/xfs/libxfs/xfs_ag.h
+++ /dev/null
@@ -1,281 +0,0 @@
-/*
- * Copyright (c) 2000-2003,2005 Silicon Graphics, Inc.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-#ifndef __XFS_AG_H__
-#define __XFS_AG_H__
-
-/*
- * Allocation group header
- * This is divided into three structures, placed in sequential 512-byte
- * buffers after a copy of the superblock (also in a 512-byte buffer).
- */
-
-struct xfs_buf;
-struct xfs_mount;
-struct xfs_trans;
-
-#define XFS_AGF_MAGIC   0x58414746      /* 'XAGF' */
-#define XFS_AGI_MAGIC   0x58414749      /* 'XAGI' */
-#define XFS_AGFL_MAGIC  0x5841464c      /* 'XAFL' */
-#define XFS_AGF_VERSION 1
-#define XFS_AGI_VERSION 1
-
-#define XFS_AGF_GOOD_VERSION(v) ((v) == XFS_AGF_VERSION)
-#define XFS_AGI_GOOD_VERSION(v) ((v) == XFS_AGI_VERSION)
-
-/*
- * Btree number 0 is bno, 1 is cnt.  This value gives the size of the
- * arrays below.
- */
-#define XFS_BTNUM_AGF   ((int)XFS_BTNUM_CNTi + 1)
-
-/*
- * The second word of agf_levels in the first a.g. overlaps the EFS
- * superblock's magic number.  Since the magic numbers valid for EFS
- * are > 64k, our value cannot be confused for an EFS superblock's.
- */
-
-typedef struct xfs_agf {
-        /*
-         * Common allocation group header information
-         */
-        __be32          agf_magicnum;   /* magic number == XFS_AGF_MAGIC */
-        __be32          agf_versionnum; /* header version == XFS_AGF_VERSION */
-        __be32          agf_seqno;      /* sequence # starting from 0 */
-        __be32          agf_length;     /* size in blocks of a.g. */
-        /*
-         * Freespace information
-         */
-        __be32          agf_roots[XFS_BTNUM_AGF];       /* root blocks */
-        __be32          agf_spare0;     /* spare field */
-        __be32          agf_levels[XFS_BTNUM_AGF];      /* btree levels */
-        __be32          agf_spare1;     /* spare field */
-
-        __be32          agf_flfirst;    /* first freelist block's index */
-        __be32          agf_fllast;     /* last freelist block's index */
-        __be32          agf_flcount;    /* count of blocks in freelist */
-        __be32          agf_freeblks;   /* total free blocks */
-
-        __be32          agf_longest;    /* longest free space */
-        __be32          agf_btreeblks;  /* # of blocks held in AGF btrees */
-        uuid_t          agf_uuid;       /* uuid of filesystem */
-
-        /*
-         * reserve some contiguous space for future logged fields before we add
-         * the unlogged fields. This makes the range logging via flags and
-         * structure offsets much simpler.
-         */
-        __be64          agf_spare64[16];
-
-        /* unlogged fields, written during buffer writeback. */
-        __be64          agf_lsn;        /* last write sequence */
-        __be32          agf_crc;        /* crc of agf sector */
-        __be32          agf_spare2;
-
-        /* structure must be padded to 64 bit alignment */
-} xfs_agf_t;
-
-#define XFS_AGF_CRC_OFF         offsetof(struct xfs_agf, agf_crc)
-
-#define XFS_AGF_MAGICNUM        0x00000001
-#define XFS_AGF_VERSIONNUM      0x00000002
-#define XFS_AGF_SEQNO           0x00000004
-#define XFS_AGF_LENGTH          0x00000008
-#define XFS_AGF_ROOTS           0x00000010
-#define XFS_AGF_LEVELS          0x00000020
-#define XFS_AGF_FLFIRST         0x00000040
-#define XFS_AGF_FLLAST          0x00000080
-#define XFS_AGF_FLCOUNT         0x00000100
-#define XFS_AGF_FREEBLKS        0x00000200
-#define XFS_AGF_LONGEST         0x00000400
-#define XFS_AGF_BTREEBLKS       0x00000800
-#define XFS_AGF_UUID            0x00001000
-#define XFS_AGF_NUM_BITS        13
-#define XFS_AGF_ALL_BITS        ((1 << XFS_AGF_NUM_BITS) - 1)
-
-#define XFS_AGF_FLAGS \
-        { XFS_AGF_MAGICNUM,     "MAGICNUM" }, \
-        { XFS_AGF_VERSIONNUM,   "VERSIONNUM" }, \
-        { XFS_AGF_SEQNO,        "SEQNO" }, \
-        { XFS_AGF_LENGTH,       "LENGTH" }, \
-        { XFS_AGF_ROOTS,        "ROOTS" }, \
-        { XFS_AGF_LEVELS,       "LEVELS" }, \
-        { XFS_AGF_FLFIRST,      "FLFIRST" }, \
-        { XFS_AGF_FLLAST,       "FLLAST" }, \
-        { XFS_AGF_FLCOUNT,      "FLCOUNT" }, \
-        { XFS_AGF_FREEBLKS,     "FREEBLKS" }, \
-        { XFS_AGF_LONGEST,      "LONGEST" }, \
-        { XFS_AGF_BTREEBLKS,    "BTREEBLKS" }, \
-        { XFS_AGF_UUID,         "UUID" }
-
-/* disk block (xfs_daddr_t) in the AG */
-#define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
-#define XFS_AGF_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGF_DADDR(mp))
-#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)((bp)->b_addr))
-
-extern int xfs_read_agf(struct xfs_mount *mp, struct xfs_trans *tp,
-                        xfs_agnumber_t agno, int flags, struct xfs_buf **bpp);
-
-/*
- * Size of the unlinked inode hash table in the agi.
- */
-#define XFS_AGI_UNLINKED_BUCKETS        64
-
-typedef struct xfs_agi {
-        /*
-         * Common allocation group header information
-         */
-        __be32          agi_magicnum;   /* magic number == XFS_AGI_MAGIC */
-        __be32          agi_versionnum; /* header version == XFS_AGI_VERSION */
-        __be32          agi_seqno;      /* sequence # starting from 0 */
-        __be32          agi_length;     /* size in blocks of a.g. */
-        /*
-         * Inode information
-         * Inodes are mapped by interpreting the inode number, so no
-         * mapping data is needed here.
-         */
-        __be32          agi_count;      /* count of allocated inodes */
-        __be32          agi_root;       /* root of inode btree */
-        __be32          agi_level;      /* levels in inode btree */
-        __be32          agi_freecount;  /* number of free inodes */
-
-        __be32          agi_newino;     /* new inode just allocated */
-        __be32          agi_dirino;     /* last directory inode chunk */
-        /*
-         * Hash table of inodes which have been unlinked but are
-         * still being referenced.
-         */
-        __be32          agi_unlinked[XFS_AGI_UNLINKED_BUCKETS];
-        /*
-         * This marks the end of logging region 1 and start of logging region 2.
-         */
-        uuid_t          agi_uuid;       /* uuid of filesystem */
-        __be32          agi_crc;        /* crc of agi sector */
-        __be32          agi_pad32;
-        __be64          agi_lsn;        /* last write sequence */
-
-        __be32          agi_free_root; /* root of the free inode btree */
-        __be32          agi_free_level;/* levels in free inode btree */
-
-        /* structure must be padded to 64 bit alignment */
-} xfs_agi_t;
-
-#define XFS_AGI_CRC_OFF         offsetof(struct xfs_agi, agi_crc)
-
-#define XFS_AGI_MAGICNUM        (1 << 0)
-#define XFS_AGI_VERSIONNUM      (1 << 1)
-#define XFS_AGI_SEQNO           (1 << 2)
-#define XFS_AGI_LENGTH          (1 << 3)
-#define XFS_AGI_COUNT           (1 << 4)
-#define XFS_AGI_ROOT            (1 << 5)
-#define XFS_AGI_LEVEL           (1 << 6)
-#define XFS_AGI_FREECOUNT       (1 << 7)
-#define XFS_AGI_NEWINO          (1 << 8)
-#define XFS_AGI_DIRINO          (1 << 9)
-#define XFS_AGI_UNLINKED        (1 << 10)
-#define XFS_AGI_NUM_BITS_R1     11      /* end of the 1st agi logging region */
-#define XFS_AGI_ALL_BITS_R1     ((1 << XFS_AGI_NUM_BITS_R1) - 1)
-#define XFS_AGI_FREE_ROOT       (1 << 11)
-#define XFS_AGI_FREE_LEVEL      (1 << 12)
-#define XFS_AGI_NUM_BITS_R2     13
-
-/* disk block (xfs_daddr_t) in the AG */
-#define XFS_AGI_DADDR(mp)       ((xfs_daddr_t)(2 << (mp)->m_sectbb_log))
-#define XFS_AGI_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGI_DADDR(mp))
-#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)((bp)->b_addr))
-
-extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
-                                xfs_agnumber_t agno, struct xfs_buf **bpp);
-
-/*
- * The third a.g. block contains the a.g. freelist, an array
- * of block pointers to blocks owned by the allocation btree code.
- */
-#define XFS_AGFL_DADDR(mp)      ((xfs_daddr_t)(3 << (mp)->m_sectbb_log))
-#define XFS_AGFL_BLOCK(mp)      XFS_HDR_BLOCK(mp, XFS_AGFL_DADDR(mp))
-#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)((bp)->b_addr))
-
-#define XFS_BUF_TO_AGFL_BNO(mp, bp) \
-        (xfs_sb_version_hascrc(&((mp)->m_sb)) ? \
-                &(XFS_BUF_TO_AGFL(bp)->agfl_bno[0]) : \
-                (__be32 *)(bp)->b_addr)
-
-/*
- * Size of the AGFL.  For CRC-enabled filesystes we steal a couple of
- * slots in the beginning of the block for a proper header with the
- * location information and CRC.
- */
-#define XFS_AGFL_SIZE(mp) \
-        (((mp)->m_sb.sb_sectsize - \
-         (xfs_sb_version_hascrc(&((mp)->m_sb)) ? \
-                sizeof(struct xfs_agfl) : 0)) / \
-          sizeof(xfs_agblock_t))
-
-typedef struct xfs_agfl {
-        __be32          agfl_magicnum;
-        __be32          agfl_seqno;
-        uuid_t          agfl_uuid;
-        __be64          agfl_lsn;
-        __be32          agfl_crc;
-        __be32          agfl_bno[];     /* actually XFS_AGFL_SIZE(mp) */
-} xfs_agfl_t;
-
-#define XFS_AGFL_CRC_OFF        offsetof(struct xfs_agfl, agfl_crc)
-
-/*
- * tags for inode radix tree
- */
-#define XFS_ICI_NO_TAG          (-1)    /* special flag for an untagged lookup
-                                           in xfs_inode_ag_iterator */
-#define XFS_ICI_RECLAIM_TAG     0       /* inode is to be reclaimed */
-#define XFS_ICI_EOFBLOCKS_TAG   1       /* inode has blocks beyond EOF */
-
-#define XFS_AG_MAXLEVELS(mp)            ((mp)->m_ag_maxlevels)
-#define XFS_MIN_FREELIST_RAW(bl,cl,mp)  \
-        (MIN(bl + 1, XFS_AG_MAXLEVELS(mp)) + MIN(cl + 1, XFS_AG_MAXLEVELS(mp)))
-#define XFS_MIN_FREELIST(a,mp)          \
-        (XFS_MIN_FREELIST_RAW(          \
-                be32_to_cpu((a)->agf_levels[XFS_BTNUM_BNOi]), \
-                be32_to_cpu((a)->agf_levels[XFS_BTNUM_CNTi]), mp))
-#define XFS_MIN_FREELIST_PAG(pag,mp)    \
-        (XFS_MIN_FREELIST_RAW(          \
-                (unsigned int)(pag)->pagf_levels[XFS_BTNUM_BNOi], \
-                (unsigned int)(pag)->pagf_levels[XFS_BTNUM_CNTi], mp))
-
-#define XFS_AGB_TO_FSB(mp,agno,agbno)   \
-        (((xfs_fsblock_t)(agno) << (mp)->m_sb.sb_agblklog) | (agbno))
-#define XFS_FSB_TO_AGNO(mp,fsbno)       \
-        ((xfs_agnumber_t)((fsbno) >> (mp)->m_sb.sb_agblklog))
-#define XFS_FSB_TO_AGBNO(mp,fsbno)      \
-        ((xfs_agblock_t)((fsbno) & xfs_mask32lo((mp)->m_sb.sb_agblklog)))
-#define XFS_AGB_TO_DADDR(mp,agno,agbno) \
-        ((xfs_daddr_t)XFS_FSB_TO_BB(mp, \
-                (xfs_fsblock_t)(agno) * (mp)->m_sb.sb_agblocks + (agbno)))
-#define XFS_AG_DADDR(mp,agno,d)         (XFS_AGB_TO_DADDR(mp, agno, 0) + (d))
-
-/*
- * For checking for bad ranges of xfs_daddr_t's, covering multiple
- * allocation groups or a single xfs_daddr_t that's a superblock copy.
- */
-#define XFS_AG_CHECK_DADDR(mp,d,len)    \
-        ((len) == 1 ? \
-            ASSERT((d) == XFS_SB_DADDR || \
-                   xfs_daddr_to_agbno(mp, d) != XFS_SB_DADDR) : \
-            ASSERT(xfs_daddr_to_agno(mp, d) == \
-                   xfs_daddr_to_agno(mp, (d) + (len) - 1)))
-
-#endif  /* __XFS_AG_H__ */
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index eff34218f405..a6fbf4472017 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -23,7 +23,6 @@
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h
index feacb061bab7..d1b4b6a5c894 100644
--- a/fs/xfs/libxfs/xfs_alloc.h
+++ b/fs/xfs/libxfs/xfs_alloc.h
@@ -231,4 +231,7 @@ xfs_alloc_get_rec(
         xfs_extlen_t            *len,   /* output: length of extent */
         int                     *stat); /* output: success/failure */
 
+int xfs_read_agf(struct xfs_mount *mp, struct xfs_trans *tp,
+                        xfs_agnumber_t agno, int flags, struct xfs_buf **bpp);
+
 #endif  /* __XFS_ALLOC_H__ */
diff --git a/fs/xfs/libxfs/xfs_alloc_btree.c b/fs/xfs/libxfs/xfs_alloc_btree.c
index e0e83e24d3ef..59d521c09a17 100644
--- a/fs/xfs/libxfs/xfs_alloc_btree.c
+++ b/fs/xfs/libxfs/xfs_alloc_btree.c
@@ -22,7 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_btree.h"
 #include "xfs_alloc_btree.h"
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index 353fb425faef..0a472fbe06d4 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -42,7 +40,6 @@
 #include "xfs_quota.h"
 #include "xfs_trans_space.h"
 #include "xfs_trace.h"
-#include "xfs_dinode.h"
 
 /*
  * xfs_attr.c
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index b1f73dbbf3d8..5d38e8b8a913 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -24,7 +24,6 @@
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -41,7 +40,6 @@
 #include "xfs_trace.h"
 #include "xfs_buf_item.h"
 #include "xfs_cksum.h"
-#include "xfs_dinode.h"
 #include "xfs_dir2.h"
 
 
diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
index 7510ab8058a4..20de88d1bf86 100644
--- a/fs/xfs/libxfs/xfs_attr_remote.c
+++ b/fs/xfs/libxfs/xfs_attr_remote.c
@@ -23,8 +23,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 79c981984dca..b5eb4743f75a 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -22,9 +22,7 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -46,7 +44,6 @@
 #include "xfs_trace.h"
 #include "xfs_symlink.h"
 #include "xfs_attr_leaf.h"
-#include "xfs_dinode.h"
 #include "xfs_filestream.h"
 
 
@@ -5450,13 +5447,11 @@ xfs_bmse_merge(
         struct xfs_btree_cur            *cur,
         int                             *logflags)      /* output */
 {
-        struct xfs_ifork                *ifp;
         struct xfs_bmbt_irec            got;
         struct xfs_bmbt_irec            left;
         xfs_filblks_t                   blockcount;
         int                             error, i;
 
-        ifp = XFS_IFORK_PTR(ip, whichfork);
         xfs_bmbt_get_all(gotp, &got);
         xfs_bmbt_get_all(leftp, &left);
         blockcount = left.br_blockcount + got.br_blockcount;
@@ -5489,32 +5484,25 @@ xfs_bmse_merge(
         error = xfs_bmbt_lookup_eq(cur, got.br_startoff, got.br_startblock,
                                    got.br_blockcount, &i);
         if (error)
-                goto out_error;
-        XFS_WANT_CORRUPTED_GOTO(i == 1, out_error);
+                return error;
+        XFS_WANT_CORRUPTED_RETURN(i == 1);
 
         error = xfs_btree_delete(cur, &i);
         if (error)
-                goto out_error;
-        XFS_WANT_CORRUPTED_GOTO(i == 1, out_error);
+                return error;
+        XFS_WANT_CORRUPTED_RETURN(i == 1);
 
         /* lookup and update size of the previous extent */
         error = xfs_bmbt_lookup_eq(cur, left.br_startoff, left.br_startblock,
                                    left.br_blockcount, &i);
         if (error)
-                goto out_error;
-        XFS_WANT_CORRUPTED_GOTO(i == 1, out_error);
+                return error;
+        XFS_WANT_CORRUPTED_RETURN(i == 1);
 
         left.br_blockcount = blockcount;
 
-        error = xfs_bmbt_update(cur, left.br_startoff, left.br_startblock,
-                                left.br_blockcount, left.br_state);
-        if (error)
-                goto out_error;
-
-        return 0;
-
-out_error:
-        return error;
+        return xfs_bmbt_update(cur, left.br_startoff, left.br_startblock,
+                               left.br_blockcount, left.br_state);
 }
 
 /*
@@ -5544,35 +5532,29 @@ xfs_bmse_shift_one(
         startoff = got.br_startoff - offset_shift_fsb;
 
         /* delalloc extents should be prevented by caller */
-        XFS_WANT_CORRUPTED_GOTO(!isnullstartblock(got.br_startblock),
-                                out_error);
+        XFS_WANT_CORRUPTED_RETURN(!isnullstartblock(got.br_startblock));
 
         /*
-         * If this is the first extent in the file, make sure there's enough
-         * room at the start of the file and jump right to the shift as there's
-         * no left extent to merge.
+         * Check for merge if we've got an extent to the left, otherwise make
+         * sure there's enough room at the start of the file for the shift.
          */
-        if (*current_ext == 0) {
-                if (got.br_startoff < offset_shift_fsb)
-                        return -EINVAL;
-                goto shift_extent;
-        }
+        if (*current_ext) {
+                /* grab the left extent and check for a large enough hole */
+                leftp = xfs_iext_get_ext(ifp, *current_ext - 1);
+                xfs_bmbt_get_all(leftp, &left);
 
-        /* grab the left extent and check for a large enough hole */
-        leftp = xfs_iext_get_ext(ifp, *current_ext - 1);
-        xfs_bmbt_get_all(leftp, &left);
+                if (startoff < left.br_startoff + left.br_blockcount)
+                        return -EINVAL;
 
-        if (startoff < left.br_startoff + left.br_blockcount)
+                /* check whether to merge the extent or shift it down */
+                if (xfs_bmse_can_merge(&left, &got, offset_shift_fsb)) {
+                        return xfs_bmse_merge(ip, whichfork, offset_shift_fsb,
+                                              *current_ext, gotp, leftp, cur,
+                                              logflags);
+                }
+        } else if (got.br_startoff < offset_shift_fsb)
                 return -EINVAL;
 
-        /* check whether to merge the extent or shift it down */
-        if (!xfs_bmse_can_merge(&left, &got, offset_shift_fsb))
-                goto shift_extent;
-
-        return xfs_bmse_merge(ip, whichfork, offset_shift_fsb, *current_ext,
-                              gotp, leftp, cur, logflags);
-
-shift_extent:
         /*
          * Increment the extent index for the next iteration, update the start
          * offset of the in-core extent and update the btree if applicable.
@@ -5589,18 +5571,11 @@ shift_extent:
                                    got.br_blockcount, &i);
         if (error)
                 return error;
-        XFS_WANT_CORRUPTED_GOTO(i == 1, out_error);
+        XFS_WANT_CORRUPTED_RETURN(i == 1);
 
         got.br_startoff = startoff;
-        error = xfs_bmbt_update(cur, got.br_startoff, got.br_startblock,
+        return xfs_bmbt_update(cur, got.br_startoff, got.br_startblock,
                                 got.br_blockcount, got.br_state);
-        if (error)
-                return error;
-
-        return 0;
-
-out_error:
-        return error;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
index fba753308f31..2c44c8e50782 100644
--- a/fs/xfs/libxfs/xfs_bmap_btree.c
+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
@@ -36,7 +34,6 @@
 #include "xfs_quota.h"
 #include "xfs_trace.h"
 #include "xfs_cksum.h"
-#include "xfs_dinode.h"
 
 /*
  * Determine the extent state.
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 8fe6a93ff473..81cad433df85 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index fd827530afec..9cb0115c6bd1 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -23,8 +23,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -514,7 +512,6 @@ xfs_da3_root_split(
         struct xfs_buf          *bp;
         struct xfs_inode        *dp;
         struct xfs_trans        *tp;
-        struct xfs_mount        *mp;
         struct xfs_dir2_leaf    *leaf;
         xfs_dablk_t             blkno;
         int                     level;
@@ -534,7 +531,6 @@ xfs_da3_root_split(
 
         dp = args->dp;
         tp = args->trans;
-        mp = state->mp;
         error = xfs_da_get_buf(tp, dp, blkno, -1, &bp, args->whichfork);
         if (error)
                 return error;
@@ -2342,14 +2338,12 @@ xfs_da_shrink_inode(
         xfs_inode_t *dp;
         int done, error, w, count;
         xfs_trans_t *tp;
-        xfs_mount_t *mp;
 
         trace_xfs_da_shrink_inode(args);
 
         dp = args->dp;
         w = args->whichfork;
         tp = args->trans;
-        mp = dp->i_mount;
         count = args->geo->fsbcount;
         for (;;) {
                 /*
diff --git a/fs/xfs/libxfs/xfs_da_format.c b/fs/xfs/libxfs/xfs_da_format.c
index 7e42fdfd2f1d..9d624a622946 100644
--- a/fs/xfs/libxfs/xfs_da_format.c
+++ b/fs/xfs/libxfs/xfs_da_format.c
@@ -22,8 +22,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
diff --git a/fs/xfs/libxfs/xfs_dinode.h b/fs/xfs/libxfs/xfs_dinode.h
deleted file mode 100644
index 623bbe8fd921..000000000000
--- a/fs/xfs/libxfs/xfs_dinode.h
+++ /dev/null
@@ -1,243 +0,0 @@
-/*
- * Copyright (c) 2000,2002,2005 Silicon Graphics, Inc.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-#ifndef __XFS_DINODE_H__
-#define __XFS_DINODE_H__
-
-#define XFS_DINODE_MAGIC                0x494e  /* 'IN' */
-#define XFS_DINODE_GOOD_VERSION(v)      ((v) >= 1 && (v) <= 3)
-
-typedef struct xfs_timestamp {
-        __be32          t_sec;          /* timestamp seconds */
-        __be32          t_nsec;         /* timestamp nanoseconds */
-} xfs_timestamp_t;
-
-/*
- * On-disk inode structure.
- *
- * This is just the header or "dinode core", the inode is expanded to fill a
- * variable size the leftover area split into a data and an attribute fork.
- * The format of the data and attribute fork depends on the format of the
- * inode as indicated by di_format and di_aformat.  To access the data and
- * attribute use the XFS_DFORK_DPTR, XFS_DFORK_APTR, and XFS_DFORK_PTR macros
- * below.
- *
- * There is a very similar struct icdinode in xfs_inode which matches the
- * layout of the first 96 bytes of this structure, but is kept in native
- * format instead of big endian.
- *
- * Note: di_flushiter is only used by v1/2 inodes - it's effectively a zeroed
- * padding field for v3 inodes.
- */
-typedef struct xfs_dinode {
-        __be16          di_magic;       /* inode magic # = XFS_DINODE_MAGIC */
-        __be16          di_mode;        /* mode and type of file */
-        __u8            di_version;     /* inode version */
-        __u8            di_format;      /* format of di_c data */
-        __be16          di_onlink;      /* old number of links to file */
-        __be32          di_uid;         /* owner's user id */
-        __be32          di_gid;         /* owner's group id */
-        __be32          di_nlink;       /* number of links to file */
-        __be16          di_projid_lo;   /* lower part of owner's project id */
-        __be16          di_projid_hi;   /* higher part owner's project id */
-        __u8            di_pad[6];      /* unused, zeroed space */
-        __be16          di_flushiter;   /* incremented on flush */
-        xfs_timestamp_t di_atime;       /* time last accessed */
-        xfs_timestamp_t di_mtime;       /* time last modified */
-        xfs_timestamp_t di_ctime;       /* time created/inode modified */
-        __be64          di_size;        /* number of bytes in file */
-        __be64          di_nblocks;     /* # of direct & btree blocks used */
-        __be32          di_extsize;     /* basic/minimum extent size for file */
-        __be32          di_nextents;    /* number of extents in data fork */
-        __be16          di_anextents;   /* number of extents in attribute fork*/
-        __u8            di_forkoff;     /* attr fork offs, <<3 for 64b align */
-        __s8            di_aformat;     /* format of attr fork's data */
-        __be32          di_dmevmask;    /* DMIG event mask */
-        __be16          di_dmstate;     /* DMIG state info */
-        __be16          di_flags;       /* random flags, XFS_DIFLAG_... */
-        __be32          di_gen;         /* generation number */
-
-        /* di_next_unlinked is the only non-core field in the old dinode */
-        __be32          di_next_unlinked;/* agi unlinked list ptr */
-
-        /* start of the extended dinode, writable fields */
-        __le32          di_crc;         /* CRC of the inode */
-        __be64          di_changecount; /* number of attribute changes */
-        __be64          di_lsn;         /* flush sequence */
-        __be64          di_flags2;      /* more random flags */
-        __u8            di_pad2[16];    /* more padding for future expansion */
-
-        /* fields only written to during inode creation */
-        xfs_timestamp_t di_crtime;      /* time created */
-        __be64          di_ino;         /* inode number */
-        uuid_t          di_uuid;        /* UUID of the filesystem */
-
-        /* structure must be padded to 64 bit alignment */
-} xfs_dinode_t;
-
-#define XFS_DINODE_CRC_OFF      offsetof(struct xfs_dinode, di_crc)
-
-#define DI_MAX_FLUSH 0xffff
-
-/*
- * Size of the core inode on disk.  Version 1 and 2 inodes have
- * the same size, but version 3 has grown a few additional fields.
- */
-static inline uint xfs_dinode_size(int version)
-{
-        if (version == 3)
-                return sizeof(struct xfs_dinode);
-        return offsetof(struct xfs_dinode, di_crc);
-}
-
-/*
- * The 32 bit link count in the inode theoretically maxes out at UINT_MAX.
- * Since the pathconf interface is signed, we use 2^31 - 1 instead.
- * The old inode format had a 16 bit link count, so its maximum is USHRT_MAX.
- */
-#define XFS_MAXLINK             ((1U << 31) - 1U)
-#define XFS_MAXLINK_1           65535U
-
-/*
- * Values for di_format
- */
-typedef enum xfs_dinode_fmt {
-        XFS_DINODE_FMT_DEV,             /* xfs_dev_t */
-        XFS_DINODE_FMT_LOCAL,           /* bulk data */
-        XFS_DINODE_FMT_EXTENTS,         /* struct xfs_bmbt_rec */
-        XFS_DINODE_FMT_BTREE,           /* struct xfs_bmdr_block */
-        XFS_DINODE_FMT_UUID             /* uuid_t */
-} xfs_dinode_fmt_t;
-
-/*
- * Inode minimum and maximum sizes.
- */
-#define XFS_DINODE_MIN_LOG      8
-#define XFS_DINODE_MAX_LOG      11
-#define XFS_DINODE_MIN_SIZE     (1 << XFS_DINODE_MIN_LOG)
-#define XFS_DINODE_MAX_SIZE     (1 << XFS_DINODE_MAX_LOG)
-
-/*
- * Inode size for given fs.
- */
-#define XFS_LITINO(mp, version) \
-        ((int)(((mp)->m_sb.sb_inodesize) - xfs_dinode_size(version)))
-
-/*
- * Inode data & attribute fork sizes, per inode.
- */
-#define XFS_DFORK_Q(dip)                ((dip)->di_forkoff != 0)
-#define XFS_DFORK_BOFF(dip)             ((int)((dip)->di_forkoff << 3))
-
-#define XFS_DFORK_DSIZE(dip,mp) \
-        (XFS_DFORK_Q(dip) ? \
-                XFS_DFORK_BOFF(dip) : \
-                XFS_LITINO(mp, (dip)->di_version))
-#define XFS_DFORK_ASIZE(dip,mp) \
-        (XFS_DFORK_Q(dip) ? \
-                XFS_LITINO(mp, (dip)->di_version) - XFS_DFORK_BOFF(dip) : \
-                0)
-#define XFS_DFORK_SIZE(dip,mp,w) \
-        ((w) == XFS_DATA_FORK ? \
-                XFS_DFORK_DSIZE(dip, mp) : \
-                XFS_DFORK_ASIZE(dip, mp))
-
-/*
- * Return pointers to the data or attribute forks.
- */
-#define XFS_DFORK_DPTR(dip) \
-        ((char *)dip + xfs_dinode_size(dip->di_version))
-#define XFS_DFORK_APTR(dip)     \
-        (XFS_DFORK_DPTR(dip) + XFS_DFORK_BOFF(dip))
-#define XFS_DFORK_PTR(dip,w)    \
-        ((w) == XFS_DATA_FORK ? XFS_DFORK_DPTR(dip) : XFS_DFORK_APTR(dip))
-
-#define XFS_DFORK_FORMAT(dip,w) \
-        ((w) == XFS_DATA_FORK ? \
-                (dip)->di_format : \
-                (dip)->di_aformat)
-#define XFS_DFORK_NEXTENTS(dip,w) \
-        ((w) == XFS_DATA_FORK ? \
-                be32_to_cpu((dip)->di_nextents) : \
-                be16_to_cpu((dip)->di_anextents))
-
-#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)((bp)->b_addr))
-
-/*
- * For block and character special files the 32bit dev_t is stored at the
- * beginning of the data fork.
- */
-static inline xfs_dev_t xfs_dinode_get_rdev(struct xfs_dinode *dip)
-{
-        return be32_to_cpu(*(__be32 *)XFS_DFORK_DPTR(dip));
-}
-
-static inline void xfs_dinode_put_rdev(struct xfs_dinode *dip, xfs_dev_t rdev)
-{
-        *(__be32 *)XFS_DFORK_DPTR(dip) = cpu_to_be32(rdev);
-}
-
-/*
- * Values for di_flags
- * There should be a one-to-one correspondence between these flags and the
- * XFS_XFLAG_s.
- */
-#define XFS_DIFLAG_REALTIME_BIT  0      /* file's blocks come from rt area */
-#define XFS_DIFLAG_PREALLOC_BIT  1      /* file space has been preallocated */
-#define XFS_DIFLAG_NEWRTBM_BIT   2      /* for rtbitmap inode, new format */
-#define XFS_DIFLAG_IMMUTABLE_BIT 3      /* inode is immutable */
-#define XFS_DIFLAG_APPEND_BIT    4      /* inode is append-only */
-#define XFS_DIFLAG_SYNC_BIT      5      /* inode is written synchronously */
-#define XFS_DIFLAG_NOATIME_BIT   6      /* do not update atime */
-#define XFS_DIFLAG_NODUMP_BIT    7      /* do not dump */
-#define XFS_DIFLAG_RTINHERIT_BIT 8      /* create with realtime bit set */
-#define XFS_DIFLAG_PROJINHERIT_BIT   9  /* create with parents projid */
-#define XFS_DIFLAG_NOSYMLINKS_BIT   10  /* disallow symlink creation */
-#define XFS_DIFLAG_EXTSIZE_BIT      11  /* inode extent size allocator hint */
-#define XFS_DIFLAG_EXTSZINHERIT_BIT 12  /* inherit inode extent size */
-#define XFS_DIFLAG_NODEFRAG_BIT     13  /* do not reorganize/defragment */
-#define XFS_DIFLAG_FILESTREAM_BIT   14  /* use filestream allocator */
-#define XFS_DIFLAG_REALTIME      (1 << XFS_DIFLAG_REALTIME_BIT)
-#define XFS_DIFLAG_PREALLOC      (1 << XFS_DIFLAG_PREALLOC_BIT)
-#define XFS_DIFLAG_NEWRTBM       (1 << XFS_DIFLAG_NEWRTBM_BIT)
-#define XFS_DIFLAG_IMMUTABLE     (1 << XFS_DIFLAG_IMMUTABLE_BIT)
-#define XFS_DIFLAG_APPEND        (1 << XFS_DIFLAG_APPEND_BIT)
-#define XFS_DIFLAG_SYNC          (1 << XFS_DIFLAG_SYNC_BIT)
-#define XFS_DIFLAG_NOATIME       (1 << XFS_DIFLAG_NOATIME_BIT)
-#define XFS_DIFLAG_NODUMP        (1 << XFS_DIFLAG_NODUMP_BIT)
-#define XFS_DIFLAG_RTINHERIT     (1 << XFS_DIFLAG_RTINHERIT_BIT)
-#define XFS_DIFLAG_PROJINHERIT   (1 << XFS_DIFLAG_PROJINHERIT_BIT)
-#define XFS_DIFLAG_NOSYMLINKS    (1 << XFS_DIFLAG_NOSYMLINKS_BIT)
-#define XFS_DIFLAG_EXTSIZE       (1 << XFS_DIFLAG_EXTSIZE_BIT)
-#define XFS_DIFLAG_EXTSZINHERIT  (1 << XFS_DIFLAG_EXTSZINHERIT_BIT)
-#define XFS_DIFLAG_NODEFRAG      (1 << XFS_DIFLAG_NODEFRAG_BIT)
-#define XFS_DIFLAG_FILESTREAM    (1 << XFS_DIFLAG_FILESTREAM_BIT)
-
-#ifdef CONFIG_XFS_RT
-#define XFS_IS_REALTIME_INODE(ip) ((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME)
-#else
-#define XFS_IS_REALTIME_INODE(ip) (0)
-#endif
-
-#define XFS_DIFLAG_ANY \
-        (XFS_DIFLAG_REALTIME | XFS_DIFLAG_PREALLOC | XFS_DIFLAG_NEWRTBM | \
-         XFS_DIFLAG_IMMUTABLE | XFS_DIFLAG_APPEND | XFS_DIFLAG_SYNC | \
-         XFS_DIFLAG_NOATIME | XFS_DIFLAG_NODUMP | XFS_DIFLAG_RTINHERIT | \
-         XFS_DIFLAG_PROJINHERIT | XFS_DIFLAG_NOSYMLINKS | XFS_DIFLAG_EXTSIZE | \
-         XFS_DIFLAG_EXTSZINHERIT | XFS_DIFLAG_NODEFRAG | XFS_DIFLAG_FILESTREAM)
-
-#endif  /* __XFS_DINODE_H__ */
diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c
index 7075aaf131f4..a69fb3a1e161 100644
--- a/fs/xfs/libxfs/xfs_dir2.c
+++ b/fs/xfs/libxfs/xfs_dir2.c
@@ -20,9 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_inum.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -34,10 +31,25 @@
 #include "xfs_dir2_priv.h"
 #include "xfs_error.h"
 #include "xfs_trace.h"
-#include "xfs_dinode.h"
 
 struct xfs_name xfs_name_dotdot = { (unsigned char *)"..", 2, XFS_DIR3_FT_DIR };
 
+/*
+ * @mode, if set, indicates that the type field needs to be set up.
+ * This uses the transformation from file mode to DT_* as defined in linux/fs.h
+ * for file type specification. This will be propagated into the directory
+ * structure if appropriate for the given operation and filesystem config.
+ */
+const unsigned char xfs_mode_to_ftype[S_IFMT >> S_SHIFT] = {
+        [0]                     = XFS_DIR3_FT_UNKNOWN,
+        [S_IFREG >> S_SHIFT]    = XFS_DIR3_FT_REG_FILE,
+        [S_IFDIR >> S_SHIFT]    = XFS_DIR3_FT_DIR,
+        [S_IFCHR >> S_SHIFT]    = XFS_DIR3_FT_CHRDEV,
+        [S_IFBLK >> S_SHIFT]    = XFS_DIR3_FT_BLKDEV,
+        [S_IFIFO >> S_SHIFT]    = XFS_DIR3_FT_FIFO,
+        [S_IFSOCK >> S_SHIFT]   = XFS_DIR3_FT_SOCK,
+        [S_IFLNK >> S_SHIFT]    = XFS_DIR3_FT_SYMLINK,
+};
 
 /*
  * ASCII case-insensitive (ie. A-Z) support for directories that was
diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h
index 4dff261e6ed5..e55353651f5b 100644
--- a/fs/xfs/libxfs/xfs_dir2.h
+++ b/fs/xfs/libxfs/xfs_dir2.h
@@ -32,6 +32,12 @@ struct xfs_dir2_data_unused;
 extern struct xfs_name  xfs_name_dotdot;
 
 /*
+ * directory filetype conversion tables.
+ */
+#define S_SHIFT 12
+extern const unsigned char xfs_mode_to_ftype[];
+
+/*
  * directory operations vector for encode/decode routines
  */
 struct xfs_dir_ops {
@@ -177,4 +183,138 @@ extern const struct xfs_buf_ops xfs_dir3_leaf1_buf_ops;
 extern const struct xfs_buf_ops xfs_dir3_free_buf_ops;
 extern const struct xfs_buf_ops xfs_dir3_data_buf_ops;
 
+/*
+ * Directory offset/block conversion functions.
+ *
+ * DB blocks here are logical directory block numbers, not filesystem blocks.
+ */
+
+/*
+ * Convert dataptr to byte in file space
+ */
+static inline xfs_dir2_off_t
+xfs_dir2_dataptr_to_byte(xfs_dir2_dataptr_t dp)
+{
+        return (xfs_dir2_off_t)dp << XFS_DIR2_DATA_ALIGN_LOG;
+}
+
+/*
+ * Convert byte in file space to dataptr.  It had better be aligned.
+ */
+static inline xfs_dir2_dataptr_t
+xfs_dir2_byte_to_dataptr(xfs_dir2_off_t by)
+{
+        return (xfs_dir2_dataptr_t)(by >> XFS_DIR2_DATA_ALIGN_LOG);
+}
+
+/*
+ * Convert byte in space to (DB) block
+ */
+static inline xfs_dir2_db_t
+xfs_dir2_byte_to_db(struct xfs_da_geometry *geo, xfs_dir2_off_t by)
+{
+        return (xfs_dir2_db_t)(by >> geo->blklog);
+}
+
+/*
+ * Convert dataptr to a block number
+ */
+static inline xfs_dir2_db_t
+xfs_dir2_dataptr_to_db(struct xfs_da_geometry *geo, xfs_dir2_dataptr_t dp)
+{
+        return xfs_dir2_byte_to_db(geo, xfs_dir2_dataptr_to_byte(dp));
+}
+
+/*
+ * Convert byte in space to offset in a block
+ */
+static inline xfs_dir2_data_aoff_t
+xfs_dir2_byte_to_off(struct xfs_da_geometry *geo, xfs_dir2_off_t by)
+{
+        return (xfs_dir2_data_aoff_t)(by & (geo->blksize - 1));
+}
+
+/*
+ * Convert dataptr to a byte offset in a block
+ */
+static inline xfs_dir2_data_aoff_t
+xfs_dir2_dataptr_to_off(struct xfs_da_geometry *geo, xfs_dir2_dataptr_t dp)
+{
+        return xfs_dir2_byte_to_off(geo, xfs_dir2_dataptr_to_byte(dp));
+}
+
+/*
+ * Convert block and offset to byte in space
+ */
+static inline xfs_dir2_off_t
+xfs_dir2_db_off_to_byte(struct xfs_da_geometry *geo, xfs_dir2_db_t db,
+                        xfs_dir2_data_aoff_t o)
+{
+        return ((xfs_dir2_off_t)db << geo->blklog) + o;
+}
+
+/*
+ * Convert block (DB) to block (dablk)
+ */
+static inline xfs_dablk_t
+xfs_dir2_db_to_da(struct xfs_da_geometry *geo, xfs_dir2_db_t db)
+{
+        return (xfs_dablk_t)(db << (geo->blklog - geo->fsblog));
+}
+
+/*
+ * Convert byte in space to (DA) block
+ */
+static inline xfs_dablk_t
+xfs_dir2_byte_to_da(struct xfs_da_geometry *geo, xfs_dir2_off_t by)
+{
+        return xfs_dir2_db_to_da(geo, xfs_dir2_byte_to_db(geo, by));
+}
+
+/*
+ * Convert block and offset to dataptr
+ */
+static inline xfs_dir2_dataptr_t
+xfs_dir2_db_off_to_dataptr(struct xfs_da_geometry *geo, xfs_dir2_db_t db,
+                           xfs_dir2_data_aoff_t o)
+{
+        return xfs_dir2_byte_to_dataptr(xfs_dir2_db_off_to_byte(geo, db, o));
+}
+
+/*
+ * Convert block (dablk) to block (DB)
+ */
+static inline xfs_dir2_db_t
+xfs_dir2_da_to_db(struct xfs_da_geometry *geo, xfs_dablk_t da)
+{
+        return (xfs_dir2_db_t)(da >> (geo->blklog - geo->fsblog));
+}
+
+/*
+ * Convert block (dablk) to byte offset in space
+ */
+static inline xfs_dir2_off_t
+xfs_dir2_da_to_byte(struct xfs_da_geometry *geo, xfs_dablk_t da)
+{
+        return xfs_dir2_db_off_to_byte(geo, xfs_dir2_da_to_db(geo, da), 0);
+}
+
+/*
+ * Directory tail pointer accessor functions. Based on block geometry.
+ */
+static inline struct xfs_dir2_block_tail *
+xfs_dir2_block_tail_p(struct xfs_da_geometry *geo, struct xfs_dir2_data_hdr *hdr)
+{
+        return ((struct xfs_dir2_block_tail *)
+                ((char *)hdr + geo->blksize)) - 1;
+}
+
+static inline struct xfs_dir2_leaf_tail *
+xfs_dir2_leaf_tail_p(struct xfs_da_geometry *geo, struct xfs_dir2_leaf *lp)
+{
+        return (struct xfs_dir2_leaf_tail *)
+                ((char *)lp + geo->blksize -
+                  sizeof(struct xfs_dir2_leaf_tail));
+}
+
 #endif  /* __XFS_DIR2_H__ */
diff --git a/fs/xfs/libxfs/xfs_dir2_block.c b/fs/xfs/libxfs/xfs_dir2_block.c
index 9628ceccfa02..9354e190b82e 100644
--- a/fs/xfs/libxfs/xfs_dir2_block.c
+++ b/fs/xfs/libxfs/xfs_dir2_block.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -36,7 +34,6 @@
 #include "xfs_error.h"
 #include "xfs_trace.h"
 #include "xfs_cksum.h"
-#include "xfs_dinode.h"
 
 /*
  * Local function prototypes.
@@ -353,7 +350,6 @@ xfs_dir2_block_addname(
         int                     low;            /* low index for binary srch */
         int                     lowstale;       /* low stale index */
         int                     mid=0;          /* midpoint for binary srch */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     needlog;        /* need to log header */
         int                     needscan;       /* need to rescan freespace */
         __be16                  *tagp;          /* pointer to tag value */
@@ -363,7 +359,6 @@ xfs_dir2_block_addname(
 
         dp = args->dp;
         tp = args->trans;
-        mp = dp->i_mount;
 
         /* Read the (one and only) directory block into bp. */
         error = xfs_dir3_block_read(tp, dp, &bp);
@@ -618,7 +613,6 @@ xfs_dir2_block_lookup(
         xfs_inode_t             *dp;            /* incore inode */
         int                     ent;            /* entry index */
         int                     error;          /* error return value */
-        xfs_mount_t             *mp;            /* filesystem mount point */
 
         trace_xfs_dir2_block_lookup(args);
 
@@ -629,7 +623,6 @@ xfs_dir2_block_lookup(
         if ((error = xfs_dir2_block_lookup_int(args, &bp, &ent)))
                 return error;
         dp = args->dp;
-        mp = dp->i_mount;
         hdr = bp->b_addr;
         xfs_dir3_data_check(dp, bp);
         btp = xfs_dir2_block_tail_p(args->geo, hdr);
@@ -770,7 +763,6 @@ xfs_dir2_block_removename(
         xfs_inode_t             *dp;            /* incore inode */
         int                     ent;            /* block leaf entry index */
         int                     error;          /* error return value */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     needlog;        /* need to log block header */
         int                     needscan;       /* need to fixup bestfree */
         xfs_dir2_sf_hdr_t       sfh;            /* shortform header */
@@ -788,7 +780,6 @@ xfs_dir2_block_removename(
         }
         dp = args->dp;
         tp = args->trans;
-        mp = dp->i_mount;
         hdr = bp->b_addr;
         btp = xfs_dir2_block_tail_p(args->geo, hdr);
         blp = xfs_dir2_block_leaf_p(btp);
@@ -852,7 +843,6 @@ xfs_dir2_block_replace(
         xfs_inode_t             *dp;            /* incore inode */
         int                     ent;            /* leaf entry index */
         int                     error;          /* error return value */
-        xfs_mount_t             *mp;            /* filesystem mount point */
 
         trace_xfs_dir2_block_replace(args);
 
@@ -864,7 +854,6 @@ xfs_dir2_block_replace(
                 return error;
         }
         dp = args->dp;
-        mp = dp->i_mount;
         hdr = bp->b_addr;
         btp = xfs_dir2_block_tail_p(args->geo, hdr);
         blp = xfs_dir2_block_leaf_p(btp);
diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index fdd803fecb8e..5ff31be9b1cd 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c
index a19174eb3cb2..106119955400 100644
--- a/fs/xfs/libxfs/xfs_dir2_leaf.c
+++ b/fs/xfs/libxfs/xfs_dir2_leaf.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -384,7 +382,6 @@ xfs_dir2_block_to_leaf(
         xfs_dir2_db_t           ldb;            /* leaf block's bno */
         xfs_dir2_leaf_t         *leaf;          /* leaf structure */
         xfs_dir2_leaf_tail_t    *ltp;           /* leaf's tail */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     needlog;        /* need to log block header */
         int                     needscan;       /* need to rescan bestfree */
         xfs_trans_t             *tp;            /* transaction pointer */
@@ -395,7 +392,6 @@ xfs_dir2_block_to_leaf(
         trace_xfs_dir2_block_to_leaf(args);
 
         dp = args->dp;
-        mp = dp->i_mount;
         tp = args->trans;
         /*
          * Add the leaf block to the inode.
@@ -626,7 +622,6 @@ xfs_dir2_leaf_addname(
         int                     lfloghigh;      /* high leaf logging index */
         int                     lowstale;       /* index of prev stale leaf */
         xfs_dir2_leaf_tail_t    *ltp;           /* leaf tail pointer */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     needbytes;      /* leaf block bytes needed */
         int                     needlog;        /* need to log data header */
         int                     needscan;       /* need to rescan data free */
@@ -641,7 +636,6 @@ xfs_dir2_leaf_addname(
 
         dp = args->dp;
         tp = args->trans;
-        mp = dp->i_mount;
 
         error = xfs_dir3_leaf_read(tp, dp, args->geo->leafblk, -1, &lbp);
         if (error)
@@ -1356,11 +1350,9 @@ xfs_dir2_leaf_removename(
         xfs_dir2_leaf_t         *leaf;          /* leaf structure */
         xfs_dir2_leaf_entry_t   *lep;           /* leaf entry */
         xfs_dir2_leaf_tail_t    *ltp;           /* leaf tail structure */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     needlog;        /* need to log data header */
         int                     needscan;       /* need to rescan data frees */
         xfs_dir2_data_off_t     oldbest;        /* old value of best free */
-        xfs_trans_t             *tp;            /* transaction pointer */
         struct xfs_dir2_data_free *bf;          /* bestfree table */
         struct xfs_dir2_leaf_entry *ents;
         struct xfs_dir3_icleaf_hdr leafhdr;
@@ -1374,8 +1366,6 @@ xfs_dir2_leaf_removename(
                 return error;
         }
         dp = args->dp;
-        tp = args->trans;
-        mp = dp->i_mount;
         leaf = lbp->b_addr;
         hdr = dbp->b_addr;
         xfs_dir3_data_check(dp, dbp);
@@ -1607,11 +1597,9 @@ xfs_dir2_leaf_trim_data(
         int                     error;          /* error return value */
         xfs_dir2_leaf_t         *leaf;          /* leaf structure */
         xfs_dir2_leaf_tail_t    *ltp;           /* leaf tail structure */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         xfs_trans_t             *tp;            /* transaction pointer */
 
         dp = args->dp;
-        mp = dp->i_mount;
         tp = args->trans;
         /*
          * Read the offending data block.  We need its buffer.
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index 2ae6ac2c11ae..41b80d3d3877 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -297,7 +295,6 @@ xfs_dir2_leaf_to_node(
         int                     i;              /* leaf freespace index */
         xfs_dir2_leaf_t         *leaf;          /* leaf structure */
         xfs_dir2_leaf_tail_t    *ltp;           /* leaf tail structure */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     n;              /* count of live freespc ents */
         xfs_dir2_data_off_t     off;            /* freespace entry value */
         __be16                  *to;            /* pointer to freespace entry */
@@ -307,7 +304,6 @@ xfs_dir2_leaf_to_node(
         trace_xfs_dir2_leaf_to_node(args);
 
         dp = args->dp;
-        mp = dp->i_mount;
         tp = args->trans;
         /*
          * Add a freespace block to the directory.
@@ -387,16 +383,12 @@ xfs_dir2_leafn_add(
         int                     lfloghigh;      /* high leaf entry logging */
         int                     lfloglow;       /* low leaf entry logging */
         int                     lowstale;       /* previous stale entry */
-        xfs_mount_t             *mp;            /* filesystem mount point */
-        xfs_trans_t             *tp;            /* transaction pointer */
         struct xfs_dir3_icleaf_hdr leafhdr;
         struct xfs_dir2_leaf_entry *ents;
 
         trace_xfs_dir2_leafn_add(args, index);
 
         dp = args->dp;
-        mp = dp->i_mount;
-        tp = args->trans;
         leaf = bp->b_addr;
         dp->d_ops->leaf_hdr_from_disk(&leafhdr, leaf);
         ents = dp->d_ops->leaf_ents_p(leaf);
@@ -1170,7 +1162,6 @@ xfs_dir2_leafn_remove(
         xfs_dir2_leaf_entry_t   *lep;           /* leaf entry */
         int                     longest;        /* longest data free entry */
         int                     off;            /* data block entry offset */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         int                     needlog;        /* need to log data header */
         int                     needscan;       /* need to rescan data frees */
         xfs_trans_t             *tp;            /* transaction pointer */
@@ -1182,7 +1173,6 @@ xfs_dir2_leafn_remove(
 
         dp = args->dp;
         tp = args->trans;
-        mp = dp->i_mount;
         leaf = bp->b_addr;
         dp->d_ops->leaf_hdr_from_disk(&leafhdr, leaf);
         ents = dp->d_ops->leaf_ents_p(leaf);
@@ -1323,7 +1313,6 @@ xfs_dir2_leafn_split(
         xfs_da_args_t           *args;          /* operation arguments */
         xfs_dablk_t             blkno;          /* new leaf block number */
         int                     error;          /* error return value */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         struct xfs_inode        *dp;
 
         /*
@@ -1331,7 +1320,6 @@ xfs_dir2_leafn_split(
          */
         args = state->args;
         dp = args->dp;
-        mp = dp->i_mount;
         ASSERT(oldblk->magic == XFS_DIR2_LEAFN_MAGIC);
         error = xfs_da_grow_inode(args, &blkno);
         if (error) {
@@ -2231,12 +2219,10 @@ xfs_dir2_node_trim_free(
         xfs_inode_t             *dp;            /* incore directory inode */
         int                     error;          /* error return code */
         xfs_dir2_free_t         *free;          /* freespace structure */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         xfs_trans_t             *tp;            /* transaction pointer */
         struct xfs_dir3_icfree_hdr freehdr;
 
         dp = args->dp;
-        mp = dp->i_mount;
         tp = args->trans;
         /*
          * Read the freespace block.
diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h
index 27ce0794d196..ef9f6ead96a4 100644
--- a/fs/xfs/libxfs/xfs_dir2_priv.h
+++ b/fs/xfs/libxfs/xfs_dir2_priv.h
@@ -20,140 +20,6 @@
 
 struct dir_context;
 
-/*
- * Directory offset/block conversion functions.
- *
- * DB blocks here are logical directory block numbers, not filesystem blocks.
- */
-
-/*
- * Convert dataptr to byte in file space
- */
-static inline xfs_dir2_off_t
-xfs_dir2_dataptr_to_byte(xfs_dir2_dataptr_t dp)
-{
-        return (xfs_dir2_off_t)dp << XFS_DIR2_DATA_ALIGN_LOG;
-}
-
-/*
- * Convert byte in file space to dataptr.  It had better be aligned.
- */
-static inline xfs_dir2_dataptr_t
-xfs_dir2_byte_to_dataptr(xfs_dir2_off_t by)
-{
-        return (xfs_dir2_dataptr_t)(by >> XFS_DIR2_DATA_ALIGN_LOG);
-}
-
-/*
- * Convert byte in space to (DB) block
- */
-static inline xfs_dir2_db_t
-xfs_dir2_byte_to_db(struct xfs_da_geometry *geo, xfs_dir2_off_t by)
-{
-        return (xfs_dir2_db_t)(by >> geo->blklog);
-}
-
-/*
- * Convert dataptr to a block number
- */
-static inline xfs_dir2_db_t
-xfs_dir2_dataptr_to_db(struct xfs_da_geometry *geo, xfs_dir2_dataptr_t dp)
-{
-        return xfs_dir2_byte_to_db(geo, xfs_dir2_dataptr_to_byte(dp));
-}
-
-/*
- * Convert byte in space to offset in a block
- */
-static inline xfs_dir2_data_aoff_t
-xfs_dir2_byte_to_off(struct xfs_da_geometry *geo, xfs_dir2_off_t by)
-{
-        return (xfs_dir2_data_aoff_t)(by & (geo->blksize - 1));
-}
-
-/*
- * Convert dataptr to a byte offset in a block
- */
-static inline xfs_dir2_data_aoff_t
-xfs_dir2_dataptr_to_off(struct xfs_da_geometry *geo, xfs_dir2_dataptr_t dp)
-{
-        return xfs_dir2_byte_to_off(geo, xfs_dir2_dataptr_to_byte(dp));
-}
-
-/*
- * Convert block and offset to byte in space
- */
-static inline xfs_dir2_off_t
-xfs_dir2_db_off_to_byte(struct xfs_da_geometry *geo, xfs_dir2_db_t db,
-                        xfs_dir2_data_aoff_t o)
-{
-        return ((xfs_dir2_off_t)db << geo->blklog) + o;
-}
-
-/*
- * Convert block (DB) to block (dablk)
- */
-static inline xfs_dablk_t
-xfs_dir2_db_to_da(struct xfs_da_geometry *geo, xfs_dir2_db_t db)
-{
-        return (xfs_dablk_t)(db << (geo->blklog - geo->fsblog));
-}
-
-/*
- * Convert byte in space to (DA) block
- */
-static inline xfs_dablk_t
-xfs_dir2_byte_to_da(struct xfs_da_geometry *geo, xfs_dir2_off_t by)
-{
-        return xfs_dir2_db_to_da(geo, xfs_dir2_byte_to_db(geo, by));
-}
-
-/*
- * Convert block and offset to dataptr
- */
-static inline xfs_dir2_dataptr_t
-xfs_dir2_db_off_to_dataptr(struct xfs_da_geometry *geo, xfs_dir2_db_t db,
-                           xfs_dir2_data_aoff_t o)
-{
-        return xfs_dir2_byte_to_dataptr(xfs_dir2_db_off_to_byte(geo, db, o));
-}
-
-/*
- * Convert block (dablk) to block (DB)
- */
-static inline xfs_dir2_db_t
-xfs_dir2_da_to_db(struct xfs_da_geometry *geo, xfs_dablk_t da)
-{
-        return (xfs_dir2_db_t)(da >> (geo->blklog - geo->fsblog));
-}
-
-/*
- * Convert block (dablk) to byte offset in space
- */
-static inline xfs_dir2_off_t
-xfs_dir2_da_to_byte(struct xfs_da_geometry *geo, xfs_dablk_t da)
-{
-        return xfs_dir2_db_off_to_byte(geo, xfs_dir2_da_to_db(geo, da), 0);
-}
-
-/*
- * Directory tail pointer accessor functions. Based on block geometry.
- */
-static inline struct xfs_dir2_block_tail *
-xfs_dir2_block_tail_p(struct xfs_da_geometry *geo, struct xfs_dir2_data_hdr *hdr)
-{
-        return ((struct xfs_dir2_block_tail *)
-                ((char *)hdr + geo->blksize)) - 1;
-}
-
-static inline struct xfs_dir2_leaf_tail *
-xfs_dir2_leaf_tail_p(struct xfs_da_geometry *geo, struct xfs_dir2_leaf *lp)
-{
-        return (struct xfs_dir2_leaf_tail *)
-                ((char *)lp + geo->blksize -
-                  sizeof(struct xfs_dir2_leaf_tail));
-}
-
 /* xfs_dir2.c */
 extern int xfs_dir_ino_validate(struct xfs_mount *mp, xfs_ino_t ino);
 extern int xfs_dir2_grow_inode(struct xfs_da_args *args, int space,
@@ -161,12 +27,6 @@ extern int xfs_dir2_grow_inode(struct xfs_da_args *args, int space,
 extern int xfs_dir_cilookup_result(struct xfs_da_args *args,
                                 const unsigned char *name, int len);
 
-#define S_SHIFT 12
-extern const unsigned char xfs_mode_to_ftype[];
-
-extern unsigned char xfs_dir3_get_dtype(struct xfs_mount *mp,
-                                        __uint8_t filetype);
-
 
 /* xfs_dir2_block.c */
 extern int xfs_dir3_block_read(struct xfs_trans *tp, struct xfs_inode *dp,
diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
index 5079e051ef08..974d62e677f4 100644
--- a/fs/xfs/libxfs/xfs_dir2_sf.c
+++ b/fs/xfs/libxfs/xfs_dir2_sf.c
@@ -20,8 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -32,7 +30,6 @@
 #include "xfs_dir2.h"
 #include "xfs_dir2_priv.h"
 #include "xfs_trace.h"
-#include "xfs_dinode.h"
 
 /*
  * Prototypes for internal functions.
@@ -455,13 +452,11 @@ xfs_dir2_sf_addname_hard(
         xfs_dir2_sf_hdr_t       *oldsfp;        /* original shortform dir */
         xfs_dir2_sf_entry_t     *sfep;          /* entry in new dir */
         xfs_dir2_sf_hdr_t       *sfp;           /* new shortform dir */
-        struct xfs_mount        *mp;
 
         /*
          * Copy the old directory to the stack buffer.
          */
         dp = args->dp;
-        mp = dp->i_mount;
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
         old_isize = (int)dp->i_d.di_size;
@@ -542,7 +537,6 @@ xfs_dir2_sf_addname_pick(
         xfs_inode_t             *dp;            /* incore directory inode */
         int                     holefit;        /* found hole it will fit in */
         int                     i;              /* entry number */
-        xfs_mount_t             *mp;            /* filesystem mount point */
         xfs_dir2_data_aoff_t    offset;         /* data block offset */
         xfs_dir2_sf_entry_t     *sfep;          /* shortform entry */
         xfs_dir2_sf_hdr_t       *sfp;           /* shortform structure */
@@ -550,7 +544,6 @@ xfs_dir2_sf_addname_pick(
         int                     used;           /* data bytes used */
 
         dp = args->dp;
-        mp = dp->i_mount;
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
         size = dp->d_ops->data_entsize(args->namelen);
@@ -616,10 +609,8 @@ xfs_dir2_sf_check(
         int                     offset;         /* data offset */
         xfs_dir2_sf_entry_t     *sfep;          /* shortform dir entry */
         xfs_dir2_sf_hdr_t       *sfp;           /* shortform structure */
-        struct xfs_mount        *mp;
 
         dp = args->dp;
-        mp = dp->i_mount;
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
         offset = dp->d_ops->data_first_offset;
@@ -1016,12 +1007,10 @@ xfs_dir2_sf_toino4(
         int                     oldsize;        /* old inode size */
         xfs_dir2_sf_entry_t     *sfep;          /* new sf entry */
         xfs_dir2_sf_hdr_t       *sfp;           /* new sf directory */
-        struct xfs_mount        *mp;
 
         trace_xfs_dir2_sf_toino4(args);
 
         dp = args->dp;
-        mp = dp->i_mount;
 
         /*
          * Copy the old directory to the buffer.
@@ -1094,12 +1083,10 @@ xfs_dir2_sf_toino8(
         int                     oldsize;        /* old inode size */
         xfs_dir2_sf_entry_t     *sfep;          /* new sf entry */
         xfs_dir2_sf_hdr_t       *sfp;           /* new sf directory */
-        struct xfs_mount        *mp;
 
         trace_xfs_dir2_sf_toino8(args);
 
         dp = args->dp;
-        mp = dp->i_mount;
 
         /*
          * Copy the old directory to the buffer.
diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
index bb969337efc8..6fbf2d853a54 100644
--- a/fs/xfs/libxfs/xfs_dquot_buf.c
+++ b/fs/xfs/libxfs/xfs_dquot_buf.c
@@ -22,8 +22,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_quota.h"
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index 7e42bba9a420..fbd6da263571 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -34,6 +34,1077 @@ struct xfs_buf;
 struct xfs_ifork;
 
 /*
+ * Super block
+ * Fits into a sector-sized buffer at address 0 of each allocation group.
+ * Only the first of these is ever updated except during growfs.
+ */
+#define XFS_SB_MAGIC            0x58465342      /* 'XFSB' */
+#define XFS_SB_VERSION_1        1               /* 5.3, 6.0.1, 6.1 */
+#define XFS_SB_VERSION_2        2               /* 6.2 - attributes */
+#define XFS_SB_VERSION_3        3               /* 6.2 - new inode version */
+#define XFS_SB_VERSION_4        4               /* 6.2+ - bitmask version */
+#define XFS_SB_VERSION_5        5               /* CRC enabled filesystem */
+#define XFS_SB_VERSION_NUMBITS          0x000f
+#define XFS_SB_VERSION_ALLFBITS         0xfff0
+#define XFS_SB_VERSION_ATTRBIT          0x0010
+#define XFS_SB_VERSION_NLINKBIT         0x0020
+#define XFS_SB_VERSION_QUOTABIT         0x0040
+#define XFS_SB_VERSION_ALIGNBIT         0x0080
+#define XFS_SB_VERSION_DALIGNBIT        0x0100
+#define XFS_SB_VERSION_SHAREDBIT        0x0200
+#define XFS_SB_VERSION_LOGV2BIT         0x0400
+#define XFS_SB_VERSION_SECTORBIT        0x0800
+#define XFS_SB_VERSION_EXTFLGBIT        0x1000
+#define XFS_SB_VERSION_DIRV2BIT         0x2000
+#define XFS_SB_VERSION_BORGBIT          0x4000  /* ASCII only case-insens. */
+#define XFS_SB_VERSION_MOREBITSBIT      0x8000
+
+/*
+ * Supported feature bit list is just all bits in the versionnum field because
+ * we've used them all up and understand them all. Except, of course, for the
+ * shared superblock bit, which nobody knows what it does and so is unsupported.
+ */
+#define XFS_SB_VERSION_OKBITS           \
+        ((XFS_SB_VERSION_NUMBITS | XFS_SB_VERSION_ALLFBITS) & \
+                ~XFS_SB_VERSION_SHAREDBIT)
+
+/*
+ * There are two words to hold XFS "feature" bits: the original
+ * word, sb_versionnum, and sb_features2.  Whenever a bit is set in
+ * sb_features2, the feature bit XFS_SB_VERSION_MOREBITSBIT must be set.
+ *
+ * These defines represent bits in sb_features2.
+ */
+#define XFS_SB_VERSION2_RESERVED1BIT    0x00000001
+#define XFS_SB_VERSION2_LAZYSBCOUNTBIT  0x00000002      /* Superblk counters */
+#define XFS_SB_VERSION2_RESERVED4BIT    0x00000004
+#define XFS_SB_VERSION2_ATTR2BIT        0x00000008      /* Inline attr rework */
+#define XFS_SB_VERSION2_PARENTBIT       0x00000010      /* parent pointers */
+#define XFS_SB_VERSION2_PROJID32BIT     0x00000080      /* 32 bit project id */
+#define XFS_SB_VERSION2_CRCBIT          0x00000100      /* metadata CRCs */
+#define XFS_SB_VERSION2_FTYPE           0x00000200      /* inode type in dir */
+
+#define XFS_SB_VERSION2_OKBITS          \
+        (XFS_SB_VERSION2_LAZYSBCOUNTBIT | \
+         XFS_SB_VERSION2_ATTR2BIT       | \
+         XFS_SB_VERSION2_PROJID32BIT    | \
+         XFS_SB_VERSION2_FTYPE)
+
+/*
+ * Superblock - in core version.  Must match the ondisk version below.
+ * Must be padded to 64 bit alignment.
+ */
+typedef struct xfs_sb {
+        __uint32_t      sb_magicnum;    /* magic number == XFS_SB_MAGIC */
+        __uint32_t      sb_blocksize;   /* logical block size, bytes */
+        xfs_rfsblock_t  sb_dblocks;     /* number of data blocks */
+        xfs_rfsblock_t  sb_rblocks;     /* number of realtime blocks */
+        xfs_rtblock_t   sb_rextents;    /* number of realtime extents */
+        uuid_t          sb_uuid;        /* file system unique id */
+        xfs_fsblock_t   sb_logstart;    /* starting block of log if internal */
+        xfs_ino_t       sb_rootino;     /* root inode number */
+        xfs_ino_t       sb_rbmino;      /* bitmap inode for realtime extents */
+        xfs_ino_t       sb_rsumino;     /* summary inode for rt bitmap */
+        xfs_agblock_t   sb_rextsize;    /* realtime extent size, blocks */
+        xfs_agblock_t   sb_agblocks;    /* size of an allocation group */
+        xfs_agnumber_t  sb_agcount;     /* number of allocation groups */
+        xfs_extlen_t    sb_rbmblocks;   /* number of rt bitmap blocks */
+        xfs_extlen_t    sb_logblocks;   /* number of log blocks */
+        __uint16_t      sb_versionnum;  /* header version == XFS_SB_VERSION */
+        __uint16_t      sb_sectsize;    /* volume sector size, bytes */
+        __uint16_t      sb_inodesize;   /* inode size, bytes */
+        __uint16_t      sb_inopblock;   /* inodes per block */
+        char            sb_fname[12];   /* file system name */
+        __uint8_t       sb_blocklog;    /* log2 of sb_blocksize */
+        __uint8_t       sb_sectlog;     /* log2 of sb_sectsize */
+        __uint8_t       sb_inodelog;    /* log2 of sb_inodesize */
+        __uint8_t       sb_inopblog;    /* log2 of sb_inopblock */
+        __uint8_t       sb_agblklog;    /* log2 of sb_agblocks (rounded up) */
+        __uint8_t       sb_rextslog;    /* log2 of sb_rextents */
+        __uint8_t       sb_inprogress;  /* mkfs is in progress, don't mount */
+        __uint8_t       sb_imax_pct;    /* max % of fs for inode space */
+                                        /* statistics */
+        /*
+         * These fields must remain contiguous.  If you really
+         * want to change their layout, make sure you fix the
+         * code in xfs_trans_apply_sb_deltas().
+         */
+        __uint64_t      sb_icount;      /* allocated inodes */
+        __uint64_t      sb_ifree;       /* free inodes */
+        __uint64_t      sb_fdblocks;    /* free data blocks */
+        __uint64_t      sb_frextents;   /* free realtime extents */
+        /*
+         * End contiguous fields.
+         */
+        xfs_ino_t       sb_uquotino;    /* user quota inode */
+        xfs_ino_t       sb_gquotino;    /* group quota inode */
+        __uint16_t      sb_qflags;      /* quota flags */
+        __uint8_t       sb_flags;       /* misc. flags */
+        __uint8_t       sb_shared_vn;   /* shared version number */
+        xfs_extlen_t    sb_inoalignmt;  /* inode chunk alignment, fsblocks */
+        __uint32_t      sb_unit;        /* stripe or raid unit */
+        __uint32_t      sb_width;       /* stripe or raid width */
+        __uint8_t       sb_dirblklog;   /* log2 of dir block size (fsbs) */
+        __uint8_t       sb_logsectlog;  /* log2 of the log sector size */
+        __uint16_t      sb_logsectsize; /* sector size for the log, bytes */
+        __uint32_t      sb_logsunit;    /* stripe unit size for the log */
+        __uint32_t      sb_features2;   /* additional feature bits */
+
+        /*
+         * bad features2 field as a result of failing to pad the sb
+         * structure to 64 bits. Some machines will be using this field
+         * for features2 bits. Easiest just to mark it bad and not use
+         * it for anything else.
+         */
+        __uint32_t      sb_bad_features2;
+
+        /* version 5 superblock fields start here */
+
+        /* feature masks */
+        __uint32_t      sb_features_compat;
+        __uint32_t      sb_features_ro_compat;
+        __uint32_t      sb_features_incompat;
+        __uint32_t      sb_features_log_incompat;
+
+        __uint32_t      sb_crc;         /* superblock crc */
+        __uint32_t      sb_pad;
+
+        xfs_ino_t       sb_pquotino;    /* project quota inode */
+        xfs_lsn_t       sb_lsn;         /* last write sequence */
+
+        /* must be padded to 64 bit alignment */
+} xfs_sb_t;
+
+#define XFS_SB_CRC_OFF          offsetof(struct xfs_sb, sb_crc)
+
+/*
+ * Superblock - on disk version.  Must match the in core version above.
+ * Must be padded to 64 bit alignment.
+ */
+typedef struct xfs_dsb {
+        __be32          sb_magicnum;    /* magic number == XFS_SB_MAGIC */
+        __be32          sb_blocksize;   /* logical block size, bytes */
+        __be64          sb_dblocks;     /* number of data blocks */
+        __be64          sb_rblocks;     /* number of realtime blocks */
+        __be64          sb_rextents;    /* number of realtime extents */
+        uuid_t          sb_uuid;        /* file system unique id */
+        __be64          sb_logstart;    /* starting block of log if internal */
+        __be64          sb_rootino;     /* root inode number */
+        __be64          sb_rbmino;      /* bitmap inode for realtime extents */
+        __be64          sb_rsumino;     /* summary inode for rt bitmap */
+        __be32          sb_rextsize;    /* realtime extent size, blocks */
+        __be32          sb_agblocks;    /* size of an allocation group */
+        __be32          sb_agcount;     /* number of allocation groups */
+        __be32          sb_rbmblocks;   /* number of rt bitmap blocks */
+        __be32          sb_logblocks;   /* number of log blocks */
+        __be16          sb_versionnum;  /* header version == XFS_SB_VERSION */
+        __be16          sb_sectsize;    /* volume sector size, bytes */
+        __be16          sb_inodesize;   /* inode size, bytes */
+        __be16          sb_inopblock;   /* inodes per block */
+        char            sb_fname[12];   /* file system name */
+        __u8            sb_blocklog;    /* log2 of sb_blocksize */
+        __u8            sb_sectlog;     /* log2 of sb_sectsize */
+        __u8            sb_inodelog;    /* log2 of sb_inodesize */
+        __u8            sb_inopblog;    /* log2 of sb_inopblock */
+        __u8            sb_agblklog;    /* log2 of sb_agblocks (rounded up) */
+        __u8            sb_rextslog;    /* log2 of sb_rextents */
+        __u8            sb_inprogress;  /* mkfs is in progress, don't mount */
+        __u8            sb_imax_pct;    /* max % of fs for inode space */
+                                        /* statistics */
+        /*
+         * These fields must remain contiguous.  If you really
+         * want to change their layout, make sure you fix the
+         * code in xfs_trans_apply_sb_deltas().
+         */
+        __be64          sb_icount;      /* allocated inodes */
+        __be64          sb_ifree;       /* free inodes */
+        __be64          sb_fdblocks;    /* free data blocks */
+        __be64          sb_frextents;   /* free realtime extents */
+        /*
+         * End contiguous fields.
+         */
+        __be64          sb_uquotino;    /* user quota inode */
+        __be64          sb_gquotino;    /* group quota inode */
+        __be16          sb_qflags;      /* quota flags */
+        __u8            sb_flags;       /* misc. flags */
+        __u8            sb_shared_vn;   /* shared version number */
+        __be32          sb_inoalignmt;  /* inode chunk alignment, fsblocks */
+        __be32          sb_unit;        /* stripe or raid unit */
+        __be32          sb_width;       /* stripe or raid width */
+        __u8            sb_dirblklog;   /* log2 of dir block size (fsbs) */
+        __u8            sb_logsectlog;  /* log2 of the log sector size */
+        __be16          sb_logsectsize; /* sector size for the log, bytes */
+        __be32          sb_logsunit;    /* stripe unit size for the log */
+        __be32          sb_features2;   /* additional feature bits */
+        /*
+         * bad features2 field as a result of failing to pad the sb
+         * structure to 64 bits. Some machines will be using this field
+         * for features2 bits. Easiest just to mark it bad and not use
+         * it for anything else.
+         */
+        __be32          sb_bad_features2;
+
+        /* version 5 superblock fields start here */
+
+        /* feature masks */
+        __be32          sb_features_compat;
+        __be32          sb_features_ro_compat;
+        __be32          sb_features_incompat;
+        __be32          sb_features_log_incompat;
+
+        __le32          sb_crc;         /* superblock crc */
+        __be32          sb_pad;
+
+        __be64          sb_pquotino;    /* project quota inode */
+        __be64          sb_lsn;         /* last write sequence */
+
+        /* must be padded to 64 bit alignment */
+} xfs_dsb_t;
+
+/*
+ * Sequence number values for the fields.
+ */
+typedef enum {
+        XFS_SBS_MAGICNUM, XFS_SBS_BLOCKSIZE, XFS_SBS_DBLOCKS, XFS_SBS_RBLOCKS,
+        XFS_SBS_REXTENTS, XFS_SBS_UUID, XFS_SBS_LOGSTART, XFS_SBS_ROOTINO,
+        XFS_SBS_RBMINO, XFS_SBS_RSUMINO, XFS_SBS_REXTSIZE, XFS_SBS_AGBLOCKS,
+        XFS_SBS_AGCOUNT, XFS_SBS_RBMBLOCKS, XFS_SBS_LOGBLOCKS,
+        XFS_SBS_VERSIONNUM, XFS_SBS_SECTSIZE, XFS_SBS_INODESIZE,
+        XFS_SBS_INOPBLOCK, XFS_SBS_FNAME, XFS_SBS_BLOCKLOG,
+        XFS_SBS_SECTLOG, XFS_SBS_INODELOG, XFS_SBS_INOPBLOG, XFS_SBS_AGBLKLOG,
+        XFS_SBS_REXTSLOG, XFS_SBS_INPROGRESS, XFS_SBS_IMAX_PCT, XFS_SBS_ICOUNT,
+        XFS_SBS_IFREE, XFS_SBS_FDBLOCKS, XFS_SBS_FREXTENTS, XFS_SBS_UQUOTINO,
+        XFS_SBS_GQUOTINO, XFS_SBS_QFLAGS, XFS_SBS_FLAGS, XFS_SBS_SHARED_VN,
+        XFS_SBS_INOALIGNMT, XFS_SBS_UNIT, XFS_SBS_WIDTH, XFS_SBS_DIRBLKLOG,
+        XFS_SBS_LOGSECTLOG, XFS_SBS_LOGSECTSIZE, XFS_SBS_LOGSUNIT,
+        XFS_SBS_FEATURES2, XFS_SBS_BAD_FEATURES2, XFS_SBS_FEATURES_COMPAT,
+        XFS_SBS_FEATURES_RO_COMPAT, XFS_SBS_FEATURES_INCOMPAT,
+        XFS_SBS_FEATURES_LOG_INCOMPAT, XFS_SBS_CRC, XFS_SBS_PAD,
+        XFS_SBS_PQUOTINO, XFS_SBS_LSN,
+        XFS_SBS_FIELDCOUNT
+} xfs_sb_field_t;
+
+/*
+ * Mask values, defined based on the xfs_sb_field_t values.
+ * Only define the ones we're using.
+ */
+#define XFS_SB_MVAL(x)          (1LL << XFS_SBS_ ## x)
+#define XFS_SB_UUID             XFS_SB_MVAL(UUID)
+#define XFS_SB_FNAME            XFS_SB_MVAL(FNAME)
+#define XFS_SB_ROOTINO          XFS_SB_MVAL(ROOTINO)
+#define XFS_SB_RBMINO           XFS_SB_MVAL(RBMINO)
+#define XFS_SB_RSUMINO          XFS_SB_MVAL(RSUMINO)
+#define XFS_SB_VERSIONNUM       XFS_SB_MVAL(VERSIONNUM)
+#define XFS_SB_UQUOTINO         XFS_SB_MVAL(UQUOTINO)
+#define XFS_SB_GQUOTINO         XFS_SB_MVAL(GQUOTINO)
+#define XFS_SB_QFLAGS           XFS_SB_MVAL(QFLAGS)
+#define XFS_SB_SHARED_VN        XFS_SB_MVAL(SHARED_VN)
+#define XFS_SB_UNIT             XFS_SB_MVAL(UNIT)
+#define XFS_SB_WIDTH            XFS_SB_MVAL(WIDTH)
+#define XFS_SB_ICOUNT           XFS_SB_MVAL(ICOUNT)
+#define XFS_SB_IFREE            XFS_SB_MVAL(IFREE)
+#define XFS_SB_FDBLOCKS         XFS_SB_MVAL(FDBLOCKS)
+#define XFS_SB_FEATURES2        XFS_SB_MVAL(FEATURES2)
+#define XFS_SB_BAD_FEATURES2    XFS_SB_MVAL(BAD_FEATURES2)
+#define XFS_SB_FEATURES_COMPAT  XFS_SB_MVAL(FEATURES_COMPAT)
+#define XFS_SB_FEATURES_RO_COMPAT XFS_SB_MVAL(FEATURES_RO_COMPAT)
+#define XFS_SB_FEATURES_INCOMPAT XFS_SB_MVAL(FEATURES_INCOMPAT)
+#define XFS_SB_FEATURES_LOG_INCOMPAT XFS_SB_MVAL(FEATURES_LOG_INCOMPAT)
+#define XFS_SB_CRC              XFS_SB_MVAL(CRC)
+#define XFS_SB_PQUOTINO         XFS_SB_MVAL(PQUOTINO)
+#define XFS_SB_NUM_BITS         ((int)XFS_SBS_FIELDCOUNT)
+#define XFS_SB_ALL_BITS         ((1LL << XFS_SB_NUM_BITS) - 1)
+#define XFS_SB_MOD_BITS         \
+        (XFS_SB_UUID | XFS_SB_ROOTINO | XFS_SB_RBMINO | XFS_SB_RSUMINO | \
+         XFS_SB_VERSIONNUM | XFS_SB_UQUOTINO | XFS_SB_GQUOTINO | \
+         XFS_SB_QFLAGS | XFS_SB_SHARED_VN | XFS_SB_UNIT | XFS_SB_WIDTH | \
+         XFS_SB_ICOUNT | XFS_SB_IFREE | XFS_SB_FDBLOCKS | XFS_SB_FEATURES2 | \
+         XFS_SB_BAD_FEATURES2 | XFS_SB_FEATURES_COMPAT | \
+         XFS_SB_FEATURES_RO_COMPAT | XFS_SB_FEATURES_INCOMPAT | \
+         XFS_SB_FEATURES_LOG_INCOMPAT | XFS_SB_PQUOTINO)
+
+
+/*
+ * Misc. Flags - warning - these will be cleared by xfs_repair unless
+ * a feature bit is set when the flag is used.
+ */
+#define XFS_SBF_NOFLAGS         0x00    /* no flags set */
+#define XFS_SBF_READONLY        0x01    /* only read-only mounts allowed */
+
+/*
+ * define max. shared version we can interoperate with
+ */
+#define XFS_SB_MAX_SHARED_VN    0
+
+#define XFS_SB_VERSION_NUM(sbp) ((sbp)->sb_versionnum & XFS_SB_VERSION_NUMBITS)
+
+/*
+ * The first XFS version we support is a v4 superblock with V2 directories.
+ */
+static inline bool xfs_sb_good_v4_features(struct xfs_sb *sbp)
+{
+        if (!(sbp->sb_versionnum & XFS_SB_VERSION_DIRV2BIT))
+                return false;
+
+        /* check for unknown features in the fs */
+        if ((sbp->sb_versionnum & ~XFS_SB_VERSION_OKBITS) ||
+            ((sbp->sb_versionnum & XFS_SB_VERSION_MOREBITSBIT) &&
+             (sbp->sb_features2 & ~XFS_SB_VERSION2_OKBITS)))
+                return false;
+
+        return true;
+}
+
+static inline bool xfs_sb_good_version(struct xfs_sb *sbp)
+{
+        if (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5)
+                return true;
+        if (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4)
+                return xfs_sb_good_v4_features(sbp);
+        return false;
+}
+
+/*
+ * Detect a mismatched features2 field.  Older kernels read/wrote
+ * this into the wrong slot, so to be safe we keep them in sync.
+ */
+static inline bool xfs_sb_has_mismatched_features2(struct xfs_sb *sbp)
+{
+        return sbp->sb_bad_features2 != sbp->sb_features2;
+}
+
+static inline bool xfs_sb_version_hasattr(struct xfs_sb *sbp)
+{
+        return (sbp->sb_versionnum & XFS_SB_VERSION_ATTRBIT);
+}
+
+static inline void xfs_sb_version_addattr(struct xfs_sb *sbp)
+{
+        sbp->sb_versionnum |= XFS_SB_VERSION_ATTRBIT;
+}
+
+static inline bool xfs_sb_version_hasquota(struct xfs_sb *sbp)
+{
+        return (sbp->sb_versionnum & XFS_SB_VERSION_QUOTABIT);
+}
+
+static inline void xfs_sb_version_addquota(struct xfs_sb *sbp)
+{
+        sbp->sb_versionnum |= XFS_SB_VERSION_QUOTABIT;
+}
+
+static inline bool xfs_sb_version_hasalign(struct xfs_sb *sbp)
+{
+        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
+                (sbp->sb_versionnum & XFS_SB_VERSION_ALIGNBIT));
+}
+
+static inline bool xfs_sb_version_hasdalign(struct xfs_sb *sbp)
+{
+        return (sbp->sb_versionnum & XFS_SB_VERSION_DALIGNBIT);
+}
+
+static inline bool xfs_sb_version_haslogv2(struct xfs_sb *sbp)
+{
+        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
+               (sbp->sb_versionnum & XFS_SB_VERSION_LOGV2BIT);
+}
+
+static inline bool xfs_sb_version_hasextflgbit(struct xfs_sb *sbp)
+{
+        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
+               (sbp->sb_versionnum & XFS_SB_VERSION_EXTFLGBIT);
+}
+
+static inline bool xfs_sb_version_hassector(struct xfs_sb *sbp)
+{
+        return (sbp->sb_versionnum & XFS_SB_VERSION_SECTORBIT);
+}
+
+static inline bool xfs_sb_version_hasasciici(struct xfs_sb *sbp)
+{
+        return (sbp->sb_versionnum & XFS_SB_VERSION_BORGBIT);
+}
+
+static inline bool xfs_sb_version_hasmorebits(struct xfs_sb *sbp)
+{
+        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
+               (sbp->sb_versionnum & XFS_SB_VERSION_MOREBITSBIT);
+}
+
+/*
+ * sb_features2 bit version macros.
+ */
+static inline bool xfs_sb_version_haslazysbcount(struct xfs_sb *sbp)
+{
+        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) ||
+               (xfs_sb_version_hasmorebits(sbp) &&
+                (sbp->sb_features2 & XFS_SB_VERSION2_LAZYSBCOUNTBIT));
+}
+
+static inline bool xfs_sb_version_hasattr2(struct xfs_sb *sbp)
+{
+        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) ||
+               (xfs_sb_version_hasmorebits(sbp) &&
+                (sbp->sb_features2 & XFS_SB_VERSION2_ATTR2BIT));
+}
+
+static inline void xfs_sb_version_addattr2(struct xfs_sb *sbp)
+{
+        sbp->sb_versionnum |= XFS_SB_VERSION_MOREBITSBIT;
+        sbp->sb_features2 |= XFS_SB_VERSION2_ATTR2BIT;
+        sbp->sb_bad_features2 |= XFS_SB_VERSION2_ATTR2BIT;
+}
+
+static inline void xfs_sb_version_removeattr2(struct xfs_sb *sbp)
+{
+        sbp->sb_features2 &= ~XFS_SB_VERSION2_ATTR2BIT;
+        sbp->sb_bad_features2 &= ~XFS_SB_VERSION2_ATTR2BIT;
+        if (!sbp->sb_features2)
+                sbp->sb_versionnum &= ~XFS_SB_VERSION_MOREBITSBIT;
+}
+
+static inline bool xfs_sb_version_hasprojid32bit(struct xfs_sb *sbp)
+{
+        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) ||
+               (xfs_sb_version_hasmorebits(sbp) &&
+                (sbp->sb_features2 & XFS_SB_VERSION2_PROJID32BIT));
+}
+
+static inline void xfs_sb_version_addprojid32bit(struct xfs_sb *sbp)
+{
+        sbp->sb_versionnum |= XFS_SB_VERSION_MOREBITSBIT;
+        sbp->sb_features2 |= XFS_SB_VERSION2_PROJID32BIT;
+        sbp->sb_bad_features2 |= XFS_SB_VERSION2_PROJID32BIT;
+}
+
+/*
+ * Extended v5 superblock feature masks. These are to be used for new v5
+ * superblock features only.
+ *
+ * Compat features are new features that old kernels will not notice or affect
+ * and so can mount read-write without issues.
+ *
+ * RO-Compat (read only) are features that old kernels can read but will break
+ * if they write. Hence only read-only mounts of such filesystems are allowed on
+ * kernels that don't support the feature bit.
+ *
+ * InCompat features are features which old kernels will not understand and so
+ * must not mount.
+ *
+ * Log-InCompat features are for changes to log formats or new transactions that
+ * can't be replayed on older kernels. The fields are set when the filesystem is
+ * mounted, and a clean unmount clears the fields.
+ */
+#define XFS_SB_FEAT_COMPAT_ALL 0
+#define XFS_SB_FEAT_COMPAT_UNKNOWN      ~XFS_SB_FEAT_COMPAT_ALL
+static inline bool
+xfs_sb_has_compat_feature(
+        struct xfs_sb   *sbp,
+        __uint32_t      feature)
+{
+        return (sbp->sb_features_compat & feature) != 0;
+}
+
+#define XFS_SB_FEAT_RO_COMPAT_FINOBT   (1 << 0)         /* free inode btree */
+#define XFS_SB_FEAT_RO_COMPAT_ALL \
+                (XFS_SB_FEAT_RO_COMPAT_FINOBT)
+#define XFS_SB_FEAT_RO_COMPAT_UNKNOWN   ~XFS_SB_FEAT_RO_COMPAT_ALL
+static inline bool
+xfs_sb_has_ro_compat_feature(
+        struct xfs_sb   *sbp,
+        __uint32_t      feature)
+{
+        return (sbp->sb_features_ro_compat & feature) != 0;
+}
+
+#define XFS_SB_FEAT_INCOMPAT_FTYPE      (1 << 0)        /* filetype in dirent */
+#define XFS_SB_FEAT_INCOMPAT_ALL \
+                (XFS_SB_FEAT_INCOMPAT_FTYPE)
+
+#define XFS_SB_FEAT_INCOMPAT_UNKNOWN    ~XFS_SB_FEAT_INCOMPAT_ALL
+static inline bool
+xfs_sb_has_incompat_feature(
+        struct xfs_sb   *sbp,
+        __uint32_t      feature)
+{
+        return (sbp->sb_features_incompat & feature) != 0;
+}
+
+#define XFS_SB_FEAT_INCOMPAT_LOG_ALL 0
+#define XFS_SB_FEAT_INCOMPAT_LOG_UNKNOWN        ~XFS_SB_FEAT_INCOMPAT_LOG_ALL
+static inline bool
+xfs_sb_has_incompat_log_feature(
+        struct xfs_sb   *sbp,
+        __uint32_t      feature)
+{
+        return (sbp->sb_features_log_incompat & feature) != 0;
+}
+
+/*
+ * V5 superblock specific feature checks
+ */
+static inline int xfs_sb_version_hascrc(struct xfs_sb *sbp)
+{
+        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5;
+}
+
+static inline int xfs_sb_version_has_pquotino(struct xfs_sb *sbp)
+{
+        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5;
+}
+
+static inline int xfs_sb_version_hasftype(struct xfs_sb *sbp)
+{
+        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 &&
+                xfs_sb_has_incompat_feature(sbp, XFS_SB_FEAT_INCOMPAT_FTYPE)) ||
+               (xfs_sb_version_hasmorebits(sbp) &&
+                 (sbp->sb_features2 & XFS_SB_VERSION2_FTYPE));
+}
+
+static inline int xfs_sb_version_hasfinobt(xfs_sb_t *sbp)
+{
+        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) &&
+                (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_FINOBT);
+}
+
+/*
+ * end of superblock version macros
+ */
+
+static inline bool
+xfs_is_quota_inode(struct xfs_sb *sbp, xfs_ino_t ino)
+{
+        return (ino == sbp->sb_uquotino ||
+                ino == sbp->sb_gquotino ||
+                ino == sbp->sb_pquotino);
+}
+
+#define XFS_SB_DADDR            ((xfs_daddr_t)0) /* daddr in filesystem/ag */
+#define XFS_SB_BLOCK(mp)        XFS_HDR_BLOCK(mp, XFS_SB_DADDR)
+#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)((bp)->b_addr))
+
+#define XFS_HDR_BLOCK(mp,d)     ((xfs_agblock_t)XFS_BB_TO_FSBT(mp,d))
+#define XFS_DADDR_TO_FSB(mp,d)  XFS_AGB_TO_FSB(mp, \
+                        xfs_daddr_to_agno(mp,d), xfs_daddr_to_agbno(mp,d))
+#define XFS_FSB_TO_DADDR(mp,fsbno)      XFS_AGB_TO_DADDR(mp, \
+                        XFS_FSB_TO_AGNO(mp,fsbno), XFS_FSB_TO_AGBNO(mp,fsbno))
+
+/*
+ * File system sector to basic block conversions.
+ */
+#define XFS_FSS_TO_BB(mp,sec)   ((sec) << (mp)->m_sectbb_log)
+
+/*
+ * File system block to basic block conversions.
+ */
+#define XFS_FSB_TO_BB(mp,fsbno) ((fsbno) << (mp)->m_blkbb_log)
+#define XFS_BB_TO_FSB(mp,bb)    \
+        (((bb) + (XFS_FSB_TO_BB(mp,1) - 1)) >> (mp)->m_blkbb_log)
+#define XFS_BB_TO_FSBT(mp,bb)   ((bb) >> (mp)->m_blkbb_log)
+
+/*
+ * File system block to byte conversions.
+ */
+#define XFS_FSB_TO_B(mp,fsbno)  ((xfs_fsize_t)(fsbno) << (mp)->m_sb.sb_blocklog)
+#define XFS_B_TO_FSB(mp,b)      \
+        ((((__uint64_t)(b)) + (mp)->m_blockmask) >> (mp)->m_sb.sb_blocklog)
+#define XFS_B_TO_FSBT(mp,b)     (((__uint64_t)(b)) >> (mp)->m_sb.sb_blocklog)
+#define XFS_B_FSB_OFFSET(mp,b)  ((b) & (mp)->m_blockmask)
+
+/*
+ * Allocation group header
+ *
+ * This is divided into three structures, placed in sequential 512-byte
+ * buffers after a copy of the superblock (also in a 512-byte buffer).
+ */
+#define XFS_AGF_MAGIC   0x58414746      /* 'XAGF' */
+#define XFS_AGI_MAGIC   0x58414749      /* 'XAGI' */
+#define XFS_AGFL_MAGIC  0x5841464c      /* 'XAFL' */
+#define XFS_AGF_VERSION 1
+#define XFS_AGI_VERSION 1
+
+#define XFS_AGF_GOOD_VERSION(v) ((v) == XFS_AGF_VERSION)
+#define XFS_AGI_GOOD_VERSION(v) ((v) == XFS_AGI_VERSION)
+
+/*
+ * Btree number 0 is bno, 1 is cnt.  This value gives the size of the
+ * arrays below.
+ */
+#define XFS_BTNUM_AGF   ((int)XFS_BTNUM_CNTi + 1)
+
+/*
+ * The second word of agf_levels in the first a.g. overlaps the EFS
+ * superblock's magic number.  Since the magic numbers valid for EFS
+ * are > 64k, our value cannot be confused for an EFS superblock's.
+ */
+
+typedef struct xfs_agf {
+        /*
+         * Common allocation group header information
+         */
+        __be32          agf_magicnum;   /* magic number == XFS_AGF_MAGIC */
+        __be32          agf_versionnum; /* header version == XFS_AGF_VERSION */
+        __be32          agf_seqno;      /* sequence # starting from 0 */
+        __be32          agf_length;     /* size in blocks of a.g. */
+        /*
+         * Freespace information
+         */
+        __be32          agf_roots[XFS_BTNUM_AGF];       /* root blocks */
+        __be32          agf_spare0;     /* spare field */
+        __be32          agf_levels[XFS_BTNUM_AGF];      /* btree levels */
+        __be32          agf_spare1;     /* spare field */
+
+        __be32          agf_flfirst;    /* first freelist block's index */
+        __be32          agf_fllast;     /* last freelist block's index */
+        __be32          agf_flcount;    /* count of blocks in freelist */
+        __be32          agf_freeblks;   /* total free blocks */
+
+        __be32          agf_longest;    /* longest free space */
+        __be32          agf_btreeblks;  /* # of blocks held in AGF btrees */
+        uuid_t          agf_uuid;       /* uuid of filesystem */
+
+        /*
+         * reserve some contiguous space for future logged fields before we add
+         * the unlogged fields. This makes the range logging via flags and
+         * structure offsets much simpler.
+         */
+        __be64          agf_spare64[16];
+
+        /* unlogged fields, written during buffer writeback. */
+        __be64          agf_lsn;        /* last write sequence */
+        __be32          agf_crc;        /* crc of agf sector */
+        __be32          agf_spare2;
+
+        /* structure must be padded to 64 bit alignment */
+} xfs_agf_t;
+
+#define XFS_AGF_CRC_OFF         offsetof(struct xfs_agf, agf_crc)
+
+#define XFS_AGF_MAGICNUM        0x00000001
+#define XFS_AGF_VERSIONNUM      0x00000002
+#define XFS_AGF_SEQNO           0x00000004
+#define XFS_AGF_LENGTH          0x00000008
+#define XFS_AGF_ROOTS           0x00000010
+#define XFS_AGF_LEVELS          0x00000020
+#define XFS_AGF_FLFIRST         0x00000040
+#define XFS_AGF_FLLAST          0x00000080
+#define XFS_AGF_FLCOUNT         0x00000100
+#define XFS_AGF_FREEBLKS        0x00000200
+#define XFS_AGF_LONGEST         0x00000400
+#define XFS_AGF_BTREEBLKS       0x00000800
+#define XFS_AGF_UUID            0x00001000
+#define XFS_AGF_NUM_BITS        13
+#define XFS_AGF_ALL_BITS        ((1 << XFS_AGF_NUM_BITS) - 1)
+
+#define XFS_AGF_FLAGS \
+        { XFS_AGF_MAGICNUM,     "MAGICNUM" }, \
+        { XFS_AGF_VERSIONNUM,   "VERSIONNUM" }, \
+        { XFS_AGF_SEQNO,        "SEQNO" }, \
+        { XFS_AGF_LENGTH,       "LENGTH" }, \
+        { XFS_AGF_ROOTS,        "ROOTS" }, \
+        { XFS_AGF_LEVELS,       "LEVELS" }, \
+        { XFS_AGF_FLFIRST,      "FLFIRST" }, \
+        { XFS_AGF_FLLAST,       "FLLAST" }, \
+        { XFS_AGF_FLCOUNT,      "FLCOUNT" }, \
+        { XFS_AGF_FREEBLKS,     "FREEBLKS" }, \
+        { XFS_AGF_LONGEST,      "LONGEST" }, \
+        { XFS_AGF_BTREEBLKS,    "BTREEBLKS" }, \
+        { XFS_AGF_UUID,         "UUID" }
+
+/* disk block (xfs_daddr_t) in the AG */
+#define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
+#define XFS_AGF_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGF_DADDR(mp))
+#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)((bp)->b_addr))
+
+/*
+ * Size of the unlinked inode hash table in the agi.
+ */
+#define XFS_AGI_UNLINKED_BUCKETS        64
+
+typedef struct xfs_agi {
+        /*
+         * Common allocation group header information
+         */
+        __be32          agi_magicnum;   /* magic number == XFS_AGI_MAGIC */
+        __be32          agi_versionnum; /* header version == XFS_AGI_VERSION */
+        __be32          agi_seqno;      /* sequence # starting from 0 */
+        __be32          agi_length;     /* size in blocks of a.g. */
+        /*
+         * Inode information
+         * Inodes are mapped by interpreting the inode number, so no
+         * mapping data is needed here.
+         */
+        __be32          agi_count;      /* count of allocated inodes */
+        __be32          agi_root;       /* root of inode btree */
+        __be32          agi_level;      /* levels in inode btree */
+        __be32          agi_freecount;  /* number of free inodes */
+
+        __be32          agi_newino;     /* new inode just allocated */
+        __be32          agi_dirino;     /* last directory inode chunk */
+        /*
+         * Hash table of inodes which have been unlinked but are
+         * still being referenced.
+         */
+        __be32          agi_unlinked[XFS_AGI_UNLINKED_BUCKETS];
+        /*
+         * This marks the end of logging region 1 and start of logging region 2.
+         */
+        uuid_t          agi_uuid;       /* uuid of filesystem */
+        __be32          agi_crc;        /* crc of agi sector */
+        __be32          agi_pad32;
+        __be64          agi_lsn;        /* last write sequence */
+
+        __be32          agi_free_root; /* root of the free inode btree */
+        __be32          agi_free_level;/* levels in free inode btree */
+
+        /* structure must be padded to 64 bit alignment */
+} xfs_agi_t;
+
+#define XFS_AGI_CRC_OFF         offsetof(struct xfs_agi, agi_crc)
+
+#define XFS_AGI_MAGICNUM        (1 << 0)
+#define XFS_AGI_VERSIONNUM      (1 << 1)
+#define XFS_AGI_SEQNO           (1 << 2)
+#define XFS_AGI_LENGTH          (1 << 3)
+#define XFS_AGI_COUNT           (1 << 4)
+#define XFS_AGI_ROOT            (1 << 5)
+#define XFS_AGI_LEVEL           (1 << 6)
+#define XFS_AGI_FREECOUNT       (1 << 7)
+#define XFS_AGI_NEWINO          (1 << 8)
+#define XFS_AGI_DIRINO          (1 << 9)
+#define XFS_AGI_UNLINKED        (1 << 10)
+#define XFS_AGI_NUM_BITS_R1     11      /* end of the 1st agi logging region */
+#define XFS_AGI_ALL_BITS_R1     ((1 << XFS_AGI_NUM_BITS_R1) - 1)
+#define XFS_AGI_FREE_ROOT       (1 << 11)
+#define XFS_AGI_FREE_LEVEL      (1 << 12)
+#define XFS_AGI_NUM_BITS_R2     13
+
+/* disk block (xfs_daddr_t) in the AG */
+#define XFS_AGI_DADDR(mp)       ((xfs_daddr_t)(2 << (mp)->m_sectbb_log))
+#define XFS_AGI_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGI_DADDR(mp))
+#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)((bp)->b_addr))
+
+/*
+ * The third a.g. block contains the a.g. freelist, an array
+ * of block pointers to blocks owned by the allocation btree code.
+ */
+#define XFS_AGFL_DADDR(mp)      ((xfs_daddr_t)(3 << (mp)->m_sectbb_log))
+#define XFS_AGFL_BLOCK(mp)      XFS_HDR_BLOCK(mp, XFS_AGFL_DADDR(mp))
+#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)((bp)->b_addr))
+
+#define XFS_BUF_TO_AGFL_BNO(mp, bp) \
+        (xfs_sb_version_hascrc(&((mp)->m_sb)) ? \
+                &(XFS_BUF_TO_AGFL(bp)->agfl_bno[0]) : \
+                (__be32 *)(bp)->b_addr)
+
+/*
+ * Size of the AGFL.  For CRC-enabled filesystes we steal a couple of
+ * slots in the beginning of the block for a proper header with the
+ * location information and CRC.
+ */
+#define XFS_AGFL_SIZE(mp) \
+        (((mp)->m_sb.sb_sectsize - \
+         (xfs_sb_version_hascrc(&((mp)->m_sb)) ? \
+                sizeof(struct xfs_agfl) : 0)) / \
+          sizeof(xfs_agblock_t))
+
+typedef struct xfs_agfl {
+        __be32          agfl_magicnum;
+        __be32          agfl_seqno;
+        uuid_t          agfl_uuid;
+        __be64          agfl_lsn;
+        __be32          agfl_crc;
+        __be32          agfl_bno[];     /* actually XFS_AGFL_SIZE(mp) */
+} xfs_agfl_t;
+
+#define XFS_AGFL_CRC_OFF        offsetof(struct xfs_agfl, agfl_crc)
+
+
+#define XFS_AG_MAXLEVELS(mp)            ((mp)->m_ag_maxlevels)
+#define XFS_MIN_FREELIST_RAW(bl,cl,mp)  \
+        (MIN(bl + 1, XFS_AG_MAXLEVELS(mp)) + MIN(cl + 1, XFS_AG_MAXLEVELS(mp)))
+#define XFS_MIN_FREELIST(a,mp)          \
+        (XFS_MIN_FREELIST_RAW(          \
+                be32_to_cpu((a)->agf_levels[XFS_BTNUM_BNOi]), \
+                be32_to_cpu((a)->agf_levels[XFS_BTNUM_CNTi]), mp))
+#define XFS_MIN_FREELIST_PAG(pag,mp)    \
+        (XFS_MIN_FREELIST_RAW(          \
+                (unsigned int)(pag)->pagf_levels[XFS_BTNUM_BNOi], \
+                (unsigned int)(pag)->pagf_levels[XFS_BTNUM_CNTi], mp))
+
+#define XFS_AGB_TO_FSB(mp,agno,agbno)   \
+        (((xfs_fsblock_t)(agno) << (mp)->m_sb.sb_agblklog) | (agbno))
+#define XFS_FSB_TO_AGNO(mp,fsbno)       \
+        ((xfs_agnumber_t)((fsbno) >> (mp)->m_sb.sb_agblklog))
+#define XFS_FSB_TO_AGBNO(mp,fsbno)      \
+        ((xfs_agblock_t)((fsbno) & xfs_mask32lo((mp)->m_sb.sb_agblklog)))
+#define XFS_AGB_TO_DADDR(mp,agno,agbno) \
+        ((xfs_daddr_t)XFS_FSB_TO_BB(mp, \
+                (xfs_fsblock_t)(agno) * (mp)->m_sb.sb_agblocks + (agbno)))
+#define XFS_AG_DADDR(mp,agno,d)         (XFS_AGB_TO_DADDR(mp, agno, 0) + (d))
+
+/*
+ * For checking for bad ranges of xfs_daddr_t's, covering multiple
+ * allocation groups or a single xfs_daddr_t that's a superblock copy.
+ */
+#define XFS_AG_CHECK_DADDR(mp,d,len)    \
+        ((len) == 1 ? \
+            ASSERT((d) == XFS_SB_DADDR || \
+                   xfs_daddr_to_agbno(mp, d) != XFS_SB_DADDR) : \
+            ASSERT(xfs_daddr_to_agno(mp, d) == \
+                   xfs_daddr_to_agno(mp, (d) + (len) - 1)))
+
+typedef struct xfs_timestamp {
+        __be32          t_sec;          /* timestamp seconds */
+        __be32          t_nsec;         /* timestamp nanoseconds */
+} xfs_timestamp_t;
+
+/*
+ * On-disk inode structure.
+ *
+ * This is just the header or "dinode core", the inode is expanded to fill a
+ * variable size the leftover area split into a data and an attribute fork.
+ * The format of the data and attribute fork depends on the format of the
+ * inode as indicated by di_format and di_aformat.  To access the data and
+ * attribute use the XFS_DFORK_DPTR, XFS_DFORK_APTR, and XFS_DFORK_PTR macros
+ * below.
+ *
+ * There is a very similar struct icdinode in xfs_inode which matches the
+ * layout of the first 96 bytes of this structure, but is kept in native
+ * format instead of big endian.
+ *
+ * Note: di_flushiter is only used by v1/2 inodes - it's effectively a zeroed
+ * padding field for v3 inodes.
+ */
+#define XFS_DINODE_MAGIC                0x494e  /* 'IN' */
+#define XFS_DINODE_GOOD_VERSION(v)      ((v) >= 1 && (v) <= 3)
+typedef struct xfs_dinode {
+        __be16          di_magic;       /* inode magic # = XFS_DINODE_MAGIC */
+        __be16          di_mode;        /* mode and type of file */
+        __u8            di_version;     /* inode version */
+        __u8            di_format;      /* format of di_c data */
+        __be16          di_onlink;      /* old number of links to file */
+        __be32          di_uid;         /* owner's user id */
+        __be32          di_gid;         /* owner's group id */
+        __be32          di_nlink;       /* number of links to file */
+        __be16          di_projid_lo;   /* lower part of owner's project id */
+        __be16          di_projid_hi;   /* higher part owner's project id */
+        __u8            di_pad[6];      /* unused, zeroed space */
+        __be16          di_flushiter;   /* incremented on flush */
+        xfs_timestamp_t di_atime;       /* time last accessed */
+        xfs_timestamp_t di_mtime;       /* time last modified */
+        xfs_timestamp_t di_ctime;       /* time created/inode modified */
+        __be64          di_size;        /* number of bytes in file */
+        __be64          di_nblocks;     /* # of direct & btree blocks used */
+        __be32          di_extsize;     /* basic/minimum extent size for file */
+        __be32          di_nextents;    /* number of extents in data fork */
+        __be16          di_anextents;   /* number of extents in attribute fork*/
+        __u8            di_forkoff;     /* attr fork offs, <<3 for 64b align */
+        __s8            di_aformat;     /* format of attr fork's data */
+        __be32          di_dmevmask;    /* DMIG event mask */
+        __be16          di_dmstate;     /* DMIG state info */
+        __be16          di_flags;       /* random flags, XFS_DIFLAG_... */
+        __be32          di_gen;         /* generation number */
+
+        /* di_next_unlinked is the only non-core field in the old dinode */
+        __be32          di_next_unlinked;/* agi unlinked list ptr */
+
+        /* start of the extended dinode, writable fields */
+        __le32          di_crc;         /* CRC of the inode */
+        __be64          di_changecount; /* number of attribute changes */
+        __be64          di_lsn;         /* flush sequence */
+        __be64          di_flags2;      /* more random flags */
+        __u8            di_pad2[16];    /* more padding for future expansion */
+
+        /* fields only written to during inode creation */
+        xfs_timestamp_t di_crtime;      /* time created */
+        __be64          di_ino;         /* inode number */
+        uuid_t          di_uuid;        /* UUID of the filesystem */
+
+        /* structure must be padded to 64 bit alignment */
+} xfs_dinode_t;
+
+#define XFS_DINODE_CRC_OFF      offsetof(struct xfs_dinode, di_crc)
+
+#define DI_MAX_FLUSH 0xffff
+
+/*
+ * Size of the core inode on disk.  Version 1 and 2 inodes have
+ * the same size, but version 3 has grown a few additional fields.
+ */
+static inline uint xfs_dinode_size(int version)
+{
+        if (version == 3)
+                return sizeof(struct xfs_dinode);
+        return offsetof(struct xfs_dinode, di_crc);
+}
+
+/*
+ * The 32 bit link count in the inode theoretically maxes out at UINT_MAX.
+ * Since the pathconf interface is signed, we use 2^31 - 1 instead.
+ * The old inode format had a 16 bit link count, so its maximum is USHRT_MAX.
+ */
+#define XFS_MAXLINK             ((1U << 31) - 1U)
+#define XFS_MAXLINK_1           65535U
+
+/*
+ * Values for di_format
+ */
+typedef enum xfs_dinode_fmt {
+        XFS_DINODE_FMT_DEV,             /* xfs_dev_t */
+        XFS_DINODE_FMT_LOCAL,           /* bulk data */
+        XFS_DINODE_FMT_EXTENTS,         /* struct xfs_bmbt_rec */
+        XFS_DINODE_FMT_BTREE,           /* struct xfs_bmdr_block */
+        XFS_DINODE_FMT_UUID             /* uuid_t */
+} xfs_dinode_fmt_t;
+
+/*
+ * Inode minimum and maximum sizes.
+ */
+#define XFS_DINODE_MIN_LOG      8
+#define XFS_DINODE_MAX_LOG      11
+#define XFS_DINODE_MIN_SIZE     (1 << XFS_DINODE_MIN_LOG)
+#define XFS_DINODE_MAX_SIZE     (1 << XFS_DINODE_MAX_LOG)
+
+/*
+ * Inode size for given fs.
+ */
+#define XFS_LITINO(mp, version) \
+        ((int)(((mp)->m_sb.sb_inodesize) - xfs_dinode_size(version)))
+
+/*
+ * Inode data & attribute fork sizes, per inode.
+ */
+#define XFS_DFORK_Q(dip)                ((dip)->di_forkoff != 0)
+#define XFS_DFORK_BOFF(dip)             ((int)((dip)->di_forkoff << 3))
+
+#define XFS_DFORK_DSIZE(dip,mp) \
+        (XFS_DFORK_Q(dip) ? \
+                XFS_DFORK_BOFF(dip) : \
+                XFS_LITINO(mp, (dip)->di_version))
+#define XFS_DFORK_ASIZE(dip,mp) \
+        (XFS_DFORK_Q(dip) ? \
+                XFS_LITINO(mp, (dip)->di_version) - XFS_DFORK_BOFF(dip) : \
+                0)
+#define XFS_DFORK_SIZE(dip,mp,w) \
+        ((w) == XFS_DATA_FORK ? \
+                XFS_DFORK_DSIZE(dip, mp) : \
+                XFS_DFORK_ASIZE(dip, mp))
+
+/*
+ * Return pointers to the data or attribute forks.
+ */
+#define XFS_DFORK_DPTR(dip) \
+        ((char *)dip + xfs_dinode_size(dip->di_version))
+#define XFS_DFORK_APTR(dip)     \
+        (XFS_DFORK_DPTR(dip) + XFS_DFORK_BOFF(dip))
+#define XFS_DFORK_PTR(dip,w)    \
+        ((w) == XFS_DATA_FORK ? XFS_DFORK_DPTR(dip) : XFS_DFORK_APTR(dip))
+
+#define XFS_DFORK_FORMAT(dip,w) \
+        ((w) == XFS_DATA_FORK ? \
+                (dip)->di_format : \
+                (dip)->di_aformat)
+#define XFS_DFORK_NEXTENTS(dip,w) \
+        ((w) == XFS_DATA_FORK ? \
+                be32_to_cpu((dip)->di_nextents) : \
+                be16_to_cpu((dip)->di_anextents))
+
+/*
+ * For block and character special files the 32bit dev_t is stored at the
+ * beginning of the data fork.
+ */
+static inline xfs_dev_t xfs_dinode_get_rdev(struct xfs_dinode *dip)
+{
+        return be32_to_cpu(*(__be32 *)XFS_DFORK_DPTR(dip));
+}
+
+static inline void xfs_dinode_put_rdev(struct xfs_dinode *dip, xfs_dev_t rdev)
+{
+        *(__be32 *)XFS_DFORK_DPTR(dip) = cpu_to_be32(rdev);
+}
+
+/*
+ * Values for di_flags
+ * There should be a one-to-one correspondence between these flags and the
+ * XFS_XFLAG_s.
+ */
+#define XFS_DIFLAG_REALTIME_BIT  0      /* file's blocks come from rt area */
+#define XFS_DIFLAG_PREALLOC_BIT  1      /* file space has been preallocated */
+#define XFS_DIFLAG_NEWRTBM_BIT   2      /* for rtbitmap inode, new format */
+#define XFS_DIFLAG_IMMUTABLE_BIT 3      /* inode is immutable */
+#define XFS_DIFLAG_APPEND_BIT    4      /* inode is append-only */
+#define XFS_DIFLAG_SYNC_BIT      5      /* inode is written synchronously */
+#define XFS_DIFLAG_NOATIME_BIT   6      /* do not update atime */
+#define XFS_DIFLAG_NODUMP_BIT    7      /* do not dump */
+#define XFS_DIFLAG_RTINHERIT_BIT 8      /* create with realtime bit set */
+#define XFS_DIFLAG_PROJINHERIT_BIT   9  /* create with parents projid */
+#define XFS_DIFLAG_NOSYMLINKS_BIT   10  /* disallow symlink creation */
+#define XFS_DIFLAG_EXTSIZE_BIT      11  /* inode extent size allocator hint */
+#define XFS_DIFLAG_EXTSZINHERIT_BIT 12  /* inherit inode extent size */
+#define XFS_DIFLAG_NODEFRAG_BIT     13  /* do not reorganize/defragment */
+#define XFS_DIFLAG_FILESTREAM_BIT   14  /* use filestream allocator */
+#define XFS_DIFLAG_REALTIME      (1 << XFS_DIFLAG_REALTIME_BIT)
+#define XFS_DIFLAG_PREALLOC      (1 << XFS_DIFLAG_PREALLOC_BIT)
+#define XFS_DIFLAG_NEWRTBM       (1 << XFS_DIFLAG_NEWRTBM_BIT)
+#define XFS_DIFLAG_IMMUTABLE     (1 << XFS_DIFLAG_IMMUTABLE_BIT)
+#define XFS_DIFLAG_APPEND        (1 << XFS_DIFLAG_APPEND_BIT)
+#define XFS_DIFLAG_SYNC          (1 << XFS_DIFLAG_SYNC_BIT)
+#define XFS_DIFLAG_NOATIME       (1 << XFS_DIFLAG_NOATIME_BIT)
+#define XFS_DIFLAG_NODUMP        (1 << XFS_DIFLAG_NODUMP_BIT)
+#define XFS_DIFLAG_RTINHERIT     (1 << XFS_DIFLAG_RTINHERIT_BIT)
+#define XFS_DIFLAG_PROJINHERIT   (1 << XFS_DIFLAG_PROJINHERIT_BIT)
+#define XFS_DIFLAG_NOSYMLINKS    (1 << XFS_DIFLAG_NOSYMLINKS_BIT)
+#define XFS_DIFLAG_EXTSIZE       (1 << XFS_DIFLAG_EXTSIZE_BIT)
+#define XFS_DIFLAG_EXTSZINHERIT  (1 << XFS_DIFLAG_EXTSZINHERIT_BIT)
+#define XFS_DIFLAG_NODEFRAG      (1 << XFS_DIFLAG_NODEFRAG_BIT)
+#define XFS_DIFLAG_FILESTREAM    (1 << XFS_DIFLAG_FILESTREAM_BIT)
+
+#define XFS_DIFLAG_ANY \
+        (XFS_DIFLAG_REALTIME | XFS_DIFLAG_PREALLOC | XFS_DIFLAG_NEWRTBM | \
+         XFS_DIFLAG_IMMUTABLE | XFS_DIFLAG_APPEND | XFS_DIFLAG_SYNC | \
+         XFS_DIFLAG_NOATIME | XFS_DIFLAG_NODUMP | XFS_DIFLAG_RTINHERIT | \
+         XFS_DIFLAG_PROJINHERIT | XFS_DIFLAG_NOSYMLINKS | XFS_DIFLAG_EXTSIZE | \
+         XFS_DIFLAG_EXTSZINHERIT | XFS_DIFLAG_NODEFRAG | XFS_DIFLAG_FILESTREAM)
+
+/*
+ * Inode number format:
+ * low inopblog bits - offset in block
+ * next agblklog bits - block number in ag
+ * next agno_log bits - ag number
+ * high agno_log-agblklog-inopblog bits - 0
+ */
+#define XFS_INO_MASK(k)                 (__uint32_t)((1ULL << (k)) - 1)
+#define XFS_INO_OFFSET_BITS(mp)         (mp)->m_sb.sb_inopblog
+#define XFS_INO_AGBNO_BITS(mp)          (mp)->m_sb.sb_agblklog
+#define XFS_INO_AGINO_BITS(mp)          (mp)->m_agino_log
+#define XFS_INO_AGNO_BITS(mp)           (mp)->m_agno_log
+#define XFS_INO_BITS(mp)                \
+        XFS_INO_AGNO_BITS(mp) + XFS_INO_AGINO_BITS(mp)
+#define XFS_INO_TO_AGNO(mp,i)           \
+        ((xfs_agnumber_t)((i) >> XFS_INO_AGINO_BITS(mp)))
+#define XFS_INO_TO_AGINO(mp,i)          \
+        ((xfs_agino_t)(i) & XFS_INO_MASK(XFS_INO_AGINO_BITS(mp)))
+#define XFS_INO_TO_AGBNO(mp,i)          \
+        (((xfs_agblock_t)(i) >> XFS_INO_OFFSET_BITS(mp)) & \
+                XFS_INO_MASK(XFS_INO_AGBNO_BITS(mp)))
+#define XFS_INO_TO_OFFSET(mp,i)         \
+        ((int)(i) & XFS_INO_MASK(XFS_INO_OFFSET_BITS(mp)))
+#define XFS_INO_TO_FSB(mp,i)            \
+        XFS_AGB_TO_FSB(mp, XFS_INO_TO_AGNO(mp,i), XFS_INO_TO_AGBNO(mp,i))
+#define XFS_AGINO_TO_INO(mp,a,i)        \
+        (((xfs_ino_t)(a) << XFS_INO_AGINO_BITS(mp)) | (i))
+#define XFS_AGINO_TO_AGBNO(mp,i)        ((i) >> XFS_INO_OFFSET_BITS(mp))
+#define XFS_AGINO_TO_OFFSET(mp,i)       \
+        ((i) & XFS_INO_MASK(XFS_INO_OFFSET_BITS(mp)))
+#define XFS_OFFBNO_TO_AGINO(mp,b,o)     \
+        ((xfs_agino_t)(((b) << XFS_INO_OFFSET_BITS(mp)) | (o)))
+
+#define XFS_MAXINUMBER          ((xfs_ino_t)((1ULL << 56) - 1ULL))
+#define XFS_MAXINUMBER_32       ((xfs_ino_t)((1ULL << 32) - 1ULL))
+
+/*
  * RealTime Device format definitions
  */
 
@@ -413,4 +1484,40 @@ struct xfs_btree_block {
 #define XFS_BTREE_LBLOCK_CRC_OFF \
         offsetof(struct xfs_btree_block, bb_u.l.bb_crc)
 
+/*
+ * On-disk XFS access control list structure.
+ */
+struct xfs_acl_entry {
+        __be32  ae_tag;
+        __be32  ae_id;
+        __be16  ae_perm;
+        __be16  ae_pad;         /* fill the implicit hole in the structure */
+};
+
+struct xfs_acl {
+        __be32                  acl_cnt;
+        struct xfs_acl_entry    acl_entry[0];
+};
+
+/*
+ * The number of ACL entries allowed is defined by the on-disk format.
+ * For v4 superblocks, that is limited to 25 entries. For v5 superblocks, it is
+ * limited only by the maximum size of the xattr that stores the information.
+ */
+#define XFS_ACL_MAX_ENTRIES(mp) \
+        (xfs_sb_version_hascrc(&mp->m_sb) \
+                ?  (XATTR_SIZE_MAX - sizeof(struct xfs_acl)) / \
+                                                sizeof(struct xfs_acl_entry) \
+                : 25)
+
+#define XFS_ACL_MAX_SIZE(mp) \
+        (sizeof(struct xfs_acl) + \
+                sizeof(struct xfs_acl_entry) * XFS_ACL_MAX_ENTRIES((mp)))
+
+/* On-disk XFS extended attribute names */
+#define SGI_ACL_FILE            (unsigned char *)"SGI_ACL_FILE"
+#define SGI_ACL_DEFAULT         (unsigned char *)"SGI_ACL_DEFAULT"
+#define SGI_ACL_FILE_SIZE       (sizeof(SGI_ACL_FILE)-1)
+#define SGI_ACL_DEFAULT_SIZE    (sizeof(SGI_ACL_DEFAULT)-1)
+
 #endif /* __XFS_FORMAT_H__ */
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index 23dcb72fc5e6..116ef1ddb3e3 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -22,9 +22,7 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
@@ -39,7 +37,6 @@
 #include "xfs_buf_item.h"
 #include "xfs_icreate_item.h"
 #include "xfs_icache.h"
-#include "xfs_dinode.h"
 #include "xfs_trace.h"
 
 
@@ -48,12 +45,12 @@
  */
 static inline int
 xfs_ialloc_cluster_alignment(
-        xfs_alloc_arg_t *args)
+        struct xfs_mount        *mp)
 {
-        if (xfs_sb_version_hasalign(&args->mp->m_sb) &&
-            args->mp->m_sb.sb_inoalignmt >=
-             XFS_B_TO_FSBT(args->mp, args->mp->m_inode_cluster_size))
-                return args->mp->m_sb.sb_inoalignmt;
+        if (xfs_sb_version_hasalign(&mp->m_sb) &&
+            mp->m_sb.sb_inoalignmt >=
+                        XFS_B_TO_FSBT(mp, mp->m_inode_cluster_size))
+                return mp->m_sb.sb_inoalignmt;
         return 1;
 }
 
@@ -412,7 +409,7 @@ xfs_ialloc_ag_alloc(
                  * but not to use them in the actual exact allocation.
                  */
                 args.alignment = 1;
-                args.minalignslop = xfs_ialloc_cluster_alignment(&args) - 1;
+                args.minalignslop = xfs_ialloc_cluster_alignment(args.mp) - 1;
 
                 /* Allow space for the inode btree to split. */
                 args.minleft = args.mp->m_in_maxlevels - 1;
@@ -448,7 +445,7 @@ xfs_ialloc_ag_alloc(
                         args.alignment = args.mp->m_dalign;
                         isaligned = 1;
                 } else
-                        args.alignment = xfs_ialloc_cluster_alignment(&args);
+                        args.alignment = xfs_ialloc_cluster_alignment(args.mp);
                 /*
                  * Need to figure out where to allocate the inode blocks.
                  * Ideally they should be spaced out through the a.g.
@@ -477,7 +474,7 @@ xfs_ialloc_ag_alloc(
                 args.type = XFS_ALLOCTYPE_NEAR_BNO;
                 args.agbno = be32_to_cpu(agi->agi_root);
                 args.fsbno = XFS_AGB_TO_FSB(args.mp, agno, args.agbno);
-                args.alignment = xfs_ialloc_cluster_alignment(&args);
+                args.alignment = xfs_ialloc_cluster_alignment(args.mp);
                 if ((error = xfs_alloc_vextent(&args)))
                         return error;
         }
@@ -632,10 +629,24 @@ xfs_ialloc_ag_select(
                 }
 
                 /*
-                 * Is there enough free space for the file plus a block of
-                 * inodes? (if we need to allocate some)?
+                 * Check that there is enough free space for the file plus a
+                 * chunk of inodes if we need to allocate some. If this is the
+                 * first pass across the AGs, take into account the potential
+                 * space needed for alignment of inode chunks when checking the
+                 * longest contiguous free space in the AG - this prevents us
+                 * from getting ENOSPC because we have free space larger than
+                 * m_ialloc_blks but alignment constraints prevent us from using
+                 * it.
+                 *
+                 * If we can't find an AG with space for full alignment slack to
+                 * be taken into account, we must be near ENOSPC in all AGs.
+                 * Hence we don't include alignment for the second pass and so
+                 * if we fail allocation due to alignment issues then it is most
+                 * likely a real ENOSPC condition.
                  */
                 ineed = mp->m_ialloc_blks;
+                if (flags && ineed > 1)
+                        ineed += xfs_ialloc_cluster_alignment(mp);
                 longest = pag->pagf_longest;
                 if (!longest)
                         longest = pag->pagf_flcount > 0;
@@ -1137,11 +1148,7 @@ xfs_dialloc_ag_update_inobt(
         XFS_WANT_CORRUPTED_RETURN((rec.ir_free == frec->ir_free) &&
                                   (rec.ir_freecount == frec->ir_freecount));
 
-        error = xfs_inobt_update(cur, &rec);
-        if (error)
-                return error;
-
-        return 0;
+        return xfs_inobt_update(cur, &rec);
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_ialloc.h b/fs/xfs/libxfs/xfs_ialloc.h
index 95ad1c002d60..100007d56449 100644
--- a/fs/xfs/libxfs/xfs_ialloc.h
+++ b/fs/xfs/libxfs/xfs_ialloc.h
@@ -160,4 +160,8 @@ int xfs_ialloc_inode_init(struct xfs_mount *mp, struct xfs_trans *tp,
                           xfs_agnumber_t agno, xfs_agblock_t agbno,
                           xfs_agblock_t length, unsigned int gen);
 
+int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
+                xfs_agnumber_t agno, struct xfs_buf **bpp);
+
+
 #endif  /* __XFS_IALLOC_H__ */
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index c9b06f30fe86..964c465ca69c 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index f18fd2da49f7..002b6b3a1988 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_error.h"
@@ -30,7 +28,6 @@
 #include "xfs_icache.h"
 #include "xfs_trans.h"
 #include "xfs_ialloc.h"
-#include "xfs_dinode.h"
 
 /*
  * Check that none of the inode's in the buffer have a next
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 6a00f7fed69d..0defbd02f62d 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -22,9 +22,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_inum.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
@@ -34,7 +31,6 @@
 #include "xfs_error.h"
 #include "xfs_trace.h"
 #include "xfs_attr_sf.h"
-#include "xfs_dinode.h"
 
 kmem_zone_t *xfs_ifork_zone;
 
diff --git a/fs/xfs/libxfs/xfs_inum.h b/fs/xfs/libxfs/xfs_inum.h
deleted file mode 100644
index 4ff2278e147a..000000000000
--- a/fs/xfs/libxfs/xfs_inum.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (c) 2000-2003,2005 Silicon Graphics, Inc.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-#ifndef __XFS_INUM_H__
-#define __XFS_INUM_H__
-
-/*
- * Inode number format:
- * low inopblog bits - offset in block
- * next agblklog bits - block number in ag
- * next agno_log bits - ag number
- * high agno_log-agblklog-inopblog bits - 0
- */
-
-struct xfs_mount;
-
-#define XFS_INO_MASK(k)                 (__uint32_t)((1ULL << (k)) - 1)
-#define XFS_INO_OFFSET_BITS(mp)         (mp)->m_sb.sb_inopblog
-#define XFS_INO_AGBNO_BITS(mp)          (mp)->m_sb.sb_agblklog
-#define XFS_INO_AGINO_BITS(mp)          (mp)->m_agino_log
-#define XFS_INO_AGNO_BITS(mp)           (mp)->m_agno_log
-#define XFS_INO_BITS(mp)                \
-        XFS_INO_AGNO_BITS(mp) + XFS_INO_AGINO_BITS(mp)
-#define XFS_INO_TO_AGNO(mp,i)           \
-        ((xfs_agnumber_t)((i) >> XFS_INO_AGINO_BITS(mp)))
-#define XFS_INO_TO_AGINO(mp,i)          \
-        ((xfs_agino_t)(i) & XFS_INO_MASK(XFS_INO_AGINO_BITS(mp)))
-#define XFS_INO_TO_AGBNO(mp,i)          \
-        (((xfs_agblock_t)(i) >> XFS_INO_OFFSET_BITS(mp)) & \
-                XFS_INO_MASK(XFS_INO_AGBNO_BITS(mp)))
-#define XFS_INO_TO_OFFSET(mp,i)         \
-        ((int)(i) & XFS_INO_MASK(XFS_INO_OFFSET_BITS(mp)))
-#define XFS_INO_TO_FSB(mp,i)            \
-        XFS_AGB_TO_FSB(mp, XFS_INO_TO_AGNO(mp,i), XFS_INO_TO_AGBNO(mp,i))
-#define XFS_AGINO_TO_INO(mp,a,i)        \
-        (((xfs_ino_t)(a) << XFS_INO_AGINO_BITS(mp)) | (i))
-#define XFS_AGINO_TO_AGBNO(mp,i)        ((i) >> XFS_INO_OFFSET_BITS(mp))
-#define XFS_AGINO_TO_OFFSET(mp,i)       \
-        ((i) & XFS_INO_MASK(XFS_INO_OFFSET_BITS(mp)))
-#define XFS_OFFBNO_TO_AGINO(mp,b,o)     \
-        ((xfs_agino_t)(((b) << XFS_INO_OFFSET_BITS(mp)) | (o)))
-
-#define XFS_MAXINUMBER          ((xfs_ino_t)((1ULL << 56) - 1ULL))
-#define XFS_MAXINUMBER_32       ((xfs_ino_t)((1ULL << 32) - 1ULL))
-
-#endif  /* __XFS_INUM_H__ */
diff --git a/fs/xfs/libxfs/xfs_log_format.h b/fs/xfs/libxfs/xfs_log_format.h
index aff12f2d4428..265314690415 100644
--- a/fs/xfs/libxfs/xfs_log_format.h
+++ b/fs/xfs/libxfs/xfs_log_format.h
@@ -361,7 +361,7 @@ typedef struct xfs_ictimestamp {
 
 /*
  * NOTE:  This structure must be kept identical to struct xfs_dinode
- *        in xfs_dinode.h except for the endianness annotations.
+ *        except for the endianness annotations.
  */
 typedef struct xfs_icdinode {
         __uint16_t      di_magic;       /* inode magic # = XFS_DINODE_MAGIC */
diff --git a/fs/xfs/libxfs/xfs_log_rlimit.c b/fs/xfs/libxfs/xfs_log_rlimit.c
index ee7e0e80246b..c10597973333 100644
--- a/fs/xfs/libxfs/xfs_log_rlimit.c
+++ b/fs/xfs/libxfs/xfs_log_rlimit.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_ag.h"
-#include "xfs_sb.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_trans_space.h"
diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c
index 7c818f1e4484..9b59ffa1fc19 100644
--- a/fs/xfs/libxfs/xfs_rtbitmap.c
+++ b/fs/xfs/libxfs/xfs_rtbitmap.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_bmap.h"
@@ -36,7 +34,6 @@
 #include "xfs_trace.h"
 #include "xfs_buf.h"
 #include "xfs_icache.h"
-#include "xfs_dinode.h"
 #include "xfs_rtalloc.h"
 
 
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index 5f902fa7913f..752915fa775a 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -23,7 +23,6 @@
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_ialloc.h"
@@ -33,7 +32,6 @@
 #include "xfs_cksum.h"
 #include "xfs_trans.h"
 #include "xfs_buf_item.h"
-#include "xfs_dinode.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_alloc_btree.h"
 #include "xfs_ialloc_btree.h"
diff --git a/fs/xfs/libxfs/xfs_sb.h b/fs/xfs/libxfs/xfs_sb.h
index 2e739708afd3..8eb1c54bafbf 100644
--- a/fs/xfs/libxfs/xfs_sb.h
+++ b/fs/xfs/libxfs/xfs_sb.h
@@ -19,590 +19,6 @@
 #define __XFS_SB_H__
 
 /*
- * Super block
- * Fits into a sector-sized buffer at address 0 of each allocation group.
- * Only the first of these is ever updated except during growfs.
- */
-
-struct xfs_buf;
-struct xfs_mount;
-struct xfs_trans;
-
-#define XFS_SB_MAGIC            0x58465342      /* 'XFSB' */
-#define XFS_SB_VERSION_1        1               /* 5.3, 6.0.1, 6.1 */
-#define XFS_SB_VERSION_2        2               /* 6.2 - attributes */
-#define XFS_SB_VERSION_3        3               /* 6.2 - new inode version */
-#define XFS_SB_VERSION_4        4               /* 6.2+ - bitmask version */
-#define XFS_SB_VERSION_5        5               /* CRC enabled filesystem */
-#define XFS_SB_VERSION_NUMBITS          0x000f
-#define XFS_SB_VERSION_ALLFBITS         0xfff0
-#define XFS_SB_VERSION_ATTRBIT          0x0010
-#define XFS_SB_VERSION_NLINKBIT         0x0020
-#define XFS_SB_VERSION_QUOTABIT         0x0040
-#define XFS_SB_VERSION_ALIGNBIT         0x0080
-#define XFS_SB_VERSION_DALIGNBIT        0x0100
-#define XFS_SB_VERSION_SHAREDBIT        0x0200
-#define XFS_SB_VERSION_LOGV2BIT         0x0400
-#define XFS_SB_VERSION_SECTORBIT        0x0800
-#define XFS_SB_VERSION_EXTFLGBIT        0x1000
-#define XFS_SB_VERSION_DIRV2BIT         0x2000
-#define XFS_SB_VERSION_BORGBIT          0x4000  /* ASCII only case-insens. */
-#define XFS_SB_VERSION_MOREBITSBIT      0x8000
-
-/*
- * Supported feature bit list is just all bits in the versionnum field because
- * we've used them all up and understand them all. Except, of course, for the
- * shared superblock bit, which nobody knows what it does and so is unsupported.
- */
-#define XFS_SB_VERSION_OKBITS           \
-        ((XFS_SB_VERSION_NUMBITS | XFS_SB_VERSION_ALLFBITS) & \
-                ~XFS_SB_VERSION_SHAREDBIT)
-
-/*
- * There are two words to hold XFS "feature" bits: the original
- * word, sb_versionnum, and sb_features2.  Whenever a bit is set in
- * sb_features2, the feature bit XFS_SB_VERSION_MOREBITSBIT must be set.
- *
- * These defines represent bits in sb_features2.
- */
-#define XFS_SB_VERSION2_RESERVED1BIT    0x00000001
-#define XFS_SB_VERSION2_LAZYSBCOUNTBIT  0x00000002      /* Superblk counters */
-#define XFS_SB_VERSION2_RESERVED4BIT    0x00000004
-#define XFS_SB_VERSION2_ATTR2BIT        0x00000008      /* Inline attr rework */
-#define XFS_SB_VERSION2_PARENTBIT       0x00000010      /* parent pointers */
-#define XFS_SB_VERSION2_PROJID32BIT     0x00000080      /* 32 bit project id */
-#define XFS_SB_VERSION2_CRCBIT          0x00000100      /* metadata CRCs */
-#define XFS_SB_VERSION2_FTYPE           0x00000200      /* inode type in dir */
-
-#define XFS_SB_VERSION2_OKBITS          \
-        (XFS_SB_VERSION2_LAZYSBCOUNTBIT | \
-         XFS_SB_VERSION2_ATTR2BIT       | \
-         XFS_SB_VERSION2_PROJID32BIT    | \
-         XFS_SB_VERSION2_FTYPE)
-
-/*
- * Superblock - in core version.  Must match the ondisk version below.
- * Must be padded to 64 bit alignment.
- */
-typedef struct xfs_sb {
-        __uint32_t      sb_magicnum;    /* magic number == XFS_SB_MAGIC */
-        __uint32_t      sb_blocksize;   /* logical block size, bytes */
-        xfs_rfsblock_t  sb_dblocks;     /* number of data blocks */
-        xfs_rfsblock_t  sb_rblocks;     /* number of realtime blocks */
-        xfs_rtblock_t   sb_rextents;    /* number of realtime extents */
-        uuid_t          sb_uuid;        /* file system unique id */
-        xfs_fsblock_t   sb_logstart;    /* starting block of log if internal */
-        xfs_ino_t       sb_rootino;     /* root inode number */
-        xfs_ino_t       sb_rbmino;      /* bitmap inode for realtime extents */
-        xfs_ino_t       sb_rsumino;     /* summary inode for rt bitmap */
-        xfs_agblock_t   sb_rextsize;    /* realtime extent size, blocks */
-        xfs_agblock_t   sb_agblocks;    /* size of an allocation group */
-        xfs_agnumber_t  sb_agcount;     /* number of allocation groups */
-        xfs_extlen_t    sb_rbmblocks;   /* number of rt bitmap blocks */
-        xfs_extlen_t    sb_logblocks;   /* number of log blocks */
-        __uint16_t      sb_versionnum;  /* header version == XFS_SB_VERSION */
-        __uint16_t      sb_sectsize;    /* volume sector size, bytes */
-        __uint16_t      sb_inodesize;   /* inode size, bytes */
-        __uint16_t      sb_inopblock;   /* inodes per block */
-        char            sb_fname[12];   /* file system name */
-        __uint8_t       sb_blocklog;    /* log2 of sb_blocksize */
-        __uint8_t       sb_sectlog;     /* log2 of sb_sectsize */
-        __uint8_t       sb_inodelog;    /* log2 of sb_inodesize */
-        __uint8_t       sb_inopblog;    /* log2 of sb_inopblock */
-        __uint8_t       sb_agblklog;    /* log2 of sb_agblocks (rounded up) */
-        __uint8_t       sb_rextslog;    /* log2 of sb_rextents */
-        __uint8_t       sb_inprogress;  /* mkfs is in progress, don't mount */
-        __uint8_t       sb_imax_pct;    /* max % of fs for inode space */
-                                        /* statistics */
-        /*
-         * These fields must remain contiguous.  If you really
-         * want to change their layout, make sure you fix the
-         * code in xfs_trans_apply_sb_deltas().
-         */
-        __uint64_t      sb_icount;      /* allocated inodes */
-        __uint64_t      sb_ifree;       /* free inodes */
-        __uint64_t      sb_fdblocks;    /* free data blocks */
-        __uint64_t      sb_frextents;   /* free realtime extents */
-        /*
-         * End contiguous fields.
-         */
-        xfs_ino_t       sb_uquotino;    /* user quota inode */
-        xfs_ino_t       sb_gquotino;    /* group quota inode */
-        __uint16_t      sb_qflags;      /* quota flags */
-        __uint8_t       sb_flags;       /* misc. flags */
-        __uint8_t       sb_shared_vn;   /* shared version number */
-        xfs_extlen_t    sb_inoalignmt;  /* inode chunk alignment, fsblocks */
-        __uint32_t      sb_unit;        /* stripe or raid unit */
-        __uint32_t      sb_width;       /* stripe or raid width */
-        __uint8_t       sb_dirblklog;   /* log2 of dir block size (fsbs) */
-        __uint8_t       sb_logsectlog;  /* log2 of the log sector size */
-        __uint16_t      sb_logsectsize; /* sector size for the log, bytes */
-        __uint32_t      sb_logsunit;    /* stripe unit size for the log */
-        __uint32_t      sb_features2;   /* additional feature bits */
-
-        /*
-         * bad features2 field as a result of failing to pad the sb
-         * structure to 64 bits. Some machines will be using this field
-         * for features2 bits. Easiest just to mark it bad and not use
-         * it for anything else.
-         */
-        __uint32_t      sb_bad_features2;
-
-        /* version 5 superblock fields start here */
-
-        /* feature masks */
-        __uint32_t      sb_features_compat;
-        __uint32_t      sb_features_ro_compat;
-        __uint32_t      sb_features_incompat;
-        __uint32_t      sb_features_log_incompat;
-
-        __uint32_t      sb_crc;         /* superblock crc */
-        __uint32_t      sb_pad;
-
-        xfs_ino_t       sb_pquotino;    /* project quota inode */
-        xfs_lsn_t       sb_lsn;         /* last write sequence */
-
-        /* must be padded to 64 bit alignment */
-} xfs_sb_t;
-
-#define XFS_SB_CRC_OFF          offsetof(struct xfs_sb, sb_crc)
-
-/*
- * Superblock - on disk version.  Must match the in core version above.
- * Must be padded to 64 bit alignment.
- */
-typedef struct xfs_dsb {
-        __be32          sb_magicnum;    /* magic number == XFS_SB_MAGIC */
-        __be32          sb_blocksize;   /* logical block size, bytes */
-        __be64          sb_dblocks;     /* number of data blocks */
-        __be64          sb_rblocks;     /* number of realtime blocks */
-        __be64          sb_rextents;    /* number of realtime extents */
-        uuid_t          sb_uuid;        /* file system unique id */
-        __be64          sb_logstart;    /* starting block of log if internal */
-        __be64          sb_rootino;     /* root inode number */
-        __be64          sb_rbmino;      /* bitmap inode for realtime extents */
-        __be64          sb_rsumino;     /* summary inode for rt bitmap */
-        __be32          sb_rextsize;    /* realtime extent size, blocks */
-        __be32          sb_agblocks;    /* size of an allocation group */
-        __be32          sb_agcount;     /* number of allocation groups */
-        __be32          sb_rbmblocks;   /* number of rt bitmap blocks */
-        __be32          sb_logblocks;   /* number of log blocks */
-        __be16          sb_versionnum;  /* header version == XFS_SB_VERSION */
-        __be16          sb_sectsize;    /* volume sector size, bytes */
-        __be16          sb_inodesize;   /* inode size, bytes */
-        __be16          sb_inopblock;   /* inodes per block */
-        char            sb_fname[12];   /* file system name */
-        __u8            sb_blocklog;    /* log2 of sb_blocksize */
-        __u8            sb_sectlog;     /* log2 of sb_sectsize */
-        __u8            sb_inodelog;    /* log2 of sb_inodesize */
-        __u8            sb_inopblog;    /* log2 of sb_inopblock */
-        __u8            sb_agblklog;    /* log2 of sb_agblocks (rounded up) */
-        __u8            sb_rextslog;    /* log2 of sb_rextents */
-        __u8            sb_inprogress;  /* mkfs is in progress, don't mount */
-        __u8            sb_imax_pct;    /* max % of fs for inode space */
-                                        /* statistics */
-        /*
-         * These fields must remain contiguous.  If you really
-         * want to change their layout, make sure you fix the
-         * code in xfs_trans_apply_sb_deltas().
-         */
-        __be64          sb_icount;      /* allocated inodes */
-        __be64          sb_ifree;       /* free inodes */
-        __be64          sb_fdblocks;    /* free data blocks */
-        __be64          sb_frextents;   /* free realtime extents */
-        /*
-         * End contiguous fields.
-         */
-        __be64          sb_uquotino;    /* user quota inode */
-        __be64          sb_gquotino;    /* group quota inode */
-        __be16          sb_qflags;      /* quota flags */
-        __u8            sb_flags;       /* misc. flags */
-        __u8            sb_shared_vn;   /* shared version number */
-        __be32          sb_inoalignmt;  /* inode chunk alignment, fsblocks */
-        __be32          sb_unit;        /* stripe or raid unit */
-        __be32          sb_width;       /* stripe or raid width */
-        __u8            sb_dirblklog;   /* log2 of dir block size (fsbs) */
-        __u8            sb_logsectlog;  /* log2 of the log sector size */
-        __be16          sb_logsectsize; /* sector size for the log, bytes */
-        __be32          sb_logsunit;    /* stripe unit size for the log */
-        __be32          sb_features2;   /* additional feature bits */
-        /*
-         * bad features2 field as a result of failing to pad the sb
-         * structure to 64 bits. Some machines will be using this field
-         * for features2 bits. Easiest just to mark it bad and not use
-         * it for anything else.
-         */
-        __be32          sb_bad_features2;
-
-        /* version 5 superblock fields start here */
-
-        /* feature masks */
-        __be32          sb_features_compat;
-        __be32          sb_features_ro_compat;
-        __be32          sb_features_incompat;
-        __be32          sb_features_log_incompat;
-
-        __le32          sb_crc;         /* superblock crc */
-        __be32          sb_pad;
-
-        __be64          sb_pquotino;    /* project quota inode */
-        __be64          sb_lsn;         /* last write sequence */
-
-        /* must be padded to 64 bit alignment */
-} xfs_dsb_t;
-
-/*
- * Sequence number values for the fields.
- */
-typedef enum {
-        XFS_SBS_MAGICNUM, XFS_SBS_BLOCKSIZE, XFS_SBS_DBLOCKS, XFS_SBS_RBLOCKS,
-        XFS_SBS_REXTENTS, XFS_SBS_UUID, XFS_SBS_LOGSTART, XFS_SBS_ROOTINO,
-        XFS_SBS_RBMINO, XFS_SBS_RSUMINO, XFS_SBS_REXTSIZE, XFS_SBS_AGBLOCKS,
-        XFS_SBS_AGCOUNT, XFS_SBS_RBMBLOCKS, XFS_SBS_LOGBLOCKS,
-        XFS_SBS_VERSIONNUM, XFS_SBS_SECTSIZE, XFS_SBS_INODESIZE,
-        XFS_SBS_INOPBLOCK, XFS_SBS_FNAME, XFS_SBS_BLOCKLOG,
-        XFS_SBS_SECTLOG, XFS_SBS_INODELOG, XFS_SBS_INOPBLOG, XFS_SBS_AGBLKLOG,
-        XFS_SBS_REXTSLOG, XFS_SBS_INPROGRESS, XFS_SBS_IMAX_PCT, XFS_SBS_ICOUNT,
-        XFS_SBS_IFREE, XFS_SBS_FDBLOCKS, XFS_SBS_FREXTENTS, XFS_SBS_UQUOTINO,
-        XFS_SBS_GQUOTINO, XFS_SBS_QFLAGS, XFS_SBS_FLAGS, XFS_SBS_SHARED_VN,
-        XFS_SBS_INOALIGNMT, XFS_SBS_UNIT, XFS_SBS_WIDTH, XFS_SBS_DIRBLKLOG,
-        XFS_SBS_LOGSECTLOG, XFS_SBS_LOGSECTSIZE, XFS_SBS_LOGSUNIT,
-        XFS_SBS_FEATURES2, XFS_SBS_BAD_FEATURES2, XFS_SBS_FEATURES_COMPAT,
-        XFS_SBS_FEATURES_RO_COMPAT, XFS_SBS_FEATURES_INCOMPAT,
-        XFS_SBS_FEATURES_LOG_INCOMPAT, XFS_SBS_CRC, XFS_SBS_PAD,
-        XFS_SBS_PQUOTINO, XFS_SBS_LSN,
-        XFS_SBS_FIELDCOUNT
-} xfs_sb_field_t;
-
-/*
- * Mask values, defined based on the xfs_sb_field_t values.
- * Only define the ones we're using.
- */
-#define XFS_SB_MVAL(x)          (1LL << XFS_SBS_ ## x)
-#define XFS_SB_UUID             XFS_SB_MVAL(UUID)
-#define XFS_SB_FNAME            XFS_SB_MVAL(FNAME)
-#define XFS_SB_ROOTINO          XFS_SB_MVAL(ROOTINO)
-#define XFS_SB_RBMINO           XFS_SB_MVAL(RBMINO)
-#define XFS_SB_RSUMINO          XFS_SB_MVAL(RSUMINO)
-#define XFS_SB_VERSIONNUM       XFS_SB_MVAL(VERSIONNUM)
-#define XFS_SB_UQUOTINO         XFS_SB_MVAL(UQUOTINO)
-#define XFS_SB_GQUOTINO         XFS_SB_MVAL(GQUOTINO)
-#define XFS_SB_QFLAGS           XFS_SB_MVAL(QFLAGS)
-#define XFS_SB_SHARED_VN        XFS_SB_MVAL(SHARED_VN)
-#define XFS_SB_UNIT             XFS_SB_MVAL(UNIT)
-#define XFS_SB_WIDTH            XFS_SB_MVAL(WIDTH)
-#define XFS_SB_ICOUNT           XFS_SB_MVAL(ICOUNT)
-#define XFS_SB_IFREE            XFS_SB_MVAL(IFREE)
-#define XFS_SB_FDBLOCKS         XFS_SB_MVAL(FDBLOCKS)
-#define XFS_SB_FEATURES2        XFS_SB_MVAL(FEATURES2)
-#define XFS_SB_BAD_FEATURES2    XFS_SB_MVAL(BAD_FEATURES2)
-#define XFS_SB_FEATURES_COMPAT  XFS_SB_MVAL(FEATURES_COMPAT)
-#define XFS_SB_FEATURES_RO_COMPAT XFS_SB_MVAL(FEATURES_RO_COMPAT)
-#define XFS_SB_FEATURES_INCOMPAT XFS_SB_MVAL(FEATURES_INCOMPAT)
-#define XFS_SB_FEATURES_LOG_INCOMPAT XFS_SB_MVAL(FEATURES_LOG_INCOMPAT)
-#define XFS_SB_CRC              XFS_SB_MVAL(CRC)
-#define XFS_SB_PQUOTINO         XFS_SB_MVAL(PQUOTINO)
-#define XFS_SB_NUM_BITS         ((int)XFS_SBS_FIELDCOUNT)
-#define XFS_SB_ALL_BITS         ((1LL << XFS_SB_NUM_BITS) - 1)
-#define XFS_SB_MOD_BITS         \
-        (XFS_SB_UUID | XFS_SB_ROOTINO | XFS_SB_RBMINO | XFS_SB_RSUMINO | \
-         XFS_SB_VERSIONNUM | XFS_SB_UQUOTINO | XFS_SB_GQUOTINO | \
-         XFS_SB_QFLAGS | XFS_SB_SHARED_VN | XFS_SB_UNIT | XFS_SB_WIDTH | \
-         XFS_SB_ICOUNT | XFS_SB_IFREE | XFS_SB_FDBLOCKS | XFS_SB_FEATURES2 | \
-         XFS_SB_BAD_FEATURES2 | XFS_SB_FEATURES_COMPAT | \
-         XFS_SB_FEATURES_RO_COMPAT | XFS_SB_FEATURES_INCOMPAT | \
-         XFS_SB_FEATURES_LOG_INCOMPAT | XFS_SB_PQUOTINO)
-
-
-/*
- * Misc. Flags - warning - these will be cleared by xfs_repair unless
- * a feature bit is set when the flag is used.
- */
-#define XFS_SBF_NOFLAGS         0x00    /* no flags set */
-#define XFS_SBF_READONLY        0x01    /* only read-only mounts allowed */
-
-/*
- * define max. shared version we can interoperate with
- */
-#define XFS_SB_MAX_SHARED_VN    0
-
-#define XFS_SB_VERSION_NUM(sbp) ((sbp)->sb_versionnum & XFS_SB_VERSION_NUMBITS)
-
-/*
- * The first XFS version we support is a v4 superblock with V2 directories.
- */
-static inline bool xfs_sb_good_v4_features(struct xfs_sb *sbp)
-{
-        if (!(sbp->sb_versionnum & XFS_SB_VERSION_DIRV2BIT))
-                return false;
-
-        /* check for unknown features in the fs */
-        if ((sbp->sb_versionnum & ~XFS_SB_VERSION_OKBITS) ||
-            ((sbp->sb_versionnum & XFS_SB_VERSION_MOREBITSBIT) &&
-             (sbp->sb_features2 & ~XFS_SB_VERSION2_OKBITS)))
-                return false;
-
-        return true;
-}
-
-static inline bool xfs_sb_good_version(struct xfs_sb *sbp)
-{
-        if (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5)
-                return true;
-        if (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4)
-                return xfs_sb_good_v4_features(sbp);
-        return false;
-}
-
-/*
- * Detect a mismatched features2 field.  Older kernels read/wrote
- * this into the wrong slot, so to be safe we keep them in sync.
- */
-static inline bool xfs_sb_has_mismatched_features2(struct xfs_sb *sbp)
-{
-        return sbp->sb_bad_features2 != sbp->sb_features2;
-}
-
-static inline bool xfs_sb_version_hasattr(struct xfs_sb *sbp)
-{
-        return (sbp->sb_versionnum & XFS_SB_VERSION_ATTRBIT);
-}
-
-static inline void xfs_sb_version_addattr(struct xfs_sb *sbp)
-{
-        sbp->sb_versionnum |= XFS_SB_VERSION_ATTRBIT;
-}
-
-static inline bool xfs_sb_version_hasquota(struct xfs_sb *sbp)
-{
-        return (sbp->sb_versionnum & XFS_SB_VERSION_QUOTABIT);
-}
-
-static inline void xfs_sb_version_addquota(struct xfs_sb *sbp)
-{
-        sbp->sb_versionnum |= XFS_SB_VERSION_QUOTABIT;
-}
-
-static inline bool xfs_sb_version_hasalign(struct xfs_sb *sbp)
-{
-        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
-                (sbp->sb_versionnum & XFS_SB_VERSION_ALIGNBIT));
-}
-
-static inline bool xfs_sb_version_hasdalign(struct xfs_sb *sbp)
-{
-        return (sbp->sb_versionnum & XFS_SB_VERSION_DALIGNBIT);
-}
-
-static inline bool xfs_sb_version_haslogv2(struct xfs_sb *sbp)
-{
-        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
-               (sbp->sb_versionnum & XFS_SB_VERSION_LOGV2BIT);
-}
-
-static inline bool xfs_sb_version_hasextflgbit(struct xfs_sb *sbp)
-{
-        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
-               (sbp->sb_versionnum & XFS_SB_VERSION_EXTFLGBIT);
-}
-
-static inline bool xfs_sb_version_hassector(struct xfs_sb *sbp)
-{
-        return (sbp->sb_versionnum & XFS_SB_VERSION_SECTORBIT);
-}
-
-static inline bool xfs_sb_version_hasasciici(struct xfs_sb *sbp)
-{
-        return (sbp->sb_versionnum & XFS_SB_VERSION_BORGBIT);
-}
-
-static inline bool xfs_sb_version_hasmorebits(struct xfs_sb *sbp)
-{
-        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 ||
-               (sbp->sb_versionnum & XFS_SB_VERSION_MOREBITSBIT);
-}
-
-/*
- * sb_features2 bit version macros.
- */
-static inline bool xfs_sb_version_haslazysbcount(struct xfs_sb *sbp)
-{
-        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) ||
-               (xfs_sb_version_hasmorebits(sbp) &&
-                (sbp->sb_features2 & XFS_SB_VERSION2_LAZYSBCOUNTBIT));
-}
-
-static inline bool xfs_sb_version_hasattr2(struct xfs_sb *sbp)
-{
-        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) ||
-               (xfs_sb_version_hasmorebits(sbp) &&
-                (sbp->sb_features2 & XFS_SB_VERSION2_ATTR2BIT));
-}
-
-static inline void xfs_sb_version_addattr2(struct xfs_sb *sbp)
-{
-        sbp->sb_versionnum |= XFS_SB_VERSION_MOREBITSBIT;
-        sbp->sb_features2 |= XFS_SB_VERSION2_ATTR2BIT;
-        sbp->sb_bad_features2 |= XFS_SB_VERSION2_ATTR2BIT;
-}
-
-static inline void xfs_sb_version_removeattr2(struct xfs_sb *sbp)
-{
-        sbp->sb_features2 &= ~XFS_SB_VERSION2_ATTR2BIT;
-        sbp->sb_bad_features2 &= ~XFS_SB_VERSION2_ATTR2BIT;
-        if (!sbp->sb_features2)
-                sbp->sb_versionnum &= ~XFS_SB_VERSION_MOREBITSBIT;
-}
-
-static inline bool xfs_sb_version_hasprojid32bit(struct xfs_sb *sbp)
-{
-        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) ||
-               (xfs_sb_version_hasmorebits(sbp) &&
-                (sbp->sb_features2 & XFS_SB_VERSION2_PROJID32BIT));
-}
-
-static inline void xfs_sb_version_addprojid32bit(struct xfs_sb *sbp)
-{
-        sbp->sb_versionnum |= XFS_SB_VERSION_MOREBITSBIT;
-        sbp->sb_features2 |= XFS_SB_VERSION2_PROJID32BIT;
-        sbp->sb_bad_features2 |= XFS_SB_VERSION2_PROJID32BIT;
-}
-
-/*
- * Extended v5 superblock feature masks. These are to be used for new v5
- * superblock features only.
- *
- * Compat features are new features that old kernels will not notice or affect
- * and so can mount read-write without issues.
- *
- * RO-Compat (read only) are features that old kernels can read but will break
- * if they write. Hence only read-only mounts of such filesystems are allowed on
- * kernels that don't support the feature bit.
- *
- * InCompat features are features which old kernels will not understand and so
- * must not mount.
- *
- * Log-InCompat features are for changes to log formats or new transactions that
- * can't be replayed on older kernels. The fields are set when the filesystem is
- * mounted, and a clean unmount clears the fields.
- */
-#define XFS_SB_FEAT_COMPAT_ALL 0
-#define XFS_SB_FEAT_COMPAT_UNKNOWN      ~XFS_SB_FEAT_COMPAT_ALL
-static inline bool
-xfs_sb_has_compat_feature(
-        struct xfs_sb   *sbp,
-        __uint32_t      feature)
-{
-        return (sbp->sb_features_compat & feature) != 0;
-}
-
-#define XFS_SB_FEAT_RO_COMPAT_FINOBT   (1 << 0)         /* free inode btree */
-#define XFS_SB_FEAT_RO_COMPAT_ALL \
-                (XFS_SB_FEAT_RO_COMPAT_FINOBT)
-#define XFS_SB_FEAT_RO_COMPAT_UNKNOWN   ~XFS_SB_FEAT_RO_COMPAT_ALL
-static inline bool
-xfs_sb_has_ro_compat_feature(
-        struct xfs_sb   *sbp,
-        __uint32_t      feature)
-{
-        return (sbp->sb_features_ro_compat & feature) != 0;
-}
-
-#define XFS_SB_FEAT_INCOMPAT_FTYPE      (1 << 0)        /* filetype in dirent */
-#define XFS_SB_FEAT_INCOMPAT_ALL \
-                (XFS_SB_FEAT_INCOMPAT_FTYPE)
-
-#define XFS_SB_FEAT_INCOMPAT_UNKNOWN    ~XFS_SB_FEAT_INCOMPAT_ALL
-static inline bool
-xfs_sb_has_incompat_feature(
-        struct xfs_sb   *sbp,
-        __uint32_t      feature)
-{
-        return (sbp->sb_features_incompat & feature) != 0;
-}
-
-#define XFS_SB_FEAT_INCOMPAT_LOG_ALL 0
-#define XFS_SB_FEAT_INCOMPAT_LOG_UNKNOWN        ~XFS_SB_FEAT_INCOMPAT_LOG_ALL
-static inline bool
-xfs_sb_has_incompat_log_feature(
-        struct xfs_sb   *sbp,
-        __uint32_t      feature)
-{
-        return (sbp->sb_features_log_incompat & feature) != 0;
-}
-
-/*
- * V5 superblock specific feature checks
- */
-static inline int xfs_sb_version_hascrc(struct xfs_sb *sbp)
-{
-        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5;
-}
-
-static inline int xfs_sb_version_has_pquotino(struct xfs_sb *sbp)
-{
-        return XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5;
-}
-
-static inline int xfs_sb_version_hasftype(struct xfs_sb *sbp)
-{
-        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5 &&
-                xfs_sb_has_incompat_feature(sbp, XFS_SB_FEAT_INCOMPAT_FTYPE)) ||
-               (xfs_sb_version_hasmorebits(sbp) &&
-                 (sbp->sb_features2 & XFS_SB_VERSION2_FTYPE));
-}
-
-static inline int xfs_sb_version_hasfinobt(xfs_sb_t *sbp)
-{
-        return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) &&
-                (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_FINOBT);
-}
-
-/*
- * end of superblock version macros
- */
-
-static inline bool
-xfs_is_quota_inode(struct xfs_sb *sbp, xfs_ino_t ino)
-{
-        return (ino == sbp->sb_uquotino ||
-                ino == sbp->sb_gquotino ||
-                ino == sbp->sb_pquotino);
-}
-
-#define XFS_SB_DADDR            ((xfs_daddr_t)0) /* daddr in filesystem/ag */
-#define XFS_SB_BLOCK(mp)        XFS_HDR_BLOCK(mp, XFS_SB_DADDR)
-#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)((bp)->b_addr))
-
-#define XFS_HDR_BLOCK(mp,d)     ((xfs_agblock_t)XFS_BB_TO_FSBT(mp,d))
-#define XFS_DADDR_TO_FSB(mp,d)  XFS_AGB_TO_FSB(mp, \
-                        xfs_daddr_to_agno(mp,d), xfs_daddr_to_agbno(mp,d))
-#define XFS_FSB_TO_DADDR(mp,fsbno)      XFS_AGB_TO_DADDR(mp, \
-                        XFS_FSB_TO_AGNO(mp,fsbno), XFS_FSB_TO_AGBNO(mp,fsbno))
-
-/*
- * File system sector to basic block conversions.
- */
-#define XFS_FSS_TO_BB(mp,sec)   ((sec) << (mp)->m_sectbb_log)
-
-/*
- * File system block to basic block conversions.
- */
-#define XFS_FSB_TO_BB(mp,fsbno) ((fsbno) << (mp)->m_blkbb_log)
-#define XFS_BB_TO_FSB(mp,bb)    \
-        (((bb) + (XFS_FSB_TO_BB(mp,1) - 1)) >> (mp)->m_blkbb_log)
-#define XFS_BB_TO_FSBT(mp,bb)   ((bb) >> (mp)->m_blkbb_log)
-
-/*
- * File system block to byte conversions.
- */
-#define XFS_FSB_TO_B(mp,fsbno)  ((xfs_fsize_t)(fsbno) << (mp)->m_sb.sb_blocklog)
-#define XFS_B_TO_FSB(mp,b)      \
-        ((((__uint64_t)(b)) + (mp)->m_blockmask) >> (mp)->m_sb.sb_blocklog)
-#define XFS_B_TO_FSBT(mp,b)     (((__uint64_t)(b)) >> (mp)->m_sb.sb_blocklog)
-#define XFS_B_FSB_OFFSET(mp,b)  ((b) & (mp)->m_blockmask)
-
-/*
  * perag get/put wrappers for ref counting
  */
 extern struct xfs_perag *xfs_perag_get(struct xfs_mount *, xfs_agnumber_t);
diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
index 5782f037eab4..c80c5236c3da 100644
--- a/fs/xfs/libxfs/xfs_symlink_remote.c
+++ b/fs/xfs/libxfs/xfs_symlink_remote.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_shared.h"
 #include "xfs_trans_resv.h"
-#include "xfs_ag.h"
-#include "xfs_sb.h"
 #include "xfs_mount.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_inode.h"
diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
index f2bda7c76b8a..6c1330f29050 100644
--- a/fs/xfs/libxfs/xfs_trans_resv.c
+++ b/fs/xfs/libxfs/xfs_trans_resv.c
@@ -22,8 +22,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
index a65fa5dde6e9..4b641676f258 100644
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -19,8 +19,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_ag.h"
-#include "xfs_sb.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_acl.h"
diff --git a/fs/xfs/xfs_acl.h b/fs/xfs/xfs_acl.h
index 5dc163744511..3841b07f27bf 100644
--- a/fs/xfs/xfs_acl.h
+++ b/fs/xfs/xfs_acl.h
@@ -22,42 +22,6 @@ struct inode;
 struct posix_acl;
 struct xfs_inode;
 
-#define XFS_ACL_NOT_PRESENT (-1)
-
-/* On-disk XFS access control list structure */
-struct xfs_acl_entry {
-        __be32  ae_tag;
-        __be32  ae_id;
-        __be16  ae_perm;
-        __be16  ae_pad;         /* fill the implicit hole in the structure */
-};
-
-struct xfs_acl {
-        __be32                  acl_cnt;
-        struct xfs_acl_entry    acl_entry[0];
-};
-
-/*
- * The number of ACL entries allowed is defined by the on-disk format.
- * For v4 superblocks, that is limited to 25 entries. For v5 superblocks, it is
- * limited only by the maximum size of the xattr that stores the information.
- */
-#define XFS_ACL_MAX_ENTRIES(mp) \
-        (xfs_sb_version_hascrc(&mp->m_sb) \
-                ?  (XATTR_SIZE_MAX - sizeof(struct xfs_acl)) / \
-                                                sizeof(struct xfs_acl_entry) \
-                : 25)
-
-#define XFS_ACL_MAX_SIZE(mp) \
-        (sizeof(struct xfs_acl) + \
-                sizeof(struct xfs_acl_entry) * XFS_ACL_MAX_ENTRIES((mp)))
-
-/* On-disk XFS extended attribute names */
-#define SGI_ACL_FILE            (unsigned char *)"SGI_ACL_FILE"
-#define SGI_ACL_DEFAULT         (unsigned char *)"SGI_ACL_DEFAULT"
-#define SGI_ACL_FILE_SIZE       (sizeof(SGI_ACL_FILE)-1)
-#define SGI_ACL_DEFAULT_SIZE    (sizeof(SGI_ACL_DEFAULT)-1)
-
 #ifdef CONFIG_XFS_POSIX_ACL
 extern struct posix_acl *xfs_get_acl(struct inode *inode, int type);
 extern int xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type);
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index f5b2453a43b2..18e2f3bbae5e 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -20,8 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
@@ -33,7 +31,6 @@
 #include "xfs_bmap.h"
 #include "xfs_bmap_util.h"
 #include "xfs_bmap_btree.h"
-#include "xfs_dinode.h"
 #include <linux/aio.h>
 #include <linux/gfp.h>
 #include <linux/mpage.h>
diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index aa2a8b1838a2..83af4c149635 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -23,8 +23,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -39,7 +37,6 @@
 #include "xfs_error.h"
 #include "xfs_quota.h"
 #include "xfs_trace.h"
-#include "xfs_dinode.h"
 #include "xfs_dir2.h"
 
 /*
diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
index 62db83ab6cbc..a43d370d2c58 100644
--- a/fs/xfs/xfs_attr_list.c
+++ b/fs/xfs/xfs_attr_list.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -39,7 +37,6 @@
 #include "xfs_trace.h"
 #include "xfs_buf_item.h"
 #include "xfs_cksum.h"
-#include "xfs_dinode.h"
 #include "xfs_dir2.h"
 
 STATIC int
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 281002689d64..22a5dcb70b32 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -23,8 +23,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_inode.h"
@@ -42,7 +40,6 @@
 #include "xfs_trace.h"
 #include "xfs_icache.h"
 #include "xfs_log.h"
-#include "xfs_dinode.h"
 
 /* Kernel only BMAP related definitions and functions */
 
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 24b4ebea0d4d..bb502a391792 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -34,18 +34,16 @@
 #include <linux/backing-dev.h>
 #include <linux/freezer.h>
 
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_trace.h"
 #include "xfs_log.h"
 
 static kmem_zone_t *xfs_buf_zone;
 
-static struct workqueue_struct *xfslogd_workqueue;
-
 #ifdef XFS_BUF_LOCK_TRACKING
 # define XB_SET_OWNER(bp)       ((bp)->b_last_holder = current->pid)
 # define XB_CLEAR_OWNER(bp)     ((bp)->b_last_holder = -1)
@@ -463,7 +461,7 @@ _xfs_buf_find(
          * have to check that the buffer falls within the filesystem bounds.
          */
         eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks);
-        if (blkno >= eofs) {
+        if (blkno < 0 || blkno >= eofs) {
                 /*
                  * XXX (dgc): we should really be returning -EFSCORRUPTED here,
                  * but none of the higher level infrastructure supports
@@ -1043,7 +1041,7 @@ xfs_buf_ioend_work(
         struct work_struct      *work)
 {
         struct xfs_buf          *bp =
-                container_of(work, xfs_buf_t, b_iodone_work);
+                container_of(work, xfs_buf_t, b_ioend_work);
 
         xfs_buf_ioend(bp);
 }
@@ -1052,8 +1050,8 @@ void
 xfs_buf_ioend_async(
         struct xfs_buf  *bp)
 {
-        INIT_WORK(&bp->b_iodone_work, xfs_buf_ioend_work);
-        queue_work(xfslogd_workqueue, &bp->b_iodone_work);
+        INIT_WORK(&bp->b_ioend_work, xfs_buf_ioend_work);
+        queue_work(bp->b_ioend_wq, &bp->b_ioend_work);
 }
 
 void
@@ -1222,6 +1220,13 @@ _xfs_buf_ioapply(
          */
         bp->b_error = 0;
 
+        /*
+         * Initialize the I/O completion workqueue if we haven't yet or the
+         * submitter has not opted to specify a custom one.
+         */
+        if (!bp->b_ioend_wq)
+                bp->b_ioend_wq = bp->b_target->bt_mount->m_buf_workqueue;
+
         if (bp->b_flags & XBF_WRITE) {
                 if (bp->b_flags & XBF_SYNCIO)
                         rw = WRITE_SYNC;
@@ -1882,15 +1887,8 @@ xfs_buf_init(void)
         if (!xfs_buf_zone)
                 goto out;
 
-        xfslogd_workqueue = alloc_workqueue("xfslogd",
-                                WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_FREEZABLE, 1);
-        if (!xfslogd_workqueue)
-                goto out_free_buf_zone;
-
         return 0;
 
- out_free_buf_zone:
-        kmem_zone_destroy(xfs_buf_zone);
  out:
         return -ENOMEM;
 }
@@ -1898,6 +1896,5 @@ xfs_buf_init(void)
 void
 xfs_buf_terminate(void)
 {
-        destroy_workqueue(xfslogd_workqueue);
         kmem_zone_destroy(xfs_buf_zone);
 }
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 82002c00af90..75ff5d5a7d2e 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -164,7 +164,8 @@ typedef struct xfs_buf {
         struct xfs_perag        *b_pag;         /* contains rbtree root */
         xfs_buftarg_t           *b_target;      /* buffer target (device) */
         void                    *b_addr;        /* virtual address of buffer */
-        struct work_struct      b_iodone_work;
+        struct work_struct      b_ioend_work;
+        struct workqueue_struct *b_ioend_wq;    /* I/O completion wq */
         xfs_buf_iodone_t        b_iodone;       /* I/O completion function */
         struct completion       b_iowait;       /* queue for I/O waiters */
         void                    *b_fspriv;
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index f15969543326..3f9bd58edec7 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -17,11 +17,11 @@
  */
 #include "xfs.h"
 #include "xfs_fs.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_trans.h"
 #include "xfs_buf_item.h"
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index f1b69edcdf31..098cd78fe708 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -34,7 +32,6 @@
 #include "xfs_trace.h"
 #include "xfs_bmap.h"
 #include "xfs_trans.h"
-#include "xfs_dinode.h"
 
 /*
  * Directory file type support functions
@@ -44,7 +41,7 @@ static unsigned char xfs_dir3_filetype_table[] = {
         DT_FIFO, DT_SOCK, DT_LNK, DT_WHT,
 };
 
-unsigned char
+static unsigned char
 xfs_dir3_get_dtype(
         struct xfs_mount        *mp,
         __uint8_t               filetype)
@@ -57,22 +54,6 @@ xfs_dir3_get_dtype(
 
         return xfs_dir3_filetype_table[filetype];
 }
-/*
- * @mode, if set, indicates that the type field needs to be set up.
- * This uses the transformation from file mode to DT_* as defined in linux/fs.h
- * for file type specification. This will be propagated into the directory
- * structure if appropriate for the given operation and filesystem config.
- */
-const unsigned char xfs_mode_to_ftype[S_IFMT >> S_SHIFT] = {
-        [0]                     = XFS_DIR3_FT_UNKNOWN,
-        [S_IFREG >> S_SHIFT]    = XFS_DIR3_FT_REG_FILE,
-        [S_IFDIR >> S_SHIFT]    = XFS_DIR3_FT_DIR,
-        [S_IFCHR >> S_SHIFT]    = XFS_DIR3_FT_CHRDEV,
-        [S_IFBLK >> S_SHIFT]    = XFS_DIR3_FT_BLKDEV,
-        [S_IFIFO >> S_SHIFT]    = XFS_DIR3_FT_FIFO,
-        [S_IFSOCK >> S_SHIFT]   = XFS_DIR3_FT_SOCK,
-        [S_IFLNK >> S_SHIFT]    = XFS_DIR3_FT_SYMLINK,
-};
 
 STATIC int
 xfs_dir2_sf_getdents(
diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index 13d08a1b390e..799e5a2d334d 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
@@ -20,7 +20,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_quota.h"
 #include "xfs_inode.h"
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 63c2de49f61d..02c01bbbc789 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -22,8 +22,6 @@
 #include "xfs_shared.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_bmap.h"
diff --git a/fs/xfs/xfs_dquot_item.c b/fs/xfs/xfs_dquot_item.c
index f33fbaaa4d8a..814cff94e78f 100644
--- a/fs/xfs/xfs_dquot_item.c
+++ b/fs/xfs/xfs_dquot_item.c
@@ -20,8 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_quota.h"
diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
index b92fd7bc49e3..3ee186ac1093 100644
--- a/fs/xfs/xfs_error.c
+++ b/fs/xfs/xfs_error.c
@@ -20,8 +20,6 @@
 #include "xfs_fs.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_error.h"
 
diff --git a/fs/xfs/xfs_export.c b/fs/xfs/xfs_export.c
index 5a6bd5d8779a..5eb4a14e0a0f 100644
--- a/fs/xfs/xfs_export.c
+++ b/fs/xfs/xfs_export.c
@@ -19,10 +19,9 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
+#include "xfs_da_btree.h"
 #include "xfs_dir2.h"
 #include "xfs_export.h"
 #include "xfs_inode.h"
diff --git a/fs/xfs/xfs_extent_busy.c b/fs/xfs/xfs_extent_busy.c
index fd22f69049d4..c263e079273e 100644
--- a/fs/xfs/xfs_extent_busy.c
+++ b/fs/xfs/xfs_extent_busy.c
@@ -24,7 +24,6 @@
 #include "xfs_shared.h"
 #include "xfs_trans_resv.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_alloc.h"
 #include "xfs_extent_busy.h"
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index c4327419dc5c..cb7fe64cdbfa 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -17,10 +17,9 @@
  */
 #include "xfs.h"
 #include "xfs_fs.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_trans.h"
 #include "xfs_trans_priv.h"
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index eb596b419942..13e974e6a889 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -37,7 +35,6 @@
 #include "xfs_ioctl.h"
 #include "xfs_trace.h"
 #include "xfs_log.h"
-#include "xfs_dinode.h"
 #include "xfs_icache.h"
 
 #include <linux/aio.h>
@@ -933,7 +930,6 @@ xfs_file_readdir(
 {
         struct inode    *inode = file_inode(file);
         xfs_inode_t     *ip = XFS_I(inode);
-        int             error;
         size_t          bufsize;
 
         /*
@@ -950,10 +946,7 @@ xfs_file_readdir(
          */
         bufsize = (size_t)min_t(loff_t, 32768, ip->i_d.di_size);
 
-        error = xfs_readdir(ip, ctx, bufsize);
-        if (error)
-                return error;
-        return 0;
+        return xfs_readdir(ip, ctx, bufsize);
 }
 
 STATIC int
diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c
index e92730c1d3ca..a2e86e8a0fea 100644
--- a/fs/xfs/xfs_filestream.c
+++ b/fs/xfs/xfs_filestream.c
@@ -20,16 +20,13 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_ag.h"
 #include "xfs_sb.h"
 #include "xfs_mount.h"
-#include "xfs_inum.h"
 #include "xfs_inode.h"
 #include "xfs_bmap.h"
 #include "xfs_bmap_util.h"
 #include "xfs_alloc.h"
 #include "xfs_mru_cache.h"
-#include "xfs_dinode.h"
 #include "xfs_filestream.h"
 #include "xfs_trace.h"
 
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index c05ac8b70fa9..fdc64220fcb0 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -22,7 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -40,7 +39,6 @@
 #include "xfs_rtalloc.h"
 #include "xfs_trace.h"
 #include "xfs_log.h"
-#include "xfs_dinode.h"
 #include "xfs_filestream.h"
 
 /*
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index b45f7b27b5df..9771b7ef62ed 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -20,9 +20,7 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_error.h"
@@ -65,6 +63,7 @@ xfs_inode_alloc(
                 return NULL;
         }
 
+        XFS_STATS_INC(vn_active);
         ASSERT(atomic_read(&ip->i_pincount) == 0);
         ASSERT(!spin_is_locked(&ip->i_flags_lock));
         ASSERT(!xfs_isiflocked(ip));
@@ -130,6 +129,7 @@ xfs_inode_free(
         /* asserts to verify all state is correct here */
         ASSERT(atomic_read(&ip->i_pincount) == 0);
         ASSERT(!xfs_isiflocked(ip));
+        XFS_STATS_DEC(vn_active);
 
         call_rcu(&VFS_I(ip)->i_rcu, xfs_inode_free_callback);
 }
diff --git a/fs/xfs/xfs_icache.h b/fs/xfs/xfs_icache.h
index 46748b86b12f..62f1f91c32cb 100644
--- a/fs/xfs/xfs_icache.h
+++ b/fs/xfs/xfs_icache.h
@@ -34,6 +34,14 @@ struct xfs_eofblocks {
 #define SYNC_TRYLOCK            0x0002  /* only try to lock inodes */
 
 /*
+ * tags for inode radix tree
+ */
+#define XFS_ICI_NO_TAG          (-1)    /* special flag for an untagged lookup
+                                           in xfs_inode_ag_iterator */
+#define XFS_ICI_RECLAIM_TAG     0       /* inode is to be reclaimed */
+#define XFS_ICI_EOFBLOCKS_TAG   1       /* inode has blocks beyond EOF */
+
+/*
  * Flags for xfs_iget()
  */
 #define XFS_IGET_CREATE         0x1
diff --git a/fs/xfs/xfs_icreate_item.c b/fs/xfs/xfs_icreate_item.c
index 7e4549233251..d45ca72af6fb 100644
--- a/fs/xfs/xfs_icreate_item.c
+++ b/fs/xfs/xfs_icreate_item.c
@@ -18,11 +18,10 @@
 #include "xfs.h"
 #include "xfs_fs.h"
 #include "xfs_shared.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_trans.h"
 #include "xfs_trans_priv.h"
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 8ed049d1e332..41f804e740d7 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -23,9 +23,7 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_da_format.h"
@@ -1082,7 +1080,7 @@ xfs_create(
         struct xfs_dquot        *udqp = NULL;
         struct xfs_dquot        *gdqp = NULL;
         struct xfs_dquot        *pdqp = NULL;
-        struct xfs_trans_res    tres;
+        struct xfs_trans_res    *tres;
         uint                    resblks;
 
         trace_xfs_create(dp, name);
@@ -1105,13 +1103,11 @@ xfs_create(
         if (is_dir) {
                 rdev = 0;
                 resblks = XFS_MKDIR_SPACE_RES(mp, name->len);
-                tres.tr_logres = M_RES(mp)->tr_mkdir.tr_logres;
-                tres.tr_logcount = XFS_MKDIR_LOG_COUNT;
+                tres = &M_RES(mp)->tr_mkdir;
                 tp = xfs_trans_alloc(mp, XFS_TRANS_MKDIR);
         } else {
                 resblks = XFS_CREATE_SPACE_RES(mp, name->len);
-                tres.tr_logres = M_RES(mp)->tr_create.tr_logres;
-                tres.tr_logcount = XFS_CREATE_LOG_COUNT;
+                tres = &M_RES(mp)->tr_create;
                 tp = xfs_trans_alloc(mp, XFS_TRANS_CREATE);
         }
 
@@ -1123,17 +1119,16 @@ xfs_create(
          * the case we'll drop the one we have and get a more
          * appropriate transaction later.
          */
-        tres.tr_logflags = XFS_TRANS_PERM_LOG_RES;
-        error = xfs_trans_reserve(tp, &tres, resblks, 0);
+        error = xfs_trans_reserve(tp, tres, resblks, 0);
         if (error == -ENOSPC) {
                 /* flush outstanding delalloc blocks and retry */
                 xfs_flush_inodes(mp);
-                error = xfs_trans_reserve(tp, &tres, resblks, 0);
+                error = xfs_trans_reserve(tp, tres, resblks, 0);
         }
         if (error == -ENOSPC) {
                 /* No space at all so try a "no-allocation" reservation */
                 resblks = 0;
-                error = xfs_trans_reserve(tp, &tres, 0, 0);
+                error = xfs_trans_reserve(tp, tres, 0, 0);
         }
         if (error) {
                 cancel_flags = 0;
@@ -2488,9 +2483,7 @@ xfs_remove(
         xfs_fsblock_t           first_block;
         int                     cancel_flags;
         int                     committed;
-        int                     link_zero;
         uint                    resblks;
-        uint                    log_count;
 
         trace_xfs_remove(dp, name);
 
@@ -2505,13 +2498,10 @@ xfs_remove(
         if (error)
                 goto std_return;
 
-        if (is_dir) {
+        if (is_dir)
                 tp = xfs_trans_alloc(mp, XFS_TRANS_RMDIR);
-                log_count = XFS_DEFAULT_LOG_COUNT;
-        } else {
+        else
                 tp = xfs_trans_alloc(mp, XFS_TRANS_REMOVE);
-                log_count = XFS_REMOVE_LOG_COUNT;
-        }
         cancel_flags = XFS_TRANS_RELEASE_LOG_RES;
 
         /*
@@ -2579,9 +2569,6 @@ xfs_remove(
         if (error)
                 goto out_trans_cancel;
 
-        /* Determine if this is the last link while the inode is locked */
-        link_zero = (ip->i_d.di_nlink == 0);
-
         xfs_bmap_init(&free_list, &first_block);
         error = xfs_dir_removename(tp, dp, name, ip->i_ino,
                                         &first_block, &free_list, resblks);
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 9af2882e1f4c..4ed2ba9342dc 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -20,7 +20,6 @@
 
 #include "xfs_inode_buf.h"
 #include "xfs_inode_fork.h"
-#include "xfs_dinode.h"
 
 /*
  * Kernel only inode definitions
@@ -324,7 +323,6 @@ static inline int xfs_isiflocked(struct xfs_inode *ip)
         (((pip)->i_mount->m_flags & XFS_MOUNT_GRPID) || \
          ((pip)->i_d.di_mode & S_ISGID))
 
-
 int             xfs_release(struct xfs_inode *ip);
 void            xfs_inactive(struct xfs_inode *ip);
 int             xfs_lookup(struct xfs_inode *dp, struct xfs_name *name,
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 63de0b0acc32..bf13a5a7e2f4 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -20,8 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
@@ -29,7 +27,6 @@
 #include "xfs_error.h"
 #include "xfs_trace.h"
 #include "xfs_trans_priv.h"
-#include "xfs_dinode.h"
 #include "xfs_log.h"
 
 
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 24c926b6fe85..a1831980a68e 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_ioctl.h"
@@ -40,7 +38,6 @@
 #include "xfs_trace.h"
 #include "xfs_icache.h"
 #include "xfs_symlink.h"
-#include "xfs_dinode.h"
 #include "xfs_trans.h"
 
 #include <linux/capability.h>
diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index 94ce027e28e3..ec6772866f3d 100644
--- a/fs/xfs/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
@@ -25,8 +25,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_itable.h"
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index afcf3c926565..c980e2a5086b 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
@@ -38,7 +36,6 @@
 #include "xfs_quota.h"
 #include "xfs_dquot_item.h"
 #include "xfs_dquot.h"
-#include "xfs_dinode.h"
 
 
 #define XFS_WRITEIO_ALIGN(mp,off)       (((off) >> mp->m_writeio_log) \
@@ -52,7 +49,6 @@ xfs_iomap_eof_align_last_fsb(
         xfs_extlen_t    extsize,
         xfs_fileoff_t   *last_fsb)
 {
-        xfs_fileoff_t   new_last_fsb = 0;
         xfs_extlen_t    align = 0;
         int             eof, error;
 
@@ -70,8 +66,8 @@ xfs_iomap_eof_align_last_fsb(
                 else if (mp->m_dalign)
                         align = mp->m_dalign;
 
-                if (align && XFS_ISIZE(ip) >= XFS_FSB_TO_B(mp, align))
-                        new_last_fsb = roundup_64(*last_fsb, align);
+                if (align && XFS_ISIZE(ip) < XFS_FSB_TO_B(mp, align))
+                        align = 0;
         }
 
         /*
@@ -79,14 +75,14 @@ xfs_iomap_eof_align_last_fsb(
          * (when file on a real-time subvolume or has di_extsize hint).
          */
         if (extsize) {
-                if (new_last_fsb)
-                        align = roundup_64(new_last_fsb, extsize);
+                if (align)
+                        align = roundup_64(align, extsize);
                 else
                         align = extsize;
-                new_last_fsb = roundup_64(*last_fsb, align);
         }
 
-        if (new_last_fsb) {
+        if (align) {
+                xfs_fileoff_t   new_last_fsb = roundup_64(*last_fsb, align);
                 error = xfs_bmap_eof(ip, new_last_fsb, XFS_DATA_FORK, &eof);
                 if (error)
                         return error;
@@ -264,7 +260,6 @@ xfs_iomap_eof_want_preallocate(
 {
         xfs_fileoff_t   start_fsb;
         xfs_filblks_t   count_fsb;
-        xfs_fsblock_t   firstblock;
         int             n, error, imaps;
         int             found_delalloc = 0;
 
@@ -289,7 +284,6 @@ xfs_iomap_eof_want_preallocate(
         count_fsb = XFS_B_TO_FSB(mp, mp->m_super->s_maxbytes);
         while (count_fsb > 0) {
                 imaps = nimaps;
-                firstblock = NULLFSBLOCK;
                 error = xfs_bmapi_read(ip, start_fsb, count_fsb, imap, &imaps,
                                        0);
                 if (error)
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ec6dcdc181ee..c50311cae1b1 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_inode.h"
@@ -37,8 +35,7 @@
 #include "xfs_icache.h"
 #include "xfs_symlink.h"
 #include "xfs_da_btree.h"
-#include "xfs_dir2_priv.h"
-#include "xfs_dinode.h"
+#include "xfs_dir2.h"
 #include "xfs_trans_space.h"
 
 #include <linux/capability.h>
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 894924a5129b..82e314258f73 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -21,9 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_inum.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
@@ -33,7 +30,6 @@
 #include "xfs_error.h"
 #include "xfs_trace.h"
 #include "xfs_icache.h"
-#include "xfs_dinode.h"
 
 STATIC int
 xfs_internal_inum(
@@ -352,7 +348,6 @@ xfs_bulkstat(
         int                     *done)  /* 1 if there are more stats to get */
 {
         xfs_buf_t               *agbp;  /* agi header buffer */
-        xfs_agi_t               *agi;   /* agi header data */
         xfs_agino_t             agino;  /* inode # in allocation group */
         xfs_agnumber_t          agno;   /* allocation group number */
         xfs_btree_cur_t         *cur;   /* btree cursor for ialloc btree */
@@ -403,7 +398,6 @@ xfs_bulkstat(
                 error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
                 if (error)
                         break;
-                agi = XFS_BUF_TO_AGI(agbp);
                 /*
                  * Allocate and initialize a btree cursor for ialloc btree.
                  */
diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
index 6a51619d8690..c31d2c2eadc4 100644
--- a/fs/xfs/xfs_linux.h
+++ b/fs/xfs/xfs_linux.h
@@ -384,4 +384,10 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
 #endif /* XFS_WARN */
 #endif /* DEBUG */
 
+#ifdef CONFIG_XFS_RT
+#define XFS_IS_REALTIME_INODE(ip) ((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME)
+#else
+#define XFS_IS_REALTIME_INODE(ip) (0)
+#endif
+
 #endif /* __XFS_LINUX__ */
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index fe88ef67f93a..e408bf5a3ff7 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_error.h"
 #include "xfs_trans.h"
@@ -1031,7 +1029,7 @@ xfs_log_need_covered(xfs_mount_t *mp)
         struct xlog     *log = mp->m_log;
         int             needed = 0;
 
-        if (!xfs_fs_writable(mp))
+        if (!xfs_fs_writable(mp, SB_FREEZE_WRITE))
                 return 0;
 
         if (!xlog_cil_empty(log))
@@ -1808,6 +1806,8 @@ xlog_sync(
         XFS_BUF_ZEROFLAGS(bp);
         XFS_BUF_ASYNC(bp);
         bp->b_flags |= XBF_SYNCIO;
+        /* use high priority completion wq */
+        bp->b_ioend_wq = log->l_mp->m_log_workqueue;
 
         if (log->l_mp->m_flags & XFS_MOUNT_BARRIER) {
                 bp->b_flags |= XBF_FUA;
@@ -1856,6 +1856,8 @@ xlog_sync(
                 bp->b_flags |= XBF_SYNCIO;
                 if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
                         bp->b_flags |= XBF_FUA;
+                /* use high priority completion wq */
+                bp->b_ioend_wq = log->l_mp->m_log_workqueue;
 
                 ASSERT(XFS_BUF_ADDR(bp) <= log->l_logBBsize-1);
                 ASSERT(XFS_BUF_ADDR(bp) + BTOBB(count) <= log->l_logBBsize);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index f506c457011e..45cc0ce18adf 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -17,11 +17,10 @@
 
 #include "xfs.h"
 #include "xfs_fs.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_shared.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_error.h"
 #include "xfs_alloc.h"
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 00cd7f3a8f59..a5a945fc3bdc 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -22,11 +22,10 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
+#include "xfs_da_btree.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
 #include "xfs_log.h"
@@ -42,7 +41,6 @@
 #include "xfs_trace.h"
 #include "xfs_icache.h"
 #include "xfs_bmap_btree.h"
-#include "xfs_dinode.h"
 #include "xfs_error.h"
 #include "xfs_dir2.h"
 
diff --git a/fs/xfs/xfs_message.c b/fs/xfs/xfs_message.c
index 63ca2f0420b1..d8b67547ab34 100644
--- a/fs/xfs/xfs_message.c
+++ b/fs/xfs/xfs_message.c
@@ -17,10 +17,9 @@
 
 #include "xfs.h"
 #include "xfs_fs.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 
 /*
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 51435dbce9c4..d3d38836f87f 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -22,11 +22,10 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
+#include "xfs_da_btree.h"
 #include "xfs_inode.h"
 #include "xfs_dir2.h"
 #include "xfs_ialloc.h"
@@ -41,7 +40,6 @@
 #include "xfs_fsops.h"
 #include "xfs_trace.h"
 #include "xfs_icache.h"
-#include "xfs_dinode.h"
 #include "xfs_sysfs.h"
 
 
@@ -1074,11 +1072,23 @@ xfs_unmountfs(
         xfs_sysfs_del(&mp->m_kobj);
 }
 
-int
-xfs_fs_writable(xfs_mount_t *mp)
+/*
+ * Determine whether modifications can proceed. The caller specifies the minimum
+ * freeze level for which modifications should not be allowed. This allows
+ * certain operations to proceed while the freeze sequence is in progress, if
+ * necessary.
+ */
+bool
+xfs_fs_writable(
+        struct xfs_mount        *mp,
+        int                     level)
 {
-        return !(mp->m_super->s_writers.frozen || XFS_FORCED_SHUTDOWN(mp) ||
-                (mp->m_flags & XFS_MOUNT_RDONLY));
+        ASSERT(level > SB_UNFROZEN);
+        if ((mp->m_super->s_writers.frozen >= level) ||
+            XFS_FORCED_SHUTDOWN(mp) || (mp->m_flags & XFS_MOUNT_RDONLY))
+                return false;
+
+        return true;
 }
 
 /*
@@ -1086,9 +1096,9 @@ xfs_fs_writable(xfs_mount_t *mp)
  *
  * Sync the superblock counters to disk.
  *
- * Note this code can be called during the process of freezing, so
- * we may need to use the transaction allocator which does not
- * block when the transaction subsystem is in its frozen state.
+ * Note this code can be called during the process of freezing, so we use the
+ * transaction allocator that does not block when the transaction subsystem is
+ * in its frozen state.
  */
 int
 xfs_log_sbcount(xfs_mount_t *mp)
@@ -1096,7 +1106,8 @@ xfs_log_sbcount(xfs_mount_t *mp)
         xfs_trans_t     *tp;
         int             error;
 
-        if (!xfs_fs_writable(mp))
+        /* allow this to proceed during the freeze sequence... */
+        if (!xfs_fs_writable(mp, SB_FREEZE_COMPLETE))
                 return 0;
 
         xfs_icsb_sync_counters(mp, 0);
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index b0447c86e7e2..22ccf69d4d3c 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -168,6 +168,7 @@ typedef struct xfs_mount {
                                                 /* low free space thresholds */
         struct xfs_kobj         m_kobj;
 
+        struct workqueue_struct *m_buf_workqueue;
         struct workqueue_struct *m_data_workqueue;
         struct workqueue_struct *m_unwritten_workqueue;
         struct workqueue_struct *m_cil_workqueue;
@@ -320,10 +321,7 @@ typedef struct xfs_mod_sb {
 
 /*
  * Per-ag incore structure, copies of information in agf and agi, to improve the
- * performance of allocation group selection. This is defined for the kernel
- * only, and hence is defined here instead of in xfs_ag.h. You need the struct
- * xfs_mount to be defined to look up a xfs_perag anyway (via mp->m_perag_tree),
- * so this doesn't introduce any strange header file dependencies.
+ * performance of allocation group selection.
  */
 typedef struct xfs_perag {
         struct xfs_mount *pag_mount;    /* owner filesystem */
@@ -384,7 +382,7 @@ extern int	xfs_mount_log_sb(xfs_mount_t *, __int64_t);
 extern struct xfs_buf *xfs_getsb(xfs_mount_t *, int);
 extern int      xfs_readsb(xfs_mount_t *, int);
 extern void     xfs_freesb(xfs_mount_t *);
-extern int      xfs_fs_writable(xfs_mount_t *);
+extern bool     xfs_fs_writable(struct xfs_mount *mp, int level);
 extern int      xfs_sb_validate_fsb_count(struct xfs_sb *, __uint64_t);
 
 extern int      xfs_dev_is_read_only(struct xfs_mount *, char *);
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index d68f23021af3..79fb19dd9c83 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -23,7 +23,6 @@
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_ialloc.h"
@@ -38,7 +37,6 @@
 #include "xfs_trace.h"
 #include "xfs_icache.h"
 #include "xfs_cksum.h"
-#include "xfs_dinode.h"
 
 /*
  * The global quota manager. There is only one of these for the entire
@@ -1749,23 +1747,21 @@ xfs_qm_vop_dqalloc(
         xfs_iunlock(ip, lockflags);
         if (O_udqpp)
                 *O_udqpp = uq;
-        else if (uq)
+        else
                 xfs_qm_dqrele(uq);
         if (O_gdqpp)
                 *O_gdqpp = gq;
-        else if (gq)
+        else
                 xfs_qm_dqrele(gq);
         if (O_pdqpp)
                 *O_pdqpp = pq;
-        else if (pq)
+        else
                 xfs_qm_dqrele(pq);
         return 0;
 
 error_rele:
-        if (gq)
-                xfs_qm_dqrele(gq);
-        if (uq)
-                xfs_qm_dqrele(uq);
+        xfs_qm_dqrele(gq);
+        xfs_qm_dqrele(uq);
         return error;
 }
 
diff --git a/fs/xfs/xfs_qm_bhv.c b/fs/xfs/xfs_qm_bhv.c
index 2c61e61b0205..3e52d5de7ae1 100644
--- a/fs/xfs/xfs_qm_bhv.c
+++ b/fs/xfs/xfs_qm_bhv.c
@@ -20,8 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_quota.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index 80f2d77d929a..74fca68e43b6 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -26,7 +26,6 @@
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
@@ -784,19 +783,21 @@ xfs_qm_log_quotaoff(
 {
         xfs_trans_t            *tp;
         int                     error;
-        xfs_qoff_logitem_t     *qoffi=NULL;
-        uint                    oldsbqflag=0;
+        xfs_qoff_logitem_t     *qoffi;
+
+        *qoffstartp = NULL;
 
         tp = xfs_trans_alloc(mp, XFS_TRANS_QM_QUOTAOFF);
         error = xfs_trans_reserve(tp, &M_RES(mp)->tr_qm_quotaoff, 0, 0);
-        if (error)
-                goto error0;
+        if (error) {
+                xfs_trans_cancel(tp, 0);
+                goto out;
+        }
 
         qoffi = xfs_trans_get_qoff_item(tp, NULL, flags & XFS_ALL_QUOTA_ACCT);
         xfs_trans_log_quotaoff_item(tp, qoffi);
 
         spin_lock(&mp->m_sb_lock);
-        oldsbqflag = mp->m_sb.sb_qflags;
         mp->m_sb.sb_qflags = (mp->m_qflags & ~(flags)) & XFS_MOUNT_QUOTA_ALL;
         spin_unlock(&mp->m_sb_lock);
 
@@ -809,19 +810,11 @@ xfs_qm_log_quotaoff(
          */
         xfs_trans_set_sync(tp);
         error = xfs_trans_commit(tp, 0);
+        if (error)
+                goto out;
 
-error0:
-        if (error) {
-                xfs_trans_cancel(tp, 0);
-                /*
-                 * No one else is modifying sb_qflags, so this is OK.
-                 * We still hold the quotaofflock.
-                 */
-                spin_lock(&mp->m_sb_lock);
-                mp->m_sb.sb_qflags = oldsbqflag;
-                spin_unlock(&mp->m_sb_lock);
-        }
         *qoffstartp = qoffi;
+out:
         return error;
 }
 
diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
index b238027df987..7542bbeca6a1 100644
--- a/fs/xfs/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -19,8 +19,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_quota.h"
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index e1175ea9b551..f2079b6911cc 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -22,8 +22,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_bmap.h"
@@ -36,7 +34,6 @@
 #include "xfs_trace.h"
 #include "xfs_buf.h"
 #include "xfs_icache.h"
-#include "xfs_dinode.h"
 #include "xfs_rtalloc.h"
 
 
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 206b97fd1d8a..19cbda196369 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -21,9 +21,7 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_inum.h"
 #include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_inode.h"
@@ -44,7 +42,6 @@
 #include "xfs_icache.h"
 #include "xfs_trace.h"
 #include "xfs_icreate_item.h"
-#include "xfs_dinode.h"
 #include "xfs_filestream.h"
 #include "xfs_quota.h"
 #include "xfs_sysfs.h"
@@ -796,8 +793,7 @@ xfs_open_devices(
  out_free_ddev_targ:
         xfs_free_buftarg(mp, mp->m_ddev_targp);
  out_close_rtdev:
-        if (rtdev)
-                xfs_blkdev_put(rtdev);
+        xfs_blkdev_put(rtdev);
  out_close_logdev:
         if (logdev && logdev != ddev)
                 xfs_blkdev_put(logdev);
@@ -842,10 +838,15 @@ STATIC int
 xfs_init_mount_workqueues(
         struct xfs_mount        *mp)
 {
+        mp->m_buf_workqueue = alloc_workqueue("xfs-buf/%s",
+                        WQ_MEM_RECLAIM|WQ_FREEZABLE, 1, mp->m_fsname);
+        if (!mp->m_buf_workqueue)
+                goto out;
+
         mp->m_data_workqueue = alloc_workqueue("xfs-data/%s",
                         WQ_MEM_RECLAIM|WQ_FREEZABLE, 0, mp->m_fsname);
         if (!mp->m_data_workqueue)
-                goto out;
+                goto out_destroy_buf;
 
         mp->m_unwritten_workqueue = alloc_workqueue("xfs-conv/%s",
                         WQ_MEM_RECLAIM|WQ_FREEZABLE, 0, mp->m_fsname);
@@ -863,7 +864,7 @@ xfs_init_mount_workqueues(
                 goto out_destroy_cil;
 
         mp->m_log_workqueue = alloc_workqueue("xfs-log/%s",
-                        WQ_FREEZABLE, 0, mp->m_fsname);
+                        WQ_FREEZABLE|WQ_HIGHPRI, 0, mp->m_fsname);
         if (!mp->m_log_workqueue)
                 goto out_destroy_reclaim;
 
@@ -884,6 +885,8 @@ out_destroy_unwritten:
         destroy_workqueue(mp->m_unwritten_workqueue);
 out_destroy_data_iodone_queue:
         destroy_workqueue(mp->m_data_workqueue);
+out_destroy_buf:
+        destroy_workqueue(mp->m_buf_workqueue);
 out:
         return -ENOMEM;
 }
@@ -898,6 +901,7 @@ xfs_destroy_mount_workqueues(
         destroy_workqueue(mp->m_cil_workqueue);
         destroy_workqueue(mp->m_data_workqueue);
         destroy_workqueue(mp->m_unwritten_workqueue);
+        destroy_workqueue(mp->m_buf_workqueue);
 }
 
 /*
@@ -1000,7 +1004,6 @@ xfs_fs_evict_inode(
         clear_inode(inode);
         XFS_STATS_INC(vn_rele);
         XFS_STATS_INC(vn_remove);
-        XFS_STATS_DEC(vn_active);
 
         xfs_inactive(ip);
 }
diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
index 02ae62a998e0..25791df6f638 100644
--- a/fs/xfs/xfs_symlink.c
+++ b/fs/xfs/xfs_symlink.c
@@ -23,8 +23,6 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
@@ -42,7 +40,6 @@
 #include "xfs_symlink.h"
 #include "xfs_trans.h"
 #include "xfs_log.h"
-#include "xfs_dinode.h"
 
 /* ----- Kernel only functions below ----- */
 STATIC int
diff --git a/fs/xfs/xfs_trace.c b/fs/xfs/xfs_trace.c
index 1e85bcd0e418..13a029806805 100644
--- a/fs/xfs/xfs_trace.c
+++ b/fs/xfs/xfs_trace.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_inode.h"
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 30e8e3410955..fa3135b9bf04 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -22,8 +22,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_extent_busy.h"
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 859482f53b5a..573aefb5a573 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -18,10 +18,9 @@
  */
 #include "xfs.h"
 #include "xfs_fs.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_trans.h"
 #include "xfs_trans_priv.h"
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index e2b2216b1635..0a4d4ab6d9a9 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
@@ -229,13 +227,6 @@ xfs_trans_getsb(xfs_trans_t	*tp,
         return bp;
 }
 
-#ifdef DEBUG
-xfs_buftarg_t *xfs_error_target;
-int     xfs_do_error;
-int     xfs_req_num;
-int     xfs_error_mod = 33;
-#endif
-
 /*
  * Get and lock the buffer for the caller if it is not already
  * locked within the given transaction.  If it has not yet been
@@ -257,46 +248,11 @@ xfs_trans_read_buf_map(
         struct xfs_buf          **bpp,
         const struct xfs_buf_ops *ops)
 {
-        xfs_buf_t               *bp;
-        xfs_buf_log_item_t      *bip;
+        struct xfs_buf          *bp = NULL;
+        struct xfs_buf_log_item *bip;
         int                     error;
 
         *bpp = NULL;
-        if (!tp) {
-                bp = xfs_buf_read_map(target, map, nmaps, flags, ops);
-                if (!bp)
-                        return (flags & XBF_TRYLOCK) ?
-                                        -EAGAIN : -ENOMEM;
-
-                if (bp->b_error) {
-                        error = bp->b_error;
-                        xfs_buf_ioerror_alert(bp, __func__);
-                        XFS_BUF_UNDONE(bp);
-                        xfs_buf_stale(bp);
-                        xfs_buf_relse(bp);
-
-                        /* bad CRC means corrupted metadata */
-                        if (error == -EFSBADCRC)
-                                error = -EFSCORRUPTED;
-                        return error;
-                }
-#ifdef DEBUG
-                if (xfs_do_error) {
-                        if (xfs_error_target == target) {
-                                if (((xfs_req_num++) % xfs_error_mod) == 0) {
-                                        xfs_buf_relse(bp);
-                                        xfs_debug(mp, "Returning error!");
-                                        return -EIO;
-                                }
-                        }
-                }
-#endif
-                if (XFS_FORCED_SHUTDOWN(mp))
-                        goto shutdown_abort;
-                *bpp = bp;
-                return 0;
-        }
-
         /*
          * If we find the buffer in the cache with this transaction
          * pointer in its b_fsprivate2 field, then we know we already
@@ -305,49 +261,24 @@ xfs_trans_read_buf_map(
          * If the buffer is not yet read in, then we read it in, increment
          * the lock recursion count, and return it to the caller.
          */
-        bp = xfs_trans_buf_item_match(tp, target, map, nmaps);
-        if (bp != NULL) {
+        if (tp)
+                bp = xfs_trans_buf_item_match(tp, target, map, nmaps);
+        if (bp) {
                 ASSERT(xfs_buf_islocked(bp));
                 ASSERT(bp->b_transp == tp);
                 ASSERT(bp->b_fspriv != NULL);
                 ASSERT(!bp->b_error);
-                if (!(XFS_BUF_ISDONE(bp))) {
-                        trace_xfs_trans_read_buf_io(bp, _RET_IP_);
-                        ASSERT(!XFS_BUF_ISASYNC(bp));
-                        ASSERT(bp->b_iodone == NULL);
-                        XFS_BUF_READ(bp);
-                        bp->b_ops = ops;
-
-                        error = xfs_buf_submit_wait(bp);
-                        if (error) {
-                                if (!XFS_FORCED_SHUTDOWN(mp))
-                                        xfs_buf_ioerror_alert(bp, __func__);
-                                xfs_buf_relse(bp);
-                                /*
-                                 * We can gracefully recover from most read
-                                 * errors. Ones we can't are those that happen
-                                 * after the transaction's already dirty.
-                                 */
-                                if (tp->t_flags & XFS_TRANS_DIRTY)
-                                        xfs_force_shutdown(tp->t_mountp,
-                                                        SHUTDOWN_META_IO_ERROR);
-                                /* bad CRC means corrupted metadata */
-                                if (error == -EFSBADCRC)
-                                        error = -EFSCORRUPTED;
-                                return error;
-                        }
-                }
+                ASSERT(bp->b_flags & XBF_DONE);
+
                 /*
                  * We never locked this buf ourselves, so we shouldn't
                  * brelse it either. Just get out.
                  */
                 if (XFS_FORCED_SHUTDOWN(mp)) {
                         trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
-                        *bpp = NULL;
                         return -EIO;
                 }
 
-
                 bip = bp->b_fspriv;
                 bip->bli_recur++;
 
@@ -358,17 +289,29 @@ xfs_trans_read_buf_map(
         }
 
         bp = xfs_buf_read_map(target, map, nmaps, flags, ops);
-        if (bp == NULL) {
-                *bpp = NULL;
-                return (flags & XBF_TRYLOCK) ?
-                                        0 : -ENOMEM;
+        if (!bp) {
+                if (!(flags & XBF_TRYLOCK))
+                        return -ENOMEM;
+                return tp ? 0 : -EAGAIN;
         }
+
+        /*
+         * If we've had a read error, then the contents of the buffer are
+         * invalid and should not be used. To ensure that a followup read tries
+         * to pull the buffer from disk again, we clear the XBF_DONE flag and
+         * mark the buffer stale. This ensures that anyone who has a current
+         * reference to the buffer will interpret it's contents correctly and
+         * future cache lookups will also treat it as an empty, uninitialised
+         * buffer.
+         */
         if (bp->b_error) {
                 error = bp->b_error;
+                if (!XFS_FORCED_SHUTDOWN(mp))
+                        xfs_buf_ioerror_alert(bp, __func__);
+                bp->b_flags &= ~XBF_DONE;
                 xfs_buf_stale(bp);
-                XFS_BUF_DONE(bp);
-                xfs_buf_ioerror_alert(bp, __func__);
-                if (tp->t_flags & XFS_TRANS_DIRTY)
+
+                if (tp && (tp->t_flags & XFS_TRANS_DIRTY))
                         xfs_force_shutdown(tp->t_mountp, SHUTDOWN_META_IO_ERROR);
                 xfs_buf_relse(bp);
 
@@ -377,33 +320,19 @@ xfs_trans_read_buf_map(
                         error = -EFSCORRUPTED;
                 return error;
         }
-#ifdef DEBUG
-        if (xfs_do_error && !(tp->t_flags & XFS_TRANS_DIRTY)) {
-                if (xfs_error_target == target) {
-                        if (((xfs_req_num++) % xfs_error_mod) == 0) {
-                                xfs_force_shutdown(tp->t_mountp,
-                                                   SHUTDOWN_META_IO_ERROR);
-                                xfs_buf_relse(bp);
-                                xfs_debug(mp, "Returning trans error!");
-                                return -EIO;
-                        }
-                }
+
+        if (XFS_FORCED_SHUTDOWN(mp)) {
+                xfs_buf_relse(bp);
+                trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
+                return -EIO;
         }
-#endif
-        if (XFS_FORCED_SHUTDOWN(mp))
-                goto shutdown_abort;
 
-        _xfs_trans_bjoin(tp, bp, 1);
+        if (tp)
+                _xfs_trans_bjoin(tp, bp, 1);
         trace_xfs_trans_read_buf(bp->b_fspriv);
-
         *bpp = bp;
         return 0;
 
-shutdown_abort:
-        trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
-        xfs_buf_relse(bp);
-        *bpp = NULL;
-        return -EIO;
 }
 
 /*
diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index 846e061c2e98..76a16df55ef7 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_error.h"
diff --git a/fs/xfs/xfs_trans_extfree.c b/fs/xfs/xfs_trans_extfree.c
index 47978ba89dae..284397dd7990 100644
--- a/fs/xfs/xfs_trans_extfree.c
+++ b/fs/xfs/xfs_trans_extfree.c
@@ -18,10 +18,9 @@
 #include "xfs.h"
 #include "xfs_fs.h"
 #include "xfs_shared.h"
+#include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_trans.h"
 #include "xfs_trans_priv.h"
diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
index cdb4d86520e1..17280cd71934 100644
--- a/fs/xfs/xfs_trans_inode.c
+++ b/fs/xfs/xfs_trans_inode.c
@@ -21,8 +21,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_inode.h"
 #include "xfs_trans.h"
diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c
index 93455b998041..69f6e475de97 100644
--- a/fs/xfs/xfs_xattr.c
+++ b/fs/xfs/xfs_xattr.c
@@ -20,8 +20,6 @@
 #include "xfs_format.h"
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
 #include "xfs_mount.h"
 #include "xfs_da_format.h"
 #include "xfs_inode.h"
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 752e30d63904..177d5973b132 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -103,6 +103,17 @@ static inline pmd_t pmdp_get_and_clear(struct mm_struct *mm,
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 #endif
 
+#ifndef __HAVE_ARCH_PMDP_GET_AND_CLEAR_FULL
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline pmd_t pmdp_get_and_clear_full(struct mm_struct *mm,
+                                            unsigned long address, pmd_t *pmdp,
+                                            int full)
+{
+        return pmdp_get_and_clear(mm, address, pmdp);
+}
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+#endif
+
 #ifndef __HAVE_ARCH_PTEP_GET_AND_CLEAR_FULL
 static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm,
                                             unsigned long address, pte_t *ptep,
diff --git a/include/dt-bindings/dma/at91.h b/include/dt-bindings/dma/at91.h
index e835037a77b4..ab6cbba45401 100644
--- a/include/dt-bindings/dma/at91.h
+++ b/include/dt-bindings/dma/at91.h
@@ -9,6 +9,8 @@
 #ifndef __DT_BINDINGS_AT91_DMA_H__
 #define __DT_BINDINGS_AT91_DMA_H__
 
+/* ---------- HDMAC ---------- */
+
 /*
  * Source and/or destination peripheral ID
  */
@@ -24,4 +26,27 @@
 #define AT91_DMA_CFG_FIFOCFG_ALAP       (0x1 << AT91_DMA_CFG_FIFOCFG_OFFSET)    /* largest defined AHB burst */
 #define AT91_DMA_CFG_FIFOCFG_ASAP       (0x2 << AT91_DMA_CFG_FIFOCFG_OFFSET)    /* single AHB access */
 
+
+/* ---------- XDMAC ---------- */
+#define AT91_XDMAC_DT_MEM_IF_MASK       (0x1)
+#define AT91_XDMAC_DT_MEM_IF_OFFSET     (13)
+#define AT91_XDMAC_DT_MEM_IF(mem_if)    (((mem_if) & AT91_XDMAC_DT_MEM_IF_MASK) \
+                                        << AT91_XDMAC_DT_MEM_IF_OFFSET)
+#define AT91_XDMAC_DT_GET_MEM_IF(cfg)   (((cfg) >> AT91_XDMAC_DT_MEM_IF_OFFSET) \
+                                        & AT91_XDMAC_DT_MEM_IF_MASK)
+
+#define AT91_XDMAC_DT_PER_IF_MASK       (0x1)
+#define AT91_XDMAC_DT_PER_IF_OFFSET     (14)
+#define AT91_XDMAC_DT_PER_IF(per_if)    (((per_if) & AT91_XDMAC_DT_PER_IF_MASK) \
+                                        << AT91_XDMAC_DT_PER_IF_OFFSET)
+#define AT91_XDMAC_DT_GET_PER_IF(cfg)   (((cfg) >> AT91_XDMAC_DT_PER_IF_OFFSET) \
+                                        & AT91_XDMAC_DT_PER_IF_MASK)
+
+#define AT91_XDMAC_DT_PERID_MASK        (0x7f)
+#define AT91_XDMAC_DT_PERID_OFFSET      (24)
+#define AT91_XDMAC_DT_PERID(perid)      (((perid) & AT91_XDMAC_DT_PERID_MASK) \
+                                        << AT91_XDMAC_DT_PERID_OFFSET)
+#define AT91_XDMAC_DT_GET_PERID(cfg)    (((cfg) >> AT91_XDMAC_DT_PERID_OFFSET) \
+                                        & AT91_XDMAC_DT_PERID_MASK)
+
 #endif /* __DT_BINDINGS_AT91_DMA_H__ */
diff --git a/include/dt-bindings/interrupt-controller/mips-gic.h b/include/dt-bindings/interrupt-controller/mips-gic.h
new file mode 100644
index 000000000000..cf35a577e371
--- /dev/null
+++ b/include/dt-bindings/interrupt-controller/mips-gic.h
@@ -0,0 +1,9 @@
+#ifndef _DT_BINDINGS_INTERRUPT_CONTROLLER_MIPS_GIC_H
+#define _DT_BINDINGS_INTERRUPT_CONTROLLER_MIPS_GIC_H
+
+#include <dt-bindings/interrupt-controller/irq.h>
+
+#define GIC_SHARED 0
+#define GIC_LOCAL 1
+
+#endif
diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h
index c324f5700d1a..ac02f9bd63dc 100644
--- a/include/linux/amba/bus.h
+++ b/include/linux/amba/bus.h
@@ -97,6 +97,16 @@ void amba_release_regions(struct amba_device *);
 #define amba_pclk_disable(d)    \
         do { if (!IS_ERR((d)->pclk)) clk_disable((d)->pclk); } while (0)
 
+static inline int amba_pclk_prepare(struct amba_device *dev)
+{
+        return clk_prepare(dev->pclk);
+}
+
+static inline void amba_pclk_unprepare(struct amba_device *dev)
+{
+        clk_unprepare(dev->pclk);
+}
+
 /* Some drivers don't use the struct amba_device */
 #define AMBA_CONFIG_BITS(a) (((a) >> 24) & 0xff)
 #define AMBA_REV_BITS(a) (((a) >> 20) & 0x0f)
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 641e56494a92..da0dae0600e6 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -638,8 +638,10 @@ struct cgroup_subsys {
         struct cgroup_subsys_state *(*css_alloc)(struct cgroup_subsys_state *parent_css);
         int (*css_online)(struct cgroup_subsys_state *css);
         void (*css_offline)(struct cgroup_subsys_state *css);
+        void (*css_released)(struct cgroup_subsys_state *css);
         void (*css_free)(struct cgroup_subsys_state *css);
         void (*css_reset)(struct cgroup_subsys_state *css);
+        void (*css_e_css_changed)(struct cgroup_subsys_state *css);
 
         int (*can_attach)(struct cgroup_subsys_state *css,
                           struct cgroup_taskset *tset);
@@ -934,6 +936,8 @@ void css_task_iter_end(struct css_task_iter *it);
 int cgroup_attach_task_all(struct task_struct *from, struct task_struct *);
 int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from);
 
+struct cgroup_subsys_state *cgroup_get_e_css(struct cgroup *cgroup,
+                                             struct cgroup_subsys *ss);
 struct cgroup_subsys_state *css_tryget_online_from_dir(struct dentry *dentry,
                                                        struct cgroup_subsys *ss);
 
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index 2f073db7392e..1b357997cac5 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -48,29 +48,16 @@ extern nodemask_t cpuset_mems_allowed(struct task_struct *p);
 void cpuset_init_current_mems_allowed(void);
 int cpuset_nodemask_valid_mems_allowed(nodemask_t *nodemask);
 
-extern int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask);
-extern int __cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask);
+extern int __cpuset_node_allowed(int node, gfp_t gfp_mask);
 
-static inline int cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
+static inline int cpuset_node_allowed(int node, gfp_t gfp_mask)
 {
-        return nr_cpusets() <= 1 ||
-                __cpuset_node_allowed_softwall(node, gfp_mask);
+        return nr_cpusets() <= 1 || __cpuset_node_allowed(node, gfp_mask);
 }
 
-static inline int cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask)
+static inline int cpuset_zone_allowed(struct zone *z, gfp_t gfp_mask)
 {
-        return nr_cpusets() <= 1 ||
-                __cpuset_node_allowed_hardwall(node, gfp_mask);
-}
-
-static inline int cpuset_zone_allowed_softwall(struct zone *z, gfp_t gfp_mask)
-{
-        return cpuset_node_allowed_softwall(zone_to_nid(z), gfp_mask);
-}
-
-static inline int cpuset_zone_allowed_hardwall(struct zone *z, gfp_t gfp_mask)
-{
-        return cpuset_node_allowed_hardwall(zone_to_nid(z), gfp_mask);
+        return cpuset_node_allowed(zone_to_nid(z), gfp_mask);
 }
 
 extern int cpuset_mems_allowed_intersects(const struct task_struct *tsk1,
@@ -179,22 +166,12 @@ static inline int cpuset_nodemask_valid_mems_allowed(nodemask_t *nodemask)
         return 1;
 }
 
-static inline int cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
-{
-        return 1;
-}
-
-static inline int cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask)
-{
-        return 1;
-}
-
-static inline int cpuset_zone_allowed_softwall(struct zone *z, gfp_t gfp_mask)
+static inline int cpuset_node_allowed(int node, gfp_t gfp_mask)
 {
         return 1;
 }
 
-static inline int cpuset_zone_allowed_hardwall(struct zone *z, gfp_t gfp_mask)
+static inline int cpuset_zone_allowed(struct zone *z, gfp_t gfp_mask)
 {
         return 1;
 }
diff --git a/include/linux/device.h b/include/linux/device.h
index ce1f21608b16..41d6a7555c6b 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -911,6 +911,11 @@ static inline void device_unlock(struct device *dev)
         mutex_unlock(&dev->mutex);
 }
 
+static inline void device_lock_assert(struct device *dev)
+{
+        lockdep_assert_held(&dev->mutex);
+}
+
 void driver_init(void);
 
 /*
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 653a1fd07ae8..40cd75e21ea2 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -447,7 +447,8 @@ struct dmaengine_unmap_data {
  *      communicate status
  * @phys: physical address of the descriptor
  * @chan: target channel for this operation
- * @tx_submit: set the prepared descriptor(s) to be executed by the engine
+ * @tx_submit: accept the descriptor, assign ordered cookie and mark the
+ * descriptor pending. To be pushed on .issue_pending() call
  * @callback: routine to call after this operation is complete
  * @callback_param: general parameter to pass to the callback routine
  * ---async_tx api specific fields---
diff --git a/include/linux/dmar.h b/include/linux/dmar.h
index 593fff99e6bf..30624954dec5 100644
--- a/include/linux/dmar.h
+++ b/include/linux/dmar.h
@@ -30,6 +30,12 @@
 
 struct acpi_dmar_header;
 
+#ifdef  CONFIG_X86
+# define        DMAR_UNITS_SUPPORTED    MAX_IO_APICS
+#else
+# define        DMAR_UNITS_SUPPORTED    64
+#endif
+
 /* DMAR Flags */
 #define DMAR_INTR_REMAP         0x1
 #define DMAR_X2APIC_OPT_OUT     0x2
@@ -120,28 +126,60 @@ extern int dmar_remove_dev_scope(struct dmar_pci_notify_info *info,
 /* Intel IOMMU detection */
 extern int detect_intel_iommu(void);
 extern int enable_drhd_fault_handling(void);
+extern int dmar_device_add(acpi_handle handle);
+extern int dmar_device_remove(acpi_handle handle);
+
+static inline int dmar_res_noop(struct acpi_dmar_header *hdr, void *arg)
+{
+        return 0;
+}
 
 #ifdef CONFIG_INTEL_IOMMU
 extern int iommu_detected, no_iommu;
 extern int intel_iommu_init(void);
-extern int dmar_parse_one_rmrr(struct acpi_dmar_header *header);
-extern int dmar_parse_one_atsr(struct acpi_dmar_header *header);
+extern int dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg);
+extern int dmar_parse_one_atsr(struct acpi_dmar_header *header, void *arg);
+extern int dmar_check_one_atsr(struct acpi_dmar_header *hdr, void *arg);
+extern int dmar_release_one_atsr(struct acpi_dmar_header *hdr, void *arg);
+extern int dmar_iommu_hotplug(struct dmar_drhd_unit *dmaru, bool insert);
 extern int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info);
 #else /* !CONFIG_INTEL_IOMMU: */
 static inline int intel_iommu_init(void) { return -ENODEV; }
-static inline int dmar_parse_one_rmrr(struct acpi_dmar_header *header)
+
+#define dmar_parse_one_rmrr             dmar_res_noop
+#define dmar_parse_one_atsr             dmar_res_noop
+#define dmar_check_one_atsr             dmar_res_noop
+#define dmar_release_one_atsr           dmar_res_noop
+
+static inline int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
 {
         return 0;
 }
-static inline int dmar_parse_one_atsr(struct acpi_dmar_header *header)
+
+static inline int dmar_iommu_hotplug(struct dmar_drhd_unit *dmaru, bool insert)
 {
         return 0;
 }
-static inline int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
+#endif /* CONFIG_INTEL_IOMMU */
+
+#ifdef CONFIG_IRQ_REMAP
+extern int dmar_ir_hotplug(struct dmar_drhd_unit *dmaru, bool insert);
+#else  /* CONFIG_IRQ_REMAP */
+static inline int dmar_ir_hotplug(struct dmar_drhd_unit *dmaru, bool insert)
+{ return 0; }
+#endif /* CONFIG_IRQ_REMAP */
+
+#else /* CONFIG_DMAR_TABLE */
+
+static inline int dmar_device_add(void *handle)
+{
+        return 0;
+}
+
+static inline int dmar_device_remove(void *handle)
 {
         return 0;
 }
-#endif /* CONFIG_INTEL_IOMMU */
 
 #endif /* CONFIG_DMAR_TABLE */
 
diff --git a/include/linux/elf.h b/include/linux/elf.h
index 67a5fa7830c4..20fa8d8ae313 100644
--- a/include/linux/elf.h
+++ b/include/linux/elf.h
@@ -15,6 +15,11 @@
         set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
 #endif
 
+#ifndef SET_PERSONALITY2
+#define SET_PERSONALITY2(ex, state) \
+        SET_PERSONALITY(ex)
+#endif
+
 #if ELF_CLASS == ELFCLASS32
 
 extern Elf32_Dyn _DYNAMIC [];
diff --git a/include/linux/fence.h b/include/linux/fence.h
index d174585b874b..39efee130d2b 100644
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -128,8 +128,8 @@ struct fence_cb {
  * from irq context, so normal spinlocks can be used.
  *
  * A return value of false indicates the fence already passed,
- * or some failure occured that made it impossible to enable
- * signaling. True indicates succesful enabling.
+ * or some failure occurred that made it impossible to enable
+ * signaling. True indicates successful enabling.
  *
  * fence->status may be set in enable_signaling, but only when false is
  * returned.
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 78ea9bf941cd..06c4607744f6 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -234,6 +234,33 @@ struct hid_item {
 #define HID_DG_BARRELSWITCH     0x000d0044
 #define HID_DG_ERASER           0x000d0045
 #define HID_DG_TABLETPICK       0x000d0046
+
+#define HID_CP_CONSUMERCONTROL  0x000c0001
+#define HID_CP_NUMERICKEYPAD    0x000c0002
+#define HID_CP_PROGRAMMABLEBUTTONS      0x000c0003
+#define HID_CP_MICROPHONE       0x000c0004
+#define HID_CP_HEADPHONE        0x000c0005
+#define HID_CP_GRAPHICEQUALIZER 0x000c0006
+#define HID_CP_FUNCTIONBUTTONS  0x000c0036
+#define HID_CP_SELECTION        0x000c0080
+#define HID_CP_MEDIASELECTION   0x000c0087
+#define HID_CP_SELECTDISC       0x000c00ba
+#define HID_CP_PLAYBACKSPEED    0x000c00f1
+#define HID_CP_PROXIMITY        0x000c0109
+#define HID_CP_SPEAKERSYSTEM    0x000c0160
+#define HID_CP_CHANNELLEFT      0x000c0161
+#define HID_CP_CHANNELRIGHT     0x000c0162
+#define HID_CP_CHANNELCENTER    0x000c0163
+#define HID_CP_CHANNELFRONT     0x000c0164
+#define HID_CP_CHANNELCENTERFRONT       0x000c0165
+#define HID_CP_CHANNELSIDE      0x000c0166
+#define HID_CP_CHANNELSURROUND  0x000c0167
+#define HID_CP_CHANNELLOWFREQUENCYENHANCEMENT   0x000c0168
+#define HID_CP_CHANNELTOP       0x000c0169
+#define HID_CP_CHANNELUNKNOWN   0x000c016a
+#define HID_CP_APPLICATIONLAUNCHBUTTONS 0x000c0180
+#define HID_CP_GENERICGUIAPPLICATIONCONTROLS    0x000c0200
+
 #define HID_DG_CONFIDENCE       0x000d0047
 #define HID_DG_WIDTH            0x000d0048
 #define HID_DG_HEIGHT           0x000d0049
@@ -312,11 +339,8 @@ struct hid_item {
  * Vendor specific HID device groups
  */
 #define HID_GROUP_RMI                           0x0100
-
-/*
- * Vendor specific HID device groups
- */
 #define HID_GROUP_WACOM                         0x0101
+#define HID_GROUP_LOGITECH_DJ_DEVICE            0x0102
 
 /*
  * This is the global environment of the parser. This information is
@@ -1063,6 +1087,17 @@ static inline void hid_hw_wait(struct hid_device *hdev)
                 hdev->ll_driver->wait(hdev);
 }
 
+/**
+ * hid_report_len - calculate the report length
+ *
+ * @report: the report we want to know the length
+ */
+static inline int hid_report_len(struct hid_report *report)
+{
+        /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
+        return ((report->size - 1) >> 3) + 1 + (report->id > 0);
+}
+
 int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
                 int interrupt);
 
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index cdd149ca5cc0..431b7fc605c9 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -175,6 +175,52 @@ static inline void __unmap_hugepage_range(struct mmu_gather *tlb,
 }
 
 #endif /* !CONFIG_HUGETLB_PAGE */
+/*
+ * hugepages at page global directory. If arch support
+ * hugepages at pgd level, they need to define this.
+ */
+#ifndef pgd_huge
+#define pgd_huge(x)     0
+#endif
+
+#ifndef pgd_write
+static inline int pgd_write(pgd_t pgd)
+{
+        BUG();
+        return 0;
+}
+#endif
+
+#ifndef pud_write
+static inline int pud_write(pud_t pud)
+{
+        BUG();
+        return 0;
+}
+#endif
+
+#ifndef is_hugepd
+/*
+ * Some architectures requires a hugepage directory format that is
+ * required to support multiple hugepage sizes. For example
+ * a4fe3ce76 "powerpc/mm: Allow more flexible layouts for hugepage pagetables"
+ * introduced the same on powerpc. This allows for a more flexible hugepage
+ * pagetable layout.
+ */
+typedef struct { unsigned long pd; } hugepd_t;
+#define is_hugepd(hugepd) (0)
+#define __hugepd(x) ((hugepd_t) { (x) })
+static inline int gup_huge_pd(hugepd_t hugepd, unsigned long addr,
+                              unsigned pdshift, unsigned long end,
+                              int write, struct page **pages, int *nr)
+{
+        return 0;
+}
+#else
+extern int gup_huge_pd(hugepd_t hugepd, unsigned long addr,
+                       unsigned pdshift, unsigned long end,
+                       int write, struct page **pages, int *nr);
+#endif
 
 #define HUGETLB_ANON_FILE "anon_hugepage"
 
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index b556e0ab946f..70ee0d3a2be3 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -359,7 +359,7 @@ i2c_register_board_info(int busnum, struct i2c_board_info const *info,
  * to name two of the most common.
  *
  * The return codes from the @master_xfer field should indicate the type of
- * error code that occured during the transfer, as documented in the kernel
+ * error code that occurred during the transfer, as documented in the kernel
  * Documentation file Documentation/i2c/fault-codes.
  */
 struct i2c_algorithm {
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index b29a5982e1c3..7a7bd15e54f1 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -28,7 +28,7 @@
 #define IOMMU_READ      (1 << 0)
 #define IOMMU_WRITE     (1 << 1)
 #define IOMMU_CACHE     (1 << 2) /* DMA cache coherency */
-#define IOMMU_EXEC      (1 << 3)
+#define IOMMU_NOEXEC    (1 << 3)
 
 struct iommu_ops;
 struct iommu_group;
@@ -62,6 +62,7 @@ enum iommu_cap {
         IOMMU_CAP_CACHE_COHERENCY,      /* IOMMU can enforce cache coherent DMA
                                            transactions */
         IOMMU_CAP_INTR_REMAP,           /* IOMMU supports interrupt isolation */
+        IOMMU_CAP_NOEXEC,               /* IOMMU_NOEXEC flag */
 };
 
 /*
diff --git a/include/linux/ipmi.h b/include/linux/ipmi.h
index 76d2acbfa7c6..838dbfa3c331 100644
--- a/include/linux/ipmi.h
+++ b/include/linux/ipmi.h
@@ -37,6 +37,7 @@
 
 #include <linux/list.h>
 #include <linux/proc_fs.h>
+#include <linux/acpi.h> /* For acpi_handle */
 
 struct module;
 struct device;
@@ -278,15 +279,18 @@ enum ipmi_addr_src {
         SI_INVALID = 0, SI_HOTMOD, SI_HARDCODED, SI_SPMI, SI_ACPI, SI_SMBIOS,
         SI_PCI, SI_DEVICETREE, SI_DEFAULT
 };
+const char *ipmi_addr_src_to_str(enum ipmi_addr_src src);
 
 union ipmi_smi_info_union {
+#ifdef CONFIG_ACPI
         /*
          * the acpi_info element is defined for the SI_ACPI
          * address type
          */
         struct {
-                void *acpi_handle;
+                acpi_handle acpi_handle;
         } acpi_info;
+#endif
 };
 
 struct ipmi_smi_info {
diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h
index bd349240d50e..0b1e569f5ff5 100644
--- a/include/linux/ipmi_smi.h
+++ b/include/linux/ipmi_smi.h
@@ -98,12 +98,11 @@ struct ipmi_smi_handlers {
            operation is not allowed to fail.  If an error occurs, it
            should report back the error in a received message.  It may
            do this in the current call context, since no write locks
-           are held when this is run.  If the priority is > 0, the
-           message will go into a high-priority queue and be sent
-           first.  Otherwise, it goes into a normal-priority queue. */
+           are held when this is run.  Message are delivered one at
+           a time by the message handler, a new message will not be
+           delivered until the previous message is returned. */
         void (*sender)(void                *send_info,
-                       struct ipmi_smi_msg *msg,
-                       int                 priority);
+                       struct ipmi_smi_msg *msg);
 
         /* Called by the upper layer to request that we try to get
            events from the BMC we are attached to. */
@@ -212,7 +211,6 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                       void                     *send_info,
                       struct ipmi_device_id    *device_id,
                       struct device            *dev,
-                      const char               *sysfs_name,
                       unsigned char            slave_addr);
 
 /*
diff --git a/arch/mips/include/asm/gic.h b/include/linux/irqchip/mips-gic.h
index d7699cf7e135..420f77b34d02 100644
--- a/arch/mips/include/asm/gic.h
+++ b/include/linux/irqchip/mips-gic.h
@@ -4,57 +4,26 @@
  * for more details.
  *
  * Copyright (C) 2000, 07 MIPS Technologies, Inc.
- *
- * GIC Register Definitions
- *
  */
-#ifndef _ASM_GICREGS_H
-#define _ASM_GICREGS_H
-
-#include <linux/bitmap.h>
-#include <linux/threads.h>
+#ifndef __LINUX_IRQCHIP_MIPS_GIC_H
+#define __LINUX_IRQCHIP_MIPS_GIC_H
 
-#include <irq.h>
+#include <linux/clocksource.h>
 
-#undef  GICISBYTELITTLEENDIAN
+#define GIC_MAX_INTRS                   256
 
 /* Constants */
 #define GIC_POL_POS                     1
 #define GIC_POL_NEG                     0
 #define GIC_TRIG_EDGE                   1
 #define GIC_TRIG_LEVEL                  0
+#define GIC_TRIG_DUAL_ENABLE            1
+#define GIC_TRIG_DUAL_DISABLE           0
 
 #define MSK(n) ((1 << (n)) - 1)
-#define REG32(addr)             (*(volatile unsigned int *) (addr))
-#define REG(base, offs)         REG32((unsigned long)(base) + offs##_##OFS)
-#define REGP(base, phys)        REG32((unsigned long)(base) + (phys))
 
 /* Accessors */
-#define GIC_REG(segment, offset) \
-        REG32(_gic_base + segment##_##SECTION_OFS + offset##_##OFS)
-#define GIC_REG_ADDR(segment, offset) \
-        REG32(_gic_base + segment##_##SECTION_OFS + offset)
-
-#define GIC_ABS_REG(segment, offset) \
-        (_gic_base + segment##_##SECTION_OFS + offset##_##OFS)
-#define GIC_REG_ABS_ADDR(segment, offset) \
-        (_gic_base + segment##_##SECTION_OFS + offset)
-
-#ifdef GICISBYTELITTLEENDIAN
-#define GICREAD(reg, data)      ((data) = (reg), (data) = le32_to_cpu(data))
-#define GICWRITE(reg, data)     ((reg) = cpu_to_le32(data))
-#else
-#define GICREAD(reg, data)      ((data) = (reg))
-#define GICWRITE(reg, data)     ((reg) = (data))
-#endif
-#define GICBIS(reg, mask, bits)                 \
-        do { u32 data;                          \
-                GICREAD(reg, data);             \
-                data &= ~(mask);                \
-                data |= ((bits) & (mask));      \
-                GICWRITE((reg), data);          \
-        } while (0)
-
+#define GIC_REG(segment, offset) (segment##_##SECTION_OFS + offset##_##OFS)
 
 /* GIC Address Space */
 #define SHARED_SECTION_OFS              0x0000
@@ -75,120 +44,42 @@
 #define GIC_SH_COUNTER_63_32_OFS        0x0014
 #define GIC_SH_REVISIONID_OFS           0x0020
 
-/* Interrupt Polarity */
-#define GIC_SH_POL_31_0_OFS             0x0100
-#define GIC_SH_POL_63_32_OFS            0x0104
-#define GIC_SH_POL_95_64_OFS            0x0108
-#define GIC_SH_POL_127_96_OFS           0x010c
-#define GIC_SH_POL_159_128_OFS          0x0110
-#define GIC_SH_POL_191_160_OFS          0x0114
-#define GIC_SH_POL_223_192_OFS          0x0118
-#define GIC_SH_POL_255_224_OFS          0x011c
-
-/* Edge/Level Triggering */
-#define GIC_SH_TRIG_31_0_OFS            0x0180
-#define GIC_SH_TRIG_63_32_OFS           0x0184
-#define GIC_SH_TRIG_95_64_OFS           0x0188
-#define GIC_SH_TRIG_127_96_OFS          0x018c
-#define GIC_SH_TRIG_159_128_OFS         0x0190
-#define GIC_SH_TRIG_191_160_OFS         0x0194
-#define GIC_SH_TRIG_223_192_OFS         0x0198
-#define GIC_SH_TRIG_255_224_OFS         0x019c
-
-/* Dual Edge Triggering */
-#define GIC_SH_DUAL_31_0_OFS            0x0200
-#define GIC_SH_DUAL_63_32_OFS           0x0204
-#define GIC_SH_DUAL_95_64_OFS           0x0208
-#define GIC_SH_DUAL_127_96_OFS          0x020c
-#define GIC_SH_DUAL_159_128_OFS         0x0210
-#define GIC_SH_DUAL_191_160_OFS         0x0214
-#define GIC_SH_DUAL_223_192_OFS         0x0218
-#define GIC_SH_DUAL_255_224_OFS         0x021c
+/* Convert an interrupt number to a byte offset/bit for multi-word registers */
+#define GIC_INTR_OFS(intr)              (((intr) / 32) * 4)
+#define GIC_INTR_BIT(intr)              ((intr) % 32)
+
+/* Polarity : Reset Value is always 0 */
+#define GIC_SH_SET_POLARITY_OFS         0x0100
+
+/* Triggering : Reset Value is always 0 */
+#define GIC_SH_SET_TRIGGER_OFS          0x0180
+
+/* Dual edge triggering : Reset Value is always 0 */
+#define GIC_SH_SET_DUAL_OFS             0x0200
 
 /* Set/Clear corresponding bit in Edge Detect Register */
 #define GIC_SH_WEDGE_OFS                0x0280
 
-/* Reset Mask - Disables Interrupt */
-#define GIC_SH_RMASK_31_0_OFS           0x0300
-#define GIC_SH_RMASK_63_32_OFS          0x0304
-#define GIC_SH_RMASK_95_64_OFS          0x0308
-#define GIC_SH_RMASK_127_96_OFS         0x030c
-#define GIC_SH_RMASK_159_128_OFS        0x0310
-#define GIC_SH_RMASK_191_160_OFS        0x0314
-#define GIC_SH_RMASK_223_192_OFS        0x0318
-#define GIC_SH_RMASK_255_224_OFS        0x031c
-
-/* Set Mask (WO) - Enables Interrupt */
-#define GIC_SH_SMASK_31_0_OFS           0x0380
-#define GIC_SH_SMASK_63_32_OFS          0x0384
-#define GIC_SH_SMASK_95_64_OFS          0x0388
-#define GIC_SH_SMASK_127_96_OFS         0x038c
-#define GIC_SH_SMASK_159_128_OFS        0x0390
-#define GIC_SH_SMASK_191_160_OFS        0x0394
-#define GIC_SH_SMASK_223_192_OFS        0x0398
-#define GIC_SH_SMASK_255_224_OFS        0x039c
+/* Mask manipulation */
+#define GIC_SH_RMASK_OFS                0x0300
+#define GIC_SH_SMASK_OFS                0x0380
 
 /* Global Interrupt Mask Register (RO) - Bit Set == Interrupt enabled */
-#define GIC_SH_MASK_31_0_OFS            0x0400
-#define GIC_SH_MASK_63_32_OFS           0x0404
-#define GIC_SH_MASK_95_64_OFS           0x0408
-#define GIC_SH_MASK_127_96_OFS          0x040c
-#define GIC_SH_MASK_159_128_OFS         0x0410
-#define GIC_SH_MASK_191_160_OFS         0x0414
-#define GIC_SH_MASK_223_192_OFS         0x0418
-#define GIC_SH_MASK_255_224_OFS         0x041c
+#define GIC_SH_MASK_OFS                 0x0400
 
 /* Pending Global Interrupts (RO) */
-#define GIC_SH_PEND_31_0_OFS            0x0480
-#define GIC_SH_PEND_63_32_OFS           0x0484
-#define GIC_SH_PEND_95_64_OFS           0x0488
-#define GIC_SH_PEND_127_96_OFS          0x048c
-#define GIC_SH_PEND_159_128_OFS         0x0490
-#define GIC_SH_PEND_191_160_OFS         0x0494
-#define GIC_SH_PEND_223_192_OFS         0x0498
-#define GIC_SH_PEND_255_224_OFS         0x049c
-
-#define GIC_SH_INTR_MAP_TO_PIN_BASE_OFS 0x0500
+#define GIC_SH_PEND_OFS                 0x0480
 
 /* Maps Interrupt X to a Pin */
-#define GIC_SH_MAP_TO_PIN(intr) \
-        (GIC_SH_INTR_MAP_TO_PIN_BASE_OFS + (4 * intr))
-
-#define GIC_SH_INTR_MAP_TO_VPE_BASE_OFS 0x2000
+#define GIC_SH_INTR_MAP_TO_PIN_BASE_OFS 0x0500
+#define GIC_SH_MAP_TO_PIN(intr)         (4 * (intr))
 
 /* Maps Interrupt X to a VPE */
+#define GIC_SH_INTR_MAP_TO_VPE_BASE_OFS 0x2000
 #define GIC_SH_MAP_TO_VPE_REG_OFF(intr, vpe) \
-        (GIC_SH_INTR_MAP_TO_VPE_BASE_OFS + (32 * (intr)) + (((vpe) / 32) * 4))
+        ((32 * (intr)) + (((vpe) / 32) * 4))
 #define GIC_SH_MAP_TO_VPE_REG_BIT(vpe)  (1 << ((vpe) % 32))
 
-/* Convert an interrupt number to a byte offset/bit for multi-word registers */
-#define GIC_INTR_OFS(intr) (((intr) / 32)*4)
-#define GIC_INTR_BIT(intr) ((intr) % 32)
-
-/* Polarity : Reset Value is always 0 */
-#define GIC_SH_SET_POLARITY_OFS         0x0100
-#define GIC_SET_POLARITY(intr, pol) \
-        GICBIS(GIC_REG_ADDR(SHARED, GIC_SH_SET_POLARITY_OFS + \
-                GIC_INTR_OFS(intr)), (1 << GIC_INTR_BIT(intr)), \
-                (pol) << GIC_INTR_BIT(intr))
-
-/* Triggering : Reset Value is always 0 */
-#define GIC_SH_SET_TRIGGER_OFS          0x0180
-#define GIC_SET_TRIGGER(intr, trig) \
-        GICBIS(GIC_REG_ADDR(SHARED, GIC_SH_SET_TRIGGER_OFS + \
-                GIC_INTR_OFS(intr)), (1 << GIC_INTR_BIT(intr)), \
-                (trig) << GIC_INTR_BIT(intr))
-
-/* Mask manipulation */
-#define GIC_SH_SMASK_OFS                0x0380
-#define GIC_SET_INTR_MASK(intr) \
-        GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_SMASK_OFS + \
-                GIC_INTR_OFS(intr)), 1 << GIC_INTR_BIT(intr))
-#define GIC_SH_RMASK_OFS                0x0300
-#define GIC_CLR_INTR_MASK(intr) \
-        GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_RMASK_OFS + \
-                GIC_INTR_OFS(intr)), 1 << GIC_INTR_BIT(intr))
-
 /* Register Map for Local Section */
 #define GIC_VPE_CTL_OFS                 0x0000
 #define GIC_VPE_PEND_OFS                0x0004
@@ -198,6 +89,7 @@
 #define GIC_VPE_WD_MAP_OFS              0x0040
 #define GIC_VPE_COMPARE_MAP_OFS         0x0044
 #define GIC_VPE_TIMER_MAP_OFS           0x0048
+#define GIC_VPE_FDC_MAP_OFS             0x004c
 #define GIC_VPE_PERFCTR_MAP_OFS         0x0050
 #define GIC_VPE_SWINT0_MAP_OFS          0x0054
 #define GIC_VPE_SWINT1_MAP_OFS          0x0058
@@ -208,13 +100,11 @@
 #define GIC_VPE_COMPARE_LO_OFS          0x00a0
 #define GIC_VPE_COMPARE_HI_OFS          0x00a4
 
-#define GIC_VPE_EIC_SHADOW_SET_BASE     0x0100
-#define GIC_VPE_EIC_SS(intr) \
-        (GIC_VPE_EIC_SHADOW_SET_BASE + (4 * intr))
+#define GIC_VPE_EIC_SHADOW_SET_BASE_OFS 0x0100
+#define GIC_VPE_EIC_SS(intr)            (4 * (intr))
 
-#define GIC_VPE_EIC_VEC_BASE            0x0800
-#define GIC_VPE_EIC_VEC(intr) \
-        (GIC_VPE_EIC_VEC_BASE + (4 * intr))
+#define GIC_VPE_EIC_VEC_BASE_OFS        0x0800
+#define GIC_VPE_EIC_VEC(intr)           (4 * (intr))
 
 #define GIC_VPE_TENABLE_NMI_OFS         0x1000
 #define GIC_VPE_TENABLE_YQ_OFS          0x1004
@@ -238,8 +128,8 @@
 #define GIC_SH_CONFIG_NUMVPES_SHF       0
 #define GIC_SH_CONFIG_NUMVPES_MSK       (MSK(8) << GIC_SH_CONFIG_NUMVPES_SHF)
 
-#define GIC_SH_WEDGE_SET(intr)          (intr | (0x1 << 31))
-#define GIC_SH_WEDGE_CLR(intr)          (intr & ~(0x1 << 31))
+#define GIC_SH_WEDGE_SET(intr)          ((intr) | (0x1 << 31))
+#define GIC_SH_WEDGE_CLR(intr)          ((intr) & ~(0x1 << 31))
 
 #define GIC_MAP_TO_PIN_SHF              31
 #define GIC_MAP_TO_PIN_MSK              (MSK(1) << GIC_MAP_TO_PIN_SHF)
@@ -251,6 +141,10 @@
 #define GIC_MAP_MSK                     (MSK(6) << GIC_MAP_SHF)
 
 /* GIC_VPE_CTL Masks */
+#define GIC_VPE_CTL_FDC_RTBL_SHF        4
+#define GIC_VPE_CTL_FDC_RTBL_MSK        (MSK(1) << GIC_VPE_CTL_FDC_RTBL_SHF)
+#define GIC_VPE_CTL_SWINT_RTBL_SHF      3
+#define GIC_VPE_CTL_SWINT_RTBL_MSK      (MSK(1) << GIC_VPE_CTL_SWINT_RTBL_SHF)
 #define GIC_VPE_CTL_PERFCNT_RTBL_SHF    2
 #define GIC_VPE_CTL_PERFCNT_RTBL_MSK    (MSK(1) << GIC_VPE_CTL_PERFCNT_RTBL_SHF)
 #define GIC_VPE_CTL_TIMER_RTBL_SHF      1
@@ -300,38 +194,6 @@
 #define GIC_VPE_SMASK_SWINT1_SHF        5
 #define GIC_VPE_SMASK_SWINT1_MSK        (MSK(1) << GIC_VPE_SMASK_SWINT1_SHF)
 
-/*
- * Set the Mapping of Interrupt X to a VPE.
- */
-#define GIC_SH_MAP_TO_VPE_SMASK(intr, vpe) \
-        GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_VPE_REG_OFF(intr, vpe)), \
-                 GIC_SH_MAP_TO_VPE_REG_BIT(vpe))
-
-/*
- * Interrupt Meta-data specification. The ipiflag helps
- * in building ipi_map.
- */
-struct gic_intr_map {
-        unsigned int cpunum;    /* Directed to this CPU */
-#define GIC_UNUSED              0xdead                  /* Dummy data */
-        unsigned int pin;       /* Directed to this Pin */
-        unsigned int polarity;  /* Polarity : +/-       */
-        unsigned int trigtype;  /* Trigger  : Edge/Levl */
-        unsigned int flags;     /* Misc flags   */
-#define GIC_FLAG_TRANSPARENT   0x01
-};
-
-/*
- * This is only used in EIC mode. This helps to figure out which
- * shared interrupts we need to process when we get a vector interrupt.
- */
-#define GIC_MAX_SHARED_INTR  0x5
-struct gic_shared_intr_map {
-        unsigned int num_shared_intr;
-        unsigned int intr_list[GIC_MAX_SHARED_INTR];
-        unsigned int local_intr_mask;
-};
-
 /* GIC nomenclature for Core Interrupt Pins. */
 #define GIC_CPU_INT0            0 /* Core Interrupt 2 */
 #define GIC_CPU_INT1            1 /* .                */
@@ -340,45 +202,48 @@ struct gic_shared_intr_map {
 #define GIC_CPU_INT4            4 /* .                */
 #define GIC_CPU_INT5            5 /* Core Interrupt 7 */
 
-/* Local GIC interrupts. */
-#define GIC_INT_TMR             (GIC_CPU_INT5)
-#define GIC_INT_PERFCTR         (GIC_CPU_INT5)
+/* Add 2 to convert GIC CPU pin to core interrupt */
+#define GIC_CPU_PIN_OFFSET      2
 
 /* Add 2 to convert non-EIC hardware interrupt to EIC vector number. */
-#define GIC_CPU_TO_VEC_OFFSET   (2)
+#define GIC_CPU_TO_VEC_OFFSET   2
 
 /* Mapped interrupt to pin X, then GIC will generate the vector (X+1). */
-#define GIC_PIN_TO_VEC_OFFSET   (1)
+#define GIC_PIN_TO_VEC_OFFSET   1
 
-#include <linux/clocksource.h>
-#include <linux/irq.h>
+/* Local GIC interrupts. */
+#define GIC_LOCAL_INT_WD        0 /* GIC watchdog */
+#define GIC_LOCAL_INT_COMPARE   1 /* GIC count and compare timer */
+#define GIC_LOCAL_INT_TIMER     2 /* CPU timer interrupt */
+#define GIC_LOCAL_INT_PERFCTR   3 /* CPU performance counter */
+#define GIC_LOCAL_INT_SWINT0    4 /* CPU software interrupt 0 */
+#define GIC_LOCAL_INT_SWINT1    5 /* CPU software interrupt 1 */
+#define GIC_LOCAL_INT_FDC       6 /* CPU fast debug channel */
+#define GIC_NUM_LOCAL_INTRS     7
+
+/* Convert between local/shared IRQ number and GIC HW IRQ number. */
+#define GIC_LOCAL_HWIRQ_BASE    0
+#define GIC_LOCAL_TO_HWIRQ(x)   (GIC_LOCAL_HWIRQ_BASE + (x))
+#define GIC_HWIRQ_TO_LOCAL(x)   ((x) - GIC_LOCAL_HWIRQ_BASE)
+#define GIC_SHARED_HWIRQ_BASE   GIC_NUM_LOCAL_INTRS
+#define GIC_SHARED_TO_HWIRQ(x)  (GIC_SHARED_HWIRQ_BASE + (x))
+#define GIC_HWIRQ_TO_SHARED(x)  ((x) - GIC_SHARED_HWIRQ_BASE)
 
 extern unsigned int gic_present;
-extern unsigned int gic_frequency;
-extern unsigned long _gic_base;
-extern unsigned int gic_irq_base;
-extern unsigned int gic_irq_flags[];
-extern struct gic_shared_intr_map gic_shared_intr_map[];
 
 extern void gic_init(unsigned long gic_base_addr,
-        unsigned long gic_addrspace_size, struct gic_intr_map *intrmap,
-        unsigned int intrmap_size, unsigned int irqbase);
+        unsigned long gic_addrspace_size, unsigned int cpu_vec,
+        unsigned int irqbase);
 extern void gic_clocksource_init(unsigned int);
-extern unsigned int gic_compare_int (void);
 extern cycle_t gic_read_count(void);
+extern unsigned int gic_get_count_width(void);
 extern cycle_t gic_read_compare(void);
 extern void gic_write_compare(cycle_t cnt);
 extern void gic_write_cpu_compare(cycle_t cnt, int cpu);
 extern void gic_send_ipi(unsigned int intr);
 extern unsigned int plat_ipi_call_int_xlate(unsigned int);
 extern unsigned int plat_ipi_resched_int_xlate(unsigned int);
-extern void gic_bind_eic_interrupt(int irq, int set);
 extern unsigned int gic_get_timer_pending(void);
-extern void gic_get_int_mask(unsigned long *dst, const unsigned long *src);
-extern unsigned int gic_get_int(void);
-extern void gic_enable_interrupt(int irq_vec);
-extern void gic_disable_interrupt(int irq_vec);
-extern void gic_irq_ack(struct irq_data *d);
-extern void gic_finish_irq(struct irq_data *d);
-extern void gic_platform_init(int irqs, struct irq_chip *irq_controller);
-#endif /* _ASM_GICREGS_H */
+extern int gic_get_c0_compare_int(void);
+extern int gic_get_c0_perfcount_int(void);
+#endif /* __LINUX_IRQCHIP_MIPS_GIC_H */
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index f7296e57d614..5297f9fa0ef2 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -335,6 +335,7 @@ extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
 extern int arch_prepare_kprobe_ftrace(struct kprobe *p);
 #endif
 
+int arch_check_ftrace_location(struct kprobe *p);
 
 /* Get the kprobe at this addr (if any) - called with preemption disabled */
 struct kprobe *get_kprobe(void *addr);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index bfbc817c34ee..2d182413b1db 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -191,7 +191,8 @@ enum {
         ATA_DEV_PMP_UNSUP       = 6,    /* SATA port multiplier (unsupported) */
         ATA_DEV_SEMB            = 7,    /* SEMB */
         ATA_DEV_SEMB_UNSUP      = 8,    /* SEMB (unsupported) */
-        ATA_DEV_NONE            = 9,    /* no device */
+        ATA_DEV_ZAC             = 9,    /* ZAC device */
+        ATA_DEV_NONE            = 10,   /* no device */
 
         /* struct ata_link flags */
         ATA_LFLAG_NO_HRST       = (1 << 1), /* avoid hardreset */
@@ -1491,7 +1492,8 @@ static inline unsigned int ata_tag_internal(unsigned int tag)
 static inline unsigned int ata_class_enabled(unsigned int class)
 {
         return class == ATA_DEV_ATA || class == ATA_DEV_ATAPI ||
-                class == ATA_DEV_PMP || class == ATA_DEV_SEMB;
+                class == ATA_DEV_PMP || class == ATA_DEV_SEMB ||
+                class == ATA_DEV_ZAC;
 }
 
 static inline unsigned int ata_class_disabled(unsigned int class)
diff --git a/include/linux/list.h b/include/linux/list.h
index f33f831eb3c8..feb773c76ee0 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -346,7 +346,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_entry - get the struct for this entry
  * @ptr:        the &struct list_head pointer.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_entry(ptr, type, member) \
         container_of(ptr, type, member)
@@ -355,7 +355,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_first_entry - get the first element from a list
  * @ptr:        the list head to take the element from.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Note, that list is expected to be not empty.
  */
@@ -366,7 +366,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_last_entry - get the last element from a list
  * @ptr:        the list head to take the element from.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Note, that list is expected to be not empty.
  */
@@ -377,7 +377,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_first_entry_or_null - get the first element from a list
  * @ptr:        the list head to take the element from.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Note that if the list is empty, it returns NULL.
  */
@@ -387,7 +387,7 @@ static inline void list_splice_tail_init(struct list_head *list,
 /**
  * list_next_entry - get the next element in list
  * @pos:        the type * to cursor
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_next_entry(pos, member) \
         list_entry((pos)->member.next, typeof(*(pos)), member)
@@ -395,7 +395,7 @@ static inline void list_splice_tail_init(struct list_head *list,
 /**
  * list_prev_entry - get the prev element in list
  * @pos:        the type * to cursor
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_prev_entry(pos, member) \
         list_entry((pos)->member.prev, typeof(*(pos)), member)
@@ -441,7 +441,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry  -       iterate over list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry(pos, head, member)                          \
         for (pos = list_first_entry(head, typeof(*pos), member);        \
@@ -452,7 +452,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_reverse - iterate backwards over list of given type.
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry_reverse(pos, head, member)                  \
         for (pos = list_last_entry(head, typeof(*pos), member);         \
@@ -463,7 +463,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue()
  * @pos:        the type * to use as a start point
  * @head:       the head of the list
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Prepares a pos entry for use as a start point in list_for_each_entry_continue().
  */
@@ -474,7 +474,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_continue - continue iteration over list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Continue to iterate over list of given type, continuing after
  * the current position.
@@ -488,7 +488,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_continue_reverse - iterate backwards from the given point
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Start to iterate over list of given type backwards, continuing after
  * the current position.
@@ -502,7 +502,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_for_each_entry_from - iterate over list of given type from the current point
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate over list of given type, continuing from current position.
  */
@@ -515,7 +515,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry_safe(pos, n, head, member)                  \
         for (pos = list_first_entry(head, typeof(*pos), member),        \
@@ -528,7 +528,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate over list of given type, continuing after current point,
  * safe against removal of list entry.
@@ -544,7 +544,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate over list of given type from current point, safe against
  * removal of list entry.
@@ -559,7 +559,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Iterate backwards over list of given type, safe against removal
  * of list entry.
@@ -574,7 +574,7 @@ static inline void list_splice_tail_init(struct list_head *list,
  * list_safe_reset_next - reset a stale list_for_each_entry_safe loop
  * @pos:        the loop cursor used in the list_for_each_entry_safe loop
  * @n:          temporary storage used in list_for_each_entry_safe
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * list_safe_reset_next is not safe to use in general if the list may be
  * modified concurrently (eg. the lock is dropped in the loop body). An
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f7606d3a0915..3b337efbe533 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -56,6 +56,17 @@ extern int sysctl_legacy_va_layout;
 #define __pa_symbol(x)  __pa(RELOC_HIDE((unsigned long)(x), 0))
 #endif
 
+/*
+ * To prevent common memory management code establishing
+ * a zero page mapping on a read fault.
+ * This macro should be defined within <asm/pgtable.h>.
+ * s390 does this to prevent multiplexing of hardware bits
+ * related to the physical page in case of virtualization.
+ */
+#ifndef mm_forbids_zeropage
+#define mm_forbids_zeropage(X)  (0)
+#endif
+
 extern unsigned long sysctl_user_reserve_kbytes;
 extern unsigned long sysctl_admin_reserve_kbytes;
 
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 44eeef0da186..745def862580 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -69,7 +69,7 @@ struct ieee1394_device_id {
  * @bDeviceClass: Class of device; numbers are assigned
  *      by the USB forum.  Products may choose to implement classes,
  *      or be vendor-specific.  Device classes specify behavior of all
- *      the interfaces on a devices.
+ *      the interfaces on a device.
  * @bDeviceSubClass: Subclass of device; associated with bDeviceClass.
  * @bDeviceProtocol: Protocol of device; associated with bDeviceClass.
  * @bInterfaceClass: Class of interface; numbers are assigned
diff --git a/include/linux/pci.h b/include/linux/pci.h
index a523cee3abb5..44a27696ab6c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1004,6 +1004,8 @@ void __iomem __must_check *pci_platform_rom(struct pci_dev *pdev, size_t *size);
 int pci_save_state(struct pci_dev *dev);
 void pci_restore_state(struct pci_dev *dev);
 struct pci_saved_state *pci_store_saved_state(struct pci_dev *dev);
+int pci_load_saved_state(struct pci_dev *dev,
+                         struct pci_saved_state *state);
 int pci_load_and_free_saved_state(struct pci_dev *dev,
                                   struct pci_saved_state **state);
 struct pci_cap_saved_state *pci_find_saved_cap(struct pci_dev *dev, char cap);
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index 530b249f7ea4..b4337646388b 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -128,10 +128,8 @@ static inline void percpu_ref_kill(struct percpu_ref *ref)
 static inline bool __ref_is_percpu(struct percpu_ref *ref,
                                           unsigned long __percpu **percpu_countp)
 {
-        unsigned long percpu_ptr = ACCESS_ONCE(ref->percpu_count_ptr);
-
         /* paired with smp_store_release() in percpu_ref_reinit() */
-        smp_read_barrier_depends();
+        unsigned long percpu_ptr = lockless_dereference(ref->percpu_count_ptr);
 
         /*
          * Theoretically, the following could test just ATOMIC; however,
diff --git a/include/linux/platform_data/dma-imx.h b/include/linux/platform_data/dma-imx.h
index 6a1357d31871..7d964e787299 100644
--- a/include/linux/platform_data/dma-imx.h
+++ b/include/linux/platform_data/dma-imx.h
@@ -41,6 +41,7 @@ enum sdma_peripheral_type {
         IMX_DMATYPE_ESAI,       /* ESAI */
         IMX_DMATYPE_SSI_DUAL,   /* SSI Dual FIFO */
         IMX_DMATYPE_ASRC_SP,    /* Shared ASRC */
+        IMX_DMATYPE_SAI,        /* SAI */
 };
 
 enum imx_dma_prio {
diff --git a/include/linux/plist.h b/include/linux/plist.h
index 8b6c970cff6c..97883604a3c5 100644
--- a/include/linux/plist.h
+++ b/include/linux/plist.h
@@ -176,7 +176,7 @@ extern void plist_requeue(struct plist_node *node, struct plist_head *head);
  * plist_for_each_entry - iterate over list of given type
  * @pos:        the type * to use as a loop counter
  * @head:       the head for your list
- * @mem:        the name of the list_struct within the struct
+ * @mem:        the name of the list_head within the struct
  */
 #define plist_for_each_entry(pos, head, mem)    \
          list_for_each_entry(pos, &(head)->node_list, mem.node_list)
@@ -185,7 +185,7 @@ extern void plist_requeue(struct plist_node *node, struct plist_head *head);
  * plist_for_each_entry_continue - continue iteration over list of given type
  * @pos:        the type * to use as a loop cursor
  * @head:       the head for your list
- * @m:          the name of the list_struct within the struct
+ * @m:          the name of the list_head within the struct
  *
  * Continue to iterate over list of given type, continuing after
  * the current position.
@@ -198,7 +198,7 @@ extern void plist_requeue(struct plist_node *node, struct plist_head *head);
  * @pos:        the type * to use as a loop counter
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list
- * @m:          the name of the list_struct within the struct
+ * @m:          the name of the list_head within the struct
  *
  * Iterate over list of given type, safe against removal of list entry.
  */
@@ -229,7 +229,7 @@ static inline int plist_node_empty(const struct plist_node *node)
  * plist_first_entry - get the struct for the first entry
  * @head:       the &struct plist_head pointer
  * @type:       the type of the struct this is embedded in
- * @member:     the name of the list_struct within the struct
+ * @member:     the name of the list_head within the struct
  */
 #ifdef CONFIG_DEBUG_PI_LIST
 # define plist_first_entry(head, type, member)  \
@@ -246,7 +246,7 @@ static inline int plist_node_empty(const struct plist_node *node)
  * plist_last_entry - get the struct for the last entry
  * @head:       the &struct plist_head pointer
  * @type:       the type of the struct this is embedded in
- * @member:     the name of the list_struct within the struct
+ * @member:     the name of the list_head within the struct
  */
 #ifdef CONFIG_DEBUG_PI_LIST
 # define plist_last_entry(head, type, member)   \
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index eda4feede048..30e84d48bfea 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -118,6 +118,11 @@ static inline void pm_runtime_mark_last_busy(struct device *dev)
         ACCESS_ONCE(dev->power.last_busy) = jiffies;
 }
 
+static inline bool pm_runtime_is_irq_safe(struct device *dev)
+{
+        return dev->power.irq_safe;
+}
+
 #else /* !CONFIG_PM */
 
 static inline bool queue_pm_work(struct work_struct *work) { return false; }
@@ -164,6 +169,7 @@ static inline bool pm_runtime_enabled(struct device *dev) { return false; }
 
 static inline void pm_runtime_no_callbacks(struct device *dev) {}
 static inline void pm_runtime_irq_safe(struct device *dev) {}
+static inline bool pm_runtime_is_irq_safe(struct device *dev) { return false; }
 
 static inline bool pm_runtime_callbacks_present(struct device *dev) { return false; }
 static inline void pm_runtime_mark_last_busy(struct device *dev) {}
diff --git a/include/linux/pstore_ram.h b/include/linux/pstore_ram.h
index 9974975d40db..4af3fdc85b01 100644
--- a/include/linux/pstore_ram.h
+++ b/include/linux/pstore_ram.h
@@ -53,7 +53,8 @@ struct persistent_ram_zone {
 };
 
 struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
-                        u32 sig, struct persistent_ram_ecc_info *ecc_info);
+                        u32 sig, struct persistent_ram_ecc_info *ecc_info,
+                        unsigned int memtype);
 void persistent_ram_free(struct persistent_ram_zone *prz);
 void persistent_ram_zap(struct persistent_ram_zone *prz);
 
@@ -76,6 +77,7 @@ ssize_t persistent_ram_ecc_string(struct persistent_ram_zone *prz,
 struct ramoops_platform_data {
         unsigned long   mem_size;
         unsigned long   mem_address;
+        unsigned int    mem_type;
         unsigned long   record_size;
         unsigned long   console_size;
         unsigned long   ftrace_size;
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index aa79b3c24f66..529bc946f450 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -241,7 +241,7 @@ static inline void list_splice_init_rcu(struct list_head *list,
  * list_entry_rcu - get the struct for this entry
  * @ptr:        the &struct list_head pointer.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * This primitive may safely run concurrently with the _rcu list-mutation
  * primitives such as list_add_rcu() as long as it's guarded by rcu_read_lock().
@@ -278,7 +278,7 @@ static inline void list_splice_init_rcu(struct list_head *list,
  * list_first_or_null_rcu - get the first element from a list
  * @ptr:        the list head to take the element from.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Note that if the list is empty, it returns NULL.
  *
@@ -296,7 +296,7 @@ static inline void list_splice_init_rcu(struct list_head *list,
  * list_for_each_entry_rcu      -       iterate over rcu list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * This list-traversal primitive may safely run concurrently with
  * the _rcu list-mutation primitives such as list_add_rcu()
@@ -311,7 +311,7 @@ static inline void list_splice_init_rcu(struct list_head *list,
  * list_for_each_entry_continue_rcu - continue iteration over list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  *
  * Continue to iterate over list of given type, continuing after
  * the current position.
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index 832dcc9f86ec..9d87a37aecad 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -161,17 +161,12 @@ struct expander_device {
 };
 
 /* ---------- SATA device ---------- */
-enum ata_command_set {
-        ATA_COMMAND_SET   = 0,
-        ATAPI_COMMAND_SET = 1,
-};
-
 #define ATA_RESP_FIS_SIZE 24
 
 struct sata_device {
-        enum   ata_command_set command_set;
-        struct smp_resp        rps_resp; /* report_phy_sata_resp */
-        u8     port_no;        /* port number, if this is a PM (Port) */
+        unsigned int class;
+        struct smp_resp        rps_resp; /* report_phy_sata_resp */
+        u8     port_no;        /* port number, if this is a PM (Port) */
 
         struct ata_port *ap;
         struct ata_host ata_host;
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index c8a462ef9a4e..e939d2b3757a 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -554,7 +554,7 @@ struct Scsi_Host {
          * __devices is protected by the host_lock, but you should
          * usually use scsi_device_lookup / shost_for_each_device
          * to access it and don't care about locking yourself.
-         * In the rare case of beeing in irq context you can use
+         * In the rare case of being in irq context you can use
          * their __ prefixed variants with the lock held. NEVER
          * access this list directly from a driver.
          */
diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
index ff4bd1b35246..6cfb841fea7c 100644
--- a/include/trace/events/ext4.h
+++ b/include/trace/events/ext4.h
@@ -43,15 +43,13 @@ struct extent_status;
         { EXT4_GET_BLOCKS_METADATA_NOFAIL,      "METADATA_NOFAIL" },    \
         { EXT4_GET_BLOCKS_NO_NORMALIZE,         "NO_NORMALIZE" },       \
         { EXT4_GET_BLOCKS_KEEP_SIZE,            "KEEP_SIZE" },          \
-        { EXT4_GET_BLOCKS_NO_LOCK,              "NO_LOCK" },            \
-        { EXT4_GET_BLOCKS_NO_PUT_HOLE,          "NO_PUT_HOLE" })
+        { EXT4_GET_BLOCKS_NO_LOCK,              "NO_LOCK" })
 
 #define show_mflags(flags) __print_flags(flags, "",     \
         { EXT4_MAP_NEW,         "N" },                  \
         { EXT4_MAP_MAPPED,      "M" },                  \
         { EXT4_MAP_UNWRITTEN,   "U" },                  \
-        { EXT4_MAP_BOUNDARY,    "B" },                  \
-        { EXT4_MAP_FROM_CLUSTER, "C" })
+        { EXT4_MAP_BOUNDARY,    "B" })
 
 #define show_free_flags(flags) __print_flags(flags, "|",        \
         { EXT4_FREE_BLOCKS_METADATA,            "METADATA" },   \
@@ -2452,15 +2450,14 @@ TRACE_EVENT(ext4_collapse_range,
 
 TRACE_EVENT(ext4_es_shrink,
         TP_PROTO(struct super_block *sb, int nr_shrunk, u64 scan_time,
-                 int skip_precached, int nr_skipped, int retried),
+                 int nr_skipped, int retried),
 
-        TP_ARGS(sb, nr_shrunk, scan_time, skip_precached, nr_skipped, retried),
+        TP_ARGS(sb, nr_shrunk, scan_time, nr_skipped, retried),
 
         TP_STRUCT__entry(
                 __field(        dev_t,          dev             )
                 __field(        int,            nr_shrunk       )
                 __field(        unsigned long long, scan_time   )
-                __field(        int,            skip_precached  )
                 __field(        int,            nr_skipped      )
                 __field(        int,            retried         )
         ),
@@ -2469,16 +2466,14 @@ TRACE_EVENT(ext4_es_shrink,
                 __entry->dev            = sb->s_dev;
                 __entry->nr_shrunk      = nr_shrunk;
                 __entry->scan_time      = div_u64(scan_time, 1000);
-                __entry->skip_precached = skip_precached;
                 __entry->nr_skipped     = nr_skipped;
                 __entry->retried        = retried;
         ),
 
-        TP_printk("dev %d,%d nr_shrunk %d, scan_time %llu skip_precached %d "
+        TP_printk("dev %d,%d nr_shrunk %d, scan_time %llu "
                   "nr_skipped %d retried %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev), __entry->nr_shrunk,
-                  __entry->scan_time, __entry->skip_precached,
-                  __entry->nr_skipped, __entry->retried)
+                  __entry->scan_time, __entry->nr_skipped, __entry->retried)
 );
 
 #endif /* _TRACE_EXT4_H */
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index 2f47824e7a36..611e1c5893b4 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -157,6 +157,7 @@ struct btrfs_ioctl_dev_replace_status_params {
 #define BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR                 0
 #define BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED              1
 #define BTRFS_IOCTL_DEV_REPLACE_RESULT_ALREADY_STARTED          2
+#define BTRFS_IOCTL_DEV_REPLACE_RESULT_SCRUB_INPROGRESS         3
 struct btrfs_ioctl_dev_replace_args {
         __u64 cmd;      /* in */
         __u64 result;   /* out */
diff --git a/include/xen/interface/features.h b/include/xen/interface/features.h
index 14334d0161d5..131a6ccdba25 100644
--- a/include/xen/interface/features.h
+++ b/include/xen/interface/features.h
@@ -53,9 +53,6 @@
 /* operation as Dom0 is supported */
 #define XENFEAT_dom0                      11
 
-/* Xen also maps grant references at pfn = mfn */
-#define XENFEAT_grant_map_identity        12
-
 #define XENFEAT_NR_SUBMAPS 1
 
 #endif /* __XEN_PUBLIC_FEATURES_H__ */
diff --git a/include/xen/interface/grant_table.h b/include/xen/interface/grant_table.h
index e40fae9bf11a..bcce56439d64 100644
--- a/include/xen/interface/grant_table.h
+++ b/include/xen/interface/grant_table.h
@@ -479,6 +479,25 @@ struct gnttab_get_version {
 DEFINE_GUEST_HANDLE_STRUCT(gnttab_get_version);
 
 /*
+ * Issue one or more cache maintenance operations on a portion of a
+ * page granted to the calling domain by a foreign domain.
+ */
+#define GNTTABOP_cache_flush          12
+struct gnttab_cache_flush {
+    union {
+        uint64_t dev_bus_addr;
+        grant_ref_t ref;
+    } a;
+    uint16_t offset;   /* offset from start of grant */
+    uint16_t length;   /* size within the grant */
+#define GNTTAB_CACHE_CLEAN          (1<<0)
+#define GNTTAB_CACHE_INVAL          (1<<1)
+#define GNTTAB_CACHE_SOURCE_GREF    (1<<31)
+    uint32_t op;
+};
+DEFINE_GUEST_HANDLE_STRUCT(gnttab_cache_flush);
+
+/*
  * Bitfield values for update_pin_status.flags.
  */
  /* Map the grant entry for access by I/O devices. */
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 136eceadeed1..bb263d0caab3 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -277,6 +277,10 @@ static struct cgroup_subsys_state *cgroup_e_css(struct cgroup *cgrp,
         if (!(cgrp->root->subsys_mask & (1 << ss->id)))
                 return NULL;
 
+        /*
+         * This function is used while updating css associations and thus
+         * can't test the csses directly.  Use ->child_subsys_mask.
+         */
         while (cgroup_parent(cgrp) &&
                !(cgroup_parent(cgrp)->child_subsys_mask & (1 << ss->id)))
                 cgrp = cgroup_parent(cgrp);
@@ -284,6 +288,39 @@ static struct cgroup_subsys_state *cgroup_e_css(struct cgroup *cgrp,
         return cgroup_css(cgrp, ss);
 }
 
+/**
+ * cgroup_get_e_css - get a cgroup's effective css for the specified subsystem
+ * @cgrp: the cgroup of interest
+ * @ss: the subsystem of interest
+ *
+ * Find and get the effective css of @cgrp for @ss.  The effective css is
+ * defined as the matching css of the nearest ancestor including self which
+ * has @ss enabled.  If @ss is not mounted on the hierarchy @cgrp is on,
+ * the root css is returned, so this function always returns a valid css.
+ * The returned css must be put using css_put().
+ */
+struct cgroup_subsys_state *cgroup_get_e_css(struct cgroup *cgrp,
+                                             struct cgroup_subsys *ss)
+{
+        struct cgroup_subsys_state *css;
+
+        rcu_read_lock();
+
+        do {
+                css = cgroup_css(cgrp, ss);
+
+                if (css && css_tryget_online(css))
+                        goto out_unlock;
+                cgrp = cgroup_parent(cgrp);
+        } while (cgrp);
+
+        css = init_css_set.subsys[ss->id];
+        css_get(css);
+out_unlock:
+        rcu_read_unlock();
+        return css;
+}
+
 /* convenient tests for these bits */
 static inline bool cgroup_is_dead(const struct cgroup *cgrp)
 {
@@ -1019,31 +1056,30 @@ static void cgroup_put(struct cgroup *cgrp)
 }
 
 /**
- * cgroup_refresh_child_subsys_mask - update child_subsys_mask
+ * cgroup_calc_child_subsys_mask - calculate child_subsys_mask
  * @cgrp: the target cgroup
+ * @subtree_control: the new subtree_control mask to consider
  *
  * On the default hierarchy, a subsystem may request other subsystems to be
  * enabled together through its ->depends_on mask.  In such cases, more
  * subsystems than specified in "cgroup.subtree_control" may be enabled.
  *
- * This function determines which subsystems need to be enabled given the
- * current @cgrp->subtree_control and records it in
- * @cgrp->child_subsys_mask.  The resulting mask is always a superset of
- * @cgrp->subtree_control and follows the usual hierarchy rules.
+ * This function calculates which subsystems need to be enabled if
+ * @subtree_control is to be applied to @cgrp.  The returned mask is always
+ * a superset of @subtree_control and follows the usual hierarchy rules.
  */
-static void cgroup_refresh_child_subsys_mask(struct cgroup *cgrp)
+static unsigned int cgroup_calc_child_subsys_mask(struct cgroup *cgrp,
+                                                  unsigned int subtree_control)
 {
         struct cgroup *parent = cgroup_parent(cgrp);
-        unsigned int cur_ss_mask = cgrp->subtree_control;
+        unsigned int cur_ss_mask = subtree_control;
         struct cgroup_subsys *ss;
         int ssid;
 
         lockdep_assert_held(&cgroup_mutex);
 
-        if (!cgroup_on_dfl(cgrp)) {
-                cgrp->child_subsys_mask = cur_ss_mask;
-                return;
-        }
+        if (!cgroup_on_dfl(cgrp))
+                return cur_ss_mask;
 
         while (true) {
                 unsigned int new_ss_mask = cur_ss_mask;
@@ -1067,7 +1103,20 @@ static void cgroup_refresh_child_subsys_mask(struct cgroup *cgrp)
                 cur_ss_mask = new_ss_mask;
         }
 
-        cgrp->child_subsys_mask = cur_ss_mask;
+        return cur_ss_mask;
+}
+
+/**
+ * cgroup_refresh_child_subsys_mask - update child_subsys_mask
+ * @cgrp: the target cgroup
+ *
+ * Update @cgrp->child_subsys_mask according to the current
+ * @cgrp->subtree_control using cgroup_calc_child_subsys_mask().
+ */
+static void cgroup_refresh_child_subsys_mask(struct cgroup *cgrp)
+{
+        cgrp->child_subsys_mask =
+                cgroup_calc_child_subsys_mask(cgrp, cgrp->subtree_control);
 }
 
 /**
@@ -2641,7 +2690,7 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
                                             loff_t off)
 {
         unsigned int enable = 0, disable = 0;
-        unsigned int css_enable, css_disable, old_ctrl, new_ctrl;
+        unsigned int css_enable, css_disable, old_sc, new_sc, old_ss, new_ss;
         struct cgroup *cgrp, *child;
         struct cgroup_subsys *ss;
         char *tok;
@@ -2693,36 +2742,6 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
                                 ret = -ENOENT;
                                 goto out_unlock;
                         }
-
-                        /*
-                         * @ss is already enabled through dependency and
-                         * we'll just make it visible.  Skip draining.
-                         */
-                        if (cgrp->child_subsys_mask & (1 << ssid))
-                                continue;
-
-                        /*
-                         * Because css offlining is asynchronous, userland
-                         * might try to re-enable the same controller while
-                         * the previous instance is still around.  In such
-                         * cases, wait till it's gone using offline_waitq.
-                         */
-                        cgroup_for_each_live_child(child, cgrp) {
-                                DEFINE_WAIT(wait);
-
-                                if (!cgroup_css(child, ss))
-                                        continue;
-
-                                cgroup_get(child);
-                                prepare_to_wait(&child->offline_waitq, &wait,
-                                                TASK_UNINTERRUPTIBLE);
-                                cgroup_kn_unlock(of->kn);
-                                schedule();
-                                finish_wait(&child->offline_waitq, &wait);
-                                cgroup_put(child);
-
-                                return restart_syscall();
-                        }
                 } else if (disable & (1 << ssid)) {
                         if (!(cgrp->subtree_control & (1 << ssid))) {
                                 disable &= ~(1 << ssid);
@@ -2758,19 +2777,48 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
          * subsystems than specified may need to be enabled or disabled
          * depending on subsystem dependencies.
          */
-        cgrp->subtree_control |= enable;
-        cgrp->subtree_control &= ~disable;
+        old_sc = cgrp->subtree_control;
+        old_ss = cgrp->child_subsys_mask;
+        new_sc = (old_sc | enable) & ~disable;
+        new_ss = cgroup_calc_child_subsys_mask(cgrp, new_sc);
 
-        old_ctrl = cgrp->child_subsys_mask;
-        cgroup_refresh_child_subsys_mask(cgrp);
-        new_ctrl = cgrp->child_subsys_mask;
-
-        css_enable = ~old_ctrl & new_ctrl;
-        css_disable = old_ctrl & ~new_ctrl;
+        css_enable = ~old_ss & new_ss;
+        css_disable = old_ss & ~new_ss;
         enable |= css_enable;
         disable |= css_disable;
 
         /*
+         * Because css offlining is asynchronous, userland might try to
+         * re-enable the same controller while the previous instance is
+         * still around.  In such cases, wait till it's gone using
+         * offline_waitq.
+         */
+        for_each_subsys(ss, ssid) {
+                if (!(css_enable & (1 << ssid)))
+                        continue;
+
+                cgroup_for_each_live_child(child, cgrp) {
+                        DEFINE_WAIT(wait);
+
+                        if (!cgroup_css(child, ss))
+                                continue;
+
+                        cgroup_get(child);
+                        prepare_to_wait(&child->offline_waitq, &wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        cgroup_kn_unlock(of->kn);
+                        schedule();
+                        finish_wait(&child->offline_waitq, &wait);
+                        cgroup_put(child);
+
+                        return restart_syscall();
+                }
+        }
+
+        cgrp->subtree_control = new_sc;
+        cgrp->child_subsys_mask = new_ss;
+
+        /*
          * Create new csses or make the existing ones visible.  A css is
          * created invisible if it's being implicitly enabled through
          * dependency.  An invisible css is made visible when the userland
@@ -2825,6 +2873,24 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
                 }
         }
 
+        /*
+         * The effective csses of all the descendants (excluding @cgrp) may
+         * have changed.  Subsystems can optionally subscribe to this event
+         * by implementing ->css_e_css_changed() which is invoked if any of
+         * the effective csses seen from the css's cgroup may have changed.
+         */
+        for_each_subsys(ss, ssid) {
+                struct cgroup_subsys_state *this_css = cgroup_css(cgrp, ss);
+                struct cgroup_subsys_state *css;
+
+                if (!ss->css_e_css_changed || !this_css)
+                        continue;
+
+                css_for_each_descendant_pre(css, this_css)
+                        if (css != this_css)
+                                ss->css_e_css_changed(css);
+        }
+
         kernfs_activate(cgrp->kn);
         ret = 0;
 out_unlock:
@@ -2832,9 +2898,8 @@ out_unlock:
         return ret ?: nbytes;
 
 err_undo_css:
-        cgrp->subtree_control &= ~enable;
-        cgrp->subtree_control |= disable;
-        cgroup_refresh_child_subsys_mask(cgrp);
+        cgrp->subtree_control = old_sc;
+        cgrp->child_subsys_mask = old_ss;
 
         for_each_subsys(ss, ssid) {
                 if (!(enable & (1 << ssid)))
@@ -4370,6 +4435,8 @@ static void css_release_work_fn(struct work_struct *work)
         if (ss) {
                 /* css release path */
                 cgroup_idr_remove(&ss->css_idr, css->id);
+                if (ss->css_released)
+                        ss->css_released(css);
         } else {
                 /* cgroup release path */
                 cgroup_idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 723cfc9d0ad7..64b257f6bca2 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -248,34 +248,34 @@ static struct cpuset top_cpuset = {
                 if (is_cpuset_online(((des_cs) = css_cs((pos_css)))))
 
 /*
- * There are two global mutexes guarding cpuset structures - cpuset_mutex
- * and callback_mutex.  The latter may nest inside the former.  We also
- * require taking task_lock() when dereferencing a task's cpuset pointer.
- * See "The task_lock() exception", at the end of this comment.
+ * There are two global locks guarding cpuset structures - cpuset_mutex and
+ * callback_lock. We also require taking task_lock() when dereferencing a
+ * task's cpuset pointer. See "The task_lock() exception", at the end of this
+ * comment.
  *
- * A task must hold both mutexes to modify cpusets.  If a task holds
+ * A task must hold both locks to modify cpusets.  If a task holds
  * cpuset_mutex, then it blocks others wanting that mutex, ensuring that it
- * is the only task able to also acquire callback_mutex and be able to
+ * is the only task able to also acquire callback_lock and be able to
  * modify cpusets.  It can perform various checks on the cpuset structure
  * first, knowing nothing will change.  It can also allocate memory while
  * just holding cpuset_mutex.  While it is performing these checks, various
- * callback routines can briefly acquire callback_mutex to query cpusets.
- * Once it is ready to make the changes, it takes callback_mutex, blocking
+ * callback routines can briefly acquire callback_lock to query cpusets.
+ * Once it is ready to make the changes, it takes callback_lock, blocking
  * everyone else.
  *
  * Calls to the kernel memory allocator can not be made while holding
- * callback_mutex, as that would risk double tripping on callback_mutex
+ * callback_lock, as that would risk double tripping on callback_lock
  * from one of the callbacks into the cpuset code from within
  * __alloc_pages().
  *
- * If a task is only holding callback_mutex, then it has read-only
+ * If a task is only holding callback_lock, then it has read-only
  * access to cpusets.
  *
  * Now, the task_struct fields mems_allowed and mempolicy may be changed
  * by other task, we use alloc_lock in the task_struct fields to protect
  * them.
  *
- * The cpuset_common_file_read() handlers only hold callback_mutex across
+ * The cpuset_common_file_read() handlers only hold callback_lock across
  * small pieces of code, such as when reading out possibly multi-word
  * cpumasks and nodemasks.
  *
@@ -284,7 +284,7 @@ static struct cpuset top_cpuset = {
  */
 
 static DEFINE_MUTEX(cpuset_mutex);
-static DEFINE_MUTEX(callback_mutex);
+static DEFINE_SPINLOCK(callback_lock);
 
 /*
  * CPU / memory hotplug is handled asynchronously.
@@ -329,7 +329,7 @@ static struct file_system_type cpuset_fs_type = {
  * One way or another, we guarantee to return some non-empty subset
  * of cpu_online_mask.
  *
- * Call with callback_mutex held.
+ * Call with callback_lock or cpuset_mutex held.
  */
 static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
 {
@@ -347,7 +347,7 @@ static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
  * One way or another, we guarantee to return some non-empty subset
  * of node_states[N_MEMORY].
  *
- * Call with callback_mutex held.
+ * Call with callback_lock or cpuset_mutex held.
  */
 static void guarantee_online_mems(struct cpuset *cs, nodemask_t *pmask)
 {
@@ -359,7 +359,7 @@ static void guarantee_online_mems(struct cpuset *cs, nodemask_t *pmask)
 /*
  * update task's spread flag if cpuset's page/slab spread flag is set
  *
- * Called with callback_mutex/cpuset_mutex held
+ * Call with callback_lock or cpuset_mutex held.
  */
 static void cpuset_update_task_spread_flag(struct cpuset *cs,
                                         struct task_struct *tsk)
@@ -886,9 +886,9 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
                         continue;
                 rcu_read_unlock();
 
-                mutex_lock(&callback_mutex);
+                spin_lock_irq(&callback_lock);
                 cpumask_copy(cp->effective_cpus, new_cpus);
-                mutex_unlock(&callback_mutex);
+                spin_unlock_irq(&callback_lock);
 
                 WARN_ON(!cgroup_on_dfl(cp->css.cgroup) &&
                         !cpumask_equal(cp->cpus_allowed, cp->effective_cpus));
@@ -953,9 +953,9 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
         if (retval < 0)
                 return retval;
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         cpumask_copy(cs->cpus_allowed, trialcs->cpus_allowed);
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 
         /* use trialcs->cpus_allowed as a temp variable */
         update_cpumasks_hier(cs, trialcs->cpus_allowed);
@@ -1142,9 +1142,9 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
                         continue;
                 rcu_read_unlock();
 
-                mutex_lock(&callback_mutex);
+                spin_lock_irq(&callback_lock);
                 cp->effective_mems = *new_mems;
-                mutex_unlock(&callback_mutex);
+                spin_unlock_irq(&callback_lock);
 
                 WARN_ON(!cgroup_on_dfl(cp->css.cgroup) &&
                         !nodes_equal(cp->mems_allowed, cp->effective_mems));
@@ -1165,7 +1165,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
  * mempolicies and if the cpuset is marked 'memory_migrate',
  * migrate the tasks pages to the new memory.
  *
- * Call with cpuset_mutex held.  May take callback_mutex during call.
+ * Call with cpuset_mutex held. May take callback_lock during call.
  * Will take tasklist_lock, scan tasklist for tasks in cpuset cs,
  * lock each such tasks mm->mmap_sem, scan its vma's and rebind
  * their mempolicies to the cpusets new mems_allowed.
@@ -1212,9 +1212,9 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
         if (retval < 0)
                 goto done;
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         cs->mems_allowed = trialcs->mems_allowed;
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 
         /* use trialcs->mems_allowed as a temp variable */
         update_nodemasks_hier(cs, &cs->mems_allowed);
@@ -1305,9 +1305,9 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
         spread_flag_changed = ((is_spread_slab(cs) != is_spread_slab(trialcs))
                         || (is_spread_page(cs) != is_spread_page(trialcs)));
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         cs->flags = trialcs->flags;
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 
         if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed)
                 rebuild_sched_domains_locked();
@@ -1714,7 +1714,7 @@ static int cpuset_common_seq_show(struct seq_file *sf, void *v)
         count = seq_get_buf(sf, &buf);
         s = buf;
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
 
         switch (type) {
         case FILE_CPULIST:
@@ -1741,7 +1741,7 @@ static int cpuset_common_seq_show(struct seq_file *sf, void *v)
                 seq_commit(sf, -1);
         }
 out_unlock:
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
         return ret;
 }
 
@@ -1958,12 +1958,12 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
 
         cpuset_inc();
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         if (cgroup_on_dfl(cs->css.cgroup)) {
                 cpumask_copy(cs->effective_cpus, parent->effective_cpus);
                 cs->effective_mems = parent->effective_mems;
         }
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 
         if (!test_bit(CGRP_CPUSET_CLONE_CHILDREN, &css->cgroup->flags))
                 goto out_unlock;
@@ -1990,10 +1990,10 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
         }
         rcu_read_unlock();
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         cs->mems_allowed = parent->mems_allowed;
         cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 out_unlock:
         mutex_unlock(&cpuset_mutex);
         return 0;
@@ -2032,7 +2032,7 @@ static void cpuset_css_free(struct cgroup_subsys_state *css)
 static void cpuset_bind(struct cgroup_subsys_state *root_css)
 {
         mutex_lock(&cpuset_mutex);
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
 
         if (cgroup_on_dfl(root_css->cgroup)) {
                 cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
@@ -2043,7 +2043,7 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
                 top_cpuset.mems_allowed = top_cpuset.effective_mems;
         }
 
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
         mutex_unlock(&cpuset_mutex);
 }
 
@@ -2128,12 +2128,12 @@ hotplug_update_tasks_legacy(struct cpuset *cs,
 {
         bool is_empty;
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         cpumask_copy(cs->cpus_allowed, new_cpus);
         cpumask_copy(cs->effective_cpus, new_cpus);
         cs->mems_allowed = *new_mems;
         cs->effective_mems = *new_mems;
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 
         /*
          * Don't call update_tasks_cpumask() if the cpuset becomes empty,
@@ -2170,10 +2170,10 @@ hotplug_update_tasks(struct cpuset *cs,
         if (nodes_empty(*new_mems))
                 *new_mems = parent_cs(cs)->effective_mems;
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irq(&callback_lock);
         cpumask_copy(cs->effective_cpus, new_cpus);
         cs->effective_mems = *new_mems;
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irq(&callback_lock);
 
         if (cpus_updated)
                 update_tasks_cpumask(cs);
@@ -2259,21 +2259,21 @@ static void cpuset_hotplug_workfn(struct work_struct *work)
 
         /* synchronize cpus_allowed to cpu_active_mask */
         if (cpus_updated) {
-                mutex_lock(&callback_mutex);
+                spin_lock_irq(&callback_lock);
                 if (!on_dfl)
                         cpumask_copy(top_cpuset.cpus_allowed, &new_cpus);
                 cpumask_copy(top_cpuset.effective_cpus, &new_cpus);
-                mutex_unlock(&callback_mutex);
+                spin_unlock_irq(&callback_lock);
                 /* we don't mess with cpumasks of tasks in top_cpuset */
         }
 
         /* synchronize mems_allowed to N_MEMORY */
         if (mems_updated) {
-                mutex_lock(&callback_mutex);
+                spin_lock_irq(&callback_lock);
                 if (!on_dfl)
                         top_cpuset.mems_allowed = new_mems;
                 top_cpuset.effective_mems = new_mems;
-                mutex_unlock(&callback_mutex);
+                spin_unlock_irq(&callback_lock);
                 update_tasks_nodemask(&top_cpuset);
         }
 
@@ -2366,11 +2366,13 @@ void __init cpuset_init_smp(void)
 
 void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask)
 {
-        mutex_lock(&callback_mutex);
+        unsigned long flags;
+
+        spin_lock_irqsave(&callback_lock, flags);
         rcu_read_lock();
         guarantee_online_cpus(task_cs(tsk), pmask);
         rcu_read_unlock();
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irqrestore(&callback_lock, flags);
 }
 
 void cpuset_cpus_allowed_fallback(struct task_struct *tsk)
@@ -2416,12 +2418,13 @@ void cpuset_init_current_mems_allowed(void)
 nodemask_t cpuset_mems_allowed(struct task_struct *tsk)
 {
         nodemask_t mask;
+        unsigned long flags;
 
-        mutex_lock(&callback_mutex);
+        spin_lock_irqsave(&callback_lock, flags);
         rcu_read_lock();
         guarantee_online_mems(task_cs(tsk), &mask);
         rcu_read_unlock();
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irqrestore(&callback_lock, flags);
 
         return mask;
 }
@@ -2440,7 +2443,7 @@ int cpuset_nodemask_valid_mems_allowed(nodemask_t *nodemask)
 /*
  * nearest_hardwall_ancestor() - Returns the nearest mem_exclusive or
  * mem_hardwall ancestor to the specified cpuset.  Call holding
- * callback_mutex.  If no ancestor is mem_exclusive or mem_hardwall
+ * callback_lock.  If no ancestor is mem_exclusive or mem_hardwall
  * (an unusual configuration), then returns the root cpuset.
  */
 static struct cpuset *nearest_hardwall_ancestor(struct cpuset *cs)
@@ -2451,7 +2454,7 @@ static struct cpuset *nearest_hardwall_ancestor(struct cpuset *cs)
 }
 
 /**
- * cpuset_node_allowed_softwall - Can we allocate on a memory node?
+ * cpuset_node_allowed - Can we allocate on a memory node?
  * @node: is this an allowed node?
  * @gfp_mask: memory allocation flags
  *
@@ -2463,13 +2466,6 @@ static struct cpuset *nearest_hardwall_ancestor(struct cpuset *cs)
  * flag, yes.
  * Otherwise, no.
  *
- * If __GFP_HARDWALL is set, cpuset_node_allowed_softwall() reduces to
- * cpuset_node_allowed_hardwall().  Otherwise, cpuset_node_allowed_softwall()
- * might sleep, and might allow a node from an enclosing cpuset.
- *
- * cpuset_node_allowed_hardwall() only handles the simpler case of hardwall
- * cpusets, and never sleeps.
- *
  * The __GFP_THISNODE placement logic is really handled elsewhere,
  * by forcibly using a zonelist starting at a specified node, and by
  * (in get_page_from_freelist()) refusing to consider the zones for
@@ -2482,13 +2478,12 @@ static struct cpuset *nearest_hardwall_ancestor(struct cpuset *cs)
  * GFP_KERNEL allocations are not so marked, so can escape to the
  * nearest enclosing hardwalled ancestor cpuset.
  *
- * Scanning up parent cpusets requires callback_mutex.  The
+ * Scanning up parent cpusets requires callback_lock.  The
  * __alloc_pages() routine only calls here with __GFP_HARDWALL bit
  * _not_ set if it's a GFP_KERNEL allocation, and all nodes in the
  * current tasks mems_allowed came up empty on the first pass over
  * the zonelist.  So only GFP_KERNEL allocations, if all nodes in the
- * cpuset are short of memory, might require taking the callback_mutex
- * mutex.
+ * cpuset are short of memory, might require taking the callback_lock.
  *
  * The first call here from mm/page_alloc:get_page_from_freelist()
  * has __GFP_HARDWALL set in gfp_mask, enforcing hardwall cpusets,
@@ -2505,20 +2500,15 @@ static struct cpuset *nearest_hardwall_ancestor(struct cpuset *cs)
  *      TIF_MEMDIE   - any node ok
  *      GFP_KERNEL   - any node in enclosing hardwalled cpuset ok
  *      GFP_USER     - only nodes in current tasks mems allowed ok.
- *
- * Rule:
- *    Don't call cpuset_node_allowed_softwall if you can't sleep, unless you
- *    pass in the __GFP_HARDWALL flag set in gfp_flag, which disables
- *    the code that might scan up ancestor cpusets and sleep.
  */
-int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
+int __cpuset_node_allowed(int node, gfp_t gfp_mask)
 {
         struct cpuset *cs;              /* current cpuset ancestors */
         int allowed;                    /* is allocation in zone z allowed? */
+        unsigned long flags;
 
         if (in_interrupt() || (gfp_mask & __GFP_THISNODE))
                 return 1;
-        might_sleep_if(!(gfp_mask & __GFP_HARDWALL));
         if (node_isset(node, current->mems_allowed))
                 return 1;
         /*
@@ -2534,55 +2524,17 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
                 return 1;
 
         /* Not hardwall and node outside mems_allowed: scan up cpusets */
-        mutex_lock(&callback_mutex);
+        spin_lock_irqsave(&callback_lock, flags);
 
         rcu_read_lock();
         cs = nearest_hardwall_ancestor(task_cs(current));
         allowed = node_isset(node, cs->mems_allowed);
         rcu_read_unlock();
 
-        mutex_unlock(&callback_mutex);
+        spin_unlock_irqrestore(&callback_lock, flags);
         return allowed;
 }
 
-/*
- * cpuset_node_allowed_hardwall - Can we allocate on a memory node?
- * @node: is this an allowed node?
- * @gfp_mask: memory allocation flags
- *
- * If we're in interrupt, yes, we can always allocate.  If __GFP_THISNODE is
- * set, yes, we can always allocate.  If node is in our task's mems_allowed,
- * yes.  If the task has been OOM killed and has access to memory reserves as
- * specified by the TIF_MEMDIE flag, yes.
- * Otherwise, no.
- *
- * The __GFP_THISNODE placement logic is really handled elsewhere,
- * by forcibly using a zonelist starting at a specified node, and by
- * (in get_page_from_freelist()) refusing to consider the zones for
- * any node on the zonelist except the first.  By the time any such
- * calls get to this routine, we should just shut up and say 'yes'.
- *
- * Unlike the cpuset_node_allowed_softwall() variant, above,
- * this variant requires that the node be in the current task's
- * mems_allowed or that we're in interrupt.  It does not scan up the
- * cpuset hierarchy for the nearest enclosing mem_exclusive cpuset.
- * It never sleeps.
- */
-int __cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask)
-{
-        if (in_interrupt() || (gfp_mask & __GFP_THISNODE))
-                return 1;
-        if (node_isset(node, current->mems_allowed))
-                return 1;
-        /*
-         * Allow tasks that have access to memory reserves because they have
-         * been OOM killed to get memory anywhere.
-         */
-        if (unlikely(test_thread_flag(TIF_MEMDIE)))
-                return 1;
-        return 0;
-}
-
 /**
  * cpuset_mem_spread_node() - On which node to begin search for a file page
  * cpuset_slab_spread_node() - On which node to begin search for a slab page
diff --git a/kernel/irq_work.c b/kernel/irq_work.c
index 3ab9048483fa..cbf9fb899d92 100644
--- a/kernel/irq_work.c
+++ b/kernel/irq_work.c
@@ -175,11 +175,11 @@ EXPORT_SYMBOL_GPL(irq_work_run);
 
 void irq_work_tick(void)
 {
-        struct llist_head *raised = &__get_cpu_var(raised_list);
+        struct llist_head *raised = this_cpu_ptr(&raised_list);
 
         if (!llist_empty(raised) && !arch_irq_work_has_interrupt())
                 irq_work_run_list(raised);
-        irq_work_run_list(&__get_cpu_var(lazy_list));
+        irq_work_run_list(this_cpu_ptr(&lazy_list));
 }
 
 /*
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 831978cebf1d..06f58309fed2 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1410,16 +1410,10 @@ static inline int check_kprobe_rereg(struct kprobe *p)
         return ret;
 }
 
-static int check_kprobe_address_safe(struct kprobe *p,
-                                     struct module **probed_mod)
+int __weak arch_check_ftrace_location(struct kprobe *p)
 {
-        int ret = 0;
         unsigned long ftrace_addr;
 
-        /*
-         * If the address is located on a ftrace nop, set the
-         * breakpoint to the following instruction.
-         */
         ftrace_addr = ftrace_location((unsigned long)p->addr);
         if (ftrace_addr) {
 #ifdef CONFIG_KPROBES_ON_FTRACE
@@ -1431,7 +1425,17 @@ static int check_kprobe_address_safe(struct kprobe *p,
                 return -EINVAL;
 #endif
         }
+        return 0;
+}
 
+static int check_kprobe_address_safe(struct kprobe *p,
+                                     struct module **probed_mod)
+{
+        int ret;
+
+        ret = arch_check_ftrace_location(p);
+        if (ret)
+                return ret;
         jump_label_lock();
         preempt_disable();
 
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 02aa4185b17e..61eea02b53f5 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -169,6 +169,8 @@ cond_syscall(ppc_rtas);
 cond_syscall(sys_spu_run);
 cond_syscall(sys_spu_create);
 cond_syscall(sys_subpage_prot);
+cond_syscall(sys_s390_pci_mmio_read);
+cond_syscall(sys_s390_pci_mmio_write);
 
 /* mmu depending weak syscall entries */
 cond_syscall(sys_mprotect);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 2e949cc9c9f1..b79f39bda7e1 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -792,7 +792,7 @@ int __clocksource_register_scale(struct clocksource *cs, u32 scale, u32 freq)
         /* Initialize mult/shift and max_idle_ns */
         __clocksource_updatefreq_scale(cs, scale, freq);
 
-        /* Add clocksource to the clcoksource list */
+        /* Add clocksource to the clocksource list */
         mutex_lock(&clocksource_mutex);
         clocksource_enqueue(cs);
         clocksource_enqueue_watchdog(cs);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 1f4356037a7d..4d54b7540585 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -235,7 +235,7 @@ void tick_nohz_full_kick(void)
         if (!tick_nohz_full_cpu(smp_processor_id()))
                 return;
 
-        irq_work_queue(&__get_cpu_var(nohz_full_kick_work));
+        irq_work_queue(this_cpu_ptr(&nohz_full_kick_work));
 }
 
 /*
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1af4f8f2ab5d..ab76b7bcb36a 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2031,7 +2031,7 @@ void trace_printk_init_buffers(void)
         pr_warning("** trace_printk() being used. Allocating extra memory.  **\n");
         pr_warning("**                                                      **\n");
         pr_warning("** This means that this is a DEBUG kernel and it is     **\n");
-        pr_warning("** unsafe for produciton use.                           **\n");
+        pr_warning("** unsafe for production use.                           **\n");
         pr_warning("**                                                      **\n");
         pr_warning("** If you see this message and you are not debugging    **\n");
         pr_warning("** the kernel, report this immediately to your vendor!  **\n");
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 09b685daee3d..6202b08f1933 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1804,8 +1804,8 @@ static void pool_mayday_timeout(unsigned long __pool)
         struct worker_pool *pool = (void *)__pool;
         struct work_struct *work;
 
-        spin_lock_irq(&wq_mayday_lock);         /* for wq->maydays */
-        spin_lock(&pool->lock);
+        spin_lock_irq(&pool->lock);
+        spin_lock(&wq_mayday_lock);             /* for wq->maydays */
 
         if (need_to_create_worker(pool)) {
                 /*
@@ -1818,8 +1818,8 @@ static void pool_mayday_timeout(unsigned long __pool)
                         send_mayday(work);
         }
 
-        spin_unlock(&pool->lock);
-        spin_unlock_irq(&wq_mayday_lock);
+        spin_unlock(&wq_mayday_lock);
+        spin_unlock_irq(&pool->lock);
 
         mod_timer(&pool->mayday_timer, jiffies + MAYDAY_INTERVAL);
 }
@@ -2248,12 +2248,30 @@ repeat:
                  * Slurp in all works issued via this workqueue and
                  * process'em.
                  */
-                WARN_ON_ONCE(!list_empty(&rescuer->scheduled));
+                WARN_ON_ONCE(!list_empty(scheduled));
                 list_for_each_entry_safe(work, n, &pool->worklist, entry)
                         if (get_work_pwq(work) == pwq)
                                 move_linked_works(work, scheduled, &n);
 
-                process_scheduled_works(rescuer);
+                if (!list_empty(scheduled)) {
+                        process_scheduled_works(rescuer);
+
+                        /*
+                         * The above execution of rescued work items could
+                         * have created more to rescue through
+                         * pwq_activate_first_delayed() or chained
+                         * queueing.  Let's put @pwq back on mayday list so
+                         * that such back-to-back work items, which may be
+                         * being used to relieve memory pressure, don't
+                         * incur MAYDAY_INTERVAL delay inbetween.
+                         */
+                        if (need_to_create_worker(pool)) {
+                                spin_lock(&wq_mayday_lock);
+                                get_pwq(pwq);
+                                list_move_tail(&pwq->mayday_node, &wq->maydays);
+                                spin_unlock(&wq_mayday_lock);
+                        }
+                }
 
                 /*
                  * Put the reference grabbed by send_mayday().  @pool won't
diff --git a/mm/gup.c b/mm/gup.c
index cd62c8c90d4a..0ca1df9075ab 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -3,7 +3,6 @@
 #include <linux/err.h>
 #include <linux/spinlock.h>
 
-#include <linux/hugetlb.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/rmap.h>
@@ -12,6 +11,7 @@
 
 #include <linux/sched.h>
 #include <linux/rwsem.h>
+#include <linux/hugetlb.h>
 #include <asm/pgtable.h>
 
 #include "internal.h"
@@ -875,6 +875,49 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
         return 1;
 }
 
+static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
+                        unsigned long end, int write,
+                        struct page **pages, int *nr)
+{
+        int refs;
+        struct page *head, *page, *tail;
+
+        if (write && !pgd_write(orig))
+                return 0;
+
+        refs = 0;
+        head = pgd_page(orig);
+        page = head + ((addr & ~PGDIR_MASK) >> PAGE_SHIFT);
+        tail = page;
+        do {
+                VM_BUG_ON_PAGE(compound_head(page) != head, page);
+                pages[*nr] = page;
+                (*nr)++;
+                page++;
+                refs++;
+        } while (addr += PAGE_SIZE, addr != end);
+
+        if (!page_cache_add_speculative(head, refs)) {
+                *nr -= refs;
+                return 0;
+        }
+
+        if (unlikely(pgd_val(orig) != pgd_val(*pgdp))) {
+                *nr -= refs;
+                while (refs--)
+                        put_page(head);
+                return 0;
+        }
+
+        while (refs--) {
+                if (PageTail(tail))
+                        get_huge_page_tail(tail);
+                tail++;
+        }
+
+        return 1;
+}
+
 static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
                 int write, struct page **pages, int *nr)
 {
@@ -902,6 +945,14 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
                                 pages, nr))
                                 return 0;
 
+                } else if (unlikely(is_hugepd(__hugepd(pmd_val(pmd))))) {
+                        /*
+                         * architecture have different format for hugetlbfs
+                         * pmd format and THP pmd format
+                         */
+                        if (!gup_huge_pd(__hugepd(pmd_val(pmd)), addr,
+                                         PMD_SHIFT, next, write, pages, nr))
+                                return 0;
                 } else if (!gup_pte_range(pmd, addr, next, write, pages, nr))
                                 return 0;
         } while (pmdp++, addr = next, addr != end);
@@ -909,22 +960,26 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
         return 1;
 }
 
-static int gup_pud_range(pgd_t *pgdp, unsigned long addr, unsigned long end,
-                int write, struct page **pages, int *nr)
+static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
+                         int write, struct page **pages, int *nr)
 {
         unsigned long next;
         pud_t *pudp;
 
-        pudp = pud_offset(pgdp, addr);
+        pudp = pud_offset(&pgd, addr);
         do {
                 pud_t pud = ACCESS_ONCE(*pudp);
 
                 next = pud_addr_end(addr, end);
                 if (pud_none(pud))
                         return 0;
-                if (pud_huge(pud)) {
+                if (unlikely(pud_huge(pud))) {
                         if (!gup_huge_pud(pud, pudp, addr, next, write,
-                                        pages, nr))
+                                          pages, nr))
+                                return 0;
+                } else if (unlikely(is_hugepd(__hugepd(pud_val(pud))))) {
+                        if (!gup_huge_pd(__hugepd(pud_val(pud)), addr,
+                                         PUD_SHIFT, next, write, pages, nr))
                                 return 0;
                 } else if (!gup_pmd_range(pud, addr, next, write, pages, nr))
                         return 0;
@@ -970,10 +1025,20 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
         local_irq_save(flags);
         pgdp = pgd_offset(mm, addr);
         do {
+                pgd_t pgd = ACCESS_ONCE(*pgdp);
+
                 next = pgd_addr_end(addr, end);
-                if (pgd_none(*pgdp))
+                if (pgd_none(pgd))
                         break;
-                else if (!gup_pud_range(pgdp, addr, next, write, pages, &nr))
+                if (unlikely(pgd_huge(pgd))) {
+                        if (!gup_huge_pgd(pgd, pgdp, addr, next, write,
+                                          pages, &nr))
+                                break;
+                } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) {
+                        if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr,
+                                         PGDIR_SHIFT, next, write, pages, &nr))
+                                break;
+                } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
                         break;
         } while (pgdp++, addr = next, addr != end);
         local_irq_restore(flags);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 5b2c6875fc38..46f96c23cc27 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -804,7 +804,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 return VM_FAULT_OOM;
         if (unlikely(khugepaged_enter(vma, vma->vm_flags)))
                 return VM_FAULT_OOM;
-        if (!(flags & FAULT_FLAG_WRITE) &&
+        if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm) &&
                         transparent_hugepage_use_zero_page()) {
                 spinlock_t *ptl;
                 pgtable_t pgtable;
@@ -1399,7 +1399,8 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                  * pgtable_trans_huge_withdraw after finishing pmdp related
                  * operations.
                  */
-                orig_pmd = pmdp_get_and_clear(tlb->mm, addr, pmd);
+                orig_pmd = pmdp_get_and_clear_full(tlb->mm, addr, pmd,
+                                                   tlb->fullmm);
                 tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
                 pgtable = pgtable_trans_huge_withdraw(tlb->mm, pmd);
                 if (is_huge_zero_pmd(orig_pmd)) {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 30cd96879152..919b86a2164d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -582,7 +582,7 @@ retry_cpuset:
 
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                                                 MAX_NR_ZONES - 1, nodemask) {
-                if (cpuset_zone_allowed_softwall(zone, htlb_alloc_mask(h))) {
+                if (cpuset_zone_allowed(zone, htlb_alloc_mask(h))) {
                         page = dequeue_huge_page_node(h, zone_to_nid(zone));
                         if (page) {
                                 if (avoid_reserve)
diff --git a/mm/memory.c b/mm/memory.c
index 0b3f6c71620d..4b5a282e1107 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2627,7 +2627,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 return VM_FAULT_SIGBUS;
 
         /* Use the zero-page for reads */
-        if (!(flags & FAULT_FLAG_WRITE)) {
+        if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) {
                 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
                                                 vma->vm_page_prot));
                 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 3b014d326151..864bba992735 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -233,7 +233,7 @@ static enum oom_constraint constrained_alloc(struct zonelist *zonelist,
         /* Check this allocation failure is caused by cpuset's wall function */
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                         high_zoneidx, nodemask)
-                if (!cpuset_zone_allowed_softwall(zone, gfp_mask))
+                if (!cpuset_zone_allowed(zone, gfp_mask))
                         cpuset_limited = true;
 
         if (cpuset_limited) {
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a7198c065999..df542feaac3b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1990,7 +1990,7 @@ zonelist_scan:
 
         /*
          * Scan zonelist, looking for a zone with enough free.
-         * See also __cpuset_node_allowed_softwall() comment in kernel/cpuset.c.
+         * See also __cpuset_node_allowed() comment in kernel/cpuset.c.
          */
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                                                 high_zoneidx, nodemask) {
@@ -2001,7 +2001,7 @@ zonelist_scan:
                                 continue;
                 if (cpusets_enabled() &&
                         (alloc_flags & ALLOC_CPUSET) &&
-                        !cpuset_zone_allowed_softwall(zone, gfp_mask))
+                        !cpuset_zone_allowed(zone, gfp_mask))
                                 continue;
                 /*
                  * Distribute pages in proportion to the individual
@@ -2529,7 +2529,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
                         alloc_flags |= ALLOC_HARDER;
                 /*
                  * Ignore cpuset mems for GFP_ATOMIC rather than fail, see the
-                 * comment for __cpuset_node_allowed_softwall().
+                 * comment for __cpuset_node_allowed().
                  */
                 alloc_flags &= ~ALLOC_CPUSET;
         } else if (unlikely(rt_task(current)) && !in_interrupt())
diff --git a/mm/percpu.c b/mm/percpu.c
index 014bab65e0ff..d39e2f4e335c 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1591,7 +1591,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
                         if (cpu == NR_CPUS)
                                 continue;
 
-                        PCPU_SETUP_BUG_ON(cpu > nr_cpu_ids);
+                        PCPU_SETUP_BUG_ON(cpu >= nr_cpu_ids);
                         PCPU_SETUP_BUG_ON(!cpu_possible(cpu));
                         PCPU_SETUP_BUG_ON(unit_map[cpu] != UINT_MAX);
 
diff --git a/mm/slab.c b/mm/slab.c
index 79e15f0a2a6e..fee275b5b6b7 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3015,7 +3015,7 @@ retry:
         for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
                 nid = zone_to_nid(zone);
 
-                if (cpuset_zone_allowed_hardwall(zone, flags) &&
+                if (cpuset_zone_allowed(zone, flags | __GFP_HARDWALL) &&
                         get_node(cache, nid) &&
                         get_node(cache, nid)->free_objects) {
                                 obj = ____cache_alloc_node(cache,
diff --git a/mm/slub.c b/mm/slub.c
index 386bbed76e94..765c5884d03d 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1665,7 +1665,8 @@ static void *get_any_partial(struct kmem_cache *s, gfp_t flags,
 
                         n = get_node(s, zone_to_nid(zone));
 
-                        if (n && cpuset_zone_allowed_hardwall(zone, flags) &&
+                        if (n && cpuset_zone_allowed(zone,
+                                                     flags | __GFP_HARDWALL) &&
                                         n->nr_partial > s->min_partial) {
                                 object = get_partial_node(s, n, c, flags);
                                 if (object) {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 4636d9e822c1..a384339bf718 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2405,7 +2405,8 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc)
                  * to global LRU.
                  */
                 if (global_reclaim(sc)) {
-                        if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
+                        if (!cpuset_zone_allowed(zone,
+                                                 GFP_KERNEL | __GFP_HARDWALL))
                                 continue;
 
                         lru_pages += zone_reclaimable_pages(zone);
@@ -3388,7 +3389,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
         if (!populated_zone(zone))
                 return;
 
-        if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
+        if (!cpuset_zone_allowed(zone, GFP_KERNEL | __GFP_HARDWALL))
                 return;
         pgdat = zone->zone_pgdat;
         if (pgdat->kswapd_max_order < order) {
diff --git a/mm/zbud.c b/mm/zbud.c
index ecf1dbef6983..ec71b37fb06c 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -619,5 +619,5 @@ module_init(init_zbud);
 module_exit(exit_zbud);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Seth Jennings <sjenning@linux.vnet.ibm.com>");
+MODULE_AUTHOR("Seth Jennings <sjennings@variantweb.net>");
 MODULE_DESCRIPTION("Buddy Allocator for Compressed Pages");
diff --git a/mm/zswap.c b/mm/zswap.c
index ea064c1a09ba..c1543061a192 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -951,5 +951,5 @@ error:
 late_initcall(init_zswap);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Seth Jennings <sjenning@linux.vnet.ibm.com>");
+MODULE_AUTHOR("Seth Jennings <sjennings@variantweb.net>");
 MODULE_DESCRIPTION("Compressed cache for swap pages");
diff --git a/scripts/kconfig/list.h b/scripts/kconfig/list.h
index 685d80e1bb0e..2cf23f002d3f 100644
--- a/scripts/kconfig/list.h
+++ b/scripts/kconfig/list.h
@@ -34,7 +34,7 @@ struct list_head {
  * list_entry - get the struct for this entry
  * @ptr:        the &struct list_head pointer.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_entry(ptr, type, member) \
         container_of(ptr, type, member)
@@ -43,7 +43,7 @@ struct list_head {
  * list_for_each_entry  -       iterate over list of given type
  * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry(pos, head, member)                          \
         for (pos = list_entry((head)->next, typeof(*pos), member);      \
@@ -55,7 +55,7 @@ struct list_head {
  * @pos:        the type * to use as a loop cursor.
  * @n:          another type * to use as temporary storage
  * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_for_each_entry_safe(pos, n, head, member)                  \
         for (pos = list_entry((head)->next, typeof(*pos), member),      \
diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 001facfa5b74..3d1984e59a30 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -404,7 +404,7 @@ do_file(char const *const fname)
                 }
                 if (w2(ghdr->e_machine) == EM_S390) {
                         reltype = R_390_64;
-                        mcount_adjust_64 = -8;
+                        mcount_adjust_64 = -14;
                 }
                 if (w2(ghdr->e_machine) == EM_MIPS) {
                         reltype = R_MIPS_64;
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index d4b665610d67..56ea99a12ab7 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -243,7 +243,7 @@ if ($arch eq "x86_64") {
 
 } elsif ($arch eq "s390" && $bits == 64) {
     $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$";
-    $mcount_adjust = -8;
+    $mcount_adjust = -14;
     $alignment = 8;
     $type = ".quad";
     $ld .= " -m elf64_s390";
diff --git a/tools/usb/ffs-aio-example/multibuff/device_app/aio_multibuff.c b/tools/usb/ffs-aio-example/multibuff/device_app/aio_multibuff.c
index af4b0508be77..aaca1f44e788 100644
--- a/tools/usb/ffs-aio-example/multibuff/device_app/aio_multibuff.c
+++ b/tools/usb/ffs-aio-example/multibuff/device_app/aio_multibuff.c
@@ -342,7 +342,7 @@ int main(int argc, char *argv[])
                                 iobuf[i].requested = ret;
                                 printf("submit: %d requests buf: %d\n", ret, i);
                         } else
-                                perror("unable to submit reqests");
+                                perror("unable to submit requests");
                 }
 
                 /* if event is ready to read */
diff --git a/tools/usb/usbip/libsrc/list.h b/tools/usb/usbip/libsrc/list.h
index 8d0c936e184f..5eaaa78e2c6a 100644
--- a/tools/usb/usbip/libsrc/list.h
+++ b/tools/usb/usbip/libsrc/list.h
@@ -98,7 +98,7 @@ static inline void list_del(struct list_head *entry)
  * list_entry - get the struct for this entry
  * @ptr:        the &struct list_head pointer.
  * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @member:     the name of the list_head within the struct.
  */
 #define list_entry(ptr, type, member) \
         container_of(ptr, type, member)